Réduction a la volée du volume des traces d' exécution pour l'analyse d'applications multimédia de systemes embarqués

摘要

The consumer electronics market is dominated by embedded systems due to their ever-increasing processingpower and the large number of functionnalities they offer. To provide such features, architectures of embedded systems have increased in complexity : they rely on several heterogeneous processing units, and allowconcurrent tasks execution. This complexity degrades the programmability of embedded system architectures and makes application execution difficult to understand on such systems. The most used approachfor analyzing application execution on embedded systems consists in capturing execution traces (event sequences, such as system call invocations or context switch, generated during application execution). This approach is used in application testing, debugging or profiling. However in some use cases, execution traces generated can be very large, up to several hundreds of gigabytes. For example endurance tests, which are tests consisting in tracing execution of an application on an embedded system during long periods, from several hours to several days. Current tools and methods for analyzing execution traces are not designed to handle such amounts of data.We propose an approach for monitoring an application execution by analyzing traces on the fly in order toreduce the volume of recorded trace. Our approach is based on features of multimedia applications whichcontribute the most to the success of popular devices such as set-top boxes or smartphones. This approachconsists in identifying automatically the suspicious periods of an application execution in order to recordonly the parts of traces which correspond to these periods. The proposed approach consists of two steps : a learning step which discovers regular behaviors of an application from its execution trace, and an anomalydetection step which identifies behaviors deviating from the regular ones.The many experiments, performed on synthetic and real-life datasets, show that our approach reduces thetrace size by an order of magnitude while maintaining a good performance in detecting suspicious behaviors.