Metric-based anomaly detection system with evolving mechanism in large-scale cloud

A non-transitory computer-readable storage medium comprising a computer-readable program executed on a processor in a data processing system for detecting anomalies in dynamic datasets generated in a cloud computing environment, wherein the computer-readable program when executed on the processor causes a computer to perform the steps of:

• monitoring a plurality of cloud servers receiving a plurality of data points;
• employing a two-level clustering training module to generate micro-clusters from the plurality of data points, each of the micro-clusters representing a set of original data from the plurality of data points;
• employing a detecting module to detect normal data points, abnormal data points, and unknown data points from the plurality of data points via a detection model;
• employing an evolving module using a different evolving mechanism for each of the normal, abnormal, and unknown data points to evolve the detection model;
• and
• generating a system report displayed on a user interface, the system report summarizing the micro-cluster information.

A system for detecting anomalies in dynamic datasets generated in a cloud computing environment, the system comprising:

• a plurality of cloud servers transmitting a plurality of data points;
• a two-level clustering training component generates micro-clusters from the plurality of data points, each of the micro-clusters representing a set of original data from the plurality of data points;
• a detector detects normal data points, abnormal data points, and unknown data points from the plurality of data points via a detection model;
• an evolving component uses a different evolving mechanism for each of the normal, abnormal, and unknown data points to evolve the detection model;
• and
• a system report generated to be displayed on a user interface, the system report summarizing the micro-cluster information.