EARLY WARNING OF CRITICAL INFORMATION SYSTEM STATES FROM SHORT SEQUENCES

Abstract

The reliability of modern information systems largely depends on the timely detection of changes that may lead to performance degradation, violation of established response-time requirements, and service unavailability. Conventional monitoring tools primarily register the exceedance of predefined thresholds but do not always make it possible to recognize the preceding development of an adverse trend and distinguish it from a short-term deviation. The objective of this study is to develop an approach to the early warning of critical information system states based on the sequential aggregation of structural estimates obtained from short monitoring-data sequences. The article proposes a procedure for normalizing heterogeneous indicators, forming binary sequences within sliding time windows, and calculating local structural estimates that characterize the frequency, fragmentation, and persistence of adverse observations. To detect developing degradation, the local estimates are sequentially aggregated with consideration of the current deviation level, trend, accumulation, duration, and variability. Based on the resulting aggregated estimate, information-response rules are developed using activation thresholds, confirmation intervals, and hysteresis during system recovery. The proposed approach distinguishes stable operation, an isolated deviation, gradually developing degradation, and a persistent critical state. A simulation-based evaluation was conducted for the corresponding server-infrastructure workload scenarios. The results showed that the sequential aggregation of structural estimates enables persistent adverse changes to be detected before established quality-of-service requirements are violated while limiting responses to isolated short-term fluctuations. Comparison with conventional threshold-based monitoring confirmed the possibility of providing a time interval for preventive actions, including resource scaling, workload redistribution, and restriction of noncritical requests. The proposed procedure can be integrated into information technologies for monitoring server, distributed, and cloud systems and used to support decision-making aimed at preventing critical operating conditions.