Kernel Event Feature Guidance for Software Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for debugging software system performance in enterprise environments face challenges due to the need for source code, high overhead in monitoring, and false alarms from assuming homogeneous behavior in diverse applications, limiting effective anomaly detection.
Innovation Solution
A method utilizing kernel event feature guidance that processes input information from training and production scenarios to generate transaction traces, applying system resource features and program behavior features for anomaly detection, enabling fine-grained analysis without requiring source code or instrumentation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional debugging mode is used to obtain fine-grained control and detailed information, then measurement precision is improved, but productivity deteriorates due to execution overhead
Solution Approach 1:
The patent creates a copy of the production environment by capturing kernel event traces during normal execution and comparing them against baseline traces. This allows detailed analysis of system behavior without instrumenting or slowing down the actual production system, resolving the contradiction between obtaining detailed information and maintaining execution speed.
2Measurement precision
If white-box monitoring approach is used to profile and categorize application status, then measurement precision is improved, but ease of operation worsens due to source code availability requirements
Solution Approach 1:
The patent uses kernel events as an intermediary layer between the monitoring system and the application. By capturing and analyzing kernel-level events (system calls, resource access) instead of requiring application source code or instrumentation, the system achieves detailed application status profiling while maintaining ease of operation in black-box environments.
3Ease of operation
If black-box approach using low level events is used to monitor software, then ease of operation is improved, but measurement precision deteriorates due to homogeneous trace assumption
Solution Approach 1:
The patent segments the monolithic trace analysis into multiple dimensions: transaction-level segmentation (grouping kernel events into logical transactions), feature-level segmentation (extracting system resource features, program behavior features, and call graph features), and comparison-level segmentation (comparing against baseline transactions). This multi-level segmentation enables precise anomaly detection in black-box environments by capturing heterogeneous application behaviors without requiring homogeneous assumptions.
Data Source
AI summary
A method includes generating a normal trace in a training stage for the monitored software systems and a monitored trace in the deployment stage for anomaly detection, applying resource transfer functions to traces to convert them to resource features, and system call categorization to traces to convert them to program behavior features, performing anomaly detection in a global scope using the derived resource features and program behavior features, in case the system finds no anomaly, generating no anomaly report, in case the anomaly is found, including the result in an anomaly report; and performing conditional anomaly detection.