Pith. sign in

REVIEW 4 major objections 4 minor 73 references

The paper claims that modeling operational dependencies between cloud API activities improves anomaly detection over a purely temporal baseline, with earlier and broader detection on a production cloud telemetry dataset.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 15:54 UTC pith:3JT3TCV2

load-bearing objection Real empirical value in the sensitivity study; the headline graph claim is confounded by the sparsity-flag input and needs an ablation. the 4 major comments →

arxiv 2607.18127 v1 pith:3JT3TCV2 submitted 2026-07-20 cs.NI cs.LG

ClouDens: Operational Context-Aware Anomaly Detection for Large-scale Cloud System Monitoring

Thu T. H. Doan , Mohammad Saiful Islam , Andriy Miranskyy , Ngoc-Thanh Nguyen , Rogardt Heldal , Patrizio Pelliccione This is my paper
classification cs.NI cs.LG
keywords anomaly detectioncloud telemetrymultivariate time seriesspatio-temporal graph neural networksoperational contexttelemetry sparsity imputationNAB scoreforecasting-based detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to show that cloud telemetry anomalies are better detected when the detector is told how services relate to each other, not just how each metric behaves over time. It proposes ClouDens, which splits high-dimensional telemetry into semantically meaningful subsets, builds a graph from operational-context attributes such as deployment location, service component, and endpoint, and feeds that graph to a spatio-temporal graph neural network for forecasting-based detection. On the IBM Cloud Telemetry Dataset, ClouDens reports higher NAB scores than a GRU model on count-based telemetry, catching anomalies the GRU misses and detecting some of them earlier. The paper also establishes that detection performance is strongly influenced by telemetry subset, sparsity imputation, anomaly scoring, and ensemble choice, and argues these factors should be reported when benchmarking cloud anomaly detectors.

Core claim

ClouDens is a forecasting-based anomaly detection framework that embeds operational-context attributes of telemetry logs into a weighted graph and uses a spatio-temporal graph neural network to predict next-step telemetry from historical windows. The central empirical claim is that this graph-aware modeling improves detection: on the 5xx count telemetry subset, ClouDens raises the NAB score from 6.58 to 11.38 under the Standard profile and from 13.16 to 18.11 under the Low FN profile with Likelihood Function scoring, and from 5.89 to 20.94 and 10.95 to 26.24 with Mahalanobis Distance scoring. It detects 7 of 19 ground-truth anomalies with fewer false positives and false negatives than the GR

What carries the argument

The context-aware graph G, whose nodes are API activities and whose weighted edges encode shared operational-context attributes such as datacenter, component, HTTP method, and endpoint. It provides the spatial dependency structure that the ST-GNN forecasting model uses alongside temporal windows; edge weights are meant to reflect the strength of shared context, with self-loops set to one. The graph is what distinguishes ClouDens from a purely temporal GRU and is the mechanism through which localized service failures are expected to propagate detectable forecasting errors.

Load-bearing premise

The load-bearing premise is that the hand-assigned graph edge weights (0.8, 0.6, 0.2) genuinely reflect which API activities are operationally related; if those weights are arbitrary or mis-encode dependencies, the reported improvement over GRU may come from extra model capacity rather than from operational context.

What would settle it

Run ClouDens with the same ST-GNN and training setup but replace the context-derived adjacency matrix with random or fully uniform edge weights on the 5xx count subset; if the NAB scores remain close to the reported 11.38 and 18.11 under Likelihood scoring, the operational-context graph is not the active cause of the improvement.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • On count-based telemetry, ClouDens outperforms the GRU baseline in NAB score, false positive reduction, and anomaly coverage, and detects some anomalies earlier.
  • Count-based subsets are individually the strongest detectors, but avg, min, and max subsets catch anomalies that count-based subsets miss, so a selective ensemble is a direct way to increase coverage.
  • Telemetry sparsity imputation is subset-dependent: zero imputation is best for 5xx count, while mean imputation is best for 4xx count, meaning no single preprocessing choice is universally safe.
  • The scoring strategy changes which anomalies are detected, so detection quality depends on post-processing as much as on the forecasting model.
  • Despite higher training cost, per-timestamp inference of ClouDens stays in the range of 1.5 to 12 milliseconds, keeping it practical for streaming monitoring.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A direct ablation not performed in the paper: replacing the context-derived adjacency weights with random or uniform weights while keeping the same ST-GNN would test whether the reported gains come from operational context or from added model capacity.
  • The sensitivity results suggest that benchmark comparisons on this dataset are underdetermined unless they fix and report imputation, scoring, window size, and ensemble configuration; future comparisons should likely adopt this reporting standard.
  • The hand-crafted context graph could be made learnable: deriving edge weights from observed cross-feature correlations or incident propagation data would make the approach transferable to platforms without a rich telemetry schema.
  • Dynamic graphs that update as services are redeployed or scaled could extend the framework to evolving cloud topologies, which the paper lists as future work.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. ClouDens is an anomaly-detection framework for the IBM Cloud Telemetry Dataset. It partitions telemetry features into subsets by HTTP status-code group and aggregation type, constructs a static 'context-aware' graph from operational-context attributes in the column schema, augments each node with a binary sparsity indicator, and trains an A3T-GCN ST-GNN for one-step-ahead forecasting. Forecast errors are scored with a Likelihood Function or Mahalanobis Distance, thresholded per subset, and combined with a one-vote ensemble. The paper reports that on the 5xx count subset ClouDens outperforms a GRU baseline in NAB score, coverage, and earliness (Table IV), and that detection is strongly influenced by subset, imputation, scoring strategy, and ensemble configuration. The central claim is that operational-context graph modeling is the source of the improvement, supported by an empirical study and released code.

Significance. If the central claim were cleanly established, the paper would be a useful contribution: it is, to my knowledge, the first study to exploit the IBM Cloud Telemetry Dataset's column-schema context for graph construction, it uses a real production dataset with 19 annotated test anomalies, it investigates several practically important design dimensions (subset decomposition, imputation, scoring, ensembling), and the replication package is a concrete strength. However, the headline EQ1 comparison is currently confounded: the sparsity indicator is an extra input given to ClouDens but not to the GRU baseline, and the context-graph edge weights are not specified. Until an ablation separates the graph from the sparsity flag and the graph construction is precisely defined, the reported NAB gains cannot be attributed to operational-context modeling.

major comments (4)
  1. [IV-C1 / V-C1, Eq. (7)-(9), Table IV] The comparison supporting EQ1 is confounded. ClouDens augments each node's input with a binary sparsity indicator M, giving [value, missing_flag] (Eqs. 7-9), while the GRU baseline in V-A2 is described as receiving only the telemetry values. On 5xx count, which is 99.02% sparse, M alone could let the forecaster discount imputed zeros and produce sharper errors, independent of the graph. The reported gains (6.58 -> 11.38 Standard, 13.16 -> 18.11 Low FN, Table IV) therefore conflate the graph contribution with an extra input channel. Please add ablations: ClouDens without M, and GRU with M, on the same subsets and both scoring strategies. Without this, the EQ1 answer that context-aware graph modeling 'significantly improves' detection is not supported.
  2. [IV-C, Definition 1 and Fig. 3] The weighted adjacency matrix is the load-bearing component of the framework, but no formula or calibration procedure is given for the edge weights. Definition 1 only says that larger values reflect stronger operational relationships; the text then cites example weights 0.8, 0.6, and 0.2 that appear illustrative. The figure is also internally inconsistent: the text says nodes 0 and 2 share 'HTTP method' and receive weight 0.8, but node 0 is GET and node 2 is POST. A precise definition (e.g., a normalized count of shared attributes, a learned attention weight, or a tunable table) is necessary for reproducibility and to rule out arbitrary weights as the source of the reported improvement. The Limitations section mentions manual graph construction, but the missing specification is a reproducibility issue, not just a generality issue.
  3. [V-B4 / V-C3, Table III and Fig. 7] Several fitted choices are selected per subset on the validation split and then presented as the final ClouDens result: imputation strategy (zero/mean/median), LF threshold L_t, and MD percentile ϵ are all tuned per subset (Table III), and Fig. 7 reports each model under its best imputation. This makes the EQ3 conclusion 'ClouDens consistently achieves higher and more stable NAB scores ... once paired with its best-performing sparsity imputation strategy' a selected-maximum statement rather than a comparison under a fixed protocol. Please report the full imputation-by-subset grid side by side for both models, state whether GRU received the same per-subset tuning, and include multiple random seeds with error bars or a significance test, since Table IV reports only point estimates.
  4. [V-A2 / V-C1, Table IV] The evaluation has a single baseline (GRU) and no ablation that isolates the graph topology while keeping all other model components fixed. The reported improvement could in principle come from model capacity (A3T-GCN vs GRU), the sparsity flag, the graph weights, or the per-subset threshold optimization. At minimum, please add a non-graph neural baseline with the same number of parameters/inputs, or an A3T-GCN run with an empty/identity adjacency matrix, so that the graph's marginal contribution is identified. The paper's honest 'we employ A3T-GCN only to demonstrate the benefit' framing in the Limitations is appreciated, but the current experiments do not yet isolate that benefit.
minor comments (4)
  1. [II-B, Eq. (3)] The sliding-window notation X'(t-w+1), ..., X'(t) is used as if each term is a column vector, while X' is defined as an F x T matrix. Please clarify row/column orientation in Eq. (3) and Eq. (10).
  2. [IV-C1] The sparsity indicator is described as 'optionally' augmenting each node, but all reported experiments appear to use it. Please state explicitly whether any experiment runs without M, and if not, describe the ablation as future work rather than optional.
  3. [Fig. 5] The text refers to a 'green marker' for early detection; the marker is not clearly visible in the grayscale figure. Use a distinct symbol or annotate the timestamp explicitly.
  4. [VI] The section header 'Threats to V alidity' contains an unintended space; also check for similar typographical artifacts in the camera-ready version.

Circularity Check

0 steps flagged

No significant circularity; the central claim is empirical, and the graph/flag confound is a validity threat, not a circular reduction.

full rationale

We walked the claimed derivation chain: telemetry decomposition by status code and aggregation type, context-aware graph construction from schema-level operational attributes, node feature augmentation with a sparsity indicator, ST-GNN forecasting, residual-based anomaly scoring, thresholding, and one-vote ensembling. No step defines its target in terms of its inputs: the graph adjacency weights are set from shared operational-context attributes (Definition 1), not from anomaly labels; forecasting errors are computed against withheld test observations; and NAB scores are computed from residual scoring with thresholds selected on a validation split. The EQ1 comparison is indeed confounded because ClouDens augments each node with a binary sparsity flag (Eqs. 7-9) that the GRU baseline does not receive, and because ClouDens uses the A3T-GCN architecture while the baseline is a plain GRU; this means the reported improvement cannot be cleanly attributed to the context-aware graph. However, this is a confound and an internal-validity threat, not a circularity: no equation in the paper reduces the claimed improvement to the fitted inputs by construction, and the missing-flag feature is an extra input channel rather than a renamed version of the score. The self-citations to Islam et al. [11] provide an externally released dataset with anomaly labels derived from multiple operational sources, so they constitute independent evidence rather than a load-bearing self-citation chain. The under-specified graph weights (Fig. 3) and the post-hoc selection among ensemble configurations are reproducibility/robustness concerns, but they do not make the derivation circular. We therefore find no circular step requiring a positive score.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 0 invented entities

The central claim rests on a set of validation-fitted thresholds and imputation choices, plus an informally specified graph weighting scheme. No new physical entities are introduced; the main burden is configuration freedom rather than theoretical assumptions.

free parameters (6)
  • LF threshold L_t per subset = e.g., 0.99975 for 5xx count; range 0.998-0.9998
    Grid-searched on validation to maximize NAB Low FN; affects which timestamps are flagged.
  • MD percentile epsilon per subset = e.g., 99.8 for 5xx count; range 99.5-99.9
    Grid-searched on validation; determines anomaly threshold.
  • Sparsity imputation strategy per subset = zero/mean/median (e.g., zero for 5xx count, mean for 4xx count)
    Selected per subset as best on validation; strongly affects NAB.
  • Context-graph edge weights = 0.8 / 0.6 / 0.2 in Fig. 3; no formula
    Hand-assigned based on shared attributes; not defined formally, so effectively free parameters.
  • Sliding window size w = 6 (main); varied 6-30
    Chosen empirically; sensitivity analyzed.
  • Forecasting hyperparameters = 32 hidden channels, lr 0.001, batch 32
    Same for both models, but not justified; chosen empirically.
axioms (4)
  • domain assumption Shared operational-context attributes imply correlated telemetry behavior.
    Used to construct context-aware graph in §IV-C; if false, graph edges add noise rather than signal.
  • domain assumption Forecasting errors are a valid anomaly signal.
    §II-B formulates anomaly detection as forecasting; assumes large deviations indicate anomalies.
  • domain assumption Ground-truth anomaly labels from Issue Tracker, Test Log, and Instant Messenger are complete and accurate.
    §V-B.2; incomplete labels would bias NAB and confusion-matrix results, acknowledged in threats to validity.
  • standard math Mahalanobis distance requires invertible covariance of forecasting errors.
    Equation 11 in §IV-D; with F=2,406 features, covariance estimation may be unstable; no regularization mentioned.

pith-pipeline@v1.3.0-alltime-deepseek · 23296 in / 12164 out tokens · 115657 ms · 2026-08-01T15:54:18.186845+00:00 · methodology

0 comments
read the original abstract

With the rapid growth of cloud computing infrastructures in scale and complexity, network monitoring for Large-scale Cloud Systems (LCSs) has become increasingly challenging, requiring automated and reliable anomaly detection to maintain service availability. Modern LCSs continuously generate telemetry logs from distributed cloud services, producing high-dimensional multivariate time series that capture system operations. Detecting anomalies in this context is difficult due to extreme dimensionality, complex dependencies among distributed components, and severe sparsity from intermittently active services. Taking these challenges into account, we first conduct an empirical study on telemetry logs from the IBM Cloud Console platform, and then propose ClouDens, an anomaly detection framework tailored to LCS monitoring that leverages operational-context attributes encoded in the telemetry log schema to improve detection accuracy and early identification of anomalies. ClouDens partitions high-dimensional telemetry logs into domain-guided subsets, constructs a context-aware graph modeling operational service dependencies, and employs Spatio-Temporal Graph Neural Networks for forecasting-based anomaly detection. We evaluate ClouDens on the recently released IBM Cloud Telemetry Dataset and provide practical insights into designing reliable anomaly detection solutions for LCS monitoring. Results show ClouDens achieves higher NAB scores in count-based telemetry features, indicating more accurate, earlier anomaly detection with broader coverage than a GRU-based model. Our study further reveals that telemetry feature subsets, operational-context modeling, scoring strategies, and sparsity imputation all substantially influence detection performance, offering practical guidance for designing and fairly benchmarking anomaly detection approaches for LCS monitoring.

Figures

Figures reproduced from arXiv: 2607.18127 by Andriy Miranskyy, Mohammad Saiful Islam, Ngoc-Thanh Nguyen, Patrizio Pelliccione, Rogardt Heldal, Thu T. H. Doan.

Figure 1
Figure 1. Figure 1: Overview of telemetry-driven anomaly detection for [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Workflow of ClouDens. The pivoted telemetry dataset is partitioned into telemetry subsets based on HTTP status code [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Context-aware graph: nodes are API activities; edge [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Sum of count of 5xx count subset as MTS and several anomalies detected by ClouDens [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: An illustration of detected anomalies from GRU and ClouDens. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Detected anomalies captured by each subset. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Impact of sliding windows and telemetry sparsity [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Impact of sliding windows on Training/Inference Time. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

73 extracted references · 7 canonical work pages

  1. [1]

    Lightweight and adaptive service api performance monitoring in highly dynamic cloud environment,

    J. Xu, Y . Wang, P. Chen, and P. Wang, “Lightweight and adaptive service api performance monitoring in highly dynamic cloud environment,” in 2017 IEEE International Conference on Services Computing (SCC), 2017, pp. 35–43

    2017

  2. [2]

    The rise of “big data

    I. A. T. Hashem, I. Yaqoob, N. B. Anuar, S. Mokhtar, A. Gani, and S. Ullah Khan, “The rise of “big data” on cloud computing: Review and open research issues,”Information Systems, 2015. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0306437914001288

    2015

  3. [3]

    A systematic review on anomaly detection for cloud computing environments,

    T. Hagemann and K. Katsarou, “A systematic review on anomaly detection for cloud computing environments,” inProceedings of the 2020 3rd Artificial Intelligence and Cloud Computing Conference, ser. AICCC ’20. New York, NY , USA: Association for Computing Machinery, 2021, p. 83–96. [Online]. Available: https://doi.org/10.1145/3442536.3442550

    arXiv 2020

  4. [4]

    Robust and accurate performance anomaly detection and prediction for cloud applications: a novel ensemble learning-based framework,

    R. Xin, H. Liu, P. Chen, and Z. Zhao, “Robust and accurate performance anomaly detection and prediction for cloud applications: a novel ensemble learning-based framework,”J. Cloud Comput., vol. 12, no. 1, Jan. 2023. [Online]. Available: https://doi.org/10.1186/s13677-0 22-00383-6

    work page doi:10.1186/s13677-0 2023

  5. [5]

    (2024, Nov

    Gartner, Inc. (2024, Nov. 19) Gartner forecasts worldwide public cloud end-user spending to total $723 billion in 2025. 2024. [Online]. Available: https://www.gartner.com/en/newsroom/press-releases/2024-1 1-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-t otal-723-billion-dollars-in-2025

    2024

  6. [6]

    Architectural styles and the de- sign of network-based software architectures,

    R. T. Fielding and R. N. Taylor, “Architectural styles and the de- sign of network-based software architectures,” Ph.D. dissertation, 2000, aAI9980887

    2000

  7. [7]

    Microservice api evolution in practice: A study on strategies and challenges,

    A. Lercher, J. Glock, C. Macho, and M. Pinzger, “Microservice api evolution in practice: A study on strategies and challenges,”Journal of Systems and Software, vol. 215, p. 112110, 2024. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0164121224001559

    2024

  8. [8]

    Towards a lightweight dis- tributed telemetry for microservices,

    M. Otero, J. M. Garcia, and P. Fernandez, “Towards a lightweight dis- tributed telemetry for microservices,” in2024 IEEE 44th International Conference on Distributed Computing Systems Workshops (ICDCSW), 2024, pp. 75–82

    2024

  9. [9]

    Anomaly detection in a large-scale cloud platform,

    M. S. Islam, W. Pourmajidi, L. Zhang, J. Steinbacher, T. Erwin, and A. Miranskyy, “Anomaly detection in a large-scale cloud platform,” in 2021 IEEE/ACM 43rd International Conference on Software Engineer- ing: Software Engineering in Practice (ICSE-SEIP). IEEE, 2021

    2021

  10. [10]

    Predicting cloud-native application failures based on monitoring data of cloud infrastructure,

    L. Toka, G. Dobreff, D. Haja, and M. Szalay, “Predicting cloud-native application failures based on monitoring data of cloud infrastructure,” in2021 IFIP/IEEE International Symposium on Integrated Network Management (IM), 2021, pp. 842–847

    2021

  11. [11]

    Anomaly detection in large-scale cloud systems: An industry case and dataset,

    M. S. Islam, M. S. Rakha, W. Pourmajidi, J. Sivaloganathan, J. Steinbacher, and A. Miranskyy, “Anomaly detection in large-scale cloud systems: An industry case and dataset,” in2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP). IEEE, Apr. 2025. [Online]. Available: http://dx.doi.org/10.1109/IC...

    arXiv 2025

  12. [12]

    Survey cloud monitoring: A survey,

    G. Aceto, A. Botta, W. De Donato, and A. Pescap `e, “Survey cloud monitoring: A survey,”Comput. Netw., vol. 57, no. 9, p. 2093–2115, Jun

    2093

  13. [13]

    Machine learning based cloud computing anomalies detection,

    Z. Chkirbene, A. Erbad, R. Hamila, A. Gouissem, A. Mohamed, and M. Hamdi, “Machine learning based cloud computing anomalies detection,”Netwrk. Mag. of Global Internetwkg., vol. 34, no. 6, p. 178–183, Nov. 2020. [Online]. Available: https://doi.org/10.1109/MN ET.011.2000097

    work page doi:10.1109/mn 2020

  14. [14]

    Monitoring data for anomaly detection in cloud-based systems: A systematic mapping study,

    A. Hrusto, N. b. Ali, E. Engstr ¨om, and Y . Wang, “Monitoring data for anomaly detection in cloud-based systems: A systematic mapping study,”ACM Trans. Softw. Eng. Methodol., vol. 35, no. 4, Mar. 2026. [Online]. Available: https://doi.org/10.1145/3744556

    doi:10.1145/3744556 2026

  15. [15]

    Operational-log analysis for big data systems: Challenges and solu- tions,

    A. Miranskyy, A. Hamou-Lhadj, E. Cialini, and A. Larsson, “Operational-log analysis for big data systems: Challenges and solu- tions,”IEEE Software, vol. 33, no. 2, pp. 52–59, 2016

    2016

  16. [16]

    On challenges of cloud monitoring,

    W. Pourmajidi, J. Steinbacher, T. Erwin, and A. Miranskyy, “On challenges of cloud monitoring,” inProceedings of the 27th Annual International Conference on Computer Science and Software Engineering, 2017, pp. 259–265. [Online]. Available: https://arxiv.org/abs/1806.05914

    Pith/arXiv arXiv 2017

  17. [17]

    Dogfooding: Using ibm cloud services to monitor ibm cloud infras- tructure,

    W. Pourmajidi, A. Miranskyy, J. Steinbacher, T. Erwin, and D. Godwin, “Dogfooding: Using ibm cloud services to monitor ibm cloud infras- tructure,” inProceedings of the 29th Annual International Conference on Computer Science and Software Engineering, 2019, pp. 344–353

    2019

  18. [18]

    The challenging landscape of cloud monitoring,

    W. Pourmajidi, L. Zhang, A. Miranskyy, J. Steinbacher, D. Godwin, and T. Erwin, “The challenging landscape of cloud monitoring,” in Knowledge Management in the Development of Data-Intensive Systems. CRC Press, 2021, pp. 157–189

    2021

  19. [19]

    Anomaly detection in cloud compo- nents,

    M. S. Islam and A. Miranskyy, “Anomaly detection in cloud compo- nents,” in2020 IEEE 13th international conference on cloud computing (CLOUD). IEEE, 2020, pp. 1–3

    2020

  20. [20]

    On the properties of neural machine translation: Encoder-decoder approaches,

    K. Cho, B. van Merrienboer, D. Bahdanau, and Y . Bengio, “On the properties of neural machine translation: Encoder-decoder approaches,”

  21. [21]

    Replication package of ClouDens,

    Thu T. H. Doan, “Replication package of ClouDens,” https://github.c om/doanthihoaithu/cloudens.git, 2026

    2026

  22. [22]

    Dataset for the paper

    M. S. Islam, M. S. Rakha, W. Pourmajidi, J. Sivaloganathan, J. Steinbacher, and A. Miranskyy, “Dataset for the paper ”anomaly detection in large-scale cloud systems: An industry case and dataset”,” Nov. 2024. [Online]. Available: https://doi.org/10.5281/zenodo.14062 900

    work page doi:10.5281/zenodo.14062 2024

  23. [23]

    Evaluating real-time anomaly detection algorithms – the numenta anomaly benchmark,

    A. Lavin and S. Ahmad, “Evaluating real-time anomaly detection algorithms – the numenta anomaly benchmark,” in2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA). IEEE, Dec. 2015. [Online]. Available: http://dx.doi.org/10. 1109/ICMLA.2015.141

    2015

  24. [24]

    Microsoft cloud monitoring dataset,

    Microsoft, “Microsoft cloud monitoring dataset,” 2023, https://github.c om/microsoft/cloud-monitoring-dataset

    2023

  25. [25]

    Exathlon: A benchmark for explainable anomaly detection over time series,

    V . Jacob, F. Songet al., “Exathlon: A benchmark for explainable anomaly detection over time series,”Proceedings of the VLDB Endow- ment, vol. 14, no. 11, pp. 2613–2626, 2021

    2021

  26. [26]

    Dive into time-series anomaly detection: A decade review,

    P. Boniol, Q. Liu, M. Huang, T. Palpanas, and J. Paparrizos, “Dive into time-series anomaly detection: A decade review,” 2024. [Online]. Available: https://arxiv.org/abs/2412.20512

    Pith/arXiv arXiv 2024

  27. [27]

    Advances in time-series anomaly detection: Algorithms, benchmarks, and evaluation measures,

    J. Paparrizos, P. Boniol, Q. Liu, and T. Palpanas, “Advances in time-series anomaly detection: Algorithms, benchmarks, and evaluation measures,” inProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V .2, ser. KDD ’25. New York, NY , USA: Association for Computing Machinery, 2025, p. 6151–6161. [Online]. Available: https:/...

    arXiv 2025

  28. [28]

    Gatev,Observability: Logs, Metrics, and Traces

    R. Gatev,Observability: Logs, Metrics, and Traces. Berkeley, CA: Apress, 2021, pp. 233–252. [Online]. Available: https://doi.org/10.100 7/978-1-4842-6998-5 12

    2021

  29. [29]

    Anomaly detection on interleaved log data with semantic association mining on log-entity graph,

    G. Chu, J. Wang, Q. Qi, H. Sun, Z. Zhuang, B. He, Y . Jing, L. Zhang, and J. Liao, “Anomaly detection on interleaved log data with semantic association mining on log-entity graph,”IEEE Trans. Softw. Eng., vol. 51, no. 2, p. 581–594, Feb. 2025. [Online]. Available: https://doi.org/10.1109/TSE.2025.3527856

    arXiv 2025

  30. [30]

    Benchmarking anomaly detection across heterogeneous cloud telemetry datasets,

    M. S. Islam and A. Miranskyy, “Benchmarking anomaly detection across heterogeneous cloud telemetry datasets,” 2026, arXiv preprint arXiv:2602.13288. [Online]. Available: https://arxiv.org/abs/2602.13288

    arXiv 2026

  31. [31]

    Outlier detection for high dimensional data,

    C. C. Aggarwal and P. S. Yu, “Outlier detection for high dimensional data,”SIGMOD Rec., vol. 30, no. 2, p. 37–46, May 2001. [Online]. Available: https://doi.org/10.1145/376284.375668

    arXiv 2001

  32. [32]

    Unsupervised anomaly event detection for vnf service monitoring using multivariate online arima,

    F. Schmidt, F. Suri-Payer, A. Gulenko, M. Wallschl ¨ager, A. Acker, and O. Kao, “Unsupervised anomaly event detection for vnf service monitoring using multivariate online arima,” in2018 IEEE International Conference on Cloud Computing Technology and Science (CloudCom), 2018, pp. 278–283

    2018

  33. [33]

    Framework for automatic detection of anomalies in devops,

    A. Hany Fawzy, K. Wassif, and H. Moussa, “Framework for automatic detection of anomalies in devops,”Journal of King Saud University - Computer and Information Sciences, vol. 35, no. 3, pp. 8–19, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S1319157823000393

    2023

  34. [34]

    Anomaly detection and diagnosis for container-based microservices with performance monitoring,

    Q. Du, T. Xie, and Y . He, “Anomaly detection and diagnosis for container-based microservices with performance monitoring,” inAlgo- rithms and Architectures for Parallel Processing, J. Vaidya and J. Li, Eds. Cham: Springer International Publishing, 2018, pp. 560–572

    2018

  35. [35]

    Delag: Using multi-objective optimization to enhance the detection of latency degradation patterns in service-based systems,

    L. Traini and V . Cortellessa, “Delag: Using multi-objective optimization to enhance the detection of latency degradation patterns in service-based systems,”IEEE Transactions on Software Engineering, p. 1–28, 2023. [Online]. Available: http://dx.doi.org/10.1109/TSE.2023.3266041 16

    arXiv 2023

  36. [36]

    Anomaly detection on openstack logs based on an improved robust principal component analysis model and its projection onto column space,

    P. S. Kalaki, A. Shameli-Sendi, and B. K. E. Abbasi, “Anomaly detection on openstack logs based on an improved robust principal component analysis model and its projection onto column space,”Software: Practice and Experience, vol. 53, no. 3, pp. 665–681, 2023. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/spe.3164

    work page doi:10.1002/spe.3164 2023

  37. [37]

    Performance anomaly detection using isolation-trees in hetero- geneous workloads of web applications in computing clouds,

    S. Kardani-Moghaddam, R. Buyya, and K. Ramamohanarao, “Performance anomaly detection using isolation-trees in hetero- geneous workloads of web applications in computing clouds,” Concurrency and Computation: Practice and Experience, vol. 31, no. 20, p. e5306, 2019, e5306 cpe.5306. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/cpe.5306

    work page doi:10.1002/cpe.5306 2019

  38. [38]

    Anomaly detection of system behavior in cloud computing environments based on one-class svm,

    S. Nan, R. Xie, and L. Chen, “Anomaly detection of system behavior in cloud computing environments based on one-class svm,” inProceedings of the 2023 6th International Conference on Artificial Intelligence and Pattern Recognition, ser. AIPR ’23. New York, NY , USA: Association for Computing Machinery, 2024, p. 1504–1510. [Online]. Available: https://doi.o...

    arXiv 2023

  39. [39]

    A comprehensive survey of anomaly detection techniques for high dimensional big data,

    S. Thudumu, P. Branch, J. Jin, and J. Singh, “A comprehensive survey of anomaly detection techniques for high dimensional big data,”Journal of Big Data, vol. 7, no. 1, p. 42, 2020

    2020

  40. [40]

    A hybrid deep learning anomaly detection framework for intrusion detection,

    R. Kale, Z. Lu, K. W. Fok, and V . L. L. Thing, “A hybrid deep learning anomaly detection framework for intrusion detection,” in 2022 IEEE 8th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing, (HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS). IEEE, May 2022....

    arXiv 2022

  41. [41]

    Online malware detection in cloud auto-scaling systems using shallow convolutional neural networks,

    M. Abdelsalam, R. Krishnan, and R. Sandhu, “Online malware detection in cloud auto-scaling systems using shallow convolutional neural networks,” inData and Applications Security and Privacy XXXIII: 33rd Annual IFIP WG 11.3 Conference, DBSec 2019, Charleston, SC, USA, July 15–17, 2019, Proceedings. Berlin, Heidelberg: Springer-Verlag, 2019, p. 381–397. [On...

    work page doi:10.1007/978-3-030-22479-0 2019

  42. [42]

    Deeplog: Anomaly detection and diagnosis from system logs through deep learning,

    M. Du, F. Li, G. Zheng, and V . Srikumar, “Deeplog: Anomaly detection and diagnosis from system logs through deep learning,” inProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’17. New York, NY , USA: Association for Computing Machinery, 2017, p. 1285–1298. [Online]. Available: https://doi.org/10.1145/3133956.3134015

    arXiv 2017

  43. [43]

    Deep anomaly detection in packet payload,

    J. Liu, X. Song, Y . Zhou, X. Peng, Y . Zhang, P. Liu, and D. Wu, “Deep anomaly detection in packet payload,” 2019. [Online]. Available: https://arxiv.org/abs/1912.02549

    Pith/arXiv arXiv 2019

  44. [44]

    Reconstruction-based anomaly detection for the cloud: A comparison on the yahoo! webscope s5 dataset,

    T. Hagemann and K. Katsarou, “Reconstruction-based anomaly detection for the cloud: A comparison on the yahoo! webscope s5 dataset,” inProceedings of the 2020 4th International Conference on Cloud and Big Data Computing, ser. ICCBDC ’20. New York, NY , USA: Association for Computing Machinery, 2020, p. 68–75. [Online]. Available: https://doi.org/10.1145/3...

    arXiv 2020

  45. [45]

    Peek inside the closed world: Evaluating autoencoder-based detection of ddos to cloud,

    H. Guo, X. Fan, A. Cao, G. Outhred, and J. Heidemann, “Peek inside the closed world: Evaluating autoencoder-based detection of ddos to cloud,” 2020. [Online]. Available: https://arxiv.org/abs/1912.05590

    Pith/arXiv arXiv 2020

  46. [46]

    itransformer: Inverted transformers are effective for time series forecasting,

    Y . Liu, T. Hu, H. Zhang, H. Wu, S. Wang, L. Ma, and M. Long, “itransformer: Inverted transformers are effective for time series forecasting,” 2024. [Online]. Available: https://arxiv.org/abs/2310.06625

    Pith/arXiv arXiv 2024

  47. [47]

    Tracegra: A trace-based anomaly detection for microservice using graph deep learning,

    J. Chen, F. Liu, J. Jiang, G. Zhong, D. Xu, Z. Tan, and S. Shi, “Tracegra: A trace-based anomaly detection for microservice using graph deep learning,”Computer Communications, vol. 204, pp. 109–117, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S0140366423001135

    2023

  48. [48]

    Lstd-mts: Anomaly detection with capturing long-term spatio-temporal dependence for multi-dimensional time series,

    H. Zeng, N. Chen, and T. Deng, “Lstd-mts: Anomaly detection with capturing long-term spatio-temporal dependence for multi-dimensional time series,” inProceedings of the 15th Asia-Pacific Symposium on Internetware, ser. Internetware ’24. New York, NY , USA: Association for Computing Machinery, 2024, p. 397–406. [Online]. Available: https://doi.org/10.1145/...

    arXiv 2024

  49. [49]

    A survey on graph neural networks for time series: Forecasting, classification, imputation, and anomaly detection,

    M. Jin, H. Y . Koh, Q. Wen, D. Zambon, C. Alippi, G. I. Webb, I. King, and S. Pan, “A survey on graph neural networks for time series: Forecasting, classification, imputation, and anomaly detection,”

  50. [50]

    Convolutional neural networks on graphs with fast localized spectral filtering,

    M. Defferrard, X. Bresson, and P. Vandergheynst, “Convolutional neural networks on graphs with fast localized spectral filtering,” 2017. [Online]. Available: https://arxiv.org/abs/1606.09375

    Pith/arXiv arXiv 2017

  51. [51]

    Graph attention networks,

    P. Veli ˇckovi´c, G. Cucurull, A. Casanova, A. Romero, P. Li `o, and Y . Bengio, “Graph attention networks,” 2018. [Online]. Available: https://arxiv.org/abs/1710.10903

    Pith/arXiv arXiv 2018

  52. [52]

    Graph neural net- works for metrics prediction in microservice architecture,

    A. Golovkina, D. Mogilnikov, and V . Ruzhnikov, “Graph neural net- works for metrics prediction in microservice architecture,” inCom- putational Science and Its Applications – ICCSA 2024 Workshops, O. Gervasi, B. Murgante, C. Garau, D. Taniar, A. M. A. C. Rocha, and M. N. Faginas Lago, Eds. Cham: Springer Nature Switzerland, 2024, pp. 343–357

    2024

  53. [53]

    Explainable graph ensemble learning for multivariate time series anomaly detection in cloud microservice archi- tectures,

    K. O’Shea, S. Yan, M. Yu, X. Chen, S. Mauceri, B. Dhariyal, L. Xu, N. O’Connor, and M. Liu, “Explainable graph ensemble learning for multivariate time series anomaly detection in cloud microservice archi- tectures,”IEEE Transactions on Cloud Computing, pp. 1–15, 2025

    2025

  54. [54]

    A survey on unsupervised outlier detection in high-dimensional numerical data,

    A. Zimek, E. Schubert, and P. Kr ¨oger, “A survey on unsupervised outlier detection in high-dimensional numerical data,”Statistical Analysis and Data Mining, vol. 5, pp. 363–387, 10 2012

    2012

  55. [55]

    A systematic literature review of spatio-temporal graph neural network models for time series forecasting and classification,

    F. Corradini, F. Gerosa, M. Gori, C. Lucheroni, M. Piangerelli, and M. Zannotti, “A systematic literature review of spatio-temporal graph neural network models for time series forecasting and classification,”

  56. [56]

    Long short term memory networks for anomaly detection in time series,

    P. Malhotra, L. Vig, G. M. Shroff, and P. Agarwal, “Long short term memory networks for anomaly detection in time series,” inThe European Symposium on Artificial Neural Networks, 2015. [Online]. Available: https://api.semanticscholar.org/CorpusID:43680425

    2015

  57. [57]

    Anomaly detection in clouds: Challenges and practice,

    K. Ye, “Anomaly detection in clouds: Challenges and practice,” inProceedings of the First Workshop on Emerging Technologies for Software-Defined and Reconfigurable Hardware-Accelerated Cloud Datacenters, ser. ETCD’17. New York, NY , USA: Association for Computing Machinery, 2017. [Online]. Available: https://doi.org/10.1 145/3129457.3129497

    arXiv 2017

  58. [58]

    Forecast evaluation for data scientists: Common pitfalls and best practices,

    H. Hewamalage, K. Ackermann, and C. Bergmeir, “Forecast evaluation for data scientists: Common pitfalls and best practices,” 2022. [Online]. Available: https://arxiv.org/abs/2203.10716

    Pith/arXiv arXiv 2022

  59. [59]

    Unsupervised real-time anomaly detection for streaming data,

    S. Ahmad, A. Lavin, S. Purdy, and Z. Agha, “Unsupervised real-time anomaly detection for streaming data,”Neurocomputing, 2017, online Real-Time Learning Strategies for Data Streams. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0925231217309864

    2017

  60. [60]

    Reprint of: Mahalanobis, p.c. (1936)

    P. C. Mahalanobis, “Reprint of: Mahalanobis, p.c. (1936) ”on the generalised distance in statistics.”,”Sankhya A, vol. 80, 2018. [Online]. Available: https://api.semanticscholar.org/CorpusID:239595337

    1936

  61. [61]

    Detecting multivariate outliers: Use a robust variant of the mahalanobis distance,

    C. Leys, O. Klein, Y . Dominicy, and C. Ley, “Detecting multivariate outliers: Use a robust variant of the mahalanobis distance,”Journal of Experimental Social Psychology, vol. 74, 2018. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0022103117302123

    2018

  62. [62]

    Temporal dependence mahalanobis distance for anomaly detection in multivariate spacecraft telemetry series,

    J. Pang, D. Liu, Y . Peng, and X. Peng, “Temporal dependence mahalanobis distance for anomaly detection in multivariate spacecraft telemetry series,”ISA Transactions, vol. 140, pp. 354–367, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S0019057823002574

    2023

  63. [63]

    A review and comparison of strategies for multi-step ahead time series forecasting based on the nn5 forecasting competition,

    S. B. Taieb, G. Bontempi, A. Atiya, and A. Sorjamaa, “A review and comparison of strategies for multi-step ahead time series forecasting based on the nn5 forecasting competition,” 2011. [Online]. Available: https://arxiv.org/abs/1108.3259

    Pith/arXiv arXiv 2011

  64. [64]

    Anomaly detectors for multivariate time series: The proof of the pudding is in the eating,

    P. Wenig, S. Schmidl, and T. Papenbrock, “Anomaly detectors for multivariate time series: The proof of the pudding is in the eating,” in2024 IEEE 40th International Conference on Data Engineering Workshops (ICDEW), 2024, pp. 96–101

    2024

  65. [65]

    A3t-gcn: Attention temporal graph convolutional network for traffic forecasting,

    J. Zhu, Y . Song, L. Zhao, and H. Li, “A3t-gcn: Attention temporal graph convolutional network for traffic forecasting,” 2020. [Online]. Available: https://arxiv.org/abs/2006.11583

    Pith/arXiv arXiv 2020

  66. [66]

    Pytorch geometric temporal: Spatiotemporal signal processing with neural machine learning models,

    B. Rozemberczki, P. Scherer, Y . He, G. Panagopoulos, A. Riedel, M. Astefanoaei, O. Kiss, F. Beres, G. L ´opez, N. Collignon, and R. Sarkar, “Pytorch geometric temporal: Spatiotemporal signal processing with neural machine learning models,” inProceedings of the 30th ACM International Conference on Information & Knowledge Management, ser. CIKM ’21. New Yor...

    arXiv 2021

  67. [67]

    Navigating the metric maze: A taxonomy of evaluation metrics for anomaly detection in time series,

    S. Sørbø and M. Ruocco, “Navigating the metric maze: A taxonomy of evaluation metrics for anomaly detection in time series,” 2023. [Online]. Available: https://arxiv.org/abs/2303.01272

    Pith/arXiv arXiv 2023

  68. [68]

    Wohlin, P

    C. Wohlin, P. Runeson, M. H ¨ost, M. Ohlsson, B. Regnell, and A. Wessl ´en,Experimentation in Software Engineering, ser. Computer Science. Springer Berlin Heidelberg, 2012

    2012

  69. [69]

    Yin,Case Study Research: Design and Methods, ser

    R. Yin,Case Study Research: Design and Methods, ser. Applied Social Research Methods. SAGE Publications, 2009

    2009

  70. [2013]

    Available: https://doi.org/10.1016/j.comnet.2013.04.001

    [Online]. Available: https://doi.org/10.1016/j.comnet.2013.04.001

    work page doi:10.1016/j.comnet.2013.04.001 2013

  71. [2014]

    Available: https://arxiv.org/abs/1409.1259

    [Online]. Available: https://arxiv.org/abs/1409.1259

    Pith/arXiv arXiv

  72. [2024]

    Available: https://arxiv.org/abs/2307.03759

    [Online]. Available: https://arxiv.org/abs/2307.03759

    Pith/arXiv arXiv

  73. [2025]

    Available: https://arxiv.org/abs/2410.22377

    [Online]. Available: https://arxiv.org/abs/2410.22377

    arXiv