Framework for anomaly detection in a cloud environment

A computing device comprising:

• a processor;
• and
• a memory including instructions that, when executed with the processor, cause the computing device to, at least:
• generate a resource group including a plurality of resources of a monitored environment based on a grouping property, wherein values of the grouping property associated with the plurality of resources satisfy a first condition;
• select a first invariance identifying property from a set of invariance identifying properties;
• determine whether values of the first invariance identifying property associated with the plurality of resources satisfy a second condition;
• responsive to a successful determination, incorporate a first invariant in a baseline, wherein the first invariant is defined by the grouping property and the first invariance identifying property;
• and
• use the baseline for performing anomaly detection of the monitored environment.

A non-transitory computer readable medium storing specific computer-executable instructions that, when executed by a processor, cause a computer system to perform operations comprising:

• identifying a set of resources in an environment to be monitored;
• generating one or more resource groups, each resource group including a plurality of resources and being generated based on a grouping property, wherein values of the grouping property associated with the plurality of resources included in the resource group satisfy a first condition;
• identifying, for each of the one or more resource groups, an invariance identifying property;
• determining, for each of the one or more resource groups, whether values of the invariance identifying property associated with the plurality of resources included in the resource group satisfy a second condition;
• responsive to a successful determination, incorporating an invariant in a baseline, wherein the invariant is defined by the grouping property and the invariance identifying property;
• and
• using the baseline for performing anomaly detection of the environment to be monitored.