A Multi-layer Anomaly Detector for Dynamic Service-Based Systems

Ceccarelli, Andrea; Zoppi, Tommaso; Itria, Massimiliano Leone; Bondavalli, Andrea

doi:10.1007/978-3-319-24255-2_13

Cited by 6 publications

(18 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The validation experiments are organized as follows: in 40 runs we inject the memory error, while in the other 40 runs the network error is injected, considering different Liferay services involved by the workload as injection points. Regarding the probing system, we observe 55 indicators [6], [22] from three different layers: 23 from the CentOS operating system, 25 from the middleware (the JVM [24]) and 7 from the Network. As explained in Section 3.3, we select the 20 most performing anomaly checkers (and consequently, the most relevant indicators) out of a set of 221 options.…”

Section: Experiments Descriptionmentioning

confidence: 99%

“…From the top of Table 4 we summarize precision, recall and F-Scores obtained i) using the framework in [6], ii) introducing the network layer, iii) including the diff data series in addition to the default (value) for each indicator and iv) considering services information in combination with context awareness. Table 4 shows how using context awareness significantly raises the F-Score.…”

Section: Precision and Recall Varying Modulesmentioning

confidence: 99%

“…The anomaly detector is in charge to observe these fluctuations providing a response to the administrator as soon as it can, triggering proactive recovery or dumping critical data. Reviewing state of the art it is possible to notice that the most used layers are the network [2], [3] and the operating system [6], [11]. This is not surprising since most of the systems include these layers: building solutions which fetch data from these layers allow building frameworks that fit in a very wide range of contexts.…”

Section: State Of the Art And Comparison With Other Solutionsmentioning

confidence: 99%

“…Therefore, this multi-layer approach turned out very suitable to cope with dynamicity of complex systems, at the cost of a calibration time to reconfigure the parameters of the anomaly detector when changes of the components of the complex system are detected. This approach was previously proved effective on systems with reduced dynamicity respect to complex systems [14], while experimental results showed that a more accurate definition of the context was needed in highly dynamic systems [6] to improve detection accuracy. In this study we consider knowledge of basic information on the context -referred as context-awareness -that can be easily retrieved from integration modules of SOAs.…”

Section: Introductionmentioning

confidence: 99%

“…Observing only OS indicators, SPS allowed implementing an anomaly detector which performed error detection with high precision. Therefore we adapted this promising approach to work in a more dynamic context [6], where we instantiated the multi-layer anomaly detection strategy on the prototype of the Secure! [8] SOA.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Context-Awareness to Improve Anomaly Detection in Dynamic Service Oriented Architectures

Zoppi

Ceccarelli

Bondavalli

2016

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Revealing anomalies to support error detection in softwareintensive systems is a promising approach when traditional detection mechanisms are considered inadequate or not applicable. The core of anomaly detection lies in the definition of the expected behavior of the observed system. Unfortunately, the behavior of complex and dynamic systems is particularly difficult to understand. To improve the accuracy of anomaly detection in such systems, in this paper we present a contextaware anomaly detection framework which acquires information on the running services to calibrate the anomaly detection. To cope with system dynamicity, our framework avoids instrumenting probes into the application layer of the observed system monitoring multiple underlying layers instead. Experimental evaluation shows that the detection accuracy is increased considerably through context-awareness and multiple layers monitoring. Results are compared to state-of-the-art anomaly detectors exercised in demanding more static contexts.

show abstract

Section: Experiments Descriptionmentioning

confidence: 99%

Section: Precision and Recall Varying Modulesmentioning

confidence: 99%

Section: State Of the Art And Comparison With Other Solutionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Context-Awareness to Improve Anomaly Detection in Dynamic Service Oriented Architectures

Zoppi

Ceccarelli

Bondavalli

2016

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

Differential analysis of Operating System indicators for anomaly detection in dependable systems: An experimental study

et al. 2016

Self Cite

View full text Add to dashboard Cite

Dependable complex systems often operate under variable and non-stationary conditions, which requires efficient and extensive monitoring and error detection solutions. Amongst the many, the paper focuses on anomaly detection techniques, which require measuring the evolution of monitored indicators through time to identify anomalies, i.e. deviations from the expected operational behavior. The timely identification of anomalies in dependable, fault tolerant systems allows to timely detect errors in the services and react appropriately. In this paper, we investigate the possibility to monitor the evolution of indicators through time using the random walk model on indicators belonging to Operating Systems, specifically in our study the Linux Red Hat EL5. The approach is based on the experimental evaluation of a large set of heterogeneous indicators, which are acquired under different operating conditions, both in terms of workload and faultload, on an air traffic management target system. The statistical analysis is based on a bestfitting approach aiming to minimize the integral distance between the empirical data distribution and some reference distributions. The outcomes of the analysis show that the idea of adopting a random walk model for the development of an anomaly detection monitor for critical systems that operates at Operating System level is promising. Moreover, standard distributions such as Laplace and Cauchy, rather than Normal, should be used for setting up the thresholds of the monitor. Further studies that involve a new application, a different Operating System and a new layer (an Application Server) will allow verifying the generalization of the approach to other fault tolerant systems, monitored layers and set of indicators.

show abstract

An Initial Investigation on Sliding Windows for Anomaly-Based Intrusion Detection

Zoppi

Ceccarellli

Bondavalli

2019

2019 IEEE World Congress on Services (SERVICES)

View full text Add to dashboard Cite

A Multi-layer Anomaly Detector for Dynamic Service-Based Systems

Cited by 6 publications

References 10 publications

Context-Awareness to Improve Anomaly Detection in Dynamic Service Oriented Architectures

Context-Awareness to Improve Anomaly Detection in Dynamic Service Oriented Architectures

Differential analysis of Operating System indicators for anomaly detection in dependable systems: An experimental study

An Initial Investigation on Sliding Windows for Anomaly-Based Intrusion Detection

Contact Info

Product

Resources

About