Integration based anomaly detection service

A computer-implemented method comprising:

• under control of computing hardware configured to execute specific computer-executable instructions,
• determining a current change in an operating metric of a computing system based at least partly on current input data, wherein the current input data reflects a value of the operating metric at a current time, and wherein the operating metric relates to performance of the computing system;
• determining an expected change in the operating metric based at least partly on prior input data, wherein the prior input data reflects a value of the operating metric at a prior time;
• determining, based at least partly on the prior input data, a particular time at which the expected change in the operating metric is expected to occur;
• determining that the current time corresponds to the particular time;
• determining, based at least partly on the value of the operating metric at the prior time, a permitted relationship to the expected change;
• determining that the current change does not satisfy the permitted relationship to the expected change;
• and
• generating an anomaly notification.

Non-transitory computer-readable storage having stored thereon an executable module configured to cause computing hardware to execute a process comprising:

• determining a current change in an operating metric of a computing system based at least partly on current input data, wherein the current input data reflects a value of the operating metric at a current time, and wherein the operating metric relates to performance of the computing system;
• determining an expected change in the operating metric based at least partly on prior input data, wherein the prior input data reflects a value of the operating metric at a prior time;
• determining, based at least partly on the prior input data, a particular time at which the expected change in the operating metric is expected to occur;
• determining that the current time corresponds to the particular time;
• determining a permitted relationship to the expected change;
• determining that the current change does not satisfy the permitted relationship to the expected change;
• and
• generating an anomaly notification.