METHODS AND SYSTEMS FOR DETECTING AND REPORTING ANOMALOUS BEHAVIOR OF OBJECTS RUNNING IN A DATA CENTER

1 . A method stored in one or more data-storage devices and executed using one or more processors of a computer system for detecting and reporting anomalous behavior of an object running in a data center, the method comprising:

using a trained deep neural network (“DNN”) to generate forecast metric values of a metric of the object in a time interval from historical metric values of the metric;

for each runtime metric value of the metric generated in the time interval, computing a runtime residual value based on the runtime metric value and a forecast metric value at a time stamp in the time interval;

determining in real time whether the runtime residual value indicates anomalous behavior of the object using spectral residual anomaly detection; and

in response to detecting anomalous behavior of the object, displaying in a graphical user interface (“GUI”) of an electronic display device an alert that identifies anomalous behavior of the object, the runtime metric value, and a time stamp of the anomalous behavior.

2 . The method of claim 1 wherein computing the residual value comprises:

computing the absolute difference between the runtime metric value and the forecast metric at the time; and

storing the residual values and associated time stamps in data storage.

3 . The method of claim 1 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

retrieving from data storage residual values with time stamps that precede the time stamp of the runtime residual value in a time window; and

computing estimated residual values for time stamps that follow the time stamp of the runtime residual value in the time window.

4 . The method of claim 1 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

Fourier transforming the residual values with time stamps in a time window from the time domain to obtain a sequence of Fourier coefficients in the frequency domain;

computing an amplitude spectrum of the Fourier coefficients;

computing a log amplitude spectrum from the amplitude spectrum;

computing a phase spectrum from the Fourier coefficients;

computing an average log spectrum from the log amplitude spectrum;

computing a spectral residual from the log spectrum and the average log spectrum; and

inverse Fourier transforming a complex exponential of the spectral residual and the phase from the frequency domain to the time domain to obtain a saliency value that corresponds to the residual value.

5 . The method of claim 1 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

computing an average saliency value from previously generated saliency values;

computing an anomaly score based on the average saliency value and the saliency value; and

identifying the object as exhibiting anomalous behavior when the anomaly score is greater than an anomaly threshold.

6 . The method of claim 1 further comprises:

partitioning historical metric values of the metric into train, validation, and test subsets of historical metric values; and

training the trained DNN to generate forecast metric values in the time interval based on train, validation, and test subsets.

7 . A computer system for detecting and reporting anomalous behavior of an object running in a data center, the computer system comprising:

one or more processors;

one or more data-storage devices; and

machine-readable instructions stored in the one or more data-storage devices that when executed using the one or more processors control the system to performance operations comprising:

using a trained deep neural network (“DNN”) to generate forecast metric values of a metric of the object in a time interval from historical metric values of the metric;

for each runtime metric value of the metric generated in the time interval, computing a runtime residual value based on the runtime metric value and a forecast metric value at a time stamp in the time interval;

determining in real time whether the runtime residual value indicates anomalous behavior of the object using spectral residual anomaly detection; and

in response to detecting anomalous behavior of the object, displaying in a graphical user interface (“GUI”) of an electronic display device an alert that identifies anomalous behavior of the object, the runtime metric value, and a time stamp of the anomalous behavior.

8 . The computer system of claim 7 wherein computing the residual value comprises:

computing the absolute difference between the runtime metric value and the forecast metric at the time; and

storing the residual values and associated time stamps in data storage.

9 . The computer system of claim 7 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

retrieving from data storage residual values with time stamps that precede the time stamp of the runtime residual value in a time window; and

computing estimated residual values for time stamps that follow the time stamp of the runtime residual value in the time window.

10 . The computer system of claim 7 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

Fourier transforming the residual values with time stamps in a time window from the time domain to obtain a sequence of Fourier coefficients in the frequency domain;

computing an amplitude spectrum of the Fourier coefficients;

computing a log amplitude spectrum from the amplitude spectrum;

computing a phase spectrum from the Fourier coefficients;

computing an average log spectrum from the log amplitude spectrum;

computing a spectral residual from the log spectrum and the average log spectrum; and

inverse Fourier transforming a complex exponential of the spectral residual and the phase from the frequency domain to the time domain to obtain a saliency value that corresponds to the residual value.

11 . The computer system of claim 7 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

computing an average saliency value from previously generated saliency values;

computing an anomaly score based on the average saliency value and the saliency value; and

identifying the object as exhibiting anomalous behavior when the anomaly score is greater than an anomaly threshold.

12 . The computer system of claim 7 further comprises:

partitioning historical metric values of the metric into train, validation, and test subsets of historical metric values; and

training the trained DNN to generate forecast metric values in the time interval based on train, validation, and test subsets.

13 . A non-transitory computer-readable medium having instructions encoded thereon for enabling one or more processors of a computer system to detect and report anomalous behavior of an object running in a data center by performing operations comprising:

using a trained deep neural network (“DNN”) to generate forecast metric values of a metric of the object in a time interval from historical metric values of the metric;

for each runtime metric value of the metric generated in the time interval, computing a runtime residual value based on the runtime metric value and a forecast metric value at a time stamp in the time interval;

determining in real time whether the runtime residual value indicates anomalous behavior of the object using spectral residual anomaly detection; and

in response to detecting anomalous behavior of the object, displaying in a graphical user interface (“GUI”) of an electronic display device an alert that identifies anomalous behavior of the object, the runtime metric value, and a time stamp of the anomalous behavior.

14 . The medium of claim 13 wherein computing the residual value comprises:

computing the absolute difference between the runtime metric value and the forecast metric at the time; and

storing the residual values and associated time stamps in data storage.

15 . The medium of claim 13 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

retrieving from data storage residual values with time stamps that precede the time stamp of the runtime residual value in a time window; and

computing estimated residual values for time stamps that follow the time stamp of the runtime residual value in the time window.

16 . The medium of claim 13 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

Fourier transforming the residual values with time stamps in a time window from the time domain to obtain a sequence of Fourier coefficients in the frequency domain;

computing an amplitude spectrum of the Fourier coefficients;

computing a log amplitude spectrum from the amplitude spectrum;

computing a phase spectrum from the Fourier coefficients;

computing an average log spectrum from the log amplitude spectrum;

computing a spectral residual from the log spectrum and the average log spectrum; and

inverse Fourier transforming a complex exponential of the spectral residual and the phase from the frequency domain to the time domain to obtain a saliency value that corresponds to the residual value.

17 . The medium of claim 13 wherein determining in real time whether the runtime residual value indicates anomalous behavior of the object comprises:

computing an average saliency value from previously generated saliency values;

computing an anomaly score based on the average saliency value and the saliency value; and

identifying the object as exhibiting anomalous behavior when the anomaly score is greater than an anomaly threshold.

18 . The medium of claim 13 further comprises:

partitioning historical metric values of the metric into train, validation, and test subsets of historical metric values; and

training the trained DNN to generate forecast metric values in the time interval based on train, validation, and test subsets.