# ClouDens: Operational Context-Aware Anomaly Detection for Large-scale Cloud System Monitoring

arXiv: https://arxiv.org/abs/2607.18127 · HTML: https://mlsanity.com/paper/2607.18127/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 69 references that are in the map.
- First posted on arXiv 20 Jul 2026.

## Builds on (most cited first, 23 of 23)

- [Graph Attention Networks](https://mlsanity.com/paper/1710.10903/) (2017)
- [Convolutional Neural Networks on Graphs with Fast Localized Spectral Filtering](https://mlsanity.com/paper/1606.09375/) (2016)
- [On the Properties of Neural Machine Translation: Encoder-Decoder Approaches](https://mlsanity.com/paper/1409.1259/) (2014)
- [iTransformer: Inverted Transformers Are Effective for Time Series Forecasting](https://mlsanity.com/paper/2310.06625/) (2023)
- [A Survey on Graph Neural Networks for Time Series: Forecasting, Classification, Imputation, and Anomaly Detection](https://mlsanity.com/paper/2307.03759/) (2023)
- [PyTorch Geometric Temporal: Spatiotemporal Signal Processing with Neural Machine Learning Models](https://mlsanity.com/paper/2104.07788/) (2021)
- [Evaluating Real-time Anomaly Detection Algorithms - the Numenta Anomaly Benchmark](https://mlsanity.com/paper/1510.03336/) (2015)
- [Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series](https://mlsanity.com/paper/2010.05073/) (2020)
- [Forecast Evaluation for Data Scientists: Common Pitfalls and Best Practices](https://mlsanity.com/paper/2203.10716/) (2022)
- [A3T-GCN: Attention Temporal Graph Convolutional Network for Traffic Forecasting](https://mlsanity.com/paper/2006.11583/) (2020)
- [Navigating the Metric Maze: A Taxonomy of Evaluation Metrics for Anomaly Detection in Time Series](https://mlsanity.com/paper/2303.01272/) (2023)
- [Dive into Time-Series Anomaly Detection: A Decade Review](https://mlsanity.com/paper/2412.20512/) (2024)
- [A Systematic Literature Review of Spatio-Temporal Graph Neural Network Models for Time Series Forecasting and Classification](https://mlsanity.com/paper/2410.22377/) (2024)
- [Anomaly Detection in a Large-scale Cloud Platform](https://mlsanity.com/paper/2010.10966/) (2020)
- [Microservice API Evolution in Practice: A Study on Strategies and Challenges](https://mlsanity.com/paper/2311.08175/) (2023)
- [Anomaly Detection in Large-Scale Cloud Systems: An Industry Case and Dataset](https://mlsanity.com/paper/2411.09047/) (2024)
- [Deep Anomaly Detection in Packet Payload](https://mlsanity.com/paper/1912.02549/) (2019)
- [A Hybrid Deep Learning Anomaly Detection Framework for Intrusion Detection](https://mlsanity.com/paper/2212.00966/) (2022)
- [On Challenges of Cloud Monitoring](https://mlsanity.com/paper/1806.05914/) (2018)
- [Anomaly Detection in Cloud Components](https://mlsanity.com/paper/2005.08739/) (2020)
- [Peek Inside the Closed World: Evaluating Autoencoder-Based Detection of DDoS to Cloud](https://mlsanity.com/paper/1912.05590/) (2019)
- [DeLag: Using Multi-Objective Optimization to Enhance the Detection of Latency Degradation Patterns in Service-based Systems](https://mlsanity.com/paper/2110.11155/) (2021)
- [Benchmarking Anomaly Detection Across Heterogeneous Cloud Telemetry Datasets](https://mlsanity.com/paper/2602.13288/) (2026)

## Abstract (arXiv)

With the rapid growth of cloud computing infrastructures in scale and complexity, network monitoring for Large-scale Cloud Systems (LCSs) has become increasingly challenging, requiring automated and reliable anomaly detection to maintain service availability. Modern LCSs continuously generate telemetry logs from distributed cloud services, producing high-dimensional multivariate time series that capture system operations. Detecting anomalies in this context is difficult due to extreme dimensionality, complex dependencies among distributed components, and severe sparsity from intermittently active services. Taking these challenges into account, we first conduct an empirical study on telemetry logs from the IBM Cloud Console platform, and then propose ClouDens, an anomaly detection framework tailored to LCS monitoring that leverages operational-context attributes encoded in the telemetry log schema to improve detection accuracy and early identification of anomalies. ClouDens partitions high-dimensional telemetry logs into domain-guided subsets, constructs a context-aware graph modeling operational service dependencies, and employs Spatio-Temporal Graph Neural Networks for forecasting-based anomaly detection. We evaluate ClouDens on the recently released IBM Cloud Telemetry Dataset and provide practical insights into designing reliable anomaly detection solutions for LCS monitoring. Results show ClouDens achieves higher NAB scores in count-based telemetry features, indicating more accurate, earlier anomaly detection with broader coverage than a GRU-based model. Our study further reveals that telemetry feature subsets, operational-context modeling, scoring strategies, and sparsity imputation all substantially influence detection performance, offering practical guidance for designing and fairly benchmarking anomaly detection approaches for LCS monitoring.