Anomaly detection in performance management

Patent metadata

Field	Value
Publication number	US-10956252-B2
Application number	US-201816197498-A
Country	US
Kind code	B2
Filing date	Nov 21, 2018
Priority date	Jul 20, 2016
Publication date	Mar 23, 2021
Grant date	Mar 23, 2021

Abstract

Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local anomalies are determined in the clustered KPIs by comparing, for each individual KPI in clusters that conform to a Gaussian distribution, a distance from a respective cluster mean to a threshold. Structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A management action is performed based on the classified structural and local anomalies.

First claim

What is claimed is:

1. A method for detecting anomalous behavior, comprising:
performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes;
clustering the KPIs in a space defined by the set of principal axes;
determining local anomalies in the clustered KPIs by comparing, for each individual KPI in clusters that conform to a Gaussian distribution, a distance from a respective cluster mean to a threshold;
determining structural anomalies in the clustered KPIs;
classifying the structural and local anomalies based on historical information; and
performing a management action based on the classified structural and local anomalies.

2. The method of claim 1 , wherein determining structural anomalies comprises determining how closely each cluster of KPIs conforms to a Gaussian distribution.

3. The method of claim 1 , wherein classifying structural anomalies comprises determining whether a cluster that does not conform to a Gaussian distribution conformed to a Gaussian distribution at a previous time.

4. The method of claim 1 , wherein classifying local anomalies comprises determining whether a KPI is an isolated outlier.

5. The method of claim 4 , wherein classifying local anomalies comprises determining whether the KPI has gone from a distance below a first threshold at a previous sampling time to a current distance that is above a second, higher threshold.

6. The method of claim 4 , wherein classifying local anomalies comprises determining whether there is a trend across multiple previous sampling times from a distance below a first threshold toward a second, higher threshold.

7. The method of claim 1 , further comprising transforming from a space based on the principal axes to an original space and determining whether each of the local and structural anomalies is a global anomaly or a local anomaly.

8. A non-transitory computer readable storage medium comprising a computer readable program for detecting anomalous behavior, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:
performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes;
clustering the KPIs in a space defined by the set of principal axes;
determining local anomalies in the clustered KPIs by comparing, for each individual KPI in clusters that conform to a Gaussian distribution, a distance from a respective cluster mean to a threshold;
determining structural anomalies in the clustered KPIs;
classifying the structural and local anomalies based on historical information; and
performing a management action based on the classified structural and local anomalies.

9. A system for detecting anomalous behavior, comprising:
a detection module comprising a processor configured to perform a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes, to cluster the KPIs in a space defined by the set of principal axes, to determine local anomalies in the clustered KPIs by comparing, for each individual KPI in clusters that conform to a Gaussian distribution, a distance from a respective cluster mean to a threshold, and to determine structural anomalies in the clustered KPIs;
a classification module configured to classify the structural and local anomalies based on historical information; and
a management module configured to perform a management action based on the classified structural and local anomalies.

10. The system of claim 9 , wherein the detection module is further configured to determine how closely each cluster of KPIs conforms to a Gaussian distribution.

11. The system of claim 10 , wherein the classification module is further configured to determine whether a cluster that does not conform to a Gaussian distribution conformed to a Gaussian distribution at a previous time.

12. The system of claim 9 , wherein the classification module is further configured to determine whether a KPI is an isolated outlier.

13. The system of claim 12 , wherein the classification module is further configured to determine whether the KPI has gone from a distance below a first threshold at a previous sampling time to a current distance that is above a second, higher threshold.

14. The system of claim 12 , wherein the classification module is further configured to determine whether there is a trend across multiple previous sampling times from a distance below a first threshold toward a second, higher threshold.

15. The system of claim 9 , wherein the classification module is further configured to transform from a space based on the principal axes to an original space and to determine whether each of the local and structural anomalies is a global anomaly or a local anomaly.

Assignees

• IBM

Inventors

• Della Corte Gianluca
• Gianfagna Leonida
• Proietti Stefano
• Pecoraro Roberto
• Sgro Antonio M

Classifications

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title