Detective-Dee: A Non-Intrusive In Situ Anomaly Detection and Fault Localization Framework

作者：Yang Man, Shiyi Li, Wen Xia, Yikai Li, Bochun Yu, Yingchi Long, Yanqi Pan · 年份：2023 · DOI：10.1109/srds60354.2023.00032 · 被引用次数：5 · 研究领域：Anomaly Detection Techniques and Applications、Network Security and Intrusion Detection、Smart Grid Security and Resilience

Maintaining the high availability of online systems requires reliable and fast online anomaly detection and fault localization. However, existing anomaly detection methods either suffer high training costs and low generalization capabilities or are designed and evaluated using offline data with limited efficacy in online usage. Furthermore, these methods' fault localization capabilities are often inadequate due to external observability constraints. Therefore, designing a new approach to address these limitations effectively is essential. To address the aforementioned limitations, this paper proposes a novel non-intrusive in situ anomaly detection and fault lo-calization framework, Detective-Dee. The proposed framework leverages a compressed sensing method for anomaly detection, which exhibits strong generalization capabilities and eliminates extensive training. Detective-Dee further improves its performance by incorporating three optimization techniques: concurrent sub-stitution sampling, Look-Up-Table-based similarity calculation, and substitution window-based threshold selection to improve parallelism and reduce computational and comparison overheads. Additionally, the framework adopts an innovative non-intrusive fault localization strategy based on anomaly detection triggering. This approach utilizes the dynamic instrumentation capabilities of eBPF, combined with extracting vulnerable function and function call chains through source code analysis, to improve the online an...