Abstract: A system and method that automatically detects anomalies in a cloud service system on an ongoing basis and which can be used to trigger live migration of cloud services includes a cloud server system configured to provide a plurality of virtualized cloud services through processes running over a set of virtual machines hosted on the cloud server system, and a processor which receives data related to the operations of the virtual machines and determines whether any of the virtual machines are exhibiting anomalous behavior. The processor applies a Kalman Filter to make predictions on the future state and covariance of the virtual machines and then calculates the log likelihood of the predicted values. If the predicted values deemed to be very unlikely, then the processor signals that an anomaly has occurred.