Anomaly detection in computer systems operating within complex environments,such as cyber-physical systems (CPS), has become increasingly popularduring these last years due to useful insights this process can provide aboutcomputer systems’ health conditions against known reference nominal states.As performance anomalies lead degraded service delivery, and, eventually,system-wide failures, promptly detecting such anomalies may trigger timelyrecovery responses. In this thesis, Process Mining, a discipline aiming at connectingdata science with process science, is broadly explored and employedfor detecting performance anomalies in complex computer systems, proposinga methodology for connecting event data to high-level process models forvalidating functional and non-functional requirements, evaluating system performances,and detecting anomalies. The proposed methodology is appliedto the industry-relevant European Rail Traffic Management System/EuropeanTrain Control System (ERTMS/ETCS) case-study. Experimental results sampledfrom an ERTMS/ETCS system Demonstrator implementing one of thescenarios the standard prescribe have shown Process Mining allows characterizingnominal system performances and detect deviations from such nominalconditions, opening the opportunity to apply recovery routines for steeringsystem performances to acceptable levels.

Cloud datacenters comprise hundreds or thousands of disparate application services, each having stringent performance and availability requirements, sharing a finite set of heterogeneous hardware and software resources. The implication of such complex environment is that the occurrence of performance problems, such as slow application response and unplanned downtimes, has become a norm rather than exception resulting in decreased revenue, damaged reputation, and huge human-effort in diagnosis. Though causes can be as varied as application issues (e.g. bugs), machine-level failures (e.g. faulty server), and operator errors (e.g. mis-configurations), recent studies have attributed capacity-related issues, such as resource shortage and contention, as the cause of most performance problems on the Internet today. As cloud datacenters become increasingly autonomous there is need for automated performance diagnosis systems that can adapt their operation to reflect the changing workload and topology in the infrastructure. In particular, such systems should be able to detect anomalous performance events, uncover manifestations of capacity bottlenecks, localize actual root-cause(s), and possibly suggest or actuate corrections. This thesis investigates approaches for diagnosing performance problems in cloud infrastructures. We present the outcome of an extensive survey of existing research contributions addressing performance diagnosis in diverse systems domains. We also present models and algorithms for detecting anomalies in real-time application performance and identification of anomalous datacenter resources based on operational metrics and spatial dependency across datacenter components. Empirical evaluations of our approaches shows how they can be used to improve end-user experience, service assurance and support root-cause analysis. / Cloud Control (C0590801)