Workload Anomaly Detection via Backup Metadata Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect behavioral or functional anomalies in workloads operating on standalone hosts, particularly when exposed to external factors, as these anomalies often go unnoticed by administrators and are not captured by current data and metadata recovery methods.
Innovation Solution
A method for workload anomaly detection that selects recent backup operation entries, generates an information history, and performs anomaly-driven actions based on predefined criteria using bare-metal recovery and system-state recovery data and metadata, enabling the identification of anomalies in workload behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup methods are used for standalone hosts, then backup operations can be performed, but anomaly detection capability is lost
Solution Approach 1:
The backup system is enhanced to perform multiple functions: traditional backup operations and anomaly detection. The agent collects not only backup data but also workload metadata and behavioral information, enabling the same infrastructure to serve both backup and security monitoring purposes without requiring separate dedicated systems.
Solution Approach 2:
An agent is introduced as an intermediary component that runs on the standalone host and collects workload metadata, behavioral data, and backup information. This agent serves as a bridge between the backup system and the host, enabling anomaly detection capabilities without requiring direct modifications to the core backup infrastructure.
2Measurement precision
If comprehensive workload monitoring is implemented, then anomaly detection improves, but data processing complexity increases
Solution Approach 1:
The monitoring system segments data collection into distinct categories: workload metadata, behavioral data, and backup information. Each type of data is collected and processed separately through dedicated handlers, which then feed into the anomaly detection engine. This segmentation reduces the complexity of processing comprehensive workload information by organizing it into manageable, structured components.
3Reliability
If backup data is used for anomaly detection, then system reliability improves, but information loss in traditional backup methods is eliminated
Solution Approach 1:
The system performs preliminary collection of workload metadata and behavioral data during normal backup operations, before anomalies occur. This preliminary data collection ensures that baseline information about workload behavior is already available and structured, enabling faster and more accurate anomaly detection when deviations are detected, without requiring additional data collection efforts at the time of anomaly occurrence.
Data Source
AI summary
A method and system for workload anomaly detection for standalone hosts based on bare-metal recovery and/or state-system recovery data and metadata. In isolated circumstances, workloads tend to operate as expected, however, their behavior and/or functionality may become unpredictable when said workloads are exposed to other factors outside of isolation. Further, most of these other factors, as well as their influence on workload behavior and/or functionality tend to go unnoticed by administrators. Data and/or metadata, pertinent to bare-metal recovery and/or system-state recovery operations, may capture host-relevant information, including which workload(s) is/are installed on a host, which file-system objects maintained thereon belong to which installed workload, and what is the nature and storage location of each file-system object. In leveraging said bare-metal recovery and/or system-state recovery data and/or metadata, embodiments disclosed herein detect behavioral or functional anomalies exhibited by any workload operating on any given host.