# Twin Graph-based Anomaly Detection via Attentive Multi-Modal Learning for Microservice System

arXiv: https://arxiv.org/abs/2310.04701 · HTML: https://mlsanity.com/paper/2310.04701/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 20 of its 45 references that are in the map.
- First posted on arXiv 7 Oct 2023.

## Builds on (most cited first, 20 of 20)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Fast Graph Representation Learning with PyTorch Geometric](https://mlsanity.com/paper/1903.02428/) (2019)
- [How Attentive are Graph Attention Networks?](https://mlsanity.com/paper/2105.14491/) (2021)
- [Enhancing the Locality and Breaking the Memory Bottleneck of Transformer on Time Series Forecasting](https://mlsanity.com/paper/1907.00235/) (2019)
- [A Transformer-based Framework for Multivariate Time Series Representation Learning](https://mlsanity.com/paper/2010.02803/) (2020)
- [Graph Neural Network-Based Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2106.06947/) (2021)
- [AdaBelief Optimizer: Adapting Stepsizes by the Belief in Observed Gradients](https://mlsanity.com/paper/2010.07468/) (2020)
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](https://mlsanity.com/paper/2201.07284/) (2022)
- [Log-based Anomaly Detection Without Log Parsing](https://mlsanity.com/paper/2108.01955/) (2021)
- [Log-based Anomaly Detection with Deep Learning: How Far Are We?](https://mlsanity.com/paper/2202.04301/) (2022)
- [Anomaly Detection and Failure Root Cause Analysis in (Micro)Service-Based Cloud Applications: A Survey](https://mlsanity.com/paper/2105.12378/) (2021)
- [MicroHECL: High-Efficient Root Cause Localization in Large-Scale Microservice Systems](https://mlsanity.com/paper/2103.01782/) (2021)
- [Robust Failure Diagnosis of Microservice System through Multimodal Data](https://mlsanity.com/paper/2302.10512/) (2023)
- [Eadro: An End-to-End Troubleshooting Framework for Microservices on Multi-source Data](https://mlsanity.com/paper/2302.05092/) (2023)
- [SemParser: A Semantic Parser for Log Analysis](https://mlsanity.com/paper/2112.12636/) (2021)
- [Robust Multimodal Failure Detection for Microservice Systems](https://mlsanity.com/paper/2305.18985/) (2023)
- [System Log Parsing: A Survey](https://mlsanity.com/paper/2212.14277/) (2022)
- [Heterogeneous Anomaly Detection for Software Systems via Semi-supervised Cross-modal Attention](https://mlsanity.com/paper/2302.06914/) (2023)

## Built on by (most cited first, 7 of 7)

- [AgentFM: Role-Aware Failure Management for Distributed Databases with LLM-Driven Multi-Agents](https://mlsanity.com/paper/2504.06614/) (2025)
- [A Systematic Literature Review of Spatio-Temporal Graph Neural Network Models for Time Series Forecasting and Classification](https://mlsanity.com/paper/2410.22377/) (2024)
- [Are GNNs Actually Effective for Multimodal Fault Diagnosis in Microservice Systems?](https://mlsanity.com/paper/2501.02766/) (2025)
- [Synthetic Time Series for Anomaly Detection in Cloud Microservices](https://mlsanity.com/paper/2408.00006/) (2024)
- [ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality](https://mlsanity.com/paper/2603.25538/) (2026)
- [OrEdge: Efficient Multi-Modal Anomaly Detection in Distributed Software Systems via Orthogonal-Domain Learning](https://mlsanity.com/paper/2608.00309/) (2026)
- [SFlexRCA: Lightweight, Scalable, and Flexible Root Cause Analysis for IIoT Edge Systems](https://mlsanity.com/paper/2610.04893/) (2026)

## Abstract (arXiv)

Microservice architecture has sprung up over recent years for managing enterprise applications, due to its ability to independently deploy and scale services. Despite its benefits, ensuring the reliability and safety of a microservice system remains highly challenging. Existing anomaly detection algorithms based on a single data modality (i.e., metrics, logs, or traces) fail to fully account for the complex correlations and interactions between different modalities, leading to false negatives and false alarms, whereas incorporating more data modalities can offer opportunities for further performance gain. As a fresh attempt, we propose in this paper a semi-supervised graph-based anomaly detection method, MSTGAD, which seamlessly integrates all available data modalities via attentive multi-modal learning. First, we extract and normalize features from the three modalities, and further integrate them using a graph, namely MST (microservice system twin) graph, where each node represents a service instance and the edge indicates the scheduling relationship between different service instances. The MST graph provides a virtual representation of the status and scheduling relationships among service instances of a real-world microservice system. Second, we construct a transformer-based neural network with both spatial and temporal attention mechanisms to model the inter-correlations between different modalities and temporal dependencies between the data points. This enables us to detect anomalies automatically and accurately in real-time. The source code of MSTGAD is publicly available at https://github.com/alipay/microservice_system_twin_graph_based_anomaly_detection.