Method and system for real-time, false positive resistant, load independent and self-learning anomaly detection of measured transaction execution parameters like response times

A computer-implemented method for detecting anomalies in a performance metric associated with monitored transactions of a distributed computing environment, comprising:

• receiving, by a transaction monitor, a plurality of transaction events resulting from transactions executed in the distributed computing environment, where the transaction events include a measurement value for at least one performance metric and the measurement value was acquired during execution of transactions in a present period of time;
• grouping, by the transaction monitor, transaction events in the plurality of transaction events into a group of transaction events, where the transaction events in the group of transaction event are from transaction that perform similar tasks;
• and
• extracting, by the transaction monitor, measurement values for a given performance metric from the transaction events in the group of transaction events to form the group of measurement values
• calculating, by the transaction monitor, a current distribution parameter from the measurement values in the group of measurement values, where the current distribution parameter is indicative of statistical distribution of the measurement values for the given performance metric during the present period of time;
• retrieving, by the transaction monitor, a baseline distribution parameter for the performance metric, where the baseline distribution parameter is indicative of statistical distribution of measurement value for the performance metric during a preceding period of time, where the preceding period of time precedes the present period of time;
• and
• detecting, by the transaction monitor, an anomaly in the performance metric by comparing the current distribution parameter to the baseline distribution parameter, where the transaction monitor is executed by a processor of a computing device.

A computer-implemented method for detecting anomalies in transactions executing in a distributed computing environment, comprising:

• receiving, by a transaction monitor, a transaction event resulting from a transaction executing in the distributed computing environment;
• classifying, by the transaction monitor, the transaction into a given classification using data extracted from a request that initiated the transaction;
• evaluating, by the transaction monitor, a failure condition for the transaction using data contained in the transaction event;
• for the given classification, tracking, by the transaction monitor, a number of transactions executed in a present period of time and a number of failed transaction occurring in the present period of time;
• periodically computing, by transaction monitor, a current statistical distribution model for failure rate of transactions in the given classification, where the current statistical distribution model for failure rate is computed using the number of transactions executed in the present period of time for the given classification and the number of failed transactions occurring in the present period of time for the given classification;
• retrieving, by the transaction monitor, a baseline statistical distribution model for failure rate of transactions in the given classification during a preceding period of time, where the preceding period of time precedes the present period of time;
• and
• detecting, by the transaction monitor, an anomaly by comparing the current statistical distribution model to the baseline statistical distribution model, where the transaction monitor is executed by a processor of a computing device.

An anomaly detection system that monitors transaction in a distributed computing environment, comprising:

• a sensor instrumented in a monitored application residing on a host computer and executed by a processor of the host computer, the sensor generates one or more transaction events and sends the transaction events across a network to a monitoring computer;
• a transaction classifier residing on the monitoring computer, the transaction classifier is configured to receive a plurality of transaction events resulting from transactions executed in the distributed computing environment and, in response to receiving the plurality of transaction events, group a portion of the plurality of transaction events into a group of transaction events, where the transaction events in the group of transaction event are from transactions that perform similar tasks;
• a measure extractor residing on the monitoring computer, the measure extractor is configured to receive the group of transaction events and extract measurement values for a given performance metric from the transaction events in the group of transaction events to form the group of measurement values, where a transaction event includes a measurement value for the given performance metric and the measurement value was acquired during execution of a transaction in a present period of time;
• and
• an anomaly detector residing on the monitoring computer and configured to receive the group of measurement values, the anomaly detector calculates a current distribution parameter from the group of measurement values and detects an anomaly in the given performance metric by comparing the current distribution parameter to a baseline distribution parameter, where the current distribution parameter is indicative of statistical distribution of the measurement values for the given performance metric during the present period of time and the baseline distribution parameter is indicative of statistical distribution of measurement values for the given performance metric during a preceding period of time, where the preceding period of time precedes the present period of time and the transaction classifier, the measure extractor and the anomaly detector are executed by a processor of the monitoring computer.