A Distributed Service Anomaly Detection Model Oriented Service Provenance

Internet service providers represented by Google and Amazon deploy a lot of services on cloud platforms and meet mass customer service's concurrent access request through services' distributed deployment.In order to achieve high reliability quality of service,anomaly detection of distributed services is an urgent problem to be solved.What's more,distributed deployment of services brings difficulties to anomaly detection of services.First,services dynamic combination forms a complex reference relationship.And the relationship is uncertain,which makes it difficult to detect anomalies.Secondly,services of high frequency invoke produce a large amount of data,which brings a challenge to the real-time discovery of service anomaly.In view of the above problems,this paper simulates the process of biological immune system and proposes a set of anomaly detection model of service origin oriented distributed service.The model is based on service provenance log,which describes the service dynamic combination relationship and service invoke information and execution path in real time,the model can be divided into two layers.The first layer is called the response layer and is mainly based on the idea of “ danger from change ”.It uses differential to describe the behavior data of mass service,capture danger signals,and find the source of anomaly.The second layer is called the immune layer and we make capture the abnormal source as a research point,then through calculate its origin invoke relationship with other services,and we can extends exception scope of a single service to a certain area,which is not immutable,but evolves over time,space,and so on.For example,in the service network,hot service is evolving with user's behaviors.Therefore,according to the thought of danger theory and the relationship of service origin,we study the evolution pattern of danger area through different calculation methods.Finally,the experiments shows the model can work well and support trace abnormal service reason.