Anomaly detection in containerized virtual environments using a process mining approach

Abstract

The growing adoption of container-based virtual environments in cloud computing introduces new challenges in anomaly detection due to the systems’ dynamic nature. Traditional monitoring approaches often fail to capture inefficiencies or security risks effectively. This study proposes a process mining approach to identify anomalies by analyzing event logs from containerized systems. Event data from the AIOps challenge 2020 was converted into extensible event stream (XES) format and processed using the inductive visual miner in the ProM tool to generate Petri Net models, accurately visualizing container activity flows. A conformance checking analysis was conducted to evaluate the alignment between modeled and actual behavior. Results demonstrated a high fitness score, confirming the model’s precision in reflecting true operational processes and its ability to reveal minor deviations indicative of potential anomalies. These findings highlight process mining as a promising method to enhance security, transparency, and performance monitoring in virtual environments. The research also recommends integrating process mining with real-time monitoring systems for proactive anomaly detection, thereby improving responsiveness and resilience in cloud-based infrastructures.