Trace Anomaly Detection for Microservice Systems via Graph-based Semi-supervised Learning

Microservice architectures have become mainstream for cloud-native applications, and distributed tracing is widely used to ensure system observability. Trace is essentially an aggregated data with multimodal attributes (e.g., performance metric, invocation log, and topology relationships). Existing methods typically do not adequately consider the complex correlations and interactions between the different modalities of trace, whereas fusing multimodal data into a unified analysis provide the possibility to improve performance. On the other hand, most of the existing methods are trained in an unsupervised manner and cannot utilize historical data. Therefore, this article proposes a trace anomaly detection method using graph-based semi-supervised learning, TraceGSAD. It extracts features of trace from multiple modalities and train an improved message-passing neural network to fuse features for unified modeling and generate a graph-level representation. The end-to-end deep anomaly detection model trained in an semi-supervised manner, using only a small amount of labeled data to achieve superior performance. The evaluation on the microservice benchmarks show that TraceGSAD achieves a high precision, outperforming state-of-the-art trace anomaly detection approaches. It also demonstrates the effectiveness of multimodal fusion analysis as well as the use of empirical data in semi-supervised learning that can significantly improve anomaly detection performance.