Multi-dimensional system anomaly detection

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive a first plurality of measurements for network metrics captured during a first time period;
• determine a first set of correlations between the network metrics using the first plurality of measurements captured during the first time period;
• receive a second plurality of measurements for the network metrics captured during a second time period;
• determine a second set of correlations between the network metrics using the second plurality of measurements captured during the second time period;
• and
• identify a difference between the first and second sets of correlations between the network metrics as a network anomaly.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• receiving a first plurality of measurements for network metrics captured during a first time period;
• determining a first set of correlations between the network metrics using the first plurality of measurements captured during the first time period;
• receiving a second plurality of measurements for the network metrics captured during a second time period;
• determining a second set of correlations between the network metrics using the second plurality of measurements captured during the second time period;
• and
• identifying a difference between the first and second sets of correlations between the network metrics as a network anomaly.