{
  "schema_version": "0.6.0",
  "paper_id": "performance-anomaly-detection-sequence-alignment",
  "page_url": "https://naser.github.io/research-publications/papers/performance-anomaly-detection-sequence-alignment/",
  "title": "Performance Anomaly Detection through Sequence Alignment of System-Level Traces",
  "title_variants": [],
  "authors": [
    "Madeline Janecek",
    "Naser Ezzati-Jivan",
    "Abdelwahab Hamou-Lhadj"
  ],
  "author_details": [
    {
      "name": "Madeline Janecek",
      "orcid": "https://orcid.org/0000-0002-7182-3958",
      "profile_url": "https://dblp.org/pid/307/5913.html"
    },
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://naser.github.io/"
    },
    {
      "name": "Abdelwahab Hamou-Lhadj",
      "orcid": "https://orcid.org/0000-0002-3319-5006",
      "profile_url": "https://dblp.org/pid/70/2136.html"
    }
  ],
  "publication": {
    "year": 2022,
    "venue": "30th International Conference on Program Comprehension (ICPC)",
    "type": "conference paper",
    "publication_date": "2022-05-16",
    "online_date": "2022-10-20",
    "print_date": "2022-05-16",
    "volume": null,
    "issue": null,
    "pages": "264-274",
    "article_number": null,
    "publisher": "ACM",
    "issn": [],
    "isbn": [],
    "crossref_type": "proceedings-article"
  },
  "publication_type": "conference paper",
  "status": "published_with_public_full_text",
  "canonical_source_url": "https://doi.org/10.1145/3524610.3527898",
  "source_record_id": "performance-anomaly-detection-through-sequence-alignment-of-system-level-traces-e36cd46801",
  "identifiers": {
    "doi": "10.1145/3524610.3527898"
  },
  "abstract": null,
  "abstract_source": "Abstract not reproduced; the four-part summary is paraphrased from the verified full text.",
  "abstract_available": false,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The framework combines critical-path extraction, coarse anomaly checks, OPTICS execution clustering, and MUSCLE multiple sequence alignment to localize performance differences in system-level traces.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-09",
    "sources": [
      {
        "note": "Private full PDF read: pdf-evidence/notes/performance-anomaly-detection-sequence-alignment.md"
      },
      {
        "note": "Performance-anomaly PDF pp. 2-8: LTTng, critical-path extraction, vectorization, average/probability tests, OPTICS, cluster pairing, and MUSCLE alignment"
      },
      {
        "note": "Performance-anomaly PDF pp. 8-10: VirtualBox/Ubuntu/LTTng environment, overhead, Python case, Docker case, and diagnosis"
      },
      {
        "note": "Performance-anomaly PDF p. 10: conclusion and future work"
      },
      {
        "note": "Local PDF hash verified in pdf-evidence/extraction-manifest.json"
      }
    ]
  },
  "summary": {
    "core_contribution": "The framework combines critical-path extraction, coarse anomaly checks, OPTICS execution clustering, and MUSCLE multiple sequence alignment to localize performance differences in system-level traces.",
    "problem": "Kernel traces provide detailed performance evidence but can contain millions of events and impose collection/analysis cost. The paper seeks offline, black-box anomaly detection and localization without application-specific instrumentation (pp. 1-2).",
    "method": "LTTng records kernel events and contexts. sched_switch, sched_wakeup, interrupt entry/exit, high-resolution timer entry/exit, and softirq entry/exit events form execution states/graphs; blocking edges are recursively replaced by waking threads to obtain a critical path. Count vectors represent path structure and duration vectors represent performance. Average/probability checks identify coarse anomalies, OPTICS clusters execution types, silhouette scores pair sample and normal clusters, and MUSCLE aligns state strings with durations for localization (pp. 3-8).",
    "findings": "The evaluation uses VirtualBox 6.1.18 VMs with two CPUs, Ubuntu 20.04.1, Linux kernel 5.8.0, and LTTng 2.11.2; the userspace case uses Python 3.8.5 and the container case uses Docker 20.10.7 with Ubuntu 20.04 images and GNU Wget (pp. 8-9). Over ten executions, no tracing averages 1,076.50 ms, full kernel tracing 1,329.26 ms (+23.479%), and minimal tracing 1,128.08 ms (+4.79145%) (p. 8, Table 1). The userspace case has about 100 normal and 10 bug-injected executions, 2-3 seconds longer on average, and 86.67% cluster assignment; the container case identifies a 10%-CPU restriction and short preempted states (pp. 8-10).",
    "limitations": "Offline/post-mortem operation, dependence on normal comparison data and delimiters, threshold/clustering choices, and two controlled case studies limit generalization. The method localizes evidence but does not automatically prove a unique root cause.",
    "future_work": "Add call-stack tracing for more precise root-cause localization and investigate deep-learning methods (p. 10)."
  },
  "tags": [
    "system-tracing",
    "anomaly-detection",
    "performance-analysis",
    "trace-analysis"
  ],
  "keywords": [
    "sequence alignment",
    "MUSCLE",
    "OPTICS",
    "critical path",
    "system-level traces",
    "performance anomalies",
    "LTTng",
    "Docker",
    "execution clustering",
    "trace overhead"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "Performance Anomaly Detection through Sequence Alignment of System-Level Traces",
      "url": "https://doi.org/10.1145/3524610.3527898",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "public-acm-pdf",
      "label": "Public ACM PDF",
      "relation": "source-record",
      "title": "Performance Anomaly Detection through Sequence Alignment of System-Level Traces",
      "url": "https://dl.acm.org/doi/pdf/10.1145/3524610.3527898",
      "pdf_url": "https://dl.acm.org/doi/pdf/10.1145/3524610.3527898",
      "status": "public_full_text",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_public_full_text",
    "note": "The DOI is the canonical citation target. The external source PDF is linked for readers; no PDF is redistributed in this repository.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when your work uses or compares black-box performance-anomaly detection from kernel traces using critical-path extraction instead of collecting all kernel events.",
    "points": [
      "For black-box performance-anomaly detection from kernel traces using critical-path extraction instead of collecting all kernel events.",
      "For the paired use of critical-path count vectors for execution-type clustering and duration vectors for performance comparison.",
      "For MUSCLE-based multiple alignment that distinguishes abnormal critical-path states from normal long waits.",
      "For the measured full-kernel (+23.479%) versus minimal-kernel (+4.79145%) tracing overhead comparison."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-09",
    "metadata_source": [
      "Private full PDF read: pdf-evidence/notes/performance-anomaly-detection-sequence-alignment.md",
      "Performance-anomaly PDF pp. 2-8: LTTng, critical-path extraction, vectorization, average/probability tests, OPTICS, cluster pairing, and MUSCLE alignment",
      "Performance-anomaly PDF pp. 8-10: VirtualBox/Ubuntu/LTTng environment, overhead, Python case, Docker case, and diagnosis",
      "Performance-anomaly PDF p. 10: conclusion and future work",
      "Local PDF hash verified in pdf-evidence/extraction-manifest.json"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-09"
  }
}