融合图神经网络与Transformer，无监督发现分布式系统异常
Graph Neural Network and Transformer Integration for Unsupervised System Anomaly Discovery
- 构建动态服务调用图，用图卷积捕捉多跳结构特征
- 通过Transformer建模节点时序行为，识别长期依赖与局部波动
- 可端到端训练，适合真实云环境的异常检测场景
本文提出一种针对分布式后端服务系统的无监督异常检测方法，解决复杂结构依赖、行为演化多样及缺乏标注数据等实际挑战。该方法基于服务调用关系构建动态图，利用图卷积从多跳拓扑中提取高阶结构表征；同时采用Transformer建模各节点的时序行为，捕捉长期依赖与局部波动。在特征融合阶段，引入可学习的联合嵌入机制，将结构与行为表征融合为统一异常向量，并通过非线性映射计算异常得分，实现无监督端到端检测。在真实云监控数据上的实验包含不同图深度、序列长度和数据扰动下的敏感性分析。结果表明，该方法在多个关键指标上优于现有模型，展现出更强的表达能力与稳定性，能有效捕捉异常传播路径并建模动态行为序列，具备良好的实际部署潜力。
原文摘要 · Abstract (English)
This study proposes an unsupervised anomaly detection method for distributed backend service systems, addressing practical challenges such as complex structural dependencies, diverse behavioral evolution, and the absence of labeled data. The method constructs a dynamic graph based on service invocation relationships and applies graph convolution to extract high-order structural representations from multi-hop topologies. A Transformer is used to model the temporal behavior of each node, capturing long-term dependencies and local fluctuations. During the feature fusion stage, a learnable joint embedding mechanism integrates structural and behavioral representations into a unified anomaly vector. A nonlinear mapping is then applied to compute anomaly scores, enabling an end-to-end detection process without supervision. Experiments on real-world cloud monitoring data include sensitivity analyses across different graph depths, sequence lengths, and data perturbations. Results show that the proposed method outperforms existing models on several key metrics, demonstrating stronger expressiveness and stability in capturing anomaly propagation paths and modeling dynamic behavior sequences, with high potential for practical deployment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。