Multivariate path-based anomaly prediction

An apparatus comprising:

• a processor;
• a network interface;
• and
• a machine-readable medium having program code stored thereon, the program code executable by the processor to cause the apparatus to,
• based on a determination that a first dimensionally reduced representation of a first time-series multivariate dataset of a first set of metrics of a distributed application is not in one of a plurality of clusters that each corresponds with a behavior of the distributed application as represented by the first set of metrics, select a first set of dimensionally reduced representations of time-series multivariate datasets that preceded the first time-series multivariate dataset;
• determine whether the selected first set of dimensionally reduced representations and the first dimensionally reduced representation occur along a first path described by a first time-dependent multivariate function, wherein the first path overlaps with at least a first cluster of the plurality of clusters;
• and
• based on a determination that the selected first set of dimensionally reduced representations and the first dimensionally reduced representation occur along the first path with at least a confidence value that satisfies a confidence threshold, generate an event that predicts the first set of metrics of the distributed application will exhibit the behavior corresponding with the first cluster.

One or more non-transitory machine-readable media having program code for path-based anomaly detection for a distributed application, the program code comprising instructions to:

• based on a determination that a first dimensionally reduced representation of a first time-series multivariate dataset of a first set of metrics of a distributed application is not in one of a plurality of clusters that each corresponds with a behavior of the distributed application as represented by the first set of metrics, select a first set of dimensionally reduced representations of time-series multivariate datasets that preceded the first time-series multivariate dataset;
• determine whether the selected first set of dimensionally reduced representations and the first dimensionally reduced representation occur along a first path described by a first time-dependent multivariate function, wherein the first path overlaps with at least a first cluster of the plurality of clusters;
• and
• based on a determination that the selected first set of dimensionally reduced representations and the first dimensionally reduced representation occur along the first path with at least a confidence value that satisfies a confidence threshold, generate an event that predicts the first set of metrics of the distributed application will exhibit the behavior corresponding with the first cluster.