Method for keeping and searching network history for corrective and preventive measures

摘要

A method is provided for identifying an event of network activity associated with a network where the network includes a plurality of interfaces and the method includes providing a first data structure comprising a node, partitioning the plurality of interfaces into a plurality of groups, associating the plurality of groups with the node, providing a vector corresponding to a group of the plurality of groups for representing a summary of the network activity, and identifying an event of network activity according to the vector. Experimental results are shown to demonstrate the effectiveness and robustness of the invention.