System and method for transforming observed metrics into detected and scored anomalies

A non-transitory computer-readable medium storing processor-executable instructions, the instructions comprising:

• receiving values for a plurality of metrics;
• storing a graph as a data structure, wherein (i) nodes in the graph represent the plurality of metrics and (ii) edges in the graph represent relationships between pairs of the plurality of metrics;
• generating, for each metric, a baseline profile corresponding to the metric that indicates normal behavior of the metric based on the received values for the metric exclusive of values for any other metrics;
• identifying, for each metric, anomalies in present values of the metric in response to deviations of the present values outside the corresponding baseline profile for the metric;
• analyzing a plurality of prior identified anomalies;
• developing, based on the plurality of prior identified anomalies, a model of anomalies of each metric;
• determining, based on the anomaly models, scores for the identified anomalies in the present values for the plurality of metrics;
• sending an alert to a designated user in response to one of the scores exceeding a threshold;
• updating the baseline profiles as the values for the plurality of metrics are received;
• and
• updating the models of the anomalies on a schedule.

A method of monitoring a system that generates a plurality of metrics, the method comprising:

• receiving values for the plurality of metrics;
• storing a graph as a data structure, wherein (i) nodes in the graph represent the plurality of metrics and (ii) edges in the graph represent relationships between pairs of the plurality of metrics;
• generating, for each metric, a baseline profile corresponding to the metric that indicates normal behavior of the metric based on the received values for the metric exclusive of values for any other metrics;
• identifying, for each metric, anomalies in present values of the metric in response to deviations of the present values outside the corresponding baseline profile for the metric;
• analyzing a plurality of prior identified anomalies;
• developing, based on the plurality of prior identified anomalies, a model of anomalies of each metric;
• determining, based on the anomaly models, scores for the identified anomalies in the present values for the plurality of metrics;
• sending an alert to a designated user in response to one of the scores exceeding a threshold;
• updating the baseline profiles as the values for the plurality of metrics are received;
• and
• updating the models of the anomalies on a schedule.