A Self-organising Isolated Anomaly Detection Architecture for Large Scale Systems

Emmanuelle Anceaume (1, 2) , Erwan Le Merrer (3) , Romaric Ludinard (4) , Bruno Sericola (4) , Gilles Straub (3)

1 CIDER
2 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
3 Technicolor R & I [Cesson Sévigné]
4 DIONYSOS - Dependability Interoperability and perfOrmance aNalYsiS Of networkS

Monitoring a system is the ability of collecting and analyzing relevant information provided by the monitored devices so as to be continuously aware of the system state. However, the ever growing complexity and scale of systems makes both real time monitoring and fault detection a quite tedious task. Thus the usually adopted option is to focus solely on a subset of information states, so as to provide coarse-grained indicators. As a consequence, detecting isolated failures or anomalies is a quite challenging issue. In this work, we propose to address this issue by pushing the monitoring task at the edge of the network. We present a peer-to-peer based architecture, which enables nodes to adaptively and efficiently self-organize according to their ''health'' indicators. By exploiting both temporal and spatial correlations that exist between a device and its vicinity, our approach guarantees that only isolated anomalies (an anomaly is isolated if it impacts solely a monitored device) are reported on the fly to the network operator. We show that the end-to-end detection process, i.e., from the local detection to the management operator reporting, requires a logarithmic number of messages in the size of the network.

Domaines: Informatique et théorie des jeux [cs.GT]

Emmanuelle Anceaume, Erwan Le Merrer, Romaric Ludinard, Bruno Sericola, Gilles Straub. A Self-organising Isolated Anomaly Detection Architecture for Large Scale Systems. Nem-Summit, Oct 2013, France. pp.12. ⟨hal-00907374⟩