Research topic
This topic addresses detecting behavior that differs from normal execution, service, workload, or network patterns. The papers cover statistical screening, clustering, sequence analysis, log parsing, trace evidence, and classification, with the individual records preserving the datasets, labels, baselines, and metrics used.
Related search terms: systems anomaly detection · performance anomaly detection · trace anomaly detection
25 papers in this topic, ordered newest first. The detailed paper records contain the evidence-grounded methods, tools, datasets, findings, and citation guidance.
2026 · ACM/SPEC International Conference on Performance Engineering (ICPE)
B-Perf reconstructs execution, memory, and messaging behavior from Linux kernel-level traces and infers performance-antipattern indicators without requiring application source access or intrusive instrumentation.
Keywords: performance antipatterns · black-box detection · system-level execution traces · LTTng · Trace Compass
2026 · Journal of Systems and Software
LMAT combines multi-task language models for kernel-event and event-duration prediction with online change detection, lightweight error-vector root-cause analysis, and adaptive tracing control.
Keywords: adaptive tracing · LTTng · kernel events · system-call sequences · event-duration modeling
2025 · IEEE International Conference on Program Comprehension (ICPC)
The paper introduces a taxonomy of log-event characteristics that explains why different log parsers fail across systems and parser families.
Keywords: log parsing · log event characteristics · LEC taxonomy · LogHub · Drain
2025 · Authorea preprint
The preprint combines communication-related kernel/system-call events with distributed traces to detect communication performance anti-patterns in microservices.
Keywords: communication anti-patterns · DeathStarBench · LTTng · Trace Compass · Jaeger
2025 · 2025 IEEE International Conference on Collaborative Advances in Software and COmputiNg (CASCON)
SynthLogAI benchmarks statistical, sequence, transformer, and prompt-based generative models for producing synthetic Linux logs while measuring fidelity, downstream utility, and privacy.
Keywords: synthetic Linux logs · generative AI · log generation · log evaluation · CASCON 2025
2024 · Software Impacts
The paper proposes a two-tier IoT intrusion detector that first separates normal from anomalous flows and then classifies the attack type with a CNN-BiLSTM model.
Keywords: IoT anomaly detection · CNN-BiLSTM · SMOTE · particle swarm optimization · PSO
2024 · ACM/SPEC ICPE Companion
The work-in-progress paper combines service-call graph context, social-network analysis, and spectrum-based fault localization to rank distributed-trace root causes.
Keywords: context-aware RCA · service-call graph · distributed traces · service communities · Louvain
2024 · Journal of Systems and Software
The paper releases a reusable Linux kernel-event and system-call artifact with controlled application workloads, injected resource noise, and analysis scenarios for software performance engineering.
Keywords: LTTng · Linux kernel events · system calls · kernel tracepoints · Elasticsearch
2024 · 2024 IEEE International Conference on Collaborative Advances in Software and COmputiNg (CASCON)
The paper detects and localizes performance noise by aligning passive kernel-event evidence with the life cycle of CPU, disk, and network requests rather than treating resource utilization as an undifferentiated aggregate.
Keywords: kernel event monitoring · resource life cycle · noise detection · CPU requests · disk requests
2024 · 2024 IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)
The paper proposes an adaptive tracing loop that combines language-model prediction of kernel-event sequences and event durations with change detection and root-cause analysis, so detailed tracing is activated only around significant behavior shifts.
Keywords: adaptive tracing · LTTng · kernel events · system-call sequences · event-duration modeling
2023 · ACM/IFIP/USENIX Middleware 2023 Industry Track
The paper applies a CNN-BiLSTM intrusion classifier to RPL/IoT traffic, combining convolutional feature extraction with bidirectional sequence modeling after imbalance-aware flow preprocessing.
Keywords: RPL attacks · IoT smart grid · CNN-BiLSTM · routing attacks · intrusion detection
2023 · 2023 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)
EMD-SCS combines sequence prediction of system calls with sonification so that partial execution prefixes can support early malware detection and an interpretable auditory alert.
Keywords: malware detection · system-call sequences · sonification · Hamming distance · detection rate
2023 · ACM/SPEC ICPE Companion
The paper uses time-series analysis to identify and classify warmup, steady-state, and anomalous states in Java JMH microbenchmarks.
Keywords: Java Microbenchmark Harness · JMH · benchmark states · steady state · warmup
2023 · IEEE Working Conference on Source Code Analysis and Manipulation (SCAM)
PASD uses Linux kernel-event traces, Perf call stacks, and statistical debugging to rank functions associated with performance problems without application-source instrumentation.
Keywords: statistical debugging · Linux kernel tracepoints · Perf · perf record · call stacks
2023 · IEEE International Conference on Program Comprehension (ICPC)
The paper classifies recurring log-parsing errors and connects them to token and event characteristics that can guide parser design and logging practice.
Keywords: log parsing · parser errors · Drain · AEL · Spell
2022 · ACM/IFIP/USENIX Middleware 2022 Demos/Posters
The poster proposes a hybrid IoT intrusion-detection pipeline with binary anomaly detection followed by multiclass attack classification.
Keywords: IoTID20 · RNN · SMOTE · PSO · binary classification
2022 · IEEE Working Conference on Source Code Analysis and Manipulation (SCAM)
N-Lane Bridge extends One-Lane Bridge analysis to active-resource bottlenecks and uses LTTng system-level traces to distinguish application-caused congestion from external interference.
Keywords: N-Lane Bridge · One-Lane Bridge · performance antipatterns · system-level execution tracing · LTTng
2022 · 30th International Conference on Program Comprehension (ICPC)
The framework combines critical-path extraction, coarse anomaly checks, OPTICS execution clustering, and MUSCLE multiple sequence alignment to localize performance differences in system-level traces.
Keywords: sequence alignment · MUSCLE · OPTICS · critical path · system-level traces
2021 · 2021 IEEE International Conference on Big Data (BigData)
The paper presents a low-intrusion heap monitor that records allocation call stacks and uses persistent heap-growth filtering plus trace correlation to identify likely memory-leak roots.
Keywords: heap monitoring · memory leaks · root-cause analysis · memory management · BigData 2021
2021 · 2021 IEEE International Systems Conference (SysCon)
The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.
Keywords: malware detection · system-call analysis · LTTng · Trace Compass · LSTM
2021 · Journal of Hardware and Systems Security
The paper proposes a cloud-side anomaly detector that combines traffic, virtual-machine resource, and kernel-level indicators to identify several DDoS classes through change-point evidence.
Keywords: DDoS attacks · cloud environment · CUSUM · bandwidth exhaustion · application exhaustion
2020 · Journal of Cloud Computing
The paper combines host-level user/kernel tracing with machine learning to detect intrusion behavior on constrained IoT and home-automation systems.
Keywords: IoT intrusion detection · host-based IDS · LTTng · barectf · Common Trace Format
2019 · IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)
The paper presents a tracing and analysis pipeline that detects slow web requests and groups them by internal execution behavior to expose likely causes.
Keywords: web requests · user-space tracing · kernel-space tracing · outlier detection · behavior clustering
2019 · Journal of Hardware and Systems Security
The paper combines execution-trace and virtual-machine metrics with machine learning to detect EDoS behavior and restrict resource expansion to apparently normal VMs.
Keywords: Economic Denial of Sustainability · EDoS · DDoS · cloud computing · execution trace analysis
2012 · International Journal of Computer Science and Network Security
This survey organizes intrusion-response systems around automation, response cost, decision evaluation, adjustment, execution, attack paths, and risk assessment.
Keywords: intrusion response systems · response cost · automated response · NIDS · HIDS