Performance Anomaly and Change Point Detection For Large-Scale System Management

Abstract

The presentation starts with the short overview of the classical SPC based anomaly detection techniques and tools including MASF [1]; SETDS, Exception Value (EV) meta-metric based Change Point Detection [2]; Control Chart [3]; business driven massive prediction [4] and methods of using them to manage large-scale systems such as on-prem servers fleet or massive clouds. Then the presentation will be focusing on modern techniques of anomaly and normality detection, such as, deep learning and entropy-based anomalous pattern detections.

Full text

 
Performance Anomaly and Change Point Detection
For Large-Scale System Management
 !
"#
$ !%&"$&
ABSTRACT
"""'"("("')
"  &&    !"  *  ""&
"&+ "    &   ,-  ./01 2
3&" 4 " 546  ""&  !"  "
  2""&  .01      .701  ! "
("  ("  "&  .0    "  )
  "    "  "&"  *"   &
 ""(" 8"" ("& $ "
"  ""  '  !"  )&     "
"&+ "  )  *    *  ""&
 &    ""  "    "*!"
 """&$
KEYWORDS
*  ""&1  &"    ""&1
! "  ("  )"&1  *"  ")&"1
&&$
1INTRODUCTION
  ""  &""   &    &*
    ")&"  """      ("*
"  9  "+ "  "  )'
&":
 3&"!" "" )&  "
&   "  ' '  )"  ("  "
9""&")""("$
 ")"(&"!"") "
  (";,< """  ""
! ")  " &" " "
&(""&$
""  " "  ("  "&"    &  !"
""""&":
 &  3&"    "  2""&
*"526'&  !"  "'
,-  "  5&  &"  
"  "  )  & "  ")&"
" ""6$
 *  ( 9  "$$      
'!""($"&"&
'"$
 # "  2("  "&  !"  
""  *    &""  ! "
  *"  ")&"       &"
") )"&$
 """&+ "  &=" 
="'  5""  "6    "*!"
!&"*$
2Statistical Exception and
Trend Detection System
(SETDS)
2    "*  .0  )    &
>"  ""&  &("
!"*&($  &"  
  3&"  4 "  546  !"
";  "    4  !"&"
;"  ""&      *"  &*
,""& &*    
")&"""$
"  - "  /$   "  ( *  '  2
*9"           !*   /?@
'""  &"' ":!""
 ")""&";" "  "&" A*
& $
/

 
 !
- "/:B" !"($B "&""

"3&" 4 "546.0'&  !&*  
  *  &"  5 "6  "  && "
 *  *    C""&"!"'"" &
5B<;<<6"& ""
  "  )    *$  "  &
'( * ' " ''""**
"*      '"  "  "
""$   "  4      "    ""& 
&"  !*( "DEV(t)=0E"+ 
'""Ft’ ""&"$
"&!" """&"&""'
&    )  "    &"      "
  "&"    $  B    !"  )  "
&  "' !    &
"&& "")"&'- "$
- ":"'")"&&:
!"*($)&"""&"
(""4!"G "")"&& !"
 && "  " " && *
! ""&$ & !"("
!*  !     ""  "  !*  &"
")&"    5"$$  B  "    -$/6 
! ""& 5"$$   !"  )& "; "
  -$/  "&  &6$  #   "    "    
&!*&&")   "  !"  )  *"
  "       .0    "    '   *
&  !   *&""!*  2  
  &  )  *  /?@'""      
 9"("") " 5
*"6$
3Anomaly Detection by
Neural Network
  ""&  ! !*    *   "
*"  ")&"    5"$$    ""
C""'" &<!&
'  "  *&  ")"&6  &   !"  "  !*
=" ="'$-$7'")"! !*
  "  H  *"  &"    &    
'  "  "  '    -$/    7
&"": <5"  & &"6
<    D8E 5& !"    !&G!
""6$#*"'*""&&-$
/$     "  &&  D&'!*  E  <  '
"! / &'"()<
"")"'"""&)
"")"&$
&*2" "("
&"  "  "      "    '
&"&*  "  ""    "" "  "  "
 * !*!" >"      &"  
<   <    D8E    "  D  "&E "
="&"9&"&*$
")"&&!"">)"" "
!*   &"   )  ' >"
 "   "! "  !*
C"&"!*"'*")"& &
"*" '*&"""$


 
- "7:2""<"=" ="'2""&
D=E5<6
4 Entropy-based Method of Anomaly
Detection
"'&"")>")
(  !G"&      &  )  " ""$  -
"3"   &   !"  "(" & "
("G " !" " & !G"&
5I6  *("("*)"$
"   ""  &      ""&   
!"(  )   *"  )  !G"&  !*  "  "
"*  )  "&  !G"&  !*    "  )'
) .J0:

¿xi
xavg
xi
xavg
∗ln ⁡¿
nIC=1
n∗ln
(
n
)
∑
i=1
n
¿
6
"")"!G"&"("":
nIC=9"!&""K&"
 !")!"(5"$$ *6
   3    " "  "&  ( "  )" "(  5"$$  
&"& 6
" """(5"$$ *6
" niC ( "  ("  ) /$DE"   
&""*  !&"  5"$$  )   I    G 
" &   !"  )    "    "   6
/&"""$-"3")
"  I    "  !"(  )    
*)""nIC !"
 !" &")&"'""'
"!""&"""""("*)"$
& " ""I&"")*
'")"&$
REFERENCES
./0 L"C"*  # 9"    "   $  /MMJ$ MASF - Multivariate
Adaptive Statistical Filtering.   &$  )   "
," ""I $//$
.0  !$@$ Exception Based Modeling and Forecasting$
&$) "," ""I $
.70  !$/7$Review of IT Control Chart$L =
AM@A4$=//=("!"/7$
.0   ! "  $  /?$ Systems and methods for modeling
computer resource metrics$"/7A?MA$
.J0  "  <!9$  //. Quantifying Imbalance in Computer
Systems$&$) "," ""I 
/