Modeling Behavior Patterns in Microservice Applications

Abstract

Over the past decade, the microservice architectural style has gained immense popularity among software companies. Many adopt this architectural style to develop their web services due to its improved maintainability, reliability, and agility. These benefits enable companies to quickly develop and deploy their web services iteratively.

Despite its advantages, microservices are notoriously known to be difficult to debug when software failures occur. Developers often struggle to identify the underlying cause of a failure due to the distributed nature of microservices. In fact, certain software failures only emerge when complex interconnected interactions are triggered between microservices. Therefore, it is becoming increasingly important to develop monitoring tools to streamline the process of determining the underlying cause of problems detected within microservices.

The AssureMOSS project, part of the EU Horizon 2020 Research Program, focuses on
delivering various tools or approaches to enhance security at various phases of the microservice development life-cycle. This dissertation, conducted as part of the AssureMOSS project, primarily investigates runtime monitoring of microservices to detect anomalies such as cyber-attacks and discrepancies between observed behaviors and the intended behaviors specified in the source code.

A key project requirement is using lightweight interpretable machine learning models to aid the understanding of detected software failures. State machines, also known
as Finite State Automata, have proven to be practical models for modeling behaviors of various software systems. Furthermore, these models are considered to be inherently interpretable as one can visualize the behaviors exhibited by a system. For this reason, state machines are a suitable choice for monitoring microservice applications. This dissertation explores how state machines can be applied to address challenges across various phases of the microservices development life-cycle.

Part I explores how state machines can be utilized to monitor the runtime of microservices for anomalies. In particular, the studies conducted in Part I focus on detecting network anomalies, such as network attacks, within microservice applications. Part I first introduces ENCODE in Chapter 2, an encoding algorithm designed to preprocess NetFlow records, making them suitable for learning state machine models. Chapter 3 demonstrates how state machines can be learned from NetFlow data collected from microservices and evaluate their effectiveness in detecting various network attacks targeting microservices deployed in a Kubernetes cluster. Finally, Chapter 4 introduces SEQUENT, a novel anomaly detection approach that dynamically uses state visit frequencies to compute anomaly scores for behaviors observed at test time. SEQUENT addresses several limitations within the approach employed in Chapter 3, offering practical applications such as ranking and clustering alerts to understand detected anomalies better. Results suggest that SEQUENT achieved considerably better performance than the approach presented in Chapter 3.

Part II of this dissertation explores how state machines can detect discrepancies (non-
conformances) between the observed runtime behaviors of microservices and the intended behaviors specified in the source code. Chapter 5 introduces CATMA, a lightweight tool for conducting conformance analysis on microservices applications. CATMA uses state machines to capture observed behaviors and compares them against insights derived from Dataflow Diagrams, representing the intended behaviors specified in the source code. This comparison reveals any non-conformances, and CATMA provides human-readable explanations for these non-conformances to aid developers with identifying potential starting points to debug their microservices applications. CATMA’s pilot study shows promising performance results and provides valuable insights to developers. Additionally, CATMA made a small impact in the open-source software community by identifying and fixing a
non-conformance detected in an open-source project.

Finally, Part III of this dissertation explores how state machines can guide an Evolutionary Algorithm in the automated generation of test cases for the REST APIs of microservices. Chapter 6 introduces MISH, a search heuristic that continuously learns a state machine model from log statements from microservices. These models are then used to generate more effective system-level test cases. MISH extracts various insights from the state machine to compute the fitness of test cases, which the Evolutionary Algorithm uses to generate better test cases. MISH demonstrates promising results in using state machines to guide an evolutionary algorithm toward generating more effective test cases, even outperforming a state-of-the-art search algorithm, MOSA, in specific scenarios. Additionally, a preliminary study suggests that integrating MISH as a part of MOSA could enhance the quality of system-level tests, creating an interesting future research direction.

This dissertation demonstrates the effectiveness of state machines in modeling the behavioral patterns of microservices across various practical applications, including monitoring, validation, and testing. Consequently, multiple toolchains and algorithms were developed to evaluate the models’ efficacy and to facilitate the use of state machines in representing the behavioral patterns of software systems.