Abstract: A computer-implemented method, computer program product and computer system of characterizing a computerized system, where data can be written to or read from the system via write channels and read channels. Including accessing first data, pertaining to the write channels, and second data, pertaining to the read channels and may continually collect, aggregate, and access data. The first data and the second data are separately fed into a convolutional or recurrent neural network, which includes two input channels defining independent subsets of one or more layers and an output layer connected by each subsets of layers. Data ingestion is performed for the neural network to separately process the first data and the second data and produce one or more values in the output layer. A current state can be characterized based on the values produced. A potential anomaly is detected in the system, and action may be taken.

Abstract: A computer-implemented method for detecting an anomaly in a computer system. The method comprises accessing a first timeseries of measured values of a quantity related to the operation of the computer system, wherein the first timeseries spans a first time period. Timeseries forecasting is performed to infer a second timeseries of values for the quantity. The second timeseries spans a second time period up to a given time horizon. Aa third timeseries of measured values of the quantity is accessed, wherein the third timeseries spans the second time period up to the time horizon. The second timeseries inferred is subsequently compared with the third timeseries accessed to obtain a comparison outcome. An anomaly score is determined based on the comparison outcome obtained, to potentially detect an anomaly in the computer system. The invention is further directed to an anomaly detection unit and a computer program product.