一句话：提出首个分组式微服务 Trace 异常检测算法 GTrace，通过共享子结构分组与 VAE 建模，显著提升准确率和效率。
随着微服务应用规模扩大，记录服务间调用的 Trace 异常检测对诊断系统故障至关重要。现有深度学习方法虽能建模调用路径与延迟，但逐点检测在十亿级 Trace 下开销大，且相同子结构编码不一致，缺乏高层信息。本文提出首个分组式 Trace 异常检测算法 GTrace：依据共享整树或子树结构将 Trace 分组，用组级 VAE 学习结构表示，并以“用结构预测延迟”范式关联结构与延迟分布；分组设计支持表示缓存和批量推理。评估表明，GTrace 的 AUC 提升 2.64% 至 195.45%，最佳 F-Score 提升 2.31% 至 40.92%，加速 21.9 至 28.2 倍，并已在 eBay 微服务集群部署验证。
As Internet applications continue to scale up, microservice architecture has become increasingly popular due to its flexibility and logical structure. Anomaly detection in traces that record inter-microservice invocations is essential for diagnosing system failures. Deep learning-based approaches allow for accurate modeling of structural features (i.e., call paths) and latency features (i.e., call response time), which can determine the anomaly of a particular trace sample. However, the point-wise manner employed by these methods results in substantial system detection overhead and impracticality, given the massive volume of traces (billion-level). Furthermore, the point-wise approach lacks high-level information, as identical sub-structures across multiple traces may be encoded differently. In this paper, we introduce the first Group-wise Trace anomaly detection algorithm, named GTrace. This method categorizes the traces into distinct groups based on their shared sub-structure, such as the entire tree or sub-tree structure. A group-wise Variational AutoEncoder (VAE) is then employed to obtain structural representations. Moreover, the innovative "predicting latency with structure" learning paradigm facilitates the association between the grouped structure and the latency distribution within each group. With the group-wise design, representation caching, and batched inference strategies can be implemented, which significantly reduces the burden of detection on the system. Our comprehensive evaluation reveals that GTrace outperforms state-of-the-art methods in both performances (2.64% to 195.45% improvement in AUC metrics and 2.31% to 40.92% improvement in best F-Score) and efficiency (21.9x to 28.2x speedup). We have deployed and assessed the proposed algorithm on eBay's microservices cluster, and our code is available at https://github.com/NetManAIOps/GTrace.git.
@inproceedings{XiePLJSLXP23,
title = {From Point-wise to Group-wise: A Fast and Accurate Microservice Trace Anomaly Detection Approach},
author = {Zhe Xie and Changhua Pei and Wanxue Li and Huai Jiang and Liangfei Su and Jianhui Li and Gaogang Xie and Dan Pei},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3613861}
}