| 摘要 |
A network analysis method for use in relation to a network having a plurality of entities, each with associated traffic, involves an analysis task comprising the steps of monitoring the network to collect data on entity traffic for a period of network operation, analyzing this data in respect of an entity operational characteristic by which the entities may be ordered into a ranking, forming an end set of at least one entity at one end of said ranking, and storing the identity of the or each entity making up that end set. The analysis task is carried out for a succession of N periods, where N is an integer greater than unity, to form an extended historical record of entities in the end sets for those N periods; the analysis task is then carried out for a further period and the entities in the resulting newly-created end set are compared with the entities in the extended historical record, to identify any entity (an 'unusually-behaved' entity) that is in the newly-created end set but not also in the historical record.
|
