[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85829-en":3,"doc-seo-85829-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85829,8796095461610,"Oliver","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","Chain-Aware Encoding for Microservice Trace Anomaly Detection","Microservice traces can exhibit structural anomalies even when every individual span returns normally, making per-span monitoring blind to issues such as silently skipped risk checks or incorrect call ordering. Existing sequence models treat endpoints as context-free tokens, collapsing invocation contexts and masking path-dependent behavior differences. Chain-aware encoding represents each event as an (endpoint, root-to-span invocation chain) pair. Unseen chains are flagged without inference, and next-event prediction becomes context-conditional, turning subtle path anomalies into clear outliers. A lightweight dual-task LSTM (CHAINLSTM) performs online detection and improves F1 on TrainTicket.","Chain-Aware Encoding for Microservice Trace  \nAnomaly Detection  \nYiliu Xu∗ , Ziwei Hong†, Zhongheng Yang‡, Xinjin Li§ , and Yu Ma∗  \n∗ Carnegie Mellon University †Lehigh University ‡Northeastern University § Columbia University  \narXiv :2607 . 10 156v 1 [ cs . SE] 11 Jul 2026  \nAbstract—Microservice traces can be structurally anomalous even when every span returns normally—a payment flow that silently skips a risk check looks fine to any per-span monitor. Sequence models like DeepLog address this by predicting the next event, but they treat each API endpoint as a context-free token: the same endpoint reached through different invocation chains is mapped to the same vocabulary entry, even when its normal behavior differs across contexts. We propose encoding each event as an (endpoint, root-to-span invocation chain) pair instead. This simple change has two consequences: unseen chains are flagged without model inference, and next-event predictions become context-conditional, turning subtle path anomalies into clear outliers. We instantiate this idea in CHAINLSTM, a lightweight dual-task LSTM supporting per-event online detection. On the TrainTicket benchmark, CHAINLSTM achieves 94.3% F1 (+5.3pp over DeepLog) with comparable latency recall and 99.1% path recall. Case analysis shows that chain-aware encoding shifts median prediction probability on path anomalies from 0.91 to 0.002, suggesting a wider separation margin for threshold-based detection.  \nIndex Terms—microservice, anomaly detection, distributed tracing, sequence modeling, AIOps  \nI. INTRODUCTION  \nIn microservice systems [1], [2], an anomalous trace can have every individual span return 200 OK with normal latency—yet the trace pattern is structurally wrong. A payment flow that bypasses a risk check due to a reordering bug looks normal to any per-span monitor. Liu et al. [3] report that rule-based methods at WeBank missed 20% of anomalies for exactly this reason. These implicit anomalies—wrong call ordering, missing calls, context-dependent latency shifts—are invisible to status-code checks and fixed thresholds [4], yet indicate real faults.  \nLearning-based approaches address this gap but face tradeoffs. DeepLog [5] predicts the next event in a flat endpoint sequence with an LSTM, enabling real-time detection but ignoring the invocation chain—the path through which a service is reached. The same endpoint can have different normal behavior depending on its calling context, and collapsing these contexts creates blind spots. TraceAnomaly [3] captures invocation structure via a whole-trace VAE, but requires the complete trace before detection and is computationally heavyweight. Few existing approaches explicitly combine invocation-chain context with real-time incremental detection. We propose CHAINLSTM, a lightweight LSTM-based approach that bridges this gap. Our contributions are: (1) an invocation chain-aware encoding that treats each (endpoint, chain) pair as a distinct token, enabling detection of structural  \nanomalies not directly exposed by endpoint-only encodingsand producing sharper context-conditional predictions; (2) a lightweight online instantiation of this encoding in a dual-task LSTM with simple path, latency, and length checks, supporting per-event detection during trace execution; (3) an evaluation on TrainTicket [6] showing 94 .3% F1, outperforming DeepLog by 5.3 points with only ∼65K parameters. We focus on tracelevel implicit anomalies; our approach complements log-level and metric-level monitoring. In maintenance settings, such early structural alerts can help detect deployment regressions, validate service-call evolution, and narrow debugging to the first context-violating span.  \nII. RELATED WORK  \nLog- and trace-based approaches. DeepLog [5] predicts the next log key from a sliding window via LSTM; extensions [7], [8] add semantic embeddings. Applied to traces, these methods treat each endpoint as contextindependent, conflating events that differ in","cbCair4PPAd7UHog","https://ap.wps.com/l/cbCair4PPAd7UHog","pdf",305292,1,6,"English","en",105,"# Introduction\n# Related Work\n# Method\n## Problem Formulation and Detection Scope","[{\"question\":\"Why can microservice traces be anomalous even when every span returns normally?\",\"answer\":\"Because the overall invocation pattern can be structurally wrong while each span still returns success and normal latency. Examples include skipped calls or wrong call ordering that status-code checks do not reveal.\"},{\"question\":\"How does the proposed chain-aware encoding differ from endpoint-only sequence models?\",\"answer\":\"It encodes each event using an (endpoint, root-to-span invocation chain) pair so the same endpoint reached under different call paths maps to different tokens. This prevents collapsing context-dependent behaviors.\"},{\"question\":\"What benefits does CHAINLSTM provide for real-time anomaly detection?\",\"answer\":\"CHAINLSTM uses a lightweight dual-task LSTM to perform per-event online detection during trace execution. It flags unseen invocation chains without model inference and yields context-conditional next-event predictions that separate path anomalies more clearly.\"}]",1784206524,15,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"chain-aware-encoding-for-microservice-trace-anomaly-detection","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/chain-aware-encoding-for-microservice-trace-anomaly-detection/85829/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why can microservice traces be anomalous even when every span returns normally?","Question",{"text":75,"@type":76},"Because the overall invocation pattern can be structurally wrong while each span still returns success and normal latency. Examples include skipped calls or wrong call ordering that status-code checks do not reveal.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed chain-aware encoding differ from endpoint-only sequence models?",{"text":80,"@type":76},"It encodes each event using an (endpoint, root-to-span invocation chain) pair so the same endpoint reached under different call paths maps to different tokens. This prevents collapsing context-dependent behaviors.",{"name":82,"@type":73,"acceptedAnswer":83},"What benefits does CHAINLSTM provide for real-time anomaly detection?",{"text":84,"@type":76},"CHAINLSTM uses a lightweight dual-task LSTM to perform per-event online detection during trace execution. It flags unseen invocation chains without model inference and yields context-conditional next-event predictions that separate path anomalies more clearly.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]