PCAD: Cloud Performance Anomaly Detection with Data Packet Counts

Cloud applications run on numerous servers and network elements. Complexity and heterogeneity of these elements make evaluation of application performance very challenging without invasive application-specific probe. We propose an anomaly detection system for Cloud application servers. Our system only collects ingress and egress data packet counts. We observe that when an application server is operating normally, the egress data packet count is highly correlated to the ingress data packet count. When the server is in an abnormal state, the correlation between ingress and egress packet counts decreases, regardless of the cause of the anomaly. This observation is the basis of our system. We validate our observation and the proposed system using heterogonous benchmarks with heavy tail service distribution and ten different anomaly types in the Cloud. We demonstrate that our system can accurately detect all injected anomalies with 1.6% false positives and 0.23% CPU overhead.