Systems and methods for automated anomaly detection

1 . A computer-implemented method comprising:

receiving, by a data storage module, time-series data from a plurality of sensors of an information technology infrastructure, each sensor of the plurality of sensors corresponding to a respective metric of a plurality of metrics;

detecting a plurality of anomalies in the time-series data stored in the data storage module;

generating a knowledge graph by:

determining a plurality of connections between the plurality of metrics based on the time-series data, wherein each connection of the plurality of connections is determined between a respective pair of metrics of the plurality of metrics; and

for each connection of the plurality of connections:

determining an impact score for the respective pair of metrics based on (i) one or more anomaly scores determined for the respective pair of metrics, (ii) a correlation score determined for the respective pair of metrics, and (iii) a support value determined for the respective pair of metrics using frequent item-set mining; and

determining a respective weight for each connection between the respective pair of metrics based on the impact score; and

configuring a root cause determination engine to determine and output one or more metrics of the plurality of metrics as one or more root cause candidates of the plurality of anomalies, the one or more metrics determined based on the knowledge graph, in response to receiving input of a query associated with at least one metric of the plurality of metrics.

2 . The computer-implemented method of claim 1 , wherein the data storage module continuously receives the time-series data, such that the knowledge graph is continuously updated.

3 . The computer-implemented method of claim 1 , wherein the data storage module periodically receives the time-series data, such that the knowledge graph is periodically updated.

4 . The computer-implemented method of claim 1 , wherein each of the one or more root cause candidates includes a set of the time-series data determined to likely be associated with at least one of the plurality of anomalies.

5 . The computer-implemented method of claim 1 , further including:

determining that an alert threshold, based on a number of the plurality of anomalies, has been breached, wherein the alert threshold is based on the received time-series data.

6 . The computer-implemented method of claim 5 , wherein the alert threshold is determined automatically based on the plurality of anomalies.

7 . The computer-implemented method of claim 1 , wherein the impact score for the respective pair of metrics represents a magnitude of impact of the respective pair of metrics as the plurality of anomalies are occurring.

8 . The computer-implemented method of claim 1 , wherein a plurality of primary anomaly scores are determined for each metric of the plurality of metrics, and the one or more anomaly scores determined for the respective pair of metrics include a first primary anomaly score for a first metric of the respective pair of metrics and a second primary anomaly score for a second metric of the respective pair of metrics.

9 . The computer-implemented method of claim 1 , wherein a plurality of secondary anomaly scores are determined for the plurality of metrics, and the method further comprises:

determining correlation values based on the plurality of secondary anomaly scores; and

storing the correlation values in a data store, wherein the frequent item-set mining is applied to the stored correlation values.

10 . A system comprising:

a plurality of sensors associated with an information technology infrastructure, each sensor of the plurality of sensors corresponding to a respective metric of a plurality of metrics;

one or more processors operatively connected to the plurality of sensors; and

one or more non-transitory computer readable media storing processor-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, by a data storage module, time-series data from the plurality of sensors;

detecting a plurality of anomalies in the time-series data stored in the data storage module;

generating a knowledge graph by:

determining a plurality of connections between the plurality of metrics based on the time-series data, wherein each connection of the plurality of connections is determined between a respective pair of metrics of the plurality of metrics; and

for each connection of the plurality of connections:

determining an impact score for the respective pair of metrics based on (i) one or more anomaly scores determined for the respective pair of metrics, (ii) a correlation score determined for the respective pair of metrics, and (iii) a support value determined for the respective pair of metrics using frequent item-set mining; and

determining a respective weight for each connection between the respective pair of metrics based on the impact score; and

configuring a root cause determination engine to determine and output one or more metrics of the plurality of metrics as one or more root cause candidates of the plurality of anomalies, the one or more metrics determined based on the knowledge graph, in response to receiving input of a query associated with at least one metric of the plurality of metrics.

11 . The system of claim 10 , wherein the data storage module continuously receives the time-series data, such that the knowledge graph is continuously updated.

12 . The system of claim 10 , wherein the data storage module periodically receives the time-series data, such that the knowledge graph is periodically updated.

13 . The system of claim 10 , wherein each of the one or more root cause candidates is a set of the time-series data determined to likely cause at least one of the plurality of anomalies.

14 . The system of claim 10 , wherein the operations further include:

determining that an alert threshold, based on a number of the plurality of anomalies, has been breached, wherein the alert threshold is based on the received time-series data.

15 . The system of claim 14 , wherein the alert threshold is determined automatically based on the plurality of anomalies.

16 . One or more non-transitory computer readable media storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving, by a data storage module, time-series data from a plurality of sensors of an information technology infrastructure, each sensor of the plurality of sensors corresponding to a respective metric of a plurality of metrics;

detecting a plurality of anomalies in the time-series data stored in the data storage module;

generating a knowledge graph by:

determining a plurality of connections between the plurality of metrics based on the time-series data, wherein each connection of the plurality of connections is determined between a respective pair of metrics of the plurality of metrics; and

for each connection of the plurality of connections:

determining an impact score for the respective pair of metrics based on (i) one or more anomaly scores determined for the respective pair of metrics, (ii) a correlation score determined for the respective pair of metrics, and (iii) a support value determined for the respective pair of metrics using frequent item-set mining; and

determining a respective weight for each connection between the respective pair of metrics based on the impact score; and

providing a root cause determination engine configured to determine and output one or more metrics of the plurality of metrics as one or more root cause candidates of the plurality of anomalies, the one or more metrics determined based on the knowledge graph, in response to receiving input of a query associated with at least one metric of the plurality of metrics.

17 . The one or more non-transitory computer readable media of claim 16 , wherein the data storage module continuously receives the time-series data, such that the knowledge graph is continuously updated.

18 . The one or more non-transitory computer readable media of claim 16 , wherein the data storage module periodically receives the time-series data, such that the knowledge graph is periodically updated.

19 . The one or more non-transitory computer readable media of claim 16 , wherein each of the one or more root cause candidates is a set of the time-series data determined to likely cause at least one of the plurality of anomalies.

20 . The one or more non-transitory computer readable media of claim 16 , wherein the operations further include:

determining that an alert threshold, based on a number of the plurality of anomalies, has been breached, wherein the alert threshold is based on the received time-series data.