Graflow: A Microservice Anomaly Detection Method Based on Cross-Modal Feature Fusion and Multi-Scale Graph Attention Networks

Abstract With the widespread adoption of microservice architectures, software systems have become increasingly complex and dynamic, leading to more diverse types of anomalies. Traditional single-modal anomaly detection methods are no longer sufficient for accurately identifying system anomalies and locating their root causes. To address these challenges, this paper proposes GRAFlow, an anomaly detection and root cause localization method based on cross-modal feature fusion and multi-scale graph attention networks. GRAFlow integrates three key modalities—logs, performance metrics, and traces—and employs a cross-modal attention mechanism to dynamically model the semantic interactions among these heterogeneous data sources, thereby enhancing detection accuracy and robustness. Additionally, a multi-scale graph attention network is introduced to capture both local dependencies and long-range propagation paths among microservices, enabling more comprehensive system state modeling. The model jointly optimizes both anomaly detection and root cause localization tasks. Experimental results on two real-world microservice datasets, TrainTicket and SocialNetwork, demonstrate that GRAFlow significantly outperforms existing state-of-the-art methods across multiple evaluation metrics, including accuracy, F1 score, HR@K, and NDCG@K, confirming its effectiveness and robustness in complex system environments.