Performance data analysis to reduce false alerts in a hybrid cloud environment

1. A computer-implemented method comprising:

converting, by a processor, runtime data points that are indicative of an influence of the runtime data points on a robustness and performance of a computing system;

clustering, by the processor, the runtime data points, wherein each cluster respectively represents a temporal state of the computing system;

translating, by the processor, each cluster into a three-dimensional representation based on a probability density of the runtime data points of each cluster;

generating, by the processor, a time-based vector describing a transition from a first three-dimensional representation to a second three-dimensional representation, wherein each three-dimensional representation traversed by the time-based vector represents a respective state of the computing system;

comparing, by the processor, the generated time-based vector with a baseline vector; and

issuing, by the processor, an anomaly alert based at least in part on the comparison.

2. The computer-implemented method of claim 1 , further comprising:

determining, based at least in part on the comparison, whether a deviation of the time-based vector from the baseline vector is due to a false positive of an anomaly; and

determining, whether a deviation of the time-based vector from the baseline vector is due to a false negative of the anomaly based at least in part on the determination of the false positive.

3. The computer-implemented method of claim 2 , wherein determining whether the deviation of the time-based vector from the baseline vector is due to a false positive of the anomaly comprises:

determining whether a starting data point and an ending data point of a first leg of the time-based vector are respectively included in a first cluster and a temporally sequential second cluster; and

comparing a trajectory of the first leg of the time-based vector and a trajectory of first leg of the baseline vector to determine whether the trajectories deviate greater than a threshold deviation.

4. The computer-implemented method of claim 2 , wherein determining whether the deviation of the time-based vector from the baseline vector is due to a false negative of the anomaly comprises comparing a sequence of state transitions described by the time-based vector with a sequence of state transitions described by the baseline vector.

5. The computer-implemented method of claim 2 , further comprising causing the anomaly alert to be issue based on the determination that the deviation is not indicative of a false positive.

6. The computer-implemented method of claim 2 , further comprising causing the anomaly alert to be issue based on the determination of a false negative.

7. The computer-implemented method of claim 1 , wherein translating the clusters into three-dimensional representations is based on a probability distribution of the runtime data points of each cluster.

8. A system comprising:

a memory having computer readable instructions; and

one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:

converting runtime data points that are indicative of an influence of the runtime data points on a robustness and performance of a computing system;

clustering the runtime data points, wherein each cluster respectively represents a temporal state of the computing system;

translating each cluster into a three-dimensional representation based on a probability density of the runtime data points of each cluster;

generating a time-based vector describing a transition from a first three-dimensional representation to a second three-dimensional representation, wherein each three-dimensional representation traversed by the time-based vector represents a respective state of the computing system;

comparing the generated time-based vector with a baseline vector; and

issuing an anomaly alert based at least in part on the comparison.

9. The system of claim 8 , the operations further comprising:

determining, based at least in part on the comparison, whether a deviation of the time-based vector from the baseline vector is due to a false positive of the anomaly; and

determining, whether a deviation of the time-based vector from the baseline vector is due to a false negative of the anomaly based at least in part on the determination of the false positive.

10. The system of claim 9 , wherein determining whether the deviation of the time-based vector from the baseline vector is due to a false positive of the anomaly comprises:

determining whether a starting data point and an ending data point of a first leg of the time-based vector are respectively included in a first cluster and a temporally sequential second cluster; and

comparing a trajectory of the first leg of the time-based vector and a trajectory of a first leg of the baseline vector to determine whether the trajectories deviate greater than a threshold deviation.

11. The system of claim 9 , wherein determining whether the deviation of the time-based vector from the baseline vector is due to a false negative of the anomaly comprises comparing a sequence of state transitions described by the time-based vector with a sequence of state transitions described by the baseline vector.

12. The system of claim 9 , further comprising causing an alert to be issue based on the determination that the deviation is not indicative of a false positive.

13. The system of claim 9 , further comprising causing an alert to be issue based on the determination of a false negative.

14. The system of claim 8 , wherein translating the clusters into three-dimensional representations is based on a probability distribution of the performance/robustness data points of each cluster.

15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:

converting runtime data points that are indicative of an influence of the runtime data points on a robustness and performance of a computing system;

clustering the runtime data points, wherein each cluster respectively represents a temporal state of the computing system;

translating each cluster into a three-dimensional representation based on a probability density of the runtime data points of each cluster;

generating a time-based vector describing a transition from a first three-dimensional representation to a second three-dimensional representation, wherein each three-dimensional representation traversed by the time-based vector represents a respective state of the computing system;

comparing the generated time-based vector with a baseline vector; and

issuing an anomaly alert based at least in part on the comparison.

16. The computer program product of claim 15 , the operations further comprising:

determining, based at least in part on the comparison, whether a deviation of the time-based vector from the baseline vector is due to a false positive of the anomaly; and

determining, whether a deviation of the time-based vector from the baseline vector is due to a false negative of the anomaly based at least in part on the determination of the false positive.

17. The computer program product of claim 16 , wherein determining whether the deviation of the time-based vector from the baseline vector is due to a false positive of an anomaly comprises:

determining whether a starting data point and an ending data point of a first leg of the time-based vector are respectively included in a first cluster and a temporally sequential second cluster; and

comparing a trajectory of the first leg of the time-based vector and a trajectory of first leg of the baseline vector to determine whether the trajectories deviate greater than a threshold deviation.

18. The computer program product of claim 16 , wherein determining whether the deviation of the time-based vector from the baseline vector is due to a false negative of an anomaly comprises comparing a sequence of state transitions described by the time-based vector with a sequence of state transitions described by the baseline vector.

19. The computer program product of claim 16 , further comprising causing an alert to be issue based on the determination that the deviation is not indicative of a false positive.

20. The computer program product of claim 15 , translating the clusters into three-dimensional representations is based on a probability distribution of the performance/robustness data points of each cluster.