# Multi-Source Anomaly Detection in Distributed IT Systems

arXiv: https://arxiv.org/abs/2101.04977 · HTML: https://mlsanity.com/paper/2101.04977/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 18 references that are in the map.
- First posted on arXiv 13 Jan 2021.

## Builds on (most cited first, 4 of 4)

- [Tools and Benchmarks for Automated Log Parsing](https://mlsanity.com/paper/1811.03509/) (2018)
- [Self-Supervised Log Parsing](https://mlsanity.com/paper/2003.07905/) (2020)
- [Anomaly Detection and Interpretation using Multimodal Autoencoder and Sparse Optimization](https://mlsanity.com/paper/1812.07136/) (2018)
- [Transparently Capturing Request Execution Path for Anomaly Detection](https://mlsanity.com/paper/2001.07276/) (2020)

## Built on by (most cited first, 4 of 4)

- [Robust and Transferable Anomaly Detection in Log Data using Pre-Trained Language Models](https://mlsanity.com/paper/2102.11570/) (2021)
- [Artificial Intelligence for IT Operations (AIOPS) Workshop White Paper](https://mlsanity.com/paper/2101.06054/) (2021)
- [LogRCA: Log-based Root Cause Analysis for Distributed Services](https://mlsanity.com/paper/2405.13599/) (2024)
- [Progressing from Anomaly Detection to Automated Log Labeling and Pioneering Root Cause Analysis](https://mlsanity.com/paper/2312.14748/) (2023)

## Abstract (arXiv)

The multi-source data generated by distributed systems, provide a holistic description of the system. Harnessing the joint distribution of the different modalities by a learning model can be beneficial for critical applications for maintenance of the distributed systems. One such important task is the task of anomaly detection where we are interested in detecting the deviation of the current behaviour of the system from the theoretically expected. In this work, we utilize the joint representation from the distributed traces and system log data for the task of anomaly detection in distributed systems. We demonstrate that the joint utilization of traces and logs produced better results compared to the single modality anomaly detection methods. Furthermore, we formalize a learning task - next template prediction NTP, that is used as a generalization for anomaly detection for both logs and distributed trace. Finally, we demonstrate that this formalization allows for the learning of template embedding for both the traces and logs. The joint embeddings can be reused in other applications as good initialization for spans and logs.