{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T16:28:25Z","timestamp":1783528105845,"version":"3.55.0"},"reference-count":39,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T00:00:00Z","timestamp":1762300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100016360","name":"Key Backbone Teachers Support Program of Zhongyuan University of Technology","doi-asserted-by":"publisher","award":["GG202417"],"award-info":[{"award-number":["GG202417"]}],"id":[{"id":"10.13039\/501100016360","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100016360","name":"Key Research and Development Program of Henan","doi-asserted-by":"publisher","award":["251111212000"],"award-info":[{"award-number":["251111212000"]}],"id":[{"id":"10.13039\/501100016360","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Anomaly detection is a critical approach for ensuring the security of microservice systems. In recent years, deep sequence models have been widely applied to transform sequence modeling into a language modeling problem. However, the objective of training sequence models with language modeling loss is not directly aligned with anomaly detection. Moreover, the diverse data types in microservice systems\u2014namely metrics, logs, and traces\u2014exhibit asynchrony and complex interdependencies. Existing methods based on deep sequence models, such as LogBERT and TranAD, can only account for a limited number of data modalities, failing to fully utilize multi-source data and effectively handle the interrelationships among multiple modalities. To address this, we propose a multimodal anomaly detection framework based on a generative pre-trained language model (GPT), named GSTGPT. GSTGPT represents multi-source data as a feature graph, with metrics and logs as node features and traces as edge features. Additionally, we model feature interactions and dependencies within sequences using spatio-temporal attention and enhance the model\u2019s focus on critical features through feature augmentation. Experimental results on two real-world datasets demonstrate that GSTGPT achieves an F1 score of 0.967, an 8.3% improvement over baseline methods, significantly outperforming them.<\/jats:p>","DOI":"10.3390\/info16110959","type":"journal-article","created":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T17:06:06Z","timestamp":1762362366000},"page":"959","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["GSTGPT: A GPT-Based Framework for Multi-Source Data Anomaly Detection"],"prefix":"10.3390","volume":"16","author":[{"given":"Jizhao","family":"Liu","sequence":"first","affiliation":[{"name":"College of Computer and Artificial Intelligence, Zhongyuan University of Technology, Zhengzhou 451191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingyan","family":"Fang","sequence":"additional","affiliation":[{"name":"College of Computer and Artificial Intelligence, Zhongyuan University of Technology, Zhengzhou 451191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shuqin","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Computer and Artificial Intelligence, Zhongyuan University of Technology, Zhengzhou 451191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fangfang","family":"Shan","sequence":"additional","affiliation":[{"name":"College of Computer and Artificial Intelligence, Zhongyuan University of Technology, Zhengzhou 451191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1089-3685","authenticated-orcid":false,"given":"Jun","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer and Artificial Intelligence, Zhongyuan University of Technology, Zhengzhou 451191, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1479","DOI":"10.1109\/TKDE.2019.2947676","article-title":"Extended isolation forest","volume":"33","author":"Hariri","year":"2019","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"351","DOI":"10.1080\/08839514.2013.785791","article-title":"One-class support vector machines approach to anomaly detection","volume":"27","author":"Hejazi","year":"2013","journal-title":"Appl. Artif. Intell."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Nanduri, A., and Sherry, L. (2016, January 19\u201321). Anomaly detection in aircraft data using Recurrent Neural Net-works (RNN). Proceedings of the 2016 Integrated Communications Navigation and Surveillance (ICNS), Herndon, VA, USA.","DOI":"10.1109\/ICNSURV.2016.7486356"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1186\/s40537-021-00448-4","article-title":"Intrusion detection systems using long short-term memory (LSTM)","volume":"8","author":"Laghrissi","year":"2021","journal-title":"J. Big Data"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"140136","DOI":"10.1109\/ACCESS.2021.3116612","article-title":"Improving performance of autoencoder-based net-work anomaly detection on nsl-kdd dataset","volume":"9","author":"Xu","year":"2021","journal-title":"IEEE Access"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"161003","DOI":"10.1109\/ACCESS.2021.3131949","article-title":"Applications of generative adversarial networks in anomaly detection: A systematic literature review","volume":"9","author":"Sabuhi","year":"2021","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Guo, H., Yuan, S., and Wu, X. (2021, January 18\u201322). Logbert: Log anomaly detection via bert. Proceedings of the 2021 International Joint Conference on Neural Networks (IJCNN), Shenzhen, China.","DOI":"10.1109\/IJCNN52387.2021.9534113"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Zhang, X., Xu, Y., Lin, Q., Qiao, B., Zhang, H., Dang, Y., Xie, C., Yang, X., Cheng, Q., and Li, Z. (2019, January 26\u201330). Robust log-based anomaly detection on unstable log data. Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Tallinn, Estonia.","DOI":"10.1145\/3338906.3338931"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Lu, S., Wei, X., Li, Y., and Wang, L. (2018, January 12\u201315). Detecting anomaly in big data system logs using convolu-tional neural network. Proceedings of the 2018 IEEE 16th Intl Conf on Dependable, Autonomic and Secure Computing, 16th Intl Conf on Pervasive Intelligence and Computing, 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress (DASC\/PiCom\/DataCom\/CyberSciTech), Athens, Greece.","DOI":"10.1109\/DASC\/PiCom\/DataCom\/CyberSciTec.2018.00037"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Yang, L., Chen, J., Wang, Z., Wang, W., Jiang, J., Dong, X., and Zhang, W. (2021, January 22\u201330). Semi-supervised log-based anomaly detection via probabilistic label estimation. Proceedings of the 2021 IEEE\/ACM 43rd International Conference on Software Engineering (ICSE), Madrid, Spain.","DOI":"10.1109\/ICSE-Companion52605.2021.00106"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Tuli, S., Casale, G., and Jennings, N.R. (2022). Tranad: Deep transformer networks for anomaly detection in multivariate time series data. arXiv.","DOI":"10.14778\/3514061.3514067"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Zhao, N., Chen, J., Yu, Z., Wang, H., Li, J., Qiu, B., Xu, H., Zhang, W., Sui, K., and Pei, D. (2021, January 23\u201328). Identifying bad software changes via multimodal anomaly detection for online service systems. Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece.","DOI":"10.1145\/3468264.3468543"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Lee, C., Yang, T., Chen, Z., Su, Y., and Lyu, M.R. (2023, January 14\u201320). Eadro: An end-to-end troubleshooting frame-work for microservices on multi-source data. Proceedings of the 2023 IEEE\/ACM 45th International Conference on Software Engineering (ICSE), Melbourne, Australia.","DOI":"10.1109\/ICSE48619.2023.00150"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Zhao, C., Ma, M., Zhong, Z., Zhang, S., Tan, Z., Xiong, X., Yu, L., Feng, J., Sun, Y., and Zhang, Y. (2023, January 6\u201310). Robust multimodal failure detection for microservice systems. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Long Beach, CA, USA.","DOI":"10.1145\/3580305.3599902"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"3851","DOI":"10.1109\/TSC.2023.3290018","article-title":"Robust failure diagnosis of microservice system through multimodal data","volume":"16","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Serv. Comput."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Nedelkoski, S., Bogatinovski, J., Mandapati, A.K., Becker, S., Cardoso, J., and Kao, O. (2020, January 28\u201330). Multi-source distributed system data for ai-powered analytics. Proceedings of the European Conference on Service-Oriented and Cloud Computing, Heraklion, Greece.","DOI":"10.1007\/978-3-030-44769-4_13"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Liu, Y., Tao, S., Meng, W., Yao, F., Zhao, X., and Yang, H. (2024, January 14\u201320). Logprompt: Prompt engineering to-wards zero-shot and interpretable log analysis. Proceedings of the 2024 IEEE\/ACM 46th International Conference on Software Engineering: Companion Proceedings, Lisbon, Portugal.","DOI":"10.1145\/3639478.3643108"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Han, X., Yuan, S., and Trabelsi, M. (2023, January 15\u201318). Loggpt: Log anomaly detection via gpt. Proceedings of the 2023 IEEE International Conference on Big Data (BigData), Sorrento, Italy.","DOI":"10.1109\/BigData59044.2023.10386543"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Xu, W., Huang, L., Fox, A., Patterson, D., and Jordan, M.I. (2009, January 11\u201314). Detecting large-scale system prob-lems by mining console logs. Proceedings of the ACM SIGOPS 22nd Symposium on Operating Systems Principles, Big Sky, MT, USA.","DOI":"10.1145\/1629575.1629587"},{"key":"ref_20","first-page":"5998","article-title":"Attention is all you need","volume":"30","author":"Vaswani","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Kurita, T. (2021). Principal component analysis (PCA). Computer Vision: A Reference Guide, Springer International Publishing.","DOI":"10.1007\/978-3-030-63416-2_649"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1715","DOI":"10.1109\/TNSM.2024.3358730","article-title":"LogFiT: Log anomaly detection using fine-tuned language models","volume":"21","author":"Almodovar","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). Deeplog: Anomaly detection and diagnosis from system logs through deep learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.","DOI":"10.1145\/3133956.3134015"},{"key":"ref_24","first-page":"4739","article-title":"Loganomaly: Unsuper-vised detection of sequential and quantitative anomalies in unstructured logs","volume":"19","author":"Meng","year":"2019","journal-title":"Int. Jt. Conf. Artif. Intell."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Liu, P., Xu, H., Ouyang, Q., Jiao, R., Chen, Z., Zhang, S., Yang, J., Mo, L., Zeng, J., and Xue, W. (2020, January 12\u201315). Unsupervised detection of microservice trace anomalies through service-level deep bayesian networks. Proceedings of the 2020 IEEE 31st International Symposium on Software Reliability Engineering (ISSRE), Coimbra, Portugal.","DOI":"10.1109\/ISSRE5003.2020.00014"},{"key":"ref_26","unstructured":"Yang, Z., and Harris, I.G. (2025). LogLLaMA: Transformer-based log anomaly detection with LLaMA. arXiv."},{"key":"ref_27","first-page":"19622","article-title":"Large language models are zero-shot time series forecasters","volume":"36","author":"Gruver","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_28","first-page":"43322","article-title":"One fits all: Power general time series analysis by pretrained lm","volume":"36","author":"Zhou","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_29","first-page":"29532","article-title":"Language models can improve event pre-diction by few-shot abductive reasoning","volume":"36","author":"Shi","year":"2023","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_30","first-page":"1","article-title":"Pre-train, prompt, and predict: A system-atic survey of prompting methods in natural language processing","volume":"55","author":"Liu","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref_31","unstructured":"Guan, W., Cao, J., Qian, S., Gao, J., and Ouyang, C. (2024). Logllm: Log-based anomaly detection using large language models. arXiv."},{"key":"ref_32","unstructured":"Li, Z., Zhao, N., Zhang, S., Sun, Y., Chen, P., Wen, X., Ma, M., and Pei, D. (2022). Constructing large-scale real-world benchmark datasets for aiops. arXiv."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"He, P., Zhu, J., Zheng, Z., and Lyu, M.R. (2017, January 25\u201330). Drain: An online log parsing approach with fixed depth tree. Proceedings of the 2017 IEEE International Conference on Web Services (ICWS), Honolulu, HI, USA.","DOI":"10.1109\/ICWS.2017.13"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"110891","DOI":"10.1016\/j.knosys.2023.110891","article-title":"Attention-aware temporal\u2013spatial graph neural net-work with multi-sensor information fusion for fault diagnosis","volume":"278","author":"Wang","year":"2023","journal-title":"Knowl. Based Syst."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Huang, J., Yang, Y., Yu, H., Li, J., and Zheng, X. (2023, January 11\u201315). Twin graph-based anomaly detection via attentive multi-modal learning for microservice system. Proceedings of the 2023 38th IEEE\/ACM International Conference on Automated Software Engineering (ASE), Luxembourg.","DOI":"10.1109\/ASE56229.2023.00138"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"2378","DOI":"10.1109\/TNNLS.2021.3068344","article-title":"Anomaly detection on attributed networks via con-trastive self-supervised learning","volume":"33","author":"Liu","year":"2021","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Zhao, H., Wang, Y., Duan, J., Huang, C., Cao, D., Tong, Y., Xu, B., Bai, J., Tong, J., and Zhang, Q. (2020, January 17\u201320). Multivariate time-series anomaly detection via graph attention network. Proceedings of the 2020 IEEE International Conference on Data Mining (ICDM), Sorrento, Italy.","DOI":"10.1109\/ICDM50108.2020.00093"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1007\/s44267-024-00072-9","article-title":"Fusionmamba: Dynamic feature enhancement for multimodal image fusion with mamba","volume":"2","author":"Xie","year":"2024","journal-title":"Vis. Intell."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"2689","DOI":"10.1109\/TASLP.2022.3192728","article-title":"The weighted cross-modal attention mechanism with sentiment prediction auxiliary task for multimodal sentiment analysis","volume":"30","author":"Chen","year":"2022","journal-title":"IEEE\/ACM Trans. Audio Speech Lang. Process."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/959\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T17:22:49Z","timestamp":1762363369000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/959"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,5]]},"references-count":39,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["info16110959"],"URL":"https:\/\/doi.org\/10.3390\/info16110959","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,5]]}}}