ClouDens: Operational Context-Aware Anomaly Detection for Large-scale Cloud System Monitoring

2026-07-20

AI Summary

This work addresses the challenges of anomaly detection in large-scale cloud system monitoring, where telemetry logs exhibit high-dimensional sparsity, intermittent service activity, and complex component dependencies. To tackle these issues, the authors propose ClouDens, a novel approach that leverages operational context attributes to guide domain-aware feature partitioning and construct context-aware graphs. ClouDens integrates a spatiotemporal graph neural network for predictive anomaly detection and incorporates sparse data imputation to enhance coverage. Experimental evaluation on a real-world IBM cloud telemetry dataset demonstrates that ClouDens significantly outperforms baseline models such as GRU on count-based features and achieves earlier, more accurate, and broader anomaly detection according to the NAB benchmark.

Abstract

With the rapid growth of cloud computing infrastructures in scale and complexity, network monitoring for Large-scale Cloud Systems (LCSs) has become increasingly challenging, requiring automated and reliable anomaly detection to maintain service availability. Modern LCSs continuously generate telemetry logs from distributed cloud services, producing high-dimensional multivariate time series that capture system operations. Detecting anomalies in this context is difficult due to extreme dimensionality, complex dependencies among distributed components, and severe sparsity from intermittently active services. Taking these challenges into account, we first conduct an empirical study on telemetry logs from the IBM Cloud Console platform, and then propose ClouDens, an anomaly detection framework tailored to LCS monitoring that leverages operational-context attributes encoded in the telemetry log schema to improve detection accuracy and early identification of anomalies. ClouDens partitions high-dimensional telemetry logs into domain-guided subsets, constructs a context-aware graph modeling operational service dependencies, and employs Spatio-Temporal Graph Neural Networks for forecasting-based anomaly detection. We evaluate ClouDens on the recently released IBM Cloud Telemetry Dataset and provide practical insights into designing reliable anomaly detection solutions for LCS monitoring. Results show ClouDens achieves higher NAB scores in count-based telemetry features, indicating more accurate, earlier anomaly detection with broader coverage than a GRU-based model. Our study further reveals that telemetry feature subsets, operational-context modeling, scoring strategies, and sparsity imputation all substantially influence detection performance, offering practical guidance for designing and fairly benchmarking anomaly detection approaches for LCS monitoring.

Problem

• anomaly detection
• large-scale cloud systems
• telemetry logs
• high-dimensional time series
• operational context

Innovation

• operational context-aware
• spatio-temporal graph neural networks
• anomaly detection
• large-scale cloud systems
• telemetry log partitioning