Abstract:Continuity and steadiness are vital for services with massive users, which requires the anomalies of services should be detected and resolved in a timely manner. Our previous work proposed a tool, namely ImpAPTr (Impact Analysis based on Pruning Tree), to identify the combination of multiple dimensional attributes as the clues leading to the root cause of service anomalies. However, ImpAPTr applies a threshold driven strategy, i.e. it needs to be triggered by a ≥ drop of the success rate of the service calls (abbr. SRSC), which may face problems in an atypical yet pervasive situation in field application. For example, the combination of trivial anomalies (i.e. each causes a drop less than 0.05% to SRSC) can lead to a far more than 0.05% drop on SRSC. Besides, a suitable threshold is usually hard to be determined, etc. To address these problems, we propose a new method, namely ImpAPTr+ in this paper to free the constraint of the 0.05% threshold. The basic idea is to involve time dimension and identify clues across multiple time intervals of data. We performed evaluation on three typical methods (i.e. ImpAPTr+, R-Adtributor and Squeeze) with both production environment dataset and simulation dataset. The former dataset is directly retrieved from the service monitoring data in Meituan, one of the largest on-line service providers worldwide. The latter dataset is fabricated also using the monitoring data from the same company. The results indicate: (1) ImpAPTr+ outperforms previous approaches to a large degree in terms of accuracy. (2) Both ImpAPTr+ and R-Adtributor are able to find proper clues within seconds. (3) ImpAPTr+ tends to find proper clues with shorter time intervals (i.e. less data), which implies that the method is more suitable for near real-time monitoring scenarios.

RAPMiner: A Generic Anomaly Localization Mechanism for CDN System with Multi-dimensional KPIs

Rapid Deployment of Anomaly Detection Models for Large Number of Emerging KPI Streams.

Multi-stage Location for Root-Cause Metrics in Online Service Systems.

Network Anomaly Detection and Localization

HotSpot: Anomaly Localization for Additive KPIs with Multi-Dimensional Attributes.

MSCA: an Unsupervised Anomaly Detection System for Network Security in Backbone Network.

ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing

AMiner: A Modular Log Data Analysis Pipeline for Anomaly-based Intrusion Detection

Switching Gaussian Mixture Variational RNN for Anomaly Detection of Diverse CDN Websites

Practical and White-Box Anomaly Detection through Unsupervised and Active Learning

CMMD: Cross-Metric Multi-Dimensional Root Cause Analysis

Opprentice: Towards Practical And Automatic Anomaly Detection Through Machine Learning

CMDiagnostor: an Ambiguity-Aware Root Cause Localization Approach Based on Call Metric Data

Robust Anomaly Clue Localization of Multi-Dimensional Derived Measure for Online Video Services

Locating Anomaly Clues for Atypical Anomalous Services: An Industrial Exploration

Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection

FTM-RCA: A Fast Two-Stage Multi-dimensional Root-Cause Analysis of Network Anomalies.

Intelligent Anomaly Detection and Mitigation in Data Centers

Generic and Robust Localization of Multi-dimensional Root Causes.

MTAD: Tools and Benchmarks for Multivariate Time Series Anomaly Detection

Cascade RDN: Towards Accurate Localization in Industrial Visual Anomaly Detection with Structural Anomaly Generation