Integration based anomaly detection service

摘要

Systems and methods are provided for analyzing operating metrics of monitored metric sources. Aspects of the present disclosure may present for display information associated with the monitored metric source and the analysis of its operating metrics. Analysis comprises determination of reference values and tolerance levels which represent allowable deviations from the reference values. Input data includes a measurement of an operating parameter and a time stamp. Input data may be saved to a data store for using in future analysis of other input data. When input data is determined to be outside the tolerance level, notifications may be issued to alert administrators or systems of the anomaly.

主权项

1. A system comprising:
a memory storing computer-executable instructions; and a computer processor in communication with the memory, the computer processor programmed by the computer-executable instructions to at least:
receive, from a monitored source, current input data regarding an operating parameter at a current time, wherein the operating parameter relates to performance of a computing system;analyze prior input data regarding the operating parameter to determine an expected change in the operating parameter, wherein the prior input data reflects a value of the operating parameter at each of a plurality of prior times;determine, based at least in part on the values of the operating parameter at each of the plurality of prior times, a particular time at which the expected change in the operating parameter is expected to occur;determine that the current time corresponds to the particular time;analyze the current input data and at least a portion of the prior input data to determine a current change in the operating parameter;determine, based at least in part on the values of the operating parameter at each of the plurality of prior times, a permitted relationship to the expected change;determine that the current change does not satisfy the permitted relationship with the expected change;in response to determining that the current change does not satisfy the permitted relationship, generate an anomaly notification; andcause display of a graphical interface presenting the anomaly notification, wherein the graphical interface is configured to obtain an indication that the anomaly notification is erroneous.