DistAD：基于执行轨迹分布的软件异常检测
DistAD: Software Anomaly Detection Based on Execution Trace Distribution
摘要：
现代软件系统变得越来越复杂，这使得它们难以测试和验证。在运行时检测复杂系统中的软件部分异常可以帮助处理非预期的软件行为，避免灾难性的软件故障，并提高软件运行时的可用性。这些检测技术旨在识别故障（异常）的表现形式之前，他们最终导致不可避免的故障，从而支持以下运行时容错技术。在这项工作中，我们提出了一种新的异常检测方法命名DistAD，这是基于软件运行时动态执行痕迹的分布。与其他现有的作品使用关键性能指标，执行跟踪收集在运行时通过侵入式仪器。仪器按照取样机制进行控制，以避免过多的间接费用。利用循环神经网络的双向长短期记忆（Bi-LSTM）结构实现异常检测。整个框架在单类神经网络（OCNN）学习模式下构建，可以帮助消除缺乏足够的标记样本和数据不平衡问题的限制。在一个广泛使用的数据库系统Cassandra上进行了一系列的控制实验，证明了该方法的有效性和可行性。还评估了侵入式探测所带来的开销。结果表明，DistAD可以达到超过70%的准确率和90%的召回率（在正常状态下），与未监视的执行相比，不超过2倍的开销。
英文摘要：
Modern software systems have become increasingly complex, which makes them difficult to test and validate. Detecting software partial anomalies in complex systems at runtime can assist with handling unintended software behaviors, avoiding catastrophic software failures and improving software runtime availability. These detection techniques aim to identify the manifestation of faults (anomalies) before they ultimately lead to unavoidable failures, thus, supporting the following runtime fault-tolerant techniques. In this work, we propose a novel anomaly detection method named DistAD, which is based on the distribution of software runtime dynamic execution traces. Unlike other existing works using key performance indicators, the execution trace is collected during runtime via intrusive instrumentation. Instrumentation are controlled following a sampling mechanism to avoid excessive overheads. Bi-directional Long Short-Term Memory (Bi-LSTM), an architecture of Recurrent Neural Network (RNN) is used to achieve the anomaly detection. The whole framework is constructed under a One-Class Neural Network (OCNN) learning mode which can help eliminate the limits of lacking for enough labeled samples and the data imbalance issues. A series of controlled experiments are conducted on a widely used database system named Cassandra to prove the validity and feasibility of the proposed method. Overheads brought about by the intrusive probing are also evaluated. The results show that DistAD can achieve more than 70% accuracy and 90% recall (in normal states) with no more than 2 times overheads compared with unmonitored executions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
