The dynamic fluctuation of workload influences system metrics, affects the precision of anomaly detection. This paper proposes an online anomaly detection approach for Web applications, which handles workload fluctuation in both request pattern and volume. The study proposes an incremental clustering algorithm to recognize online workload patterns automatically. For a specific workload pattern, the study adopts local outlier factor to detect anomaly and qualify the anomaly degree, and then locate the abnormal metrics with a student's t-test method. The experimental results show that the clustering algorithm can accurately capture workload fluctuations in a typical Web application, and demonstrate that the approach is capable of not only detecting the typical faults in Web applications, but also locating the abnormal metrics.
