基于小波分析的云计算在线业务异常负载检测方法

删除或更新信息，请邮件至freekaoyan#163.com(#换成@)

清华大学辅仁网/2017-07-07

刘金钊, 周悦芝, 张尧学

清华大学计算机科学与技术系, 北京 100084

Wavelet-based approach for anomaly detection of online services in cloud computing systems

LIU Jinzhao, ZHOU Yuezhi, ZHANG Yaoxue

Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China

摘要:

输出: BibTeX | EndNote (RIS)

摘要随着越来越多的在线业务被迁移到基于云的平台上，如何检测云平台上在线业务的异常运行状态成为了一个重要的问题。现有方法通过分析在线业务的实时负载数据来判断业务是否存在异常，在应对由程序异常或突发用户访问引起的异常负载时存在准确率低、误报率高的问题。该文提出并实现了一种面向云计算在线业务的异常负载检测方法。该方法利用小波分析技术，将原始负载数据分解成频率不同的多条曲线，并利用统计分析技术，通过检测各个频率上的异常增长或降低来判断负载是否存在异常。实验结果表明：同现有方法相比，该方法更准确，同时可以大大降低误报率。

关键词 ：云计算,异常负载检测,离散小波变换

Abstract：As an increasing number of online services have migrated into the cloud, anomaly detection has now become an important problem. Existing efforts detect anomalies by mining real-time workloads; however, the accuracy of such approaches cannot be assured in case of user spikes and application errors. This paper presents a wavelet-based online anomaly detection approach that uses discrete wavelet transforms to decompose real-time workload traces into multiple curves with different frequencies and then applies statistical analysis to the decomposed traces to detect the workload anomalies. Tests show that this approach is more accurate with a lower false-alarm rate than existing approaches.

Key words：cloud computing workload anomaly detection discrete wavelet transform

收稿日期: 2016-01-08 出版日期: 2017-05-20

ZTFLH:

TP393

通讯作者:周悦芝,副教授,E-mail:zhouyz@tsinghua.edu.cnE-mail: zhouyz@tsinghua.edu.cn

引用本文:

刘金钊, 周悦芝, 张尧学. 基于小波分析的云计算在线业务异常负载检测方法[J]. 清华大学学报（自然科学版）, 2017, 57(5): 550-554.
LIU Jinzhao, ZHOU Yuezhi, ZHANG Yaoxue. Wavelet-based approach for anomaly detection of online services in cloud computing systems. Journal of Tsinghua University(Science and Technology), 2017, 57(5): 550-554.

链接本文:

http://jst.tsinghuajournals.com/CN/10.16511/j.cnki.qhdxxb.2017.22.036或 http://jst.tsinghuajournals.com/CN/Y2017/V57/I5/550

图表:

图1 3级离散小波变换示例

图2 1级离散小波变换

图3 多级离散小波变换

表1 负载数据集的基本信息

表2 3个算法的误报数与误报率

参考文献:

[1]	Armbrust M, Fox A, Griffith R, et al. A view of cloud computing [J]. Communications of the ACM, 2010, 53(4): 50-58.
[2]	Jadeja Y, Modi K. Cloud computing-concepts, architecture and challenges [C]//Proc International Conference on Computing, Electronics and Electrical Technologies (ICCEET). Piscataway, NJ, USA: IEEE Press, 2012: 877-880.
[3]	Kandias M, Virvilis N, Gritzalis D. The insider threat in cloud computing [C]//Proc 6th International Workshop on Critical Information Infrastructure Security. Berlin, Germany: Springer-Verlag, 2013: 93-103.
[4]	IBM. Tivoli[EB/OL].[2015-12-24]. https://www.ibm.com/software/tivoli.
[5]	HP.Operations Manager[EB/OL].[2015-12-24]. http://www8.hp.com/us/en/software-solutions/operations-manager-infrastructure-monitoring/.
[6]	Tan Y, Nguyen H, Shen Z, et al. PREPARE: Predictive performance anomaly prevention for virtualized cloud systems [C]//Proc 32nd International Conference on Distributed Computing Systems (ICDCS). Piscataway, NJ, USA: IEEE Press, 2012: 285-294.
[7]	WANG Chengwei, Viswanathan K, Choudur L, et al. Statistical techniques for online anomaly detection in data centers [C]//Proc 2011 IFIP/IEEE International Symposium on Integrated Network Management (IM). Piscataway, NJ, USA: IEEE Press, 2011: 385-392.
[8]	XIE Yi, YU Shunzheng. A large-scale hidden semi-Markov model for anomaly detection on user browsing behaviors [J]. IEEE/ACM Transactions on Networking, 2009, 17(1): 54-65.
[9]	WANG Tao, ZHANG Wenbo, WEI Jun. Workload-aware online anomaly detection in enterprise applications with local outlier factor [C]//Proc 36th Annual Conference on Computer Software and Applications (COMPSAC). Piscataway, NJ, USA: IEEE Press, 2012: 25-34.
[10]	GUAN Qiang, FU Song. Adaptive anomaly identification by exploring metric subspace in cloud computing infrastructures [C]//Proc 32nd International Symposium on Reliable Distributed Systems (SRDS). Piscataway, NJ, USA: IEEE Press, 2013: 205-214.
[11]	WANG Chengwei, Talwar V, Schwan K, et al. Online detection of utility cloud anomalies using metric distributions [C]//Proc Network Operations and Management Symposium (NOMS). Piscataway, NJ, USA: IEEE Press, 2010: 96-103.
[12]	Vasic N, Novakovicet D, Miucin S, et al. DejaVu: Accelerating resource allocation in virtualized environments [J]. ACM SIGARCH Computer Architecture News, 2012, 40(1): 423-436.
[13]	Reis A, Rocha J, Alexandre P. Feature extraction via multiresolution analysis for short-term load forecasting [J]. IEEE Transactions on Power Systems, 2005, 20(1): 189-198.
[14]	Pannu H, LIU Jianguo, FU Song. AAD: Adaptive anomaly detection system for cloud computing infrastructures [C]//Proc 31st Symposium on Reliable Distributed Systems (SRDS). Piscataway, NJ, USA: IEEE Press, 2012: 396-397.
[15]	Mallat S. A theory for multiresolution signal decomposition: The wavelet representation [J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1989, 11(7): 674-693.

[1]	刘荣华, 魏加华, 翁燕章, 王光谦, 唐爽. HydroMP:基于云计算的水动力学建模及计算服务平台[J]. 清华大学学报（自然科学版）, 2014, 54(5): 575-583.
[2]	王志华, 庞海波, 李占波. 一种适用于Hadoop云平台的访问控制方案[J]. 清华大学学报（自然科学版）, 2014, 54(1): 53-59.