FRAPpuccino: Fault-detection through Runtime Analysis of Provenance
arXiv:1711.11487
Abstract
We present FRAPpuccino (or FRAP), a provenance-based fault detection mechanism for Platform as a Service (PaaS) users, who run many instances of an application on a large cluster of machines. FRAP models, records, and analyzes the behavior of an application and its impact on the system as a directed acyclic provenance graph. It assumes that most instances behave normally and uses their behavior to construct a model of legitimate behavior. Given a model of legitimate behavior, FRAP uses a dynamic sliding window algorithm to compare a new instance's execution to that of the model. Any instance that does not conform to the model is identified as an anomaly. We present the FRAP prototype and experimental results showing that it can accurately detect application anomalies.
arXiv comment7 pages, 2 figures, 1 table
Cited by in corpus (5)
- UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
- Decision Provenance: Harnessing data flow for accountable systems
- Provenance-based Intrusion Detection: Opportunities and Challenges
- Xanthus: Push-button Orchestration of Host Provenance Data Collection
- Runtime Analysis of Whole-System Provenance