| CPC H04L 49/555 (2013.01) [H04L 49/3009 (2013.01); H04L 49/557 (2013.01)] | 20 Claims |

|
1. A method comprising:
based on a change in connections between network devices, determining a number of changes to one or more elements of historical data store data over a time window, the historical data store data comprising times of data store events and types of data store events, the data store events comprising types of changes occurring in a data store table that result from changes in network information, wherein the types of changes comprises one or more of: a row deletion in the data store table responsive to an inactive connection between network devices and a row insertion responsive to an available connection between network devices;
computing current information associated with the change in connections between network devices based on the number of changes to the one or more elements;
performing a statistical analysis comprising comparing the current information to prior information associated with the connections between network devices;
detecting an anomaly within the current information based on the statistical analysis;
sending an alert indicating detection of the anomaly; and
providing to a user interface, an identification of a network event that caused the anomaly.
|