Short-Term Performance Metrics Forecasting for Virtual Machine to Support Anomaly Detection Using Hybrid ARIMA-WNN Model

Anomaly detection is a significant functionality in most cloud monitoring applications. Time-series forecasting model could be easily used for predicting the values of the performance metrics which could be used for representing the performance status of the cloud environment. The proposed hybrid model combines both Autoregressive Integrated Moving Average (ARIMA) and Wavelet Neural Network (WNN) models. Firstly, ARIMA model is employed to firstly predict the linear component and then WNN model is used for the nonlinear residual component prediction. Finally, the results of the two parts are combined into the final prediction value of the performance metric. Finally the experimental results show that the hybrid model could produce more accurate short-term prediction than other models.

[1]  Marcos V. O. de Assis,et al.  Anomaly Detection Using Forecasting Methods ARIMA and HWDS , 2013, 2013 32nd International Conference of the Chilean Computer Science Society (SCCC).

[2]  Su Fong Chien,et al.  ARIMA Based Network Anomaly Detection , 2010, 2010 Second International Conference on Communication Software and Networks.

[3]  Qian Quan,et al.  Entropy Based Method for Network Anomaly Detection , 2009, 2009 15th IEEE Pacific Rim International Symposium on Dependable Computing.

[4]  Wei Xu,et al.  Improving one-class SVM for anomaly detection , 2003, Proceedings of the 2003 International Conference on Machine Learning and Cybernetics (IEEE Cat. No.03EX693).

[5]  Joseph J. LaViola,et al.  Double exponential smoothing: an alternative to Kalman filter-based predictive tracking , 2003, IPT/EGVE.

[6]  Mark Crovella,et al.  Characterization of network-wide anomalies in traffic flows , 2004, IMC '04.

[7]  Hu-Sheng Wu,et al.  A survey of research on anomaly detection for time series , 2016, 2016 13th International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP).

[8]  Saeed Amizadeh,et al.  Generic and Scalable Framework for Automated Time-series Anomaly Detection , 2015, KDD.

[9]  Hannu Tenhunen,et al.  Utilization Prediction Aware VM Consolidation Approach for Green Cloud Computing , 2015, 2015 IEEE 8th International Conference on Cloud Computing.

[10]  Ioannis Lambadaris,et al.  Studies in applying PCA and wavelet algorithms for network traffic anomaly detection , 2013, 2013 IEEE 14th International Conference on High Performance Switching and Routing (HPSR).

[11]  Robert L. Winkler,et al.  The accuracy of extrapolation (time series) methods: Results of a forecasting competition , 1982 .

[12]  S. Shankar Sastry,et al.  Revisit Dynamic ARIMA Based Anomaly Detection , 2011, 2011 IEEE Third Int'l Conference on Privacy, Security, Risk and Trust and 2011 IEEE Third Int'l Conference on Social Computing.

[13]  Tilman Wolf,et al.  A Taxonomy and Comparative Evaluation of Algorithms for Parallel Anomaly Detection , 2010, 2010 Proceedings of 19th International Conference on Computer Communications and Networks.

[14]  Lian Duan,et al.  Anomaly Detection by Clustering in the Network , 2009, 2009 International Conference on Computational Intelligence and Software Engineering.

[15]  Mohsen Guizani,et al.  Efficient datacenter resource utilization through cloud resource overcommitment , 2015, 2015 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS).

[16]  J. Deng,et al.  Introduction to Grey system theory , 1989 .

[17]  Anja Feldmann,et al.  Predicting the resource consumption of network intrusion detection systems , 2008, SIGMETRICS '08.

[18]  Qinghua Zhang,et al.  Wavelet networks , 1992, IEEE Trans. Neural Networks.

[19]  Zhirui Ye,et al.  Short‐Term Traffic Volume Forecasting Using Kalman Filter with Discrete Wavelet Decomposition , 2007, Comput. Aided Civ. Infrastructure Eng..