云环境下基于多属性信息熵的虚拟机异常检测  

Anomaly detection of virtual machines based on multi-attribute entropy in cloud computing environments

作　　者：于明[1] 张雨[1] 刘畅[1] 张丹丹[1] 

机构地区：[1]大连理工大学信息与通信工程学院,辽宁大连116024

出　　处：《华中科技大学学报（自然科学版）》2015年第5期63-67,共5页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(61172059);辽宁省博士启动基金资助项目(20111022)

摘　　要：针对云环境下虚拟机因资源耗尽或程序运行错误而发生性能逐步恶化的异常现象,提出了一种基于多属性信息熵的检测方法.首先,计算每次采样的多个虚拟机状态属性的联合2-范数.然后,统计该联合2-范数的取值在一定时间内的出现频率,计算出各虚拟机状态属性的联合信息熵.当该熵值取最大值时,执行异常检测.期间,以各联合2-范数的移动加权均值及方差为基础构建检测变量,利用非参数CUSUM算法完成异常状态的判定.基于Hadoop的实验结果表明:该方法既能降低偶发暂态异常引发的虚警干扰,又能在虚拟机运行状态出现显著异常之前准确地发出告警.A method based on multi-attribute information entropy was proposed to detect anomalous states of virtual machines in cloud computing environments.Firstly,the 2-norm of several attributes characterizing the states of a virtual machine was computed for each sampled data.Then,the joint information entropy was computed based on the occurrence frequency of each 2-norm value in a fixed period of time.Once the entropy reached its maximum,the anomaly detection function in the proposed method was activated.During the anomaly detection,the moving weighted average and the variance of the 2-norm sequence were used to construct the test variable,and the non-parametric CUSUM algorithm was adopted to complete the anomaly detection.Experimental results based on Hadoop show that the method can not only reduce false alarms caused by accidental and transient anomalous states,but also give accurate alarms before the significant anomalous state occurs.

关 键 词：异常检测 云计算 虚拟机 多属性决策 性能监控 

分 类 号：TP277[自动化与计算机技术—检测技术与自动化装置] TP393.07[自动化与计算机技术—控制科学与工程]