METHODS, SYSTEMS, AND COMPUTER PROGRAM PRODUCTS FOR NETWORK SERVER PERFORMANCE ANOMALY DETECTION

Methods, systems, and computer readable media for network server performance anomaly detection are disclosed. According to one aspect of the subject matter disclosed, a method is disclosed for real-time computation of an endpoint performance measure based on transport and network layer header information. The method includes passively collecting transport and network layer header information from packet traffic in a network. Connections in the network are modeled using an abstract syntax for characterizing a sequence of application-level bidirectional interactions between endpoints of each connection and delays between the interactions. Application-level characteristics of the packet traffic are determined based on the modeled connections. A performance measure of at least one endpoint is computed based on the application-level characteristics and the modeled connections.