在异构云遥测数据集上评估异常检测
Benchmarking Anomaly Detection Across Heterogeneous Cloud Telemetry Datasets
AI总结：
本研究评估了四种深度学习模型在异构云遥测数据集上的异常检测性能，发现模型性能不仅取决于架构，还受校准稳定性和特征空间几何影响。
摘要：
异常检测对于保持云系统可靠和稳定至关重要。深度学习已经提升了时间序列异常检测，但大多数模型仅在单个数据集上进行评估。这引发了关于这些模型是否能处理不同类型遥测数据，尤其是在大规模和高维环境中存在疑问。在本研究中，我们评估了四种深度学习模型，包括GRU、TCN、Transformer和TSMixer，并包含了Isolation Forest作为经典基线。这些模型在四个遥测数据集上进行测试：Numenta Anomaly Benchmark、Microsoft Cloud Monitoring数据集、Exathlon数据集和IBM Console数据集。这些数据集在结构、维度和标注策略上各不相同。它们包括单变量时间序列、合成多变量工作负载和具有超过10万个特征的真实世界生产遥测数据。我们使用统一的训练和评估流程处理所有数据集。评估包括NAB风格的指标，以捕捉异常持续时间连续时间区间的数据集中的早期检测行为。这使得在异常发生在连续时间区间的情况下，即使标签记录在点级别，也能实现基于窗口的评分。统一的设置使得在共享评分和校准假设下对模型行为进行一致分析。我们的结果表明，云系统中的异常检测性能不仅由模型架构决定，还受到校准稳定性和特征空间几何的关键影响。通过发布我们的预处理流程、基准配置和评估工具，我们旨在支持可重复且面向部署的异常检测系统评估，以云环境为研究对象。
英文摘要：
Anomaly detection is important for keeping cloud systems reliable and stable. Deep learning has improved time-series anomaly detection, but most models are evaluated on one dataset at a time. This raises questions about whether these models can handle different types of telemetry, especially in large-scale and high-dimensional environments. In this study, we evaluate four deep learning models, GRU, TCN, Transformer, and TSMixer. We also include Isolation Forest as a classical baseline. The models are tested across four telemetry datasets: the Numenta Anomaly Benchmark, Microsoft Cloud Monitoring dataset, Exathlon dataset, and IBM Console dataset. These datasets differ in structure, dimensionality, and labelling strategy. They include univariate time series, synthetic multivariate workloads, and real-world production telemetry with over 100,000 features. We use a unified training and evaluation pipeline across all datasets. The evaluation includes NAB-style metrics to capture early detection behaviour for datasets where anomalies persist over contiguous time intervals. This enables window-based scoring in settings where anomalies occur over contiguous time intervals, even when labels are recorded at the point level. The unified setup enables consistent analysis of model behaviour under shared scoring and calibration assumptions. Our results demonstrate that anomaly detection performance in cloud systems is governed not only by model architecture, but critically by calibration stability and feature-space geometry. By releasing our preprocessing pipelines, benchmark configuration, and evaluation artifacts, we aim to support reproducible and deployment-aware evaluation of anomaly detection systems for cloud environments.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
