Performance data analysis to reduce false alarms in hybrid cloud environments

Abstract

A computer-implemented method is provided. The method includes transforming run-time data points indicative of an impact of the run-time data points on robustness and performance of a computing system. The run-time data points are clustered, with each cluster representing a respective time state of the computing system. Each cluster is transformed into a three-dimensional representation based on a probability density of the run-time data points of each cluster. A time-based vector is generated, the vector representing a transition from a first three-dimensional representation to a second three-dimensional representation. Each three-dimensional representation traversed by the time-based vector represents a respective state of the computing system. The time-based vector is compared to a baseline vector. An anomaly alert is issued based at least in part on the comparison.

Description

[Technical Field]

[0001] The present invention relates generally to programmable computing systems, and more particularly to programmable computing systems configured to perform performance data analytics that reduce false alarms in hybrid cloud environments. [Background technology]

[0002] Data science is an interdisciplinary field in which computing systems use complex algorithms to analyze large amounts of unstructured data and generate insights from the analysis. Data scientists use business acumen, mathematics, computer science knowledge, and communication skills to generate these algorithms and interpret various computing outputs. One aspect of data science is anomaly detection, which is the process by which a computing system identifies data points or trends that deviate from the norm. Anomaly data can be used to identify exceptions or as an indicator of changes in the behavior of a computing model, for example, in hybrid cloud computing environments.

[0003] A hybrid cloud computing environment is one in which data is shared and processed between a centralized data center (a private cloud computing environment) and third-party applications operating in one or more public cloud computing environments. System administrators measure the performance of a hybrid cloud computing environment using data such as throughput, queue length, and response time. System data is unpredictable and complex, requiring system administrators to set thresholds for numerous performance indicators to monitor for anomalies and measure application performance across the cloud computing environment. Administrators typically perform static anomaly detection by setting static thresholds as anomaly warning triggers. However, if the thresholds are set too low, the anomaly detection system may issue false alarms. On the other hand, if the thresholds are set too high, the anomaly detection system will fail to issue any warnings. Summary of the Invention

[0004] An embodiment of the present invention is directed to a computer-implemented method for performance analysis to reduce false alarms in a hybrid cloud environment. A non-limiting example of the computer-implemented method includes transforming runtime data points to indicate their impact on the robustness and performance of a computing system. The runtime data points are clustered, with each cluster representing a respective temporal state of the computing system. Each cluster is transformed into a three-dimensional representation based on a probability density of the runtime data points in each cluster. A time-based vector is generated, with the vector representing a transition from a first three-dimensional representation to a second three-dimensional representation. Each three-dimensional representation traversed by the time-based vector represents a respective state of the computing system. The time-based vector is compared to a baseline vector. An anomaly alert is issued based at least in part on the comparison.

[0005] The embodiment of the present invention further includes determining whether deviations of the time base vector from the baseline vector are due to false positive anomalies by determining whether the start and end data points of the first leg of the time base vector are included in a first cluster and a second temporally consecutive cluster, respectively, and comparing the trajectory of the first leg of the time base vector with the trajectory of the first leg of the baseline vector to determine whether the trajectory deviates significantly from a threshold deviation.

[0006] Embodiments of the present invention further include determining whether deviations of the time base vector from the baseline vector are due to false negative anomalies by comparing the sequence of state transitions represented by the time base vector with the sequence of state transitions represented by the baseline vector.

[0007] Embodiments of the present invention provide the technical solutions described herein, which accordingly address the technical challenges of using static thresholds for anomaly detection. Hybrid cloud systems and artificial intelligence for IT operations (AIOps) involve large volumes of unpredictable and complex data. System administrators must set numerous performance indicators and monitor the data to evaluate the status of applications and systems. Therefore, the technical solutions described herein provide practical applications for generating three-dimensional representations of the temporal state of an application or system. Furthermore, the technical solutions described herein improve on related anomaly detection systems and other technical solutions that generate anomaly indicators by continuously monitoring the real-time trajectory of an application or system from one temporal state to the next, rather than relying on static performance indicator thresholds.

[0008] An embodiment of the present invention is directed to a system for performance analysis to reduce false alarms in a hybrid cloud environment. A non-limiting example of the system includes transforming runtime data points to indicate their impact on the robustness and performance of a computing system. The system clusters the runtime data points, with each cluster representing a temporal state of the computing system. The system converts each cluster into a three-dimensional representation based on a probability density of the runtime data points in each cluster. The system generates a time base vector, where the vector represents a transition from a first three-dimensional representation to a second three-dimensional representation. Each three-dimensional representation traversed by the time base vector represents a respective state of the computing system. The system compares the time base vector with a baseline vector. The system issues an anomaly alert based at least in part on the comparison.

[0009] An embodiment of the present invention is directed to a computer program product for performance analysis to reduce false alarms in a hybrid cloud environment. A non-limiting example of the computer program product includes transforming runtime data points to indicate an impact of the runtime data points on the robustness and performance of a computing system. The computer program product clusters the runtime data points, with each cluster representing a respective temporal state of the computing system. The computer program product transforms each cluster into a three-dimensional representation based on a probability density of the runtime data points in each cluster. The computer program product generates a time-based vector, the vector representing a transition from a first three-dimensional representation to a second three-dimensional representation. Each three-dimensional representation traversed by the time-based vector represents a respective state of the computing system. The computer program product compares the time-based vector with a baseline vector. The computer program product issues an anomaly alert based at least in part on the comparison.

[0010] Further technical features and advantages are realized by the techniques of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered part of the claimed subject matter. For a better understanding, please refer to the detailed description and drawings.

[0011] The particular subject matter of the exclusive rights set forth herein is particularly pointed out and distinctly claimed in the claims at the end of the specification. The foregoing and other features and advantages of embodiments of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 illustrates a performance analysis system for reducing false alarms in a hybrid cloud environment in accordance with one or more embodiments of the present invention. [Figure 2] FIG. 1 illustrates a two-dimensional representation of clustered performance / robustness data points in accordance with one or more embodiments of the present invention. [Figure 3A] FIG. 1 illustrates a two-dimensional representation of performance / robustness data point clusters and time base vectors in accordance with one or more embodiments of the present invention. [Figure 3B] FIG. 1 illustrates a three-dimensional representation of performance / robustness data point clusters and time base vectors in accordance with one or more embodiments of the present invention. [Figure 4] FIG. 1 is a flow diagram for reducing false alarms in a hybrid cloud environment in accordance with one or more embodiments of the present invention. [Figure 5] FIG. 10 illustrates a flow diagram for comparing a time base vector with a baseline vector in accordance with one or more embodiments of the present invention. [Figure 6] FIG. 1 illustrates a cloud computing environment in accordance with one or more embodiments of the present invention. [Figure 7] FIG. 2 illustrates abstraction model layers in accordance with one or more embodiments of the present invention. [Figure 8] FIG. 1 is a block diagram of a computer system for use in implementing one or more embodiments of the present invention.

[0013] The diagrams depicted herein are illustrative. Many variations are possible in the diagrams or the operations described therein without departing from the spirit of the invention. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Additionally, the term "coupled" and variations thereof describe that there is a communication path between two elements, and do not imply a direct connection between the elements without an intervening element / connection between them. All of these variations are considered part of this specification. DETAILED DESCRIPTION OF THE INVENTION

[0014] One or more embodiments of the present invention provide a computer-implemented method, computing system, and computer program product for anomaly detection based on comparing real-time performance and robustness patterns of a computing system with baseline patterns of the computing system.

[0015] One or more embodiments of the present invention address one or more of the above-mentioned shortcomings by providing a computer-implemented method, computing system, and computer program product for anomaly detection that collects system data and generates clusters of performance / robustness data points. Each cluster represents the state of a hybrid cloud computing environment at a point in time. The different clusters of data points are mapped to a two-dimensional coordinate system. The clustered two-dimensional performance / robustness values ​​are converted to a three-dimensional representation. A vector is generated that represents the time-based trajectory of the transition from one state to the next time-sequential state. The generated time-based vector is compared to a baseline vector to determine whether to issue an anomaly alert.

[0016] Referring to FIG. 1, a system 100 for anomaly detection according to an embodiment of the present invention is shown. The system 100 includes a data point generation unit 102 that collects system data 110 from a computing system 112 to analyze and calculate performance / robustness data points from the data. The system 100 further includes a data point clustering unit 104 that transforms the performance / robustness data points into a two-dimensional coordinate system, clusters the data points, and calculates the dimensions of the different clusters. The system 100 further includes a three-dimensional data point conversion unit 106 that converts the clusters into a three-dimensional representation based on the gradients and probability densities of the data points. The system 100 further includes a performance and robustness vector unit 108 that calculates vectors representing time-based paths traversing the three-dimensional representation and compares the calculated vectors with a baseline vector. Based on the comparison, the performance and robustness vector unit 108 makes a prediction 114 as to whether the system data indicates an anomaly. It should be understood that some or all of the functionality of the system 100 can be performed on a cloud computing environment 50, such as that shown in FIG. 6, and a processing system 800, such as that shown in FIG. 8.

[0017] According to one or more embodiments of the present invention, the data point generation unit 102 is operable to receive as input system data 110 in the form of real-time runtime data from the computing system 112 and determine the impact of the data on the performance and robustness of the computing system 112. The system data 110 may include computer hardware and software-related data related to, but not limited to, CPU performance values, memory performance values, input / output (IO) performance values, and network performance values. In a hybrid cloud computing environment, the system data 110 may be collected from any connected private cloud, public cloud, and edge device. The system data 110 may further be collected from multiple perspectives, such as the server side (the private cloud's response time to a request from the public cloud) and the edge device side (resource load time).

[0018] In accordance with one or more embodiments of the present invention, the data point generation unit 102 may be implemented, for example, as a neural network, running a pre-trained model to generate values ​​representing the degree to which data points in the system data 110 contribute to the robustness and performance of the computing system 112. The neural network samples the system data 110 through an input layer, extracts features through a hidden layer, and outputs robustness and performance values ​​for the sampled data points. In effect, the data point generation unit 102 generates performance / robustness data points from the system data 110. Robustness is the insensitivity of the computing system's hardware and software to errors that occur during the operation of the computing system. Performance is a measure of the work performed by the computing system 112. The data point generation unit 102 may be configured as a radial basis function (RBF) network designed for forecasting based on time-series data. An RBF network is a feedforward network that includes an input layer, a hidden layer, and an output layer. RBF networks are distinguished from other neural networks based on their universal approximation capabilities and learning speed. The RBF network uses an RBF function as an activation function that operates on the concept that the predicted value target value of an item is similar to other items of predictor variables (e.g., performance value and robustness value). The RBF network generates values ​​within a range of values ​​for how low or high each system data point's impact on both performance and robustness is. For example, one system data point may have a low impact on performance but a high impact on robustness. Meanwhile, another system data point may have a high impact on performance but a low impact on robustness. By assigning performance and robustness values ​​to the system data points, the data point generation unit 102 generates performance / robustness data points.

[0019] The data point clustering unit 104 receives the robustness / performance data points from the data point generation unit 102 and maps the points to a two-dimensional coordinate system (e.g., a Cartesian coordinate system) in accordance with one or more embodiments of the present invention. For example, the data point clustering unit 104 may map the robustness / performance data points to a two-dimensional grid where the X-axis represents a range from low to high values ​​for the system data point's influence on robustness and the Y-axis represents a range from low to high values ​​for the system data point's influence on performance.

[0020] Once the robustness / performance data points are mapped to the two-dimensional coordinate system, the data point clustering unit 104 clusters the robustness / performance data points into groups of data points. For example, the data point clustering unit 104 can use a mean shift model (mode-seeking algorithm) in which each data point is iteratively assigned toward the nearest cluster centroid of the robustness / performance data point. After each iteration, the data point clustering unit 104 moves each data point closer to the cluster center. After many iterations, the data point clustering unit 104 stops moving the data points, and the data points are assigned to clusters. Each cluster is considered a state of the computing system 112, with each cluster being a characteristic of the computing system 112 at a given time. Upon determining each cluster, the data point clustering unit 104 can characterize an aspect of the computing system 112 for each state. For example, for the overall computing system 112, if a cluster exhibits high performance and low robustness, the computing system 112 can be characterized as having high concurrency. However, if a cluster is characterized as low performance and medium robustness, the computing system 112 may be characterized by CPU contention. Data points that are a predetermined distance away from the centroid cluster are considered outliers and are not assigned to any cluster. The data point clustering unit 104 may also use various other clustering algorithms, such as a connectivity clustering model, a density clustering model, a centroid clustering model, and a distribution clustering model.

[0021] The 3D data point conversion unit 106 converts the 2D representation of the data points into a 3D representation. The 3D data point conversion unit 106 begins by calculating the "centroid" of each state. In some embodiments of the invention, the 3D data point conversion unit 106 uses the following relationship: TIFF0007789095000001.tif13162 where P C(SK) is a point along the performance axis, R C(SK) are points along the robustness axis (collectively the barycentric coordinates), and n k is the number of points in state k, m is the total number of states, and p i is the point along the performance axis of the cluster data point, and r i is the point along the performance axis of the data points of the cluster, and Center is the centroid. Then, the 3-dimensional data point transformation unit 106 calculates the probability of each state using the following relationship: TIFF0007789095000002.tif13162Here, the sum of the probabilities of all states is equal to 1.

[0022] The three-dimensional data point transformation unit 106 then calculates the probability density of each state using the following relationship: TIFF0007789095000003.tif12162TIFF0007789095000004.tif10165where, h k denotes the maximum probability density of state k, and D denotes the area of ​​state k.

[0023] The 3D data point transformation unit 106 transforms the 2D clusters (states) into a 3D representation, where the local height of a cluster is defined by its local probability density. Visually, this structure resembles a mountain range, where mountains are defined as areas of high probability density and valleys are defined as areas of low probability density.

[0024] The performance and robustness vector unit 108 then calculates a time-based three-dimensional vector that tracks the trajectory of the progression of the state of the computing system 112. For example, the time-based vector may represent the computing system 112 transitioning from a high concurrency state to a resource contention state. The performance and robustness vector unit 108 then compares any deviations from the trajectory of the generated time-based vector with the trajectory of the baseline vector to determine whether an error alert should be issued.

[0025] The present system 100 provides more accurate anomaly warnings than related anomaly detection systems, which focus on a single point in time for the computing system, whereas the system 100 described herein looks at state transitions for the computing system 112. Not only can three-dimensional trajectories represent transitions from one state to the next, but the three-dimensional component of the system 100 allows for analysis of local concentrations of runtime data points through elevation of the three-dimensional structure.

[0026] The phrases “neural network” and “machine learning” broadly describe the ability of an electronic system to learn from data. A machine learning system, engine, or module may include a machine learning algorithm that can be trained to learn functional relationships between currently unknown inputs and outputs, such as in an external cloud environment (e.g., cloud computing environment 50). In one or more embodiments, the machine learning function may be implemented using a data point generation unit 102 and a performance and robustness vector unit 108, which have the ability to be trained to perform currently unknown functions. In machine learning and cognitive science, neural networks are a family of statistical learning models inspired by the biological neural networks of animals, particularly the brain. Neural networks can be used to estimate or approximate systems or functions that depend on a large number of inputs.

[0027] The data point generation unit 102 and the performance and robustness vector unit 108 can be embodied as a so-called "neuromorphic" system of interconnected processor elements that function as simulated "neurons" and exchange "messages" between each other in the form of electronic signals. Similar to the so-called "plasticity" of synaptic neurotransmitter connections that transmit messages between biological neurons, the connections between the data point generation unit 102 and the performance and robustness vector unit 108 that transmit electronic messages between simulated neurons are provided with numerical weights corresponding to the strength or weakness of a given connection. During training, the weights can be adjusted based on experience, allowing the data point generation unit 102 and the performance and robustness vector unit 108 to adapt to the inputs and learn. After being weighted and transformed by a function determined by the network designer, the activation of these input neurons is passed to other downstream neurons, often called "hidden" neurons. This process is repeated until an output neuron is activated. The activated output neuron determines which character has been read.

[0028] Referring to FIG. 2, a diagram of performance / robustness data points mapped onto a two-dimensional coordinate system 200 is shown in accordance with an embodiment of the present invention. A first performance / robustness data point 202 is shown as part of a first cluster 204. An outlier data point 206 is also shown outside of any shown cluster. As shown, six clusters S1, S2, S3, S4, S5, and S6 each include multiple performance / robustness data points 202 and are shown at various locations on the two-dimensional coordinate system 200. Each cluster represents the state of the computing system 112 at a given point in time. The six clusters S1, S2, S3, S4, S5, and S6 are not necessarily numbered in chronological order, but rather for illustrative purposes. The axes of the two-dimensional coordinate system 200 include a robustness axis (x-axis) and a performance axis (y-axis). As each axis moves away from the origin, which represents indifference to either performance or robustness, the influence on either performance or robustness increases. For example, the S1 cluster 204 contains nine performance / robustness data points 202 and is positioned to indicate high performance and low robustness.

[0029] Referring to FIG. 3A, a diagram of the clusters shown in FIG. 2 mapped onto a two-dimensional coordinate system 300 is shown in accordance with an embodiment of the present invention. As shown, a first time base vector 304 extends from the S1 cluster 302 to the S2 cluster 306. A second time base vector 312 extends from the S3 cluster 308 to the S4 cluster 310. Referring to FIG. 3B, a diagram of the clusters shown in FIG. 2 mapped onto a three-dimensional coordinate system 320 is shown in accordance with an embodiment of the present invention. As shown, a first time base vector 324 extends from the S1 cluster 322 to the S2 cluster 326. A second time base vector 332 extends from the S3 cluster 328 to the S4 cluster 330. The relative height of each three-dimensional structure is based on the probability density of the underlying performance / robustness data points for each cluster. As can be seen, the probability density of performance / robustness data points is greater in the S6 cluster 334 than in the S5 cluster 336, and therefore the height of the S6 cluster 334 is greater than the height of the S5 cluster 336.

[0030] Referring to FIG. 4, a method 400 for performance analysis to reduce false alarms in a hybrid cloud environment is shown. It should be understood that some or all of the described method 400 may be executed on a cloud computing environment 50 such as that shown in FIG. 6 and a processing system 800 such as that shown in FIG. 8. In block 402, the data point generation unit 102 may receive system data 110 from a computing system 112 and generate performance / robustness data points. The system data 110 may be input as input to a model executed by a neural network of the data point generation unit 102. The data point generation unit 102 may sample the system data 110 and utilize the model to extract features indicative of performance and robustness. The data point generation unit 102 further generates performance / robustness data points relative to a two-dimensional coordinate system (e.g., Cartesian coordinates).

[0031] In block 404, the data point clustering unit 104 clusters the generated performance / robustness data points. Each cluster includes data points indicative of performance and robustness, and further represents the state of the computing system 112 at a particular time. Once the clusters are identified, the data point clustering unit 104 determines the state of the computing system 112 represented by the associated cluster based on the positioning of the cluster in a two-dimensional coordinate system. The clustering can be performed, for example, by a neural network running a model such as a mean shift model that iteratively clusters the performance / robustness data points.

[0032] In block 406, the 3D data point conversion unit 106 converts the performance / robustness data points from a 2D representation to a 3D representation. The 3D data point conversion unit 106 calculates the centroid of each state (cluster). The 3D data point conversion unit 106 then calculates the probability of each state and uses these probabilities to calculate the probability density of each state. The probability density includes local maxima and minima, and the local elevation of each 3D state is proportional to the local maxima and minima.

[0033] In block 408, the performance and robustness vector unit 108 generates a three-dimensional time base vector that represents the progression of the computing system 112 from one state to the next state in time. The performance and robustness vector unit 108 analyzes the system data 110 for indicators of temporal relationships between states. For example, the performance and robustness vector unit 108 searches timestamp data, conditional statements, and continuous action statements to determine the temporal order in which states occurred. The performance and robustness vector unit 108 then compares the three-dimensional trajectory of the generated time base vector with the trajectory of the baseline vector in block 410 to generate a prediction 114. In block 412, the performance and robustness vector unit 108 evaluates an error warning based on the comparison. Blocks 410 and 412 are described more specifically with reference to FIG. 5 .

[0034] Referring to FIG. 5, a method 500 for comparing performance / robustness vectors and evaluating error warnings is shown in accordance with an embodiment of the present invention. It should be understood that some or all of the described method 400 may be executed on a cloud computing environment 50 such as that shown in FIG. 6 and a processing system 800 such as that shown in FIG. 8. In block 502, the performance and robustness vector unit 108 pre-trains baseline vectors by collecting historical data and generating performance / robustness data points from the historical data. Next, the performance and robustness vector unit 108 generates clusters of two-dimensional clusters of performance / robustness data points. Each cluster represents a state of the computing system 112 at a point in time. Next, the performance and robustness vector unit 108 converts the two-dimensional clusters into a three-dimensional representation based on the probability density of the data points in the cluster. Next, the performance and robustness vector unit 108 generates a time-based baseline vector that describes the transition from one state to the next state of the computing system in time.

[0035] In block 504, the performance and robustness vector unit 108 then compares the trajectory of the generated time base vector with the trajectory of the baseline vector to determine whether the generated time base vector and the baseline vector deviate by more than a threshold deviation. For example, the threshold deviation can be a standard deviation based on a probability distribution derived from historical data. Thus, if the deviation is greater than the standard deviation and does not match, the performance and robustness vector unit 108 proceeds to block 506 and determines whether it is a false positive.

[0036] In block 506, the performance and robustness vector unit 108 proceeds to determine whether a false positive is detected by iteratively comparing each leg of the generated time base vector with each leg of the baseline vector. Because the first leg of each of the generated time base vector and baseline vector is the first in time, the performance and robustness vector unit 108 first analyzes this set of legs and then proceeds to sequentially compare the remaining legs. If the performance and robustness vector unit 108 determines that the set of legs deviates by more than a threshold deviation, it determines whether the deviation is due to outlier data. If both the start and end data points are associated with the respective clusters, the performance and robustness vector unit 108 can verify the deviation. However, if the end data point of a leg is an outlier data point (e.g., outlier data point 206 shown in FIG. 2), the performance and robustness vector unit 108 further analyzes the deviation. If the ending data point is an outlier data point, the performance and robustness vector unit 108 removes the outlier data point as the ending data point and recalculates a new leg of the generated time base vector without the outlier data point as the ending data point. The performance and robustness vector unit 108 uses the ending data point from the next consecutive leg as the new ending data point. In effect, the performance and robustness vector unit 108 removes the outlier data point and collapses the two consecutive legs of the vector into one leg. The performance and robustness vector unit 108 then compares the newly generated leg with the leg of the baseline vector to determine whether their trajectories are within a threshold deviation.

[0037] If at least one leg of the original legs of the generated timeline vector and baseline vector or the newly generated timeline vector and baseline vector significantly deviates from the threshold deviation, there is no false positive, and the performance and robustness vector unit 108 issues an anomaly warning in block 510. However, if each leg of the original legs of the generated timeline vector and baseline vector or the newly generated timeline vector and baseline vector does not significantly deviate from the threshold deviation, the performance and robustness vector unit 108 determines whether there is a false negative in block 508. The performance and robustness vector unit 108 verifies that the state progression of the generated timeline vector matches the baseline vector. For example, if the state progression of the generated timebase vector is state 1 to state 3 to state 4 to state 5 to state 6, the performance and robustness vector unit 108 verifies that the baseline vector also progresses from state 1 to state 3 to state 4 to state 5 to state 6. If the performance and robustness vector unit 108 determines that the comparison does not establish a false negative, the process ends in block 512. However, if the performance and robustness vector unit 108 determines that the comparison does not establish a false negative, the performance and robustness vector unit 108 issues an anomaly alert at block 510. The alert may be in the form of a visual icon displayed on the display of a software engineer, software developer, or other appropriate person.

[0038] In some embodiments of the present invention, the system 100 monitors components of a hybrid cloud system that includes a private cloud in operable communication with multiple public clouds. For example, the system 100 can monitor a private cloud, a public cloud, an application, or a combination thereof. The system 100 can further direct that resources be re-visioned in response to determining that the anomaly alert is not a false positive or false negative result. If the performance and robustness vector unit 108 generates an anomaly prediction 114 indicating that performance / robustness data indicates an anomaly in one component of the hybrid cloud computing system, it can direct measures to limit service disruptions in other aspects of the cloud computing system. For example, if an anomaly is predicted in the private cloud, the data point generation unit 102 determines whether any of the collected system data 110 relates to an application running on the public cloud or the public cloud itself. The anomaly may indicate an unexpected decrease in dedicated memory or dedicated processing capacity available to the public cloud or an application running on the public cloud. In this situation, the performance and robustness vector unit 108 can redirect excess memory or processing power dedicated to one or more other public clouds or unused memory or processing power toward the public cloud or application associated with the anomaly in the private cloud. Alternatively, the anomaly may be predicted in the public cloud. For example, the performance and robustness vector unit 108 can determine that the anomaly will result in resource exhaustion in the private cloud. In this example, the performance and robustness vector unit 108 can instruct the private cloud to redirect more resources to the public cloud or instruct the private cloud or public cloud to stop supporting the application causing the spill.It should be understood that the system 100 may cause other redirections of resources to maintain the core functionality of the hybrid cloud computing system.

[0039] Although this disclosure includes detailed descriptions of cloud computing, implementation of the teachings described herein is not limited to cloud computing environments. Rather, embodiments of the invention can be practiced in conjunction with any other type of computing environment now known or later developed.

[0040] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five characteristics, at least three service models, and at least four implementation models.

[0041] The characteristics are as follows:

[0042] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capacity, such as server time or network storage, automatically as needed, without the need for human interaction with the service provider.

[0043] Broad network access: Computing power is available over the network and can be accessed through standard mechanisms, facilitating use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, PDAs).

[0044] Resource Pooling: Computing resources from a provider are pooled and offered to multiple consumers using a multi-tenant model. Various physical and virtual resources are dynamically allocated and reallocated based on demand. Consumers generally have no control or knowledge of the exact location of the resources they are provided with, resulting in a sense of location independence. However, consumers may be able to determine location at a higher level of abstraction (e.g., country, state, data center).

[0045] Rapid Elasticity: Computing capacity can be provisioned quickly and elastically, sometimes automatically, to instantly scale out and quickly release to instantly scale in. To the consumer, the computing power available for provisioning often appears unlimited, and can be purchased at any time and in any quantity.

[0046] Metered Services: Cloud systems leverage measurement capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, active user accounts) to automatically control and optimize resource usage. Resource usage can be monitored, controlled, and reported to provide transparency to both providers and consumers of utilized services.

[0047] The service model is as follows:

[0048] Software as a Service (SaaS): The consumer is offered access to a provider's applications running on a cloud infrastructure that can be accessed from a variety of client devices through a thin-client interface such as a web browser (e.g., webmail). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions.

[0049] Platform as a Service (PaaS): The capability offered to consumers is to deploy applications they create or acquire using programming languages ​​and tools supported by the provider onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the configuration of their hosting environment.

[0050] Infrastructure as a Service (IaaS): The functionality offered to consumers is the provisioning of processors, storage, networking, and other basic computing resources on which they can deploy and run any software, including operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over the operating system, storage, and deployed applications, and in some cases partial control over some network components (e.g., host firewalls).

[0051] The deployment model is as follows:

[0052] Private Cloud: This cloud infrastructure is dedicated to a specific organization and can be managed by that organization or a third party, and can exist on-premise or off-premise.

[0053] Community Cloud: This cloud infrastructure is shared by multiple organizations to support a specific community with common concerns (e.g., mission, security requirements, policies, and compliance). This cloud infrastructure can be managed by those organizations or a third party and can exist on-premises or off-premises.

[0054] Public cloud: This cloud infrastructure is available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0055] Hybrid cloud: This cloud infrastructure combines two or more cloud models (private, community, or public), each of which retains its inherent nuances but is bound by standards or specific technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0056] A cloud computing environment is a service-oriented environment that emphasizes statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0057] Referring now to FIG. 6, an exemplary cloud computing environment 50 is depicted. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10, with which local computing devices used by cloud consumers (e.g., a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof) can communicate. The nodes 10 can communicate with each other. The nodes 10 can be grouped (not shown), either physically or virtually, in one or more networks, such as the private, community, public, or hybrid clouds described above, or combinations thereof. This enables the cloud computing environment 50 to provide infrastructure, platform, or software as a service, or combinations thereof, for which cloud consumers are not required to maintain resources on their local computing devices. It should be understood that the types of computing devices 54A-N depicted in FIG. 6 are merely exemplary, and that the computing nodes 10 and the cloud computing environment 50 can communicate with any type of electronic device via any type of network or network-addressable connection (e.g., using a web browser), or both.

[0058] Referring now to Figure 7, a series of functional abstraction layers provided by cloud computing environment 50 (Figure 6) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 7 are merely exemplary, and embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0059] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, reduced instruction set computer (RISC) architecture-based server 62, server 63, blade server 64, storage device 65, and network and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0060] The virtualization layer 70 provides an abstraction layer from which the following virtual entities can be provided, for example: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0061] By way of example, the management layer 80 may provide the following functions: Resource provisioning 81 enables dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment; Metering and pricing 82 enables cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources; By way of example, these resources may include application software licenses; Security enables identification and verification of cloud consumers and tasks, as well as protection for data and other resources; User portal 83 provides consumers and system administrators with access to the cloud computing environment; Service level management 84 enables allocation and management of cloud computing resources so that requested service levels are met; Service level agreement (SLA) planning and fulfillment 85 enables advance arrangement and procurement of anticipated future cloud computing resources required in accordance with SLAs.

[0062] The workload layer 90 provides examples of functionality available to a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include mapping and navigation 91, software development and lifecycle management 92, virtualization 93, data analytics processing 94, transaction processing 95, and performance analytics 96 to reduce false alarms in a hybrid cloud environment.

[0063] In one or more embodiments of the invention, the hardware / software modules of system 100 of FIG. 1 may be implemented on a processing system 800 shown in FIG. 8. Turning now to FIG. 8, a computer system 800 according to an embodiment is generally illustrated. Computer system 800 may be an electronic computer framework made up of or employing any number and combination of computing devices and networks utilizing various communication technologies, as described herein. Computer system 800 may be readily scalable, extensible, and modular, and may have the ability to be modified for different services or to reconfigure some functions independently of other functions. Computer system 800 may be, for example, a server, a desktop computer, a laptop computer, a tablet computer, or a smartphone. In some examples, computer system 800 may be a cloud computing node, such as node 10 of FIG. 6. Computer system 800 may be described in the general context of computer system-executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer system 800 may be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0064] As shown in FIG. 8, computer system 800 has one or more central processing units (CPUs) 801a, 801b, 801c, etc. (collectively or generally referred to as processor 801). Processor 801 can be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. Processor 801, also referred to as a processing circuit, is coupled to system memory 803 and various other components via a system bus 802. System memory 803 can include read-only memory (ROM) 804 and random access memory (RAM) 805. ROM 804 is coupled to system bus 802 and can include a basic input / output system (BIOS) that controls certain basic functions of computer system 800. RAM is read-write memory coupled to system bus 802 for use by processor 801. System memory 803 provides temporary memory space for the execution of said instructions during operation. System memory 803 can include random access memory (RAM), read-only memory, flash memory, or any other suitable memory system.

[0065] Computer system 800 includes an input / output (I / O) adapter 806 and a communications adapter 807 coupled to a system bus 802. I / O adapter 806 may be a small computer system interface (SCSI) adapter or combination thereof, which communicates with a hard disk 808 or any other similar component. I / O adapter 806 and hard disk 808 are collectively referred to herein as mass storage device 810.

[0066] Software 811 for execution on computer system 800 may be stored on mass storage device 810. Mass storage device 810 is an example of a tangible storage medium readable by processor 801, with software 811 stored as instructions for execution by processor 801 to operate computer system 800, as described later herein in conjunction with the various figures. Examples of computer program products and the execution of such instructions are described in more detail herein. Communications adapter 807 interconnects system bus 802 with network 812, which may be an external network, enabling computer system 800 to communicate with other such systems. In one embodiment, a portion of system memory 803 and mass storage device 810 collectively store an operating system, which may be any suitable operating system, such as the z / OS or AIX operating systems from IBM Corporation, for coordinating the functions of the various components shown in FIG. 8.

[0067] Additional input / output devices are shown connected to system bus 802 via display adapter 815 and interface adapter 816. In one embodiment, adapters 806, 807, 815, and 816 may be connected to one or more I / O buses that are connected to system bus 802 via an intermediate bus bridge (not shown). A display 819 (e.g., a screen or display monitor) is connected to system bus 802 by display adapter 815, which may include a graphics controller and a video controller to improve performance of graphics-intensive applications. A keyboard 821, mouse 822, speakers 823, etc. may be interconnected to system bus 802 via interface adapter 816, which may include, for example, a super I / O chip that integrates multiple device adapters into a single integrated circuit. I / O buses suitable for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include a common protocol such as Peripheral Component Interconnect (PCI). Thus, as configured in FIG. 8, computer system 800 includes processing capability in the form of processor 801, storage capability including system memory 803 and mass storage device 810, input means such as keyboard 821 and mouse 822, and output capability including speakers 823 and display 819.

[0068] In some embodiments, communications adapter 807 can transmit data using any suitable interface or protocol, such as an Internet Small Computer System Interface, among others. Network 812 may be a cellular network, a wireless network, a wide area network (WAN), a local area network (LAN), or the Internet, among others. External computing devices can connect to computer system 800 via network 812. In some examples, the external computing device may be an external web server or a cloud computing node.

[0069] It should be understood that the block diagram of Figure 8 is not intended to indicate that computer system 800 includes all of the components shown in Figure 8. Rather, computer system 800 may include any suitable fewer or additional components (e.g., additional memory components, embedded controllers, modules, additional network interfaces, etc.) not shown in Figure 8. Furthermore, the embodiments described herein with respect to computer system 800 may be implemented with any suitable logic, where logic referred to herein may, in various embodiments, include any suitable hardware (e.g., a processor, embedded controller, or application specific integrated circuit, etc.), software (e.g., an application, etc.), firmware, or any suitable combination of hardware, software, and firmware.

[0070] Various embodiments of the present invention are described herein with reference to the associated drawings. Alternate embodiments of the present invention may be devised without departing from the scope of the present invention. Various connections and relationships (e.g., above, below, adjacent, etc.) are defined between elements in the following description and in the drawings. These connections and / or relationships may be direct or indirect unless otherwise specified, and the present invention is not intended to be limited in this respect. Thus, coupling of entities may refer to either direct coupling or indirect coupling, and relationships between entities may be direct or indirect. Furthermore, various tasks and process steps described herein may be combined into a more comprehensive procedure or process having additional steps or functionality not described in detail herein.

[0071] One or more of the methods described herein may be implemented in any one or combination of the following technologies, each of which is well known in the art: discrete logic circuits having logic gates for implementing logic functions on data signals, application specific integrated circuits (ASICs) having appropriate combinatorial logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), and the like.

[0072] For the sake of brevity, prior art related to making and using aspects of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing various technical features described herein are well known. Thus, for the sake of brevity, details of many conventional implementations are only briefly mentioned herein or omitted entirely without providing details of well-known systems and / or processes.

[0073] In some embodiments, various functions or acts may be performed at a given location, or in connection with the operation of one or more devices or systems, or both. In some embodiments, some of a given function or act may be performed at a first device or location, and the remainder of the function or act may be performed at one or more additional devices or locations.

[0074] The terms used herein are for the purpose of describing particular embodiments only and are not intended to limit the invention. As used herein, the singular forms "a," "an," and "the" include the plural unless the context clearly dictates otherwise. Furthermore, as used herein, the terms "comprise" and / or "comprising" specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or groups thereof, or combinations thereof.

[0075] All corresponding structure, material, acts, and equivalent or step-plus-function elements in the following claims are intended to include any structure, material, or act for performing a function in combination with other claimed elements, as specifically claimed. This disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the precise form disclosed. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the disclosure. The embodiments were chosen and described to best explain the principles and practical applications of the disclosure and to enable those skilled in the art to understand the disclosure in various embodiments with various modifications suitable for the particular use contemplated.

[0076] The diagrams depicted herein are illustrative. Many variations are possible in the diagrams or the steps (or operations) described therein without departing from the spirit of the present disclosure. For example, operations may be performed in a different order, or operations may be added, deleted, or modified. Also, the term "coupled" describes that there is a signal path between two elements, and does not imply a direct connection between elements with no intervening elements / connections between them. All of these variations are considered part of the present disclosure.

[0077] The following definitions and abbreviations are used for interpreting the claims and the specification. As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," "contains," or "containing," or other variations thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or device consisting of a list of elements is not necessarily limited to only those elements and may include other elements not expressly listed or inherent in such composition, mixture, process, method, article, or device.

[0078] Moreover, the word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" are understood to include any integer greater than or equal to one, i.e., 1, 2, 3, 4, etc. The term "a plurality" is understood to include integers greater than or equal to two, i.e., 2, 3, 4, 5, etc. The term "connection" can include both an indirect and a direct connection.

[0079] The terms "about," "substantially," "approximately," and variations thereof are intended to include the degree of error associated with measurement of a particular quantity based on equipment available at the time of filing. For example, "about" can include a range of ±8%, 5%, or 2% of a given value.

[0080] The present invention may be a system, method, or computer program product, or combination thereof, integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium having stored thereon computer-readable program instructions for causing a processor to carry out aspects of the present invention.

[0081] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. The computer-readable storage medium may be, by way of example only, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or a suitable combination thereof. More specific, non-exhaustive examples of computer-readable storage media include portable computer diskettes, hard disks, RAM, ROM, EPROM (or flash memory), SRAM, CD-ROMs, DVDs, memory sticks, floppy disks, mechanically encoded devices having instructions recorded on punch cards or ridge-in-groove structures, or the like, and suitable combinations thereof. Computer-readable storage devices, as used herein, should not be construed as ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0082] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device via a network (e.g., the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof). The network may be comprised of copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within the respective computing / processing device.

[0083] Computer-readable program instructions for carrying out operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object-oriented programming languages ​​such as Smalltalk, C++, etc., and procedural programming languages ​​such as the "C" programming language and similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, as a standalone software package, or partially on the user's computer. Alternatively, the computer may be executed partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the computer-readable program instructions in order to carry out aspects of the present invention.

[0084] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0085] These computer-readable program instructions can be provided to a processor of a computer or other programmable data processing apparatus to create a machine, such that the instructions, when executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions can also be stored in a computer-readable storage medium connectable to a computer, programmable data processing apparatus, or other device, or combination thereof, that functions in a particular way, such that the computer-readable program instructions stored therein configure one of the products including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0086] Computer-readable program instructions, such as instructions to perform the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams on a computer, other programmable apparatus, or other device, can also be loaded into a computer, other programmable data processing apparatus, or other device to perform a series of operational steps on the computer, other programmable apparatus, or other device to produce a computer-implemented process.

[0087] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of executable implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which constitute one or more executable instructions for implementing the specified logical function(s). In some alternative embodiments, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be executed substantially concurrently, in a partially or fully overlapping manner, or the blocks may be executed in the reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations or executes a combination of special-purpose hardware and computer instructions.

[0088] The description of various embodiments of the present invention is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. It will be apparent to those skilled in the art that many modifications and variations are possible without departing from the scope and spirit of the invention. The terms used herein have been selected to best explain the principles of the embodiments, practical applications or technical improvements to technology found in the market, or to enable those skilled in the art to understand the embodiments described herein.

Claims

1. generating, by the processor, a value representing the degree to which a data point of system data, including computer hardware and software related data, affects robustness and performance of the computing system; clustering, by the processor, the data points, each cluster representing a respective temporal state of the computing system; converting, by the processor, each cluster into a three-dimensional representation based on the probability density of the data points in each cluster; generating, by the processor, a time base vector representing a transition from a first three-dimensional representation to a second three-dimensional representation, each three-dimensional representation traversed by the time base vector representing a respective state of the computing system; comparing, by the processor, the generated time base vector to a baseline vector; and issuing, by the processor, an anomaly alert based at least in part on the comparison.

2. determining whether a deviation of the time base vector from the baseline vector is due to a false positive anomaly based at least in part on the comparison; and determining whether deviations of the time base vector from the baseline vector are due to false negative anomalies based at least in part on the determination of false positives.

3. Determining whether the deviation of the time base vector from the baseline vector is due to a false positive anomaly includes: The start and end data points of the first leg of the time base vector are: determining whether the image is included in a first cluster and a second cluster that is temporally consecutive; and comparing the trajectory of the first leg of the time base vector to the trajectory of the first leg of the baseline vector to determine whether the trajectories deviate significantly from a threshold deviation.

4. 3. The computer-implemented method of claim 2, wherein determining whether the deviation of the time base vector from the baseline vector is due to a false negative of the anomaly comprises comparing a sequence of state transitions represented by the time base vector to a sequence of state transitions represented by the baseline vector.

5. The computer-implemented method of claim 2 , further comprising issuing the anomaly alert based on the determination that the deviation does not indicate a false positive.

6. The computer-implemented method of claim 2 , further comprising issuing the anomaly alert based on the false negative determination.

7. The computer-implemented method of claim 1 , wherein converting the clusters into a three-dimensional representation is based on a probability distribution of the data points in each cluster.

8. a memory having computer readable instructions; one or more processors for executing the computer-readable instructions, the computer-readable instructions controlling the one or more processors to perform operations, the operations including: generating a value representing the degree to which a data point of system data, including computer hardware and software related data, affects the robustness and performance of the computing system; clustering the data points, each cluster representing a respective temporal state of the computing system; converting each cluster into a three-dimensional representation based on the probability density of the data points in each cluster; generating a time base vector representing a transition from a first three-dimensional representation to a second three-dimensional representation, each three-dimensional representation traversed by the time base vector representing a respective state of the computing system; comparing the generated time base vector to a baseline vector; and issuing an anomaly alert based at least in part on said comparison.

9. The operation is determining whether a deviation of the time base vector from the baseline vector is due to a false positive anomaly based at least in part on the comparison; and determining whether deviations of the time base vector from the baseline vector are due to false negative anomalies based at least in part on the determination of false positives.

10. Determining whether the deviation of the time base vector from the baseline vector is due to a false positive anomaly includes: The start and end data points of the first leg of the time base vector are: determining whether the image is included in a first cluster and a second cluster that is temporally consecutive; and comparing the trajectory of the first leg of the time base vector to the trajectory of the first leg of the baseline vector to determine whether the trajectories deviate significantly from a threshold deviation.

11. 10. The system of claim 9, wherein determining whether the deviation of the time base vector from the baseline vector is due to a false negative for the anomaly comprises comparing a sequence of state transitions represented by the time base vector to a sequence of state transitions represented by the baseline vector.

12. The system of claim 9 , further comprising issuing the anomaly alert based on the determination that the deviation does not indicate a false positive.

13. The system of claim 9 , further comprising issuing an alert based on the false negative determination.

14. The system of claim 8 , wherein converting the clusters into a three-dimensional representation is based on a probability distribution of the data points in each cluster.

15. Generating a value representing the degree to which a data point of system data, including computer hardware and software related data, affects the robustness and performance of a computing system; clustering the data points, each cluster representing a respective temporal state of the computing system; converting each cluster into a three-dimensional representation based on the probability density of the data points in each cluster; generating a time base vector representing a transition from a first three-dimensional representation to a second three-dimensional representation, each three-dimensional representation traversed by the time base vector representing a respective state of the computing system; comparing the generated time base vector to a baseline vector; and issuing an abnormality alert based at least in part on said comparison.

16. The operation is determining whether a deviation of the time base vector from the baseline vector is due to a false positive anomaly based at least in part on the comparison; and determining whether a deviation of the time base vector from the baseline vector is due to a false negative anomaly based at least in part on the determination of a false positive.

17. Determining whether the deviation of the time base vector from the baseline vector is due to a false positive anomaly includes: determining whether a start data point and an end data point of a first leg of the time base vector are included in a first cluster and a second cluster that is temporally contiguous with the first cluster, respectively; and comparing a trajectory of the first leg of the time base vector to a trajectory of the first leg of the baseline vector to determine whether the trajectories deviate significantly from a threshold deviation.

18. 17. The computer program product of claim 16, wherein determining whether the deviation of the time base vector from the baseline vector is due to a false negative for the anomaly comprises comparing a sequence of state transitions represented by the time base vector to a sequence of state transitions represented by the baseline vector.

19. The computer program product of claim 16 , further comprising issuing the anomaly alert based on the determination that the deviation does not indicate a false positive.

20. The computer program of claim 15 , wherein converting the clusters into a three-dimensional representation is based on a probability distribution of the data points in each cluster.

Images