a fixed memory size for each cht structure the second configuration section 33 defines a mapping table which ties observation rule tags as used in rules 28 from fig3 to data row names as defined in the cht definition 32 any particular rule tag may have zero or more mapping entries each entry the mapping table can also contain an associated scaling factor which can be used by a configuration designer to multiply the effect of an observation rule in application to certain cht rows this allows a particular cht row to potentially receive separately scaled input from multiple rule tag mapping entries the third configuration section 34 in this embodiment of the present invention defines tests and threshold limits that are to be applied to the data contained in cht structures in order to determine the presence of abnormal network behavior by a client each test will be applied to a single cht row zero or more tests can be applied for any particular cht row name the test descriptions in configuration section 34 are intended to illustrate for the sake of example the basic types of mathematical or algorithmic tests that can be applied to historical observations tracked on a per client basis by this embodiment of the system as would be obvious to any practitioner of the art there are numerous possible ways to represent define declare or specify these operations further it should be anticipated that more sophisticated mathematical operations than shown in the figures such as correlation and predictive extrapolation will be useful in the accurate detection of aberrant network behavior fig5 is a representation of several embodiments of data structures that can be used in first section 32 of configuration 26 see fig4 the system can maintain.