云计算服务异常检测关键技术研究

Cloud Computing (CC) has become one of the newest network computing services, as CC can offer on-demand allocating resources, and it provides services with characterists of resilient expansion, service-oriented， high cost performance, and so on. But the quality of service (QoS) of CC services are reduced by the frequent outbreaks of online CC failures, and these failures also reduce the dependability and security and block the promotion processes of CC. Anomaly Monitoring is an important means to deal with this problem, but related researches are lagging behind. And Anomaly Detection is the most important fundamental component for Anomaly Monitoring. This project intends to research and explore in-depth several key technologies in this area. It starts from summarizing and analyzing the runtime features of general and dedicated CC services. Then a suite of State Snapshot (SS) processing functions including generation, pre-processing, dissemination, storage and detection will be set up, and these functions would support further researches on auditability and traceability in security area. Focused on the characteristics of diversity and emergence of CC services, combined with the detection indices such as accuracy, real-time, self-development and so on, an improved Multi-Kernel Support Vector Machine (MKSVM) and other several detection algorithms are introduced. Then a self-adaptive detection strategy is designed to implement anomaly detection. Meanwhile, a CC service state display mode with user configurable granularity will be researched and implemented. Eventually, a CC services oriented anomaly detection compact framework with complete theories, methods, and algorithms will be built. An anomaly detection proto-type system which is loosely coupled with CC services will be deployed and testified in the general CC test-bed and Chongqing Medical Treatment and Public Health Services Cloud.

由于云计算的按需分配使用资源、弹性扩展、面向服务、高性价比等特点，成为新型网络化计算模式且发展迅猛。但目前已投入使用的知名云计算系统时有故障产生，影响了服务质量，降低了服务的可信性和安全性，也阻碍了云计算的发展。面向云计算的异常监控是解决该问题的重要手段，但相关研究相对滞后。异常监控的重要基础是异常检测，本项目将研究异常检测的关键问题，抽取通用网络系统与云计算服务主体的特征，比较其相关性及差异，研究可审计和可追溯的云计算服务状态快照生成及存储方法；针对云计算服务多样性、涌现性等特点，结合准确性、实时性和可生长性等检测指标，引入改进的多核支持向量机等检测方法，研究自适应检测策略；面向云计算用户设计粒度可适配的服务状态展示方法。最后产生完整的面向云计算服务异常检测的理论和方法体系，研制与云计算服务低耦合的异常检测系统，在云计算试验床上测试，然后在实际重庆医疗卫生服务云上验证。

由于云计算平台的弹性扩展、按需分配、面向服务等特点，使其提供的服务具有极高的动态性和复杂性，从而影响服务的可信行和安全性，导致服务质量下降。而对云计算平台的异常检测是提高其可信性的重要方法。我们研究了云计算平台服务状态快照的生成、存储及传播方法，通过引入改进的PCA、ICA、K-means等算法对高维服务快照数据进行快速的特征提取和特征选择处理，结合D-Gossip散播算法获得服务状态快照描述信息实现异常行为状态的可追溯性；面向云计算服务快照存储策略，提出了基于子块回溯的滑动块算法和基于聚类算法的分布式虚拟机镜像管理机制，有效的优化了资源分配，减少了服务开销；针对云计算平台服务的动态性、复杂性，提出了基于环境感知的异常检测框架，形成基于环境感知的异常检测框架模型，有效提高了检测的准确率；提出基于ICA与贝叶斯分类的异常检测算法优化数据处理，加快检测速度；此外，完成云计算异常检测原型系统的开发。