arXiv:2501.16875cs.SEcs.LG2025-01中稿 · WWW' 25被引 7

通过细粒度关联与频域分析,提升网页服务异常检测准确率

Enhancing Web Service Anomaly Detection via Fine-grained Multi-modal Association and Frequency Domain Analysis

  • 构建日志-指标关系图,用图算法实现精准多模态对齐
  • 引入频域聚焦机制,有效避免正常模式过度泛化
  • 在三个数据集上平均F1达93.6%,优于现有方法8.8%

异常检测对于保障网页服务系统的稳定性和可靠性至关重要。日志和指标包含反映系统运行状态及潜在异常的多种信息。现有方法通过数据融合,利用粗粒度时间窗口对齐来关联日志与指标,并通过重构捕捉正常模式。然而,这些方法存在两个关键问题:其一,日志与指标间的异步性导致粗粒度对齐难以实现精确关联;其二,基于重构的方法存在严重过泛化问题,导致异常被错误地重建。本文提出一种名为FFAD的新方法以解决上述问题。一方面,FFAD采用基于图的对齐策略,从构建的日志-指标关系图中挖掘并提取模态间的关联,实现日志与指标的精确对齐;另一方面,通过傅里叶频域聚焦(Fourier Frequency Focus)增强模型对正常数据分布的拟合能力,从而提升异常检测效果。我们在两个真实工业数据集和一个开源数据集上验证了模型有效性,结果表明,该方法平均异常检测F1分数达到93.6%,相比之前最先进方法提升8.8%。

原文摘要 · Abstract (English)

Anomaly detection is crucial for ensuring the stability and reliability of web service systems. Logs and metrics contain multiple information that can reflect the system's operational state and potential anomalies. Thus, existing anomaly detection methods use logs and metrics to detect web service systems' anomalies through data fusion approaches. They associate logs and metrics using coarse-grained time window alignment and capture the normal patterns of system operation through reconstruction. However, these methods have two issues that limit their performance in anomaly detection. First, due to asynchrony between logs and metrics, coarse-grained time window alignment cannot achieve a precise association between the two modalities. Second, reconstruction-based methods suffer from severe overgeneralization problems, resulting in anomalies being accurately reconstructed. In this paper, we propose a novel anomaly detection method named FFAD to address these two issues. On the one hand, FFAD employs graph-based alignment to mine and extract associations between the modalities from the constructed log-metric relation graph, achieving precise associations between logs and metrics. On the other hand, we improve the model's fit to normal data distributions through Fourier Frequency Focus, thereby enhancing the effectiveness of anomaly detection. We validated the effectiveness of our model on two real-world industrial datasets and one open-source dataset. The results show that our method achieves an average anomaly detection F1-score of 93.6%, representing an 8.8% improvement over previous state-of-the-art methods.

异常检测多模态频域分析

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。