Passive and comprehensive hierarchical anomaly detection system and method
A technique for monitoring performance in a network uses passively monitored traffic data at the server access routers. The technique aggregates performance metrics into clusters according to a spatial hierarchy in the network, and then aggregates performance metrics within spatial clusters to form time series of temporal bins. Representative values from the temporal bins are then analyzed using an enhanced Holt-Winters exponential smoothing algorithm.
1. A method for detecting an anomaly event in a computer network comprising a plurality of clients, comprising:
determining, by a computer, a plurality of series performance metrics, each one of the series performance metrics representing a time series of performance measurements of connections made to one of the plurality of clients;
spatially aggregating, by the computer, the series performance metrics according to a spatial hierarchy to create a plurality of spatial clusters;
in each spatial cluster of the plurality of spatial clusters, temporally aggregating, by the computer, series performance metrics to form a time series of temporal bins;
for each temporal bin of the time series of temporal bins, determining, by the computer, an actual temporal bin metric representative of time series performance metrics in the temporal bin; and
for each temporal bin of the time series of temporal bins:
determining, by the computer, a forecast temporal bin metric from actual temporal bin metrics determined for temporal bins preceding the temporal bin; and
comparing, by the computer, an actual temporal bin metric of the temporal bin with the forecast temporal bin metric to detect the anomaly event.
2. The method of claim 1 , wherein the performance measurements of connections made to one of the plurality of clients comprise client round trip time measurements.
3. The method of claim 2 , wherein the round trip time measurements are separated from each other by at least 600 seconds.
4. The method of claim 2 , further comprising:
suppressing client round trip time measurements by using only a minimum round trip time measurement in each of a plurality of time windows.
5. The method of claim 1 , wherein spatially aggregating the representative series performance metrics comprises aggregating according to a requesting client IP address.
6. The method of claim 1 , wherein spatially aggregating the representative series performance metrics comprises aggregating into spatial clusters based on at least one of a subnet, a border gateway protocol prefix, an autonomous system path and an Internet service provider egress router level.
7. The method of claim 1 , wherein determining actual temporal bin metrics for each temporal bin comprises determining a median of the time series performance metrics in the temporal bin.
8. The method of claim 1 , wherein comparing an actual temporal bin metric of the temporal bin with the forecast temporal bin metric to detect the anomaly event further comprises using an enhanced Holt-Winters anomaly detection algorithm.
9. A non-transitory computer-readable medium having computer readable instructions stored thereon for execution by one or more processors to perform a method for detecting anomaly events in a computer network comprising a plurality of clients, the method comprising:
determining a plurality of series performance metrics, each one of the series performance metrics representing a time series of performance measurements of connections made to one of the plurality of clients;
spatially aggregating the series performance metrics according to a spatial hierarchy to create a plurality of spatial clusters including a first spatial cluster;
in each spatial cluster of the plurality of spatial clusters, temporally aggregating series performance metrics to form a time series of temporal bins;
for each temporal bin of the time series of temporal bins, determining an actual temporal bin metric representative of time series performance metrics in the temporal bin; and
for a each temporal bin of the time series of temporal bins:
determining a forecast temporal bin metric from actual temporal bin metrics determined for temporal bins preceding the temporal bin; and
comparing an actual temporal bin metric of the temporal bin with the forecast temporal bin metric to detect the anomaly event.
10. The non-transitory computer-readable medium of claim 9 , wherein the performance measurements of connections made to one of the plurality of clients comprise client round trip time measurements.
11. The non-transitory computer-readable medium of claim 9 , wherein spatially aggregating the representative series performance metrics comprises aggregating according to a requesting client IP address.
12. The non-transitory computer-readable medium of claim 9 , wherein spatially aggregating the representative series performance metrics comprises aggregating into spatial clusters based on at least one of a subnet, a border gateway protocol prefix, an autonomous system path and an Internet service provider egress router level.
13. The non-transitory computer-readable medium of claim 9 , wherein determining actual temporal bin metrics for each temporal bin comprises determining a median of the time series performance metrics in the temporal bin.
14. The non-transitory computer-readable medium of claim 9 , wherein comparing an actual temporal bin metric of the temporal bin with the forecast temporal bin metric to detect the anomaly event further comprises using an enhanced Holt-Winters anomaly detection algorithm.
15. The non-transitory computer-readable medium of claim 10 , wherein the round trip time measurements are separated from each other by at least 600 seconds.
16. The non-transitory computer-readable medium of claim 10 , the method further comprising:
suppressing client round trip time measurements by using only a minimum round trip time measurement in each of a plurality of time windows.