Abstract: Network traffic flow records received from a network probe are recorded in multiple sets of buckets of different granularity, optimized for the purpose of almost instant analysis and display as well as for longer term report generation. The flow data is pre-processed and stored redundantly in parallel in multiple bucketized data base tables of different time window sizes. Denormalized tables keyed on different combinations of traffic flow attributes are precomputed and stored in parallel tables redundantly to facilitate a near real time display of summarized network traffic data, and a capability to rapidly generate reports for different monitoring periods.

Abstract: Network traffic flow records received from a network probe are filtered and short traffic flows are selected so that the total number of short traffic flows is high but the number of bytes in the short traffic flows is negligible, followed by discarding of the short traffic flows. Traffic flow data is recorded in multiple sets of buckets of different granularity, optimized for the purpose of almost instant analysis and display as well as for longer term report generation. The traffic flow data is pre-processed and stored redundantly in parallel in multiple bucketized data base tables of different time window sizes. A corresponding method and system are provided.

Abstract: Network traffic flow records received from a network probe are recorded in multiple sets of buckets of different granularity, optimized for the purpose of almost instant analysis and display as well as for longer term report generation. The flow data is pre-processed and stored redundantly in parallel in multiple bucketized data base tables of different time window sizes. Denormalized tables keyed on different combinations of traffic flow attributes are precomputed and stored in parallel tables redundantly to facilitate a near real time display of summarized network traffic data, and a capability to rapidly generate reports for different monitoring periods.

Abstract: Network traffic flow records received from a network probe are filtered and short traffic flows are selected so that the total number of short traffic flows is high but the number of bytes in the short traffic flows is negligible, followed by discarding of the short traffic flows. Traffic flow data is recorded in multiple sets of buckets of different granularity, optimized for the purpose of almost instant analysis and display as well as for longer term report generation. The traffic flow data is pre-processed and stored redundantly in parallel in multiple bucketized data base tables of different time window sizes. A corresponding method and system are provided.