Patent ID: 8271838

Claim:
A computer-implemented method for detecting security intrusions and soft faults in a software system, the method implemented by the computer comprising the steps of: receiving a performance signature sampled by a software system monitoring infrastructure; associating a plurality of buckets with each component of the performance signature; comparing a component of the sampled performance signature to an expected value for the performance signature component, wherein a bucket for the performance signature component is incremented if the sampled performance signature component exceeds the corresponding expected value, and the bucket for the performance signature component is decremented if the sampled performance signature component is less than the corresponding expected value; increasing a number of standard deviations from a mean value for the performance signature component if the bucket for the performance signature component overflows; reinitializing the current bucket to zero, if the bucket for the performance signature component is emptied; and executing a soft-fault or security categorization routine when said bucket for said performance signature component exceeds a threshold.