Patent Document ID: 9578046
Application ID: 14405684
Patent Flag: 1

Claim One:
1. A computer-implemented method comprising: generating a model related to network traffic, wherein the model comprises values and is indexed by a plurality of sets of keys and a plurality of time ranges, and each value comprises a sketch that approximates network traffic that is consistent with a key of the plurality of sets of keys and a time range of the plurality of time ranges, wherein each key within the sets of keys defines different criteria of multiple criteria to be compared to the network traffic; and wherein each set of keys define criteria that include a time interval and a time amount, the time amount representing a multiple of the time interval, each multiple defining a different resolution of a time scale used by that set of keys; displaying the model; detecting a first instance of network traffic that is consistent with criteria defined by at least one key included in a first set of keys of the plurality of sets of keys; identifying a first time value for the first instance of network traffic; identifying a first time range of the plurality of time ranges index in the model that is consistent with the first time value; calculating a first sketch from the first instance of network traffic; and updating the model with the first sketch at each location in the model indexed by each key of the at least one key and the first time range.