  Monitoring often requires insight into the monitored system as well as
concrete specifications of expected behavior. More and more systems, however,
provide information about their inner procedures by emitting provenance
information in a W3C-standardized graph format.
  In this work, we present an approach to monitor such provenance data for
anomalous behavior by performing spectral graph analysis on slices of the
constructed provenance graph and by comparing the characteristics of each slice
with those of a sliding window over recently seen slices. We argue that this
approach not only simplifies the monitoring of heterogeneous distributed
systems, but also enables applying a host of well-studied techniques to monitor
such systems.
