Chain-Aware Encoding for Microservice Trace Anomaly Detection
TL;DR
This work instantiates CHAINLSTM, a lightweight dual-task LSTM supporting per-event online detection and shows that chain-aware encoding shifts median prediction probability on path anomalies from 0.91 to 0.002, suggesting a wider separation margin for threshold-based detection.
Abstract
Microservice traces can be structurally anomalous even when every span returns normally -- a payment flow that silently skips a risk check looks fine to any per-span monitor. Sequence models like DeepLog address this by predicting the next event, but they treat each API endpoint as a context-free token: the same endpoint reached through different invocation chains is mapped to the same vocabulary entry, even when its normal behavior differs across contexts. We propose encoding each event as an (endpoint, root-to-span invocation chain) pair instead. This simple change has two consequences: unseen chains are flagged without model inference, and next-event predictions become context-conditional, turning subtle path anomalies into clear outliers. We instantiate this idea in CHAINLSTM, a lightweight dual-task LSTM supporting per-event online detection. On the TrainTicket benchmark, CHAINLSTM achieves 94.3% F1 (+5.3 pp over DeepLog) with comparable latency recall and 99.1\% path recall. Case analysis shows that chain-aware encoding shifts median prediction probability on path anomalies from 0.91 to 0.002, suggesting a wider separation margin for threshold-based detection.