Automated Extraction of Behaviour Model of Applications

Snapshot;Monitoring;Datacenters;Replication

Chakraborty, Tandra

University of Waterloo

关键词: Snapshot;    Monitoring;    Datacenters;    Replication;   

Others  :  https://uwspace.uwaterloo.ca/bitstream/10012/10834/1/Chakraborty_Tandra.pdf

瑞士|英语

来源: UWSPACE Waterloo Institutional Repository

【 摘 要 】

Highly replicated cloud applications are deployed only when they are deemed to be func-tional. That is, they generally perform their task and their failure rate is relatively low.However, even though failure is rare, it does occur and is very difficult to diagnose. Wedevise a tool for failure diagnosis which learns the normal behaviour of an application interms of the statistical properties of variables used throughout its execution, and thenmonitors it for deviation from these statistical properties. Our study reveals that manyvariables have unique statistical characteristics that amount to an invariant of the pro-gram. Therefore, any significant deviation from these characteristics reflects an abnormalbehaviour of the application which may be caused by a program error.It is difficult to get the invariant from the application’s static code analysis alone. Forexample, the name of a person usually does not include a semicolon; however, an intrudermay try to do a SQL injection (which will include a semicolon) through the ;;name’ fieldwhile entering his information and be successful if there is no checking for this case. Thisscenario can only be captured at runtime and may not be tested by the application de-veloper. The character range of the ;;name’ variable is one of its statistical properties; bylearning this range from the execution of the application it is possible to detect the abovedescribed abnormal input. Hence, monitoring the statistics of values taken by the differentvariables of an application is an effective way to detect anomalies that can help to diagnosethe failure of the application.We build a tool that collects frequent snapshots of the application’s heap and build astatistical model solely from the extensional knowledge of the application. The extensionalknowledge is only obtainable from runtime data of the application without having anydescription or explanation of the application’s execution flow. The model characterizesthe application’s normal behaviour. Collecting snapshots in form of memory dumps and determine the application’s behaviour model from them without code instrumentationmake our tool applicable in cases where instrumentation is computationally expensive.Our approach allows a behaviour model to be automatically and efficiently built usingthe monitoring data alone. We evaluate the utility of our approach by applying it onan e-commerce application and online bidding system, and then derive different statisti-cal properties of variables from their runtime-exhibited values. Our experimental resultdemonstrates 96% accuracy in the generated statistical model with a maximum 1% per-formance overhead. This accuracy is measured at the basis of generating less false positivealerts when the application is running without any anomaly. The high accuracy and lowperformance overhead indicates that our tool can successfully determine the application’snormal behaviour without affecting the performance of the application and can be used tomonitor it in production time. Moreover, our tool also correctly detected two anomalouscondition while monitoring the application with a small amount of injected fault. In ad-dition to anomaly detection, our tool logs all the variables of the application that violatesthe learned model. The log file can help to diagnose any failure caused by the variablesand gives our tool a source-code granularity in fault localization.