1. A method comprising: receiving, by learning logic, historical metrics of a computing system being monitored; determining, by the learning logic, from the received historical metrics, forms of sub-functions that are included in an equation, wherein each sub-function represents a dependency between two components linked in a hierarchical structure representing the computing system being monitored; receiving, by state determination logic, metric values of the computing system being monitored; determining, by state determination logic, states that minimize the equation composed of the sub-functions over the received metric values; and detecting anomalous behavior of the computing system based on the determined states.