Systems and methods for multivariate anomaly detection in software monitoring

A method comprising:

• training an anomaly detection model to learn a plurality of anomaly regions within a multidimensional space including two or more dimensions of a computing application;
• storing a mapping between each respective anomaly region of the plurality of anomaly regions and a respective anomaly classifier from a set of anomaly classifiers;
• evaluating a set of metrics for the computing application using the trained anomaly detection model to detect an anomaly in the computing application;
• assigning, based at least in part on the mapping, a particular anomaly classifier to the anomaly from the set of anomaly classifiers;
• performing a responsive action to address the at least one anomaly based at least in part on the particular anomaly classifier.

One or more non-transitory computer-readable media storing instructions, which when executed by one or more hardware processors, cause:

• automatically assigning labels to a first set of data points representing varying values for at least one metric in a computing application, wherein the automatically assigned labels indicate which data points in the first set of data points are anomalous and which data points in the first set of data points are unanomalous;
• training a first anomaly detection model based at least in part on the automatically assigned labels;
• receiving input that assigns at least one user-set label to one or more data points;
• responsive to receiving the input, propagating the at least one user-set label to at least one other data point in the first set of data points such that at least one automatically assigned label assigned to the at least one other data point is modified;
• performing at least one of retraining the first anomaly detection model or training a second anomaly detection model based at least in part on the user set label assigned to the one or more data points and propagated to the at least one other data point;
• evaluating a second set of data points for the at least one metric in the computing application using at least one of the first anomaly detection model or the second anomaly detection model to identify anomalous behavior exhibited by the computing application.