SYSTEMS AND METHODS FOR ANOMALY DETECTION IN A DISTRIBUTED COMPUTING SYSTEM

There is provided a system for identifying a system level anomalous, comprising code for receiving data-points indicative of a time-based dynamic state of processing nodes of a distributed system, each associated with a timestamp, a metric, and a metric value, clustering the data-points into clusters, comprising a sub-set of the data-points having a same metric and a timestamp within a same metric anomaly time interval, computing metric anomaly scores for each respective cluster denoting likelihood of an anomaly being present, analyzing metric anomaly scores of each system level anomalous time interval including at least two of the metric anomaly time intervals, computing a single anomalous event score for each respective system level anomalous time interval according to the analysis, and generating an alert indicative of the system level anomalous event for a certain system level anomalous time interval when the single anomalous event score is according to an anomaly requirement.