Towards Specificationless Monitoring of Provenance-Emitting Systems

TL;DR

This paper introduces a novel approach for monitoring provenance-emitting systems by analyzing graph slices spectrally, enabling specificationless anomaly detection in complex distributed systems.

Contribution

It presents a spectral graph analysis method for provenance data that eliminates the need for predefined specifications, simplifying monitoring of heterogeneous systems.

Findings

Effective anomaly detection through spectral analysis

Simplifies monitoring without explicit specifications

Applicable to distributed, heterogeneous systems

Abstract

Monitoring often requires insight into the monitored system as well as concrete specifications of expected behavior. More and more systems, however, provide information about their inner procedures by emitting provenance information in a W3C-standardized graph format. In this work, we present an approach to monitor such provenance data for anomalous behavior by performing spectral graph analysis on slices of the constructed provenance graph and by comparing the characteristics of each slice with those of a sliding window over recently seen slices. We argue that this approach not only simplifies the monitoring of heterogeneous distributed systems, but also enables applying a host of well-studied techniques to monitor such systems.