A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A system comprising: a windowing module configured to divide, for each metric of a plurality of metrics, time series data for values of the metric into a plurality of time series portions, each corresponding to a respective window of time; a hash module configured to calculate a hash value for each of the time series portions for each of the plurality of metrics; a candidate identification module configured to (i) compare the hash values for each pair of metrics from the plurality of metrics, (ii) for a selected pair of metrics, count for how many windows of time the hash values of the selected pair of metrics are equal to each other, and (iii) identify the pair of metrics as a candidate pair in response to the count exceeding a threshold; a metric relationship graph creation module configured to selectively create a first edge in a graph based on the candidate pair of metrics, wherein (i) each metric of the plurality of metrics is a node in the graph and (ii) direct relationships between each pair of the plurality of metrics are edges in the graph; and an anomaly combination module configured to analyze an anomaly condition based on the graph. 2. The system of claim 1 further comprising a correlation module configured to compute a similarity value between the candidate pair of metrics. 3. The system of claim 2 wherein the similarity value is one of a Euclidean distance, a hamming distance, a cosine distance, and a correlation coefficient. 4. The system of claim 2 wherein the metric relationship graph creation module is configured to only create the first edge in the graph in response to the similarity value exceeding a threshold. 5. The system of claim 1 wherein the windows of time are equal in length. 6. The system of claim 1 wherein the hash module computes hash values using locality-sensitive hashing. 7. The system of claim 1 further comprising a conditioning module logically positioned prior to the windowing module and configured to apply a low-pass filter to the time series data for the metrics and to remove long-term trends from the time series data for the metrics. 8. The system of claim 7 wherein the conditioning module is further configured to normalize the time series data for the metrics. 9. The system of claim 1 wherein the graph is undirected. 10. The system of claim 2 further comprising: a stacked autoencoder module configured to (i) train a stacked autoencoder using each of the time series portions of each of the plurality of metrics and (ii) to identify output nodes in the stacked autoencoder activated by each of the time series portions of each of the plurality of metrics; a concatenation module configured to, for each of the plurality of metrics, concatenate a representation of activated output nodes for each of the time series portions of the metric; a similarity identification module configured to compare each possible pair of the plurality of metrics, wherein the similarity identification module only computes a similarity value for a pair of metrics if a preliminary indication of the similarity value exceeds a first threshold; and a combination module configured to, for a selected pair of metrics, combine the similarity value from the similarity identification module with the similarity value from the correlation module to create an overall similarity value, wherein the metric relationship graph creation module is configured to create the first edge in the graph only when the overall similarity value exceeds a second threshold. 11. The system of claim 10 wherein the combination module is configured to create the overall similarity value by averaging the similarity value from the similarity identification module with the similarity value from the correlation module. 12. A system comprising: a windowing module configured to divide, for each metric of a plurality of metrics, time series data for values of the metric into a plurality of time series portions, each corresponding to a respective window of time; a stacked autoencoder module configured to (i) train a stacked autoencoder using each of the time series portions of each of the plurality of metrics and (ii) to identify output nodes in the stacked autoencoder activated by each of the time series portions of each of the plurality of metrics; a concatenation module configured to, for each of the plurality of metrics, concatenate a representation of activated output nodes for each of the time series portions of the metric; a similarity identification module configured to compare each possible pair of the plurality of metrics, wherein the similarity identification module only computes a similarity value for a pair of metrics if a preliminary indication of the similarity value exceeds a first threshold; a metric relationship graph creation module configured to selectively create a first edge in a graph based on a pair of the plurality of metrics whose similarity value exceeds a second threshold, wherein (i) each metric of the plurality of metrics is a node in the graph and (ii) direct relationships between each pair of the plurality of metrics are edges in the graph; and an anomaly combination module configured to analyze an anomaly condition based on the graph. 13. The system of claim 12 wherein the first threshold and the second threshold are equal. 14. A method comprising: dividing, for each metric of a plurality of metrics, time series data for values of the metric into a plurality of time series portions, each corresponding to a respective window of time; calculating a hash value for each of the time series portions for each of the plurality of metrics; comparing the hash values for each pair of metrics from the plurality of metrics; for a selected pair of metrics, counting for how many windows of time the hash values of the selected pair of metrics are equal to each other; identifying the pair of metrics as a candidate pair in response to the count exceeding a threshold; selectively creating a first edge in a graph based on the candidate pair of metrics, wherein (i) each metric of the plurality of metrics is a node in the graph and (ii) direct relationships between each pair of the plurality of metrics are edges in the graph; and analyzing an anomaly condition based on the graph. 15. The method of claim 14 further comprising computing a first similarity value between the candidate pair of metrics. 16. The method of claim 15 wherein the first similarity value is one of a Euclidean distance, a hamming distance, a cosine distance, and a correlation coefficient. 17. The method of claim 15 wherein the first edge is only created in the graph in response to the first similarity value exceeding a threshold. 18. The method of claim 14 wherein the windows of time are equal in length. 19. The method of claim 14 wherein the hash values are computed using locality-sensitive hashing. 20. The method of claim 14 further comprising applying a low-pass filter to the time series data for the metrics and removing long-term trends from the time series data for the metrics. 21. The method of claim 20 further comprising normalizing the time series data for the metrics. 22. The method of claim 14 wherein the graph is undirected. 23. The method of claim 15 further comprising: training a stacked autoencoder using each of the time series portions of each of the plurality of metrics; identifying output nodes in the stacked autoencoder activated by each of the time series portions of each of the plurality of metrics; for each of the plurality of metrics, concatenating a representation of activated output nodes for each of the time series portions of the metric; comparing each possible pair of the plurality of metrics; computing a second similarity value for a pair of metrics only if a preliminary indication of the second similarity value exceeds a first threshold; and for a selected pair of metrics, combining the first similarity value with the second similarity value to create an overall similarity value, creating the first edge in the graph only when the overall similarity value exceeds a second threshold. 24. The method of claim 23 wherein the overall similarity value is created by averaging the first similarity value and the second similarity value. 25. A method comprising: dividing, for each metric of a plurality of metrics, time series data for values of the metric into a plurality of time series portions, each corresponding to a respective window of time; training a stacked autoencoder using each of the time series portions of each of the plurality of metrics; identifying output nodes in the stacked autoencoder activated by each of the time series portions of each of the plurality of metrics; for each of the plurality of metrics, concatenating a representation of activated output nodes for each of the time series portions of the metric; comparing each possible pair of the plurality of metrics; computing a similarity value for a pair of metrics only if a preliminary indication of the similarity value exceeds a first threshold; selectively creating a first edge in a graph based on a pair of the plurality of metrics whose similarity value exceeds a second threshold, wherein (i) each metric of the plurality of metrics is a node in the graph and (ii) direct relationships between each pair of the plurality of metrics are edges in the graph; and analyzing an anomaly condition based on the graph. 26. The method of claim 25 wherein the first threshold and the second threshold are equal.