Automated known problem diagnosis with event traces

Proceedings of the 2006 EuroSys Conference

Volumn , Issue , 2006, Pages 375-388

  Yuan, Chun ^a   Lao, Ni ^c   Wen, Ji Rong ^a   Li, Jiwei ^d   Zhang, Zheng ^a   Wang, Yi Min ^b   Ma, Wei Ying ^a  

^a MICROSOFT RESEARCH ASIA   (China)

^b MICROSOFT RESEARCH   (United States)

^c TSINGHUA UNIVERSITY   (China)

^d UNIVERSITY OF SCIENCE AND TECHNOLOGY OF CHINA   (China)

Author keywords

Root cause analysis; Support vector machine; System call sequences

Indexed keywords

CLASSIFICATION (OF INFORMATION); INFORMATION SYSTEMS; LEARNING SYSTEMS; PATTERN RECOGNITION; PROBLEM SOLVING; USER INTERFACES;

AUTOMATIC IDENTIFICATION; COMPUTER PROBLEM DIAGNOSIS; ROOT CAUSE; SYSTEM BEHAVIOR INFORMATION;

COMPUTER AIDED DIAGNOSIS;

EID: 34748888898     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1217935.1217972     Document Type: Conference Paper

References (33)

1. M.K. Aguilera, J.C. Mogul, J. Wiener, P. Reynolds, and A. Muthitacharoen. Performance debugging for distributed systems of black boxes. In the 19th ACM Symposium on Operating Systems Principles, October 2003
2. F. Apap, A. Honig, S. Hershkop, E. Eskin, and S.J. Stolfo. Detecting Malicious Software by Monitoring Anomalous Windows Registry Accesses. In Proceedings of the Fifth International Symposium on Recent Advances in Intrusion Detection (RAID-2002). Zurich, Switzerland, October 2002
3. AutoMate, http://www.unisyn.com/automate/
4. T. Ball, M. Naik, and S. Rajamani. From Symptom to Cause: Localizing Errors in Counterexample Traces. POPL 2003
5. G. Banga. Auto-Diagnosis of Field Problems in an Appliance Operating System. USENIX Annual Technical Conference, San Diego, California, USA, June 2000
6. P. Barham, A. Donnelly, R. Isaacs, and R. Mortier. Using Magpie for Request Extraction and Workload Modelling. 6th Symposium on Operating System Design and Implementation (OSDI), December, 2004
7. P. Barham, R. Isaacs, R. Mortier, and D. Narayanan. Magpie: Online Modelling and Performance-aware Systems. 9th Workshop on Hot Topics in Operating Systems, 2003
8. W.B. Cavnar and J.M. Trenkle. N-gram Based Text Categorization, Proceedings of the Third Annual Symposium on Document Analysis and Information Retrieval, April 1994
9. C.-C. Chang and C.-J. Lin. LIBSVM: a library for support vector machines. September 2002. Available at http://www.csie.nta.edu.tw/~cjlin/papers/libsvm. pdf
10. M. Chen, A. Accardi, E. Kiciman, A. Fox, D. Patterson, and E. Brewer. Path-based Failure and Evolution Management. USENIX/ACM Symposium on Networked Systems Design and Implementation, San Francisco, CA, March 2004
11. M. Chen, E. Kiciman, E. Fratkin, A. Fox, and E. Brewer. Pinpoint: Problem Determination in Large, Dynamic Systems. International Conference on Dependable Systems and Networks, IPDS track, Washington, DC, June 2002
12. I. Cohen, J. Chase, M. Goldszmidt, T. Kelly, and J. Symons. Correlating Instrumentation Data to System States: A Building Block for Automated Diagnosis and Control. 6th Symposium on Operating Systems Design and Implementation (OSDI '04), December 2004
13. I. Cohen, S. Zhang, M. Goldszmidt, J. Symons, T. Kelly, and A. Fox. Capturing, Indexing, Clustering, and Retrieving System History. In the 20th ACM Symposium on Operating Systems Principles, October 2005
14. T.G. Dietterich and G. Bakiri. Error-correcting output codes: a general method for improving multiclass inductive learning programs, in the proceedings of AAAI-91, pages 572-577. AAAI press / MIT press, 1991
15. D. Gusfield. Algorithms on Strings, Trees and Sequences: Computer Science and Computational Biology. Cambridge University Press, January 1997
16. S. Hofmeyr, S. Forrest, and A. Somayaji. Intrusion Detection Using Sequences of System Calls. Journal of Computer Security, Vol. 6, pp. 151-180, 1998
17. J.O. Kephart and D.M. Chess. The Vision of Autonomic Computing. IEEE Computer, January 2003
18. W. Lee and S. Stolfo. Data Mining Approaches for Intrusion Detection. In Proceedings of the Seventh USENIX Security Symposium, San Antonio, TX, January 1998
19. J.R. Lorch and A.J. Smith. The VTraceTool: Building a System Tracer for Windows NT and Windows 2000. MSDN Magazine, October 2000
20. J.A. Redstone, M.M. Swift, and B.N. Bershad. Using Computers to Diagnose Computer Problems. 9th Workshop on Hot Topics in Operating Systems (HotOS IX), Lihue, Hawaii, May 2003
21. M. Renieris and S. Reiss. Fault Localization with Nearest Neighbor Queries. ASE 2003
22. M. Russinovich and B. Cogswell. Windows NT System Call Hooking. Dr. Dobb's Journal, January 1997
23. D.A. Solomon and M.E. Russinovich. Inside Microsoft Windows 2000, 3rd Edition. Microsoft Press, September 2000
24. M. Steinder and A.S. Sethi. A Survey of Fault Localization Techniques in Computer Networks. Science of Computer Programming, Special Edition on Topics in System Administration Vol. 53, 2 (Nov. 2004), pp. 165-194
25. Strace for NT. http://www.bindview.com/Services/RAZOR/Utilities/Windows/ strace_readme.cfm
26. C.Y. Suen, N-Gram Statistics for Natural Language Understanding and Text Processing., IEEE Trans. on Pattern Analysis and Machine Intelligence, Vol. 1, No. 2, April 1979
27. V. Vapnik. Principles of risk minimization for learning theory. In D.S. Lippman, J.E. Moody, and D.S. Touretzky, editors, Advances in Neural Information Processing Systems 3, pp. 831-838. Morgan Kaufmann, 1992
28. Y.-M. Wang, C. Verbowski, J. Dunagan, Y. Chen, H.J. Wang, C. Yuan, and Z. Zhang. STRIDER: A Black-box, State-based Approach to Change and Configuration Management and Support. Proc. Usenix LISA, pp. 159-172, Oct. 2003
29. C. Warrender, S. Forrest, and B. Pearlmutter. Detecting intrusions using system calls: Alternative data models. IEEE Symposium on Security and Privacy, 1999
30. A. Whitaker, R.S. Cox, and S.D. Gribble. Configuration Debugging as Search: Finding the Needle in the Haystack. 6th Symposium on Operating System Design and Implementation (OSDI), December, 2004
31. Windows XP System Restore. http://msdn.microsoft.com/library/default.asp? url=/library/en-us/dnwxp/html/windowsxpsystemrestore.asp
32. WPP Software Tracing. http://www.microsoft.com/whdc/devtools/tools/ EventTracing.mspx
33. A. Yemini and S. Kliger. High Speed and Robust Event Correlation. IEEE Communication Magazine 34,5 (May 1996), 82-90