Time-Series-Based Self-Healing Architecture for Incident Management in Infrastructure-as-Code

Abstract

: This paper presents a closed-loop self-healing architecture for incident management in Infrastructure-as-Code (IaC) environments, structured as an instantiation of the MAPE–K (Monitor–Analyze–Plan–Execute over Knowledge) pattern. The main contribution is an architecture that connects runtime monitoring, time-series-based anomaly analysis, remediation planning, and IaC-based execution into a codified and auditable feedback loop. We first analyze a catalog of 20 IaC incident-management rules to identify which incident types exhibit temporal behavior and may therefore benefit from time-series-based analysis. We then instantiate the architecture for one controlled SSH-related anomaly scenario, where Moving Average (MA) and ARIMA are used as lightweight statistical detectors and Ansible playbooks are used to trigger a temporary ban/unban remediation action. The results provide proof-of-concept evidence that time-series anomaly signals can be linked to codified IaC remediation within a complete detection-to-remediation loop.