Abstract: A method includes generating a plurality of correlation information based on correlations between changes in each item in each of different pairs of items in a plurality of items per unit period of time in a time series, calculating a similarity between one piece of correlation information and another piece of correlation information, clustering the plurality of pieces of correlation information in identifying at least one normal state of a computer system, wherein the plurality of pieces of correlation information are clustered into one or more clusters, each representing a state of the computer system, based on the calculated similarities, and displaying the one or more clusters including an indication of an anomaly in the state of the computer system when a piece of correlation information is not clustered with at least one cluster identified as normal state of the computer system.

Abstract: A method includes generating a plurality of pieces of correlation information based on correlations between changes in each item in each of different pairs of items in a plurality of items per unit period of time in a time series, each item relating to at least one of an operation, a performance, or a load in a computer system, each of the plurality of pieces of correlation information being generated for the plurality of items in one unit period of time in the time series, clustering the plurality of pieces of correlation information into a plurality of clusters, each cluster representing a state of the computer system and including a subset of the plurality of pieces of correlation information meeting a threshold for similarity, generating transition probabilities between each pair of the plurality of clusters, and determining an anomaly in the computer system based on the transition probability.

Abstract: A method includes generating a plurality of correlation information based on correlations between changes in each item in each of different pairs of items in a plurality of items per unit period of time in a time series, calculating a similarity between one piece of correlation information and another piece of correlation information, clustering the plurality of pieces of correlation information in identifying at least one normal state of a computer system, wherein the plurality of pieces of correlation information are clustered into one or more clusters, each representing a state of the computer system, based on the calculated similarities, and displaying the one or more clusters including an indication of an anomaly in the state of the computer system when a piece of correlation information is not clustered with at least one cluster identified as normal state of the computer system.

Abstract: A method includes generating a plurality of pieces of correlation information based on correlations between changes in each item in each of different pairs of items in a plurality of items per unit period of time in a time series, each item relating to at least one of an operation, a performance, or a load in a computer system, each of the plurality of pieces of correlation information being generated for the plurality of items in one unit period of time in the time series, clustering the plurality of pieces of correlation information into a plurality of clusters, each cluster representing a state of the computer system and including a subset of the plurality of pieces of correlation information meeting a threshold for similarity, generating transition probabilities between each pair of the plurality of clusters, and determining an anomaly in the computer system based on the transition probability.