Real-Time Anomaly Detection of NoSQL Systems Based on Resource Usage Monitoring

Today, the emergence of the industry revolution systems such as Industry 4.0, Internet of Things, and big data frameworks poses new challenges in terms of storage and processing of real-time data. As systems scale in humongous sizes, a crucial task is to administer the variety of different subsystems and applications to ensure high performance. This is directly related with the identification and elimination of system failures and errors, while the system runs. In particular, database systems may experience abnormalities related with decreased throughput or increased resource usage, that in turn affects system performance. In this article, we focus on not only SQL (NoSQL) database systems that are ideal for storing sensor data in the concept of Industry 4.0. This typically includes a variety of applications and workloads that are difficult to online monitor, thus making anomaly detection a challenging task. Creating a robust platform to serve such infrastructures with minimum hardware or software failures is a key challenge. In this article, we propose RADAR, an anomaly detection system that works on real time. RADAR is a data-driven decision-making system for NoSQL systems, by providing process information extraction during resource monitoring and by associating resource usage with the top processes, to identify anomalous cases. In this article, we focus on anomalies such as hardware failures or software bugs that could lead to abnormal application runs, without necessarily stopping system functionality, e.g., due to a system crash, but by affecting its performance, e.g., decreased database system throughput. Although different patterns may occur through time, we focus on periodic running workloads (e.g., monitoring daily usage) that are very common for NoSQL systems, and Internet of Things scenarios where data streams are forwarded to the Cloud for storage and processing. We apply various machine learning algorithms such as autoregressive integrated moving average (ARIMA), seasonal ARIMA, and long-short-term memory recurrent neural networks. We experimentally analyze our solution to demonstrate the benefits of supporting online erroneous state identification and characterization for modern applications.