@article{he_yeh_wu_wang_zhang_2021, title={Mining Anomalies in Subspaces of High-Dimensional Time Series for Financial Transactional Data}, volume={12978}, ISBN={["978-3-030-86513-9"]}, ISSN={["1611-3349"]}, DOI={10.1007/978-3-030-86514-6_2}, abstractNote={Anomaly detection for high-dimensional time series is always a difficult problem due to its vast search space. For general high-dimensional data, the anomalies often manifest in subspaces rather than the whole data space, and it requires an \(O(2^N)\) combinatorial search for finding the exact solution (i.e., the anomalous subspaces) where N denotes the number of dimensions. In this paper, we present a novel and practical unsupervised anomaly retrieval system to retrieve anomalies from a large volume of high dimensional transactional time series. Our system consists of two integrated modules: subspace searching module and time series discord mining module. For the subspace searching module, we propose two approximate searching methods which are capable of finding quality anomalous subspaces orders of magnitudes faster than the brute-force solution. For the discord mining module, we adopt a simple, yet effective nearest neighbor method. The proposed system is implemented and evaluated on both synthetic and real-world transactional data. The results indicate that our anomaly retrieval system can localize high quality anomaly candidates in seconds, making it practical to use in a production environment.}, journal={MACHINE LEARNING AND KNOWLEDGE DISCOVERY IN DATABASES, ECML PKDD 2021: APPLIED DATA SCIENCE TRACK, PT IV}, author={He, Jingzhu and Yeh, Chin-Chia Michael and Wu, Yanhong and Wang, Liang and Zhang, Wei}, year={2021}, pages={19–36} }
 @article{tunde-onadele_lin_he_gu_2020, title={Self-Patch: Beyond Patch Tuesday for Containerized Applications}, DOI={10.1109/ACSOS49614.2020.00022}, abstractNote={Containers have become increasingly popular in distributed computing environments. However, recent studies have shown that containerized applications are susceptible to various security attacks. Traditional periodically scheduled software update approaches not only become ineffective under dynamic container environments but also impose high overhead to containers. In this paper, we present Self-Patch, a new self-triggering patching framework for applications running inside containers. Self-Patch combines light-weight runtime attack detection and dynamic targeted patching to achieve more efficient and effective security protection for containerized applications. We evaluated our schemes over 31 real world vulnerability attacks in 23 commonly used server applications. Results show that Self-Patch can accurately detect and classify 81% of attacks and reduce patching overhead by up to 84%.}, journal={2020 IEEE INTERNATIONAL CONFERENCE ON AUTONOMIC COMPUTING AND SELF-ORGANIZING SYSTEMS (ACSOS 2020)}, author={Tunde-Onadele, Olufogorehan and Lin, Yuhang and He, Jingzhu and Gu, Xiaohui}, year={2020}, pages={21–27} }
 @article{tunde-onadele_he_dai_gu_2019, title={A Study on Container Vulnerability Exploit Detection}, ISSN={["2373-3845"]}, DOI={10.1109/IC2E.2019.00026}, abstractNote={Containers have become increasingly popular for deploying applications in cloud computing infrastructures. However, recent studies have shown that containers are prone to various security attacks. In this paper, we conduct a study on the effectiveness of various vulnerability detection schemes for containers. Specifically, we implement and evaluate a set of static and dynamic vulnerability attack detection schemes using 28 real world vulnerability exploits that widely exist in docker images. Our results show that the static vulnerability scanning scheme only detects 3 out of 28 tested vulnerabilities and dynamic anomaly detection schemes detect 22 vulnerability exploits. Combining static and dynamic schemes can further improve the detection rate to 86% (i.e., 24 out of 28 exploits). We also observe that the dynamic anomaly detection scheme can achieve more than 20 seconds lead time (i.e., a time window before attacks succeed) for a group of commonly seen attacks in containers that try to gain a shell and execute arbitrary code.}, journal={2019 IEEE INTERNATIONAL CONFERENCE ON CLOUD ENGINEERING (IC2E)}, author={Tunde-Onadele, Olufogorehan and He, Jingzhu and Dai, Ting and Gu, Xiaohui}, year={2019}, pages={121–127} }
 @article{he_dai_gu_2019, title={TFix: Automatic Timeout Bug Fixing in Production Server Systems}, ISSN={["1063-6927"]}, DOI={10.1109/ICDCS.2019.00067}, abstractNote={Timeout is widely used to handle unexpected failures in distributed systems. However, improper use of timeout schemes can cause serious availability and performance issues, which is often difficult to fix due to lack of diagnostic information. In this paper, we present TFix, an automatic timeout bug fixing system for correcting misused timeout bugs in production systems. TFix adopts a drill-down bug analysis protocol that can narrow down the root cause of a misused timeout bug and producing recommendations for correcting the root cause. TFix first employs a system call frequent episode mining scheme to check whether a timeout bug is caused by a misused timeout variable. TFix then employs application tracing to identify timeout affected functions. Next, TFix uses taint analysis to localize the misused timeout variable. Last, TFix produces recommendations for proper timeout variable values based on the tracing results during normal runs. We have implemented a prototype of TFix and conducted extensive experiments using 13 real world server timeout bugs. Our experimental results show that TFix can correctly localize the misused timeout variables and suggest proper timeout values for fixing those bugs.}, journal={2019 39TH IEEE INTERNATIONAL CONFERENCE ON DISTRIBUTED COMPUTING SYSTEMS (ICDCS 2019)}, author={He, Jingzhu and Dai, Ting and Gu, Xiaohui}, year={2019}, pages={612–623} }
 @article{dai_he_gu_lu_wang_2018, title={DScope: Detecting Real-World Data Corruption Hang Bugs in Cloud Server Systems}, DOI={10.1145/3267809.3267844}, abstractNote={Cloud server systems such as Hadoop and Cassandra have enabled many real-world data-intensive applications running inside computing clouds. However, those systems present many data-corruption and performance problems which are notoriously difficult to debug due to the lack of diagnosis information. In this paper, we present DScope, a tool that statically detects data-corruption related software hang bugs in cloud server systems. DScope statically analyzes I/O operations and loops in a software package, and identifies loops whose exit conditions can be affected by I/O operations through returned data, returned error code, or I/O exception handling. After identifying those loops which are prone to hang problems under data corruption, DScope conducts loop bound and loop stride analysis to prune out false positives. We have implemented DScope and evaluated it using 9 common cloud server systems. Our results show that DScope can detect 42 real software hang bugs including 29 newly discovered software hang bugs. In contrast, existing bug detection tools miss detecting most of those bugs.}, journal={PROCEEDINGS OF THE 2018 ACM SYMPOSIUM ON CLOUD COMPUTING (SOCC '18)}, author={Dai, Ting and He, Jingzhu and Gu, Xiaohui and Lu, Shan and Wang, Peipei}, year={2018}, pages={313–325} }
 @article{he_dai_gu_2018, title={TScope: Automatic Timeout Bug Identification for Server Systems}, ISSN={["2474-0756"]}, DOI={10.1109/ICAC.2018.00010}, abstractNote={Timeout is commonly used to handle unexpected failures in server systems. However, improper use of timeout can cause server systems to hang or experience performance degradation. In this paper, we present TScope, an automatic timeout bug identification tool for server systems. TScope leverages kernel-level system call tracing and machine learning based anomaly detection and feature extraction schemes to achieve timeout bug identification. TScope introduces a unique system call selection scheme to achieve higher accuracy than existing generic performance bug detection tools. We have implemented a prototype of TScope and conducted extensive experiments using 19 real-world server performance bugs, including 12 timeout bugs and 7 non-timeout performance bugs. The experimental results show that TScope correctly classifies 18 out of 19 bugs. Compared to existing runtime bug detection schemes, TScope reduces the average false positive rate from 47.24% to 0.8%. TScope is light-weight and does not require application instrumentation, which makes it practical for production server performance bug identification.}, journal={15TH IEEE INTERNATIONAL CONFERENCE ON AUTONOMIC COMPUTING (ICAC 2018)}, author={He, Jingzhu and Dai, Ting and Gu, Xiaohui}, year={2018}, pages={1–10} }