Beacon improves cloud anomaly detection by linking multimodal data
BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detection
Machine Learning
Summary
Cloud systems produce many different types of data like performance numbers, logs, and graphs that show how parts of the system connect. Detecting problems by looking at this mixed data is hard because the data types don’t naturally fit together and events happen at different times in different parts of the system. The authors present BEACON, a method that better combines these data types and tracks issues as they spread asynchronously across the system. Their tests on real cloud data showed BEACON finds anomalies more accurately than previous methods.
What this means in practice
- •For cloud operations teams: Detect anomalies more reliably by linking different data types and tracking irregularities that occur at different times across system components.
- •For security monitoring teams: Identify complex cloud system faults that manifest asynchronously through metrics and logs, improving detection of security-related anomalies.
Authors
Zhe Li, Tengxue Zhang, Yang Shu, Tung Kieu, Lunting Fan, Yingying Zhang, Bin Yang
Abstract
Modern large-scale cloud systems continuously generate massive and multimodal observability data, such as time-series metrics, log records, and system dependency graphs, which reflect the health state of the system. To ensure reliable cloud system operation, anomaly detection models identify abnormal states by analyzing these multimodal observations. However, existing approaches rely on simple fusion strategies and graph learning, ignoring the semantic gap among modalities and the asynchronous spatio-temporal dependencies across system instances over time. To this end, we propose BEACON, a framework to Bridge multimodal sEmantics and Asynchronous propagation for Cloud system anOmaly detectioN. Specifically, we introduce a Dynamic Interpretable Multimodal Aggregator (DIMA) that leverages an information-bottleneck mechanism to compress information from the semantics and temporal dynamics of metrics, and aligns them with logs in a shared prototype space. Furthermore, we propose an Asynchronous Spatio-Temporal Propagator (ASTP) that captures temporal dependencies with multi-scale temporal attention and models spatial relations with topology-aware aggregation. This enables asynchronous propagation of anomalies across system instances. Extensive experiments on three real-world cloud system datasets demonstrate that \textbf{BEACON} consistently outperforms state-of-the-art baselines in anomaly detection.