Methods and systems for detecting anomalous behavior include performing a principal component analysis on a plurality of key performance indicators (KPIs) to determine a set of principal axes. The KPIs are clustered in a space defined by the set of principal axes. Local anomalies are determined in the clustered KPIs by comparing, for each individual KPI in clusters that conform to a Gaussian distribution, a distance from a respective cluster mean to a threshold. Structural anomalies are determined in the clustered KPIs. The structural and local anomalies are classified based on historical information. A management action is performed based on the classified structural and local anomalies.