Real time detection of metric baseline behavior change

Abstract

Example aspects include techniques for real-time detection of metric baseline behavior change. These techniques may include generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, and comparing the reference distance signature to the sample distance signature to determine a signature difference. In addition, the techniques may include determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold, and presenting, based at least in part on the signature difference, an alert notification identifying the second period of time as the baseline change candidate.

1 - 20 . (canceled) 
     
     
         21 . A system comprising:
 a processor; and   memory comprising computer executable instructions that, when executed, perform operations comprising:
 generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, wherein generating the reference distance signature comprises:
 generating initial deseasonalized time series information based on the historic time series information; 
 determining updated deseasonalized time series information by removing outlier datapoints from the initial deseasonalized time series information; 
 determining formatted historic time series information by removing one or more outages; and 
 generating the reference distance signature based on the formatted historic time series information; 
 
 generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time; 
 determining a signature difference by comparing the reference distance signature to the sample distance signature; 
 determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold; and 
 presenting an alert notification identifying the second period of time as the baseline change candidate. 
   
     
     
         22 . The system of  claim 21 , further comprising:
 a cloud computing platform including a plurality of tenant components.   
     
     
         23 . The system of  claim 22 , wherein the component metric measures activity from a tenant component in the plurality of tenant components. 
     
     
         24 . The system of  claim 23 , wherein the component metric corresponds to one of:
 request duration metrics;   dependency duration metrics; or   client performance metrics.   
     
     
         25 . The system of  claim 24 , wherein the request duration metrics represent an amount of time elapsed between receipt of a service request at the tenant component and transmission of a service response by the tenant component. 
     
     
         26 . The system of  claim 24 , wherein the client performance metrics represent an amount of time elapsed during completion of a process by the tenant component for a type of a client. 
     
     
         27 . The system of  claim 26 , wherein the type of the client corresponds to:
 a browser;   an operating system; or   a client application.   
     
     
         28 . The system of  claim 21 , further comprising:
 a training module used to periodically generate reference distance signatures for the component metric.   
     
     
         29 . The system of  claim 28 , wherein the training module uses a one-class support vector machine (SVM) to generate the reference distance signature based on historic data collected over a preconfigured period of time. 
     
     
         30 . The system of  claim 29 , wherein using the one-class SVM to generate the reference distance signature comprises scaling the updated deseasonalized time series information to a preconfigured range. 
     
     
         31 . The system of  claim 29 , wherein the training module:
 determines a plurality of support vectors via the one-class SVM based on pre-processed time series information;   computes a matrix of pairwise distances between each pair of support vectors in the plurality of support vectors; and   determines a kernel of the matrix.   
     
     
         32 . The system of  claim 31 , wherein the training module determines the kernel of the matrix using a gaussian radial basis function (RBF) as a kernel function used to generate the kernel. 
     
     
         33 . The system of  claim 21 , further comprising:
 a sampling module used to periodically generate sample distance signatures for the component metric.   
     
     
         34 . The system of  claim 33 , wherein the sampling module uses a one-class support vector machine (SVM) to generate the sample distance signature based on recently-collected data collected over a preconfigured period of time. 
     
     
         35 . The system of  claim 34 , wherein the one-class SVM encapsulates instances of a same class in a hyperplane to provide a representation of the reference distance signature and the sample distance signature. 
     
     
         36 . A method comprising:
 a processor; and   memory comprising computer executable instructions that, when executed, perform operations comprising:
 generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time; 
 generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, wherein generating the sample distance signature comprises:
 generating initial deseasonalized time series information based on the sample time series information; 
 determining updated deseasonalized time series information by removing outlier datapoints from the initial deseasonalized time series information; 
 determining formatted sample time series information by scaling the updated deseasonalized time series information; and 
 generating the sample distance signature based on the formatted sample time series information; 
 
 determining a signature difference by comparing the reference distance signature to the sample distance signature; 
 determining that the second period of time is a baseline change candidate based on the signature difference being greater than a distance threshold; and 
 presenting an alert notification identifying the second period of time as the baseline change candidate. 
   
     
     
         37 . The method of  claim 36 , wherein the signature difference represents a kernel matrix distance between a first kernel associated with the reference distance signature and a second kernel associated with the sample distance signature. 
     
     
         38 . The method of  claim 36 , wherein the distance threshold indicates that a baseline change has a predefined level of impact. 
     
     
         39 . The method of  claim 36 , wherein the alert notification is provide to a tenant device associated with a tenant component of a cloud computing platform, the tenant component being a website, the component metric measuring activity of the website. 
     
     
         40 . A device comprising:
 a processor; and   memory comprising computer executable instructions that, when executed, perform operations comprising:
 generating a reference distance signature based on historic time series information for a component metric, the historic time series information corresponding to a first period of time, the reference distance signature being generated via a first support vector machine (SVM) model; 
 generating a sample distance signature based on sample time series information for the component metric, the sample time series information corresponding to a second period of time, the sample distance signature being generated via a second SVM model; 
 determining a signature difference by comparing the reference distance signature to the sample distance signature; 
 determining that the second period of time is not a baseline change candidate based on the signature difference being less than a distance threshold; and 
 providing an indication that the second period of time is not the baseline change candidate.