Efficient single user metric usage for high precision service incident detection

Abstract

Systems and methods for service incident detection in a cloud computing platform. According to an example implementation, the incident detection system retrieves a single user metric corresponding to a service call to a resource on which the service is dependent and uses unsupervised anomaly detection to detect anomalies indicative of a service incident. Detected anomalies include an anomaly score indicating a level of anomality. Additionally, a supervised learning classifier is trained and used to filter/classify the anomaly detection results based on features corresponding to the anomaly score. The features are learned based on characteristic dimensions, distribution, and statistics of anomaly scores of the user metric at different resolution/aggregation levels. Anomaly detection results are classified as an incident or not an incident. A report is generated for a determined incident.