Chain-Aware Encoding for Microservice Trace Anomaly Detection
2026-07-11 • Software Engineering
Software Engineering
AI summaryⓘ
The authors explain that monitoring individual steps in microservice systems can miss problems when the overall flow is unusual but each step seems fine. They improve this by including the whole sequence of calls leading to each event, not just the event itself. Their method, CHAINLSTM, can better detect when the process misses or changes steps by understanding these sequences, showing much clearer signs of trouble than previous methods. Tests show their approach is more accurate at spotting path-related anomalies without extra delay.
microservicestrace analysissequence modelsLSTManomaly detectionAPI endpointsinvocation chainDeepLogpath anomaliesonline detection
Authors
Yiliu Xu, Ziwei Hong, Zhongheng Yang, Xinjin Li, Yu Ma
Abstract
Microservice traces can be structurally anomalous even when every span returns normally -- a payment flow that silently skips a risk check looks fine to any per-span monitor. Sequence models like DeepLog address this by predicting the next event, but they treat each API endpoint as a context-free token: the same endpoint reached through different invocation chains is mapped to the same vocabulary entry, even when its normal behavior differs across contexts. We propose encoding each event as an (endpoint, root-to-span invocation chain) pair instead. This simple change has two consequences: unseen chains are flagged without model inference, and next-event predictions become context-conditional, turning subtle path anomalies into clear outliers. We instantiate this idea in CHAINLSTM, a lightweight dual-task LSTM supporting per-event online detection. On the TrainTicket benchmark, CHAINLSTM achieves 94.3% F1 (+5.3 pp over DeepLog) with comparable latency recall and 99.1\% path recall. Case analysis shows that chain-aware encoding shifts median prediction probability on path anomalies from 0.91 to 0.002, suggesting a wider separation margin for threshold-based detection.