关键词: 异常检测, 孤立森林算法, Docker容器, 特征加权选择, 日志异常检测

Abstract: With the problems of anomaly detection for poor accuracy, high resource consumption, and high time complexity of the isolation forest (iForest) algorithm, this paper proposed a novel DiForest algorithm which applies the featureweighted selection and the standard deviation of the isolation tree path lengths for anomaly detection of Docker container. The experiment simulates four types, CPU, memory, disk IO, and URL access overruns. The experimental results show that DiForest algorithm performs anomaly detection. The average running memory in the container is 30.6 MB, which is about 6.67% smaller than the average running memory of iForest algorithm for anomaly detection. The network throughput for DiForest algorithm is 110Mbps, which is about 13.3% higher than the network throughput for iForest algorithm. Meanwhile, the log anomaly detection experiments for URL access overruns show that the DiForest algorithm accesses requests with a success rate of 82.9%. It is 31.8% higher than the success rate of the iForest algorithm in the state of handling URL access overruns. Therefore, DiForest algorithm not only reduces the resource consumption when the container is abnormal, but also improves the accuracy of abnormality log detection.

Key words: anomaly detection, isolation forest algorithm, Docker container, featureweighted selection, log anomaly detection