Praxium: Diagnosing Cloud Anomalies with AI-based Telemetry and Dependency Analysis

Rohan Kumar; Jason Li; Zongshun Zhang; Syed Mohammad Qasim; Gianluca Stringhini; Ayse K. Coskun

cs.SEMar 25, 2026

Praxium: Diagnosing Cloud Anomalies with AI-based Telemetry and Dependency Analysis

Authors: Rohan Kumar, Jason Li, Zongshun Zhang, Syed Mohammad Qasim, Gianluca Stringhini, Ayse K. Coskun

Organizations: Boston University

Abstract

As the modern microservice architecture for cloud applications grows in popularity, cloud services are becoming increasingly complex and more vulnerable to misconfiguration and software bugs. Traditional approaches rely on expert input to diagnose and fix microservice anomalies, which lacks scalability in the face of the continuous integration and continuous deployment (CI/CD) paradigm. Microservice rollouts, containing new software installations, have complex interactions with the components of an application. Consequently, this added difficulty in attributing anomalous behavior to any specific installation or rollout results in potentially slower resolution times. To address the gaps in current diagnostic methods, this paper introduces Praxium, a framework for anomaly detection and root cause inference. Praxium aids administrators in evaluating target metric performance in the context of dependency installation information provided by a software discovery tool, PraxiPaaS. Praxium continuously monitors telemetry data to identify anomalies, then conducts root cause analysis via causal impact on recent software installations, in order to provide site reliability engineers (SRE) relevant information about an observed anomaly. In this paper, we demonstrate that Praxium is capable of effective anomaly detection and root cause inference, and we provide an analysis on effective anomaly detection hyperparameter tuning as needed in a practical setting. Across 75 total trials using four synthetic anomalies, anomaly detection consistently performs at >0.97 macro-F1. In addition, we show that causal impact analysis reliably infers the correct root cause of anomalies, even as package installations occur at increasingly shorter intervals.

Figures & tables

Figure 1: An overview of Praxium. The system monitors a microservice cluster, collecting telemetry, trace, and installation data via Prometheus, Jaeger, and PraxiPaaS. Install logs are stored in MongoDB, while telemetry is streamed through anomaly detection. Upon detection of an anomaly, trace data populates the causal graph generator, and critical path logs along with target pod metrics pass to root cause analysis. From there, Praxium diagnoses the anomaly to a single installation.

Figure 2: An example of the software dependency logging system. A background process periodically scans for software changes that occurred within the past $T$ time units. For each service, it creates a SBOM log history in a persistent database. In the figure, there were $3$ rollouts for Service $A$ and each of them updates the $libcurl$ lib. The first generation found no changes to Service $A$ in the past $T$ unit time, so no entry is created in the database. The second one can see two rollouts, so it create an entry with the timestamp ( $Ts_{0}$ ) as the key where the value is a list of sets including software changes in deployment order. Note that the first set includes all software of the service but the second set only has the changed ones. The final run can see the last rollout and creates a corresponding entry in the database.

Injected Anomaly	Injection Method and Target Component
CPU Spike	A script triggers CPU-intensive computations inside the target pod to simulate high CPU usage.
Disk Saturation	Temporary files are written to exhaust available disk space on the pod’s storage volume.
Memory Leak	The application is instrumented to continuously allocate memory without releasing it.
Network Latency	Repeated outbound HTTP requests are issued from the pod to flood its network interface.

TABLE I: Synthetic Anomalies Injected During Experiments

Figure 3: An example of the hyperparameters of experiment 1. Stride $s$ controls the distance of time shifted between each window. Window size $w$ is the duration of each window. Threshold $T$ is the number of consecutive anomalous windows necessary to alarm the system about an anomaly.

Anomaly	Best W, S (sec)		No Thresholding (T=1)				With Thresholding (T=2)
Anomaly	W	S	F1	Precision	Recall	Accuracy	F1	Precision	Recall	Accuracy
CPU	600	300	0.985	0.972	0.998	0.996	1.0	1.0	1.0	1.0
RAM	600	300	0.961	0.932	0.994	0.989	1.0	1.0	1.0	1.0
DISK	600	30	0.951	0.941	0.960	0.978	0.976	0.987	0.961	0.990
HTTP	300	60	0.958	0.932	0.988	0.936	0.995	0.999	0.991	0.999

TABLE II: Best Window Duration (W) and Stride (S) Configuration with Performance Metrics for Each Anomaly Type

Figure 4: An example of experiment 2, in two cases. First, the case 1 is trivial: there is an easily identified rollout that correlates to the shift in target metric. Then, in case 2, the quick succession of rollouts crowds around the shift in metric, obfuscating the best-correlated rollout.

Panel of Figure 5 — Figure 5: An example of the Social Network service dependency graph during the ComposePost functionality. Here, an anomaly is injected into home-timeline-service while home-timeline-service , social-graph-service , and text-service are redeployed with new installations. Only installations along the critical path (in blue) are considered for causal inference.

Explore similar work

Anomaly Detection and Root Cause Analysis for Microservice Systems
Jun 8, 2026Luan PhamSoftware Engineering Microservice Architecture
Viet Nam National University Ho Chi Minh City - University of Technology (HCMUT) · School of Computing Technologies, College of Science, Technology, Engineering and Maths, Royal Melbourne Institute of Technology (RMIT University), Melbourne, Victoria, Australia
ClouDens: Operational Context-Aware Anomaly Detection for Large-scale Cloud System Monitoring
Jul 20, 2026Thu T. H. Doan, Mohammad Saiful Islam, Andriy Miranskyy +3Cloud Computing Time-Series Anomaly Detection
Department of Computer Science, Gran Sasso Science Institute, L’Aquila, Italy · Department of Computer Science, Toronto Metropolitan University, Toronto, Canada · Department of Computer Science, Electrical Engineering and Mathematical Sciences, Western Norway University of Applied Sciences, Bergen, Norway +1
ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality
Mar 26, 2026Wenzhuo Qian, Hailiang Zhao, Ziqi Wang +4Root Cause Analysis Multimodal Anomaly Detection
Zhejiang University, Hangzhou, China

Jun 8, 2026J/K move · Enter open · S save

Anomaly Detection and Root Cause Analysis for Microservice Systems

Luan Pham

Viet Nam National University Ho Chi Minh City - University of Technology (HCMUT) · School of Computing Technologies, College of Science, Technology, Engineering and Maths, Royal Melbourne Institute of Technology (RMIT University), Melbourne, Victoria, Australia

Software Engineering Microservice Architecture Root Cause Analysis Time-Series Anomaly Detection Anomaly Detection

Open paper AskPDF arXiv

Microservice systems are widely used to build cloud applications, yet their complexity makes failures inevitable, degrading user experience and causing economic loss. Automated anomaly detection and root cause analysis (RCA) are now active research areas, but existing techniques share five limitations. First, most treat anomaly detection and RCA separately, assuming anomalies are detected correctly, and falter when detection is imprecise due to noise or delay. Second, they focus on metrics, logs, and traces, leaving event data such as API calls and configuration changes underexplored. Third, many require a given service call graph and cannot diagnose without one. Fourth, the field lacks standardised datasets and evaluation frameworks, so methods are hard to compare fairly. Fifth, although causal inference-based RCA has become dominant, its effectiveness, efficiency, and robustness remain unclear. This thesis addresses these limitations through two groups of contributions. The first introduces methods that exploit observability data both independently and collectively. BARO is an end-to-end anomaly detection and RCA approach for metric data. EventADL is an end-to-end framework for event data. TORAI is a multimodal RCA framework that requires no service call graph. Extensive experiments on real microservice systems demonstrate their effectiveness and robustness. The second group delivers benchmarking datasets, an evaluation framework, and systematic evaluation efforts. RCAEval is a comprehensive benchmark providing ready-to-use datasets and reproducible baselines for future research. A systematic evaluation of existing RCA methods, especially causal inference-based approaches, offers insights that guide future directions. This thesis thereby advances automated anomaly detection and RCA for microservice failures, enabling future research on incident mitigation and remediation.

Abstract

Explore similar work

Anomaly Detection and Root Cause Analysis for Microservice Systems

ClouDens: Operational Context-Aware Anomaly Detection for Large-scale Cloud System Monitoring

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality