一句话：提出 DeepTraLog，用统一图表示融合 trace 与日志事件，并基于 GGNN 和 deep SVDD 检测微服务异常。
微服务系统通常由大量跨机服务组成，其异常会反映在记录服务间交互的 trace 与记录服务内行为的日志中。现有 trace 异常检测将 trace 视为服务调用序列，忽略调用层级和并行/异步调用带来的复杂结构；现有日志异常检测将日志视为事件序列，难以处理分布广泛且交互复杂的微服务日志。本文提出 DeepTraLog，使用统一图表示描述 trace 的复杂结构并将日志事件嵌入其中，进而训练基于 GGNN 的 deep SVDD 模型，结合 trace 与日志检测新 trace 及其对应日志中的异常。在微服务基准上的评估显示，DeepTraLog 达到 0.93 精确率和 0.97 召回率，F1 相较最先进方法平均提升 0.37，并验证了效率、统一图表示的贡献及关键参数配置的影响。
A microservice system in industry is usually a large-scale distributed system consisting of dozens to thousands of services running in different machines. An anomaly of the system often can be reflected in traces and logs, which record inter-service interactions and intra-service behaviors respectively. Existing trace anomaly detection approaches treat a trace as a sequence of service invocations. They ignore the complex structure of a trace brought by its invocation hierarchy and parallel/asynchronous invocations. On the other hand, existing log anomaly detection approaches treat a log as a sequence of events and cannot handle microservice logs that are distributed in a large number of services with complex interactions. In this paper, we propose DeepTraLog, a deep learning based microservice anomaly detection approach. DeepTraLog uses a unified graph representation to describe the complex structure of a trace together with log events embedded in the structure. Based on the graph representation, DeepTraLog trains a GGNNs based deep SVDD model by combing traces and logs and detects anomalies in new traces and the corresponding logs. Evaluation on a microservice benchmark shows that DeepTraLog achieves a high precision (0.93) and recall (0.97), outperforming state-of-the-art trace/log anomaly detection approaches with an average increase of 0.37 in F1-score. It also validates the efficiency of DeepTraLog, the contribution of the unified graph representation, and the impact of the configurations of some key parameters.