Fmeter: Extracting Indexable Low-level System Signatures by Counting Kernel Function Calls
No Access Until
Permanent Link(s)
Other Titles
Abstract
System monitoring tools have served to provide operators and developers with an insight into system execution and an understanding of how the system behaves under previously untested scenarios. Many system abnormalities leave a signature impact on the system execution which may arise out of performance issues, bugs or errors. Having the ability to quantify and search such behavior in the system execution history can facilitate new ways of looking at problems. For example, operators may use clustering to group and visualize similar system behaviors together. In this work we propose a monitoring infrastructure that extracts a new breed of formal, indexable, low-level system signatures using the classical vector space model from the field of information retrieval and text mining. We drive an analogy between the representation of kernel function invocations with terms within text documents. This parallel allows us to automatically index, store, and later retrieve and compare the system signatures. As with information retrieval, the key insight is that we need not rely on the semantic information in a document. Instead, we consider only the statistical properties of the terms belonging to the document (and to the corpus), which enables us to provide an efficient way to extract signatures at runtime and analyze the signatures using statistical formal methods. We have built a prototype in Linux, Fmeter, which extracts low-level system signatures by recording all kernel function invocations. We show that the signatures are naturally amenable to formal processing with statistical methods like clustering and supervised machine learning.