Abstract: A method for generating samples for an anomaly detection system includes receiving events that occurred during a time series of a target metric. Each respective event includes an event attribute characterizing the respective event. The method includes generating a set of event groups for the events. Each event shares a respective attribute with one or more other events of the respective event group. For each respective event group of the set of event groups, the method includes determining an influence pattern that identifies an influence of the respective event group on the target metric. The method includes clustering the set of event groups into event clusters based on a respective influence pattern of each respective event group. Each event cluster includes one or more event groups that share a similar influence pattern. The method includes generating training samples for an anomaly detection system based on a respective event cluster.

Abstract: A system includes a metric data store configured to receive and store a time-series of values of a first metric, a seasonal trend identification module configured to determine a periodicity profile for the first metric, and a modeling module configured to generate an autoregressive moving average (ARMA) model. The modeling module includes a seasonal model module configured to generate a first model of the time-series of values, a non-seasonal model module configured to generate a second model of the time-series of values, and a combination module configured to generate a third model based on the first and second models. The modeling module is configured to, in response to determining that a first periodicity profile describes the time-series of values, output the third model as the ARMA model. The system includes an envelope determination module configured to determine a normal behavior of the first metric based on the ARMA model.

Abstract: A system includes a metric data store configured to receive and store a time-series of values of a first metric, a seasonal trend identification module configured to determine a periodicity profile for the first metric, and a modeling module configured to generate an autoregressive moving average (ARMA) model. The modeling module includes a seasonal model module configured to generate a first model of the time-series of values, a non-seasonal model module configured to generate a second model of the time-series of values, and a combination module configured to generate a third model based on the first and second models. The modeling module is configured to, in response to determining that a first periodicity profile describes the time-series of values, output the third model as the ARMA model. The system includes an envelope determination module configured to determine a normal behavior of the first metric based on the ARMA model.

Abstract: A processing system receives a time series of values of a first metric corresponding to computing system performance. A computation module calculates an autocorrelation function (ACF) based on the time series of values across a set of values of tau. The spacing between each consecutive pair of values in the set of values of tau increases as tau increases. A local maxima extraction module identifies local maxima of the calculated ACF. A period determination module determines a significant period based on spacing between the local maxima and selectively outputs the significant period as a periodicity profile. A baseline profile indicating normal behavior of the first metric is generated based on the periodicity profile. An anomaly identification module selectively identifies an anomaly in present values of the first metric in response to the present values deviating outside the baseline profile.

Abstract: A processing system receives a time series of values of a first metric corresponding to computing system performance. A computation module calculates an autocorrelation function (ACF) based on the time series of values across a set of values of tau. The spacing between each consecutive pair of values in the set of values of tau increases as tau increases. A local maxima extraction module identifies local maxima of the calculated ACF. A period determination module determines a significant period based on spacing between the local maxima and selectively outputs the significant period as a periodicity profile. A baseline profile indicating normal behavior of the first metric is generated based on the periodicity profile. An anomaly identification module selectively identifies an anomaly in present values of the first metric in response to the present values deviating outside the baseline profile.