USING CNN AND AUTOENCODERS FOR ANOMALY DETECTION IN SIMULATED MICROSERVICE SYSTEMS: A HYBRID APPROACH

Abstract

ABSTRACT Microservice architectures have become one of the fundamental building blocks of distributed systems today. However, the complex structure of these systems creates significant challenges in areas such as performance monitoring and anomaly detection. In this study, we developed a hybrid model based on autoencoders and Convolutional Neural Networks (CNN) to detect and classify anomalies on a simulated microservice dataset. The autoencoder identifies anomalies by learning normal performance behaviors, while the CNN classifies these anomalies into “Normal,” “High Load,” and “Weak” categories. In our experiments using a simulated dataset containing 10,000 examples, our model achieved a high classification accuracy of 98.8%. The autoencoder's anomaly detection performance was quite satisfactory, with 0.728 precision, 0.990 sensitivity, and 0.840 F1-score. Our hybrid model delivered successful results with F1-scores of 0.988 and 0.993 in the “Normal” and ‘Weak’ classes, respectively, while showing a slight limitation in the “High Load” class with an F1-score of 0.945 due to class imbalance. These results once again demonstrate how effective hybrid models can be in microservice performance monitoring processes.

Keywords

• Microservices
• Anomaly Detection
• Cnn
• Autoencoder
• Simulation
• Performance Monitoring
• Hybrid Model

References

1. [1] J. Nobre, E. J. S. Pires, and A. Reis, “Anomaly detection in microservice-based systems,” Appl. Sci., vol. 13, no. 13, p. 7891, Jul. 2023, doi: 10.3390/app13137891.
2. [2] J. Lewis and M. Fowler, “Microservices: A Definition of This New Architectural Term,” 2014. [Online]. Available: https://martinfowler.com/articles/microservices.html
3. [3] A. Nandi et al., “Anomaly detection using program control flow graph mining from execution logs,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowl. Discov. Data Min., San Francisco, CA, USA, 2016, pp. 215–224.
4. [4] S. Newman, Building Microservices, Sebastopol, CA, USA: O’Reilly Media, Inc., 2021.
5. [5] M. Du, F. Li, G. Zheng, and V. Srikumar, “Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., Dallas, TX, USA, 2017, pp. 1285–1298.
6. [6] B. Sharma, P. Jayachandran, A. Verma, and C. R. Das, “CloudPD: Problem determination and diagnosis in shared dynamic clouds,” in Proc. 43rd Annu. IEEE/IFIP Int. Conf. Dependable Syst. Netw. (DSN), Budapest, Hungary, 2013, pp. 1–12.
7. [7] I. Yagoub, M. A. Khan, and L. Jiyun, “IT equipment monitoring and analyzing system for forecasting and detecting anomalies in log files utilizing machine learning techniques,” in Proc. Int. Conf. Adv. Big Data, Comput. Data Commun. Syst. (icABCD), Durban, South Africa, 2018, pp. 1–6.
8. [8] H. Xu et al., “Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications,” in Proc. World Wide Web Conf., Lyon, France, 2018, pp. 187–196.

9. [9] A. Gulenko et al., “Detecting anomalous behavior of black-box services modeled with distance-based online clustering,” in Proc. IEEE 11th Int. Conf. Cloud Comput. (CLOUD), San Francisco, CA, USA, 2018, pp. 912–915.
10. [10] P. Liu et al., “Unsupervised detection of microservice trace anomalies through service-level deep bayesian networks,” in Proc. IEEE 31st Int. Symp. Softw. Reliab. Eng. (ISSRE), Coimbra, Portugal, 2020, pp. 48–58.
11. [11] X. Zhou et al., “Latent error prediction and fault localization for microservice applications by learning from system trace logs,” in Proc. 27th ACM Joint Meet. Eur. Softw. Eng. Conf. Symp. Found. Softw. Eng., Athens, Greece, 2019, pp. 683–694.
12. [12] F. Salfner and M. Malek, “Using hidden semi-Markov models for effective online failure prediction,” in Proc. 26th IEEE Int. Symp. Reliab. Distrib. Syst. (SRDS), Beijing, China, 2007, pp. 161–174.
13. [13] L. Wu, J. Tordsson, E. Elmroth, and O. Kao, “Causal inference techniques for microservice performance diagnosis: Evaluation and guiding recommendations,” in Proc. IEEE Int. Conf. Auton. Comput. Self-Organizing Syst. (ACSOS), Washington, DC, USA, 2021, pp. 21–30.
14. [14] L. Meng, F. Ji, Y. Sun, and T. Wang, “Detecting anomalies in microservices with execution trace comparison,” Future Gener. Comput. Syst., vol. 116, pp. 291–301, 2021, doi: 10.1016/j.future.2020.10.032.
15. [15] C. Sauvanaud et al., “Anomaly detection and diagnosis for cloud services: Practical experiments and lessons learned,” J. Syst. Softw., vol. 139, pp. 84–106, 2018, doi: 10.1016/j.jss.2018.01.023.
16. [16] Q. Du, T. Xie, and Y. He, “Anomaly detection and diagnosis for container-based microservices with performance monitoring,” in Proc. Int. Conf. Algorithms Archit. Parallel Process., Copenhagen, Denmark, 2018, pp. 560–572.
17. [17] L. Mariani, M. Pezzè, O. Riganelli, and R. Xin, “Predicting failures in multi-tier distributed systems,” J. Syst. Softw., vol. 161, p. 110464, Mar. 2020, doi: 10.1016/j.jss.2019.110464.
18. [18] H. Xu et al., “Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications,” in Proc. World Wide Web Conf., Lyon, France, 2018, pp. 187–196.
19. [19] S. Lu, X. Wei, Y. Li, and L. Wang, “Detecting anomaly in big data system logs using convolutional neural network,” in Proc. IEEE 16th Int. Conf. Dependable, Autonomic Secure Comput. (DASC/PiCom/DataCom/CyberSciTech), Athens, Greece, 2018, pp. 151–158.