Network performance metrics anomaly detection
A method for detecting anomalies in one or more network performance metrics stream for one or more monitored object comprising using a discrete window on the stream to extract a motif from said stream for a first of said network performance metric for a first of said monitored object. Maintaining an abnormal and a normal cluster center of historical time series for said first network performance metric for said first monitored object. Classifying said motif based on a distance between said new time series and said abnormal and said normal cluster center. Determining whether an anomaly for said motif occurred based on said distance and a predetermined decision boundary.
1. A method for detecting anomalies in one or more performance measures stream for one or more monitored object relating to a network comprising:
selecting, by a processor, a discrete window on the stream to extract a new motif from said stream for one of said performance measure for one of said monitored object;
maintaining, by the processor, an abnormal cluster center, and a normal cluster center, from a binary clustering of historical time series for said one of said performance measure for said one of said monitored object;
classifying, by the processor, said new motif based on a distance between said new motif and said abnormal cluster center and said normal cluster center; and
determining, by the processor, whether an anomaly for said one of said performance measure for said one of said monitored object occurred based on said distance and a predetermined decision boundary.
2. The method of claim 1 wherein said distance is computed, by the processor, using a euclidean distance algorithm.
3. The method of claim 1 wherein a cluster member furthest from the normal cluster center or the abnormal cluster center is used as said decision boundary.
4. The method of claim 1 further comprising sending, by the processor, an anomaly notification to a user that the anomaly has occurred.
5. An network anomaly detection system for detecting performance anomalies comprising:
a measurement system configured to collect a plurality of performance measures on a monitored object in a network, to create a new time series;
a processor; and
a non-volatile memory storing instructions that, when executed by the processor, configure the anomaly detection system to:
maintain an abnormal cluster center, and a normal cluster center with most members from a binary clustering of historical time series for said performance measure for said monitored object;
extract a motif using a discrete window on the new time series;
classify said motif based on a distance between said motif and said abnormal cluster center and said normal cluster center; and
determine said anomaly for said performance measure for said monitored object occurred based on said distance and a predetermined decision boundary.
6. The system of claim 5 wherein said distance is computed using a euclidean distance algorithm.
7. The system of claim 5 wherein a furthest cluster member is used as said decision boundary.
8. The system of claim 5 , wherein the instructions that, when executed by the processor, further configure the anomaly detection system to: send a notification to a user that said anomaly has occurred.