Efficient single user metric usage for high precision service incident detection

A system comprising:

• a processing system;
• and
• memory storing instructions that, when executed, cause the system to:
• detect an anomaly in a time-series of a single user metric corresponding to activity of a service by using unsupervised learning on the single user metric, wherein the time-series dataset comprises measurements representing durations of dependency calls from the service to a resource that the service depends on, wherein the anomaly is associated with an anomaly score indicating that a duration of a dependency call from the service to the resource exceeds a first threshold, and wherein the single user metric comprises at least one of:
• a dependency type dimension including a low cardinality value for logical grouping of dependencies;
• or
• a dependency success dimension indicating whether one or more dependency calls were successful;
• identify features of the anomaly score at multiple different resolution levels, wherein the features are indicative of a service incident by applying supervised learning to the anomaly score;
• classify the anomaly corresponding to the anomaly score as the service incident based on the features;
• generate an indication of the service incident;
• and
• provide the indication of the service incident to a resolution entity for mitigation or resolution of the serviced incident.

A computer-readable storage device storing instructions that, when executed by a computer, cause the computer to:

• receive a plurality of time-series datasets of a single user metric corresponding to durations of dependency calls from a service to a plurality of resources that the service depends on, and wherein the single user metric comprises at least one of:
• a dependency type dimension including a low cardinality value for logical grouping of dependencies;
• or
• a dependency success dimension indicating whether one or more dependency calls were successful;
• detect anomalies in the plurality of time-series datasets by applying unsupervised learning to the plurality of time-series datasets, wherein the anomalies are associated with anomaly scores indicating that a duration of a dependency call from the service to the resource exceeds a threshold value;
• aggregate the anomalies as aggregated anomalies per time unit;
• when a number of the aggregated anomalies is above a threshold, tag the aggregated anomalies as anomalous;
• identify features of the anomaly scores at multiple different resolution levels by applying supervised learning to the anomaly scores, wherein the features are indicative of a service incident;
• classify the aggregated anomalies as the service incident based on the features;
• determine whether the service incident is low-severity or high-severity based on at least one of:
• a duration of the service incident;
• or
• an impact of the service incident on users;
• and
• transmit an indication of the service incident to a resolution entity for mitigation or resolution of the serviced incident, wherein the indication of the service incident is provided to a first resolution entity if the service incident is determined to be low-severity and the service incident is provided to a second resolution entity if the service incident is determined to be high-severity.