Patent ID: 7620523

Claim:
A method comprising: 1. initializing a system for determining anomalous event states in an information technology (IT) infrastructure by: (a) collecting historical time-series data for a metric in the IT infrastructure for at least one monitoring period, each monitoring period having a plurality of timeslots and each timeslot observing metric data at least once; (b) screening the historical data to remove abnormal metric data to form a non-abnormal historical data set; (c) collecting each data point from the non-abnormal historical data set into a timeslot historical data set that corresponds with the timeslot from which each data point was collected historically; (d) simulating m monitoring periods by: (i) generating a simulated time-series data stream comprising randomly selected data points selected from the timeslot historical data set corresponding to the same timeslot in the simulated time-series data stream; (ii) calculating a cumulative sum value for each simulated randomly selected data point; and (iii) determining a maximum cusum value (max {S n } m ) for the simulated monitoring period, where n is an indicator of sequential position of each data point in the data stream to create a set {max{S n } 1 , max{S n } 2 ,...,max{S n } m }; and (e) selecting as a threshold max{max{S n } 1 , max{S n } 2 ,...,max{S n } m }; 2. comparing incoming data for each metric against the threshold by performing a cumulative sum analysis on a set of incoming metric data in real time by calculating a cumulative sum value for each metric and comparing the cumulative sum value to the threshold to detect anomalous events: and 3. initiating an alert state when an anomalous event is detected that effects at least one response to address the conditions triggering the anomalous event in the affected component of the IT infrastructure: wherein each cumulative sum value is calculated by adding to the previous cumulative sum value the difference between the value of a metric and a value for normal behavior for a current timeslot within the monitoring period: and wherein if the calculation of the cumulative sum value is negative, it is set to zero.