MADneSs: A Multi-Layer Anomaly Detection Framework for Complex Dynamic Systems

Tommaso Zoppi

doi:10.1109/TDSC.2019.2908366

2021-03-01

Tommaso Zoppi *

Andrea Ceccarelli

Andrea Bondavalli

DOI：10.1109/TDSC.2019.2908366

原文链接

查看原文

摘要

En 中文

Anomaly detection can infer the presence of errors without observing the target services, but detecting variations in the observable parts of the system on which the services reside. This is a promising technique in complex software-intensive systems, because either instrumenting the services' internals is exceedingly time-consuming, or encapsulation makes them not accessible. Unfortunately, in such systems anomaly detection is often ineffective due to their dynamicity, which implies changes in the services or their expected workload. Here we present our approach to enhance the efficacy of anomaly detection in complex, dynamic software-intensive systems. After discussing the related challenges, we present MADneSs, an anomaly detection framework tailored for the above systems that includes an adaptive multi-layer monitoring module. Monitored data are then processed by the anomaly detector, which adapts its parameters depending on the current system behavior. An anomaly alert is provided if the analysis conducted by the anomaly detector identify unexpected trends in the data. MADneSs is evaluated through an experimental campaign on two service-oriented architectures; software faults are injected in the application layer, and detected through monitoring of underlying system layers. Lastly, we quantitatively and qualitatively discuss our results with respect to state-of-the-art solutions, highlighting the key contributions of MADneSs.

Keyword:

Anomaly detection

Monitoring

Detectors

Complex systems

Heuristic algorithms

Software

Market research

Anomaly detection

software-intensive system

dynamicity

MADneSs