Detecting anomalous behavior in a cloud computing environment

A method for determining whether to provide data to a computer-executable model that is trained to identify anomalies in data corresponding to an entity that is executing in a cloud computing environment, the method comprising:

• obtaining time-series data for a feature of the entity, where the feature comprises multiple processes that are executable by the entity, and further where the time-series data comprises:
• values assigned to time periods within a time window, where a value in the values is representative of a number of processes in the processes that were executed by the entity a first time within the time window;
• computing a likelihood that a next value in the time-series data for a next time period following the time window is able to be correctly predicted, where the likelihood is computed based upon the values assigned to the time periods;
• providing the data corresponding to the entity to the computer-executable model based upon the likelihood, where the computer-executable model generates an output based upon the data, and further where an alert is transmitted to a computing device associated with the entity based upon the output of the computer-executable model.

A computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to perform acts comprising:

• obtaining time-series data for a computer-executable entity that is being executed in a cloud computing environment, where the time-series data comprises:
• values assigned to time periods over a window of time, where a value assigned to a time period in the time periods is indicative of a number of processes that were executed with respect to a feature of the entity during the time period that were not executed in any previous time period in the window of time;
• computing a metric value for the entity based upon the time-series data, where the metric value is indicative of applicability of a computer-executable model with respect to data corresponding to the entity in a most recent period of time in the periods of time, and further where the computer-executable model is trained to identify anomalies in the data corresponding to the entity;
• and
• based upon the metric value, providing the data corresponding to the entity to the computer-executable model, where the computer-executable model generates an output that indicates whether the data includes an anomaly based upon the data corresponding to the entity.