ML Anomaly Detection for Multi-Tenant Data Center Resource Correlation

The patent introduces a machine learning-based anomaly detection engine as an intermediary component that sits between the multi-tenant execution environment and the monitoring system. This engine processes data from multiple data streams (workload metadata, performance metrics, logs) and uses trained machine learning models to dynamically detect anomalies, misconfigurations, and misuse. The intermediary handles the complexity of analyzing ephemeral and distributed workload data, transforming it into actionable anomaly detections without requiring changes to the underlying multi-tenant infrastructure.

The system implements continuous feedback loops where the anomaly detection engine constantly monitors data streams, compares actual system state against learned normal patterns, and generates anomaly detections that can trigger automated responses. The machine learning models are trained on historical data and continuously refined based on detected anomalies, creating a feedback mechanism that improves detection accuracy over time. This feedback approach enables dynamic adaptation to changing workload patterns while maintaining reliable anomaly detection.

The patent segments the data processing task into distinct functional components: data collection from multiple streams, data correlation through search engines, anomaly detection through machine learning models, and automated response generation. Each component handles a specific aspect of the complex processing task independently. The system collects data from segmented sources (workload metadata, performance metrics, logs) and processes them through segmented analytical pipelines, reducing the complexity of handling the entire data set monolithically.

The patent introduces intermediary components including a search engine that correlates data across multiple streams and a machine learning-based anomaly detection engine that processes correlated data. These intermediaries act as buffers and processors between raw data collection and final analysis, breaking down the complex processing task into manageable stages. The search engine intermediates between raw log data and anomaly detection by performing correlation and filtering, while the ML engine intermediates between correlated data and final anomaly determination.

The patent implements preliminary action by pre-training machine learning models on historical workload data before deployment. The system collects and stores historical data from multiple data streams, trains anomaly detection models on this data to learn normal patterns and anomalies, and stores the trained models for rapid inference. This preliminary training phase separates the computationally intensive model development from real-time anomaly detection, allowing fast processing during operation while maintaining high detection accuracy through pre-learned patterns.

The system applies partial action by focusing machine learning processing on specific anomaly detection tasks rather than analyzing all data equally. The anomaly detection engine processes only correlated portions of data streams that are most relevant to anomaly identification, using the search engine to filter and prioritize data. This selective processing reduces computational overhead while maintaining detection accuracy by concentrating resources on the most informative data subsets.