AdaptGuard: guarding adaptive systems from instability
ICAC '09 Proceedings of the 6th international conference on Autonomic computing
Runtime Monitoring and Dynamic Reconfiguration for Intrusion Detection Systems
RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
SelfTalk for Dena: query language and runtime support for evaluating system behavior
ACM SIGOPS Operating Systems Review
Diagnosis of software failures using computational geometry
ASE '11 Proceedings of the 2011 26th IEEE/ACM International Conference on Automated Software Engineering
Workload-aware anomaly detection for Web applications
Journal of Systems and Software
Hi-index | 0.00 |
In this paper, we introduce a semantic-driven approachto system modeling for improving the accuracy ofanomaly diagnosis. Our framework composes heterogeneousfamilies of models, including generic statistical models,and resource-specific models into a belief network, i.e.,Bayesian network. Given a set of models which sense thebehavior of various system components, the key idea is to incorporateexpert knowledge about the system structure anddependencies within this structure, as meta-correlationsacross components and models. Our approach is flexible,easily extensible and does not put undue burden on the systemadministrator. Expert beliefs about the system hierarchy,relationships and known problems can guide learning,but do not need to be fully specified. The system dynamicallyevolves its beliefs about anomalies over time.We evaluate our prototype implementation on a dynamiccontent site running the TPC-W industry-standard ecommercebenchmark. We sketch a system structure andtrain our belief network using automatic fault injection.We demonstrate that our technique provides accurate problemdiagnosis in cases of single and multiple faults. Wealso show that our semantic-driven modeling approach effectivelyfinds the component containing the root cause ofinjected anomalies, and avoids false alarms for normalchanges in environment or workload.