| CPC H04L 43/0864 (2013.01) [H04L 43/028 (2013.01); H04L 43/0888 (2013.01); H04L 43/16 (2013.01)] | 20 Claims |

|
1. A method of network traffic analysis, the method comprising:
receiving network performance metrics data for each network flow in a plurality of network flows;
receiving application host resource information for an application indicative of a subset of network flows in the plurality of network flows belonging to the application;
aggregating the network performance metrics data for the subset of network flows to obtain network performance metrics data for the application; and
providing an output indicating an anomalous event for the application based on the obtained network performance metrics data for the application.
|