{
  "schema_version": "0.1.0",
  "record_type": "research-topic",
  "topic_id": "kernel-tracing",
  "label": "Kernel Tracing",
  "title": "Kernel Tracing Research",
  "description": "Research papers on Linux kernel tracing, kernel events, execution analysis, and system-level performance diagnosis.",
  "introduction": "This topic groups research on Linux kernel tracing and kernel-event analysis for understanding execution behavior, resource contention, performance anomalies, and system-level observability. The collection includes work on trace collection, event and state representations, diagnosis, noise reduction, and trace-driven explanations. Individual paper pages identify the actual tracer, event sources, kernel versions, workloads, and evaluation evidence when those details were reported.",
  "aliases": [
    "kernel trace",
    "Linux kernel trace analysis",
    "kernel event tracing",
    "system-level tracing"
  ],
  "search_terms": [
    "Linux kernel tracing",
    "kernel events",
    "kernel trace analysis",
    "execution tracing",
    "performance diagnosis"
  ],
  "related_topics": [
    "system-tracing",
    "trace-analysis",
    "performance-analysis",
    "observability",
    "lttng"
  ],
  "canonical_url": "https://threadslab.org/research-publications/topics/kernel-tracing.html",
  "paper_count": 35,
  "papers": [
    {
      "paper_id": "b-perf-black-box-performance-antipatterns",
      "title": "B-Perf: Black-box Performance Antipattern Detection Using System-level Execution Tracing",
      "year": 2026,
      "authors": [
        "Morteza Noferesti",
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/b-perf-black-box-performance-antipatterns/",
      "canonical_source_url": "https://doi.org/10.1145/3777884.3797014",
      "core_contribution": "B-Perf reconstructs execution, memory, and messaging behavior from Linux kernel-level traces and infers performance-antipattern indicators without requiring application source access or intrusive instrumentation.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "anomaly-detection"
      ],
      "keywords": [
        "performance antipatterns",
        "black-box detection",
        "system-level execution traces",
        "LTTng",
        "Trace Compass",
        "critical paths",
        "resource contention",
        "execution serialization",
        "allocation churn",
        "small-message overhead"
      ]
    },
    {
      "paper_id": "dtracomp-distributed-trace-comparison",
      "title": "DTraComp: Comparing distributed execution traces for understanding intermittent latency sources",
      "year": 2026,
      "authors": [
        "Maryam Ekhlasi",
        "Fatemeh Faraji Daneshgar",
        "Michel Dagenais",
        "Maxime Lamothe",
        "Naser Ezzati-Jivan",
        "Matthew Khouzam"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/dtracomp-distributed-trace-comparison/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112990",
      "core_contribution": "DTraComp is an open-source Eclipse Trace Compass framework that compares groups of distributed requests and attributes span time to user-space, kernel, thread-state, and system-call evidence.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "trace-analysis",
        "trace-visualization",
        "latency-analysis",
        "root-cause-analysis",
        "microservices",
        "lttng"
      ],
      "keywords": [
        "DTraComp",
        "distributed trace comparison",
        "OpenTracing",
        "LTTng",
        "LTTng-UST",
        "Eclipse Trace Compass",
        "differential flame graph",
        "span-state attribution",
        "system-call attribution",
        "Waited CPU",
        "Waited Blocked",
        "HotROD",
        "TiDB",
        "Apache Cassandra",
        "Eclipse Theia",
        "JFreeChart",
        "Jaeger",
        "microservice performance"
      ]
    },
    {
      "paper_id": "lmat-adaptive-tracing-language-models",
      "title": "LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models",
      "year": 2026,
      "authors": [
        "Kasra Darvishi",
        "Morteza Noferesti",
        "Yuvraj Sehgal",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/lmat-adaptive-tracing-language-models/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112890",
      "core_contribution": "LMAT combines multi-task language models for kernel-event and event-duration prediction with online change detection, lightweight error-vector root-cause analysis, and adaptive tracing control.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "llm-assisted-analysis",
        "observability",
        "anomaly-detection",
        "root-cause-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive tracing",
        "LTTng",
        "kernel events",
        "system-call sequences",
        "event-duration modeling",
        "language models",
        "LSTM",
        "BERT",
        "multi-task learning",
        "HDBSCAN",
        "change detection",
        "root-cause analysis",
        "Apache",
        "Sock Shop",
        "OpenTelemetry",
        "Prometheus",
        "stress-ng",
        "trace reduction",
        "trace overhead"
      ]
    },
    {
      "paper_id": "taaf-trace-abstraction-analysis-framework",
      "title": "TAAF: A Trace Abstraction and Analysis Framework Synergizing Knowledge Graphs and LLMs",
      "year": 2026,
      "authors": [
        "Alireza Ezaz",
        "Ghazal Khodabandeh",
        "Majid Babaei",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/taaf-trace-abstraction-analysis-framework/",
      "canonical_source_url": "https://doi.org/10.1145/3744916.3787832",
      "core_contribution": "TAAF combines time-indexed knowledge graphs with large language models to turn large execution traces into queryable, actionable explanations.",
      "tags": [
        "kernel-tracing",
        "trace-analysis",
        "knowledge-graphs",
        "llm-assisted-analysis",
        "observability"
      ],
      "keywords": [
        "TAAF",
        "TraceQA-100",
        "time-indexed knowledge graph",
        "natural-language trace queries",
        "multi-hop reasoning",
        "causal reasoning"
      ]
    },
    {
      "paper_id": "tracesynth-kernel-trace-generation",
      "title": "TraceSynth: Generating Production-Quality Kernel Traces with Constraint-Guided Diffusion Models",
      "year": 2026,
      "authors": [
        "Yuvraj Sehgal",
        "Sneh Patel",
        "Mahsa Panahandeh",
        "Naser Ezzati-Jivan",
        "Francois Tetreault"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/tracesynth-kernel-trace-generation/",
      "canonical_source_url": "https://doi.org/10.1145/3803437.3805222",
      "core_contribution": "TraceSynth generates novel structured kernel-trace windows with a Transformer diffusion model and repairs generated events against invariants mined from real LTTng traces.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "trace-analysis",
        "machine-learning"
      ],
      "keywords": [
        "kernel traces",
        "trace generation",
        "diffusion models",
        "constraint-guided generation",
        "LTTng",
        "Parquet",
        "Phoronix Test Suite",
        "DDIM",
        "next-event prediction",
        "synthetic traces"
      ]
    },
    {
      "paper_id": "execution-trace-reconstruction-using-diffusion-based-generative-models",
      "title": "Execution Trace Reconstruction Using Diffusion-Based Generative Models",
      "year": 2025,
      "authors": [
        "Madeline Janecek",
        "Naser Ezzati-Jivan",
        "Abdelwahab Hamou-Lhadj"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/execution-trace-reconstruction-using-diffusion-based-generative-models/",
      "canonical_source_url": "https://doi.org/10.1109/ICSE55347.2025.00063",
      "core_contribution": "The paper reconstructs missing system-call events in execution traces with diffusion and structured state-space generative models.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "trace-analysis",
        "trace-reduction",
        "performance-analysis"
      ],
      "keywords": [
        "execution trace reconstruction",
        "trace imputation",
        "diffusion models",
        "DiffWave",
        "SSSDS4",
        "SSSDSA",
        "CSDIS4",
        "structured state-space",
        "system-call sequences",
        "LTTng",
        "Phoronix Test Suite",
        "ROUGE-L",
        "perfect rate",
        "missing events",
        "ring-buffer overflow"
      ]
    },
    {
      "paper_id": "enhancing-performance-engineering-with-kernel-events",
      "title": "Enhancing empirical software performance engineering research with kernel-level events: A comprehensive system tracing approach",
      "year": 2024,
      "authors": [
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/enhancing-performance-engineering-with-kernel-events/",
      "canonical_source_url": "https://doi.org/10.1016/j.jss.2024.112117",
      "core_contribution": "The paper releases a reusable Linux kernel-event and system-call artifact with controlled application workloads, injected resource noise, and analysis scenarios for software performance engineering.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-engineering",
        "observability",
        "anomaly-detection"
      ],
      "keywords": [
        "LTTng",
        "Linux kernel events",
        "system calls",
        "kernel tracepoints",
        "Elasticsearch",
        "Kibana",
        "IoT dataset",
        "stress-ng",
        "CPU noise",
        "I/O noise",
        "network noise",
        "memory noise",
        "software phase detection",
        "24,263,691 events"
      ]
    },
    {
      "paper_id": "resource-life-cycle-aware-noise-detection-kernel-events",
      "title": "Resource Life-Cycle Aware Noise Detection via Kernel Event Monitoring",
      "year": 2024,
      "authors": [
        "Morteza Noferesti",
        "Ben Grandy",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/resource-life-cycle-aware-noise-detection-kernel-events/",
      "canonical_source_url": "https://doi.org/10.1109/CASCON62161.2024.10838205",
      "core_contribution": "The paper detects and localizes performance noise by aligning passive kernel-event evidence with the life cycle of CPU, disk, and network requests rather than treating resource utilization as an undifferentiated aggregate.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "anomaly-detection",
        "performance-analysis"
      ],
      "keywords": [
        "kernel event monitoring",
        "resource life cycle",
        "noise detection",
        "CPU requests",
        "disk requests",
        "network requests"
      ]
    },
    {
      "paper_id": "toward-adaptive-tracing-language-models",
      "title": "Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models",
      "year": 2024,
      "authors": [
        "Kasra Darvishi",
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/toward-adaptive-tracing-language-models/",
      "canonical_source_url": "https://doi.org/10.1145/3639476.3639778",
      "core_contribution": "The paper proposes an adaptive tracing loop that combines language-model prediction of kernel-event sequences and event durations with change detection and root-cause analysis, so detailed tracing is activated only around significant behavior shifts.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "llm-assisted-analysis",
        "observability",
        "anomaly-detection",
        "root-cause-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "adaptive tracing",
        "LTTng",
        "kernel events",
        "system-call sequences",
        "event-duration modeling",
        "language models",
        "LSTM",
        "BERT",
        "multi-task learning",
        "change detection",
        "root-cause analysis",
        "Apache2",
        "trace reduction",
        "trace overhead"
      ]
    },
    {
      "paper_id": "multi-level-adaptive-execution-tracing-performance-analysis",
      "title": "Multi-level Adaptive Execution Tracing for Efficient Performance Analysis",
      "year": 2023,
      "authors": [
        "Mohammed Adib Khan",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multi-level-adaptive-execution-tracing-performance-analysis/",
      "canonical_source_url": "https://doi.org/10.1109/SERA57763.2023.10197790",
      "core_contribution": "The paper presents a multi-level adaptive tracing workflow that uses lightweight stress detection and performance evidence to change the application/kernel instrumentation scope during an investigation.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "adaptive-scheduling"
      ],
      "keywords": [
        "adaptive execution tracing",
        "time-series trends",
        "multi-level tracing",
        "kernel tracing",
        "performance analysis",
        "SERA 2023"
      ]
    },
    {
      "paper_id": "pasd-statistical-debugging-kernel-events",
      "title": "PASD: A Performance Analysis Approach Through the Statistical Debugging of Kernel Events",
      "year": 2023,
      "authors": [
        "Mohammed Adib Khan",
        "Morteza Noferesti",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/pasd-statistical-debugging-kernel-events/",
      "canonical_source_url": "https://doi.org/10.1109/scam59687.2023.00025",
      "core_contribution": "PASD uses Linux kernel-event traces, Perf call stacks, and statistical debugging to rank functions associated with performance problems without application-source instrumentation.",
      "tags": [
        "kernel-tracing",
        "performance-analysis",
        "root-cause-analysis",
        "anomaly-detection"
      ],
      "keywords": [
        "statistical debugging",
        "Linux kernel tracepoints",
        "Perf",
        "perf record",
        "call stacks",
        "sched_switch",
        "Firefox",
        "Coreutils",
        "ls",
        "Bug 1637586",
        "Bug 1565019",
        "function suspect ranking"
      ]
    },
    {
      "paper_id": "execution-trace-model-verification-multicore",
      "title": "Execution trace-based model verification to analyze multicore and real-time systems",
      "year": 2022,
      "authors": [
        "Raphaël Beamonte",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/execution-trace-model-verification-multicore/",
      "canonical_source_url": "https://doi.org/10.1002/cpe.6974",
      "core_contribution": "The paper combines model-based quantitative constraints with user-space and kernel execution traces to automatically identify likely causes of real-time and multicore constraint violations.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "multicore-systems",
        "trace-analysis",
        "root-cause-analysis",
        "lttng"
      ],
      "keywords": [
        "model-based constraints",
        "execution tracing",
        "user-space traces",
        "kernel traces",
        "LTTng",
        "LTTng-UST",
        "Common Trace Format",
        "Trace Compass",
        "reservoir sampling",
        "critical-path analysis",
        "JACK2",
        "cyclictest",
        "priority inversion",
        "CPUTop"
      ]
    },
    {
      "paper_id": "n-lane-bridge-performance-antipatterns",
      "title": "N-Lane Bridge Performance Antipattern Analysis Using System-Level Execution Tracing",
      "year": 2022,
      "authors": [
        "Riley VanDonge",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/n-lane-bridge-performance-antipatterns/",
      "canonical_source_url": "https://doi.org/10.1109/scam55253.2022.00015",
      "core_contribution": "N-Lane Bridge extends One-Lane Bridge analysis to active-resource bottlenecks and uses LTTng system-level traces to distinguish application-caused congestion from external interference.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "anomaly-detection"
      ],
      "keywords": [
        "N-Lane Bridge",
        "One-Lane Bridge",
        "performance antipatterns",
        "system-level execution tracing",
        "LTTng",
        "Trace Compass",
        "sched_switch",
        "sched_wakeup",
        "futex",
        "Firefox PDF.js",
        "InDebitO",
        "SysBench",
        "memory paging",
        "CPU preemption"
      ]
    },
    {
      "paper_id": "operating-system-support-applications-performance-analysis-poster",
      "title": "Poster Paper: Operating System Support for Applications Performance Analysis",
      "year": 2022,
      "authors": [
        "Riley VanDonge",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/operating-system-support-applications-performance-analysis-poster/",
      "canonical_source_url": "https://doi.org/10.1109/IC2E55432.2022.00039",
      "core_contribution": "This poster proposes operating-system-aware antipattern detection that uses system-level traces and scalability trends to expose resource blocking that aggregate CPU utilization can hide.",
      "tags": [
        "performance-analysis",
        "system-tracing",
        "kernel-tracing"
      ],
      "keywords": [
        "operating-system support",
        "application performance analysis",
        "performance instrumentation",
        "IC2E 2022",
        "poster paper"
      ]
    },
    {
      "paper_id": "combining-distributed-kernel-tracing-cloud",
      "title": "Combining Distributed and Kernel Tracing for Performance Analysis of Cloud Applications",
      "year": 2021,
      "authors": [
        "Loïc Gelle",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/combining-distributed-kernel-tracing-cloud/",
      "canonical_source_url": "https://doi.org/10.3390/electronics10212610",
      "core_contribution": "The paper combines Jaeger distributed traces with LTTng kernel and user-space events and extends critical-path analysis from threads to distributed requests so request latency can be related to low-level scheduling and resource behavior.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "observability",
        "lttng"
      ],
      "keywords": [
        "distributed tracing",
        "kernel tracing",
        "cloud applications",
        "cross-layer performance analysis",
        "LTTng",
        "Jaeger",
        "Trace Compass",
        "Babeltrace",
        "Common Trace Format",
        "HotROD",
        "Cassandra",
        "Apache ab",
        "cassandra-stress",
        "critical-path analysis",
        "snapshot tracing",
        "CPU control groups",
        "liblttng-ust",
        "request synchronization"
      ]
    },
    {
      "paper_id": "container-workload-characterization-host-tracing",
      "title": "Container Workload Characterization Through Host System Tracing",
      "year": 2021,
      "authors": [
        "Madeline Janecek",
        "Naser Ezzati-Jivan",
        "Seyed Vahid Azhari"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/container-workload-characterization-host-tracing/",
      "canonical_source_url": "https://doi.org/10.1109/ic2e52221.2021.00015",
      "core_contribution": "The paper characterizes container workloads from host-level LTTng traces by selecting important threads and clustering execution-state behavior without instrumenting the containers internally.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "resource-analysis"
      ],
      "keywords": [
        "container workloads",
        "host tracing",
        "LTTng",
        "pid_ns",
        "tid",
        "Trace Compass",
        "PageRank",
        "K-Means",
        "Docker",
        "Ubuntu 20.04.1",
        "Linux 5.8.0",
        "silhouette score",
        "tracing overhead"
      ]
    },
    {
      "paper_id": "malware-system-calls-detection-using-hybrid-system",
      "title": "Malware System Calls Detection Using Hybrid System",
      "year": 2021,
      "authors": [
        "Yue Guan",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/malware-system-calls-detection-using-hybrid-system/",
      "canonical_source_url": "https://doi.org/10.1109/SysCon48628.2021.9447094",
      "core_contribution": "The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "anomaly-detection",
        "machine-learning",
        "observability"
      ],
      "keywords": [
        "malware detection",
        "system-call analysis",
        "LTTng",
        "Trace Compass",
        "LSTM",
        "Transformer",
        "multi-head attention",
        "PyTorch",
        "Linux VMs",
        "sequence classification",
        "precision",
        "recall",
        "unknown attacks"
      ]
    },
    {
      "paper_id": "depgraph",
      "title": "DepGraph: Localizing Performance Bottlenecks in Multi-Core Applications Using Waiting Dependency Graphs and Software Tracing",
      "year": 2020,
      "authors": [
        "Naser Ezzati-Jivan",
        "Quentin Fournier",
        "Michel R. Dagenais",
        "Abdelwahab Hamou-Lhadj"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/depgraph/",
      "canonical_source_url": "https://doi.org/10.1109/SCAM51674.2020.00022",
      "core_contribution": "DepGraph uses system-level tracing to expose the waiting dependencies that divide a task's execution time across threads and hardware resources.",
      "tags": [
        "kernel-tracing",
        "performance-analysis",
        "root-cause-analysis",
        "multicore-systems"
      ],
      "keywords": [
        "waiting dependency graph",
        "system-level tracing",
        "blocking dependencies",
        "performance bottlenecks",
        "thread-resource interactions"
      ]
    },
    {
      "paper_id": "enhanced-trace-abstraction-social-network-analysis",
      "title": "Enhanced Execution Trace Abstraction Approach Using Social Network Analysis Methods",
      "year": 2020,
      "authors": [
        "Ji Wang",
        "Naser Ezzati-Jivan"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/enhanced-trace-abstraction-social-network-analysis/",
      "canonical_source_url": "https://fb-swt.gi.de/fileadmin/FB/SWT/Softwaretechnik-Trends/Verzeichnis/Band_40_Heft_3/SSP2020_Wang.pdf",
      "core_contribution": "The paper adapts community detection and PageRank from social-network analysis to reduce and prioritize system execution traces.",
      "tags": [
        "kernel-tracing",
        "trace-abstraction",
        "social-network-analysis",
        "trace-filtering",
        "lttng"
      ],
      "keywords": [
        "LTTng",
        "Trace Compass",
        "Louvain community detection",
        "PageRank",
        "thread interaction graph",
        "trace filtering",
        "virtual-machine clustering"
      ]
    },
    {
      "paper_id": "multilevel-trace-lock-contention",
      "title": "Multi-Level Execution Trace Based Lock Contention Analysis",
      "year": 2020,
      "authors": [
        "Majid Rezazadeh",
        "Naser Ezzati-Jivan",
        "Evan Galea",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multilevel-trace-lock-contention/",
      "canonical_source_url": "https://doi.org/10.1109/issrew51248.2020.00068",
      "core_contribution": "The paper extends critical-path analysis across kernel and user-space lock events so contention from futexes, spinlocks, semaphores, and other synchronization mechanisms can be diagnosed without recompiling the application.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "root-cause-analysis"
      ],
      "keywords": [
        "lock contention",
        "multi-level execution traces",
        "LTTng 2.10",
        "Trace Compass 4",
        "LD_PRELOAD",
        "Pthreads",
        "futex",
        "spinlock",
        "semaphore",
        "critical path",
        "state system",
        "Apache",
        "OPcache"
      ]
    },
    {
      "paper_id": "multi-level-host-based-intrusion-detection-system-for-internet-of-things",
      "title": "Multi-level Host-based Intrusion Detection System for Internet of Things",
      "year": 2020,
      "authors": [
        "Robin Gassais",
        "Naser Ezzati-Jivan",
        "Jose M. Fernandez",
        "Daniel Aloise",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multi-level-host-based-intrusion-detection-system-for-internet-of-things/",
      "canonical_source_url": "https://doi.org/10.1186/s13677-020-00206-6",
      "core_contribution": "The paper combines host-level user/kernel tracing with machine learning to detect intrusion behavior on constrained IoT and home-automation systems.",
      "tags": [
        "iot-security",
        "kernel-tracing",
        "machine-learning",
        "anomaly-detection",
        "lttng",
        "observability"
      ],
      "keywords": [
        "IoT intrusion detection",
        "host-based IDS",
        "LTTng",
        "barectf",
        "Common Trace Format",
        "Babeltrace",
        "Raspberry Pi 3",
        "Home Assistant",
        "Decision Tree",
        "Random Forest",
        "Gradient Boosted Trees",
        "SVM",
        "MLP",
        "LSTM",
        "Mirai",
        "ransomware",
        "CPU overhead",
        "memory overhead"
      ]
    },
    {
      "paper_id": "automatic-cause-detection-web-applications",
      "title": "Automatic Cause Detection of Performance Problems in Web Applications",
      "year": 2019,
      "authors": [
        "Quentin Fournier",
        "Naser Ezzati-Jivan",
        "Daniel Aloise",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/automatic-cause-detection-web-applications/",
      "canonical_source_url": "https://doi.org/10.1109/ISSREW.2019.00102",
      "core_contribution": "The paper presents a tracing and analysis pipeline that detects slow web requests and groups them by internal execution behavior to expose likely causes.",
      "tags": [
        "kernel-tracing",
        "web-performance",
        "anomaly-detection",
        "root-cause-analysis"
      ],
      "keywords": [
        "web requests",
        "user-space tracing",
        "kernel-space tracing",
        "outlier detection",
        "behavior clustering",
        "PHP cache contention"
      ]
    },
    {
      "paper_id": "machine-learning-based-edos-attack-detection-technique-using-execution-trace-analysis",
      "title": "Machine Learning-Based EDoS Attack Detection Technique Using Execution Trace Analysis",
      "year": 2019,
      "authors": [
        "Hossein Abbasi",
        "Naser Ezzati-Jivan",
        "Martine Bellaiche",
        "Chamseddine Talhi",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/machine-learning-based-edos-attack-detection-technique-using-execution-trace-analysis/",
      "canonical_source_url": "https://doi.org/10.1007/s41635-018-0061-2",
      "core_contribution": "The paper combines execution-trace and virtual-machine metrics with machine learning to detect EDoS behavior and restrict resource expansion to apparently normal VMs.",
      "tags": [
        "anomaly-detection",
        "kernel-tracing",
        "machine-learning",
        "performance-analysis",
        "resource-analysis",
        "system-tracing"
      ],
      "keywords": [
        "Economic Denial of Sustainability",
        "EDoS",
        "DDoS",
        "cloud computing",
        "execution trace analysis",
        "LTTng",
        "QEMU",
        "KVM",
        "Apache",
        "MySQL",
        "HTTPFlooder",
        "LoadRunner",
        "WEKA",
        "multilayer perceptron",
        "SVM",
        "Snort"
      ]
    },
    {
      "paper_id": "efficient-cloud-tracing-levels",
      "title": "Efficient cloud tracing: From very high level to very low level",
      "year": 2018,
      "authors": [
        "Yves J. Bationo",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/efficient-cloud-tracing-levels/",
      "canonical_source_url": "https://doi.org/10.1109/ICCE.2018.8326353",
      "core_contribution": "The paper correlates OpenStack Nova, QEMU/KVM, and host/guest kernel evidence to diagnose live-migration behavior across cloud-system layers.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "observability"
      ],
      "keywords": [
        "cloud tracing",
        "high-level tracing",
        "low-level tracing",
        "cross-layer observability",
        "OpenStack Nova",
        "QEMU",
        "KVM",
        "Trace Compass",
        "live migration"
      ]
    },
    {
      "paper_id": "dynamic-trace-sampling-memory-usage",
      "title": "Dynamic trace-based sampling algorithm for memory usage tracking of enterprise applications",
      "year": 2017,
      "authors": [
        "Houssem Daoud",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/dynamic-trace-sampling-memory-usage/",
      "canonical_source_url": "https://doi.org/10.1109/HPEC.2017.8091061",
      "core_contribution": "The paper introduces a kernel-resident dynamic sampler that tracks virtual and physical memory usage while reducing the event volume generated by high-frequency memory activity.",
      "tags": [
        "kernel-tracing",
        "resource-analysis",
        "performance-analysis",
        "trace-reduction"
      ],
      "keywords": [
        "memory usage",
        "dynamic sampling",
        "enterprise applications",
        "trace overhead",
        "LTTng",
        "kernel module",
        "Kprobes",
        "kmem_mm_page_alloc",
        "kmem_mm_page_free"
      ]
    },
    {
      "paper_id": "hardware-assisted-software-event-tracing",
      "title": "Hardware-assisted software event tracing",
      "year": 2017,
      "authors": [
        "Adrien Vergé",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/hardware-assisted-software-event-tracing/",
      "canonical_source_url": "https://doi.org/10.1002/cpe.4069",
      "core_contribution": "The paper designs and evaluates hardware-assisted alternatives to LTTng-UST for software-event and execution-path tracing, including STM/ETB, ETM/ETB, and a modified Perf/BTS path.",
      "tags": [
        "system-tracing",
        "kernel-tracing",
        "trace-analysis",
        "performance-engineering"
      ],
      "keywords": [
        "hardware-assisted tracing",
        "software events",
        "event collection",
        "trace overhead",
        "ARM CoreSight",
        "STM",
        "ETM",
        "ETB",
        "Intel BTS",
        "Perf",
        "LTTng-UST"
      ]
    },
    {
      "paper_id": "multi-scale-navigation-of-large-trace-data-a-survey",
      "title": "Multi-scale navigation of large trace data: A survey",
      "year": 2017,
      "authors": [
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multi-scale-navigation-of-large-trace-data-a-survey/",
      "canonical_source_url": "https://doi.org/10.1002/cpe.4068",
      "core_contribution": "The survey provides a taxonomy and requirements-oriented comparison of techniques for collecting, abstracting, analyzing, visualizing, and navigating large execution traces.",
      "tags": [
        "trace-visualization",
        "trace-abstraction",
        "kernel-tracing",
        "performance-analysis",
        "system-tracing"
      ],
      "keywords": [
        "trace navigation",
        "multi-scale analysis",
        "trace visualization",
        "content abstraction",
        "metric abstraction",
        "visual abstraction",
        "resource abstraction",
        "semantic zoom",
        "focus-plus-context",
        "Trace Compass",
        "Vampir",
        "Jumpshot",
        "SLOG",
        "R-tree",
        "quadtree",
        "State History Tree"
      ]
    },
    {
      "paper_id": "enhanced-state-history-tree-esht-a-stateful-data-structure-for-analysis-of-highly-parallel-syste",
      "title": "Enhanced State History Tree (eSHT): A Stateful Data Structure for Analysis of Highly Parallel System Traces",
      "year": 2016,
      "authors": [
        "Loic Prieur-Drevon",
        "Raphael Beamonte",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/enhanced-state-history-tree-esht-a-stateful-data-structure-for-analysis-of-highly-parallel-syste/",
      "canonical_source_url": "https://doi.org/10.1109/BigDataCongress.2016.19",
      "core_contribution": "eSHT redesigns the State History Tree to store and query highly parallel trace intervals more compactly and with shallower trees.",
      "tags": [
        "kernel-tracing",
        "trace-analysis",
        "performance-optimization",
        "multicore-systems",
        "resource-analysis"
      ],
      "keywords": [
        "Enhanced State History Tree",
        "eSHT",
        "State History Tree",
        "interval data",
        "external-memory indexing",
        "LTTng 2.7.0",
        "Trace Compass",
        "Linux kernel 4.3.0",
        "parallel traces",
        "node fill",
        "tree depth",
        "query optimization"
      ]
    },
    {
      "paper_id": "multilayer-virtualized-systems-kernel-tracing",
      "title": "Multilayer Virtualized Systems Analysis with Kernel Tracing",
      "year": 2016,
      "authors": [
        "Cedric Biancheri",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/multilayer-virtualized-systems-kernel-tracing/",
      "canonical_source_url": "https://doi.org/10.1109/W-FiCloud.2016.18",
      "core_contribution": "The paper fuses synchronized host and virtual-machine kernel traces into a Fused Virtual Machine view that exposes how VM threads, virtual CPUs, hypervisor transitions, and physical CPUs interact.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "performance-analysis",
        "resource-analysis"
      ],
      "keywords": [
        "virtualized systems",
        "kernel tracing",
        "multilayer analysis",
        "virtualization overhead",
        "LTTng",
        "KVM",
        "Trace Compass",
        "Fused Virtual Machine view",
        "State History Tree",
        "vmentry",
        "vmexit"
      ]
    },
    {
      "paper_id": "a-flexible-data-driven-approach-for-execution-trace-filtering",
      "title": "A Flexible Data-Driven Approach for Execution Trace Filtering",
      "year": 2015,
      "authors": [
        "Kadjo Gwandy Kouame",
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/a-flexible-data-driven-approach-for-execution-trace-filtering/",
      "canonical_source_url": "https://doi.org/10.1109/BigDataCongress.2015.112",
      "core_contribution": "The paper provides a declarative XML/state-machine approach for flexible filtering and synthetic-event generation over large kernel traces.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "trace-filtering",
        "trace-abstraction",
        "trace-analysis"
      ],
      "keywords": [
        "execution trace filtering",
        "LTTng 2.4.0",
        "Trace Compass",
        "finite-state machine",
        "declarative analysis",
        "synthetic events",
        "SYN flood",
        "hping3",
        "state system",
        "XML modeling",
        "kernel tracing"
      ]
    },
    {
      "paper_id": "cube-data-model-for-multilevel-statistics-computation-of-live-execution-traces",
      "title": "Cube data model for multilevel statistics computation of live execution traces",
      "year": 2015,
      "authors": [
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/cube-data-model-for-multilevel-statistics-computation-of-live-execution-traces/",
      "canonical_source_url": "https://doi.org/10.1002/cpe.3272",
      "core_contribution": "The paper proposes a multilevel data-cube model for computing statistics over live execution traces across several time scales.",
      "tags": [
        "kernel-tracing",
        "trace-analysis",
        "performance-analysis",
        "resource-analysis",
        "performance-engineering"
      ],
      "keywords": [
        "data cube",
        "stream cube",
        "live trace statistics",
        "LTTng",
        "State History Tree",
        "tilted time frame",
        "multilevel analysis",
        "roll-up",
        "drill-down",
        "range query",
        "sliding window",
        "cuboid materialization"
      ]
    },
    {
      "paper_id": "a-framework-to-compute-statistics-of-system-parameters-from-very-large-trace-files",
      "title": "A framework to compute statistics of system parameters from very large trace files",
      "year": 2013,
      "authors": [
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/a-framework-to-compute-statistics-of-system-parameters-from-very-large-trace-files/",
      "canonical_source_url": "https://doi.org/10.1145/2433140.2433151",
      "core_contribution": "The framework computes system-parameter statistics for arbitrary intervals and resource hierarchies from very large traces using a disk-resident history structure and controlled granularity.",
      "tags": [
        "kernel-tracing",
        "trace-analysis",
        "performance-analysis",
        "resource-analysis",
        "performance-engineering"
      ],
      "keywords": [
        "trace statistics",
        "LTTng",
        "Linux kernel 2.6.38.6",
        "disk-resident interval tree",
        "history tree",
        "granularity degree",
        "linear interpolation",
        "hierarchical query",
        "large-scale tracing",
        "online analysis",
        "CPU usage",
        "I/O throughput"
      ]
    },
    {
      "paper_id": "state-history-tree-an-incremental-disk-based-data-structure-for-very-large-interval-data",
      "title": "State History Tree: An Incremental Disk-Based Data Structure for Very Large Interval Data",
      "year": 2013,
      "authors": [
        "Alexandre Montplaisir-Goncalves",
        "Naser Ezzati-Jivan",
        "Florian Wininger",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/state-history-tree-an-incremental-disk-based-data-structure-for-very-large-interval-data/",
      "canonical_source_url": "https://doi.org/10.1109/SocialCom.2013.107",
      "core_contribution": "The paper presents a disk-oriented State History Tree that stores very large, time-ordered trace intervals without repeated node rebalancing.",
      "tags": [
        "kernel-tracing",
        "trace-analysis",
        "performance-engineering",
        "resource-analysis"
      ],
      "keywords": [
        "State History Tree",
        "disk-based interval data",
        "streaming interval data",
        "time-ordered intervals",
        "LTTng",
        "Eclipse Tracing and Monitoring Framework",
        "Linux Tools Project",
        "Java",
        "R-tree",
        "PostgreSQL/PostGIS",
        "full query",
        "ad-hoc query"
      ]
    },
    {
      "paper_id": "a-stateful-approach-to-generate-synthetic-events-from-kernel-traces",
      "title": "A Stateful Approach to Generate Synthetic Events from Kernel Traces",
      "year": 2012,
      "authors": [
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/a-stateful-approach-to-generate-synthetic-events-from-kernel-traces/",
      "canonical_source_url": "https://doi.org/10.1155/2012/140368",
      "core_contribution": "The paper introduces a stateful trace-abstraction method that converts low-level kernel events into semantic and synthetic events using modeled resource state and finite-state patterns.",
      "tags": [
        "kernel-tracing",
        "system-tracing",
        "trace-abstraction",
        "trace-analysis",
        "performance-analysis"
      ],
      "keywords": [
        "stateful trace abstraction",
        "synthetic events",
        "semantic events",
        "modeled state",
        "finite-state machine",
        "LTTng",
        "Linux kernel 2.6.38.6",
        "XML pattern library",
        "partial trace abstraction",
        "fork bomb",
        "SYN flood",
        "port scanning"
      ]
    },
    {
      "paper_id": "efficient-analysis-multi-core-system-tracing-data",
      "title": "An Efficient Analysis Approach for Multi-Core System Tracing Data",
      "year": 2012,
      "authors": [
        "Naser Ezzati-Jivan",
        "Michel R. Dagenais"
      ],
      "page_url": "https://threadslab.org/research-publications/papers/efficient-analysis-multi-core-system-tracing-data/",
      "canonical_source_url": "https://doi.org/10.2316/P.2012.790-053",
      "core_contribution": "The paper introduces a stateful trace-abstraction architecture that shares modeled system state and intermediate computation across concurrent patterns to reduce the cost of analyzing large Linux kernel traces.",
      "tags": [
        "kernel-tracing",
        "lttng",
        "trace-analysis",
        "trace-abstraction",
        "trace-filtering",
        "performance-analysis",
        "multicore-systems"
      ],
      "keywords": [
        "multi-core tracing",
        "LTTng",
        "Linux kernel 2.6.38.6",
        "stateful trace analysis",
        "trace abstraction",
        "EventMapper",
        "modeled state",
        "semantic events",
        "synthetic event generation",
        "State Machine Language",
        "pattern library",
        "partial trace abstraction",
        "SYN flood",
        "fork bomb",
        "kernel trace",
        "Java trace analyzer",
        "computation sharing",
        "storage efficiency"
      ]
    }
  ]
}