Apparatus and Method for Defining Baseline Network Behavior and Producing Analytics and Alerts Therefrom

A machine has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to collect from network connected devices key performance indicators characterizing network traffic information. The key performance indicators are aggregated into a time segment for a current weekday. Key performance indicators for the time segment for the current weekday are compared to corresponding key performance indicators for time segments from previous weekdays. The corresponding key performance indicators for time segments from previous weekdays establish a network behavior baseline. An alert is produced when the key performance indicators for the time segments for the current weekday exceed a deviation threshold from the network behavior baseline.