A method of monitoring a network is provided that includes receiving a stream of samples having respective network delay values; defining at least one first group of samples having a size defined by a window size; determining respective first network delay characteristics for the first groups based on the network delay values corresponding to the respective samples included in the corresponding group; applying a first test to the first network delay characteristic determined for the respective first groups; adjusting the window size based on a result of the first test associated with the respective first groups; using the adjusted window size, define respective second groups of samples having samples of the stream of samples subsequent to the samples included in the at least one first group; determining a second network delay characteristic for the respective second groups; applying a second test to the second network delay characteristics; and determining whether to generate an alert notification based on a result of at least one of the first and second tests.