Leveraging Petri Nets for Workflow Anomaly Detection in Microservice Architectures
摘要
Modern microservice architectures pose challenges in understanding and managing the complex workflows within these decentralized services. In particular, it is difficult to identify anomalous behavior that could indicate a bug or attack. We use traces of microservice application activity (requests and responses) to infer a model of the application’s normal behavior. Our approach mines Petri nets to formally represent concurrent operations and their temporal dependencies with a targeted delay injection approach that accurately and efficiently learns these dependencies. The models produced are both explainable and easy to inspect, which offers more transparency and control. Our evaluation shows that injecting delays during model training allows us to achieve perfect model and log fitness (Move-Model and Move-Log fitness of 1) with just 29 traces. In contrast, a straightforward approach requires over 10,000 traces to achieve similar accuracy. Our models successfully identify anomalies in various experiments, such as traces with one missing or multiple missing activities, and reordered sequences to simulate issues in real-world scenarios. Our approach outperforms the state-of-the-art method, demonstrating higher accuracy.