Abstract: A determination is made that anomaly analysis is to be performed with respect to an application. An anomaly score of the application is generated with respect to observed values of a plurality of metrics of the application. Generation of the anomaly score comprises computing an anomaly score contribution associated with an analysis of a correlation between values of a pair of metrics of the application. In response to a detection that the anomaly score exceeds a threshold, an anomaly response operation is initiated.

Abstract: Techniques for detecting regressions with respect to the accuracy of an anomaly detection compute service in detecting anomalies in users' time series data. The techniques include providing an instrumented time series instrumented with a set of one or more anomalies to the anomaly detection service. The anomaly detection service detects a set of one or more anomalies in the instrumented time series. The precision and recall of the detected anomalies with respect to the instrumented anomalies is computed. From the computed precision and recall, an anomaly detection accuracy is computed as an F-score or F-measure. It is then determined whether a regression in anomaly detection accuracy has occurred by comparing the computed accuracy score to a threshold. If a regression has occurred, an alert can be generated or a recent change to the anomaly detection service can be rolled back.

Abstract: Techniques for anomaly and causality detection are described. An example includes receiving time series data; performing anomaly detection on the received time series data to detect at least one anomaly using an anomaly detection model; detecting a causal relationship between measures, wherein a set of measures are related when a first of the set of measures has a causal influence on a second of the set of measures, wherein a single time series is a metric and a measure is a numerical or categorical quantity a metric describes; and outputting a result of the anomaly and causality relationship detections.

Abstract: Techniques for performing anomaly detection are described. An exemplary method includes receiving a request to detect potential anomalies using an anomaly detection system having at least one anomaly scoring model; processing the received data using the anomaly detection system to score the data to determine when the data is potentially anomalous based on one or more thresholds; requesting feedback of at least one determined potential anomaly; receiving feedback on the least one determined potential anomaly; and adjusting at least one of one or more of thresholds used to determine potential anomalies and what is considered an anomaly without adjusting the at least one anomaly scoring model.

Abstract: Methods, systems, and computer-readable media for automatically detecting root causes of anomalies occurring in information technology (IT) systems are disclosed. In some embodiments, data of a service graph depicting dependencies between nodes or services of the IT infrastructure is traversed to determine propagation patterns of anomaly symptoms/alarms through the IT infrastructure. Also, a causal inference model is used to determine probabilities that an observed propagation pattern corresponds to a stored propagation pattern, wherein a close correspondence indicates that the current anomaly is likely caused by a similar root cause as a past anomaly that caused the stored propagation pattern.