Issue No.03 - May-June (2015 vol.12)
Antonio Bovenzi , Dipartimento di Ingegneria Elettrica e delle Tecnologie dell?Informazione, UniversitÓ di Napoli Federico II, Italy
Francesco Brancati , Resiltech S.R.L., Pontedera (PI), Italy
Stefano Russo , Dipartimento di Ingegneria Elettrica e delle Tecnologie dell?Informazione, UniversitÓ di Napoli Federico II, Italy
Andrea Bondavalli , Departimento di Sistemi e Informatica, Università di Firenze
Revealing anomalies at the operating system (OS) level to support online diagnosis activities of complex software systems is a promising approach when traditional detection mechanisms (e.g., based on event logs, probes and heartbeats) are inadequate or cannot be applied. In this paper we propose aconfigurable detection framework to reveal anomalies in the OS behavior, related to system misbehaviors. The detector is based on online statistical analysestechniques, and it is designed for systems that operate under variable andnon-stationary conditions. The framework is evaluated to detect the activation of software faults in a complex distributed system for Air Traffic Management (ATM). Results of experiments with two different OSs, namely Linux Red Hat EL5 and Windows Server 2008, show that the detector is effective for mission-critical systems. The framework can be configured to select the monitored indicators so as to tune the level of intrusivity. A sensitivity analysis of the detector parameters iscarried out to show their impact on the performance and to give to practitioners guidelines for its field tuning.
Monitoring, Detectors, Linux, Operating systems, Software systems, Probes,mission-critical systems, Anomaly-detection, system monitoring, operating system
Antonio Bovenzi, Francesco Brancati, Stefano Russo, Andrea Bondavalli, "An OS-level Framework for Anomaly Detection in Complex Software Systems", IEEE Transactions on Dependable and Secure Computing, vol.12, no. 3, pp. 366-372, May-June 2015, doi:10.1109/TDSC.2014.2334305