{"id":"https://openalex.org/W4416582939","doi":"https://doi.org/10.1109/tnsm.2025.3634590","title":"MADGuard: A High-Performance Microservice Anomaly Detection System With Multidimensional Data Fusion and Temporal Causal Analysis","display_name":"MADGuard: A High-Performance Microservice Anomaly Detection System With Multidimensional Data Fusion and Temporal Causal Analysis","publication_year":2025,"publication_date":"2025-11-24","ids":{"openalex":"https://openalex.org/W4416582939","doi":"https://doi.org/10.1109/tnsm.2025.3634590"},"language":null,"primary_location":{"id":"doi:10.1109/tnsm.2025.3634590","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2025.3634590","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075605296","display_name":"Yanshang Yin","orcid":"https://orcid.org/0000-0003-4790-9361"},"institutions":[{"id":"https://openalex.org/I55712492","display_name":"Zhejiang University of Technology","ror":"https://ror.org/02djqfd08","country_code":"CN","type":"education","lineage":["https://openalex.org/I55712492"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanshang Yin","raw_affiliation_strings":["School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-4790-9361","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China","institution_ids":["https://openalex.org/I55712492"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029428788","display_name":"Tiantian Zhu","orcid":"https://orcid.org/0000-0002-8657-662X"},"institutions":[{"id":"https://openalex.org/I55712492","display_name":"Zhejiang University of Technology","ror":"https://ror.org/02djqfd08","country_code":"CN","type":"education","lineage":["https://openalex.org/I55712492"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tiantian Zhu","raw_affiliation_strings":["School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-8657-662X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China","institution_ids":["https://openalex.org/I55712492"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056827411","display_name":"Tieming Chen","orcid":"https://orcid.org/0000-0003-4664-3311"},"institutions":[{"id":"https://openalex.org/I55712492","display_name":"Zhejiang University of Technology","ror":"https://ror.org/02djqfd08","country_code":"CN","type":"education","lineage":["https://openalex.org/I55712492"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tieming Chen","raw_affiliation_strings":["School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-4664-3311","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China","institution_ids":["https://openalex.org/I55712492"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5068773146","display_name":"Mingqi Lv","orcid":"https://orcid.org/0000-0003-4810-7491"},"institutions":[{"id":"https://openalex.org/I55712492","display_name":"Zhejiang University of Technology","ror":"https://ror.org/02djqfd08","country_code":"CN","type":"education","lineage":["https://openalex.org/I55712492"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingqi Lv","raw_affiliation_strings":["School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-4810-7491","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, China","institution_ids":["https://openalex.org/I55712492"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I55712492"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.36815301,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"23","issue":null,"first_page":"767","last_page":"788"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9930999875068665,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9930999875068665,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.0012000000569969416,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6751999855041504},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5540000200271606},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.49779999256134033},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.49050000309944153},{"id":"https://openalex.org/keywords/hash-function","display_name":"Hash function","score":0.4878000020980835},{"id":"https://openalex.org/keywords/sensor-fusion","display_name":"Sensor fusion","score":0.4226999878883362},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.38199999928474426},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.3562000095844269},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.35040000081062317}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8402000069618225},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6751999855041504},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6401000022888184},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5540000200271606},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.49779999256134033},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.49050000309944153},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.4878000020980835},{"id":"https://openalex.org/C33954974","wikidata":"https://www.wikidata.org/wiki/Q486494","display_name":"Sensor fusion","level":2,"score":0.4226999878883362},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.38589999079704285},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.38199999928474426},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3562000095844269},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.35040000081062317},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.3140000104904175},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.30570000410079956},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.303600013256073},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.3003999888896942},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3003000020980835},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.29980000853538513},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.2865999937057495},{"id":"https://openalex.org/C200749887","wikidata":"https://www.wikidata.org/wiki/Q1165574","display_name":"System monitoring","level":2,"score":0.2854999899864197},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2782000005245209},{"id":"https://openalex.org/C22047676","wikidata":"https://www.wikidata.org/wiki/Q898680","display_name":"Clustering coefficient","level":3,"score":0.2662999927997589},{"id":"https://openalex.org/C2987525970","wikidata":"https://www.wikidata.org/wiki/Q96374569","display_name":"Causal analysis","level":2,"score":0.2606000006198883},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.25920000672340393},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.2533999979496002}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tnsm.2025.3634590","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2025.3634590","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1083766541","display_name":null,"funder_award_id":"62372410","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2375910601","display_name":null,"funder_award_id":"RF-A2023009","funder_id":"https://openalex.org/F4554350417","funder_display_name":"Fundamental Research Funds for the Provincial Universities of Zhejiang"},{"id":"https://openalex.org/G3558286546","display_name":null,"funder_award_id":"62002324","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6401997768","display_name":"\u6570\u636e\u4e0e\u77e5\u8bc6\u6df7\u5408\u9a71\u52a8\u7684\u590d\u6742\u7f51\u7edc\u653b\u51fb\u68c0\u6d4b\u65b9\u6cd5\u7814\u7a76","funder_award_id":"LZ23F020011","funder_id":"https://openalex.org/F4320338464","funder_display_name":"Natural Science Foundation of Zhejiang Province"},{"id":"https://openalex.org/G6450626337","display_name":null,"funder_award_id":"RF-A2023009","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G7595483912","display_name":null,"funder_award_id":"2021C01117","funder_id":"https://openalex.org/F8142712028","funder_display_name":"Key Research and Development Program of Zhejiang Province"},{"id":"https://openalex.org/G8825203574","display_name":null,"funder_award_id":"U22B2028","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G979421220","display_name":null,"funder_award_id":"LQ21F020016","funder_id":"https://openalex.org/F4320338464","funder_display_name":"Natural Science Foundation of Zhejiang Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null},{"id":"https://openalex.org/F4320338464","display_name":"Natural Science Foundation of Zhejiang Province","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4554350417","display_name":"Fundamental Research Funds for the Provincial Universities of Zhejiang","ror":null},{"id":"https://openalex.org/F8142712028","display_name":"Key Research and Development Program of Zhejiang Province","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":42,"referenced_works":["https://openalex.org/W1980867644","https://openalex.org/W2129860818","https://openalex.org/W2239647876","https://openalex.org/W2605904959","https://openalex.org/W2898017895","https://openalex.org/W2911048197","https://openalex.org/W2942615718","https://openalex.org/W2985907279","https://openalex.org/W2998908795","https://openalex.org/W3011512329","https://openalex.org/W3015650867","https://openalex.org/W3094662328","https://openalex.org/W3110723107","https://openalex.org/W3121723636","https://openalex.org/W3126165507","https://openalex.org/W3157720608","https://openalex.org/W3212868562","https://openalex.org/W4212848882","https://openalex.org/W4214831727","https://openalex.org/W4224245486","https://openalex.org/W4284664377","https://openalex.org/W4288057803","https://openalex.org/W4297830654","https://openalex.org/W4308219550","https://openalex.org/W4309939034","https://openalex.org/W4322493038","https://openalex.org/W4323308647","https://openalex.org/W4361285721","https://openalex.org/W4377007561","https://openalex.org/W4386858763","https://openalex.org/W4386946955","https://openalex.org/W4391558506","https://openalex.org/W4391725260","https://openalex.org/W4393621502","https://openalex.org/W4396795653","https://openalex.org/W4399989299","https://openalex.org/W4402040376","https://openalex.org/W4402264034","https://openalex.org/W4402265033","https://openalex.org/W4402288718","https://openalex.org/W4405975062","https://openalex.org/W4407923863"],"related_works":[],"abstract_inverted_index":{"With":[0],"the":[1,7,113,122],"widespread":[2],"adoption":[3],"of":[4,40],"microservice":[5,126,148],"architectures,":[6],"security":[8],"threats":[9],"they":[10],"face":[11],"have":[12],"become":[13],"increasingly":[14],"sophisticated.":[15],"Existing":[16],"anomaly":[17,49,137,142],"detection":[18,50,158],"methods":[19],"based":[20],"on":[21,146],"system":[22,51,88],"calls":[23],"exhibit":[24],"significant":[25],"limitations":[26],"in":[27,112,125],"three":[28,59],"key":[29,60],"aspects:":[30],"multidimensional":[31,74],"data":[32],"fusion,":[33],"temporal":[34],"causality":[35],"modeling,":[36],"and":[37,73,79,101],"forensic":[38,130],"analysis":[39,131],"anomalies.":[41],"This":[42],"paper":[43],"proposes":[44],"MADGuard,":[45],"a":[46,65,90,108],"provenance":[47,67],"graph-based":[48],"for":[52,82],"microservices.":[53],"MADGuard":[54],"addresses":[55],"these":[56],"challenges":[57],"through":[58,140],"innovations:":[61],"(1)":[62],"It":[63],"constructs":[64],"native":[66],"graph":[68,84],"by":[69],"integrating":[70],"multisource":[71],"services":[72],"data,":[75],"employing":[76],"feature":[77],"hashing":[78],"positional":[80],"encoding":[81],"efficient":[83],"representation;":[85],"(2)":[86],"The":[87],"introduces":[89],"Temporal":[91],"Graph":[92],"Network":[93],"(TGN)":[94],"model":[95],"combined":[96],"with":[97],"edge":[98],"reconstruction":[99,139],"error":[100],"Inverse":[102],"Document":[103],"Frequency":[104],"(IDF)":[105],"weighting,":[106],"achieving":[107],"15.":[109],"07%":[110],"improvement":[111],"F1":[114],"score":[115],"compared":[116],"to":[117],"existing":[118],"methods;":[119],"(3)":[120],"For":[121],"first":[123],"time":[124],"security,":[127],"an":[128],"integrated":[129],"module":[132],"is":[133],"implemented,":[134],"allowing":[135],"rapid":[136],"path":[138],"aggregated":[141],"subgraphs.":[143],"Comprehensive":[144],"evaluations":[145],"typical":[147],"benchmarks":[149],"(TeaStore,":[150],"RobotShop,":[151],"SockShop)":[152],"demonstrate":[153],"MADGuard\u2019s":[154],"superior":[155],"performance:":[156],"94.08%":[157],"accuracy,":[159],"significantly":[160],"outperforming":[161],"state-of-the-art":[162],"approaches":[163],"while":[164],"maintaining":[165],"practical":[166],"operational":[167],"efficiency.":[168]},"counts_by_year":[],"updated_date":"2026-07-13T07:31:44.756512","created_date":"2025-11-25T00:00:00"}