Cross-Modal Attention Networks for Multi-Modal Anomaly Detection in System Software

Anomaly detection in system software traditionally relies on single-modal algorithms that analyze either discrete log events or continuous performance metrics in isolation, potentially missing complex anomalies that manifest across both modalities. We present a novel deep learning framework that leverages cross-modal attention mechanisms to jointly model log sequences and performance metrics for enhanced anomaly detection. Our method proposes Long Short-Term Memory (LSTM) networks to capture temporal dependencies in log event sequences and Temporal Convolutional Networks (TCNs) to model performance metric time series. The core innovation lies in our Cross-Modal Attention Mechanism, which dynamically weighs log events and metric features based on inter-modal relationships, enabling the detection of subtle anomalies that require contextual information from both data sources. Unlike conventional multi-modal fusion techniques that merely concatenate features, our attention mechanism explicitly models the dependencies between log patterns and metric behaviors, allowing the network to focus on relevant log events during metric anomalies and vice versa. We conduct comprehensive experiments on public datasets including HDFS and BGL logs paired with cloud computing performance metrics, as well as real-world cloud environments. Our method achieves significant improvements over single-modal baselines, with F1-scores increasing by 12.3% on average across datasets. Ablation studies confirm the effectiveness of the cross-modal attention mechanism, while real-time deployment experiments using Apache Flink demonstrate practical applicability with sub-second latency. The proposed framework addresses a critical gap in system software monitoring by providing a principled approach to multi-modal anomaly detection that scales to enterprise-level deployments.