Abstract:In a large-scale cloud environment, many key performance indicators (KPIs) of entities are monitored in real time. These multivariate time series consist of high-dimensional, high-noise, random and time-dependent data. As a common method implemented in artificial intelligence for IT operations (AIOps), time series anomaly detection has been widely studied and applied. However, the existing detection methods cannot fully consider the influence of multiple factors and cannot quickly and accurately detect anomalies in multivariate KPIs of entities. Concurrently, fine-grained root cause locations cannot be determined for detected anomalies and often require abundant normal data that are difficult to obtain for model training. To solve these problems, we propose a long short-term memory (LSTM)-based semisupervised variational autoencoder (VAE) anomaly detection strategy called LR-SemiVAE. First, LR-SemiVAE uses VAE to perform feature dimension reduction and reconstruction of multivariate time series data and judges whether the entity is abnormal by calculating the reconstruction probability score. Second, by introducing an LSTM network into the VAE encoder and decoder, the model can fully learn the time dependence of multivariate time series. Then, LR-SemiVAE predicts the data labels by introducing a classifier to reduce the dependence on the original labeled data during model training. Finally, by proposing a new evidence lower bound (ELBO) loss function calculation method, LR-SemiVAE pays attention to the normal pattern and ignores the abnormal pattern during training to reduce the time cost of removing random anomaly and noise data. However, due to the limitations of LSTM in learning the long-term dependence of time series data, based on LR-SemiVAE, we propose a transformer-based semisupervised VAE anomaly detection and location strategy called RT-SemiVAE for cluster systems with complex service dependencies. This method learns the long-term dependence of multivariate time series by introducing a parallel multihead attention mechanism transformer, while LSTM is used to capture short-term dependence, and the introduction of parallel computing also markedly reduces model training time. After RT-SemiVAE detects entity anomalies, it traces the root entities according to the obtained service dependence graph and locates the root causes at the indicator level. We verify the strategies by using public data sets and constructing a system prototype. Experimental results show that compared with existing baseline methods, the LR-SemiVAE and RT-SemiVAE strategies can detect anomalies more quickly and accurately and perform fine-grained and accurate localization of the root causes of anomalies.

Time Series Anomaly Detection for Trustworthy Services in Cloud Computing Systems

Anomaly Detection at Scale: The Case for Deep Distributional Time Series Models

CloudDet: Interactive Visual Analysis of Anomalous Performances in Cloud Computing Systems

Statistical Learning for Anomaly Detection in Cloud Server Systems: A Multi-Order Markov Chain Framework

An Empirical Analysis of Anomaly Detection Methods for Multivariate Time Series

Synthetic Time Series for Anomaly Detection in Cloud Microservices

Utility Cloud: A Novel Approach for Diagnosis and Self-healing Based on the Uncertainty in Anomalous Metrics

Semisupervised anomaly detection of multivariate time series based on a variational autoencoder

Cross-dataset Time Series Anomaly Detection for Cloud Systems

Robust Anomaly Detection for Time-series Data

Distributed Online One-Class Support Vector Machine for Anomaly Detection over Networks

Algorithmic Recourse for Anomaly Detection in Multivariate Time Series

Practical Anomaly Detection over Multivariate Monitoring Metrics for Online Services

DL-RLSTM: an Anomaly Detection Framework for High Dimensional Time Series Data

Runtime reliability fractional distribution change analytics against cloud-based systems DDoS attacks

Non-Intrusive Anomaly Detection with Streaming Performance Metrics and Logs for DevOps in Public Clouds: A Case Study in AWS

An Effective Constraint-Based Anomaly Detection Approach on Multivariate Time Series.

A New Distributional Treatment for Time Series and an Anomaly Detection Investigation.

Utility Cloud

Wavelet-based Approach for Anomaly Detection of Online Services in Cloud Computing Systems

RCInvestigator: Towards Better Investigation of Anomaly Root Causes in Cloud Computing Systems