SST-LOF: Container Anomaly Detection Method Based on Singular Spectrum Transformation and Local Outlier Factor

Abstract

In recent years, the use of container cloud platforms has experienced rapid growth. However, because containers are operating-system-level virtualization, their isolation is far less than that of virtual machines, posing considerable challenges for multi-tenant container cloud platforms. To address the issues associated with current container anomaly detection algorithms, such as the difficulty in mining periodic features and the high rate of false positives due to noisy data, we propose an anomaly detection method named SST-LOF, based on singular spectrum transformation and the local outlier factor. Our method enhances the traditional Singular Spectrum Transformation (SST) algorithm to meet the needs of streaming unsupervised detection. Furthermore, our method improves the calculation mode of the anomaly score of the Local Outlier Factor algorithm (LOF) and reduces false positives of noisy data with dynamic sliding windows. Additionally, we have designed and implemented a container cloud anomaly detection system that can perform real-time, unsupervised, streaming anomaly detection on containers quickly and accurately. The experimental results demonstrate the effectiveness and efficiency of our method in detecting anomalies in containers in both simulated and real cloud environments.