Integration based anomaly detection service

摘要

Systems and methods are provided for analyzing operating metrics of monitored metric sources. Aspects of the present disclosure may present for display information associated with the monitored metric source and the analysis of its operating metrics. Analysis comprises determination of reference values and tolerance levels which represent allowable deviations from the reference values. Input data includes a measurement of an operating parameter and a time stamp. Input data may be saved to a data store for using in future analysis of other input data. When input data is determined to be outside the tolerance level, notifications may be issued to alert administrators or systems of the anomaly.

主权项

1. A system comprising:
an electronic data store that stores one or more reference value definitions and one or more permitted relationship definitions, wherein at least one reference value definition and at least one permitted relationship definition are associated with a monitored metric source, and wherein the permitted relationship definition represents a permitted relationship to the reference value; and a computing device in communication with the electronic data store, the computing device operative to at least:
receive input data for the monitored metric source, the input data comprising a time stamp and a data value, wherein the data value represents an operating property of the monitored metric source at a point in time represented by the time stamp;apply the at least one permitted relationship definition associated with the monitored metric source to the input data received for the monitored metric source, wherein applying the at least one permitted relationship definition comprises:
determining a function that approximates, as a function of time, a rate of change in a plurality of data values representing the operating property at different points in time;determining a reference value satisfying the reference value definition, wherein the reference value is based at least partly on an area under a curve of the function, the area under the curve corresponding to a sum total of changes in the operating property over a time period;determining a current rate of change of the operating property based at least partly on the input data;observing a relationship between the current rate of change and the reference value; andcomparing the observed relationship to the permitted relationship represented in the permitted relationship definition in order to detect an anomaly in the monitored metric source; andissue an electronic anomaly notification when the observed relationship is not a permitted relationship.