| 摘要 |
<p>A system for identifying extreme behaviour in elements of a network comprises a profiler (14) and a collator (16). The profiler maintains one or more group profiles of network elements where each profile is associated with a plurality of network elements. The profiler accumulates values of a first function of the contents of an input data stream (12), containing a network element reference, over a first time period for each group profile. Accumulated values are compared with a corresponding collation threshold. The collator creates a collation instance for each group profile that reaches the threshold and each collation instance creates a plurality of collation profiles where each such profile is associated with a plurality of network elements. The collator instance accumulates values of a second function of the contents of the data stream for each collation profile over a second time period. Extreme behaviour is identified from the accumulated values of collation profiles.</p> |
