Entropy-Based Anomaly Detection for SAP z/OS Systems

This paper presents techniques based on relative entropy a metric for characterizing structure in data environments and applies them to both measured production performance data as well as synthetic data modeled on the statistical profiles of production data. The proposed technique provides significant improvements over industry standard Gaussian-based multivariate adaptive statistical filter (MASF) methods. In addition, the proposed algorithms have greater computational efficiency. In a series of experiments, entropy based anomaly detection algorithms were applied to production data in a SAP Z/OS-based operating environment as well as carefully calibrated anomaly-injected datasets of varying structure. Results showed important improvements in recall and false positive rates over conventional MASF techniques.