Anomaly detection of asynchronous transactions

A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by a processor to cause the processor to perform operations comprising:

• receiving trace data by an input at a receiving interface of an anomaly detection system, wherein the trace data is queued in a start node queue and an end node queue;
• issuing a provision instruction via an interface of the anomaly detection system, the provision instruction received by a data store interface, the provision instruction executing to provision a data store comprising the start node queue and the end node queue;
• executing a modifying instruction to modify a start trace in the start node queue and an end trace in the end node queue to result in a grouped trace for an interval, the grouped trace grouped by a relationship between the start trace and the end trace;
• and
• executing a quota metric instruction to determine a quota metric for the interval from the grouped trace based on an uncompleted transaction count wherein the quota metric determines whether an anomaly exists in the trace data, the anomaly comprising a change in the trace data.

A computer system comprising a processor and one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by the processor to cause the processor to perform operations comprising:

• receiving trace data by an input at a receiving interface of an anomaly detection system, wherein the trace data is queued in a start node queue and an end node queue;
• issuing a provision instruction via an interface of the anomaly detection system, the provision instruction received by a data store interface, the provision instruction executing to provision a data store comprising the start node queue and the end node queue;
• executing a modifying instruction to modify a start trace in the start node queue and an end trace in the end node queue to result in a grouped trace for an interval, the grouped trace grouped by a relationship between the start trace and the end trace;
• and
• executing a quota metric instruction to determine a quota metric for the interval from the grouped trace based on an uncompleted transaction count wherein the quota metric determines whether an anomaly exists in the trace data, the anomaly comprising a change in the trace data.