Anomaly Detection by Monitoring Filesystem Activities

Abstract

Software diagnosis in enterprise systems is an expensive, largely manual process. It significantly contributes to the increasing costs in IT management, because it takes time and expertise for system administrators to notice an anomalous state due to the information overload generated by the many components in such systems. In this paper, we propose an unsupervised approach for anomaly detection using the monitored application's run-time behaviors. These behaviors, represented by the state of the file system and how files are accessed when the system is running normally, serve as a baseline. An alert is generated when behaviors that significantly deviate from the baseline appear, and a starting point of investigation is provided to assist the human operators in understanding the context of the problem.