DLA: Detecting and Localizing Anomalies in Containerized Microservice Architectures Using Markov Models Areeg Samir Free University of Bozen-Bolzano, Bolzano, Italy Claus Pahl Free University of Bozen-Bolzano, Bolzano, Italy Abstract—Container-based microservice architectures are emerging as a new approach for building distributed applications as a collection of independent services that works together. As a result, with microservices, we are able to scale and update their applications based on the load attributed to each service. Monitoring and managing the load in a distributed system is a complex task as the degradation of performance within a single service will cascade reducing the performance of other dependent services. Such performance degradations may result in anomalous behaviour observed for instance for the response time of a service. This paper presents a Detection and Local- ization system for Anomalies (DLA) that monitors and analyzes performance-related anomalies in container-based microservice architectures. To evaluate the DLA, an experiment is done using R, Docker and Kubernetes, and different performance metrics are considered. The results show that DLA is able to accurately detect and localize anomalous behaviour. Index Terms—Cloud, Anomaly Detection, Performance, Con- tainer, Microservice, HHMM, Correlation Analysis. I. I NTRODUCTION Microservice architectures structure an application as a collection of services to keep it scalable and reliable [1, 6]. Each service can be considered as an application of its own. Services can communicate with each other by exposing their endpoints for the same service contract in order to provide functionality over different protocols. Microservices introduce multiple benefits like high availability, better flexibility, fast responsiveness, and scalability. To support microservices, it is beneficial having a light-weight deployment mechanism using small independently deployable services. Those requirements can be achieved by utilizing the container technology. Containers [3] isolate microservices into smaller instances that utilize only the required operating system and platform components, thus making them lightweight [15, 22]. However, microservices may face several challenges. One of these challenges is changing a service workload in a composed microservice may increase the system load as changes in one service may influence the workload of other dependent services, and may result in response time degradation that would be considered as anomalous. These variations may lead to violations of Service Level Agreements (SLAs) between providers and users. In such a case, anomaly detection and localization can help in capturing and tracking the anomalous behaviour that deviates from the normal behaviour [11]. To be able to detect and localize the anomalous behaviour, there are plentiful metrics at node, container, service, and application levels. In this paper, we propose a Detection and Localization systems for Anomalies (DLA) that detects and locates the anomalous behaviour of microservices based on the observed response time. The DLA tries to detect the variation in response time, and correlates it to the respective component (microservice, container, service), which shows anomalous behaviour. To validate the DLA, evaluation based on analyz- ing a dataset extracted from microservice based container is discussed in Section VI. The experiment shows that DLA can detect and locate the anomalous behaviour with an accuracy percentage of more than 97%. The paper is organized as follows: a background is given in Section II. An overview of the literature studies is explained in Section III. Adjusting our model to reflect our system topology is addressed in Section IV. An overview of the proposed work (DLA) is presented in Section V. An evaluation is presented in Section VI. Conclusions are made in Section VII. II. BACKGROUND Containers are isolated workload environments in a virtual- ized operating system such as cloud. They are used to allocate computing resources, help to organize, migrate and develop microservices [8, 9, 12]. Microservice architectures are an approach to develop a single application that is composed of small services, each of which is in a container and runs its own process. Mi- croservices are communicating with lightweight mechanisms, often an HTTP resource API. They enable continuous de- livery/deployment of large complex applications as they are deployed as individual containers within a containerized archi- tecture so they can be scaled up or down by adding or remov- ing instances. However, there are some characteristics [2] of microservices, which complicate its performance monitoring. One of such characteristics is monitoring and deployment. To guarantee the performance of container-based microservice application, a coherent analysis of the performance metrics across microservices, containers, and nodes monitored re- sources is required. However, variations and uncertainties of performance metrics across different microservices, con- tainers and nodes resources complicate the assessment of microservice performance. If the anomalous measurements are