Efficient KPI Anomaly Detection Through Transfer Learning for Large-Scale Web Services

Zhang, Shenglin; Zhong, Zhenyu; Li, Dongwen; Fan, Qiliang; Sun, Yongqian; Zhu, Man; Zhang, Yuzhi; Pei, Dan; Sun, Jiyan; Liu, Yinlong; Ye, Hui; Zou, Yongqiang

doi:10.1109/jsac.2022.3180785

Cited by 25 publications

(4 citation statements)

References 53 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Domain adaptation has recently attracted the attention of the network community for various use cases, from wireless [23]- [27] to traffic classification [28], [29], from anomaly detection [30], [31] to network management [32].…”

Section: B Domain Adaptation In Communication Networkmentioning

confidence: 99%

Cross-Network Embeddings Transfer for Traffic Analysis

Gioacchini,

Mellia,

Vassio

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Artificial Intelligence (AI) approaches have emerged as powerful tools to improve traffic analysis for network monitoring and management. However, the lack of large labeled datasets and the ever-changing networking scenarios make a fundamental difference compared to other domains where AI is thriving. We believe the ability to transfer the specific knowledge acquired in one network (or dataset) to a different network (or dataset) would be fundamental to speed up the adoption of AI-based solutions for traffic analysis and other networking applications (e.g., cybersecurity). We here propose and evaluate different options to transfer the knowledge built from a provider network, owning data and labels, to a customer network that desires to label its traffic but lacks labels. We formulate this problem as a domain adaptation problem that we solve with embedding alignment techniques and canonical transfer learning approaches. We present a thorough experimental analysis to assess the performance considering both supervised (e.g., classification) and unsupervised (e.g., novelty detection) downstream tasks related to darknet and honeypot traffic. Our experiments show the proper transfer techniques to use the models obtained from a network in a different network. We believe our contribution opens new opportunities and business models where network providers can successfully share their knowledge and AI models with customers.

show abstract

Section: B Domain Adaptation In Communication Networkmentioning

confidence: 99%

Cross-Network Embeddings Transfer for Traffic Analysis

Gioacchini,

Mellia,

Vassio

et al. 2024

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

show abstract

“…Zhang et al 48 focused on KPI issues in large-scale web services. The authors have exploited adaptive transfer learning and variational AutoEncoder to propose an unsupervised KPI anomaly detection method.…”

Section: Big Service Management Approachesmentioning

confidence: 99%

On the use of big data frameworks in big service management

Ghedass,

Ben Charrada

2023

J Software Evolu Process

View full text Add to dashboard Cite

Over the last few years, big data have emerged as a paradigm for processing and analyzing a large volume of data. Coupled with other paradigms, such as cloud computing, service computing, and Internet of Things, big data processing takes advantage of the underlying cloud infrastructure, which allows hosting and managing massive amounts of data, while service computing allows to process and deliver various data sources as on‐demand services. This synergy between multiple paradigms has led to the emergence of big services, as a cross‐domain, large‐scale, and big data‐centric service model. Apart from the adaptation issues (e.g., need of high reaction to changes) inherited from other service models, the massiveness and heterogeneity of big services add a new factor of complexity to the way such a large‐scale service ecosystem is managed in case of execution deviations. Indeed, big services are often subject to frequent deviations at both the functional (e.g., service failure, QoS degradation, and IoT resource unavailability) and data (e.g., data source unavailability or access restrictions) levels. Handling these execution problems is beyond the capacity of traditional web/cloud service management tools, and the majority of big service approaches have targeted specific management operations, such as selection and composition. To maintain a moderate state and high quality of their cross‐domain execution, big services should be continuously monitored and managed in a scalable and autonomous way. To cope with the absence of self‐management frameworks for large‐scale services, the goal of this work is to design an autonomic management solution that takes the whole control of big services in an autonomous and distributed lifecycle process. We combine autonomic computing and big data processing paradigms to endow big services with self‐* and parallel processing capabilities. The proposed management framework takes advantage of the well‐known MapReduce programming model and Apache Spark and manages big service's related data using knowledge graph technology. We also define a scalable embedding model that allows processing and learning latent big service knowledge in a distributed manner. Finally, a cooperative decision mechanism is defined to trigger non‐conflicting management policies in response to the captured deviations of the running big service. Big services' management tasks (monitoring, embedding, and decision), as well as the core modules (autonomic managers' controller, embedding module, and coordinator), are implemented on top of Apache Spark as MapReduce jobs, while the processed data are represented as resilient distributed dataset (RDD) structures. To exploit the shared information exchanged between the workers and the master node (coordinator), and for further resolution of conflicts between management policies, we endowed the proposed framework with a lightweight communication mechanism that allows transferring useful knowledge between the running map‐reduce tasks and filtering inappropriate intermediate data (e.g., conflicting actions). The experimental results proved the increased quality of embeddings and the high performance of autonomic managers in a parallel and cooperative setting, thanks to the shared knowledge.

show abstract

“…The out-of-band information (including background information and feedback information) is integrated in VAE, so it has a better detection effect. Zhang et al [ 18 ] proposed an unsupervised KPI anomaly detection approach, named AnoTransfer, by combining a novel VAE-based KPI clustering algorithm with an adaptive transfer learning strategy. VAE can jointly train a basic model by clustering KPI fragments with similar shapes.…”

Section: Related Workmentioning

confidence: 99%

DA-LSTM-VAE: Dual-Stage Attention-Based LSTM-VAE for KPI Anomaly Detection

Zhao

Zhang

Shang

et al. 2022

Entropy

View full text Add to dashboard Cite

To ensure the normal operation of the system, the enterprise’s operations engineer will monitor the system through the KPI (key performance indicator). For example, web page visits, server memory utilization, etc. KPI anomaly detection is a core technology, which is of great significance for rapid fault detection and repair. This paper proposes a novel dual-stage attention-based LSTM-VAE (DA-LSTM-VAE) model for KPI anomaly detection. Firstly, in order to capture time correlation in KPI data, long–short-term memory (LSTM) units are used to replace traditional neurons in the variational autoencoder (VAE). Then, in order to improve the effect of KPI anomaly detection, an attention mechanism is introduced into the input stage of the encoder and decoder, respectively. During the input stage of the encoder, a time attention mechanism is adopted to assign different weights to different time points, which can adaptively select important input sequences to avoid the influence of noise in the data. During the input stage of the decoder, a feature attention mechanism is adopted to adaptively select important latent variable representations, which can capture the long-term dependence of time series better. In addition, this paper proposes an adaptive threshold method based on anomaly scores measured by reconstruction probability, which can minimize false positives and false negatives and avoid adjustment of the threshold manually. Experimental results in a public dataset show that the proposed method in this paper outperforms other baseline methods.

show abstract

Efficient KPI Anomaly Detection Through Transfer Learning for Large-Scale Web Services

Cited by 25 publications

References 53 publications

Cross-Network Embeddings Transfer for Traffic Analysis

Cross-Network Embeddings Transfer for Traffic Analysis

On the use of big data frameworks in big service management

DA-LSTM-VAE: Dual-Stage Attention-Based LSTM-VAE for KPI Anomaly Detection

Contact Info

Product

Resources

About