The DOI matches its Crossref record.
An Approach for Anomaly Diagnosis Based on Hybrid Graph Model with Logs for Distributed Services
Abstract
Detecting runtime anomalies is very important to monitoring and maintenance of distributed services. People often use execution logs for troubleshooting and problem diagnosis manually, which is time consuming and error-prone. In this paper, we propose an approach for automatic anomaly detection based on logs. We first mine a hybrid graph model that captures normal execution flows inter and intra services, and then raise anomaly alerts on observing deviations from the hybrid model. We evaluate the effectiveness of our approach by leveraging logs from an IBM public cloud production platform and two simulated systems in the lab environment. Evaluation results show that our hybrid graph model mining performs over 80% precision and 70% recall and anomaly detection performs nearly 90% precision and 80% recall on average.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“given their increasing popularity for software engineering tasks [53]- [55]”
From Practitioners’ expectations on log anomaly detection (2025) · cites this paper as [53]
Citations
Cites
No references could be resolved yet.
Research works printed but not linked: 34
- 10.1109/IPOM.2003.1251233 · DOI
- 10.1109/CLOUD.2017.64 · DOI
- spirtes, 1993, Causation, prediction, and search[J], Lecture Notes in Statistics, 81, 272
- causality, 2011, Models reasoning and inference, 79, 289
- 10.1007/BFb0014140 · DOI
- 10.1145/1740390.1740411 · DOI
- animesh, 2016, Anomaly Detection Using Program Control Flow Graph Mining From Execution Logs[C], SIGKDD
- deraalst, 2004, workflow mining: Fdis Discovering process models from event logs[C], TKDE
- gunther, 2007, Fuzzy mining-adaptive process simplification based on multi-perspective metrics[C], BPM
- 10.1145/1835804.1835883 · DOI
- levenshtein, 1965, Binary codes capable of correcting deletions, insertions and reversals [J], Problems of Information Transmission, 707
- ester, 1996, A Density-Based Algorithm for Discovering Clusters, Large Spatial Databases with Noise[C], 226
- 10.1145/2038633.2038636 · DOI
- 0, Hadoop
- kalisch, 2007, Estimating high-dimensional directed acyclic graphs with the pc-algorithm[J], Mach Learn Res, 8, 613
- chen, 2008, Automating network application dependency discovery: Experiences, limitations, and new solutions[C], Proc 8th USENIX Conf Operating Syst Des Implementation, 117
- wei, 2010, Detecting large-scale system problems by mining console logs[C], International Conference on Machine Learning, 37
- barham, 2004, Using magpie for request extraction and workload modelling[C], Proc 6th Conf Symp Opearting Syst Des Implementation, 18
- 10.1109/ICDM.2009.19 · DOI
- 10.1145/2872362.2872407 · DOI
- barham, 2008, Constellation Automated Discovery of Service and Host Dependencies in Networked Systems
- lin, 2016, Log Clustering based Problem Identification for Online Service Systems[C], International Conference on Software Engineering
- 0, OpenStack
- 10.1109/IC2E.2016.12 · DOI
- lim, 2008, A log mining approach to failure analysis of enterprise telephony systems[C], Dependable Systems and Networks With FTCS and DCC 2008 DSN 2008 IEEE International Conference on, 398
- 0, Cloud Foundry
- 10.1109/ICDM.2009.60 · DOI
- 10.1198/016214508000000193 · DOI
- 10.1109/DSN.2005.44 · DOI
- cohen, 2004, Correlating instrumentation data to system states: A building block for automated diagnosis and control[C], Proc 6th Conf Symp Opearting Syst Des Implementation, 16
- bhlmann, 2008, Robustification of the pc-algorithm for directed acyclic graphs[J], Journal of Computational & Graphical Statistics, 17, 773, 10.1198/106186008X381927 · DOI
- cohen, 2005, Capturing, indexing, clustering, and retrieving system history[C], ACM SIGOPS Operating Syst Rev, 39, 105, 10.1145/1095809.1095821 · DOI
- fonseca, 2007, X-trace: A pervasive network tracing framework, Proc 4th USENIX Conf Netw Syst Des Implementation, 20
- 10.1109/TSC.2016.2607739 · DOI
Cited by
Sorted by citations
A Survey on Automated Log Analysis for Reliability Engineering
He, S., He, P., Chen, Z., Yang, T., Su, Y., & Lyu, M. R. (2022) · ACM Computing Surveys · doi:10.1145/3460345 · Cited by 334
Soldani, J., & Brogi, A. (2023) · ACM Computing Surveys · doi:10.1145/3501297 · Cited by 256
MicroRCA: Root Cause Localization of Performance Issues in Microservices
Wu, L., Tordsson, J., Elmroth, E., & Kao, O. (2020) · NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium · doi:10.1109/noms47738.2020.9110353 · Cited by 265
MicroHECL: High-Efficient Root Cause Localization in Large-Scale Microservice Systems
Liu, D., He, C., Peng, X., Lin, F., Zhang, C., Gong, S., Li, Z., Ou, J., & Wu, Z. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00043 · Cited by 192
Qiu, J., Du, Q., Yin, K., Zhang, S.-L., & Qian, C. (2020) · Applied Sciences · doi:10.3390/app10062166 · Cited by 96
Metadata
- Authors
- Jia, T., Chen, P., Yang, L., Li, Y., Meng, F., & Xu, J.
- Venue
- 2017 IEEE International Conference on Web Services (ICWS)
- Publisher
- IEEE
- Published
- 2017-06
- Pages
- 25-32
- Cited by
- 78
- References
- 0
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: An Approach for Anomaly Diagnosis Based on Hybrid Graph Model with Logs for Distributed Services. https://app.cochat.ai/papers/10.1109/icws.2017.12
- The paper
- Jia, T., Chen, P., Yang, L., Li, Y., Meng, F., & Xu, J. (2017). An Approach for Anomaly Diagnosis Based on Hybrid Graph Model with Logs for Distributed Services. 2017 IEEE International Conference on Web Services (ICWS). https://doi.org/10.1109/icws.2017.12
