 |
Next, we move to profile-based anomaly detection.
To conduct this experiment, we use real metrics of the service CHF-Gy with TPS - transaction per second as the feature, CPU usage as predicted output — collected during normal operation, and an abnormal period with DEBUG logging was enabled - which is not used in the PRODUCT environment. This logging option will make the service consume more CPU and Disk IO than usual because of the volume of log writes to disk.
We trained linear regression and decision tree models.
To detect the anomaly, we set the relative threshold equal to 1.15 and the absolute threshold equal to 0.1. This option confirms that the difference between the predicted CPU and the measured CPU is significant.
|
IEEE/ICACT20260142 Slide.24
[Big Slide]