# GAL-MAD: Towards Explainable Anomaly Detection in Microservice Applications Using Graph Attention Networks

arXiv: https://arxiv.org/abs/2504.00058 · HTML: https://mlsanity.com/paper/2504.00058/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 59 references that are in the map.
- First posted on arXiv 31 Mar 2025.

## Builds on (most cited first, 16 of 16)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [A Unified Approach to Interpreting Model Predictions](https://mlsanity.com/paper/1705.07874/) (2017)
- [Graph Neural Network-Based Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2106.06947/) (2021)
- [MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks](https://mlsanity.com/paper/1901.04997/) (2019)
- [Multivariate Time-series Anomaly Detection via Graph Attention Network](https://mlsanity.com/paper/2009.02040/) (2020)
- [Deep Learning for Anomaly Detection: A Review](https://mlsanity.com/paper/2007.02500/) (2020)
- [Evaluating Real-time Anomaly Detection Algorithms - the Numenta Anomaly Benchmark](https://mlsanity.com/paper/1510.03336/) (2015)
- [Learning Deep Features for One-Class Classification](https://mlsanity.com/paper/1801.05365/) (2018)
- [Unsupervised and Semi-supervised Anomaly Detection with LSTM Neural Networks](https://mlsanity.com/paper/1710.09207/) (2017)
- [MicroHECL: High-Efficient Root Cause Localization in Large-Scale Microservice Systems](https://mlsanity.com/paper/2103.01782/) (2021)
- [Root Cause Analysis In Microservice Using Neural Granger Causal Discovery](https://mlsanity.com/paper/2402.01140/) (2024)
- [CausalRCA: Causal Inference based Precise Fine-grained Root Cause Localization for Microservice Applications](https://mlsanity.com/paper/2209.02500/) (2022)
- [BARO: Robust Root Cause Analysis for Microservices via Multivariate Bayesian Online Change Point Detection](https://mlsanity.com/paper/2405.09330/) (2024)
- [Actionable and Interpretable Fault Localization for Recurring Failures in Online Service Systems](https://mlsanity.com/paper/2207.09021/) (2022)
- [TraceDiag: Adaptive, Interpretable, and Efficient Root Cause Analysis on Large-Scale Microservice Systems](https://mlsanity.com/paper/2310.18740/) (2023)

## Built on by (most cited first, 3 of 3)

- [Contrastive Learning-Based Dependency Modeling for Anomaly Detection in Cloud Services](https://mlsanity.com/paper/2510.13368/) (2025)
- [Graph Neural AI with Temporal Dynamics for Comprehensive Anomaly Detection in Microservices](https://mlsanity.com/paper/2511.03285/) (2025)
- [Towards Generalizable Context-aware Anomaly Detection: A Large-scale Benchmark in Cloud Environments](https://mlsanity.com/paper/2508.01844/) (2025)

## Abstract (arXiv)

The transition to microservices has revolutionized software architectures, offering enhanced scalability and modularity. However, the distributed and dynamic nature of microservices introduces complexities in ensuring system reliability, making anomaly detection crucial for maintaining performance and functionality. Anomalies stemming from network and performance issues must be swiftly identified and addressed. Existing anomaly detection techniques often rely on statistical models or machine learning methods that struggle with the high-dimensional, interdependent data inherent in microservice applications. Current techniques and available datasets predominantly focus on system traces and logs, limiting their ability to support advanced detection models. This paper addresses these gaps by introducing the RS-Anomic dataset generated using the open-source RobotShop microservice application. The dataset captures multivariate performance metrics and response times under normal and anomalous conditions, encompassing ten types of anomalies. We propose a novel anomaly detection model called Graph Attention and LSTM-based Microservice Anomaly Detection (GAL-MAD), leveraging Graph Attention and Long Short-Term Memory architectures to capture spatial and temporal dependencies in microservices. We utilize SHAP values to localize anomalous services and identify root causes to enhance explainability. Experimental results demonstrate that GAL-MAD outperforms state-of-the-art models on the RS-Anomic dataset, achieving higher accuracy and recall across varying anomaly rates. The explanations provide actionable insights into service anomalies, which benefits system administrators.