Graph Neural Network and Transformer Integration for Unsupervised System Anomaly Discovery

2025-08-12

AI Summary

This paper addresses the unsupervised anomaly detection challenge in distributed backend services—characterized by complex structural dependencies, dynamically evolving behavioral patterns, and scarce labeled data. We propose an end-to-end approach integrating dynamic graph representation with spatiotemporal modeling. First, we construct a service-call dynamic graph; then, we design a learnable joint embedding mechanism that unifies topological structure and temporal behavior. Graph convolution captures multi-hop structural dependencies, while a Transformer architecture models long-range temporal patterns; finally, a nonlinear mapping generates anomaly scores. Our core innovations lie in (i) synergistic structural-behavioral modeling and (ii) implicit learning of anomaly propagation paths. Experiments on real-world cloud monitoring datasets demonstrate that our method significantly outperforms state-of-the-art baselines across standard metrics—including F1-score and AUC—while exhibiting strong representational capacity, robustness to noise and concept drift, and practical deployability in production environments.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Graph-based Machine Learning
• Knowledge Representation and Reasoning: Geometric, Spatial, and Temporal Reasoning

Application Category

• Graph Algorithms and Modeling for the Web: Graph embeddings and representation learning for Web-related graphs
• Web Mining and Content Analysis: Bridging structured and unstructured data
• Search and Retrieval-Augmented AI: Web query analysis, representation and understanding

Abstract

This study proposes an unsupervised anomaly detection method for distributed backend service systems, addressing practical challenges such as complex structural dependencies, diverse behavioral evolution, and the absence of labeled data. The method constructs a dynamic graph based on service invocation relationships and applies graph convolution to extract high-order structural representations from multi-hop topologies. A Transformer is used to model the temporal behavior of each node, capturing long-term dependencies and local fluctuations. During the feature fusion stage, a learnable joint embedding mechanism integrates structural and behavioral representations into a unified anomaly vector. A nonlinear mapping is then applied to compute anomaly scores, enabling an end-to-end detection process without supervision. Experiments on real-world cloud monitoring data include sensitivity analyses across different graph depths, sequence lengths, and data perturbations. Results show that the proposed method outperforms existing models on several key metrics, demonstrating stronger expressiveness and stability in capturing anomaly propagation paths and modeling dynamic behavior sequences, with high potential for practical deployment.

Problem

• Unsupervised anomaly detection in distributed backend services
• Modeling complex structural dependencies and behavioral evolution
• Integrating graph and temporal features without labeled data

Innovation

• Dynamic graph construction for service dependencies
• Transformer modeling for temporal behavior analysis
• Learnable joint embedding for anomaly detection