Method, device and computer program product for anomaly detection and root cause analysis

A method includes, for each feature, performing an anomaly detection process. The anomaly detection process includes selecting, from a plurality of historical data points of the feature, a set of historical data points. Using a machine learning module, a set of scores, each corresponding to one historical data point, is selected. An anomaly threshold is determined based on the set of scores, and compared with a score corresponding to a current data point of the feature to determine whether the current data point is anomalous or not. When the current data point is anomalous, the anomaly detection process includes identifying the feature as an anomalous feature, and including the anomalous feature and the current data point in an anomaly detection report.