low. We use the classic variance of the average of the squared deviations from the mean to accomodate proportional change.

    Analysis based on the variance of performance measurements day over day across short historical periods can be applied to a single network or client as between ISPs. We would anticipate that if an administrative ceiling were imposed on throughput speed, particularly at a limit below the potential capacity of the network, the variation would near zero, as the tests would cap out at the maximum available bandwidth. We would also expect that trend line of such an incident to follow a peak and valley model, where a sudden decrease or increase leads to a spike in variance when the limit is imposed or lifted, with low variance during the throttling. Figure \[fig:nov11:thuvar\], demonstrates that in practice this hypothesis holds mixed results. While peaks do occur, the variance, particularly the relative variance, remains high.

As these mechanisms serve as a warning system to direct further investigation, rather than being a sole determinant of interest, we are less concerned about its robustness. Additionally, for the purposes of identifications and coding of events, we generally call attention to extremely abnormal values, relative to 