Pod-Level Anomaly Detection in Kubernetes Distributed Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection techniques developed for monolithic applications are not effective in detecting anomalous behavior in distributed applications deployed on a Kubernetes platform, as they fail to account for the unique behavior of individual pods and data traffic patterns within and between pods, leading to undetected anomalies.
Innovation Solution
A system that monitors and compiles statistics on data traffic between pods, creates a reference model of normal behavior, and compares current activity data against this model to flag deviations as anomalies, also comparing pod behavior within replica sets to identify discrepancies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection techniques developed for monolithic applications are used, then the detection process is simple, but the detection accuracy is low for distributed applications
Solution Approach 1:
The patent segments the distributed application into individual pods and analyzes each pod's behavior separately. It collects activity data from each pod independently, creates individual reference models for each pod, and detects anomalies at the pod level. This segmentation approach enables accurate detection of pod-specific anomalies while maintaining manageable complexity through modular processing.
Solution Approach 2:
The patent changes the detection parameters from monolithic application-level metrics to pod-level activity data metrics. It tracks specific parameters such as data traffic patterns, request rates, and resource usage at the individual pod level, allowing for more precise anomaly detection tailored to the distributed architecture's unique characteristics.
2Measurement precision
If only data traffic in and out of the application is evaluated, then the detection process is simple, but anomalies within pod interactions are undetected
Solution Approach 1:
The patent segments data collection into three distinct categories: data traffic in and out of each pod, data traffic between pods, and inter-workload traffic. This segmentation enables comprehensive monitoring of all data flows while maintaining organized and manageable data collection processes through structured categorization.
Solution Approach 2:
The activity monitor is designed with multi-functionality to collect various types of activity data simultaneously - ingress traffic, egress traffic, inter-pod traffic, and inter-workload traffic. This universal data collection capability ensures comprehensive anomaly detection without requiring separate monitoring systems for each traffic type.
3Measurement precision
If individual pod behavior is not considered, then the detection process is simple, but anomalies in specific pods are undetected
Solution Approach 1:
The patent creates separate reference models for each pod based on their individual historical activity data. This segmentation allows the system to understand and detect anomalies specific to each pod's normal behavior patterns, rather than applying a single generic model to all pods. Each pod's unique characteristics are captured in its own reference model.
Solution Approach 2:
The patent applies local quality by tailoring the anomaly detection approach to each individual pod's characteristics. Instead of using a uniform detection threshold or model for all pods, it creates pod-specific reference models that reflect each pod's local behavior patterns, enabling more accurate detection of pod-specific anomalies.
4Measurement precision
If pod behavior in replica sets is not compared, then the detection process is simple, but discrepancies between pods are undetected
Solution Approach 1:
The patent leverages the homogeneity expected in replica sets by comparing activity data across pods that should behave similarly. It identifies pods belonging to the same replica set and compares their activity patterns, assuming they should exhibit homogeneous behavior. Deviations from this expected homogeneity indicate potential anomalies.
Solution Approach 2:
The patent implements feedback by comparing each pod's behavior against its replica set peers and using these comparisons to detect anomalies. The system continuously monitors inter-pod discrepancies and provides feedback when behavioral deviations are detected, enabling dynamic anomaly detection based on real-time comparisons.
Data Source
AI summary
Anomalies are detected in a distributed application that runs on a plurality of nodes to execute at least first and second workloads. The method of detecting anomalies includes collecting first network traffic data of the first workload and second network traffic data of the second workload during a first period of execution of the first and second workloads, collecting third network traffic data of the first workload and fourth network traffic data of the second workload during a second period of execution of the first and second workloads, and detecting an anomaly in the distributed application based on a comparison of the third network traffic data against the first network traffic data or a comparison of the fourth network traffic data against the second network traffic data. Anomalies may also be detected by comparing network traffic data of two groups of containers executing the same workload.