PaperlayerView exact revision on arXiv

Source-linked AI summary

STAR: Adaptive Spatial-Temporal Normalization for Unified Microservice Incident Management

Xinhua Miao, Linyu Zhu, Bowei Yang, Zhengong Cai

arXiv:2609.31645v1cs.LGcs.AI

TL;DR

Static normalization can misrepresent non-stationary temporal dynamics and heterogeneous service dependencies in microservice incident management. STAR combines temporal and spatial adaptive normalization in a unified self-supervised framework, and the paper reports that it outperforms existing baselines across AD, FT, and RCL.

  • Problem

    Unified self-supervised incident-management frameworks still face representation bias from static normalization under non-stationary temporal dynamics and heterogeneous service structures.

    Source: §1 · pp. 1–2

  • Method

    STAR combines multi-scale Temporal Adaptive Normalization and structure-aware Spatial Adaptive Normalization in a unified self-supervised framework for AD, FT, and RCL.

    Source: §1 · pp. 2–3

  • Results

    STAR consistently outperforms existing baselines across AD, FT, and RCL on two real-world benchmarks.

    Source: §1 · p. 3, §5 · p. 13

  • Takeaways & Limitations

    The authors conclude that adaptive normalization offers a principled and practical foundation for robust multimodal representation learning.

    Source: §5 · p. 13

    The authors note that STAR's strong, consistent performance leaves several limitations and directions for future research.

    Source: E Limitations and Future Directions · p. 24

Abstract

from arXiv · show

Automated incident management in large-scale microservice systems relies on learning robust representations from multimodal observability data, including metrics, logs, and traces. Although recent self-supervised frameworks enable unified modeling for anomaly detection (AD), failure triage (FT), and root cause localization (RCL), they often struggle with non-stationary temporal dynamics and heterogeneous service dependency structures. In this paper, we propose STAR, a Spatial-Temporal Adaptive Representation learning framework that explicitly addresses these challenges through adaptive normalizations. STAR introduces two tightly coupled mechanisms: Temporal Adaptive Normalization (TAN), which dynamically normalizes multivariate time series using multi-scale temporal context, and Spatial Adaptive Normalization (SAN), which performs structure-aware normalization over service dependency graphs. Unlike prior methods that treat normalization as static or task-agnostic, STAR formulates it as a learnable, context-conditioned transformation aligned with the intrinsic properties of microservice systems. The resulting adaptive representations are integrated into a unified self-supervised framework, enabling end-to-end unsupervised support for AD, FT, and RCL tasks. Extensive experiments on two real-world microservice benchmarks demonstrate that STAR consistently outperforms all state-of-the-art baselines, yielding significant and stable improvements across all three tasks. Our results highlight adaptive normalization as a principled and effective mechanism for robust multimodal representation learning in complex software systems.

1 Introduction

Microservice incident management must handle non-stationary temporal dynamics and heterogeneous service structures, but static normalization can bias representations. STAR combines temporal and spatial adaptive normalization in a unified self-supervised framework for AD, FT, and RCL.

1 Introduction

  • Static normalization misaligns with non-stationary time series and heterogeneous service graphs, suppressing informative temporal deviations and limiting graph expressiveness.The paper identifies distribution shifts, concept drift, transient spikes, and varying node degrees as core challenges.Source: §1 · p. 2, Figure 1 · p. 2
  • STAR addresses temporal non-stationarity and structural heterogeneity with Temporal Adaptive Normalization (TAN) and Spatial Adaptive Normalization (SAN).TAN uses multi-scale temporal context; SAN performs structure-aware normalization over service dependency graphs.Source: §1 · pp. 2–3
  • The framework jointly supports unsupervised anomaly detection, failure triage, and root cause localization using multimodal observability data.The problem formulation includes per-instance metrics, logs, and traces, with learning from normal-period observations.Source: §1 · pp. 2–3
  • STAR outperforms all state-of-the-art baselines across AD, FT, and RCL on two real-world microservice benchmarks.The introduction reports the overall comparison across all three tasks.Source: §1 · p. 3

2 Related Work

Prior incident-management work ranges from task-specific pipelines to unified frameworks, while self-supervised representation learning offers a label-free route. The related work identifies static-normalization bias as an overlooked issue and positions STAR's joint temporal and structural adaptation against existing methods.

2.1 Automated Incident Management

  • Task-specific incident-management methods cannot exploit shared diagnostic signals, while unified approaches may depend on labels, handcrafted rules, or costly reasoning components.The section contrasts early separate methods with multi-task and LLM-based frameworks.Source: §2.1 · p. 3

2.2 Self-Supervised and Multimodal Representation Learning

  • Existing self-supervised and multimodal frameworks focus on feature fusion and dependency modeling but largely overlook static-normalization bias.ART jointly supports AD, FT, and RCL using channel, temporal, and call-dependency models.Source: §2.2 · pp. 3–4

2.3 Adaptive Normalization

  • STAR jointly integrates temporal and structural adaptive normalization for unified AD, FT, and RCL, unlike prior methods described as addressing only one side.The section contrasts time-series methods targeting forecasting with graph normalizers that do not explicitly model directed, heterogeneous service dependencies.Source: §2.3 · p. 4

3 Methodology

STAR combines temporal and spatial adaptive normalization to model multimodal microservice data and service dependencies. TAN conditions normalization on multi-scale temporal context, while SAN calibrates node features using graph structure.

3.1 Overview

  • STAR combines TAN and SAN to capture spatial-temporal dependencies for unsupervised AD, FT, and RCL.Source: §3.1 · p. 4

3.2 Temporal Adaptive Normalization (TAN)

  • TAN dynamically generates normalization parameters from multi-scale temporal context to handle non-stationary, channel-heterogeneous multimodal time series.Source: §3.2 · p. 4, De-Normalization · p. 6

Multi-Scale Contextual Feature Extraction

  • The temporal feature extractor applies convolutions with different kernel sizes and global average pooling to obtain multi-scale features.It transposes the input tensor from B×L×C to B×C×L before convolution.Source: Multi-Scale Contextual Feature… · p. 4

Adaptive Parameter Generation

  • A fully connected parameter generator maps concatenated context features to scale and shift parameters for adaptive normalization.The output is split into γ1, δ1, γ2, and δ2.Source: Adaptive Parameter Generation · p. 5

De-Normalization

  • TAN de-normalizes the Transformer encoder features to restore them near their original scale, producing the temporal output.Source: De-Normalization · p. 6

3.3 Spatial Adaptive Normalization (SAN)

Graph structure adaptive normalization

  • SAN embeds clipped node in-degrees and derives graph-level adaptive scaling and bias from the node embeddings.The fused adaptive parameters combine with standard learnable normalization parameters to scale and offset normalized node features.Source: Graph structure adaptive normalization · p. 7

Structure-awareness and residual learning

  • The GraphSAGE encoder adds input projection, residual connections, and structure-adaptive normalization to support stable, expressive node representations.Residual connections are used in all graph convolutional layers except the first, and a skip connection projects the input directly to the output.Source: Structure-awareness and residual… · pp. 8–9

4 Experiments

The experiments use two multimodal microservice datasets and compare STAR with single-task and multitask baselines. AD and FT are evaluated with precision, recall, and F1; RCL uses top-k accuracy.

Datasets

  • D1 is a simulated e-commerce system with 46 instances, and D2 is a bank management system with 18 instances; both contain metrics, logs, and traces.The training and test split follows the original setup.Source: Datasets · p. 9

Baselines

  • Comparisons include single-task AD, FT, and RCL models and multitask methods, using the benchmark models selected for comparison with TrioXpert.Source: Baselines · p. 9

Evaluation Metrics

  • AD and FT use precision, recall, and F1-score, while RCL is evaluated with top-k accuracy.The RCL top-k accuracy measures whether the ground-truth root cause appears among the first k predictions.Source: Evaluation Metrics · p. 10

Appendix B.

STAR combines temporal and degree-aware spatial adaptive normalization in a unified framework, outperforming baselines across three diagnostic tasks. Ablations and hyperparameter analyses further examine the modules and their settings.

4.2 Overall performance

  • STAR significantly outperforms all baselines across AD, FT, and RCL, with AD F1 0.956 (D1)/0.983 (D2), weighted FT F1 0.870/0.855, and RCL AVG@5 0.793/0.885.The reported metrics are for D1/D2, respectively.Source: §4.2 · pp. 10–11

4.3 Comparison with Alternative Normalization Methods.

  • TAN outperforms temporal baselines through instance-specific scale and shift from multi-scale context, while SAN outperforms GraphNorm and DegNorm by conditioning parameters on degree embeddings.TAN and SAN achieve the best or near-best performance across settings in Table 3.Source: §4.3 · p. 11, Table 3 · p. 11

4.4 Ablation Study

  • STAR beats its ablation variants in almost all cases, while variants without TAN or SAN also surpass the ART baseline.The ablations remove both modules, TAN alone, or SAN alone.Source: §4.4 · p. 12, Table 4 · p. 12

4.5 Hyperparameter Analysis

  • Three scales achieve SOTA performance in almost all cases, but the optimal maximum degree varies by task and dataset, so STAR uses scenario-specific settings.The analysis varies Ns while holding D at 100, and varies D while holding Ns at 3.Source: §4.5 · p. 12, Figure 4 · p. 13

5 Conclusion

  • The conclusion presents STAR as a robust, generalizable, and scalable approach to unsupervised AD, FT, and RCL on two real-world benchmarks.It frames adaptive normalization as a practical foundation for multimodal representation learning in complex systems.Source: §5 · p. 13

A.1 Existing Methods

The background describes ART and its multimodal diagnostic pipeline, then motivates STAR’s temporal and spatial adaptive normalization. It also characterizes the two benchmark datasets.

A.1 Existing Methods

  • ART is an end-to-end unsupervised framework that extracts shared multimodal knowledge for AD, FT, and RCL through three diagnostic modules.Its modules cover dependency-aware state learning, fault representation acquisition, and unsupervised diagnosis.Source: §A.1 · p. 16

Dependency-Aware Status Learning

  • ART serializes metrics, logs, and traces, then models channel, temporal, and call dependencies using Transformer, GRU, and GraphSAGE components.The call-dependency model uses instance neighbors in the graph.Source: Dependency-Aware Status Learning · p. 16

Unified Failure Representation Acquisition

Motivation for Temporal Adaptive Normalization (TAN)

  • TAN uses one temporal scale per modality (Ns = 3) and combines base normalization, context-driven adaptive transformation, and weighted fusion.The scales address different temporal resolutions of metrics, logs, and traces; fusion can favor base normalization in stable periods and adaptive features during incidents.Source: Motivation for Temporal Adaptive… · pp. 17–18

Motivation for Spatial Adaptive Normalization (SAN)

  • SAN embeds node in-degrees and derives degree-aware corrections from each graph snapshot, adapting normalization to topology changes and structural roles.The paper contrasts this with GraphNorm’s shared shift and DegNorm’s post-hoc degree correction; SAN is trained jointly with TAN for AD, FT, and RCL.Source: Motivation for Spatial Adaptive… · pp. 18–19

Joint Temporal-Spatial Normalization

  • STAR applies TAN before the Transformer and SAN after the GNN, with residual connections intended to preserve the original signal when normalization is unnecessary.The combined design addresses temporal development and spatial propagation of failures.Source: Joint Temporal-Spatial Normalization · p. 19

Dataset D1

  • D1 is a simulated e-commerce system with 46 instances and replayed, annotated failure cases spanning five failure types.It includes 40 microservice instances and six virtual machines.Source: §B.1 · p. 19, Dataset D1 · p. 19

Dataset D2

  • D2 is a commercial bank production system with 18 instances and six months of manually labeled failures; confidentiality restrictions make it unavailable publicly.The failures include memory, CPU, network, disk, JVM-memory, and JVM-CPU types.Source: Dataset D2 · pp. 19–20

Data Characteristics and Distribution Shift

The two datasets differ in feature distributions, temporal variation, and graph topology. Evaluation uses a failure-timestamp-based temporal split.

Data Characteristics and Distribution Shift

Train-Test Split

  • The split point is the earliest timestamp among the last 40% of failure cases; earlier data train and initialize the model, while later data are used for evaluation.The authors state that this temporal split avoids information leakage and reflects realistic deployment scenarios.Source: Train-Test Split · p. 20

B.2 Metrics Details

The evaluation measures binary anomaly detection, multiclass failure triage, and ranked root cause localization using standard task-specific metrics.

B.2 Metrics Details

  • The three diagnostic tasks follow standard evaluation protocols used in prior work.The section covers AD, FT, and RCL.Source: §B.2 · p. 21
  • AD is binary classification and FT is multiclass classification; both report precision, recall, and F1-score, with weighted F1 additionally reported for imbalanced failure types.Weighted F1 weights each class’s F1 by its evaluation-set support.Source: §B.2 · p. 21
  • RCL uses Top-k accuracy, which checks whether the ground-truth root cause appears among the top-k predicted instances.The evaluation also reports average Top-k accuracy over k ∈ {1, 2, 3, 4, 5}.Source: §B.2 · pp. 21–22

B.3 Implementation details

STAR uses the ART method’s experimental settings, training strategies, and hyperparameter ranges, with specific choices for TAN scales and SAN maximum degree.

B.3 Implementation details

  • STAR uses the same experimental settings, training strategies, and hyperparameter ranges as ART.Source: §B.3 · p. 22
  • In the experimental settings, the STAR method sets the number of scales in temporal adaptive normalization (TAN) to Ns = 3, while its training strategies and hyperparameter ranges match ART.Source: §B.3 · p. 22
  • SAN uses scenario-specific maximum-degree settings, while Table 5 identifies the parameter setting of maximum degree D.Source: §B.3 · p. 22, Table 5 · p. 23

C Model Efficiency

STAR’s lightweight, parallelizable normalization modules support efficient inference on the evaluated benchmarks. The visualizations show more compact and separable representations after TAN and SAN.

C Model Efficiency

  • TAN uses shallow multi-scale temporal convolutions and SAN conditions normalization on simple structural features, making both modules lightweight and highly parallelizable.Source: C Model Efficiency · p. 23
  • STAR’s end-to-end inference runtimes are reported as within real-time or near-real-time requirements across AD, FT, and RCL on D1 and D2.Table 6 reports the runtimes in seconds for each task and dataset.Source: C Model Efficiency · p. 23, Table 6 · p. 23
  • STAR is described as balancing representation quality and computational cost to enable practical end-to-end deployment.Source: C Model Efficiency · p. 23

D Visualization of Adaptive Normalization Effects

  • After TAN, temporal feature clusters become more compact with less overlap between fault types and normal states; after SAN, graph-role clusters improve root-cause-instance separability.Figure 8 visualizes intermediate representations before and after the two normalization modules on D1 and D2.Source: D Visualization of Adaptive… · p. 23, Figure 8 · p. 24

E Limitations and Future Directions

The authors identify boundaries in STAR’s computational scalability, topology assumptions, and adaptation to new failure types. They describe these as directions for future development.

E.1 Scalability and Computational Efficiency

  • Although STAR meets real-time or near-real-time inference requirements on evaluated benchmarks, further efficiency optimization may be needed for ultra-large-scale systems or resource-constrained edge environments.The authors identify pruning, knowledge distillation, and dynamic inference as possible techniques.Source: §E.1 · p. 24

E.2 Dynamic Topology Modeling

  • STAR assumes relatively stable service topologies within short time windows, and rapid topology changes may affect dependency modeling and root cause localization.Dynamic graph learning and temporal graph networks are identified as promising directions for modeling evolving dependencies.Source: §E.2 · pp. 24–25

E.3 Adaptation to Evolving Failure Patterns

  • Because failure triage initializes its clustering structure from historical failure patterns, adaptability to previously unseen failure types may be limited during early deployment.The authors suggest online or incremental learning to adapt to emerging patterns without full retraining.Source: §E.3 · p. 25

E Limitations and Future Directions

  • The authors frame these limitations as opportunities to extend STAR toward more scalable, adaptive, and resilient incident management systems.Source: §E.3 · p. 25
Loading 2609.31645v1…