We present FRAPpuccino (or FRAP), a provenance- based fault detection mechanism for Platform as a Ser- vice (PaaS) users, who run many instances of an appli- cation on a large cluster of machines. FRAP models, records, and analyzes the behavior of an application and its impact on the system as a directed acyclic provenance graph. It assumes that most instances behave normally and uses their behavior to construct a model of legitimate behavior. Given a model of legitimate behavior, FRAP uses a dynamic sliding window algorithm to compare a new instance’s execution to that of the model. Any in- stance that does not conform to the model is identified as an anomaly. We present the FRAP prototype and ex- perimental results showing that it can accurately detect application anomalies.
