论文标题
Syslrn：学习有效检测的方法
syslrn: Learning What to Monitor for Efficient Anomaly Detection
论文作者
论文摘要
虽然监视系统行为以检测异常和故障很重要，但基于对数分析的现有方法只能与日志中包含的信息一样好，而其他观察OS级软件状态状态的方法也会引入高开销。我们解决了Syslrn的问题，Syslrn是该系统，该系统首先建立了对目标系统离线的了解，然后根据知识的正常行为标识符量身定制在线监视仪器。尽管我们的Syslrn原型仍然是初步的，并且缺乏许多功能，但我们在监视OpenStack失败的案例研究中表明，它可以超越最先进的对数分析系统，而开头很少。
While monitoring system behavior to detect anomalies and failures is important, existing methods based on log-analysis can only be as good as the information contained in the logs, and other approaches that look at the OS-level software state introduce high overheads. We tackle the problem with syslrn, a system that first builds an understanding of a target system offline, and then tailors the online monitoring instrumentation based on the learned identifiers of normal behavior. While our syslrn prototype is still preliminary and lacks many features, we show in a case study for the monitoring of OpenStack failures that it can outperform state-of-the-art log-analysis systems with little overhead.
