Cloud anomaly detection using normalization, binning and entropy determination

摘要

Illustrated is a system and method for anomaly detection in data centers and across utility clouds using an Entropy-based Anomaly Testing (EbAT), the system and method including normalizing sample data through transforming the sample data into a normalized value that is based, in part, on an identified average value for the sample data. Further, the system and method includes binning the normalized value through transforming the normalized value into a binned value that is based, in part, on a predefined value range for a bin such that a bin value, within the predefined value range, exists for the sample data. Additionally, the system and method includes identifying at least one vector value from the binned value. The system and method also includes generating an entropy time series through transforming the at least one vector value into an entropy value to be displayed as part of a look-back window.

主权项

1. A computer implemented method comprising:
normalizing sample data through transforming the sample data into a normalized value that is based, in part, on an identified average value for the sample data; binning the normalized value through transforming the normalized value into a binned value that is based, in part, on a predefined value range for a bin such that a bin value, within the predefined value range, exists for the sample data; identifying at least one vector value from the binned value; generating an entropy time series through transforming the at least one vector value into an entropy value to be displayed as part of a look-back window using the equation:H⁡(E)=-∑i=1v⁢nin⁢log⁢⁢ninwhere v is the total number of unique vector values in n samples and ni is the count vector value in the n samples; and
using H(E) to generate an additional entropy time series represented by an additional equation:A=∑i=1c⁢Hi+∏i=1c⁢Hiwhere c represents at least one child node, and Hi represents H(E).