Anomaly detection in data centers

• US 8,688,620 B2
• Filed: 09/23/2011
• Issued: 04/01/2014
• Est. Priority Date: 09/23/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Viswanathan, Krishnamurthy, Lakshminarayan, Choudur, Talwar, Vanish, Wang, Chengwei
• Primary Examiner(s): Holmes, Michael B
• Application Number:
  US13/243,476
• Publication Number:
  US 20130080375A1
• Time in Patent Office: 921 Days
• Field of Search: 706/62
• US Class Current: 706/62
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit

Abstract

Systems and methods of anomaly detection in data centers. An example method may include analyzing time series data for the data center by testing statistical hypotheses. The method may also include constructing upper and lower bounds based on the statistical hypotheses. The method may also include flagging anomalies in the time series data falling outside of the upper and lower bounds.

Claims

1. A method of anomaly detection in data centers, comprising:

analyzing time series data for the data center by testing statistical hypotheses corresponding to different operational states of the data center;

constructing upper and lower bounds based on the statistical hypotheses; and

flagging anomalies in the time series data falling outside of the upper and lower bounds.

2. The method of claim 1, further comprising applying a multinomial goodness-of-fit test.

3. The method of claim 2, further comprising quantizing a metric being measured in the time series data and discretizing the metric to a few values.

4. The method of claim 3, further comprising windowing the time series data and analyzing each window for anomalies, and wherein analyzing each window further comprises:

selecting the quantized data in a window selecting a hypothesis; and

performing the multinomial goodness-of-fit test with a threshold based on an acceptable false negative probability.

5. The method of claim 3, wherein the multinomial goodness-of-fit test is based on relative entropy analysis.

6. The method of claim 5, further comprising raising an alarm that the window includes an anomaly if the hypothesis is rejected.

7. The method of claim 5, further comprising declaring that the window does not include an anomaly if the hypothesis is accepted.

8. The method of claim 1, further comprising distinguishing between gentle and abrupt changes in distribution of a monitored metric.

9. The method of claim 8, further comprising declaring a window to be anomalous if distribution of metric values in a window differs significantly from distribution of historical metric values.

10. The method of claim 1, further comprising contextualizing the time series data to factor changing load on the data center.

11. The method of claim 1, further comprising computing a test statistic against several null hypotheses to factor multiple states of operation of the data center.

12. A system for anomaly detection in data centers, the system comprising program code stored on non-transient computer-readable media and executable by a processor to:

analyze time series data by testing statistical hypotheses corresponding to different operational states of the data center;

construct upper and lower bounds based on the statistical hypotheses; and

flag anomalies in the time series data based on the upper and lower bounds.

13. The system of claim 12, wherein the processor is executable to further distinguish between gentle changes in distribution of a monitored metric and abrupt changes in distribution of the monitored metric.

14. The system of claim 12, wherein the processor is executable to further contextualize the time series data to factor changing load on the data center.

15. The system of claim 12, wherein the processor is executable to further compute a test statistic against several null hypotheses to factor multiple states of operation of the data center.

16. The system of claim 12, wherein the processor is executable to further compute statistics for a current window and update historical statistics.

17. The system of claim 12, wherein the processor is executable online, using limited memory.

18. The system of claim 12, wherein processor is executable to compute a relative entropy using multiple hypotheses.