Anomaly detection based on cluster transitions

A system comprising:

• a processing system configured to:
• receive first performance data of a plurality of components in a system, the first performance data representing performance characteristics of the plurality of components in a first time period;
• perform a first cluster analysis of the first performance data, the first cluster analysis comprising:
• identifying clusters of the plurality of components with similar performance characteristics in the first time period;
• receive second performance data of the plurality of components, the second performance data representing performance characteristics of the plurality of components in a second time period;
• perform a second cluster analysis of the second performance data, the second cluster analysis comprising:
• identifying clusters of the plurality of components with similar performance characteristics in the second time period;
• determine whether a component of the plurality of components transitioned from a first cluster to a second cluster, the first cluster being different from the second cluster, and the determining comprising:
• determining that the component transitioned from the first cluster to the second cluster if the component was identified as being in the first cluster in the first cluster analysis and was identified as being in the second cluster in the second cluster analysis;
• and
• determining that the component did not transition from the first cluster to the second cluster if the component was identified as being in the first cluster in the first cluster analysis and was identified as being in the first cluster in the second cluster analysis;
• and
• in response to determining that the component transitioned from the first cluster to the second cluster, determine that an anomalous event has occurred.

A computer program product comprising:

• a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising:
• computer readable program code configured to receive first performance data of a plurality of components in a system, the first performance data representing performance characteristics of the plurality of components in a first time period;
• computer readable program code configured to perform a first cluster analysis of the first performance data, the first cluster analysis comprising:
• identifying clusters of the plurality of components with similar performance characteristics in the first time period;
• computer readable program code configured to receive second performance data of the plurality of components, the second performance data representing performance characteristics of the plurality of components in a second time period;
• computer readable program code configured to perform a second cluster analysis of the second performance data, the first cluster analysis comprising:
• identifying clusters of the plurality of components with similar performance characteristics in the second time period;
• computer readable program code configured to determine whether a component of the plurality of components transitioned from a first cluster to a second cluster, the first cluster being different from the second cluster, and the determining comprising:
• determining that the component transitioned from the first cluster to the second cluster if the component was identified as being in the first cluster in the first cluster analysis and was identified as being in the second cluster in the second cluster analysis;
• and
• determining that the component did not transition from the first cluster to the second cluster if the component was identified as being in the first cluster in the first cluster analysis and was identified as being in the first cluster in the second cluster analysis;
• and
• computer readable program code configured to, in response to determining that the component transitioned from the first cluster to the second cluster, determine that an anomalous event has occurred.