Anomaly Detection in Cloud Components

Abstract

Cloud platforms, under the hood, consist of a complex inter-connected stack of hardware and software components. Each of these components can fail which may lead to an outage. Our goal is to improve the quality of Cloud services through early detection of such failures by analyzing resource utilization metrics. We tested Gated-Recurrent-Unit-based autoencoder with a likelihood function to detect anomalies in various multi-dimensional time series and achieved high performance.

A Systematic Review on Anomaly Detection for Cloud Computing Environments

“…References Multi-layer perceptron [16], [26], [56], [64], [139], [185], [48], [46], [15], [92], [38], [36], [88], [37], [109], [90], [104], [208], [25], [159], [25], [214], [144] Autoencoder [206], [32], [86], [73] Recurrent neural network [21], [72], [104], [86] Convolutional neural network [180], [62], [2], [104] Self-organizing map [179], [27], [177], [187] Adaptive neuro-fuzzy inference system [60], [124], [138] Extreme learning machine [209], [96], [ [197] for. Similar to the LSTM-based approaches, the values that actually occur are then compared to the prediction which allows to decide how rare they are.…”

Anomaly Detection in a Large-scale Cloud Platform

“…We evaluated the performance against a publicly available single-dimensional labelled dataset and multi-dimensional datasets of the Console. Our model yields adequate results for the one-dimensional Numenta Anomaly Benchmark (NAB) benchmark dataset with a score of 59.8 on the Standard Profile, which is currently the third-best score [37]. But, we have not performed a quantitative comparison for the multi-dimensional telemetry due to the lack of a standard benchmark in this field.…”

“…Based on our experience, of all the models we experimented with, they gave the strongest predictive power. To the best of our knowledge, we are the first to use the GRU-based autoencoder model incorporated with the likelihood function for anomaly detection in multi-dimensional Cloud components telemetry [37,38]. The works that are closest to ours are Numenta's Hierarchical Temporal Memory (HTM) [39] based learning algorithm for error calculation in time series, and National Aeronautics and Space Administration (NASA)'s LSTM networks-based anomaly detectors [40].…”

“…We saw that the raw error values' predictive power is low against publicly available benchmark datasets (NAB score of < 40). Therefore, the likelihood transformation was in order [37]. We use the anomaly likelihood measurement approach introduced by Ahmad et al [39].…”

“…We compared the anecdotal feedback of the DevOps team against the anomalies reported by the model. The DevOps team found the anomaly flagging better than that of the existing approaches (see [38] for details of the analysis).…”