Methods and systems that estimate a degree of abnormality of a complex system based on historical time-series data representative of the complex system's past behavior and using the historical degree of abnormality to determine whether or not a degree of abnormality determined from current time-series data representative of the same complex system's current behavior is worthy of attention. The time-series data may be metric data that represents behavior of a complex system as a result of successive measurements of the complex system made over time or in a time interval. A degree of abnormality represents the amount by which the time-series data violates a threshold. The larger the degree of abnormality of the current time-series data is from the historical degree of abnormality, the larger the violation of the thresholds and the greater the probability the violation in the current time-series data is worthy of attention.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method stored in one or more data-storage devices and executed using one or more processors of a computing environment to estimate a degree of abnormality of a complex system, the method comprising: computing estimated upper-threshold and lower-threshold historical degrees of abnormality based on historical time-series data, the historical time-series data represents one of past behavior, performance, and usage of the complex system retrieved from a data-storage device; computing estimated current degree of abnormality based on current time-series data, the current time-series data represents one of current behavior, performance, and usage of the complex system retrieved from a data-storage device; and comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality to determine whether one of the current behavior, performance, and usage of the complex system is abnormal. 2. The method of claim 1, wherein computing the estimated historical degree of abnormality further comprises computing upper and lower combined sets of abnormalities based on the historical time-series data; for each set of abnormalities, forming a histogram of the set of abnormalities; computing an empirical probability density function based on the histogram; computing a cumulative distribution based on the empirical probability; computing an inverse empirical cumulative distribution based on the empirical cumulative distribution, the inverse empirical cumulative distribution is one of an upper-threshold abnormality degree component of the upper-threshold historical degree of abnormality and a lower-threshold abnormality degree component of the lower-threshold historical degree of abnormality; forming the upper-threshold estimated historical degree of abnormality based the upper-threshold abnormality degree components; and forming the lower-threshold estimated historical degree of abnormality based the lower-threshold abnormality degree components. 3. The method of claim 2, wherein computing the upper and lower combined sets of abnormalities further comprises: forming upper-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical upper-threshold event distances and a set of historical upper-threshold distance metrics and one of a set of historical upper-threshold event durations and a set of historical upper-threshold event counts; and forming lower-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical lower-threshold event distances and a set of historical lower-threshold distance metrics and one of a set of historical lower-threshold event durations and a set of historical lower-threshold event counts. 4. The method of claim 2, wherein the cumulative distribution further comprises one of an empirical cumulative distribution and a parametric cumulative distribution. 5. The method of claim 1, wherein computing the estimated current degree of abnormality further comprises: computing a current distance metric for data values of the current time-series that violates one of an upper threshold and a lower threshold; computing one of a current count and a current duration of the data values of the current time-series that violates one of an upper threshold and a lower threshold; and forming the estimated current degree of abnormality based on the current distance metric and one of the current count and the current duration. 6. The method of claim 1, wherein comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality further comprises: when the estimated current degree of abnormality corresponds to an upper-threshold event, comparing the estimated current degree of abnormality with the estimated upper-threshold historical degree of abnormality; when the estimated current degree of abnormality corresponds to a lower-threshold event, comparing the estimated current degree of abnormality with the estimated lower-threshold historical degree of abnormality; and generating an alert when a current distance metric and one of a current count and a current duration of the estimated current degree of abnormality are greater than the abnormality degree components one of the upper-threshold historical degree of abnormality and lower-threshold degree of historical degree of abnormality. 7. A system to estimate a degree of abnormality of a complex system, the system comprising: one or more processors; one or more data-storage devices; and machine-readable instructions stored in the data-storage devices and executed using the one or more processors, the machine-readable instructions computing estimated upper-threshold and lower-threshold historical degrees of abnormality based on historical time-series data, the historical time-series data represents one of past behavior, performance, and usage of the complex system retrieved from a data-storage device; computing estimated current degree of abnormality based on current time-series data, the current time-series data represents one of current behavior, performance, and usage of the complex system retrieved from a data-storage device; and comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality to determine whether one of the current behavior, performance, and usage of the complex system is abnormal. 8. The system of claim 7, wherein computing the estimated historical degree of abnormality further comprises computing upper and lower combined sets of abnormalities based on the historical time-series data; for each set of abnormalities, forming a histogram of the set of abnormalities; computing an empirical probability density function based on the histogram; computing a cumulative distribution based on the empirical probability; computing an inverse empirical cumulative distribution based on the empirical cumulative distribution, the inverse empirical cumulative distribution is one of an upper-threshold abnormality degree component of the upper-threshold historical degree of abnormality and a lower-threshold abnormality degree component of the lower-threshold historical degree of abnormality; forming the upper-threshold estimated historical degree of abnormality based the upper-threshold abnormality degree components; and forming the lower-threshold estimated historical degree of abnormality based the lower-threshold abnormality degree components. 9. The method of claim 8, wherein computing the upper and lower combined sets of abnormalities further comprises: forming upper-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical upper-threshold event distances and a set of historical upper-threshold distance metrics and one of a set of historical upper-threshold event durations and a set of historical upper-threshold event counts; and forming lower-threshold combined set of abnormalities, the upper-threshold combined set of abnormalities having one of a set of historical lower-threshold event distances and a set of historical lower-threshold distance metrics and one of a set of historical lower-threshold event durations and a set of historical lower-threshold event counts. 10. The method of claim 8, wherein the cumulative distribution further comprises one of an empirical cumulative distribution and a parametric cumulative distribution. 11. The method of claim 7, wherein computing the estimated current degree of abnormality further comprises: computing a current distance metric for data values of the current time-series that violates one of an upper threshold and a lower threshold; computing one of a current count and a current duration of the data values of the current time-series that violates one of an upper threshold and a lower threshold; and forming the estimated current degree of abnormality based on the current distance metric and one of the current count and the current duration. 12. The method of claim 7, wherein comparing the estimated current degree of abnormality with one of the estimated upper-threshold and lower-threshold historical degrees of abnormality further comprises: when the estimated current degree of abnormality corresponds to an upper-threshold event, comparing the estimated current degree of abnormality with the estimated upper-threshold historical degree of abnormality; when the estimated current degree of abnormality corresponds to a lower-threshold event, comparing the estimated current degree of abnormality with the estimated lower-threshold historical degree of abnormality; and generating an alert when a current distance metric and one of a current count and a current duration of the estimated current degree of abnormality are greater than the abnormality degree components one of the upper-threshold historical degree of abnormality and lower-threshold degree of historical degree of abnormality. 13. A method stored in one or more data-storage devices and executed using one or more processors of a computing environment to estimate a degree of abnormality of a complex system, the method comprising: determining upper-threshold events and lower-threshold event in historical time-series data; for each upper and lower threshold event, computing a normalized total relative distance, computing a median of the normalized total relative distances, and computing a mean of the normalized total relative distances; and computing one of an upper-threshold cumulative distribution and lower-threshold cumulative distribution for current time-series data based on the median and mean of the normalized total relative distance, the cumulative distribution is the estimate of the degree of abnormality. 14. The method of claim 13, wherein determining the upper-threshold events in the historical time-series data further comprises: for each data value of the historical time-series greater than the upper threshold, computing a relative distance; and forming an upper-threshold event, each upper-threshold event corresponds to set of consecutive relative distances. 15. The method of claim 13, wherein determining the lower-threshold events in the historical time-series data further comprises: for each data value of the historical time-series greater than the lower threshold, computing a relative distance; and forming a lower-threshold event, each lower-threshold event corresponds to set of consecutive relative distances. 16. The method of claim 13, wherein computing a normalized total relative distance further comprises integrating over the relative distances comprising one of an upper-threshold event and a lower-threshold event. 17. The method of claim 13, wherein computing the cumulative distribution for the current data further comprises: determining one of an upper-threshold event and a lower-threshold event in the current time-series data; computing a total relative distance of one of the upper-threshold event and the lower-threshold event; normalizing the total relative distance based on the event counts of the event; and computing a value for the cumulative distribution based on the normalized total relative distance of the event, the value is the degree of abnormality of the current time-series data. 18. A computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform the operations of determining upper-threshold events and lower-threshold event in historical time-series data; for each upper and lower threshold event, computing a normalized total relative distance, computing a median of the normalized total relative distances, and computing a mean of the normalized total relative distances; and computing one of an upper-threshold cumulative distribution and lower-threshold cumulative distribution for current time-series data based on the median and mean of the normalized total relative distance, the cumulative distribution is the estimate of the degree of abnormality. 19. The computer-readable medium of claim 18, wherein determining the upper-threshold events in the historical time-series data further comprises: for each data value of the historical time-series greater than the upper threshold, computing a relative distance; and forming an upper-threshold event, each upper-threshold event corresponds to set of consecutive relative distances. 20. The computer-readable medium of claim 18, wherein determining the lower-threshold events in the historical time-series data further comprises: for each data value of the historical time-series greater than the lower threshold, computing a relative distance; and forming a lower-threshold event, each lower-threshold event corresponds to set of consecutive relative distances. 21. The computer-readable medium of claim 18, wherein computing a normalized total relative distance further comprises integrating over the relative distances comprising one of an upper-threshold event and a lower-threshold event. 22. The computer-readable medium of claim 18, wherein computing the cumulative distribution for the current data further comprises: determining one of an upper-threshold event and a lower-threshold event in the current time-series data; computing a total relative distance of one of the upper-threshold event and the lower-threshold event; normalizing the total relative distance based on the event counts of the event; and computing a value for the cumulative distribution based on the normalized total relative distance of the event, the value is the degree of abnormality of the current time-series data.