Development a set of mathematical models for anomaly detection in high-load complex computer systems

The subject of this study is the process of anomaly detection in high-load complex computer systems (HLCCSs). The task addressed in the paper is the lack of real-time anomaly detection models in HLCCS with a specified accuracy. A set of mathematical models for real-time anomaly detection has been built and investigated. This set includes a mathematical model for detecting anomalous connections between components of computer system (DACCCSs) and a mathematical model for assessing current state of computer system (CSACS). The results of models tests showed the following efficiency metrics. For a DACCCS model: accuracy – 84 %, positive predictive value – 87 %, recall – 74 %, and weighted average accuracy (WAA) – 78 %. For a CSACS model: accuracy – 91 %, positive predictive value – 82 %, recall – 68 %, and WAA – 67 %. The positive results of the study can be attributed to the following factors. A DACCCS model uses projection matrices and orthogonal vector functions to analyze anomalies. This enables the creation of spatial decompositions that reveal complex interrelationships between system components using only eigenvalues and eigenvectors. A CSACS model applies the singular value decomposition method, which implies solving a system of scalar equations to determine the current state of the system. This approach minimizes computational costs compared to methods requiring the solution of complex matrix equations. Thus, the model could be applied for real-time data analysis and anomaly detection under conditions of limited resources and high system load. The practical application scope includes HLCCS, such as banking transaction servers and cloud platforms, in which it is essential to enable stable operation under high request amount and to minimize the risk of data loss or service failure