# EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems

arXiv: https://arxiv.org/abs/2605.00936 · HTML: https://mlsanity.com/paper/2605.00936/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 25 of its 69 references that are in the map.
- First posted on arXiv 1 May 2026.

## Builds on (most cited first, 25 of 25)

- [Neural Transformation Learning for Deep Anomaly Detection Beyond Images](https://mlsanity.com/paper/2103.16440/) (2021)
- [Deep Isolation Forest for Anomaly Detection](https://mlsanity.com/paper/2206.06602/) (2022)
- [Exploring LLM-based Agents for Root Cause Analysis](https://mlsanity.com/paper/2403.04123/) (2024)
- [Log-based Anomaly Detection Without Log Parsing](https://mlsanity.com/paper/2108.01955/) (2021)
- [Causal Inference-Based Root Cause Analysis for Online Service Systems with Intervention Recognition](https://mlsanity.com/paper/2206.05871/) (2022)
- [Anomaly Detection and Failure Root Cause Analysis in (Micro)Service-Based Cloud Applications: A Survey](https://mlsanity.com/paper/2105.12378/) (2021)
- [Unsupervised Representation Learning by Predicting Random Distances](https://mlsanity.com/paper/1912.12186/) (2019)
- [RCAEval: A Benchmark for Root Cause Analysis of Microservice Systems with Telemetry Data](https://mlsanity.com/paper/2412.17015/) (2024)
- [CausalRCA: Causal Inference based Precise Fine-grained Root Cause Localization for Microservice Applications](https://mlsanity.com/paper/2209.02500/) (2022)
- [BARO: Robust Root Cause Analysis for Microservices via Multivariate Bayesian Online Change Point Detection](https://mlsanity.com/paper/2405.09330/) (2024)
- [Groot: An Event-graph-based Approach for Root Cause Analysis in Industrial Settings](https://mlsanity.com/paper/2108.00344/) (2021)
- [AI for IT Operations (AIOps) on Cloud Platforms: Reviews, Opportunities and Challenges](https://mlsanity.com/paper/2304.04661/) (2023)
- [Explainable Time Series Anomaly Detection using Masked Latent Generative Modeling](https://mlsanity.com/paper/2311.12550/) (2023)
- [LogFormer: A Pre-train and Tuning Pipeline for Log Anomaly Detection](https://mlsanity.com/paper/2401.04749/) (2024)
- [Root Cause Analysis for Microservice System based on Causal Inference: How Far Are We?](https://mlsanity.com/paper/2408.13729/) (2024)
- [Adaptive Performance Anomaly Detection for Online Service Systems via Pattern Sketching](https://mlsanity.com/paper/2201.02944/) (2022)
- [Entity Embedding-based Anomaly Detection for Heterogeneous Categorical Events](https://mlsanity.com/paper/1608.07502/) (2016)
- [Heterogeneous Anomaly Detection for Software Systems via Semi-supervised Cross-modal Attention](https://mlsanity.com/paper/2302.06914/) (2023)
- [A Critical Review of Common Log Data Sets Used for Evaluation of Sequence-based Anomaly Detection Techniques](https://mlsanity.com/paper/2309.02854/) (2023)
- [Rethinking the Evaluation of Microservice RCA with a Fault Propagation-Aware Benchmark](https://mlsanity.com/paper/2510.04711/) (2025)
- [A Comprehensive Study of Machine Learning Techniques for Log-Based Anomaly Detection](https://mlsanity.com/paper/2307.16714/) (2023)
- [TORAI: Multi-source Root Cause Analysis for Blind Spots in Microservice Service Call Graph](https://mlsanity.com/paper/2604.13522/) (2026)
- [Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection](https://mlsanity.com/paper/2509.06911/) (2025)
- [Salesforce CausalAI Library: A Fast and Scalable Framework for Causal Analysis of Time Series and Tabular Data](https://mlsanity.com/paper/2301.10859/) (2023)
- [SLIM: a Scalable Light-weight Root Cause Analysis for Imbalanced Data in Microservice](https://mlsanity.com/paper/2405.20848/) (2024)

## Built on by (most cited first, 1 of 1)

- [When Identical Rows Disagree: From Benchmark Identifiability to Replication-Robust Anomaly Detection](https://mlsanity.com/paper/2609.29580/) (2026)

## Abstract (arXiv)

Anomaly detection and localization (ADL) is critical for maintaining reliability and availability in cloud systems. Recent ADL developments focus on metric and log data, leaving event data unexplored. To address this gap, we propose EventADL, the first open-box event-based ADL framework for cloud-based service systems. To motivate the design of our framework, we conduct a systematic analysis on 520 real-world incidents, and provide insights into how anomalies and their root causes manifest through event data. EventADL has three phases: offline training, online anomaly detection, and root cause localization. During the training phase, EventADL first learns Event Semantic Patterns (ESPs), which capture normal interactions between system entities using historical event data, and then learns Event Frequency Patterns (EFPs), which capture the normal frequency of known ESPs. In the online anomaly detection phase, any data in the event stream that deviates significantly from either pattern is identified as anomalous. For localization, EventADL constructs an Intervention Graph that models the relationships between recent system interactions and the detected anomalies for automatic root cause localization. The framework is designed to operate efficiently with unlabeled data and to produce interpretable anomalies with their corresponding root causes. Our evaluation on three real cloud service systems and two real-world incidents demonstrates that EventADL outperforms existing methods, achieving F1-scores of at least 90% for anomaly detection and 100% top-3 accuracy in root cause localization.