Abstract: A system includes a normal behavior characterization module configured to receive values for a first metric of a plurality of metrics and generate a baseline profile indicating normal behavior of the first metric based on the received values. The system also includes an anomaly identification module configured to identify an anomaly in response to present values of the metric deviating outside the baseline profile. The system also includes an anomaly behavior characterization module configured to analyze a plurality of prior anomalies identified by the anomaly identification module and develop a model of the anomalies of the first metric. The system also includes an anomaly scoring module configured to determine a first score for a present anomaly detected by the anomaly identification module for the first metric. The first score is based on characteristics of the present anomaly and the model of the anomalies of the first metric.

Abstract: A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.

Abstract: A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.

Abstract: A system includes a normal behavior characterization module configured to receive values for a first metric of a plurality of metrics and generate a baseline profile indicating normal behavior of the first metric based on the received values. The system also includes an anomaly identification module configured to identify an anomaly in response to present values of the metric deviating outside the baseline profile. The system also includes an anomaly behavior characterization module configured to analyze a plurality of prior anomalies identified by the anomaly identification module and develop a model of the anomalies of the first metric. The system also includes an anomaly scoring module configured to determine a first score for a present anomaly detected by the anomaly identification module for the first metric. The first score is based on characteristics of the present anomaly and the model of the anomalies of the first metric.

Abstract: A system includes a normal behavior characterization module configured to receive values for a first metric of a plurality of metrics and generate a baseline profile indicating normal behavior of the first metric based on the received values. The system also includes an anomaly identification module configured to identify an anomaly in response to present values of the metric deviating outside the baseline profile. The system also includes an anomaly behavior characterization module configured to analyze a plurality of prior anomalies identified by the anomaly identification module and develop a model of the anomalies of the first metric. The system also includes an anomaly scoring module configured to determine a first score for a present anomaly detected by the anomaly identification module for the first metric. The first score is based on characteristics of the present anomaly and the model of the anomalies of the first metric.

Abstract: A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.

Abstract: A system includes a normal behavior characterization module configured to receive values for a first metric of a plurality of metrics and generate a baseline profile indicating normal behavior of the first metric based on the received values. The system also includes an anomaly identification module configured to identify an anomaly in response to present values of the metric deviating outside the baseline profile. The system also includes an anomaly behavior characterization module configured to analyze a plurality of prior anomalies identified by the anomaly identification module and develop a model of the anomalies of the first metric. The system also includes an anomaly scoring module configured to determine a first score for a present anomaly detected by the anomaly identification module for the first metric. The first score is based on characteristics of the present anomaly and the model of the anomalies of the first metric.