Generating an operational definition of baseline for monitoring network traffic data

Abstract

A system and a method are disclosed for establishing a baseline and the corresponding bands of data for alarming, etc. Historical raw data are aggregated and grouped. For example, the data may be and hourly grouped as 168 groups of data in a weekly frame. Clusters of the groups of data are then formed based on dynamic data window by analyzing statistical similarity among the 168 groups of data. Data in each cluster of groups, originated from the raw data at specific hour(s) of day on specific day(s) of week, are used as historical data to predict a baseline and the envelopes at these associated hour(s) and day(s). Generating a baseline includes determining a mapping function, which transforms data in a cluster to become normal or nearly normal. A mean and standard deviation of the transformed data are calculated. Envelopes are determined using the mean and the standard deviation. An inverse transformation function is uniquely derived. The mean and the envelopes are inversely transformed using the inverse function. This operationally decides a baseline and the corresponding bands for every weekly time frame hour.