Anomaly Detection and Classification Using Telemetry Data

A system comprising:

• one or more processors;
• memory storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• receiving telemetry data originating from a plurality of client devices;
• selecting a class of data from the telemetry data;
• converting the class of data to a set of metrics;
• aggregating the set of metrics according to a component of interest to obtain values of aggregated metrics over time for the component of interest;
• determining a prediction error by comparing the values of the aggregated metrics to a prediction, the prediction being based at least in part on historical telemetry data pertaining to the class of data and the component of interest;
• detecting an anomaly based at least in part on the prediction error;
• and
• initiating an automatic recovery action with respect to the component of interest.

One or more computer-readable storage media storing instructions that, when executed by one or more processors, perform operations comprising:

• receiving telemetry data originating from a plurality of client devices;
• selecting a class of data from the telemetry data;
• converting the class of data to a set of metrics;
• aggregating the set of metrics according to a component of interest to obtain values of aggregated metrics over time for the component of interest;
• determining a prediction error by comparing the values of the aggregated metrics to a prediction, the prediction being based at least in part on historical telemetry data pertaining to the class of data and the component of interest;
• detecting an anomaly based at least in part on the prediction error;
• and
• transmitting an alert message of the anomaly.