US 2019/0294933 A1 · MULTIVARIATE CLUSTERING-BASED ANOMALY DETECTION

Abstract

A multivariate clustering-based anomaly detector can generate an event for consumption by an APM manager that indicates detection of an anomaly based on multivariate clustering analysis after topology-based feature selection. The anomaly detector accumulates time-series data across a series of time instants to form a multivariate time-series data slice or multivariate data slice. The anomaly detector then performs multivariate clustering analysis with the multivariate data slice. The anomaly detector determines whether a multivariate data slice is within a cluster of multivariate data slices. If the multivariate data slice is within the cluster and the cluster is a known anomaly cluster, then the anomaly detector generates an anomaly detection event indicating detection of the known anomaly. The anomaly detector can also determine that a multivariate data slice is within an unknown cluster and generate an event indicating detection of an unknown anomaly.

Claims20

Dependent claims

A method comprising:

determining a first slice of time-series multivariate data collected over a plurality of time instants,
wherein the time-series multivariate data comprises measurements of a set of application related metrics selected from a plurality of application related metrics based on topology of a distributed application,
wherein the plurality of time instants comprises a number of time instants defined for indicating a behavior;
generating a first dimensionally reduced representation of the first slice;
determining whether the first dimensionally reduced representation of the first slice should be assigned to one of a plurality of clusters, wherein a first cluster of the plurality of clusters corresponds to canonical behavior of the distributed application and a second cluster corresponds to a first named anomaly;
and
based on a determination that the first dimensionally reduced representation of the first slice should be assigned to the second cluster,
assigning the first dimensionally reduced representation of the first slice to the second cluster, and
generating an anomaly event indicating the first named anomaly.

6 more elements

One or more non-transitory machine-readable media having program code for cluster-based anomaly detection for a distributed application, the program code comprising instructions to:

for each set of metrics of a plurality of sets of metrics that have been selected as corresponding to behaviors of the distributed application,
based on a first discrete time dataset for the set of metrics being aggregated with a plurality of preceding discrete time datasets for the set of metrics into a first time-series dataset for the set of metrics, generate a dimensionally reduced representation of the first time-series dataset;
analyze the dimensionally reduced representation of the first time-series dataset against a first plurality of clusters that corresponds to the set of metrics;
and
based on a determination that the dimensionally reduced representation of the first time-series dataset should be associated with one of the first plurality of clusters that corresponds to anomalous behavior of the distributed application as represented by the set of metrics,
associate the dimensionally reduced representation of the first time-series dataset to the anomalous behavior cluster of the first plurality of clusters, and
generate an anomaly event indicating a label assigned to the anomalous behavior cluster of the first plurality of clusters.

4 more elements

An apparatus comprising:

a processor;
a network interface;
and
a machine-readable medium having program code stored thereon, the program code executable by the processor to cause the apparatus to,
determine a first slice of time-series multivariate data collected over a plurality of time instants,
wherein the time-series multivariate data comprises measurements of a set of application related metrics selected from a plurality of application related metrics based on topology of a distributed application,
wherein the plurality of time instants comprises a number of time instants defined for indicating a behavior;
generate a first dimensionally reduced representation of the first slice;
determine whether the first dimensionally reduced representation of the first slice should be assigned to one of a plurality of clusters, wherein a first cluster of the plurality of clusters corresponds to canonical behavior of the distributed application and a second cluster corresponds to a first named anomaly;
and
based on a determination that the first dimensionally reduced representation of the first slice should be assigned to the second cluster,
assign the first dimensionally reduced representation of the first slice to the second cluster, and
generate an anomaly event indicating the first named anomaly.

10 more elements

Dependencies are inferred from the claim text.

Multivariate clustering-based anomaly detection

Life of this patent

Multivariate clustering-based anomaly detection

Life of this patent

Abstract

Claims20