An unsupervised behavior learning system and method for predicting anomalies in a distributed computing infrastructure. The distributed computing infrastructure includes a plurality of computer machines. The system includes a first computer machine and a second computer machine. The second computer machine is configured to generate a model of normal and anomalous behavior of the first computer machine, where the model is based on unlabeled training data. The second computer machine is also configured to acquire real-time data of system level metrics of the first machine; determine whether the real-time data is normal or anomalous based on a comparison of the real-time data to the model; and predict a future failure of the first computer machine based on multiple consecutive comparisons of the real-time data to the model. Upon predicting a future failure of the first computer machine, generate a ranked set of system-level metrics which are contributors to the predicted failure of the first computer machine, and generate an alarm that includes the ranked set of system-level metrics. The model of normal and anomalous behavior may include a self-organizing map.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method of predicting performance anomalies in a first computer machine in a distributed computing infrastructure with a second computer machine using unsupervised behavior learning, the method comprising: generating, by the second computer machine, a model of normal and anomalous behavior for the first computer machine based on unlabeled training data; acquiring, by the second computer machine, real-time data of system level metrics for the first computer machine; determining, by the second computer machine, whether the real-time data is normal or anomalous based on a comparison of the real-time data to the model; predicting, by the second computer machine, a future system failure of the first computer machine based on multiple consecutive comparisons of the real-time data to the model; and upon predicting the future system failure, the second computer machine generating a ranked set of system-level metrics which are contributors to the predicted system failure of the first computer machine, and generating an alarm that includes the ranked set of system-level metrics. 2. The method of claim 1, wherein generating the model of normal and anomalous behavior includes generating a self-organizing map (“SOM”). 3. The method of claim 2, wherein generating the SOM includes calculating a neighborhood area size for a first neuron in the SOM. 4. The method of claim 3, wherein calculating the neighborhood area size for a neuron in the SOM includes calculating a Manhattan distance between the first neuron and a second neuron in the SOM. 5. The method of claim 3, wherein generating the SOM further includes setting a threshold value based at least in part on the neighborhood area size. 6. The method of claim 1, wherein generating the model of normal and anomalous behavior includes updating a self-organizing map (“SOM”). 7. The method of claim 6, wherein updating the SOM includes receiving an input measurement vector, comparing a Euclidean distance of the input measurement vector to a weight vector of each neuron in the SOM, selecting a neuron in the SOM with the smallest Euclidean distance to the input measurement vector, updating the weight vector of the selected neuron, and updating weight vectors of neurons in a neighborhood of the selected neuron. 8. The method of claim 2, wherein determining whether the real-time data is normal or anomalous includes receiving a real-time input measurement vector, mapping the real-time input measurement vector to a first neuron in the SOM, comparing a neighborhood area size value of the first neuron to a threshold value, classifying the real-time input measurement vector as normal if the neighborhood area size value of the first neuron is less than the threshold value, and classifying the real-time input measurement vector as anomalous if the neighborhood area size value of the first neuron is greater than or equal to the threshold value. 9. The method of claim 2, wherein predicting the future system failure of the first computer machine includes determining if a number of consecutive anomalous real-time input measurement vectors is greater than a threshold value. 10. The method of claim 2, wherein generating the ranked set of system-level metrics includes determining a set of normal neurons that are nearby to an anomalous neuron which a last real-time input measurement vector was mapped to. 11. An unsupervised behavior learning system for predicting anomalies in a distributed computing infrastructure, the distributed computing infrastructure including a plurality of computer machines, the system comprising: a first computer machine; a second computer machine configured to generate a model of normal and anomalous behavior for the first computer machine, the model based on unlabeled training data; acquire real-time data of system level metrics of the first machine; determine whether the real-time data is normal or anomalous based on a comparison of the real-time data to the model; predict a future failure of the first computer machine based on multiple consecutive comparisons of the real-time data to the model; and upon predicting the future failure of the first computer machine, generate a ranked set of system-level metrics which are contributors to the predicted failure of the first computer machine, and generate an alarm that includes the ranked set of system-level metrics. 12. The system of claim 11, wherein the model of normal and anomalous behavior includes a self-organizing map (“SOM”). 13. The system of claim 12, wherein the second computer machine generates the SOM includes calculating a neighborhood area size for a first neuron in the SOM. 14. The system of claim 13, wherein calculating the neighborhood area size for a neuron includes calculating a Manhattan distance between the first neuron and a second neuron in the SOM. 15. The system of claim 13, wherein the second computer machine generates the SOM further includes by setting a threshold value based at least in part on the neighborhood area size. 16. The system of claim 11, wherein the second computer machine generates the model of normal and anomalous behavior includes updating a self-organizing map (“SOM”). 17. The system of claim 16, wherein updating the SOM includes receiving an input measurement vector, comparing a Euclidean distance of the input measurement vector to a weight vector of each neuron in the SOM, selecting a neuron in the SOM with the smallest Euclidean distance to the input measurement vector, updating the weight vector of the selected neuron, and updating weight vectors of neurons in a neighborhood of the selected neuron. 18. The system of claim 12, wherein the second computer machine determines whether the real-time data is normal or anomalous includes receiving a real-time input measurement vector, mapping the real-time input measurement vector to a first neuron in the SOM, comparing a neighborhood area size value of the first neuron to a threshold value, classifying the real-time input measurement vector as normal if the neighborhood area size value of the first neuron is less than the threshold value, and classifying the real-time input measurement vector as anomalous if the neighborhood area size value of the first neuron is greater than or equal to the threshold value. 19. The system of claim 12, wherein the second computer machine predicts the future system failure of the first computer machine includes determining if a number of consecutive anomalous real-time input measurement vectors is greater than a threshold value. 20. The system of claim 12, wherein the second computer machine generates the ranked set of system-level metrics includes determining a set of normal neurons that are nearby to an anomalous neuron which a last real-time input measurement vector was mapped to.