Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local and structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A management action is performed based on the classified structural and local anomalies.