Anomaly detection can infer the presence of errors without observing the target services, but detecting variations in the observable parts of the system on which the services reside. This is a promising technique in complex software-intensive systems, because either instrumenting the services' internals is exceedingly time-consuming, or encapsulation makes them not accessible. Unfortunately, in such systems anomaly detection is often ineffective due to their dynamicity, which implies changes in the services or their expected workload. Here we present our approach to enhance the efficacy of anomaly detection in complex, dynamic software-intensive systems. After discussing the related challenges, we present MADneSs, an anomaly detection framework tailored for the above systems that includes an adaptive multi-layer monitoring module. Monitored data are then processed by the anomaly detector, which adapts its parameters depending on the current system behavior. An anomaly alert is provided if the analysis conducted by the anomaly detector identify unexpected trends in the data. MADneSs is evaluated through an experimental campaign on two service-oriented architectures; software faults are injected in the application layer, and detected through monitoring of underlying system layers. Lastly, we quantitatively and qualitatively discuss our results with respect to state-of-the-art solutions, highlighting the key contributions of MADneSs.

中文翻译：

---

MADneSs：复杂动态系统的多层异常检测框架

异常检测可以在不观察目标服务的情况下推断错误的存在，而是检测服务所在系统的可观察部分的变化。在复杂的软件密集型系统中，这是一种很有前途的技术，因为检测服务的内部非常耗时，或者封装使它们无法访问。不幸的是，在此类系统中，由于其动态性，异常检测通常是无效的，这意味着服务或其预期工作负载的变化。在这里，我们提出了在复杂的动态软件密集型系统中提高异常检测效率的方法。在讨论了相关挑战之后，我们提出了 MADneSs，这是一种为上述系统量身定制的异常检测框架，其中包括一个自适应多层监控模块。然后由异常检测器处理监控数据，该检测器根据当前系统行为调整其参数。如果异常检测器进行的分析识别出数据中的意外趋势，则会提供异常警报。MADneSs 是通过在两个面向服务的架构上的实验活动来评估的；软件故障注入应用层，通过底层系统层监控检测。最后，我们定量和定性地讨论了我们在最先进解决方案方面的结果，突出了 MADneSs 的关键贡献。MADneSs 是通过在两个面向服务的架构上的实验活动来评估的；软件故障注入应用层，通过底层系统层监控检测。最后，我们定量和定性地讨论了我们在最先进解决方案方面的结果，突出了 MADneSs 的关键贡献。MADneSs 是通过在两个面向服务的架构上的实验活动来评估的；软件故障注入应用层，通过底层系统层监控检测。最后，我们定量和定性地讨论了我们在最先进解决方案方面的结果，突出了 MADneSs 的关键贡献。