Heterogeneous Anomaly Detection for Software Systems via Attentive Multi-modal Learning

TL;DR

This paper introduces HADES, a novel multi-modal learning approach that effectively integrates logs and metrics for more accurate and comprehensive system anomaly detection, outperforming existing single-source methods.

Contribution

HADES is the first method to fuse heterogeneous data with a hierarchical architecture and cross-modal attention for improved anomaly detection in software systems.

Findings

HADES outperforms baseline methods on large-scale datasets.

Integrating logs and metrics improves detection accuracy.

The approach captures diverse anomaly manifestations across data types.

Abstract

Prompt and accurate detection of system anomalies is essential to ensure the reliability of software systems. Unlike manual efforts that exploit all available run-time information, existing approaches usually leverage only a single type of monitoring data (often logs or metrics) or fail to make effective use of the joint information among multi-source data. Consequently, many false predictions occur. To better understand the manifestations of system anomalies, we conduct a comprehensive empirical study based on a large amount of heterogeneous data, i.e., logs and metrics. Our study demonstrates that system anomalies could manifest distinctly in different data types. Thus, integrating heterogeneous data can help recover the complete picture of a system's health status. In this context, we propose HADES, the first work to effectively identify system anomalies based on heterogeneous data. Our approach employs a hierarchical architecture to learn a global representation of the system status by fusing log semantics and metric patterns. It captures discriminative features and meaningful interactions from multi-modal data via a novel cross-modal attention module, enabling accurate system anomaly detection. We evaluate HADES extensively on large-scale simulated and industrial datasets. The experimental results present the superiority of HADES in detecting system anomalies on heterogeneous data. We release the code and the annotated dataset for reproducibility and future research.