From Load Tests to Live Streams: Graph Embedding-Based Anomaly Detection in Microservice Architectures

• URL: http://arxiv.org/abs/2604.06448v2
• Date: Tue, 14 Apr 2026 18:05:15 GMT
• Title: From Load Tests to Live Streams: Graph Embedding-Based Anomaly Detection in Microservice Architectures
• Abstract summary: Prime Video regularly conducts load tests to simulate viewer traffic spikes during live events such as Thursday Night Football.<n>While these stress tests validate system capacity, they can sometimes miss service behaviors unique to real event traffic.<n>We present a graph-based anomaly detection system that identifies under-represented services using unsupervised node-level graph embeddings.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Prime Video regularly conducts load tests to simulate the viewer traffic spikes seen during live events such as Thursday Night Football as well as video-on-demand (VOD) events such as Rings of Power. While these stress tests validate system capacity, they can sometimes miss service behaviors unique to real event traffic. We present a graph-based anomaly detection system that identifies under-represented services using unsupervised node-level graph embeddings. Built on a GCN-GAE, our approach learns structural representations from directed, weighted service graphs at minute-level resolution and flags anomalies based on cosine similarity between load test and event embeddings. The system identifies incident-related services that are documented and demonstrates early detection capability. We also introduce a preliminary synthetic anomaly injection framework for controlled evaluation that show promising precision (96%) and low false positive rate (0.08%), though recall (58%) remains limited under conservative propagation assumptions. This framework demonstrates practical utility within Prime Video while also surfacing methodological lessons and directions, providing a foundation for broader application across microservice ecosystems.

Related papers

• Can Graph-Based Microservice Performance Detection Be Used for Microservice Intrusion Detection? [0.0]
  This paper asks whether graph-based microservice performance detection can also serve as a foundation for microservice intrusion detection.<n>We deploy a Docker Compose based synthetic e-commerce microservice benchmark, run 50 controlled trials across five attack types under normal workloads, and collect metrics, logs, and distributed traces.<n>We train a two-layer graph convolutional network for 6-way classification over 21,438 request graphs. The model 96.2% test accuracy with a macro F1 of 0.955 under a graph-level random split.
  arXiv  Detail & Related papers  (2026-05-22T23:30:38Z)
• NeuroTrace: Inference Provenance-Based Detection of Adversarial Examples [1.096626056612224]
  We introduce NeuroTrace, a framework for analyzing inference provenance through Inference Provenance Graphs (IPGs)<n>IPGs are heterogeneous graphs that capture both activation behavior and parameter-induced dataflow during a model's forward pass.<n>We evaluate IPG-based detectors for adversarial example detection under intra-attack, multi-attack, and cross-threat transfer settings.
  arXiv  Detail & Related papers  (2026-04-15T22:23:40Z)
• PROVEX: Enhancing SOC Analyst Trust with Explainable Provenance-Based IDS [1.9336815376402718]
  This paper presents a comprehensive XAI framework designed to bridge the trust gap in Security Operations Centers (SOCs) by making graph-based detection transparent.<n>We implement this framework on top of KAIROS, a state-of-the-art temporal graph-based IDS, though our design is applicable to any temporal graph-based detector with minimal adaptation.
  arXiv  Detail & Related papers  (2025-12-20T03:45:21Z)
• GraphFaaS: Serverless GNN Inference for Burst-Resilient, Real-Time Intrusion Detection [13.23114511657902]
  Provenance-based intrusion detection is an increasingly popular application of graphical machine learning in cybersecurity.<n>Traditional statically-provisioned Graph Networks (GNNs) fall short in meeting two crucial demands of intrusion detection.<n>We present GraphF, a serverless architecture tailored for GNN-based intrusion detection.
  arXiv  Detail & Related papers  (2025-11-13T17:55:06Z)
• BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services [7.024862094862467]
  BLADE is a novel unsupervised traffic anomaly detection system for web services.<n> BLADE exploits a flow autoencoder to learn a latent feature representation and calculates its reconstruction losses per flow.<n> BLADE is extensively evaluated on both the custom dataset and the CIC-IDS 2017 dataset.
  arXiv  Detail & Related papers  (2025-11-07T12:25:39Z)
• Graph Neural Networks Are More Than Filters: Revisiting and Benchmarking from A Spectral Perspective [49.613774305350084]
  Graph Neural Networks (GNNs) have achieved remarkable success in various graph-based learning tasks.<n>Recent studies suggest that other components such as non-linear layers may also significantly affect how GNNs process the input graph data in the spectral domain.<n>This paper introduces a comprehensive benchmark to measure and evaluate GNNs' capability in capturing and leveraging the information encoded in different frequency components of the input graph data.
  arXiv  Detail & Related papers  (2024-12-10T04:53:53Z)
• Weakly Supervised Video Anomaly Detection and Localization with Spatio-Temporal Prompts [57.01985221057047]
  This paper introduces a novel method that learnstemporal prompt embeddings for weakly supervised video anomaly detection and localization (WSVADL) based on pre-trained vision-language models (VLMs) Our method achieves state-of-theart performance on three public benchmarks for the WSVADL task.
  arXiv  Detail & Related papers  (2024-08-12T03:31:29Z)
• Multitask Active Learning for Graph Anomaly Detection [48.690169078479116]
  We propose a novel MultItask acTIve Graph Anomaly deTEction framework, namely MITIGATE. By coupling node classification tasks, MITIGATE obtains the capability to detect out-of-distribution nodes without known anomalies. Empirical studies on four datasets demonstrate that MITIGATE significantly outperforms the state-of-the-art methods for anomaly detection.
  arXiv  Detail & Related papers  (2024-01-24T03:43:45Z)
• A Temporal Graph Neural Network for Cyber Attack Detection and Localization in Smart Grids [0.3093890460224435]
  This paper presents a Temporal Graph Neural Network (TGNN) framework for detection and localization of false data injection and ramp attacks on the system state in smart grids. The sensitivity of the model to intensity and location of the attacks and model's detection delay versus detection accuracy have been evaluated.
  arXiv  Detail & Related papers  (2022-12-07T00:56:02Z)
• Robust Unsupervised Video Anomaly Detection by Multi-Path Frame Prediction [61.17654438176999]
  We propose a novel and robust unsupervised video anomaly detection method by frame prediction with proper design. Our proposed method obtains the frame-level AUROC score of 88.3% on the CUHK Avenue dataset.
  arXiv  Detail & Related papers  (2020-11-05T11:34:12Z)
• A Background-Agnostic Framework with Adversarial Training for Abnormal Event Detection in Video [120.18562044084678]
  Abnormal event detection in video is a complex computer vision problem that has attracted significant attention in recent years. We propose a background-agnostic framework that learns from training videos containing only normal events.
  arXiv  Detail & Related papers  (2020-08-27T18:39:24Z)
• A Self-Reasoning Framework for Anomaly Detection Using Video-Level Labels [17.615297975503648]
  Alous event detection in surveillance videos is a challenging and practical research problem among image and video processing community. We propose a weakly supervised anomaly detection framework based on deep neural networks which is trained in a self-reasoning fashion using only video-level labels. The proposed framework has been evaluated on publicly available real-world anomaly detection datasets including UCF-crime, ShanghaiTech and Ped2.
  arXiv  Detail & Related papers  (2020-08-27T02:14:15Z)
• Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs [54.13919050090926]
  We propose an end-to-end structural temporal Graph Neural Network model for detecting anomalous edges in dynamic graphs. In particular, we first extract the $h$-hop enclosing subgraph centered on the target edge and propose the node labeling function to identify the role of each node in the subgraph. Based on the extracted features, we utilize Gated recurrent units (GRUs) to capture the temporal information for anomaly detection.
  arXiv  Detail & Related papers  (2020-05-15T09:17:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.