Nonparametric method for determination of anomalous event states in complex systems exhibiting non-stationarity

A non-transitory computer medium containing computer instructions stored therein for causing a computer processor to perform a method for determining the end point of an anomalous event in an information technology (IT) infrastructure comprising:

• on a computer, measuring and collecting data for a metric in the IT infrastructure;
• obtaining a cusum value for the metric over a series of time periods;
• obtaining a linear regression of cusum values for a set of v time periods, wherein if the slope of linear regression is positive, increasing v by w (v=v+w), where w is an integer, and obtaining a new linear regression for the new set of v time periods and repeating until the regression slope is negative;
• designating a time period in the set of v historical cusum values in which the regression slope is negative as the end point of the anomalous event;
• and
• when the anomalous event is detected using the cusum values, initiating an alert state that effects at least one response to address at least one condition triggering the anomalous event in an affected component of the IT infrastructure, the designated end point of the anomalous event being used for reset to avoid subsequent false alert states,
• wherein regressions over v cusum values begins at the first cusum statistic to exceed the threshold and progresses for each cusum statistic thereafter until a negative or flat slope is calculated.

A method for determining the start point of an anomalous event in an information technology (IT) infrastructure comprising:

• on a computer, measuring and collecting data for a metric in the IT infrastructure;
• obtaining a cusum value for the metric over a series of time periods;
• determining an end point for the anomalous event;
• obtaining a linear regression for a set of v time periods corresponding with the end point of the anomalous event and the v−1 time periods prior to the time period corresponding with the end point;
• if the slope of linear regression is positive, decreasing v by w (v=v−w), where w is an integer, and obtaining a linear regression for the new time interval and repeating until the regression slope is negative;
• when the regression slope is negative, assigning one of the time periods in the v time periods to be the starting point of the anomalous event;
• and
• when the anomalous event is detected using the cusum value, initiating an alert state that effects at least one response to address at least one condition triggering the anomalous event in an affected component of the IT infrastructure, the assigned start point of the anomalous event being used to determine a threshold to detect a subsequent anomalous event.

A non-transitory computer medium containing computer instructions stored therein for causing a computer processor to perform a method for determining the start point of an anomalous event in an information technology (IT) infrastructure comprising:

• on a computer, measuring and collecting data for a metric in the IT infrastructure;
• obtaining a cusum value for the metric over a series of time periods;
• determining an end point for the anomalous event;
• obtaining a linear regression for a set of v time periods corresponding with the end point of the anomalous event and the v−1 time periods prior to the time period corresponding with the end point;
• if the slope of linear regression is positive, decreasing v by w (v=v−w), where w is an integer, and obtaining a linear regression for the new time interval and repeating until the regression slope is negative;
• when the regression slope is negative, assigning one of the time periods in the v time periods to be the starting point of the anomalous event;
• and
• when the anomalous event is detected using the cusum value, initiating an alert state that effects at least one response to address at least one condition triggering the anomalous event in an affected component of the IT infrastructure, the assigned start point of the anomalous event being used to determine a threshold to detect a subsequent anomalous event.