Context-Aware Anomaly Detection in Microservices Using GCN‑Encoded Trace Graphs and LSTM‑AE Metrics with Local and Global Embeddings
Received: 22 July 2025 | Revised: 9 September 2025 and 18 September 2025 | Accepted: 20 September 2025 | Online: 8 December 2025
Corresponding author: Tariq Al-Omari
Abstract
Modern microservice architectures generate massive volumes of fine-grained telemetry, yet effective span-level anomaly detection remains elusive due to limited contextual visibility and fragmented metrics. This paper presents a novel, lightweight anomaly detection framework that fuses structural and temporal telemetry signals to identify anomalous spans in distributed traces. The study constructs Directed Acyclic Graphs (DAGs) from service traces and applies Graph Convolutional Networks (GCNs) to learn structural embeddings that capture inter-span relationships. In parallel, the Long Short-Term Memory Autoencoders (LSTM-AEs) model aligned sequences of CPU and memory metrics for each service, capturing temporal irregularities. A global trace embedding is derived and broadcast to each span, enriching node features with holistic context. The final anomaly scores are computed by a tunable fusion of the GCN and LSTM-AE signals. Extensive experiments on the Alibaba CloudOps 2022 dataset with synthetic fault injections validate the proposed framework's strong top-K precision and low-latency suitability. The results demonstrate that the proposed architecture offers a promising direction for real-time anomaly detection with low computational overhead. The implementation serves as a compelling proof-of-concept, laying a strong foundation for further optimization and deployment at scale on more powerful infrastructure.
Keywords:
microservices, anomaly detection, Graph Convolutional Networks (GCNs), LSTM-Autoencoders, trace telemetry fusionDownloads
References
H. Chen et al., "Graph Neural Network Based Robust Anomaly Detection at Service Level in SDN Driven Microservice System," Computer Networks, vol. 239, Feb. 2024, Art. no. 110135. DOI: https://doi.org/10.1016/j.comnet.2023.110135
J. Chen et al., "Tracegra: A Trace-Based Anomaly Detection for Microservice Using Graph Deep Learning," SSRN Electronic Journal, 2022. DOI: https://doi.org/10.2139/ssrn.4211339
K. Shi, J. Li, Y. Liu, Y. Chang, and X. Li, "BSDG: Anomaly Detection of Microservice Trace Based on Dual Graph Convolutional Neural Network," in International Conference on Service-Oriented Computing, Nov. 2022, pp 171-185. DOI: https://doi.org/10.1007/978-3-031-20984-0_12
H. Kong, T. Li, J. Ge, L. Zhang, and L. Li, "Enhancing Fault Localization in Microservices Systems Through Span-level Using Graph Convolutional Networks," Automated Software Engineering, vol. 31, no. 2, Nov. 2024, Art. no. 46. DOI: https://doi.org/10.1007/s10515-024-00445-w
Z. Xie et al., "Unsupervised Anomaly Detection on Microservice Traces through Graph VAE," in Proceedings of the ACM Web Conference 2023, Austin, TX, USA, Apr. 2023, pp. 2874–2884. DOI: https://doi.org/10.1145/3543507.3583215
J. Audibert, P. Michiardi, F. Guyard, S. Marti, and M. A. Zuluaga, "USAD: UnSupervised Anomaly Detection on Multivariate Time Series," in Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual Event CA, USA, Aug. 2020, pp. 3395–3404. DOI: https://doi.org/10.1145/3394486.3403392
M. N. Amin, L. Hubner, F. S. Bayram, and A. Jesser, "Real-Time Anomaly Detection with LSTM-Autoencoder Network on Microcontrollers for Industrial Applications," in Proceedings of the 2024 8th International Conference on Graphics and Signal Processing, Tokyo, Japan, June 2024, pp. 42–46. DOI: https://doi.org/10.1145/3694875.3694883
L. Kirichenko, Y. Koval, S. Yakovlev, and D. Chumachenko, "Anomaly Detection in Fractal Time Series with LSTM Autoencoders," Mathematics, vol. 12, no. 19, Oct. 2024, Art. no. 3079. DOI: https://doi.org/10.3390/math12193079
M. Munir, S. A. Siddiqui, A. Dengel, and S. Ahmed, "DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series," IEEE Access, vol. 7, pp. 1991–2005, 2019. DOI: https://doi.org/10.1109/ACCESS.2018.2886457
M. Panahandeh, A. Hamou-Lhadj, M. Hamdaqa, and J. Miller, "Serviceanomaly: An Anomaly Detection Approach in Microservices Using Distributed Traces and Profiling Metrics." SSRN, 2023. DOI: https://doi.org/10.2139/ssrn.4415639
C. Zhang et al., "DeepTraLog: Trace-log Combined Microservice Anomaly Detection Through Graph-based Deep Learning," in Proceedings of the 44th International Conference on Software Engineering, Pittsburgh, PA, May 2022, pp. 623–634. DOI: https://doi.org/10.1145/3510003.3510180
L. Akmeemana, C. Attanayake, H. Faiz, and S. Wickramanayake, "GAL-MAD: Towards Explainable Anomaly Detection in Microservice Applications Using Graph Attention Networks." arXiv, 2025.
M. S. Islam, M. S. Rakha, W. Pourmajidi, J. Sivaloganathan, J. Steinbacher, and A. Miranskyy, "Anomaly Detection in Large-Scale Cloud Systems: An Industry Case and Dataset," in 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), Ottawa, ON, Canada, Apr. 2025, pp. 377–388. DOI: https://doi.org/10.1109/ICSE-SEIP66354.2025.00039
X. Liang, L. Li, and H. Peng, "Unsupervised Microservice Log Anomaly Detection Method Based on Graph Neural Network," in Advances in Swarm Intelligence, vol. 14789, Y. Tan and Y. Shi, Eds. Singapore: Springer Nature Singapore, 2024, pp. 197–208. DOI: https://doi.org/10.1007/978-981-97-7184-4_17
M. Fan, X. Zhang, P. Wang, and Z. Cao, "Multi-Modal Anomaly Detection for Microservice System Through Nested Graph Diffusion Reconstruction," Applied Intelligence, vol. 55, no. 11, July 2025, Art. no. 784. DOI: https://doi.org/10.1007/s10489-025-06681-1
P. Wang, X. Zhang, Z. Cao, and Z. Chen, "MADMM: Microservice System Anomaly Detection via Multi-modal Data and Multi-feature Extraction," Neural Computing and Applications, vol. 36, no. 25, pp. 15739–15757, Sept. 2024. DOI: https://doi.org/10.1007/s00521-024-09918-1
J. Chen et al., "MTG_CD: Multi-Scale Learnable Transformation Graph for Fault Classification and Diagnosis in Microservices," Journal of Cloud Computing, vol. 13, no. 1, May 2024, Art. no. 103. DOI: https://doi.org/10.1186/s13677-024-00666-0
X. Li, P. Chen, L. Jing, Z. He, and G. Yu, "SwissLog: Robust and Unified Deep Learning Based Log Anomaly Detection for Diverse Faults," in 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE), Coimbra, Portugal, Oct. 2020, pp. 92–103. DOI: https://doi.org/10.1109/ISSRE5003.2020.00018
S. Nedelkoski, J. Bogatinovski, A. Acker, J. Cardoso, and O. Kao, "Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs," in 2020 IEEE International Conference on Data Mining (ICDM), Sorrento, Italy, Nov. 2020, pp. 1196–1201. DOI: https://doi.org/10.1109/ICDM50108.2020.00148
Z. Zamanzadeh Darban, G. I. Webb, S. Pan, C. Aggarwal, and M. Salehi, "Deep Learning for Time Series Anomaly Detection: A Survey," ACM Computing Surveys, vol. 57, no. 1, pp. 1–42, Jan. 2025. DOI: https://doi.org/10.1145/3691338
M. I. H. Okfie and S. Mishra, "Anomaly Detection in IIoT Transactions using Machine Learning: A Lightweight Blockchain-based Approach," Engineering, Technology & Applied Science Research, vol. 14, no. 3, pp. 14645–14653, June 2024. DOI: https://doi.org/10.48084/etasr.7384
T. Al-Omari, "Microservice-Anomaly-Notebooks," Sept. 2025. https://github.com/tariqalomari/microservice-anomaly-notebooks.git.
Alibaba Group, "Cluster-Trace-Microservices-v2022." GitHub, 2024, [Online]. Available: https://github.com/alibaba/clusterdata/tree/master/cluster-trace-microservices-v2022.
S. Xing, Y. Wang, and W. Liu, "Multi-Dimensional Anomaly Detection and Fault Localization in Microservice Architectures: A Dual-Channel Deep Learning Approach with Causal Inference for Intelligent Sensing," Sensors, vol. 25, no. 11, May 2025, Art. no. 3396. DOI: https://doi.org/10.3390/s25113396
S. Zhang, Z. Feng, and B. Dong, "LAMDA: Low-Latency Anomaly Detection Architecture for Real-Time Cross-Market Financial Decision Support," Academia Nexus Journal, vol. 3, no. 2, pp. 1–26, Aug. 2024.
Downloads
How to Cite
License
Copyright (c) 2025 Tariq Al-Omari
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
