Method and system for real-time, false positive resistant, load independent and self-learning anomaly detection of measured transaction execution parameters like response times

An anomaly detection system that monitors transactions in a distributed computing environment, comprising:

• a sensor instrumented in a monitored application residing on a host computer and executed by a processor of the host computer, the sensor generates one or more transaction events and sends the transaction events across a network to a monitoring computer;
• a transaction classifier residing on the monitoring computer, the transaction classifier is configured receive a transaction event resulting from a transaction executing in the distributed computing environment and, in response to receiving the transaction event, classifying the transaction into a given classification using data extracted from a request that initiated the transaction and evaluating a failure condition for the transaction using data contained in the transaction event;
• a measure extractor residing on the monitoring computer, the measure extractor is configured to track a number of transaction executed in a present period of time and a number of failed transaction occurring in the present period of time for the given classification;
• and
• an anomaly detector residing on the monitoring computer and configured to periodically compute a current statistical distribution model for failure rate of transactions in the given classification, where the current statistical distribution model for failure rate is computed using the number of transactions executed in the present period of time for the given classification and the number of failed transactions occurring in the present period of time for the given classification;
• wherein the anomaly detector further operates to retrieve a baseline statistical distribution model for failure rate of transactions in the given classification during a preceding period of time and detects an anomaly of the failure rate for the given classification by comparing the current statistical distribution model to the baseline statistical distribution model, where the preceding period of time precedes the present period of time and the transaction classifier, the measure extractor and the anomaly detector are executed by a processor of the monitoring computer.