Anomaly Detection and Root Cause Analysis for Microservice Systems

• URL: http://arxiv.org/abs/2606.09942v1
• Date: Mon, 08 Jun 2026 00:50:43 GMT
• Title: Anomaly Detection and Root Cause Analysis for Microservice Systems
• Abstract summary: Microservice systems are widely used to build cloud applications, yet their complexity makes failures inevitable.<n>This thesis advances automated anomaly detection and root cause analysis for microservice failures.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Microservice systems are widely used to build cloud applications, yet their complexity makes failures inevitable, degrading user experience and causing economic loss. Automated anomaly detection and root cause analysis (RCA) are now active research areas, but existing techniques share five limitations. First, most treat anomaly detection and RCA separately, assuming anomalies are detected correctly, and falter when detection is imprecise due to noise or delay. Second, they focus on metrics, logs, and traces, leaving event data such as API calls and configuration changes underexplored. Third, many require a given service call graph and cannot diagnose without one. Fourth, the field lacks standardised datasets and evaluation frameworks, so methods are hard to compare fairly. Fifth, although causal inference-based RCA has become dominant, its effectiveness, efficiency, and robustness remain unclear. This thesis addresses these limitations through two groups of contributions. The first introduces methods that exploit observability data both independently and collectively. BARO is an end-to-end anomaly detection and RCA approach for metric data. EventADL is an end-to-end framework for event data. TORAI is a multimodal RCA framework that requires no service call graph. Extensive experiments on real microservice systems demonstrate their effectiveness and robustness. The second group delivers benchmarking datasets, an evaluation framework, and systematic evaluation efforts. RCAEval is a comprehensive benchmark providing ready-to-use datasets and reproducible baselines for future research. A systematic evaluation of existing RCA methods, especially causal inference-based approaches, offers insights that guide future directions. This thesis thereby advances automated anomaly detection and RCA for microservice failures, enabling future research on incident mitigation and remediation.

Related papers

• Beyond Fault Localization: A Trajectory-Level Study of LLM Agents for Microservice Root Cause Analysis [13.865176720288938]
  We use a trajectory-level framework to evaluate root cause analysis (RCA) performance.<n>We find a disconnect between answer correctness and diagnostic quality.<n>We operationalize this taxonomy as DiagGuard, a two-stage defense-in-depth architecture.
  arXiv  Detail & Related papers  (2026-08-21T17:13:45Z)
• How Far Can Root Cause Analysis Go on Real-World Telemetry Data? [0.8594140167290097]
  We show that classical causal discovery methods and existing LLM-based multi-agent systems fail to reliably identify root causes.<n>We present a Structured Multi-Agent RCA pipeline that substantially outperforms existing LLM-based and classical baselines.
  arXiv  Detail & Related papers  (2026-07-15T07:54:46Z)
• Root Cause Analysis with Latent Confounders using Partial Ancestral Graphs [0.8602553195689513]
  Finding the source of failures is essential for identifying the root causes of anomalies and maintaining the reliability of complex systems.<n>While causal theory has advanced data-driven Root Cause Analysis, existing frameworks assume causal sufficiency, failing to account for the unobserved latent variables prevalent in real-world environments.<n>This framework models system failures as parametric interventions over Partial Ancestral Graphs (PAGs) to perform RCA in the presence of latent variables.
  arXiv  Detail & Related papers  (2026-06-18T20:08:34Z)
• AnoMod: A Dataset for Anomaly Detection and Root Cause Analysis in Microservice Systems [18.34761164400137]
  We introduce a new multimodal anomaly dataset built on two open-source microservice systems: SocialNetwork and TrainTicket.<n>For each scenario, we collect five modalities (Mod): logs, metrics, distributed traces, API responses, and code coverage reports.<n>This dataset enables evaluation of cross-modal anomaly detection and fusion/ablation strategies.
  arXiv  Detail & Related papers  (2026-01-30T12:03:51Z)
• Revisiting Multivariate Time Series Forecasting with Missing Values [65.30332997607141]
  Missing values are common in real-world time series.<n>Current approaches have developed an imputation-then-prediction framework that uses imputation modules to fill in missing values, followed by forecasting on the imputed data.<n>This framework overlooks a critical issue: there is no ground truth for the missing values, making the imputation process susceptible to errors that can degrade prediction accuracy.<n>We introduce Consistency-Regularized Information Bottleneck (CRIB), a novel framework built on the Information Bottleneck principle.
  arXiv  Detail & Related papers  (2025-09-27T20:57:48Z)
• A Comprehensive Library for Benchmarking Multi-class Visual Anomaly Detection [89.92916473403108]
  This paper proposes a comprehensive visual anomaly detection benchmark, ADer, which is a modular framework for new methods.<n>The benchmark includes multiple datasets from industrial and medical domains, implementing fifteen state-of-the-art methods and nine comprehensive metrics.<n>We objectively reveal the strengths and weaknesses of different methods and provide insights into the challenges and future directions of multi-class visual anomaly detection.
  arXiv  Detail & Related papers  (2024-06-05T13:40:07Z)
• Identifying Performance Issues in Cloud Service Systems Based on Relational-Temporal Features [11.83269525626691]
  Cloud systems are susceptible to performance issues, which may cause service-level agreement violations and financial losses. We propose a learning-based approach that leverages both the relational and temporal features of metrics to identify performance issues.
  arXiv  Detail & Related papers  (2023-07-20T13:41:26Z)
• Disentangled Causal Graph Learning for Online Unsupervised Root Cause Analysis [49.910053255238566]
  Root cause analysis (RCA) can identify the root causes of system faults/failures by analyzing system monitoring data. Previous research has mostly focused on developing offline RCA algorithms, which often require manually initiating the RCA process. We propose CORAL, a novel online RCA framework that can automatically trigger the RCA process and incrementally update the RCA model.
  arXiv  Detail & Related papers  (2023-05-18T01:27:48Z)
• PULL: Reactive Log Anomaly Detection Based On Iterative PU Learning [58.85063149619348]
  We propose PULL, an iterative log analysis method for reactive anomaly detection based on estimated failure time windows. Our evaluation shows that PULL consistently outperforms ten benchmark baselines across three different datasets.
  arXiv  Detail & Related papers  (2023-01-25T16:34:43Z)
• A2Log: Attentive Augmented Log Anomaly Detection [53.06341151551106]
  Anomaly detection becomes increasingly important for the dependability and serviceability of IT services. Existing unsupervised methods need anomaly examples to obtain a suitable decision boundary. We develop A2Log, which is an unsupervised anomaly detection method consisting of two steps: Anomaly scoring and anomaly decision.
  arXiv  Detail & Related papers  (2021-09-20T13:40:21Z)
• TadGAN: Time Series Anomaly Detection Using Generative Adversarial Networks [73.01104041298031]
  TadGAN is an unsupervised anomaly detection approach built on Generative Adversarial Networks (GANs) To capture the temporal correlations of time series, we use LSTM Recurrent Neural Networks as base models for Generators and Critics. To demonstrate the performance and generalizability of our approach, we test several anomaly scoring techniques and report the best-suited one.
  arXiv  Detail & Related papers  (2020-09-16T15:52:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.