Abstract: The disclosed embodiments provide a system that detects anomalous events in a virtual machine. During operation, the system obtains time-series garbage-collection (GC) data collected during execution of a virtual machine in a computer system. Next, the system generates one or more seasonal features from the time-series GC data. The system then uses a sequential-analysis technique to analyze the time-series GC data and the one or more seasonal features for an anomaly in the GC activity of the virtual machine. Finally, the system stores an indication of a potential out-of-memory (OOM) event for the virtual machine based at least in part on identifying the anomaly in the GC activity of the virtual machine.

Abstract: The disclosed embodiments provide a system that detects anomalous events. During operation, the system obtains machine-generated time-series performance data collected during execution of a software program in a computer system. Next, the system removes a subset of the machine-generated time-series performance data within an interval around one or more known anomalous events of the software program to generate filtered time-series performance data. The system uses the filtered time-series performance data to build a statistical model of normal behavior in the software program and obtains a number of unique patterns learned by the statistical model. When the number of unique patterns satisfies a complexity threshold, the system applies the statistical model to subsequent machine-generated time-series performance data from the software program to identify an anomaly in an activity of the software program and stores an indication of the anomaly for the software program upon identifying the anomaly.

Abstract: The disclosed embodiments provide a system that detects anomalous events in a virtual machine. During operation, the system obtains time-series garbage-collection (GC) data collected during execution of a virtual machine in a computer system. Next, the system generates one or more seasonal features from the time-series GC data. The system then uses a sequential-analysis technique to analyze the time-series GC data and the one or more seasonal features for an anomaly in the GC activity of the virtual machine. Finally, the system stores an indication of a potential out-of-memory (OOM) event for the virtual machine based at least in part on identifying the anomaly in the GC activity of the virtual machine.

Abstract: The disclosed embodiments provide a system that detects anomalous events. During operation, the system obtains machine-generated time-series performance data collected during execution of a software program in a computer system. Next, the system removes a subset of the machine-generated time-series performance data within an interval around one or more known anomalous events of the software program to generate filtered time-series performance data. The system uses the filtered time-series performance data to build a statistical model of normal behavior in the software program and obtains a number of unique patterns learned by the statistical model. When the number of unique patterns satisfies a complexity threshold, the system applies the statistical model to subsequent machine-generated time-series performance data from the software program to identify an anomaly in an activity of the software program and stores an indication of the anomaly for the software program upon identifying the anomaly.