EbAT: An entropy based online Anomaly Tester for data center management

The online detection of anomalies is a vital task in data centers, potentially incurring high personnel costs. Causes of anomalies range from hardware/software failures, to resource over- or under-provisioning, to application misbehaviors. This paper develops new methods and an associated utility for online anomaly detection, termed EbAT, entropy based anomaly tester, which can efficiently detect anomalies. This is done without the need for operator interaction, analysis intervention, or predefineed system models or rules. EbAT also offers ways to dasiazoom inpsila on detected anomalies, the intent being to localize anomalies to certain components of the data center's applications or facility. EbAT is implemented in the context of virtual machine monitors, using Xen as a representative platform, and it is used to detect anomalous behaviors on such platforms running multi-tier enterprise and map-reduce applications.