Systems and methods for detecting anomalies

Abstract

Apparatus and method for detecting anomalies in a computer system are disclosed herein. In some embodiments, multiple probes are executed on an evolving data set. Each probe may return a result. Property values are then derived from a respective result returned by a corresponding probe. Surprise scores corresponding to the property values are generated, where each surprise score is generated based on a comparison between a corresponding property value and historical property values. The corresponding property value and the historical property values are derived from results returned from the same probe. Historical surprise scores generated by the anomaly detection engine are accessed. Responsive to a comparison between the plurality of surprise scores and the plurality of historical surprise scores, a monitoring system is alerted of an anomaly regarding the evolving data set.

What is claimed is: 
     
         1 . A computer-implemented system comprising:
 a probe module implemented by one or more processors and configured to execute a plurality of probes on an evolving data set, each probe from the plurality of probes returning a result, the probe module further configured to derive a plurality of property values, each property value from the plurality of property values is derived from a respective result returned by a corresponding probe of the plurality of probes; and   an anomaly detection engine implemented by the one or more processors and configured to:
 generate a plurality of surprise scores corresponding to the plurality of property values, each surprise score being generated based on a comparison of a corresponding property value from the plurality of property values and historical property values, the corresponding property value and the historical property values having been derived from results returned from the same probe, 
 access a plurality of historical surprise scores generated by the anomaly detection engine, and 
 responsive to a comparison between the plurality of surprise scores and the plurality of historical surprise scores, alert a monitoring system of an anomaly regarding the evolving data set. 
   
     
     
         2 . The computer-implemented system of  claim 1 , wherein the plurality of surprise scores are generated at a first iteration, and the historical surprise scores were generated at one or more past iterations. 
     
     
         3 . The computer-implemented system of  claim 1 , wherein:
 the probe module is further configured to derive a plurality of additional property values, each additional property value from the plurality of property values are derived from the respective result returned by the corresponding probe of the plurality of probes, the plurality of additional property values relating to a different property than the plurality of property values; and   the anomaly detection engine is further configured to:
 generate a plurality of additional surprise scores corresponding to the plurality of additional property values, each additional surprise score being generated based on a comparison of a corresponding additional property value from the plurality of additional property values and additional historical property values, the corresponding additional property value and the additional historical property values having been derived from results returned from the same probe, 
 access a plurality of additional historical surprise scores generated by the anomaly detection engine, and 
 responsive to a comparison between the plurality of additional surprise scores and the plurality of additional historical surprise scores, alert the monitoring system of an additional anomaly regarding the evolving data set. 
   
     
     
         4 . The computer-implemented system of  claim 1 , wherein the comparison between the plurality of surprise scores and the plurality of historical surprise scores includes determining whether the plurality of surprise scores deviate from a historical distribution of the plurality of historical surprise scores. 
     
     
         5 . The computer-implemented system of  claim 1 , wherein the comparison between the plurality of surprise scores and the plurality of historical surprise scores includes determining whether a number of surprise scores from the plurality of surprise scores deviates from the plurality of historical surprise scores. 
     
     
         6 . The computer-implemented system of  claim 1 , wherein the comparison between the plurality of surprise scores and the plurality of historical surprise scores includes determining whether a quantile of the plurality of surprise property values deviates from a historical distribution of quantiles derived from the plurality of historical surprise scores. 
     
     
         7 . The computer-implemented system of  claim 1 , wherein the evolving data set relates to data obtained by monitoring a computer system. 
     
     
         8 . The computer-implemented system of  claim 1 , wherein the evolving data set relates to data obtained by monitoring an inventory of items listed in a database. 
     
     
         9 . The computer-implemented system of  claim 1 , wherein the evolving data set relates to data obtained by monitoring a performance metrics of a plurality of servers. 
     
     
         10 . The computer-implemented system of  claim 9 , wherein the plura of property values relate to at least one of: a processor load, a bandwidth consumption, a thread count, a running processes count, a memory usage, a throughput count, a rate of disk seeks, a rate of packets transmitted or received, or a rate of response. 
     
     
         11 . A computer-implemented method comprising:
 executing a plurality of probes on an evolving data set, each probe from the plurality of probes returning a result;   deriving a plurality of property values, each property value from the plurality of property values is derived from a respective result returned by a corresponding probe of the plurality of probes;   generating a plurality of surprise scores corresponding to the plurality of property values, each surprise score being generated based on a comparison of a corresponding property value from the plurality of property values and historical property values, the corresponding property value and the historical property values having been derived from results returned from the same probe;   accessing a plurality of historical surprise scores generated by the anomaly detection engine and responsive to a comparison between the plurality of surprise scores and the plurality of historical surprise scores, alerting a monitoring system of an anomaly regarding the evolving data set.   
     
     
         12 . The computer-implemented method of  claim 11 , wherein the plurality of surprise scores are generated at a first iteration, and the historical surprise scores were generated at one or more past iterations. 
     
     
         13 . The computer-implemented method of  claim 11 , wherein the comparison between the plurality of surprise scores and the plurality of historical surprise scores includes determining whether the plurality of surprise scores deviate from a historical distribution of the plurality of historical surprise scores. 
     
     
         14 . The computer-implemented method of  claim 11 , wherein the comparison between the plurality of surprise scores and the plurality of historical surprise scores includes determining whether a number of surprise scores from the plurality of surprise scores deviates from the plurality of historical surprise scores. 
     
     
         15 . The computer-implemented method of  claim 11 , wherein the comparison between the plurality of surprise scores and the plurality of historical surprise scores includes determining whether a quantile of the plurality of surprise property values deviates from a historical distribution of quantiles derived from the plurality of historical surprise scores. 
     
     
         16 . The computer-implemented method of  claim 11 , wherein the evolving data set relates to data obtained by monitoring a computer system. 
     
     
         17 . The computer-implemented method of  claim 11 , wherein the evolving data set relates to data obtained by monitoring an inventory of items listed in a database. 
     
     
         18 . The computer-implemented method of  claim 11 , wherein the evolving data set relates to data obtained by monitoring a performance metrics of a plurality of servers. 
     
     
         19 . The computer-implemented method of  claim 18 , wherein the plurality of property values relate to at least one of: a processor load, a bandwidth consumption, a thread count, a running processes count, a memory usage, a throughput count, a rate of disk seeks, a rate of packets transmitted or received, or a rate of response. 
     
     
         20 . A non-transitory computer-readable medium storing executable instructions thereon, which, when executed by a processor, cause the processor to perform operations comprising:
 executing a plurality of probes on an evolving data set, each probe from the plurality of probes returning a result;   deriving a plurality of property values, each property value from the plurality of property values is derived from a respective result returned by a corresponding probe of the plurality of probes;   generating a plurality of surprise scores corresponding to the plurality of property values, each surprise score being generated based on a comparison of a corresponding property value from the plurality of property values and historical property values, the corresponding property value and the historical property values having been derived from results returned from the same probe;   accessing a plurality of historical surprise scores generated by the anomaly detection engine and responsive to a comparison between the plurality of surprise scores and the plurality of historical surprise scores, alerting a monitoring system of an anomaly regarding the evolving data set.