OrEdge：基于正交域学习的分布式软件系统高效多模态异常检测

中文摘要 AI 辅助

我们提出OrEdge（Orthogonal-Edge），这是一个用于多模态分布式软件系统实时异常检测的轻量级框架。与依赖计算成本高昂的基于注意力机制和图架构的现有方法不同，OrEdge利用正交域时间表示实现了准确的异常检测，同时大幅降低了计算复杂度和模型规模。它联合分析包括日志、指标和调用链在内的异构监控数据，以识别异常软件行为、捕捉时间依赖关系并降低可观测性信号之间的冗余。OrEdge的核心是OrEdgeCore，这是一个轻量级正交域重构模块，可捕捉重复的时间模式同时抑制瞬态变化。在三个真实世界微服务数据集（MSDS、SN和TT）上进行评估，OrEdge实现了具有竞争力的检测性能，同时将重构模型参数规模降至最多9.6K，而现有方法的参数规模为20K至143K。这种紧凑的设计使其能够在资源受限的边缘设备上高效部署：在树莓派（Raspberry Pi）平台上，OrEdge实现了亚秒级推理，与现有方法相比，推理延迟降低了一个数量级以上。大量 ablation研究、敏感性分析、正交基评估和定性案例研究进一步验证了每个设计组件的有效性。总体而言，OrEdge证明正交域时间建模为计算密集型的基于注意力机制和图架构的方法提供了一种有效的替代方案，在边缘环境的实时多模态异常检测中，实现了检测准确性与计算效率之间的良好平衡。代码可在该https网址获取。

英文摘要

We introduce Orthogonal-Edge (OrEdge), a lightweight framework for real-time anomaly detection in multi-modal distributed software systems. Unlike existing approaches that rely on computationally expensive attention- and graph-based architectures, OrEdge leverages orthogonal-domain temporal representations to achieve accurate anomaly detection with substantially lower computational complexity and model size. It jointly analyzes heterogeneous monitoring data, including logs, metrics, and traces, to identify abnormal software behavior, capture temporal dependencies, and reduce redundancy across observability signals. At its core, OrEdge incorporates OrEdgeCore, a lightweight orthogonal-domain reconstruction module that captures recurring temporal patterns while suppressing transient variations. Evaluated on three real-world microservice datasets (MSDS, SN, and TT), OrEdge achieves competitive detection performance while reducing the reconstruction model size to at most 9.6K parameters, compared with 20K--143K parameters in existing methods. This compact design enables efficient deployment on resource-constrained edge devices: on Raspberry Pi platforms, OrEdge achieves sub-second inference and reduces inference latency by over an order of magnitude compared with existing approaches. Extensive ablation studies, sensitivity analyses, orthogonal basis evaluations, and qualitative case studies further validate the effectiveness of each design component. Overall, OrEdge demonstrates that orthogonal-domain temporal modeling provides an effective alternative to computationally intensive attention- and graph-based architectures, achieving a favorable balance between detection accuracy and computational efficiency for real-time multi-modal anomaly detection in edge environments. The code is available at https://github.com/theamrzaki/MicroService_Twin_Original.

发表机构

• Lassonde School of Engineering, York University（约克大学拉松德工程学院）

机构由 AI 辅助整理，请以论文原文为准。