Method And System For Real-Time, Load-Driven Multidimensional And Hierarchical Classification Of Monitored Transaction Executions For Visualization And Analysis Tasks Like Statistical Anomaly Detection

摘要

A system and method is disclosed that analyzes a set of historic transaction traces to identify an optimized set of transaction clusters with the highest transaction frequency. The transaction clusters are defined according to multiple parameters describing the execution context of the analyzed transactions. The transaction clusters are described by coordinates in a multidimensional, hierarchical classification space. Descriptive statistical data is extracted from historic transactions corresponding to previously identified transaction clusters and stored as reference data. Transaction trace data from currently executed transactions is analyzed to find a best matching historic transaction cluster. The current transaction traces are grouped according to their corresponding historic transaction cluster. Statistical data is extracted from those groups of current transaction trace and statistical test are performed that compare current and historic data on a per historic transaction cluster basis to identify deviations in performance and functional behavior of current and historic transactions.

主权项

1. A computer-implemented method for detecting anomalies in a performance metric associated with transactions of a distributed computing environment, comprising:
receiving, by a historic category extractor, a plurality of previous transaction events resulting from transactions executed in the distributed computing environment, where each transaction event includes one or more classification parameters for the associated transaction; identifying, by the historic category extractor, a listing of top n categories from the plurality of previous transaction events, where the top n categories correlate to classification parameters from a subset of previous transaction events which meet a selection criteria and the top n categories are arranged hierarchically such that a particular category is a root category or has one or more parent categories, where a parent category is more generic than the particular category; for each transaction event in the plurality of previous transaction events, determining, by a historic category description extractor, categories in the listing of top n categories that match the classification parameters in a given previous transaction event, extracting a measurement value for a given performance metric from the given previous transaction event and updating a historic distribution parameter for the given performance metric associated with matched categories using the extracted measurement value for the given performance metric; receiving, by a current category measure extractor, a plurality of current transactions events resulting from transactions executed in the distributed computing environment, where the plurality of current transaction event occurred more recently than the plurality of previous transaction events; for each transaction event in the plurality of current transaction events, determining, by the current category measure extractor, categories in the listing of top n categories that match the classification parameters in a given current transaction event, extracting a measurement value for the given performance metric from the given current transaction event and updating a current distribution parameter for the given performance metric associated with matched categories using the extracted measurement value for the given performance metric; and comparing, by a statistical anomaly detector, the current distribution parameter to the historic distribution parameter to detect anomalies in the given performance metric.