Abstract: Described is a system and method for receiving first data corresponding to usage of a network, receiving second data corresponding to usage of the network, comparing the first data to the second data and providing an indication of a network event when the second data varies from the second data greater than a predetermined threshold.

Abstract: A method and apparatus for providing network traffic composite graphs for packet networks are disclosed. The graph enables analysts to visually determine the relative size of an event in relation to other traffic activity. For example, a user or a network analyst creates categories of applications for the river-chart graph and optionally enters a weight factor for each of the application categories. The method then gathers records for flows, number of bytes (or packets), etc. from monitoring device(s) in a predetermined interval. The expected values are determined and composite volumes are calculated for each protocol and/or port. The method then updates the cumulative river-chart bands and the cumulative expected values for historical and predicted time periods in the river-chart graph.

Abstract: A method and apparatus for providing network traffic composite graphs for packet networks are disclosed. The graph enables analysts to visually determine the relative size of an event in relation to other traffic activity. For example, a user or a network analyst creates categories of applications for the river-chart graph and optionally enters a weight factor for each of the application categories. The method then gathers records for flows, number of bytes (or packets), etc. from monitoring device(s) in a predetermined interval. The expected values are determined and composite volumes are calculated for each protocol and/or port. The method then updates the cumulative river-chart bands and the cumulative expected values for historical and predicted time periods in the river-chart graph.