Patent Document ID: 20050138463
Application ID: 10965670
Patent Status: 0

Claim One:
1. A method of identifying extreme behavior in elements of a network, comprising: maintaining one or more group profiles of network elements, each group profile being associated with a plurality of network elements; accumulating values of a first function of the contents of an input data stream over a first period of time for each group profile, the contents of the data stream including at least one field containing a network element reference; comparing the accumulated values of each group profile with a corresponding collation threshold; creating a collation instance for each group profile that reaches the collation threshold, each collation instance creating a plurality of collation profiles, each collation profile being associated with one or more network elements from the plurality of network elements corresponding to the group profile that caused the creation of the collation instance; accumulating values of a second function of the contents of the input data stream for each collation profile over a second period of time; and identifying extreme behavior of network elements from the accumulated values of the collation profiles.