# Heterogeneous Anomaly Detection for Software Systems via Semi-supervised Cross-modal Attention

arXiv: https://arxiv.org/abs/2302.06914 · HTML: https://mlsanity.com/paper/2302.06914/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 62 references that are in the map.
- First posted on arXiv 14 Feb 2023.

## Builds on (most cited first, 13 of 13)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Enriching Word Vectors with Subword Information](https://mlsanity.com/paper/1607.04606/) (2016)
- [An Empirical Evaluation of Generic Convolutional and Recurrent Networks for Sequence Modeling](https://mlsanity.com/paper/1803.01271/) (2018)
- [Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding](https://mlsanity.com/paper/1802.04431/) (2018)
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](https://mlsanity.com/paper/2201.07284/) (2022)
- [Temporal Convolutional Networks: A Unified Approach to Action Segmentation](https://mlsanity.com/paper/1608.08242/) (2016)
- [Time-Series Anomaly Detection Service at Microsoft](https://mlsanity.com/paper/1906.03821/) (2019)
- [Log-based Anomaly Detection Without Log Parsing](https://mlsanity.com/paper/2108.01955/) (2021)
- [Tools and Benchmarks for Automated Log Parsing](https://mlsanity.com/paper/1811.03509/) (2018)
- [A Survey on Automated Log Analysis for Reliability Engineering](https://mlsanity.com/paper/2009.07237/) (2020)
- [Experience Report: Deep Learning-based System Log Analysis for Anomaly Detection](https://mlsanity.com/paper/2107.05908/) (2021)
- [Adaptive Performance Anomaly Detection for Online Service Systems via Pattern Sketching](https://mlsanity.com/paper/2201.02944/) (2022)

## Built on by (most cited first, 9 of 9)

- [AgentFM: Role-Aware Failure Management for Distributed Databases with LLM-Driven Multi-Agents](https://mlsanity.com/paper/2504.06614/) (2025)
- [Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System](https://mlsanity.com/paper/2310.04701/) (2023)
- [Demystifying and Extracting Fault-indicating Information from Logs for Failure Diagnosis](https://mlsanity.com/paper/2409.13561/) (2024)
- [Identifying Performance Issues in Cloud Service Systems Based on Relational-Temporal Features](https://mlsanity.com/paper/2307.10869/) (2023)
- [Knowledge-aware Alert Aggregation in Large-scale Cloud Systems: a Hybrid Approach](https://mlsanity.com/paper/2403.06485/) (2024)
- [Enhancing Web Service Anomaly Detection via Fine-grained Multi-modal Association and Frequency Domain Analysis](https://mlsanity.com/paper/2501.16875/) (2025)
- [EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems](https://mlsanity.com/paper/2605.00936/) (2026)
- [ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality](https://mlsanity.com/paper/2603.25538/) (2026)
- [STAR: Adaptive Spatial-Temporal Normalization for Unified Microservice Incident Management](https://mlsanity.com/paper/2609.31645/) (2026)

## Abstract (arXiv)

Prompt and accurate detection of system anomalies is essential to ensure the reliability of software systems. Unlike manual efforts that exploit all available run-time information, existing approaches usually leverage only a single type of monitoring data (often logs or metrics) or fail to make effective use of the joint information among different types of data. Consequently, many false predictions occur. To better understand the manifestations of system anomalies, we conduct a systematical study on a large amount of heterogeneous data, i.e., logs and metrics. Our study demonstrates that logs and metrics can manifest system anomalies collaboratively and complementarily, and neither of them only is sufficient. Thus, integrating heterogeneous data can help recover the complete picture of a system's health status. In this context, we propose Hades, the first end-to-end semi-supervised approach to effectively identify system anomalies based on heterogeneous data. Our approach employs a hierarchical architecture to learn a global representation of the system status by fusing log semantics and metric patterns. It captures discriminative features and meaningful interactions from heterogeneous data via a cross-modal attention module, trained in a semi-supervised manner. We evaluate Hades extensively on large-scale simulated data and datasets from Huawei Cloud. The experimental results present the effectiveness of our model in detecting system anomalies. We also release the code and the annotated dataset for replication and future research.