Abstract: A system and a method are disclosed for establishing a baseline and the corresponding bands of data for alarming, etc. Historical raw data are aggregated and grouped. For example, the data may be and hourly grouped as 168 groups of data in a weekly frame. Clusters of the groups of data are then formed based on dynamic data window by analyzing statistical similarity among the 168 groups of data. Data in each cluster of groups, originated from the raw data at specific hour(s) of day on specific day(s) of week, are used as historical data to predict a baseline and the envelopes at these associated hour(s) and day(s). Generating a baseline includes determining a mapping function, which transforms data in a cluster to become normal or nearly normal. A mean and standard deviation of the transformed data are calculated. Envelopes are determined using the mean and the standard deviation. An inverse transformation function is uniquely derived.

Abstract: Critical servers are identified in a network, based upon network flow records collected from the network for a predetermined period. A plurality of rules are applied to application-server pairs based upon the collected network flow records to identify, among the application-server pairs, candidate application-server pairs that satisfy at least one of the plurality of rules during the predetermined period in excess of a predetermined number of times, in which case the application-server pair is identified as a candidate application-server pair. A global application-server list including application-server pairs identified across all of the sources is determined. A critical server list including servers corresponding to the global application-server list is generated. Various network mappings comprised of the servers in the critical server list are created, and network measures corresponding to the mappings are displayed.