Abstract: In a host device, a method for stabilizing a data training set comprises generating, by the host device, a data training set based upon a set of data elements received from a computer infrastructure; applying, by the host device, multiple iterations of a classification function to the data training set to generate a set of data element groups; dividing, by the host device, the set of data element groups resulting from the multiple iterations of the clustering function into multiple time intervals; for each time interval of the multiple time intervals, deriving, by the host device, a maximum threshold and a minimum threshold for each data element groups of the set of data element groups included in the time interval; applying an order statistic function to the maximum thresholds and the minimum thresholds for each time interval; and identifying a relative variability among the ordered maximum thresholds.

Abstract: Embodiments of the innovation relate to a host device having a memory and a processor, the host device configured to determine an anomaly associated with an attribute of a computer environment resource of the computer infrastructure. The host device is configured to correlate an object associated with the attribute of the detected anomaly with a related object of the computer infrastructure. The host device is configured to determine a root cause probability for each object of the correlated objects, the root cause probability identifying a probability of the correlated object functioning as a cause of the detected anomaly. The host device is configured to output an identification of a root object associated with the anomaly based upon the identified root cause probability.

Abstract: In a host device, a method for performing an anomaly analysis of a computer environment includes applying a learned behavior function to a data training set and to a set of data elements received from at least one computer environment resource to define at least one learned behavior boundary relative to at least one cluster of data elements of the data training set; applying a sensitivity function to the at least one cluster to define a sensitivity boundary relative to at least one learned behavior boundary, the sensitivity boundary related to a variance associated with the at least one cluster and to a mean value of the at least one cluster; and identifying a data element of the set of data elements as an anomalous data element when the data element of the set of data falls outside of the sensitivity boundary.