Methodology for statistical analysis of enterprise network data is becoming increasingly important in cyber-security. The
volume and velocity of enterprise network data sources puts a premium on streaming analytics that pass over the data once, while
handling temporal variation in the process. In this paper we introduce ReTiNA: a framework for streaming network anomaly detection.
This procedure first detects anomalies in the correlation processes on individual edges of the network graph. Second, anomalies
across multiple edges are combined and scored to give network-wide situational awareness. The approach is tested in simulation and
demonstrated on two real Netflow datasets.