Network performance metrics anomaly detection

An network anomaly detection system for detecting performance anomalies comprising:

• a measurement system configured to collect a plurality of performance measures on a monitored object in a network, to create a new time series;
• a processor;
• and
• a non-volatile memory storing instructions that, when executed by the processor, configure the anomaly detection system to:
• maintain an abnormal cluster center, and a normal cluster center with most members from a binary clustering of historical time series for said performance measure for said monitored object;
• extract a motif using a discrete window on the new time series;
• classify said motif based on a distance between said motif and said abnormal cluster center and said normal cluster center;
• and
• determine said anomaly for said performance measure for said monitored object occurred based on said distance and a predetermined decision boundary.