US Patent 10956253 Anomaly detection in performance management

Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local and structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A transformation is performed from a space based on the principal axes to an original space. It is determined whether each of the local and structural anomalies is a global or a local anomaly. A management action is performed based on the classified structural and local anomalies.