{"id":"https://openalex.org/W7160269838","doi":"https://doi.org/10.48550/arxiv.2605.00936","title":"EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems","display_name":"EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems","publication_year":2026,"publication_date":"2026-05-01","ids":{"openalex":"https://openalex.org/W7160269838","doi":"https://doi.org/10.48550/arxiv.2605.00936"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.00936","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.00936","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.00936","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102903082","display_name":"Luan Pham","orcid":"https://orcid.org/0000-0001-7243-3225"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pham, Luan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005233952","display_name":"Victor Nicolet","orcid":"https://orcid.org/0000-0002-3743-7498"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nicolet, Victor","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029677703","display_name":"Joey Dodds","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dodds, Joey","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135372097","display_name":"Hui Guan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guan, Hui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5086206346","display_name":"Daniel Kroening","orcid":"https://orcid.org/0000-0002-6681-5283"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kroening, Daniel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9732999801635742,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9732999801635742,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.004699999932199717,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.003599999938160181,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7821999788284302},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.6866000294685364},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.5426999926567078},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5139999985694885},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.5135999917984009},{"id":"https://openalex.org/keywords/root","display_name":"Root (linguistics)","score":0.45590001344680786},{"id":"https://openalex.org/keywords/metric","display_name":"Metric (unit)","score":0.4383000135421753},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4099000096321106}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7821999788284302},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7019000053405762},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.6866000294685364},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5717999935150146},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.5426999926567078},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5139999985694885},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.5135999917984009},{"id":"https://openalex.org/C171078966","wikidata":"https://www.wikidata.org/wiki/Q111029","display_name":"Root (linguistics)","level":2,"score":0.45590001344680786},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.4383000135421753},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4099000096321106},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.4043000042438507},{"id":"https://openalex.org/C130963320","wikidata":"https://www.wikidata.org/wiki/Q1401207","display_name":"Root cause analysis","level":2,"score":0.40310001373291016},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39320001006126404},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.38280001282691956},{"id":"https://openalex.org/C84945661","wikidata":"https://www.wikidata.org/wiki/Q7366567","display_name":"Root cause","level":2,"score":0.33820000290870667},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.32600000500679016},{"id":"https://openalex.org/C123606473","wikidata":"https://www.wikidata.org/wiki/Q907918","display_name":"Complex event processing","level":3,"score":0.3160000145435333},{"id":"https://openalex.org/C179800331","wikidata":"https://www.wikidata.org/wiki/Q15260703","display_name":"Event tree analysis","level":3,"score":0.2849000096321106},{"id":"https://openalex.org/C2776544517","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Unexpected events","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C67069471","wikidata":"https://www.wikidata.org/wiki/Q1140205","display_name":"IT service continuity","level":2,"score":0.26570001244544983},{"id":"https://openalex.org/C2777317252","wikidata":"https://www.wikidata.org/wiki/Q18393516","display_name":"Rare events","level":2,"score":0.2517000138759613}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.00936","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.00936","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.00936","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.00936","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Anomaly":[0],"detection":[1,129,217],"and":[2,10,21,61,67,84,110,162,181,199,218],"localization":[3],"(ADL)":[4],"is":[5,143,173],"critical":[6],"for":[7,41,166,215],"maintaining":[8],"reliability":[9],"availability":[11],"in":[12,133,222],"cloud":[13,196],"systems.":[14,44],"Recent":[15],"ADL":[16,39],"developments":[17],"focus":[18],"on":[19,57,193],"metric":[20],"log":[22],"data,":[23,109],"leaving":[24],"event":[25,73,108,135],"data":[26,132,180],"unexplored.":[27],"To":[28,45],"address":[29],"this":[30],"gap,":[31],"we":[32,52],"propose":[33],"EventADL,":[34],"the":[35,47,89,119,126,134,156,163],"first":[36,93],"open-box":[37],"event-based":[38],"framework":[40,172],"cloud-based":[42],"service":[43,197],"motivate":[46],"design":[48],"of":[49,122,211],"our":[50],"framework,":[51],"conduct":[53],"a":[54],"systematic":[55],"analysis":[56],"520":[58],"real-world":[59,201],"incidents,":[60],"provide":[62],"insights":[63],"into":[64],"how":[65],"anomalies":[66,165,185],"their":[68,187],"root":[69,85,168,189,223],"causes":[70],"manifest":[71],"through":[72],"data.":[74],"EventADL":[75,92,149,205],"has":[76],"three":[77,194],"phases:":[78],"offline":[79],"training,":[80],"online":[81,127],"anomaly":[82,128,216],"detection,":[83],"cause":[86,169,224],"localization.":[87,170,225],"During":[88],"training":[90],"phase,":[91,130],"learns":[94,112],"Event":[95,113],"Semantic":[96],"Patterns":[97,115],"(ESPs),":[98],"which":[99,117],"capture":[100,118],"normal":[101,120],"interactions":[102,161],"between":[103,158],"system":[104,160],"entities":[105],"using":[106],"historical":[107],"then":[111],"Frequency":[114],"(EFPs),":[116],"frequency":[121],"known":[123],"ESPs.":[124],"In":[125],"any":[131],"stream":[136],"that":[137,154,204],"deviates":[138],"significantly":[139],"from":[140],"either":[141],"pattern":[142],"identified":[144],"as":[145],"anomalous.":[146],"For":[147],"localization,":[148],"constructs":[150],"an":[151],"Intervention":[152],"Graph":[153],"models":[155],"relationships":[157],"recent":[159],"detected":[164],"automatic":[167],"The":[171],"designed":[174],"to":[175,182],"operate":[176],"efficiently":[177],"with":[178,186],"unlabeled":[179],"produce":[183],"interpretable":[184],"corresponding":[188],"causes.":[190],"Our":[191],"evaluation":[192],"real":[195],"systems":[198],"two":[200],"incidents":[202],"demonstrates":[203],"outperforms":[206],"existing":[207],"methods,":[208],"achieving":[209],"F1-scores":[210],"at":[212],"least":[213],"90%":[214],"100%":[219],"top-3":[220],"accuracy":[221]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-06T00:00:00"}