Detecting Flow Anomalies in Distributed Systems

TL;DR

This paper introduces a novel method for detecting and localizing flow anomalies in distributed systems using only coarse-grained endpoint data, validated on urban transportation data and social media reports.

Contribution

It proposes a new network transmission model and localization algorithm that effectively identify and rank anomalies with limited monitoring data.

Findings

The proposed metric outperforms standard deviation measures in anomaly ranking.

The localization algorithm accurately matches anomalies with social media reports.

Case studies confirm the method's effectiveness in real-world transportation systems.

Abstract

Deep within the networks of distributed systems, one often finds anomalies that affect their efficiency and performance. These anomalies are difficult to detect because the distributed systems may not have sufficient sensors to monitor the flow of traffic within the interconnected nodes of the networks. Without early detection and making corrections, these anomalies may aggravate over time and could possibly cause disastrous outcomes in the system in the unforeseeable future. Using only coarse-grained information from the two end points of network flows, we propose a network transmission model and a localization algorithm, to detect the location of anomalies and rank them using a proposed metric within distributed systems. We evaluate our approach on passengers' records of an urbanized city's public transportation system and correlate our findings with passengers' postings on social media microblogs. Our experiments show that the metric derived using our localization algorithm gives a better ranking of anomalies as compared to standard deviation measures from statistical models. Our case studies also demonstrate that transportation events reported in social media microblogs matches the locations of our detect anomalies, suggesting that our algorithm performs well in locating the anomalies within distributed systems.