Abstract: Various exemplary embodiments relate to a method of detecting anomalies in network traffic. The method includes: receiving a plurality of accounting reports from an application assurance device, the accounting reports indicating a metric of network performance; aggregating the metric from a plurality of accounting reports to determine a plurality of aggregated metrics corresponding to a plurality of intervals; storing the aggregated metrics in a database in association with the corresponding plurality of intervals; determining a rolling baseline for a current time period based on metrics of intervals corresponding to a primary partition and a sub-partition; comparing a metric for a current time period to the rolling baseline; and determining that an anomaly is occurring if the metric for the current time period differs from the rolling baseline by more than a pre-defined threshold.

Abstract: A network monitoring architecture for multiple computer network systems is disclosed. In particular, the network monitoring architecture includes an agent system installed within each computer network and a remote central management unit in communication with the agent system of each computer network. The agent systems collect data from key network devices that reside on the corresponding computer network, and send the collected data to the remote central management unit as a message through the Internet. The data from the computer networks are processed at the remote central management unit to determine imminent or actual failure of the monitored network devices. The appropriate technicians can be immediately notified by the central management unit through automatically generated messages.