Method and system for automatic anomaly detection in data

Abstract

A method and system for detecting anomaly transition point candidates in performance metadata. The method can be applied to computer system performance monitoring. Anomaly candidates, indicative of a possible transition, of a process generating the performance metadata, to or from an anomalous behavior mode are identified, for example by comparing z-scores to the left and right of various timestamps and identifying anomaly candidates when the z-scores are significantly different. Anomaly candidates occur singularly rather than as pairs of endpoints of an anomaly interval. For at least one of the anomaly candidates, an explanatory predicate, indicative of a human-readable explanation of behavior of the process, can be generated. The set of anomalies can then be filtered, for example by removing those without explanatory predicates or replacing clusters of anomalies with a most relevant anomaly.