Abstract: A method for analysing performance of a network by managing network data relating to operation of the network is disclosed. The method comprises receiving a plurality of network data records from at least one network data source, processing the received plurality of network data records into a plurality of network data documents, each network data document corresponding to a received network data record, assembling the plurality of network data documents into document groups, generating statistical data for terms appearing in the document groups, and for at least one term, performing anomaly detection upon the statistical data for the term in the document groups, and detecting an anomaly in the term. The method further comprises performing at least one of identifying the term as an anomalous term, identifying the document group containing the anomaly as an anomalous group, and/or identifying a document containing the anomalous term as an anomalous document.

Abstract: A method of real-time processing of network events, wherein an event comprises a plurality of attributes. The method comprises maintaining counters, including counters indicating numbers of occurrences and co-occurrences of instances of specific attributes of received network events, maintaining a record of instances of specific attributes of recent events, receiving a first event, increasing respective counters based on the instances of attributes of the first event. The method further comprises calculating relation measure scores between a first instance of the first attribute of the first event and instances of the first attribute of events recently received. The relation measure score depends on a number of co-occurrences in which the first instance of the first attribute and a second instance of the first attribute were received within the measurement window, the total number of occurrences of the first instance and the total number of occurrences of the second instance.

Abstract: A method of real-time processing of network events, wherein an event comprises a plurality of attributes. The method comprises maintaining counters, including counters indicating numbers of occurrences and co-occurrences of instances of specific attributes of received network events, maintaining a record of instances of specific attributes of recent events, receiving a first event, increasing respective counters based on the instances of attributes of the first event. The method further comprises calculating relation measure scores between a first instance of the first attribute of the first event and instances of the first attribute of events recently received. The relation measure score depends on a number of co-occurrences in which the first instance of the first attribute and a second instance of the first attribute were received within the measurement window, the total number of occurrences of the first instance and the total number of occurrences of the second instance.

Abstract: A method for analysing performance of a network by managing network data relating to operation of the network is disclosed. The method comprises receiving a plurality of network data records from at least one network data source (102), processing the received network data records into a plurality of network data documents, each document corresponding to a received network data record (104) and assembling the network data documents into document groups (108). The method further comprises generating statistical data for terms appearing in the document groups (110) and for at least one term, performing anomaly detection upon the term statistical data for the document groups (114) and, if an anomaly is detected, performing at least one of identifying the term as an anomalous term (120), identifying the document group containing the anomaly as an anomalous group (122), and/or identifying a document containing the anomalous term as an anomalous document (124).