Towards identifying OS-level anomalies to detect application software failures

Abstract

The next generation of critical systems, namely complex Critical Infrastructures (LCCIs), require efficient runtime management, reconfiguration strategies, and the ability to take decisions on the basis of current and past behavior of the system. Anomaly-based detection, leveraging information gathered at Operating System (OS) level (e.g., number of system call errors, signals, and holding semaphores in the time unit), seems to be a promising approach to reveal online application faults. Recently an experimental campaign to evaluate the performance of two anomaly detection algorithms was performed on a case study from the Air Traffic Management (ATM) domain, deployed under the popular OS used in the production environment, i.e., Red Hat 5 EL. In this paper we investigate the impact of the OS and the monitored resources on the quality of the detection, by executing experiments on Windows Server 2008. Experimental results allow identifying which of the two operating systems provides monitoring facilities best suited to implement the anomaly detection algorithms that we have considered. Moreover numerical sensitivity analysis of the detector parameters is carried out to understand the impact of their setting on the performance.

An OS-level Framework for Anomaly Detection in Complex Software Systems

“…Recent studies [8] and our earlier works [9], [10] show that revealing anomalies at operating system (OS) level is a promising approach when traditional detection mechanisms (e.g., based on event logs, probes and heartbeats) have poor performance or have limited applicability. 1 The driving idea is to shift the observation perspective to the OS, monitoring its behavior and interactions with the applications.…”

Experimental analysis of the first order time difference of indicators used in the monitoring of complex systems

“…This dataset is the result of the experimental campaign performed in [2], where the authors implemented an instrumentation infrastructures able to collect OS-level indicators, both for Linux and Windows environments. The testing activity was performed analyzing a large amount of data monitored in a real and complex case application, namely the SWIM-BOX® [2], a prototype to support global interoperability for the novel Air Traffic Management (ATM) systems. SWIM-BOX is deployed on Windows and Linux platforms.…”

“…The model is then used to detect performance anomalies, namely those changes in CPU usage not clearly justified by the actual workload. In [2] the authors propose a configurable detection framework to reveal anomalies in the OS behavior, related to system misbehaviors (software faults injected at the application level). For each monitored OS indicator, the framework computes lower and upper adaptive thresholds in order to take into account the dynamic behavior of the system.…”

“…All suspicious indicators are combined to reveal an anomaly. The work in [2] models the behavior and dynamics of the OS indicators using the random walk model [10], [11], so that changes in the features of indicators caused by non-random factors are considered suspicious. The random walk model is intuitive and easy-to-model, thus resulting practical in many scenarios e.g., for the modeling of a software clock in [12]- [15].…”

“…The random walk model is intuitive and easy-to-model, thus resulting practical in many scenarios e.g., for the modeling of a software clock in [12]- [15]. While the results shown in [2] are encouraging, it has to be noted that the random walk model is empirically used without any assessment of its validity for the indicators taken into consideration.…”