Graph Neural Network and Transformer Integration for Unsupervised System Anomaly Discovery

TL;DR

This paper introduces an unsupervised method combining graph neural networks and Transformers to detect anomalies in distributed systems by modeling structural dependencies and temporal behaviors without labeled data.

Contribution

It presents a novel end-to-end anomaly detection approach that integrates dynamic graph construction, graph convolution, and Transformer-based temporal modeling for the first time in this context.

Findings

Outperforms existing models on real-world cloud data

Demonstrates robustness across different graph depths and sequence lengths

Effectively captures anomaly propagation and dynamic behaviors

Abstract

This study proposes an unsupervised anomaly detection method for distributed backend service systems, addressing practical challenges such as complex structural dependencies, diverse behavioral evolution, and the absence of labeled data. The method constructs a dynamic graph based on service invocation relationships and applies graph convolution to extract high-order structural representations from multi-hop topologies. A Transformer is used to model the temporal behavior of each node, capturing long-term dependencies and local fluctuations. During the feature fusion stage, a learnable joint embedding mechanism integrates structural and behavioral representations into a unified anomaly vector. A nonlinear mapping is then applied to compute anomaly scores, enabling an end-to-end detection process without supervision. Experiments on real-world cloud monitoring data include sensitivity analyses across different graph depths, sequence lengths, and data perturbations. Results show that the proposed method outperforms existing models on several key metrics, demonstrating stronger expressiveness and stability in capturing anomaly propagation paths and modeling dynamic behavior sequences, with high potential for practical deployment.