{ "schema_version": "0.1.0", "record_type": "research-topic", "topic_id": "system-tracing", "label": "System Tracing", "title": "System Tracing Research", "description": "Research papers on system-level tracing, execution events, cross-layer instrumentation, and performance analysis.", "introduction": "This topic covers system-level execution tracing across operating-system, runtime, application, and distributed-service layers. The papers use traces to reconstruct execution states, correlate requests with resource behavior, identify bottlenecks, and support performance or reliability analysis. Tool and version details are kept on the individual records so the topic page remains a map of the research area rather than a generic tool list.", "aliases": [ "system-level tracing", "execution tracing", "system trace analysis" ], "search_terms": [ "system tracing", "execution traces", "cross-layer tracing", "runtime observability" ], "related_topics": [ "kernel-tracing", "trace-analysis", "observability", "performance-analysis", "trace-visualization" ], "canonical_url": "https://threadslab.org/research-publications/topics/system-tracing.html", "paper_count": 40, "papers": [ { "paper_id": "b-perf-black-box-performance-antipatterns", "title": "B-Perf: Black-box Performance Antipattern Detection Using System-level Execution Tracing", "year": 2026, "authors": [ "Morteza Noferesti", "Mahsa Panahandeh", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/b-perf-black-box-performance-antipatterns/", "canonical_source_url": "https://doi.org/10.1145/3777884.3797014", "core_contribution": "B-Perf reconstructs execution, memory, and messaging behavior from Linux kernel-level traces and infers performance-antipattern indicators without requiring application source access or intrusive instrumentation.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "anomaly-detection" ], "keywords": [ "performance antipatterns", "black-box detection", "system-level execution traces", "LTTng", "Trace Compass", "critical paths", "resource contention", "execution serialization", "allocation churn", "small-message overhead" ] }, { "paper_id": "care-context-aware-root-cause-identification", "title": "CARE: Context Aware Root Cause Identification Using Distributed Traces and Profiling Metrics", "year": 2026, "authors": [ "Mahsa Panahandeh", "Naser Ezzati-Jivan", "Abdelwahab Hamou-Lhadj", "James Miller" ], "page_url": "https://threadslab.org/research-publications/papers/care-context-aware-root-cause-identification/", "canonical_source_url": "https://doi.org/10.1109/TSE.2025.3645143", "core_contribution": "CARE combines distributed traces and profiling metrics with graph- and spectrum-based analysis to localize performance root causes in microservices.", "tags": [ "system-tracing", "microservices", "root-cause-analysis", "latency-analysis" ], "keywords": [ "distributed traces", "profiling metrics", "context-aware RCA", "microservice diagnosis", "TrainTicket", "spectrum-based fault localization", "PageRank", "China Mobile Zhejiang" ] }, { "paper_id": "dtracomp-distributed-trace-comparison", "title": "DTraComp: Comparing distributed execution traces for understanding intermittent latency sources", "year": 2026, "authors": [ "Maryam Ekhlasi", "Fatemeh Faraji Daneshgar", "Michel Dagenais", "Maxime Lamothe", "Naser Ezzati-Jivan", "Matthew Khouzam" ], "page_url": "https://threadslab.org/research-publications/papers/dtracomp-distributed-trace-comparison/", "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112990", "core_contribution": "DTraComp is an open-source Eclipse Trace Compass framework that compares groups of distributed requests and attributes span time to user-space, kernel, thread-state, and system-call evidence.", "tags": [ "system-tracing", "kernel-tracing", "trace-analysis", "trace-visualization", "latency-analysis", "root-cause-analysis", "microservices", "lttng" ], "keywords": [ "DTraComp", "distributed trace comparison", "OpenTracing", "LTTng", "LTTng-UST", "Eclipse Trace Compass", "differential flame graph", "span-state attribution", "system-call attribution", "Waited CPU", "Waited Blocked", "HotROD", "TiDB", "Apache Cassandra", "Eclipse Theia", "JFreeChart", "Jaeger", "microservice performance" ] }, { "paper_id": "lmat-adaptive-tracing-language-models", "title": "LMAT: An adaptive tracing approach based on efficient system behavior analysis using language models", "year": 2026, "authors": [ "Kasra Darvishi", "Morteza Noferesti", "Yuvraj Sehgal", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/lmat-adaptive-tracing-language-models/", "canonical_source_url": "https://doi.org/10.1016/j.jss.2026.112890", "core_contribution": "LMAT combines multi-task language models for kernel-event and event-duration prediction with online change detection, lightweight error-vector root-cause analysis, and adaptive tracing control.", "tags": [ "kernel-tracing", "system-tracing", "llm-assisted-analysis", "observability", "anomaly-detection", "root-cause-analysis", "trace-reduction" ], "keywords": [ "adaptive tracing", "LTTng", "kernel events", "system-call sequences", "event-duration modeling", "language models", "LSTM", "BERT", "multi-task learning", "HDBSCAN", "change detection", "root-cause analysis", "Apache", "Sock Shop", "OpenTelemetry", "Prometheus", "stress-ng", "trace reduction", "trace overhead" ] }, { "paper_id": "tracesynth-kernel-trace-generation", "title": "TraceSynth: Generating Production-Quality Kernel Traces with Constraint-Guided Diffusion Models", "year": 2026, "authors": [ "Yuvraj Sehgal", "Sneh Patel", "Mahsa Panahandeh", "Naser Ezzati-Jivan", "Francois Tetreault" ], "page_url": "https://threadslab.org/research-publications/papers/tracesynth-kernel-trace-generation/", "canonical_source_url": "https://doi.org/10.1145/3803437.3805222", "core_contribution": "TraceSynth generates novel structured kernel-trace windows with a Transformer diffusion model and repairs generated events against invariants mined from real LTTng traces.", "tags": [ "kernel-tracing", "system-tracing", "trace-analysis", "machine-learning" ], "keywords": [ "kernel traces", "trace generation", "diffusion models", "constraint-guided generation", "LTTng", "Parquet", "Phoronix Test Suite", "DDIM", "next-event prediction", "synthetic traces" ] }, { "paper_id": "efficient-communication-performance-antipattern-detection-microservices", "title": "Efficient Detection of Communication-related Performance Anti-patterns in Microservices", "year": 2025, "authors": [ "Masoumeh Nourollahi", "Naser Ezzati-Jivan", "Adel Belkheiri", "Michel Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/efficient-communication-performance-antipattern-detection-microservices/", "canonical_source_url": "https://doi.org/10.22541/au.175533132.24109345/v1", "core_contribution": "The preprint combines communication-related kernel/system-call events with distributed traces to detect communication performance anti-patterns in microservices.", "tags": [ "microservices", "system-tracing", "anomaly-detection", "machine-learning", "performance-analysis" ], "keywords": [ "communication anti-patterns", "DeathStarBench", "LTTng", "Trace Compass", "Jaeger", "system calls", "distributed traces", "Blob", "Empty Semi Trucks", "supervised learning", "semi-supervised learning" ] }, { "paper_id": "execution-trace-reconstruction-using-diffusion-based-generative-models", "title": "Execution Trace Reconstruction Using Diffusion-Based Generative Models", "year": 2025, "authors": [ "Madeline Janecek", "Naser Ezzati-Jivan", "Abdelwahab Hamou-Lhadj" ], "page_url": "https://threadslab.org/research-publications/papers/execution-trace-reconstruction-using-diffusion-based-generative-models/", "canonical_source_url": "https://doi.org/10.1109/ICSE55347.2025.00063", "core_contribution": "The paper reconstructs missing system-call events in execution traces with diffusion and structured state-space generative models.", "tags": [ "kernel-tracing", "system-tracing", "trace-analysis", "trace-reduction", "performance-analysis" ], "keywords": [ "execution trace reconstruction", "trace imputation", "diffusion models", "DiffWave", "SSSDS4", "SSSDSA", "CSDIS4", "structured state-space", "system-call sequences", "LTTng", "Phoronix Test Suite", "ROUGE-L", "perfect rate", "missing events", "ring-buffer overflow" ] }, { "paper_id": "hybridrca-critical-path-aware-tracing", "title": "HybridRCA: Lightweight Critical-Path-Aware Hybrid Tracing for Root-Cause Analysis in Production Microservices", "year": 2025, "authors": [ "Maryam Ekhlasi", "Arnaud Fiorini", "Michel R. Dagenais", "Naser Ezzati-Jivan", "Maxime Lamothe" ], "page_url": "https://threadslab.org/research-publications/papers/hybridrca-critical-path-aware-tracing/", "canonical_source_url": "https://doi.org/10.1109/icsme64153.2025.00056", "core_contribution": "HybridRCA combines critical-path-aware span analysis with targeted kernel metrics to reduce production trace volume while preserving root-cause localization evidence.", "tags": [ "system-tracing", "microservices", "root-cause-analysis", "latency-analysis" ], "keywords": [ "critical path", "hybrid tracing", "production microservices", "LTTng", "OpenTracing", "Personalized PageRank", "weighted spectrum-based fault localization", "HotROD", "TrainTicket", "OnlineBoutique", "TiDB", "SysBench", "kernel-level storage" ] }, { "paper_id": "synthlogai-synthetic-linux-log-generation", "title": "SynthLogAI: Generative AI for Synthetic Linux Log Generation and Evaluation", "year": 2025, "authors": [ "Hridoy Rahman", "Naser Ezzati-Jivan", "Blessing Ogbuokiri" ], "page_url": "https://threadslab.org/research-publications/papers/synthlogai-synthetic-linux-log-generation/", "canonical_source_url": "https://doi.org/10.1109/CASCON66301.2025.00032", "core_contribution": "SynthLogAI benchmarks statistical, sequence, transformer, and prompt-based generative models for producing synthetic Linux logs while measuring fidelity, downstream utility, and privacy.", "tags": [ "machine-learning", "observability", "anomaly-detection", "system-tracing" ], "keywords": [ "synthetic Linux logs", "generative AI", "log generation", "log evaluation", "CASCON 2025" ] }, { "paper_id": "enhancing-performance-engineering-with-kernel-events", "title": "Enhancing empirical software performance engineering research with kernel-level events: A comprehensive system tracing approach", "year": 2024, "authors": [ "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/enhancing-performance-engineering-with-kernel-events/", "canonical_source_url": "https://doi.org/10.1016/j.jss.2024.112117", "core_contribution": "The paper releases a reusable Linux kernel-event and system-call artifact with controlled application workloads, injected resource noise, and analysis scenarios for software performance engineering.", "tags": [ "kernel-tracing", "system-tracing", "performance-engineering", "observability", "anomaly-detection" ], "keywords": [ "LTTng", "Linux kernel events", "system calls", "kernel tracepoints", "Elasticsearch", "Kibana", "IoT dataset", "stress-ng", "CPU noise", "I/O noise", "network noise", "memory noise", "software phase detection", "24,263,691 events" ] }, { "paper_id": "resource-life-cycle-aware-noise-detection-kernel-events", "title": "Resource Life-Cycle Aware Noise Detection via Kernel Event Monitoring", "year": 2024, "authors": [ "Morteza Noferesti", "Ben Grandy", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/resource-life-cycle-aware-noise-detection-kernel-events/", "canonical_source_url": "https://doi.org/10.1109/CASCON62161.2024.10838205", "core_contribution": "The paper detects and localizes performance noise by aligning passive kernel-event evidence with the life cycle of CPU, disk, and network requests rather than treating resource utilization as an undifferentiated aggregate.", "tags": [ "kernel-tracing", "system-tracing", "anomaly-detection", "performance-analysis" ], "keywords": [ "kernel event monitoring", "resource life cycle", "noise detection", "CPU requests", "disk requests", "network requests" ] }, { "paper_id": "toward-adaptive-tracing-language-models", "title": "Toward Adaptive Tracing: Efficient System Behavior Analysis using Language Models", "year": 2024, "authors": [ "Kasra Darvishi", "Morteza Noferesti", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/toward-adaptive-tracing-language-models/", "canonical_source_url": "https://doi.org/10.1145/3639476.3639778", "core_contribution": "The paper proposes an adaptive tracing loop that combines language-model prediction of kernel-event sequences and event durations with change detection and root-cause analysis, so detailed tracing is activated only around significant behavior shifts.", "tags": [ "kernel-tracing", "system-tracing", "llm-assisted-analysis", "observability", "anomaly-detection", "root-cause-analysis", "trace-reduction" ], "keywords": [ "adaptive tracing", "LTTng", "kernel events", "system-call sequences", "event-duration modeling", "language models", "LSTM", "BERT", "multi-task learning", "change detection", "root-cause analysis", "Apache2", "trace reduction", "trace overhead" ] }, { "paper_id": "altoom-out-of-memory-root-cause", "title": "AltOOM: A Data-driven Out of Memory Root Cause Identification Strategy", "year": 2023, "authors": [ "Pranjal Chakraborty", "Naser Ezzati-Jivan", "Vahid Azhari", "François Tetreault" ], "page_url": "https://threadslab.org/research-publications/papers/altoom-out-of-memory-root-cause/", "canonical_source_url": "https://doi.org/10.1109/bigdata59044.2023.10386937", "core_contribution": "AltOOM combines early memory-pressure forecasting with selective process-level profiling to identify the process most responsible for an impending out-of-memory event.", "tags": [ "resource-analysis", "root-cause-analysis", "system-tracing", "predictive-monitoring" ], "keywords": [ "out-of-memory", "OOM diagnosis", "data-driven RCA", "resource analysis", "memory pressure forecasting", "process-level profiling", "Perf", "sar" ] }, { "paper_id": "emd-scs-malware-detection-sonification-system-calls", "title": "EMD-SCS: A Dynamic Behavioral Approach for Early Malware Detection with Sonification of System Call Sequences", "year": 2023, "authors": [ "Raghav Bhardwaj", "Morteza Noferesti", "Madeline Janecek", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/emd-scs-malware-detection-sonification-system-calls/", "canonical_source_url": "https://doi.org/10.1109/TRUSTCOM60117.2023.00235", "core_contribution": "EMD-SCS combines sequence prediction of system calls with sonification so that partial execution prefixes can support early malware detection and an interpretable auditory alert.", "tags": [ "system-tracing", "anomaly-detection", "machine-learning", "performance-analysis" ], "keywords": [ "malware detection", "system-call sequences", "sonification", "Hamming distance", "detection rate", "false-positive rate", "EMD-SCS" ] }, { "paper_id": "multi-level-adaptive-execution-tracing-performance-analysis", "title": "Multi-level Adaptive Execution Tracing for Efficient Performance Analysis", "year": 2023, "authors": [ "Mohammed Adib Khan", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/multi-level-adaptive-execution-tracing-performance-analysis/", "canonical_source_url": "https://doi.org/10.1109/SERA57763.2023.10197790", "core_contribution": "The paper presents a multi-level adaptive tracing workflow that uses lightweight stress detection and performance evidence to change the application/kernel instrumentation scope during an investigation.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "adaptive-scheduling" ], "keywords": [ "adaptive execution tracing", "time-series trends", "multi-level tracing", "kernel tracing", "performance analysis", "SERA 2023" ] }, { "paper_id": "execution-trace-model-verification-multicore", "title": "Execution trace-based model verification to analyze multicore and real-time systems", "year": 2022, "authors": [ "Raphaël Beamonte", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/execution-trace-model-verification-multicore/", "canonical_source_url": "https://doi.org/10.1002/cpe.6974", "core_contribution": "The paper combines model-based quantitative constraints with user-space and kernel execution traces to automatically identify likely causes of real-time and multicore constraint violations.", "tags": [ "system-tracing", "kernel-tracing", "multicore-systems", "trace-analysis", "root-cause-analysis", "lttng" ], "keywords": [ "model-based constraints", "execution tracing", "user-space traces", "kernel traces", "LTTng", "LTTng-UST", "Common Trace Format", "Trace Compass", "reservoir sampling", "critical-path analysis", "JACK2", "cyclictest", "priority inversion", "CPUTop" ] }, { "paper_id": "n-lane-bridge-performance-antipatterns", "title": "N-Lane Bridge Performance Antipattern Analysis Using System-Level Execution Tracing", "year": 2022, "authors": [ "Riley VanDonge", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/n-lane-bridge-performance-antipatterns/", "canonical_source_url": "https://doi.org/10.1109/scam55253.2022.00015", "core_contribution": "N-Lane Bridge extends One-Lane Bridge analysis to active-resource bottlenecks and uses LTTng system-level traces to distinguish application-caused congestion from external interference.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "anomaly-detection" ], "keywords": [ "N-Lane Bridge", "One-Lane Bridge", "performance antipatterns", "system-level execution tracing", "LTTng", "Trace Compass", "sched_switch", "sched_wakeup", "futex", "Firefox PDF.js", "InDebitO", "SysBench", "memory paging", "CPU preemption" ] }, { "paper_id": "performance-anomaly-detection-sequence-alignment", "title": "Performance Anomaly Detection through Sequence Alignment of System-Level Traces", "year": 2022, "authors": [ "Madeline Janecek", "Naser Ezzati-Jivan", "Abdelwahab Hamou-Lhadj" ], "page_url": "https://threadslab.org/research-publications/papers/performance-anomaly-detection-sequence-alignment/", "canonical_source_url": "https://doi.org/10.1145/3524610.3527898", "core_contribution": "The framework combines critical-path extraction, coarse anomaly checks, OPTICS execution clustering, and MUSCLE multiple sequence alignment to localize performance differences in system-level traces.", "tags": [ "system-tracing", "anomaly-detection", "performance-analysis", "trace-analysis" ], "keywords": [ "sequence alignment", "MUSCLE", "OPTICS", "critical path", "system-level traces", "performance anomalies", "LTTng", "Docker", "execution clustering", "trace overhead" ] }, { "paper_id": "operating-system-support-applications-performance-analysis-poster", "title": "Poster Paper: Operating System Support for Applications Performance Analysis", "year": 2022, "authors": [ "Riley VanDonge", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/operating-system-support-applications-performance-analysis-poster/", "canonical_source_url": "https://doi.org/10.1109/IC2E55432.2022.00039", "core_contribution": "This poster proposes operating-system-aware antipattern detection that uses system-level traces and scalability trends to expose resource blocking that aggregate CPU utilization can hide.", "tags": [ "performance-analysis", "system-tracing", "kernel-tracing" ], "keywords": [ "operating-system support", "application performance analysis", "performance instrumentation", "IC2E 2022", "poster paper" ] }, { "paper_id": "automated-cause-analysis-latency-outliers", "title": "Automated Cause Analysis of Latency Outliers Using System-Level Dependency Graphs", "year": 2021, "authors": [ "Sneh Patel", "Brendan Park", "Naser Ezzati-Jivan", "Quentin Fournier" ], "page_url": "https://threadslab.org/research-publications/papers/automated-cause-analysis-latency-outliers/", "canonical_source_url": "https://doi.org/10.1109/QRS54544.2021.00054", "core_contribution": "The paper combines system-level dependency graphs with automated outlier detection to localize likely causes of latency anomalies.", "tags": [ "system-tracing", "latency-analysis", "root-cause-analysis", "dependency-graphs" ], "keywords": [ "latency outliers", "system-level traces", "dependency graphs", "density-based models", "z-score", "production diagnosis" ] }, { "paper_id": "model-based-constraints-execution-tracing", "title": "Automated Generation of Model-Based Constraints for Common Multi-core and Real-Time Applications Using Execution Tracing", "year": 2021, "authors": [ "Raphael Beamonte", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/model-based-constraints-execution-tracing/", "canonical_source_url": "https://doi.org/10.1007/s10766-020-00689-5", "core_contribution": "The paper automatically builds an approximate workflow model and adaptive quantitative constraints from user-space and kernel execution traces, reducing manual model construction for real-time and multicore diagnosis.", "tags": [ "system-tracing", "multicore-systems", "trace-analysis", "performance-analysis", "lttng" ], "keywords": [ "model-based constraints", "execution tracing", "multi-core systems", "real-time applications", "constraint generation", "LTTng", "Trace Compass", "cyclictest", "JACK2", "wakelock" ] }, { "paper_id": "combining-distributed-kernel-tracing-cloud", "title": "Combining Distributed and Kernel Tracing for Performance Analysis of Cloud Applications", "year": 2021, "authors": [ "Loïc Gelle", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/combining-distributed-kernel-tracing-cloud/", "canonical_source_url": "https://doi.org/10.3390/electronics10212610", "core_contribution": "The paper combines Jaeger distributed traces with LTTng kernel and user-space events and extends critical-path analysis from threads to distributed requests so request latency can be related to low-level scheduling and resource behavior.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "observability", "lttng" ], "keywords": [ "distributed tracing", "kernel tracing", "cloud applications", "cross-layer performance analysis", "LTTng", "Jaeger", "Trace Compass", "Babeltrace", "Common Trace Format", "HotROD", "Cassandra", "Apache ab", "cassandra-stress", "critical-path analysis", "snapshot tracing", "CPU control groups", "liblttng-ust", "request synchronization" ] }, { "paper_id": "container-workload-characterization-host-tracing", "title": "Container Workload Characterization Through Host System Tracing", "year": 2021, "authors": [ "Madeline Janecek", "Naser Ezzati-Jivan", "Seyed Vahid Azhari" ], "page_url": "https://threadslab.org/research-publications/papers/container-workload-characterization-host-tracing/", "canonical_source_url": "https://doi.org/10.1109/ic2e52221.2021.00015", "core_contribution": "The paper characterizes container workloads from host-level LTTng traces by selecting important threads and clustering execution-state behavior without instrumenting the containers internally.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "resource-analysis" ], "keywords": [ "container workloads", "host tracing", "LTTng", "pid_ns", "tid", "Trace Compass", "PageRank", "K-Means", "Docker", "Ubuntu 20.04.1", "Linux 5.8.0", "silhouette score", "tracing overhead" ] }, { "paper_id": "debugging-performance-degradation-distributed-requests", "title": "Debugging of Performance Degradation in Distributed Requests Handling Using Multilevel Trace Analysis", "year": 2021, "authors": [ "Naser Ezzati-Jivan", "Houssem Daoud", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/debugging-performance-degradation-distributed-requests/", "canonical_source_url": "https://doi.org/10.1155/2021/8478076", "core_contribution": "The paper correlates LTTng traces from user space through kernel, storage, network, and multiple hosts in a disk-backed state model, enabling top-down diagnosis of distributed request latency.", "tags": [ "system-tracing", "microservices", "performance-analysis", "root-cause-analysis", "trace-analysis" ], "keywords": [ "distributed requests", "multilevel trace analysis", "LTTng", "Apache", "PHP", "MariaDB", "State History Tree", "cache hit ratio", "disk contention", "ApacheBench", "Trace Compass" ] }, { "paper_id": "distributed-architecture-for-an-integrated-development-environment-large-trace-analysis-and-visu", "title": "Distributed Architecture for an Integrated Development Environment, Large Trace Analysis, and Visualization", "year": 2021, "authors": [ "Yonni Chen Kuang Piao", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/distributed-architecture-for-an-integrated-development-environment-large-trace-analysis-and-visu/", "canonical_source_url": "https://doi.org/10.3390/s21165560", "core_contribution": "The paper presents a modular client-server architecture for large-trace storage, analysis, and visualization inside an integrated development environment.", "tags": [ "system-tracing", "trace-analysis", "observability", "performance-optimization", "multicore-systems" ], "keywords": [ "distributed architecture", "Trace Compass", "TraceScape", "LTTng 2.10.3", "Trace Analysis Server Protocol", "TASP", "Protobuf", "GZip JSON", "large traces", "state models", "trace visualization", "PixiJS", "Chart.js", "HighCharts" ] }, { "paper_id": "efficient-heap-monitoring-memory-leak-root-cause", "title": "Efficient Heap Monitoring Tool for Memory Leak Detection and Root-cause Analysis", "year": 2021, "authors": [ "Vahid Azhari", "Simar Bhamra", "Naser Ezzati-Jivan", "Francois Tetreault" ], "page_url": "https://threadslab.org/research-publications/papers/efficient-heap-monitoring-memory-leak-root-cause/", "canonical_source_url": "https://doi.org/10.1109/BigData52589.2021.9671473", "core_contribution": "The paper presents a low-intrusion heap monitor that records allocation call stacks and uses persistent heap-growth filtering plus trace correlation to identify likely memory-leak roots.", "tags": [ "resource-analysis", "anomaly-detection", "performance-analysis", "system-tracing" ], "keywords": [ "heap monitoring", "memory leaks", "root-cause analysis", "memory management", "BigData 2021" ] }, { "paper_id": "malware-system-calls-detection-using-hybrid-system", "title": "Malware System Calls Detection Using Hybrid System", "year": 2021, "authors": [ "Yue Guan", "Naser Ezzati-Jivan" ], "page_url": "https://threadslab.org/research-publications/papers/malware-system-calls-detection-using-hybrid-system/", "canonical_source_url": "https://doi.org/10.1109/SysCon48628.2021.9447094", "core_contribution": "The paper combines LTTng system-call monitoring with recurrent and Transformer-style models for malware and anomalous system-behavior detection.", "tags": [ "kernel-tracing", "system-tracing", "anomaly-detection", "machine-learning", "observability" ], "keywords": [ "malware detection", "system-call analysis", "LTTng", "Trace Compass", "LSTM", "Transformer", "multi-head attention", "PyTorch", "Linux VMs", "sequence classification", "precision", "recall", "unknown attacks" ] }, { "paper_id": "system-execution-path-profiling-hardware-counters", "title": "System Execution Path Profiling Using Hardware Performance Counters", "year": 2021, "authors": [ "Francis Giraldeau", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/system-execution-path-profiling-hardware-counters/", "canonical_source_url": "https://doi.org/10.1109/SYSCON48628.2021.9447121", "core_contribution": "The work bridges kernel-level hardware-counter sampling and user-space interpreter state so execution-path profiling can attribute performance evidence to interpreted code.", "tags": [ "performance-analysis", "resource-analysis", "multicore-systems", "system-tracing" ], "keywords": [ "execution paths", "hardware performance counters", "critical-path profiling", "CPython", "PyPMU", "Linux perf", "perf NMI", "LTTng-UST", "libunwind", "sampling", "SysCon 2021" ] }, { "paper_id": "cloud-platform-performance-multilevel-tracing", "title": "Cloud Platform Performance Evaluation Using Multi-level Execution Tracing", "year": 2020, "authors": [ "Yves J. Bationo", "Naser Ezzati-Jivan", "Evan Galea", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/cloud-platform-performance-multilevel-tracing/", "canonical_source_url": "https://doi.org/10.1109/ithings-greencom-cpscom-smartdata-cybermatics50389.2020.00063", "core_contribution": "The paper correlates LTTng traces across OpenStack services, QEMU/KVM, network components, and host kernels to diagnose cloud-platform performance problems.", "tags": [ "system-tracing", "performance-analysis", "performance-engineering", "resource-analysis" ], "keywords": [ "cloud platforms", "multi-level execution tracing", "LTTng", "LTTng-UST", "OpenStack Nova", "Neutron", "QEMU", "KVM", "Open vSwitch", "Trace Compass", "live VM migration", "preemption", "VM interference" ] }, { "paper_id": "multilevel-trace-lock-contention", "title": "Multi-Level Execution Trace Based Lock Contention Analysis", "year": 2020, "authors": [ "Majid Rezazadeh", "Naser Ezzati-Jivan", "Evan Galea", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/multilevel-trace-lock-contention/", "canonical_source_url": "https://doi.org/10.1109/issrew51248.2020.00068", "core_contribution": "The paper extends critical-path analysis across kernel and user-space lock events so contention from futexes, spinlocks, semaphores, and other synchronization mechanisms can be diagnosed without recompiling the application.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "root-cause-analysis" ], "keywords": [ "lock contention", "multi-level execution traces", "LTTng 2.10", "Trace Compass 4", "LD_PRELOAD", "Pthreads", "futex", "spinlock", "semaphore", "critical path", "state system", "Apache", "OPcache" ] }, { "paper_id": "heterogeneous-debugging-dynamic-tracing", "title": "Efficient Large-Scale Heterogeneous Debugging Using Dynamic Tracing", "year": 2019, "authors": [ "Didier Nadeau", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/heterogeneous-debugging-dynamic-tracing/", "canonical_source_url": "https://doi.org/10.1016/j.sysarc.2019.02.016", "core_contribution": "The paper redesigns GDB dynamic tracing around LTTng-UST and scalable trace views so multi-threaded CPU/GPU debugging remains usable on heterogeneous many-core systems.", "tags": [ "system-tracing", "trace-analysis", "performance-analysis", "root-cause-analysis" ], "keywords": [ "heterogeneous systems", "dynamic tracing", "large-scale debugging", "debugging efficiency", "GDB", "LTTng-UST", "Trace Compass", "ROCm-GDB", "GPU debugging", "pbzip2" ] }, { "paper_id": "machine-learning-based-edos-attack-detection-technique-using-execution-trace-analysis", "title": "Machine Learning-Based EDoS Attack Detection Technique Using Execution Trace Analysis", "year": 2019, "authors": [ "Hossein Abbasi", "Naser Ezzati-Jivan", "Martine Bellaiche", "Chamseddine Talhi", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/machine-learning-based-edos-attack-detection-technique-using-execution-trace-analysis/", "canonical_source_url": "https://doi.org/10.1007/s41635-018-0061-2", "core_contribution": "The paper combines execution-trace and virtual-machine metrics with machine learning to detect EDoS behavior and restrict resource expansion to apparently normal VMs.", "tags": [ "anomaly-detection", "kernel-tracing", "machine-learning", "performance-analysis", "resource-analysis", "system-tracing" ], "keywords": [ "Economic Denial of Sustainability", "EDoS", "DDoS", "cloud computing", "execution trace analysis", "LTTng", "QEMU", "KVM", "Apache", "MySQL", "HTTPFlooder", "LoadRunner", "WEKA", "multilayer perceptron", "SVM", "Snort" ] }, { "paper_id": "efficient-cloud-tracing-levels", "title": "Efficient cloud tracing: From very high level to very low level", "year": 2018, "authors": [ "Yves J. Bationo", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/efficient-cloud-tracing-levels/", "canonical_source_url": "https://doi.org/10.1109/ICCE.2018.8326353", "core_contribution": "The paper correlates OpenStack Nova, QEMU/KVM, and host/guest kernel evidence to diagnose live-migration behavior across cloud-system layers.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "observability" ], "keywords": [ "cloud tracing", "high-level tracing", "low-level tracing", "cross-layer observability", "OpenStack Nova", "QEMU", "KVM", "Trace Compass", "live migration" ] }, { "paper_id": "high-latency-cause-detection-multilevel-analysis", "title": "High latency cause detection using multilevel dynamic analysis", "year": 2018, "authors": [ "Naser Ezzati-Jivan", "Genevieve Bastien", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/high-latency-cause-detection-multilevel-analysis/", "canonical_source_url": "https://doi.org/10.1109/SYSCON.2018.8369613", "core_contribution": "The paper correlates PHP user-space events with LTTng kernel events in a unified multilevel model to explain high-latency web requests.", "tags": [ "system-tracing", "latency-analysis", "root-cause-analysis", "performance-analysis" ], "keywords": [ "high latency", "dynamic analysis", "multilevel analysis", "latency causes", "LTTng", "LTTng-UST", "Trace Compass", "OPcache contention" ] }, { "paper_id": "declarative-framework-stateful-trace-analysis", "title": "A declarative framework for stateful analysis of execution traces", "year": 2017, "authors": [ "Florian Wininger", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/declarative-framework-stateful-trace-analysis/", "canonical_source_url": "https://doi.org/10.1007/s11219-016-9311-0", "core_contribution": "The framework lets analysts define stateful trace analyses declaratively, using a generic state model and XML specifications that can drive storage, filtering, and visualization across trace formats.", "tags": [ "trace-analysis", "trace-abstraction", "performance-analysis", "system-tracing", "trace-visualization" ], "keywords": [ "declarative trace analysis", "stateful analysis", "execution traces", "LTTng", "ETW", "State History Tree", "XML", "trace filtering", "Gantt chart", "critical-path analysis" ] }, { "paper_id": "hardware-assisted-software-event-tracing", "title": "Hardware-assisted software event tracing", "year": 2017, "authors": [ "Adrien Vergé", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/hardware-assisted-software-event-tracing/", "canonical_source_url": "https://doi.org/10.1002/cpe.4069", "core_contribution": "The paper designs and evaluates hardware-assisted alternatives to LTTng-UST for software-event and execution-path tracing, including STM/ETB, ETM/ETB, and a modified Perf/BTS path.", "tags": [ "system-tracing", "kernel-tracing", "trace-analysis", "performance-engineering" ], "keywords": [ "hardware-assisted tracing", "software events", "event collection", "trace overhead", "ARM CoreSight", "STM", "ETM", "ETB", "Intel BTS", "Perf", "LTTng-UST" ] }, { "paper_id": "multi-scale-navigation-of-large-trace-data-a-survey", "title": "Multi-scale navigation of large trace data: A survey", "year": 2017, "authors": [ "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/multi-scale-navigation-of-large-trace-data-a-survey/", "canonical_source_url": "https://doi.org/10.1002/cpe.4068", "core_contribution": "The survey provides a taxonomy and requirements-oriented comparison of techniques for collecting, abstracting, analyzing, visualizing, and navigating large execution traces.", "tags": [ "trace-visualization", "trace-abstraction", "kernel-tracing", "performance-analysis", "system-tracing" ], "keywords": [ "trace navigation", "multi-scale analysis", "trace visualization", "content abstraction", "metric abstraction", "visual abstraction", "resource abstraction", "semantic zoom", "focus-plus-context", "Trace Compass", "Vampir", "Jumpshot", "SLOG", "R-tree", "quadtree", "State History Tree" ] }, { "paper_id": "multilayer-virtualized-systems-kernel-tracing", "title": "Multilayer Virtualized Systems Analysis with Kernel Tracing", "year": 2016, "authors": [ "Cedric Biancheri", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/multilayer-virtualized-systems-kernel-tracing/", "canonical_source_url": "https://doi.org/10.1109/W-FiCloud.2016.18", "core_contribution": "The paper fuses synchronized host and virtual-machine kernel traces into a Fused Virtual Machine view that exposes how VM threads, virtual CPUs, hypervisor transitions, and physical CPUs interact.", "tags": [ "kernel-tracing", "system-tracing", "performance-analysis", "resource-analysis" ], "keywords": [ "virtualized systems", "kernel tracing", "multilayer analysis", "virtualization overhead", "LTTng", "KVM", "Trace Compass", "Fused Virtual Machine view", "State History Tree", "vmentry", "vmexit" ] }, { "paper_id": "a-flexible-data-driven-approach-for-execution-trace-filtering", "title": "A Flexible Data-Driven Approach for Execution Trace Filtering", "year": 2015, "authors": [ "Kadjo Gwandy Kouame", "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/a-flexible-data-driven-approach-for-execution-trace-filtering/", "canonical_source_url": "https://doi.org/10.1109/BigDataCongress.2015.112", "core_contribution": "The paper provides a declarative XML/state-machine approach for flexible filtering and synthetic-event generation over large kernel traces.", "tags": [ "kernel-tracing", "system-tracing", "trace-filtering", "trace-abstraction", "trace-analysis" ], "keywords": [ "execution trace filtering", "LTTng 2.4.0", "Trace Compass", "finite-state machine", "declarative analysis", "synthetic events", "SYN flood", "hping3", "state system", "XML modeling", "kernel tracing" ] }, { "paper_id": "a-stateful-approach-to-generate-synthetic-events-from-kernel-traces", "title": "A Stateful Approach to Generate Synthetic Events from Kernel Traces", "year": 2012, "authors": [ "Naser Ezzati-Jivan", "Michel R. Dagenais" ], "page_url": "https://threadslab.org/research-publications/papers/a-stateful-approach-to-generate-synthetic-events-from-kernel-traces/", "canonical_source_url": "https://doi.org/10.1155/2012/140368", "core_contribution": "The paper introduces a stateful trace-abstraction method that converts low-level kernel events into semantic and synthetic events using modeled resource state and finite-state patterns.", "tags": [ "kernel-tracing", "system-tracing", "trace-abstraction", "trace-analysis", "performance-analysis" ], "keywords": [ "stateful trace abstraction", "synthetic events", "semantic events", "modeled state", "finite-state machine", "LTTng", "Linux kernel 2.6.38.6", "XML pattern library", "partial trace abstraction", "fork bomb", "SYN flood", "port scanning" ] } ] }