Method, device and computer program product for anomaly detection and root cause analysis

A method performed by at least one processor, and comprising:

• for each feature among a plurality of features of a communications network, wherein the communications network comprises a plurality of nodes, and each node among the plurality of nodes has one or more executed virtual machines (VMs), performing an anomaly detection process comprising:
• determining an anomaly threshold of the feature, based on a plurality of historical data points of the feature,
• determining whether a current data point of the feature is anomalous or not, based on the anomaly threshold,
• in response to a determination that the current data point is anomalous,
• identifying the feature as an anomalous feature,
• including the anomalous feature and the current data point in an anomaly detection report,
• identifying, among the plurality of nodes, a node corresponding to the feature,
• identifying, among the one or more executed VMs of the identified node, at least one worst VM having a lowest value of the feature in a time period corresponding to the current data point, and
• including, in the anomaly detection report,
• the at least one worst VM, and
• the corresponding lowest value of the feature.

A method performed by at least one processor, and comprising:

• for each feature among a plurality of features of a communications network, performing an anomaly detection process comprising:
• selecting, from a plurality of historical data points of the feature, a set of historical data points,
• calculating, using a machine learning module, a set of scores, wherein each score in the set of scores is in one-to-one correspondence with one historical data point in the set of historical data points,
• determining an anomaly threshold based on the set of scores,
• comparing the anomaly threshold with a score corresponding to a current data point of the feature to determine whether the current data point is anomalous or not, and
• in response to a determination that the current data point is anomalous,
• identifying the feature as an anomalous feature, and
• including the anomalous feature and the current data point in an anomaly detection report,
• wherein said determining the anomaly threshold based on the set of scores comprises:
• comparing a maximum score in the set of scores with a predetermined value,
• in response to the maximum score lower than the predetermined value, determining the predetermined value as the anomaly threshold, and
• in response to the maximum score not lower than the predetermined value, calculating the anomaly threshold based on the maximum score.