A real-time system-adapted anomaly detector
We present techniques for detecting anomalies in the performance of computer systems. We take both "performance" and "computer systems" quite generally. We assume that samples of performance data are available both in real-time and also historically from past normal performance of the target system. In addition we assume that there is some vector space and each sample is a point in that vector space. Detections are made by comparing the most recent sample of data with the historical data, thus yielding detections in real-time which are adaptive to the particular target system. Our techniques are probabilistic but are distribution-free and otherwise make relatively mild assumptions. We present some supporting mathematics that shows how to select the false alarm rate. We address detection rate with a general theorem and also with a specific simulation experiment. The data used can be of wide variety, possibly finely grained, and can be collected from hardware, system software, software subsystems, applications, or distributed applications. Our techniques may be of value in various aspects of future computer systems and in other systems as well. (C) 1999 Elsevier Science Inc. All rights reserved.
adaptive distribution-free computer performance monitoring computer system management parallel computing distributed computing artificial intelligence machine learning anomaly detection multidimensional nearest-neighbors hypothesis tests tightness