Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models

Problem and motivation

Continuous kernel tracing imposes performance, storage, and analysis cost, while event-only analysis can miss duration changes. The paper asks how tracing can remain selective while preserving evidence around abrupt system behavior changes.

Method and contribution

LTTng kernel/system-call events are represented with event/process names, PID/TID, delay, return status, and other arguments. A multi-task model predicts the next event and a categorized system-call duration; LSTM and transformer-based BERT variants share features. Cross-entropy prediction losses are MAD-rescaled and combined for change detection. Error vectors of unexpected/missing event types are compared by cosine similarity with pre-clustered, tagged vectors for root-cause/noise assignment.

Findings and evidence

Normal Apache2 traces and noisy traces from the prior dataset plus an author-created bandwidth-limited duration-noise set yield seven noise categories. Across 50%-0% noise scenarios, adaptive tracing reduces recorded events by 77.1% with a 5.8% miss rate for events related to abrupt changes. Duration F1 is 82.9% for LSTM and 83.1% for BERT. On a combined 700,000-request test set, root-cause/noise identification averages 91.3%, up to 20.9% above event-sequence-only analysis. On a V100 GPU, batch-16 inference is under 100 ms; average change-detection time is 106 ms for LSTM and 151 ms for BERT, with about 29 ms added for RCA.

Limitations and future directions

Limitations: The study is a short preliminary ICSE-NIER paper centered on Apache2 and controlled/noisy traces. LTTng is named but its evaluation version is not specified; the LTTng v2.13 URL is a documentation reference, not proof of runtime version. OS, kernel, CPU, RAM, and replication count are unknown.

Future work: Test database logs, API traces, network traffic, and application logs; build a larger anomaly benchmark; model recurring anomalies as normal when appropriate; and use online learning/model adjustment to maintain low tracing overhead.

Resources

• Data

Sources and identifiers

• Published version published
• Public full text · PDF public_full_text

When to cite this paper

Cite this paper when your work uses or compares combining next-system-call prediction with categorized system-call-duration prediction in a multi-task adaptive tracer.

• combining next-system-call prediction with categorized system-call-duration prediction in a multi-task adaptive tracer.
• selective tracing that reports 77.1% event reduction at a 5.8% abrupt-change-related miss rate.
• cosine-similarity clustering of abnormal event vectors as an interpretable root-cause/noise assignment step.
• the V100 latency measurements when discussing inference feasibility, with the Apache/noise-testbed boundary.

Citation

@inproceedings{ezzatiJivan2024towardadaptive,
  author = {Kasra Darvishi and Morteza Noferesti and Naser Ezzati-Jivan},
  title = {Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models},
  year = {2024},
  booktitle = {2024 IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)},
  pages = {62-66},
  publisher = {ACM},
  doi = {10.1145/3639476.3639778},
  url = {https://doi.org/10.1145/3639476.3639778}
}

Darvishi, K., Noferesti, M., & Ezzati-Jivan, N. (2024). Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models. In 2024 IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) (pp. 62-66). https://doi.org/10.1145/3639476.3639778

K. Darvishi, M. Noferesti, and N. Ezzati-Jivan, "Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models," in 2024 IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER), pp. 62-66, 2024, doi: 10.1145/3639476.3639778