ABSTRACT
CONTENTS 22.1 Fault Detection and Diagnosis...............................................................472 22.2 Abnormal Trace Detection......................................................................473 22.3 N-gram Extraction ...................................................................................475 22.4 Automata Construction ..........................................................................477 22.5 Generalization of Automata...................................................................479 22.6 Detection Algorithms ..............................................................................481 22.7 Multiresolution Detection.......................................................................483 22.8 Trace Diversity: A Case Study ...............................................................484 22.9 Detection Experiments ............................................................................486 22.10 Related Work ............................................................................................489 References.............................................................................................................490
Interest in monitoring and using traces of user requests for fault detection has been on the rise recently. In this chapter we propose novel fault detection methods based on trace analysis in application servers. One essential problem is how to represent the large amount of training trace data compactly as an oracle. Our key contribution is the novel use of varied-length n-grams and automata to characterize normal traces. Anew trace is compared against the learnedautomata todeterminewhether it is abnormal.Wedevelop algorithms toautomatically extractn-gramsandconstructmultiresolutionautomata from training data. Further, both deterministic and multihypothesis algorithms are proposed for detection.We inspect the trace constraints of real application software and verify the existence of long n-grams. Our approach is tested in a real system with injected faults and achieves good results in experiments.
