Annual Report on CHOReOS Dissemination - 1st year (D9.3.1)

This report summarizes achievement of the CHOReOS project in terms of disseminating project's goals and results during the first year. It further provides links to the concrete material that has been disseminated so far, hence enabling the interested reader to get access to the published material to know more about CHOReOS

Early Failure Prediction in Software Programs: Dimensionality Reduction Kernel

The aim of this paper is to build an online failure prediction classifier for monitoring the behavior of programs. The classifier predicts the termination state of the program execution paths as failing or passing. This could be achieved by mapping each execution path as a vector into a feature space whose dimensions represent common sub-paths amongst failing and passing execution paths. The main contribution of this paper is to treat the failure prediction problem as a classification task of execution paths in a customized feature space. The main dilemma is the size and the number of space dimensions, affecting the speed of the classifier. The size of the dimensions could be reduced by shortening the length of the common sub-paths, used as the space dimensions. The length of common sub-paths is affected by repeated patterns in program executions. Replacing the consecutively repeated patterns with only a single iteration in execution paths, reduces the size of the common sub-paths. The number of dimensions could be reduced by removing dimensions which have projection onto others. This paper proposes two kernels which measure similarity amongst execution paths in an implicit feature space with reduced dimensionality. Our experiments demonstrate a significant reduction in time overhead of the failure prediction classifier while preserving accuracy

A Novel System Anomaly Prediction System Based on Belief Markov Model and Ensemble Classification

Computer systems are becoming extremely complex, while system anomalies dramatically influence the availability and usability of systems. Online anomaly prediction is an important approach to manage imminent anomalies, and the high accuracy relies on precise system monitoring data. However, precise monitoring data is not easily achievable because of widespread noise. In this paper, we present a method which integrates an improved Evidential Markov model and ensemble classification to predict anomaly for systems with noise. Traditional Markov models use explicit state boundaries to build the Markov chain and then make prediction of different measurement metrics. A Problem arises when data comes with noise because even slight oscillation around the true value will lead to very different predictions. Evidential Markov chain method is able to deal with noisy data but is not suitable in complex data stream scenario. The Belief Markov chain that we propose has extended Evidential Markov chain and can cope with noisy data stream. This study further applies ensemble classification to identify system anomaly based on the predicted metrics. Extensive experiments on anomaly data collected from 66 metrics in PlanetLab have confirmed that our approach can achieve high prediction accuracy and time efficiency

Information-value-based feature selection algorithm for anomaly detection over data streams

Računalni sustavi postaju sve složeniji i nepravilnosti sustava uveliko utječu na raspoloživost sustava. Učinkovit način za postizanje visoke raspoloživosti sustava je primjena alata za otkrivanje anomalija kako bi se otkrile nenormalne aktivnosti u računalnom sustavu i bile popravljene. Zbog složenosti modernih računalnih sustava mnoge se matrice sustava moraju nadgledati. Zbog toga je multi-dimenzionalnost jedan od najvažnijih zahtjeva u otkrivanju nepravilnosti. Veliki broj matrica povećava vrijeme obrade tehnologije otkrivanja nepravilnosti i smanjuje točnost. Za rješavanje ovog problema mi koristimo vrijednost informacije kako bismo provjerili važnost karakteristika u odnosu na otkrivanje nepravilnosti. Međutim, metoda vrijednosti informacije ne uzima u obzir redundantne karakteristike. Zbog toga se procijenjuju korelacije između karakteristika kako bi se odbacile redundantne karakteristike. U ovom se radu prikazana metoda uspoređuje s drugim metodama odabira karakteristika primjenom niza podataka o nepravilnosti stvarnog sustava. Eksperimentalni rezultati pokazuju da prikazana metoda može učinkovitije podučiti model i točnije otkriti anomalije.Computer systems are becoming more and more complex, and system anomalies have a serious impact on system availability. One effective way to achieve high availability is to use anomaly detection tools to find the abnormal activities in the computer system so that they can be repaired. Because of the complexity of modern computing systems, many system metrics need to be monitored. For this reason, one major challenge of anomaly detection is multi-dimensionality. Large numbers of metrics increase the processing time of anomaly detection technology and lower the accuracy. To overcome this problem, we use information-value to ascertain the importance of features with respect to detecting anomalies. However, the information-value method does not take redundant features into account. Thus, correlations between features are evaluated to remove redundant features. This paper compares the presented method to other feature selection methods using a real system anomaly data set. Experimental results show that the presented method can learn the model more efficiently and detect anomalies more accurately

Information-value-based feature selection algorithm for anomaly detection over data streams

Računalni sustavi postaju sve složeniji i nepravilnosti sustava uveliko utječu na raspoloživost sustava. Učinkovit način za postizanje visoke raspoloživosti sustava je primjena alata za otkrivanje anomalija kako bi se otkrile nenormalne aktivnosti u računalnom sustavu i bile popravljene. Zbog složenosti modernih računalnih sustava mnoge se matrice sustava moraju nadgledati. Zbog toga je multi-dimenzionalnost jedan od najvažnijih zahtjeva u otkrivanju nepravilnosti. Veliki broj matrica povećava vrijeme obrade tehnologije otkrivanja nepravilnosti i smanjuje točnost. Za rješavanje ovog problema mi koristimo vrijednost informacije kako bismo provjerili važnost karakteristika u odnosu na otkrivanje nepravilnosti. Međutim, metoda vrijednosti informacije ne uzima u obzir redundantne karakteristike. Zbog toga se procijenjuju korelacije između karakteristika kako bi se odbacile redundantne karakteristike. U ovom se radu prikazana metoda uspoređuje s drugim metodama odabira karakteristika primjenom niza podataka o nepravilnosti stvarnog sustava. Eksperimentalni rezultati pokazuju da prikazana metoda može učinkovitije podučiti model i točnije otkriti anomalije.Computer systems are becoming more and more complex, and system anomalies have a serious impact on system availability. One effective way to achieve high availability is to use anomaly detection tools to find the abnormal activities in the computer system so that they can be repaired. Because of the complexity of modern computing systems, many system metrics need to be monitored. For this reason, one major challenge of anomaly detection is multi-dimensionality. Large numbers of metrics increase the processing time of anomaly detection technology and lower the accuracy. To overcome this problem, we use information-value to ascertain the importance of features with respect to detecting anomalies. However, the information-value method does not take redundant features into account. Thus, correlations between features are evaluated to remove redundant features. This paper compares the presented method to other feature selection methods using a real system anomaly data set. Experimental results show that the presented method can learn the model more efficiently and detect anomalies more accurately

Run-time systems failure prediction via proactive monitoring

In run-time evolving systems, components may evolve while the system is being operated. Unsafe run-time changes may compromise the correct execution of the entire system. Traditional design-time verification techniques difficultly cope with run-time changes, and run-time monitoring may detect disfunctions only too late, when the failure arises. The desire would be to define advanced monitors with the ability to predict and prevent the potential errors happening in the future. In this direction, this paper proposes CASSANDRA, a new approach that by combining design-time and run-time analysis techniques, can "look ahead" in the near execution future, and predict potential failures. During run-time we on-the-fly construct a model of the future k-step global state space according to design-time specifications and the current execution state. Consequently, we can run-time check whether possible failures might happen in the future

An Early Warning System For Risk Management

isk management in healthcare has solved a wide range of healthcare-related issues in Saudi Arabia. However, the limitation of risk management teams working under special conditions (needing to solve critical health-related issues) has highlighted the urgent need for an early risk warning system (ERWS) in healthcare. The influences of changing weather conditions demand that diabetic patients and doctors in Saudi Arabia have a continuous check on health conditions. The number of diabetic patients is increasing rapidly in Saudi Arabia. Hence, risk management teams in healthcare must be supported with a system that alerts to changes before the changes become a significant risk/problem. Our proposed approach does the following: 1) predicts changes in BP and blood sugar level within hospital environment at runtime. 2) Continually checks patient health status with respect to health condition at runtime. 3) Alerts to the changes as detected (e.g. risk or unknown parameter), and also provides feedback for patient and doctor. We present a computational model that defines the interaction and communication of the system components and describes the prediction and checking process in our proposed approach. We designed the architecture for our proposed approach with respect to the computational model. The thesis proposes an early risk warning system approach, which predicts and checks patient health conditions with respect to the ideal conditions according to medical standards. The health status of a patient will be communicated to doctors and patients on an emergency note if the predicted values are outside normal conditions. In this way, the risk can be mitigated before the occurrence of damage to patient health at runtime. To implement the proposed approach, neural networks is used for developing the prediction component using Java programming. The results of this research successfully predicted the health condition of a patient by checking outputs against medical standards. The risks defined in this research include hyperglycaemia, hypoglycaemia, hypertension and hypotension. Appropriate results were obtained for almost every patient when checked with four input parameters for 200 patients. Consistent results were produced by the risk prediction component and the alerts were generated after every five (5) seconds to communicate to the patients and doctors at runtime. Health status of all 200 patients can also be seen to check the changes in health conditions in the hospital environment. Finally, a case study with different scenarios based on changes in patient health status with respect to ideal conditions revealed evaluated the approach.Saudi Cultural Burea