An unsupervised behavior learning system and method for predicting anomalies in a distributed computing infrastructure. The distributed computing infrastructure includes a plurality of computer machines. The system includes a first computer machine and a second computer machine. The second computer machine is configured to generate a model of normal and anomalous behavior of the first computer machine, where the model is based on unlabeled training data. The second computer machine is also configured to acquire real-time data of system level metrics of the first machine; determine whether the real-time data is normal or anomalous based on a comparison of the real-time data to the model; and predict a future failure of the first computer machine based on multiple consecutive comparisons of the real-time data to the model. Upon predicting a future failure of the first computer machine, generate a ranked set of system-level metrics which are contributors to the predicted failure of the first computer machine, and generate an alarm that includes the ranked set of system-level metrics. The model of normal and anomalous behavior may include a self-organizing map.