Summary of Alert Analysis Results
Connie Logg
Sun Jul 6 06:31:05 PDT 2008

A modified and simplified version of the "plateau" algorithm for detecting network change has been implemented and is run on all the bandwidth measurement data. This is a summary of the results of that analysis.

The analysis is applied to the data taken over the past 10 days. Only the latest 5 alerts are listed in the table. If the alert date is magenta, then this is a new alert (just recentlydetected) and an alert email message is also generated.

The values in the table respresent the date and time the change was detected, the percentage of bandwidth change, the mean of the history buffer, and the mean of the trigger buffer. The percentage of the bandwidth change is a link to the analysis of that data

In brief the algorithm implemented works as follows:

• The data is examined to determine how large the history buffer and the trigger buffers should be. Their lengths are set to the number of points that make up 5 days and 6 hours respectively.
• The history buffer is primed with the oldest data and the mean (hmean) and standard deviation (hstd) are calculated.
• A loop over the remaining data is started.
  • Each value is examined, and if it is less than hmean-2*hstd, it is loaded into the trigger buffer. If not, it is loaded into the history buffer and the hist mean and histstd are recalculated.
  • If there are values in the trigger buffer, and a point is encountered which is not less than histmean-2*histstd, then the oldest value is removed from the trigger buffer and placed in the history buffer.
  • When the trigger buffer fills up, its mean (tmean) and standard deviation (tstd) are calculated and if the tmean is less than 33% lower than the hmean, an the data is discarded.
  • The tmean and tstd are defined temporarily to be the hmean and hstd, and the processing of the data continues. Thus only drops of 33% or more are alerted.