Method and system for real-time, false positive resistant, load independent and self-learning anomaly detection of measured transaction execution parameters like response times

Patent metadata

Field	Value
Publication number	US-9817884-B2
Application number	US-201414338707-A
Country	US
Kind code	B2
Filing date	Jul 23, 2014
Priority date	Jul 24, 2013
Publication date	Nov 14, 2017
Grant date	Nov 14, 2017

Abstract

A combined transaction execution monitoring, transaction classification and transaction execution performance anomaly detection system is disclosed. The system receives and analyzes transaction tracing data which may be provided by monitoring agents deployed to transaction executing entities like processes. In a first classification stage, parameters are extracted from received transaction tracing data, and the transaction tracing data is tagged with the extracted classification data. A subsequent measure extraction stage analyzes the classified transaction tracing data and creates corresponding measurements which are tagged with the transaction classifier. A following statistical analysis process maintains statistical data describing the long term statistical behavior of classified measures as a baseline, and also calculates corresponding statistical data describing the current statistical behavior of the classified measures. The statistical analysis process detects and notifies significant deviations between the statistical distribution of baseline and current measure data. A subsequent anomaly alerting and visualization stage processes those notifications.

First claim

What is claimed is:

1. A computer-implemented method for detecting anomalies in a performance metric associated with monitored transactions of a distributed computing environment, comprising:
capturing, by a sensor instrumented in a monitored application, a plurality of measurement values for a performance metric, where the performance metric is for a transaction executed in part by the monitored application, and the sensor and the monitored application reside on and are executed by a processor of a host computer;
calculating, by the anomaly detector, a current distribution parameter from the plurality of measurement values, where the current distribution parameter is indicative of statistical distribution of the plurality of measurement values for the performance metric during the present period of time;
retrieving, by the anomaly detector, a baseline distribution parameter for the performance metric, where the baseline distribution parameter is indicative of statistical distribution of measurement value for the performance metric during a preceding period of time, where the preceding period of time precedes the present period of time;
detecting, by the anomaly detector, a change in shape of the statistical distribution of the plurality of measurement values for the performance metric during the present period of time by comparing the current distribution parameter to the baseline distribution parameter;
determining whether quantity of the plurality of measurement values exceeds a significance threshold; and
detecting an anomaly in the performance metric based on the detected change in shape of the statistical distribution only when the quantity of measurement values exceeds the significance threshold, where the anomaly detector is executed by a processor of a monitoring computer residing across a network from the host computer.

2. The method of claim 1 further comprises detecting an anomaly in response to the change in shape of the statistical distribution exceeding a threshold and generating an alert by the computing device, the alert being generated in response to detecting an anomaly in the performance metric.

3. The method of claim 1 further comprises performing the steps of calculating, retrieving and detecting in part while the transaction is being executed.

4. The method of claim 1 further comprises identifying an anomaly in the performance metric when the current distribution parameter falls outside a tolerance of the baseline distribution parameter.

5. The method of claim 1 further comprises initializing value of the current distribution parameter when anomaly detection was performed unless the anomaly detection generated a result indicating statistical uncertainty as to the existence or not of an anomaly.

6. The method of claim 1 further comprises
accumulating, by the anomaly detector, a preceding set of measurement values for the performance metric, where the preceding set of measurement values were acquired during execution of transactions in the preceding period of time;
calculating, by the anomaly detector, the baseline distribution parameter from the preceding set of measurement values; and
storing, by the anomaly detector, the baseline distribution parameter in a repository.

7. The method of claim 1 wherein the baseline distribution parameter and the current distribution parameter are selected from the group comprising mean, median, standard deviation, and quantile.

8. The method of claim 1 wherein capturing a plurality of measurement values for a performance metric further comprises instrumenting bytecode for the monitored application with the sensor.

9. The method of claim 1 wherein capturing a plurality of measurement values for a performance metric further comprises identifying elements in a document object model that contains request directives and instruments an identified element with the sensor, where the monitored application is further defined as a web browser instrumented with a browser agent and the browser agent instruments the identified element with the sensor.

10. The method of claim 9 wherein the request directive is defined as content update request directive or content load request directive.

11. The method of claim 9 wherein the request directive is defined as resource request directive.

12. The method of claim 1 wherein calculating a current distribution parameter further comprises calculating a quantile for the plurality of measurement values using an estimation method that examines each measurement value in the plurality of measurement values only once.

13. The method of claim 12 wherein the estimation method is further defined as a p 2 algorithm.

14. The method of claim 1 further comprises
calculating, by the anomaly detector, a second current distribution parameter from the plurality of measurement values, where the second current distribution parameter differs from the current distribution parameter and is indicative of statistical distribution of the plurality of measurement values for the performance metric during the present period of time;
retrieving, by the anomaly detector, a second baseline distribution parameter for the performance metric, where the second baseline distribution parameter is of same type as the second current distribution parameter and is indicative of statistical distribution of measurement value for the performance metric during the preceding period of time; and
detecting, by the anomaly detector, another type of anomaly in the performance metric by comparing the second current distribution parameter to the second baseline distribution parameter.

15. The method of claim 1 wherein the current distribution parameter has a value that changes in response to an anomaly that affects a majority of the measurement values for the performance metric.

16. The method of claim 15 wherein the current distribution parameter is defined as a 0.5 quantile.

17. The method of claim 1 wherein the current distribution parameter has a value that changes in response to an anomaly that causes outliers of the performance metric.

18. The method of claim 17 wherein the current distribution parameter is defined as a 0.9 quantile.

19. The method of claim 1 further comprises
receiving, by a measure extractor, a plurality of transaction events resulting from transactions executed in the distributed computing environment, where the transaction event include a measurement value for at least one performance metric;
grouping, by the measure extractor, transaction events in the plurality of transaction events into a group of transaction events, where the transaction events in the group of transaction event are from transaction that perform similar tasks; and
extracting, by the measure extractor, measurement values for the performance metric from the transaction events in the group of transaction events to form the group of measurement values, where the measure extractor is executed by a processor of a computing device.

20. The method of claim 19 further comprises grouping transaction events in the group of transaction events using data extracted from a request that initiated the transaction associated with the transaction events.

21. The method of claim 20 wherein grouping transaction events further comprises extracting a uniform resource locator from the request, parsing the uniform resource locator to determine an identifier for a server to which the request was sent and a path identifying an addressed resource on the server, and grou

Assignees

• Compuware Corp
• Dynatrace Llc

Inventors

• Greifeneder Bernd
• Lehofer Andreas
• Schwarzbauer Günther

Classifications

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title

• G06F17/30598 Primary

  Physics · mapped topic

• H04L41/064

  involving time analysis · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• G06F16/285 Primary

  Clustering or classification · CPC title