System and method for detecting anomalies based on feature signature of task workflows

1. A computer-implemented method for detecting anomalies in task workflows, the method comprising:

collecting metrics from software entities that perform operations to execute a task;

constructing a directed acyclic graph using the collected metrics for a workflow of the task;

extracting key values from the directed acyclic graph related to at least one of latency of edges and topology of vertexes in the directed acyclic graph;

generating a feature signature for the task workflow using the key values;

computing a similarity value by comparing the feature signature with a reference feature signature of a baseline task workflow; and

using the similarity value to diagnose any performance issues in the workflow of the task executed by the software entities,

wherein generating the feature signature includes generating a topology feature signature using the key values related to the topology of vertexes and wherein computing the similarity value includes computing a topology similarity value by comparing the topology feature signature with a reference topology feature signature of the baseline task workflow.

2. The method of claim 1 , wherein generating the feature signature includes generating a latency feature signature using the key values related to the latency of edges and wherein computing the similarity value includes computing a latency similarity value by comparing the latency feature signature with a reference latency feature signature of the baseline task workflow.

3. The method of claim 1 , wherein generating the feature signature includes generating a latency feature signature using the key values related to the latency of edges and the topology feature signature using the key values related to the topology of vertexes and wherein computing the similarity value includes computing a latency similarity value by comparing the latency feature signature with a reference latency feature signature of the baseline task workflow and computing the topology similarity value by comparing the topology feature signature with the reference topology feature signature of the baseline task workflow.

4. The method of claim 1 , wherein constructing the directed acyclic graph includes constructing the directed acyclic graph with latency information of edges of the directed acyclic graph.

5. The method of claim 4 , wherein the latency information for each edge from a first vertex to a second vertex of the directed acyclic graph includes queueing time at the first vertex, processing time at the first vertex and network latency from the first vertex to the second vertex.

6. The method of claim 1 , wherein generating the feature signature using the key values includes using a hashing scheme on the key values to produce the feature signature.

7. The method of claim 1 , wherein the hashing scheme is a SimHash hashing scheme.

8. A non-transitory computer-readable storage medium containing program instructions for method for detecting anomalies in task workflows, wherein execution of the program instructions by one or more processors of a computer causes the one or more processors to perform steps comprising:

collecting metrics from software entities that perform operations to execute a task;

constructing a directed acyclic graph using the collected metrics for a workflow of the task;

extracting key values from the directed acyclic graph related to at least one of latency of edges and topology of vertexes in the directed acyclic graph;

generating a feature signature for the task workflow using the key values;

computing a similarity value by comparing the feature signature with a reference feature signature of a baseline task workflow; and

using the similarity value to any diagnose performance issues in the workflow of the task executed by the software entities,

wherein generating the feature signature includes generating a topology feature signature using the key values related to the topology of vertexes and wherein computing the similarity value includes computing a topology similarity value by comparing the topology feature signature with a reference topology feature signature of the baseline task workflow.

9. The computer-readable storage medium of claim 8 , wherein generating the feature signature includes generating a latency feature signature using the key values related to the latency of edges and wherein computing the similarity value includes computing a latency similarity value by comparing the latency feature signature with a reference latency feature signature of the baseline task workflow.

10. The computer-readable storage medium of claim 8 , wherein generating the feature signature includes generating a latency feature signature using the key values related to the latency of edges and the topology feature signature using the key values related to the topology of vertexes and wherein computing the similarity value includes computing a latency similarity value by comparing the latency feature signature with a reference latency feature signature of the baseline task workflow and computing the topology similarity value by comparing the topology feature signature with the reference topology feature signature of the baseline task workflow.

11. The computer-readable storage medium of claim 8 , wherein constructing the directed acyclic graph includes constructing the directed acyclic graph with latency information of edges of the directed acyclic graph.

12. The computer-readable storage medium of claim 11 , wherein the latency information for each edge from a first vertex to a second vertex of the directed acyclic graph includes queueing time at the first vertex, processing time at the first vertex and network latency from the first vertex to the second vertex.

13. The computer-readable storage medium of claim 8 , wherein generating the feature signature using the key values includes using a hashing scheme on the key values to produce the feature signature.

14. The computer-readable storage medium of claim 8 , wherein the hashing scheme is a SimHash hashing scheme.

15. A system comprising:

memory; and

at least one processor configured to:

collect metrics from software entities that perform operations to execute a task;

construct a directed acyclic graph using the collected metrics for a workflow of the task;

extract key values from the directed acyclic graph related to at least one of latency of edges and topology of vertexes in the directed acyclic graph;

generate a feature signature for the task workflow using the key values;

compute a similarity value by comparing the feature signature with a reference feature signature of a baseline task workflow; and

use the similarity value to diagnose any performance issues in the workflow of the task executed by the software entities,

wherein the at least one processor is configured to generate a topology feature signature using the key values related to the topology of vertexes and compute a topology similarity value by comparing the topology feature signature with a reference topology feature signature of the baseline task workflow.

16. The system of claim 15 , wherein the at least one processor is configured to generate a latency feature signature using the key values related to the latency of edges and compute a latency similarity value by comparing the latency feature signature with a reference latency feature signature of the baseline task workflow.

17. The system of claim 15 , wherein the at least one processor is configured to use a SimHash hashing scheme on the key values to produce the feature signature.

18. The method of claim 1 , wherein the key values that are extracted from the directed acyclic graph includes at least one of frequency of vertexes based on software entity type, summation of the number of vertex neighbors based on software entity type, the number of different types of vertex neighbors based on software entity type and the average distance of vertexes based on software entity type.

19. The computer-readable storage medium of claim 8 , wherein the key values that are extracted from the directed acyclic graph includes at least one of frequency of vertexes based on software entity type, summation of the number of vertex neighbors based on software entity type, the number of different types of vertex neighbors based on software entity type and the average distance of vertexes based on software entity type.

20. The system of claim 15 , wherein the key values that are extracted from the directed acyclic graph includes at least one of frequency of vertexes based on software entity type, summation of the number of vertex neighbors based on software entity type, the number of different types of vertex neighbors based on software entity type and the average distance of vertexes based on software entity type.