TraLogAnomaly: A microservice system anomaly detection approach based on hybrid event sequences

Abstract

Microservice architecture has been increasingly adopted to develop various distributed systems due to, amongst other things, its flexibility and scalability. A microservice system often involves numerous invocations among services, making it vulnerable to potential anomalies such as improper configurations of services and improper coordination among services. Existing anomaly detection techniques either identify inter-service anomalies by constructing distributed traces or identify intra-service anomalies by mining features from system logs. However, the intra-service and inter-service behaviors may couple with each other, leading to complex anomalies that may escape detection through the individual examination of traces or logs. In this paper, we propose TraLogAnomaly, an approach for microservice-system anomaly detection. TraLogAnomaly proposes hybrid event vector sequences (HVSs) integrating both inter-service traces and intra-service logs and then identifies the anomalies' patterns from these HVSs. It extracts the patterns of anomalies with the help of a Transformer model. Term frequency-inverse document frequency (TF-IDF) is applied to weighted features learned from hybrid sequences. By integrating information from diverse data sources, the HVSs enhance the ability of these patterns to capture complex system behavior, cover multiple layers of system information, and have higher context-awareness. In addition, TraLogAnomaly also integrates a module that employs agglomeration hierarchical clustering to mine trace patterns of performance anomalies. Empirical results based on widely-used benchmarks show that TraLogAnomaly achieves a high F1-score for detecting anomalies of different types.