A method comprises receiving, by learning logic, historical metrics of a computing system being monitored. The learning logic determines, from the received historical metrics, forms of sub-functions that are included in an equation, wherein each sub-function represents a dependency between two components linked in a hierarchical structure representing the computing system being monitored. State determination logic receives metric values of the computing system being monitored, and determines states that minimize the equation composed of the sub-functions over the received metric values. Finally, anomalous behavior of the computing system may be detected based on the determined states.