Patent ID: 8472328

Claim:
A non-transitory computer readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for determining the impact of an anomalous event on a network entity, the method comprising: detecting an anomalous event based on an outlier at a first network entity; determining a time T 1 when the outlier occurred at the first network entity; determining a first difference in a network traffic metric between time T 1 and time T 2 , wherein time T 2 is prior to time T 1 , and wherein the first difference is based on overall observed network traffic in a network; determining a second difference in the network traffic metric between time T 1 and time T 2 , wherein the second difference is based on observed network traffic at a second network entity for time T 1 and time T 2 , wherein the second network entity is different from the first network entity; and determining an impact score for the second network entity based on the first difference and the second difference.