Nonparametric method for determination of anomalous event states in complex systems exhibiting non-stationarity

A device for determining dynamic thresholds comprising:

• an initializer device configured to:
• (a) collect a historical time-series data set for a metric in an IT infrastructure for at least one monitoring period, each monitoring period having a plurality of timeslots and each timeslot observing metric data at least once;
• (b) screen the historical time-series data set to remove abnormal metric data to form a non-abnormal historical data set;
• (c) collect each data point from the non-abnormal historical data set into a timeslot historical data set that corresponds with the timeslot from which each data point was collected historically;
• (d) simulate m monitoring periods by:
• (i) generating a simulated time-series data stream comprising randomly selected data points selected from the timeslot historical data set corresponding to the same timeslot in the simulated time-series data stream;
• (ii) calculating a cumulative sum value for each simulated randomly selected data point;
• and
• (iii) determining a maximum cusum value (max{Sn}m) for the simulated monitoring period, where n is an indicator of sequential position of each data point in the data stream
• to create a set }max{Sn}1, max{Sn}2, . . . , max{Sn}m};
• and
• (e) selecting as a threshold max{max{Sn}1, max{Sn}2, . . . , max{Sn}m};
• a cumulative sum analyzer configured to compare incoming data for each metric against the threshold by performing a cumulative sum analysis on a set of incoming metric data in real time by calculating a cumulative sum value for each metric and comparing the cumulative sum value to the threshold to detect anomalous events;
• and
• an alerting device configured to initiate an alert state when an anomalous event is detected that effects at least one response to address the conditions triggering the anomalous event in the affected component of the IT infrastructure;
• wherein each cumulative sum value is calculated by adding to the previous cumulative sum value the difference between the value of a metric and a value for normal behavior for a current timeslot within the monitoring period;
• and
• wherein if the calculation of the cumulative sum value is negative, it is set to zero.