Abstract: Methods, systems, and computer readable media for network server performance anomaly detection are disclosed. According to one aspect of the subject matter disclosed, a method is disclosed for real-time computation of an endpoint performance measure based on transport and network layer header information. The method includes passively collecting transport and network layer header information from packet traffic in a network. Connections in the network are modeled using an abstract syntax for characterizing a sequence of application-level bidirectional interactions between endpoints of each connection and delays between the interactions. Application-level characteristics of the packet traffic are determined based on the modeled connections. A performance measure of at least one endpoint is computed based on the application-level characteristics and the modeled connections.

Abstract: Methods, systems, and computer readable media for network server performance anomaly detection are disclosed. According to one aspect of the subject matter disclosed, a method is disclosed for real-time computation of an endpoint performance measure based on transport and network layer header information. The method includes passively collecting transport and network layer header information from packet traffic in a network. Connections in the network are modeled using an abstract syntax for characterizing a sequence of application-level bidirectional interactions between endpoints of each connection and delays between the interactions. Application-level characteristics of the packet traffic are determined based on the modeled connections. A performance measure of at least one endpoint is computed based on the application-level characteristics and the modeled connections.

Abstract: Methods, systems, and computer program products are disclosed for determining application-level traffic characteristics in a network based on transport and network layer header information. Transport and network layer header information is collected from packet traffic in a network. Packets are classified to different connections based on the transport and network layer header information. Each connection is modeled using an abstract syntax for characterizing bidirectional interactions between endpoints of each connection and delays between the interactions. Application-level characteristics of the packet traffic are determined based on the modeled connections. Simulated traffic that models application-level traffic behavior in a real network may also be generated by simulating traffic connections based on the modeled connections.