{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T06:18:04Z","timestamp":1780553884971,"version":"3.54.1"},"reference-count":41,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2022,8,13]],"date-time":"2022-08-13T00:00:00Z","timestamp":1660348800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,8,13]],"date-time":"2022-08-13T00:00:00Z","timestamp":1660348800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100002790","name":"Canadian Network for Research and Innovation in Machining Technology, Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002790","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cloud Comp"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>In recent years DevOps and agile approaches like microservice architectures and Continuous Integration have become extremely popular given the increasing need for flexible and scalable solutions. However, several factors such as their distribution in the network, the use of different technologies, their short life, etc. make microservices prone to the occurrence of anomalous system behaviours. In addition, due to the high degree of complexity of small services, it is difficult to adequately monitor the security and behavior of microservice environments. In this work, we propose an NLP (natural language processing) based approach to detect performance anomalies in spans during a given trace, besides locating release-over-release regressions. Notably, the whole system needs no prior knowledge, which facilitates the collection of training data. Our proposed approach benefits from distributed tracing data to collect sequences of events that happened during spans. Extensive experiments on real datasets demonstrate that the proposed method achieved an F_score of 0.9759. The results also reveal that in addition to the ability to detect anomalies and release-over-release regressions, our proposed approach speeds up root cause analysis by means of implemented visualization tools in Trace Compass.<\/jats:p>","DOI":"10.1186\/s13677-022-00296-4","type":"journal-article","created":{"date-parts":[[2022,8,13]],"date-time":"2022-08-13T06:02:45Z","timestamp":1660370565000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":27,"title":["Anomaly detection in microservice environments using distributed tracing data analysis and NLP"],"prefix":"10.1186","volume":"11","author":[{"given":"Iman","family":"Kohyarnejadfard","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Daniel","family":"Aloise","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Seyed Vahid","family":"Azhari","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michel R.","family":"Dagenais","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,8,13]]},"reference":[{"issue":"1","key":"296_CR1","doi-asserted-by":"publisher","first-page":"116","DOI":"10.1109\/MS.2015.11","volume":"32","author":"J Th\u00f6nes","year":"2015","unstructured":"Th\u00f6nes J (2015) Microservices. IEEE Softw 32(1):116\u2013116.","journal-title":"IEEE Softw"},{"key":"296_CR2","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1145\/3297858.3304004","volume-title":"Proceedings of the Twenty-fourth International Conference on Architectural Support for Programming Languages and Operating Systems","author":"Y Gan","year":"2019","unstructured":"Gan Y, Zhang Y, Hu K, Cheng D, He Y, Pancholi M, Delimitrou C (2019) Seer: Leveraging big data to navigate the complexity of performance debugging in cloud microservices. In: Proceedings of the Twenty-fourth International Conference on Architectural Support for Programming Languages and Operating Systems. Association for Computing Machinery, New York, pp 19\u201333. https:\/\/doi.org\/10.1145\/3297858.3304004"},{"issue":"3","key":"296_CR3","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1109\/MS.2018.2141039","volume":"35","author":"P Jamshidi","year":"2018","unstructured":"Jamshidi P, Pahl C, Mendon\u00e7a NC, Lewis J, Tilkov S (2018) Microservices: The journey so far and challenges ahead. IEEE Softw 35(3):24\u201335.","journal-title":"IEEE Softw"},{"key":"296_CR4","doi-asserted-by":"publisher","unstructured":"Wu L, Tordsson J, Elmroth E, Kao O (2020) Microrca: Root cause localization of performance issues in microservices. In: NOMS 2020-2020 IEEE\/IFIP Network Operations and Management Symposium. IEEE, pp 1\u20139. https:\/\/doi.org\/10.1109\/NOMS47738.2020.9110353","DOI":"10.1109\/NOMS47738.2020.9110353"},{"key":"296_CR5","unstructured":"Sol\u00e9 M, Munt\u00e9s-Mulero V, Rana AI, Estrada G (2017) Survey on models and techniques for root-cause analysis. arXiv preprint arXiv:1701.08546."},{"issue":"4","key":"296_CR6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2382553.2382555","volume":"30","author":"\u00da. Erlingsson","year":"2012","unstructured":"Erlingsson \u00da., Peinado M, Peter S, Budiu M, Mainar-Ruiz G (2012) Fay: Extensible distributed tracing from kernels to clusters. ACM Trans Comput Syst (TOCS) 30(4):1\u201335.","journal-title":"ACM Trans Comput Syst (TOCS)"},{"key":"296_CR7","first-page":"209","volume-title":"OLS (Ottawa Linux Symposium)","author":"M Desnoyers","year":"2006","unstructured":"Desnoyers M, Dagenais MR (2006) The lttng tracer: A low impact performance and behavior monitor for gnu\/linux. OLS (Ottawa Linux Symposium), vol 2006. Linux Symposium, Citeseer, pp 209\u2013224"},{"issue":"3","key":"296_CR8","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/1541880.1541882","volume":"41","author":"V Chandola","year":"2009","unstructured":"Chandola V, Banerjee A, Kumar V (2009) Anomaly detection: A survey. ACM Comput Surv (CSUR) 41(3):1\u201358.","journal-title":"ACM Comput Surv (CSUR)"},{"key":"296_CR9","unstructured":"Ohlsson J (2018) Anomaly detection in microservice infrastructures."},{"key":"296_CR10","unstructured":"OpenTracingVendor-neutral APIs and instrumentation for distributed tracing. https:\/\/opentracing.io\/. Accessed 09 Apr 2021."},{"key":"296_CR11","doi-asserted-by":"publisher","unstructured":"Ravichandiran R, Bannazadeh H, Leon-Garcia A (2018) Anomaly detection using resource behaviour analysis for autoscaling systems. In:\u00a02018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft). IEEE, pp 192\u2013196. https:\/\/doi.org\/10.1109\/NETSOFT.2018.8460025","DOI":"10.1109\/NETSOFT.2018.8460025"},{"issue":"1","key":"296_CR12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2791120","volume":"48","author":"O Ibidunmoye","year":"2015","unstructured":"Ibidunmoye O, Hern\u00e1ndez-Rodriguez F, Elmroth E (2015) Performance anomaly detection and bottleneck identification. ACM Comput Surv (CSUR) 48(1):1\u201335.","journal-title":"ACM Comput Surv (CSUR)"},{"key":"296_CR13","unstructured":"Shkuro Y (2019) Mastering Distributed Tracing: Analyzing Performance in Microservices and Complex Systems. Packt Publishing Ltd."},{"key":"296_CR14","unstructured":"JaegerOpen source, end-to-end distributed tracing. Uber Technologies. https:\/\/www.jaegertracing.io\/. Accessed 10 Apr 2021."},{"key":"296_CR15","doi-asserted-by":"publisher","first-page":"291","DOI":"10.1016\/j.future.2020.10.040","volume":"116","author":"L Meng","year":"2021","unstructured":"Meng L, Ji F, Sun Y, Wang T (2021) Detecting anomalies in microservices with execution trace comparison. Futur Gener Comput Syst 116:291\u2013301.","journal-title":"Futur Gener Comput Syst"},{"key":"296_CR16","doi-asserted-by":"crossref","unstructured":"Gan Y, Liang M, Dev S, Lo D, Delimitrou C (2021) Sage: Using unsupervised learning for scalable performance debugging in microservices. arXiv preprint arXiv:2101.00267.","DOI":"10.1145\/3445814.3446700"},{"key":"296_CR17","unstructured":"ZipkinA distributed tracing system. https:\/\/zipkin.io\/. Accessed 10 Apr 2021."},{"key":"296_CR18","doi-asserted-by":"publisher","unstructured":"Nedelkoski S, Cardoso J, Kao O (2019) Anomaly detection from system tracing data using multimodal deep learning. 2019 IEEE 12th International Conference on Cloud Computing (CLOUD). IEEE., pp 179\u2013186. https:\/\/doi.org\/10.1109\/CLOUD.2019.00038","DOI":"10.1109\/CLOUD.2019.00038"},{"issue":"4","key":"296_CR19","doi-asserted-by":"publisher","first-page":"2350","DOI":"10.1109\/TNSM.2020.3022028","volume":"17","author":"T Wang","year":"2020","unstructured":"Wang T, Zhang W, Xu J, Gu Z (2020) Workflow-aware automatic fault diagnosis for microservice-based applications with statistics. IEEE Trans Netw Serv Manag 17(4):2350\u20132363.","journal-title":"IEEE Trans Netw Serv Manag"},{"issue":"1","key":"296_CR20","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s13677-020-00206-6","volume":"9","author":"R Gassais","year":"2020","unstructured":"Gassais R, Ezzati-Jivan N, Fernandez JM, Aloise D, Dagenais MR (2020) Multi-level host-based intrusion detection system for internet of things. J Cloud Comput 9(1):1\u201316.","journal-title":"J Cloud Comput"},{"issue":"12","key":"296_CR21","doi-asserted-by":"publisher","first-page":"3448","DOI":"10.1016\/j.comnet.2007.02.001","volume":"51","author":"A Patcha","year":"2007","unstructured":"Patcha A, Park J-M (2007) An overview of anomaly detection techniques: Existing solutions and latest technological trends. Comput Netw 51(12):3448\u20133470.","journal-title":"Comput Netw"},{"key":"296_CR22","doi-asserted-by":"crossref","unstructured":"Amaral M, Polo J, Carrera D, Mohomed I, Unuvar M, Steinder M (2015) Performance evaluation of microservices architectures using containers In: 2015 IEEE 14th International Symposium on Network Computing and Applications, 27\u201334. IEEE.","DOI":"10.1109\/NCA.2015.49"},{"key":"296_CR23","doi-asserted-by":"publisher","unstructured":"Samir A, Pahl C (2019) Dla: Detecting and localizing anomalies in containerized microservice architectures using markov models In: 2019 7th International Conference on Future Internet of Things and Cloud (FiCloud), 205\u2013213. IEEE. https:\/\/doi.org\/10.1109\/FiCloud.2019.00036","DOI":"10.1109\/FiCloud.2019.00036"},{"issue":"2","key":"296_CR24","first-page":"70","volume":"3","author":"I Syarif","year":"2012","unstructured":"Syarif I, Prugel-Bennett A, Wills G (2012) Data mining approaches for network intrusion detection: from dimensionality reduction to misuse and anomaly detection. J Inf Technol Rev 3(2):70\u201383.","journal-title":"J Inf Technol Rev"},{"key":"296_CR25","unstructured":"Ranjan R, Sahoo G (2014) A new clustering approach for anomaly intrusion detection. arXiv preprint arXiv:1404.2772."},{"key":"296_CR26","doi-asserted-by":"crossref","unstructured":"Animesh P, Jung M (2007) Network anomaly detection with incomplete audit data. Computer Networks 51(13):3935\u201355.","DOI":"10.1016\/j.comnet.2007.04.017"},{"issue":"4","key":"296_CR27","first-page":"799","volume":"2","author":"N Kaur","year":"2013","unstructured":"Kaur N, et al (2013) Survey paper on data mining techniques of intrusion detection. Int J Sci Eng Technol Res 2(4):799\u2013804.","journal-title":"Int J Sci Eng Technol Res"},{"issue":"1","key":"296_CR28","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s13677-018-0109-4","volume":"7","author":"A Abusitta","year":"2018","unstructured":"Abusitta A, Bellaiche M, Dagenais M (2018) An svm-based framework for detecting dos attacks in virtualized clouds under changing environment. J Cloud Comput 7(1):1\u201318.","journal-title":"J Cloud Comput"},{"issue":"1","key":"296_CR29","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s13677-018-0123-6","volume":"7","author":"MF Elrawy","year":"2018","unstructured":"Elrawy MF, Awad AI, Hamed HF (2018) Intrusion detection systems for iot-based smart environments: a survey. J Cloud Comput 7(1):1\u201320.","journal-title":"J Cloud Comput"},{"key":"296_CR30","doi-asserted-by":"publisher","first-page":"708","DOI":"10.1016\/j.procs.2015.08.220","volume":"60","author":"S Agrawal","year":"2015","unstructured":"Agrawal S, Agrawal J (2015) Survey on anomaly detection using data mining techniques. Procedia Comput Sci 60:708\u2013713.","journal-title":"Procedia Comput Sci"},{"key":"296_CR31","doi-asserted-by":"publisher","unstructured":"Nedelkoski S, Cardoso J, Kao O (2019) Anomaly detection from system tracing data using multimodal deep learning In: 2019 IEEE 12th International Conference on Cloud Computing (CLOUD), 179\u2013186. IEEE. https:\/\/doi.org\/10.1109\/CLOUD.2019.00038","DOI":"10.1109\/CLOUD.2019.00038"},{"key":"296_CR32","doi-asserted-by":"publisher","unstructured":"Ji S, Wu W, Pu Y (2020) Multi-indicators prediction in microservice using granger causality test and attention lstm In: 2020 IEEE World Congress on Services (SERVICES), 77\u201382. IEEE. https:\/\/doi.org\/10.1109\/SERVICES48979.2020.00030","DOI":"10.1109\/SERVICES48979.2020.00030"},{"key":"296_CR33","unstructured":"Malhotra P, Vig L, Shroff G, Agarwal P (2015) Long short term memory networks for anomaly detection in time series In: Proceedings, vol. 89, 89\u201394. Presses universitaires de Louvain."},{"key":"296_CR34","doi-asserted-by":"publisher","first-page":"1939","DOI":"10.1145\/2783258.2788611","volume-title":"Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","author":"N Laptev","year":"2015","unstructured":"Laptev N, Amizadeh S, Flint I (2015) Generic and scalable framework for automated time-series anomaly detection. In: Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Association for Computing Machinery, New York, pp 1939\u20131947. https:\/\/doi.org\/10.1145\/2783258.2788611"},{"key":"296_CR35","doi-asserted-by":"publisher","first-page":"1285","DOI":"10.1145\/3133956.3134015","volume-title":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","author":"M Du","year":"2017","unstructured":"Du M, Li F, Zheng G, Srikumar V (2017) Deeplog: Anomaly detection and diagnosis from system logs through deep learning. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. Association for Computing Machinery, New York, pp 1285\u20131298. https:\/\/doi.org\/10.1145\/3133956.3134015"},{"key":"296_CR36","doi-asserted-by":"publisher","unstructured":"Ravichandiran R, Bannazadeh H, Leon-Garcia A (2018) Anomaly detection using resource behaviour analysis for autoscaling systems In: 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), 192\u2013196. IEEE. https:\/\/doi.org\/10.1109\/NETSOFT.2018.8460025","DOI":"10.1109\/NETSOFT.2018.8460025"},{"key":"296_CR37","doi-asserted-by":"crossref","unstructured":"Gaidels E, Kirikova M (2020) Service dependency graph analysis in microservice architecture In: International Conference on Business Informatics Research, 128\u2013139. Springer.","DOI":"10.1007\/978-3-030-61140-8_9"},{"issue":"4","key":"296_CR38","doi-asserted-by":"publisher","first-page":"2350","DOI":"10.1109\/TNSM.2020.3022028","volume":"17","author":"T Wang","year":"2020","unstructured":"Wang T, Zhang W, Xu J, Gu Z (2020) Workflow-aware automatic fault diagnosis for microservice-based applications with statistics. IEEE Trans Netw Serv Manag 17(4):2350\u20132363.","journal-title":"IEEE Trans Netw Serv Manag"},{"key":"296_CR39","doi-asserted-by":"publisher","unstructured":"Fournier Q, Aloise D, Azhari SV, Tetreault F (2021) On improving deep learning trace analysis with system call arguments In: 2021 IEEE\/ACM 18th International Conference on Mining Software Repositories (MSR), 120\u2013130. https:\/\/doi.org\/10.1109\/MSR52588.2021.00025.","DOI":"10.1109\/MSR52588.2021.00025"},{"key":"296_CR40","unstructured":"tracecompass-ease-scripting. https:\/\/archive.eclipse.org\/tracecompass.incubator\/doc\/. Accessed 10 May 2021."},{"key":"296_CR41","unstructured":"Zhang Z, Sabuncu MR (2018) Generalized cross entropy loss for training deep neural networks with noisy labels. In: Bengio S, Wallach H, Larochelle H, Grauman K, Cesa-Bianchi N, Garnett R (eds) 32nd Conference on Neural Information Processing Systems (NeurIPS). Curran Associates, Inc. https:\/\/proceedings.neurips.cc\/paper\/2018\/file\/f2925f97bc13ad2852a7a551802feea0-Paper.pdf"}],"container-title":["Journal of Cloud Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-022-00296-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13677-022-00296-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-022-00296-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,8,13]],"date-time":"2022-08-13T06:21:20Z","timestamp":1660371680000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofcloudcomputing.springeropen.com\/articles\/10.1186\/s13677-022-00296-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,13]]},"references-count":41,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["296"],"URL":"https:\/\/doi.org\/10.1186\/s13677-022-00296-4","relation":{},"ISSN":["2192-113X"],"issn-type":[{"value":"2192-113X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,8,13]]},"assertion":[{"value":"17 March 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 July 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 August 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare that they have no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"25"}}