# Graph Neural Network and Transformer Integration for Unsupervised System Anomaly Discovery

arXiv: https://arxiv.org/abs/2508.09401 · HTML: https://mlsanity.com/paper/2508.09401/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 23 references that are in the map.
- First posted on arXiv 13 Aug 2025.

## Builds on (most cited first, 15 of 15)

- [Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy](https://mlsanity.com/paper/2110.02642/) (2021)
- [Graph Neural Network-Based Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2106.06947/) (2021)
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](https://mlsanity.com/paper/2201.07284/) (2022)
- [Multivariate Time-series Anomaly Detection via Graph Attention Network](https://mlsanity.com/paper/2009.02040/) (2020)
- [Time-Series Anomaly Detection Service at Microsoft](https://mlsanity.com/paper/1906.03821/) (2019)
- [Generative Adversarial Active Learning](https://mlsanity.com/paper/1702.07956/) (2017)
- [Generative Adversarial Active Learning for Unsupervised Outlier Detection](https://mlsanity.com/paper/1809.10816/) (2018)
- [MEMTO: Memory-guided Transformer for Multivariate Time Series Anomaly Detection](https://mlsanity.com/paper/2312.02530/) (2023)
- [Collaborative Multi-Agent Reinforcement Learning Approach for Elastic Cloud Resource Scaling](https://mlsanity.com/paper/2507.00550/) (2025)
- [Graph Neural Networks based Log Anomaly Detection and Explanation](https://mlsanity.com/paper/2307.00527/) (2023)
- [Clinical NLP with Attention-Based Deep Learning for Multi-Disease Prediction](https://mlsanity.com/paper/2507.01437/) (2025)
- [Capsule Network-Based Semantic Intent Modeling for Human-Computer Interaction](https://mlsanity.com/paper/2507.00540/) (2025)
- [Collaborative Distillation Strategies for Parameter-Efficient Language Model Deployment](https://mlsanity.com/paper/2507.15198/) (2025)
- [Time-Series Learning for Proactive Fault Prediction in Distributed Systems with Deep Neural Structures](https://mlsanity.com/paper/2505.20705/) (2025)
- [Behavioral Anomaly Detection in Distributed Systems via Federated Contrastive Learning](https://mlsanity.com/paper/2506.19246/) (2025)

## Built on by (most cited first, 4 of 4)

- [Multi-Objective Adaptive Rate Limiting in Microservices Using Deep Reinforcement Learning](https://mlsanity.com/paper/2511.03279/) (2025)
- [Dynamic Topic Evolution with Temporal Decay and Attention in Large Language Models](https://mlsanity.com/paper/2510.10613/) (2025)
- [Topology-Aware Graph Reinforcement Learning for Dynamic Routing in Cloud Networks](https://mlsanity.com/paper/2509.04973/) (2025)
- [Dynamic Anomaly Identification in Accounting Transactions via Multi-Head Self-Attention Networks](https://mlsanity.com/paper/2511.12122/) (2025)

## Abstract (arXiv)

This study proposes an unsupervised anomaly detection method for distributed backend service systems, addressing practical challenges such as complex structural dependencies, diverse behavioral evolution, and the absence of labeled data. The method constructs a dynamic graph based on service invocation relationships and applies graph convolution to extract high-order structural representations from multi-hop topologies. A Transformer is used to model the temporal behavior of each node, capturing long-term dependencies and local fluctuations. During the feature fusion stage, a learnable joint embedding mechanism integrates structural and behavioral representations into a unified anomaly vector. A nonlinear mapping is then applied to compute anomaly scores, enabling an end-to-end detection process without supervision. Experiments on real-world cloud monitoring data include sensitivity analyses across different graph depths, sequence lengths, and data perturbations. Results show that the proposed method outperforms existing models on several key metrics, demonstrating stronger expressiveness and stability in capturing anomaly propagation paths and modeling dynamic behavior sequences, with high potential for practical deployment.