Data Stream Clustering for Online Anomaly Detection in Cloud Applications

Carla Sauvanaud (1) , Guthemberg Silvestre (1) , Mohamed Kaâniche (1) , Karama Kanoun (1)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique

This paper introduces a new approach for the online detection of performance anomalies in cloud virtual machines (VMs). It is designed for cloud infrastructure providers to detect during runtime unknown anomalies that may still be observed in complex modern systems hosted on VMs. The approach is drawn on data stream clustering of per-VM monitoring data and detects at a fine granularity where anomalies occur. It is design to be independent of the types of applications deployed over VMs. Moreover it deals with relentless changes in systems normal behaviors during runtime. The parallel analyses of each VM makes this approach scalable to a large number of VMs composing an application. The approach consists of two online steps: 1) the incremental update of sets of clusters by means of data stream clustering, and 2) the computation of two attributes characterizing the global clusters evolution. We validate our approach over a VMware vSphere testbed. It hosts a typical cloud application, MongoDB, that we study in normal behavior contexts and in presence of anomalies.

Mots clés: Anomaly detection; Data stream clustering; Cloud computing; service; MongoDB

Domaines: Performance et fiabilité [cs.PF]

Carla Sauvanaud, Guthemberg Silvestre, Mohamed Kaâniche, Karama Kanoun. Data Stream Clustering for Online Anomaly Detection in Cloud Applications. 11th European Dependable Computing Conference (EDCC 2015), Sep 2015, Paris, France. ⟨hal-01211774⟩