TechRxiv
_submitted__SRDS2020__long_Anomaly_Detection_via_Mining_Numerical_Workflow_Relations_from_Logs.pdf (3.16 MB)
0/0

Anomaly Detection via Mining Numerical Workflow Relations from Logs

Download (3.16 MB)
preprint
posted on 26.06.2020 by Bo Zhang, Hongyu Zhang, Pablo Moscato
Complex software intensive systems, especially distributed systems, generate logs for troubleshooting. The logs are text messages recording system events, which can help engineers determine the system's runtime status. This paper proposes a novel approach named ADR (stands for Anomaly Detection by workflow Relations) that employs matrix nullspace to mine numerical relations from log data. The mined relations can be used for both offline and online anomaly detection and facilitate fault diagnosis. We have evaluated ADR on log data collected from two distributed systems, HDFS (Hadoop Distributed File System) and BGL (IBM Blue Gene/L supercomputers system). ADR successfully mined 87 and 669 numerical relations from the logs and used them to detect anomalies with high precision and recall. For online anomaly detection, ADR employs PSO (Particle Swarm Optimization) to find the optimal sliding windows' size and achieves fast anomaly detection.
The experimental results confirm that ADR is effective for both offline and online anomaly detection.

History

Email Address of Submitting Author

c3288930@uon.edu.au

Submitting Author's Institution

University Of Newcastle Australia

Submitting Author's Country

Australia

Licence

Exports

Licence

Exports