FSAD: Flow Similarity Analysis for Anomaly Detection in Cloud Applications

Fast detection of performance anomalies is critical in Cloud applications, but challenging to implement in a general and effective tool with low operational overload. We propose FSAD, a performance anomaly detection system based on the concept of flow similarity. It stems from the observation that, in general, the number of responses generated by a component closely follows the number of received requests, but this relation stops holding in presence of performance anomalies. In FSAD, components are regarded as black boxes, and time series of incoming and outgoing packets are fed to the flow similarity analysis for anomaly detection. The effectiveness of FSAD is demonstrated in experimental results.