Method and system for evaluating peer groups for comparative anomaly

A method, comprising:

• determining a candidate group including a plurality of component metrics, each component metric corresponding to an associated cloud component and expected to have measurements within a range associated with the candidate group;
• determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior over a period of time, wherein a clustering algorithm is used to generate the cluster profile from historical metrics information of the candidate group, the cluster profile indicating a number of persistent clusters associated with the candidate group, the number of persistent clusters being determined to be less than a preconfigured threshold;
• collecting first performance information for a component metric of the plurality of component metrics;
• detecting anomalous activity based at least in part on the first performance information deviating from second performance information for the peer group;
• and
• providing a notification of the anomalous activity.

A non-transitory computer-readable device storing instructions thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:

• determining a candidate group including a plurality of component metrics, each component metric corresponding to an associated cloud component and expected to have measurements within a range associated with the candidate group;
• determining that the plurality of component metrics are a peer group based at least in part on a cluster profile of the candidate group and the candidate group exhibiting peer-like behavior of a period of time, wherein a clustering algorithm is used to generate the cluster profile from historical metrics information of the candidate group, the cluster profile indicating a number of persistent clusters associated with the candidate group, the number of persistent clusters being determined to be less than a preconfigured threshold;
• collecting first performance information for a first component metric of the plurality of component metrics;
• detecting anomalous activity based at least in part on the first performance information deviating from second performance information for the peer group;
• and
• providing a notification of the anomalous activity.