Can Graph-Based Microservice Performance Detection Be Used for Microservice Intrusion Detection?

• URL: http://arxiv.org/abs/2605.24283v1
• Date: Fri, 22 May 2026 23:30:38 GMT
• Title: Can Graph-Based Microservice Performance Detection Be Used for Microservice Intrusion Detection?
• Abstract summary: This paper asks whether graph-based microservice performance detection can also serve as a foundation for microservice intrusion detection.<n>We deploy a Docker Compose based synthetic e-commerce microservice benchmark, run 50 controlled trials across five attack types under normal workloads, and collect metrics, logs, and distributed traces.<n>We train a two-layer graph convolutional network for 6-way classification over 21,438 request graphs. The model 96.2% test accuracy with a macro F1 of 0.955 under a graph-level random split.
• Score: 0.0
• License: http://creativecommons.org/publicdomain/zero/1.0/
• Abstract: Microservice systems expose rich telemetry streams, including metrics, logs, and distributed traces. Existing performance anomaly detection methods increasingly model these systems as graphs, where nodes represent services and edges represent runtime dependencies. This paper asks whether graph-based microservice performance detection can also serve as a foundation for microservice intrusion detection. We deploy a Docker Compose based synthetic e-commerce microservice benchmark, run 50 controlled trials across five attack types under normal workloads, and collect metrics, logs, and distributed traces. Each request trace is converted into a request-level invocation graph with multi-modal node features derived from timestamped logs and per-service performance metrics. As a first baseline, we train a two-layer graph convolutional network for 6-way classification over 21,438 request graphs. The model achieves 96.2% test accuracy with a macro F1 of 0.955 under a graph-level random split. We then conduct modality ablation, trial-level split evaluation, non-graph baseline comparison, runtime analysis, t-SNE visualization, confusion-matrix analysis, and error-case inspection. The stricter trial-level results show that trace structure alone is insufficient, logs and metrics improve detection, and strong flattened baselines currently outperform the shallow graph model on the engineered feature set.

Related papers

• From Load Tests to Live Streams: Graph Embedding-Based Anomaly Detection in Microservice Architectures [0.0]
  Prime Video regularly conducts load tests to simulate viewer traffic spikes during live events such as Thursday Night Football.<n>While these stress tests validate system capacity, they can sometimes miss service behaviors unique to real event traffic.<n>We present a graph-based anomaly detection system that identifies under-represented services using unsupervised node-level graph embeddings.
  arXiv  Detail & Related papers  (2026-04-07T20:43:07Z)
• ChronoGraph: A Real-World Graph-Based Multivariate Time Series Dataset [4.186511632537852]
  ChronoGraph is a graph-structured multivariate time series forecasting dataset built from real-world production.<n> ChronoGraph provides expert-annotated incident windows as anomaly labels, enabling evaluation of anomaly detection methods.<n>We report baseline results spanning forecasting models, pretrained time-series foundation models, and standard anomaly detectors.
  arXiv  Detail & Related papers  (2025-09-04T17:59:52Z)
• Beyond Message Passing: Neural Graph Pattern Machine [50.78679002846741]
  We introduce the Neural Graph Pattern Machine (GPM), a novel framework that bypasses message passing by learning directly from graph substructures.<n>GPM efficiently extracts, encodes, and prioritizes task-relevant graph patterns, offering greater expressivity and improved ability to capture long-range dependencies.
  arXiv  Detail & Related papers  (2025-01-30T20:37:47Z)
• A Microservice Graph Generator with Production Characteristics [14.487102827568856]
  We propose a Service Dependency Graph Generator (DGG) that comprises a Data Handler and a Graph Generator.<n>DGG generates the service dependency graphs of benchmarks that incorporate production-level characteristics from traces.<n>Case studies show that DGG's generated graphs similar to real traces in terms of topologies.
  arXiv  Detail & Related papers  (2024-12-26T06:51:35Z)
• CHASE: A Causal Hypergraph based Framework for Root Cause Analysis in Multimodal Microservice Systems [29.424326542377386]
  We propose a Causal Heterogeneous grAph baSed framEwork for root cause analysis, namely CHASE, for microservice systems with multimodal data.<n> CHASE learns from the constructed hypergraph with hyperedges representing the flow of causality and performs root cause localization.
  arXiv  Detail & Related papers  (2024-06-28T07:46:51Z)
• Multitask Active Learning for Graph Anomaly Detection [48.690169078479116]
  We propose a novel MultItask acTIve Graph Anomaly deTEction framework, namely MITIGATE. By coupling node classification tasks, MITIGATE obtains the capability to detect out-of-distribution nodes without known anomalies. Empirical studies on four datasets demonstrate that MITIGATE significantly outperforms the state-of-the-art methods for anomaly detection.
  arXiv  Detail & Related papers  (2024-01-24T03:43:45Z)
• Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System [24.2074235652359]
  We propose MSTGAD, which seamlessly integrates all available data modalities via attentive multi-modal learning. We construct a transformer-based neural network with both spatial and temporal attention mechanisms to model the inter-correlations between different modalities. This enables us to detect anomalies automatically and accurately in real-time.
  arXiv  Detail & Related papers  (2023-10-07T06:28:41Z)
• Bures-Wasserstein Means of Graphs [60.42414991820453]
  We propose a novel framework for defining a graph mean via embeddings in the space of smooth graph signal distributions. By finding a mean in this embedding space, we can recover a mean graph that preserves structural information. We establish the existence and uniqueness of the novel graph mean, and provide an iterative algorithm for computing it.
  arXiv  Detail & Related papers  (2023-05-31T11:04:53Z)
• Similarity-aware Positive Instance Sampling for Graph Contrastive Pre-training [82.68805025636165]
  We propose to select positive graph instances directly from existing graphs in the training set. Our selection is based on certain domain-specific pair-wise similarity measurements. Besides, we develop an adaptive node-level pre-training method to dynamically mask nodes to distribute them evenly in the graph.
  arXiv  Detail & Related papers  (2022-06-23T20:12:51Z)
• Temporal Graph Network Embedding with Causal Anonymous Walks Representations [54.05212871508062]
  We propose a novel approach for dynamic network representation learning based on Temporal Graph Network. For evaluation, we provide a benchmark pipeline for the evaluation of temporal network embeddings. We show the applicability and superior performance of our model in the real-world downstream graph machine learning task provided by one of the top European banks.
  arXiv  Detail & Related papers  (2021-08-19T15:39:52Z)
• Structural Temporal Graph Neural Networks for Anomaly Detection in Dynamic Graphs [54.13919050090926]
  We propose an end-to-end structural temporal Graph Neural Network model for detecting anomalous edges in dynamic graphs. In particular, we first extract the $h$-hop enclosing subgraph centered on the target edge and propose the node labeling function to identify the role of each node in the subgraph. Based on the extracted features, we utilize Gated recurrent units (GRUs) to capture the temporal information for anomaly detection.
  arXiv  Detail & Related papers  (2020-05-15T09:17:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.