An Anomaly Detection Algorithm for Microservice Architecture Based on Robust Principal Component Analysis
An Anomaly Detection Algorithm for Microservice Architecture Based on Robust Principal Component Analysis
复制标题
一种基于鲁棒主成分分析的微服务架构异常检测算法
DOI：
10.1109/access.2020.3044610
复制
发表时间：
2020-01-01
期刊：
影响因子：
3.9
通讯作者：
Chen, Fengyi
中科院分区：
文献类型：
--
作者：
Jin, Mingxu;Lv, Aoran;Chen, Fengyi
微服务架构（MSA）是一种新的软件架构，它将一个大型的单个应用程序和服务划分为几十个支持微服务。随着MSA的日益普及，MSA的安全问题也越来越受到人们的关注。在本文中，我们提出了一个算法挖掘因果关系和根本原因。该算法由两部分组成：基于鲁棒主成分分析（RPCA）的调用链异常分析和单指标异常检测算法。单指标异常检测算法由隔离森林（IF）算法、单类支持向量机（SVM）算法、局部离群因子（LOF）算法和3 σ准则组成。针对MSA过程中出现的一般性异常和网络耗时异常，制定了不同的异常耗时检测策略。我们选取了2020年国际AIOps挑战赛的一批样本数据和三批测试数据对我们的算法进行调试。根据比赛组织者的评分标准，我们的算法在四批数据中的平均得分为0.8304（满分为1）。我们提出的算法在异常检测方面比一些传统的机器学习算法有更高的准确性。
Microservice architecture (MSA) is a new software architecture, which divides a large single application and service into dozens of supporting microservices. With the increasingly popularity of MSA, the security issues of MSA get a lot of attention. In this paper, we propose an algorithm for mining causality and the root cause. Our algorithm consists of two parts: invocation chain anomaly analysis based on robust principal component analysis (RPCA) and a single indicator anomaly detection algorithm. The single indicator anomaly detection algorithm is composed of Isolation Forest (IF) algorithm, One-Class Support Vector Machine (SVM) algorithm, Local Outlier Factor (LOF) algorithm, and $3\sigma $ principle. For general and network time-consuming anomaly in the process of the MSA, we formulate different anomaly time-consuming detection strategies. We select a batch of sample data and three batches of test data of the 2020 International AIOps Challenge to debug our algorithm. According to the scoring criteria of the competition organizers, our algorithm has an average score of 0.8304 (The full score is 1) in the four batches of data. Our proposed algorithm has higher accuracy than some traditional machine learning algorithms in anomaly detection.