Anomaly detection in computer systems

1 . A computer-implemented method comprising:

obtaining first event data for a first computer system, wherein the first computer system is a computer system for which an anomaly-detection model is being trained, wherein the first event data includes subject event data originating from the first computer system;

obtaining second event data for a second computer system, wherein the second computer system is a computer system other than the first computer system, wherein the second event data includes foreign event data originating from the second computer system, wherein the foreign event data is adapted via metric classification, wherein the metric classification identifies differences between a format of the subject event data and a format of the foreign event data and performs an action to eliminate the differences;

identifying a first shape of the first event data, wherein identifying the first shape of the first event data includes graphing the first event data on a first graph;

identifying a second shape of the adapted second event data, wherein identifying the second shape of the adapted second event data includes graphing the adapted second event data on a second graph;

calculating a shape similarity between the first shape and the second shape, wherein calculating the shape similarity includes inputting the first graph and the second graph into an image-processing neural network, wherein the image-processing neural network analyzes a picture of the first graph and a picture of the second graph and assigns a first overall shape to an aggregation of data points plotted on the first graph and assigns a second overall shape to an aggregation of data points plotted on the second graph;

determining that the shape similarity is above a similarity threshold, wherein determining that the shape similarity is above the similarity threshold includes using the image-processing neural network to overlay the first overall shape and the second overall shape on top of each other and to compute a number of pixels between the first overall shape and the second overall shape that overlap and a number of pixels between the first overall shape and the second overall shape that do not overlap;

generating, based on the determining, training features from the first event data and the adapted second event data; and

inputting the training features into the anomaly-detection model.

2 . The method of claim 1 , further comprising:

equalizing a measurement window between the first event data and the second event data.

3 . The method of claim 1 , further comprising:

equalizing a measurement frequency between the first event data and the second event data.

4 . The method of claim 1 , further comprising:

plotting the second event data on a cartesian coordinate system;

eliminating outlier data from the second event data; and

converting the cartesian coordinate system to a polar coordinate system.

5 . The method of claim 4 , wherein the training features are generated, in part, from the second event data using the polar coordinate system.

6 . The method of claim 4 , wherein the method further comprises:

identifying a reference distance data point in the second event data in the polar coordinate system;

expressing a distance between a remaining data point on the polar coordinate system as a proportion of the distance between the reference distance data point and a pole on the polar coordinate system.

7 . The method of claim 1 , wherein the inputting causes the anomaly-detection model to be trained to detect anomalies in computer systems, and wherein the method further comprises: utilizing the anomaly-detection model, after the inputting, to detect anomalies in a third computer system.

8 . A system comprising:

a processor; and

a memory in communication with the processor, the memory containing program instructions that, when executed by the processor, are configured to cause the processor to perform a method, the method comprising:

obtaining first event data for a first computer system, wherein the first computer system is a computer system for which an anomaly-detection model is being trained, wherein the first event data includes subject event data originating from the first computer system;

obtaining second event data for a second computer system, wherein the second computer system is a computer system other than the first computer system, wherein the second event data includes foreign event data originating from the second computer system, wherein the foreign event data is adapted via metric classification, wherein the metric classification identifies differences between a format of the subject event data and a format of the foreign event data and performs an action to eliminate the differences;

identifying a first shape of the first event data, wherein identifying the first shape of the first event data includes graphing the first event data on a first graph;

identifying a second shape of the adapted second event data, wherein identifying the second shape of the adapted second event data includes graphing the adapted second event data on a second graph;

calculating a shape similarity between the first shape and the second shape, wherein calculating the shape similarity includes inputting the first graph and the second graph into an image-processing neural network, wherein the image-processing neural network analyzes a picture of the first graph and a picture of the second graph and assigns a first overall shape to an aggregation of data points plotted on the first graph and assigns a second overall shape to an aggregation of data points plotted on the second graph;

determining that the shape similarity is above a similarity threshold, wherein determining that the shape similarity is above the similarity threshold includes using the image-processing neural network to overlay the first overall shape and the second overall shape on top of each other and to compute a number of pixels between the first overall shape and the second overall shape that overlap and a number of pixels between the first overall shape and the second overall shape that do not overlap;

generating, based on the determining, training features from the first event data and the adapted second event data; and

inputting the training features into the anomaly-detection model.

9 . The system of claim 8 , wherein the method performed by the processor further comprises equalizing a measurement window between the first event data and the second event data.

10 . The system of claim 8 , wherein the method performed by the processor further comprises equalizing a measurement frequency between the first event data and the second event data.

11 . The system of claim 8 , wherein the method performed by the processor further comprises

identifying a reference distance data point in the first event data in a polar coordinate system; and

expressing a distance between a remaining data point on the polar coordinate system as a proportion of the distance between the reference distance data point and a pole on the polar coordinate system.

12 . A computer program product, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to:

obtain first event data for a first computer system, wherein the first computer system is a computer system for which an anomaly-detection model is being trained, wherein the first event data includes subject event data originating from the first computer system;

obtain second event data for a second computer system, wherein the second computer system is a computer system other than the first computer system, wherein the second event data includes foreign event data originating from the second computer system, wherein the foreign event data is adapted via metric classification, wherein the metric classification identifies differences between a format of the subject event data and a format of the foreign event data and performs an action to eliminate the differences;

identify a first shape of the first event data, wherein identifying the first shape of the first event data includes graphing the first event data on a first graph;

identify a second shape of the adapted second event data, wherein identifying the second shape of the adapted second event data includes graphing the adapted second event data on a second graph;

calculate a shape similarity between the first shape and the second shape, wherein calculating the shape similarity includes inputting the first graph and the second graph into an image-processing neural network, wherein the image-processing neural network analyzes a picture of the first graph and a picture of the second graph and assigns a first overall shape to an aggregation of data points plotted on the first graph and assigns a second overall shape to an aggregation of data points plotted on the second graph;

determine that the shape similarity is above a similarity threshold, wherein determining that the shape similarity is above the similarity threshold includes using the image-processing neural network to overlay the first overall shape and the second overall shape on top of each other and to compute a number of pixels between the first overall shape and the second overall shape that overlap and a number of pixels between the first overall shape and the second overall shape that do not overlap;

generate, based on the determining, training features from the first event data and the adapted second event data; and

input the training features into the anomaly-detection model.

13 . The computer program product of claim 12 , wherein the program instructions are further executable by the computer to cause the computer to equalize a measurement window between the first event data and the second event data.

14 . The computer program product of claim 12 , wherein the program instructions are further executable by the computer to cause the computer to equalize a measurement frequency between the first event data and the second event data.

15 . The computer program product of claim 12 , wherein the program instructions are further executable by the computer to:

plot the second event data on a cartesian coordinate system;

eliminate outlier data from the second event data; and

convert the cartesian coordinate system to a polar coordinate system.