Cost anomaly detection in cloud data protection
Systems and methods for detecting cost anomalies in a data protection system. Data is collected for assets of a data protection system operating in a cloud. The data often relates to cost and may constitute time series. The time series are then analyzed by performing a fitting competition using multiple models. The best fitting model is selected and the residuals are analyzes to find outliers and produce a normal zone for the signal. The outliers can identify cost anomalies that may reflect the health of the data protection system.
1. A method for detecting cost-anomalies in a disaster recovery system, the method comprising:
collecting data from assets associated with the disaster recovery system, the data including time series data;
performing a plurality of time series analysis on at least a time series included in the time series data using a plurality of models, wherein each of the plurality of models is configured to determine expected values of the time series;
determining that a first model from the plurality of models provides a best fit to the time series;
determining a normal zone for the time series based on residuals of the first model, wherein the residuals include differences between the expected values and actual values of the time series and wherein both an upper limit and a lower limit of the normal zone are adjustable to control a sensitivity;
determining outliers associated with the time series by applying the normal zone to an output of the first model, wherein a number of the determined outliers is based on the sensitivity;
determining a cause of the outliers in the disaster recovery system; and
alerting a user to newly detected outliers.
2. The method of claim 1 , wherein each asset is associated with a unique identifier.
3. The method of claim 2 , wherein the collected data includes a plurality of time series, wherein a first time series is associated with the disaster recovery system, a second time series is associated with a particular asset, and a third time series is associated with a plurality of the assets.
4. The method of claim 1 , wherein the plurality of time series analysis includes a regression operation.
5. The method of claim 1 , further comprising determining that an outlier is incorrectly classified and changing the classification of the outlier.
6. The method of claim 1 , further comprising performing the plurality of time series analysis such that at least a subset of business patterns are included in the analysis.
7. The method of claim 6 , further comprising detecting a potential new business pattern.
8. The method of claim 1 , further comprising displaying results in a calendar or in a graph.
9. A system configured to detect cost-anomalies in a disaster recovery system, the system comprising:
storage, processors, and memory, wherein the storage processors and memory are configured to:
collect data from assets associated with the disaster recovery system and stored in the storage, wherein the collected data is stored in the storage as a plurality of time series;
perform a plurality of time series analysis on at least a time series included in the plurality of time series using a plurality of models on the collected data, wherein each of the plurality of models is configured to determine expected values of the time series;
determine that a first model from the plurality of models provides a best fit to the time series;
determine a normal zone for the time series based on residuals of the first model, wherein the normal zone includes an upper limit and a lower limit and wherein the residuals include differences between the expected values and actual values of the time series and wherein both an upper limit and a lower limit of the normal zone are adjustable to control a sensitivity;
determine outliers associated with the time series by applying the normal zone to an output of the first model, wherein the outliers are outside of the normal zone, wherein the outliers include the cost anomalies in the disaster recovery system and wherein a number of the determined outliers is based on the sensitivity;
determining a cause of the outliers in the disaster recovery system; and
alerting a user to newly detected outliers.
10. The system of claim 9 , wherein each asset is associated with a unique identifier.
11. The system of claim 10 , wherein the plurality of time series includes at least one of a first time series s associated with the disaster recovery system, a second time series associated with a particular asset, and a third time series associated with a plurality of the assets.
12. The system of claim 9 , wherein the plurality of time series analysis includes a regression operation.
13. The system of claim 9 , wherein the system is configured to determine that an outlier is incorrectly classified and is configured to change a classification of the outlier.
14. The system of claim 9 , wherein the plurality of time series analysis accounts for at least a subset of predefined business patterns.
15. The system of claim 14 , further wherein the system is configured to detect a potential new business pattern.
16. The method of claim 1 , wherein the cost anomalies are presented in a user interface that allows a user to interact with the cost anomalies and wherein the cost anomalies are associated with assets protected by the disaster recovery system identified by the outliers.