A system includes a windowing module that divides time series data for each metric into portions. Each portion corresponds to a respective window of time. A hash module calculates a hash value for each of the portions for each of the metrics. An identification module compares the hash values for each pair of metrics and, for a selected pair of metrics, counts how many windows of time in which the hash values of the selected pair of metrics are equal. A pair is identified as a candidate pair in response to the count exceeding a threshold. A metric graph module creates a first edge in a graph based on the candidate pair of metrics. Each of the metrics is a node in the graph and direct relationships between each pair of the metrics are edges in the graph. An anomaly combination module analyzes an anomaly condition based on the graph.