Block-based anomaly detection in computing environments

A method for identifying anomalies, the method comprising:

• receiving log data from one or more nodes in a cloud computing environment, wherein the log data comprises a sequence of log codes generated by the one or more nodes;
• identifying code blocks within the sequence of log codes,
• wherein identifying the code blocks within the sequence of log codes comprises:
• identifying potential code blocks within the sequence of log codes;
• and
• selecting the code blocks from the potential code blocks based at least on a scoring function applied to one or more of the potential code blocks,
• wherein the scoring function promotes dominant sub-sequences of log codes within the sequence of log codes relative to non-dominant sub-sequences of log codes;
• separating the code blocks into at least normal blocks and anomaly blocks;
• generating anomaly vectors based at least on the anomaly blocks;
• and
• distributing anomaly data to the one or more nodes to detect the anomalies, wherein the anomaly data includes the anomaly vectors.

A computing apparatus comprising:

• one or more computer-readable storage media;
• one or more processors operatively coupled with the one or more computer-readable storage media;
• and
• program instructions stored on the one or more computer-readable storage media that, when executed by the one or more processors, direct the computing apparatus to at least:
• receive log data from a plurality of nodes in a computing environment, wherein the log data comprises a sequence of information indicative of log messages produced by the plurality of nodes;
• identify, in the sequence of information, dominant patterns representative of non-anomalous blocks of the log messages,
• wherein to identify the dominant patterns within the sequence of information, the program instructions, when executed by the one or more processors, direct the computing apparatus to at least:
• identify potential patterns within the sequence of information;
• and
• select the dominant patterns from the potential patterns based at least on a scoring function applied to one or more of the potential patterns,
• wherein the scoring function promotes a subset of the potential patterns that occur frequently within the sequence of information relative to a different subset of the potential patterns that occur less frequently within the sequence of information;
• extract the non-anomalous blocks from the log data based on the dominant patterns to reveal anomalous blocks that do not fit the dominant patterns;
• generate anomaly vectors based at least on the anomalous blocks;
• and
• distribute anomaly data to at least one of the plurality of nodes to detect the anomalies, wherein the anomaly data includes the anomaly vectors.