Patent ID: 7962607

Claim:
A method executed on a computer including at least one processor for establishing a baseline of network traffic data, the method comprising: generating a configurable static window for grouping said network traffic data; extracting, grouping and ordering said network traffic data based on the configurable static window; generating a dynamic window for clustering said groups of network traffic data based on statistical similarity of groups; clustering said groups of network traffic data based on the dynamic window; determining a transformation function from historical network traffic data using feedback control, the transformation function making a data set having a normal distribution or a nearly normal distribution; generating transformed network traffic data associated with a distribution having the normal distribution or having the nearly normal distribution by applying the transformation function to said network traffic data within a cluster to map the network traffic data within the cluster into the data set having the normal distribution or having a nearly normal distribution; calculating an error indicating a similarity between the distribution associated with the transformed network traffic data and the normal distribution, and responsive to the error equaling or exceeding a threshold, modifying the transformation function to modify the distribution associated with the transformed network traffic data to reduce the error; and generating a baseline of network traffic data for each cluster from the transformed network traffic data.