Patent ID: 7647524

Claim:
A computer implemented anomaly detection method comprising: a step of monitoring a program for a fault on the basis of a probabilistic model to automatically detect a fault, said program being run through cooperation between computers in a computer system forming a network consisting of a plurality of computers; a recording step performed by an agent module of associating and recording transactions with a service, said transactions being processes of said service performed by each of said plurality of computers in response to a call from a program running on another of said plurality of computers; and steps performed by an anomaly monitoring server connected to said network, comprising: a transaction collecting step of collecting transactions recorded by said agent module from each of said plurality of computers; a correlation matrix calculating step of outputting a node correlation matrix calculated from said transactions collected from each of said plurality of computers; an activity vector calculating step of calculating an activity vector by solving an equation specific to said node correlation matrix; a probability estimating step of estimating the probability of occurrence of said activity vector; and a fault detecting step of calculating an outlier measure of the activity vector from a probability density estimated in said probability estimating step to automatically detect a fault in the program being run through cooperation between said plurality of computers.