Abstract: Anomaly detection, as a crucial component for ensuring the health and performance of microservice systems, has become a hot topic in the field of intelligent operations and maintenance. However, existing anomaly detection methods face three significant challenges: (1) Insufficient correlation analysis of heterogeneous monitoring data, such as indexes, logs, and call chains, in microservice systems leads to false negatives. (2) Inadequate mining of spatiotemporal features of heterogeneous data results in false positives. (3) Anomaly detection results fail to comprehensively characterize the state of microservice systems, lacking interpretability. To address these issues, a multimodal spatiotemporal enhanced anomaly detection framework (STEAD) is proposed. The framework effectively unifies the representation of heterogeneous multimodal data generated by microservice systems. A cross-modal attention module is introduced to precisely extract correlations between different data modalities. The correlated data are fed into a spatiotemporal enhanced network, which leverages its powerful spatiotemporal recursive encoding capabilities to deeply mine spatiotemporal features in the data. The encoded results are mapped to a latent space through a variational autoencoder to learn the feature distribution, and anomalies are detected by comparing the differences between the decoded reconstruction results and the original inputs. Extensive experimental results demonstrate that STEAD achieves an average improvement of 7.76%~39.43% in the F1-score compared with existing methods. Moreover, compared with multimodal methods, STEAD reduces model training time by approximately 80%.

Key words: anomaly detection, microservice, spatiotemporal enhancement, multimodality

摘要： 异常检测作为确保微服务系统健康和性能的关键环节，已经成为智能运维领域的一个热点问题。然而现有异常检测方法存在三个重要问题：（1）微服务系统中收集的指标、日志和调用链等异构监测数据的关联分析不足，导致假阴性。（2）对异构数据时空特征挖掘不充分，导致假阳性。（3）异常检测结果无法综合表征微服务系统状态，缺乏可解释性。为了克服这些问题，提出一种多模态时空增强异常检测框架（STEAD）。对微服务系统中产生的异构多模态数据进行有效的统一表征处理；通过引入跨模态注意力模块，能够精确提取出不同数据模态之间的相关性；将经过关联处理的数据输入到时空增强网络中，利用该网络强大的时空递归编码能力，深入挖掘数据中的时空特征；将编码结果通过变分自编码器映射到潜在空间学习特征分布，通过对比解码重构的结果与输入的差异实现异常检测。实验结果证明STEAD在F1-score指标上相较于现有方法平均提升了7.76%~39.43%，与多模态方法相比，STEAD将模型训练时间缩短了约80%。

关键词: 异常检测, 微服务, 时空增强, 多模态