STAR: Adaptive Spatial-Temporal Normalization for Unified Microservice Incident Management

Xinhua Miao; Linyu Zhu; Bowei Yang; Zhengong Cai

cs.LGSep 12, 2026

STAR: Adaptive Spatial-Temporal Normalization for Unified Microservice Incident Management

Authors: Xinhua Miao, Linyu Zhu, Bowei Yang, Zhengong Cai

Organizations: School of Software Technology, Zhejiang University, Ningbo, China · School of Aeronautics and Astronautics, Zhejiang University, Hangzhou, China · Zhejiang University, Ningbo, China

Abstract

Automated incident management in large-scale microservice systems relies on learning robust representations from multimodal observability data, including metrics, logs, and traces. Although recent self-supervised frameworks enable unified modeling for anomaly detection (AD), failure triage (FT), and root cause localization (RCL), they often struggle with non-stationary temporal dynamics and heterogeneous service dependency structures. In this paper, we propose STAR, a Spatial-Temporal Adaptive Representation learning framework that explicitly addresses these challenges through adaptive normalizations. STAR introduces two tightly coupled mechanisms: Temporal Adaptive Normalization (TAN), which dynamically normalizes multivariate time series using multi-scale temporal context, and Spatial Adaptive Normalization (SAN), which performs structure-aware normalization over service dependency graphs. Unlike prior methods that treat normalization as static or task-agnostic, STAR formulates it as a learnable, context-conditioned transformation aligned with the intrinsic properties of microservice systems. The resulting adaptive representations are integrated into a unified self-supervised framework, enabling end-to-end unsupervised support for AD, FT, and RCL tasks. Extensive experiments on two real-world microservice benchmarks demonstrate that STAR consistently outperforms all state-of-the-art baselines, yielding significant and stable improvements across all three tasks. Our results highlight adaptive normalization as a principled and effective mechanism for robust multimodal representation learning in complex software systems.

Figures & tables

Figure 1: Static vs. adaptive normalization. Adaptive normalization preserves multi-scale temporal deviations, whereas static normalization smooths them out.

Figure 2: Unified incident management frameworks encode multimodal observability data into shared representations for AD, FT, and RCL.

Figure 3: Overall STAR framework with two core components: TAN and SAN.

Datasets	Instances	Normal	Failures	Failure Types	Metrics	Logs	Traces
D1	46	3,714	210	5	20.92M	66.65M	44.86M
D2	18	12,297	133	6	12.87M	21.36M	21.43M

Table 1: The details of the D1 and D2 datasets.

Datasets	Methods	AD			FT			RCL
Datasets	Methods	Precision	Recall	F1-score	Precision	Recall	F1-score	Top-1	Top-3	AVG@5
D1	$M_{s}$	0.866	0.863	0.865	0.667	0.796	0.717	0.615	0.692	0.685
	DiagFusion	-	-	-	0.675	0.500	0.568	0.310	0.452	0.467
	Dejevu	-	-	-	0.369	0.621	0.415	0.411	0.679	0.625
	Eadro	0.425	0.946	0.586	-	-	-	0.137	0.315	0.302
	ART	0 .899	0 .990	0 .942	0.836	0 .809	0 .812	0 .667	0.810	0 .776

Table 2: Comparative experimental results of the AD, FT, and RCL tasks between the STAR method and the baseline models. The best performance is highlighted in bold and the second best is underlined .

M_{s}

represents the Single-task method.

Methods	AD			FT			RCL
Methods	Precision	Recall	F1-score	Precision	Recall	F1-score	Top-1	Top-3	AVG@5
ZScore	0.884	0.929	0.906	0.755	0.750	0.745	0 .643	0 .774	0 .757
BatchNorm	0.888	0.969	0.927	0 .792	0 .798	0 .792	0.619	0.702	0.721
LayerNorm	0.856	0.908	0.881	0.737	0.702	0.704	0.607	0.762	0.736
RevIN	0 .890	0 .990	0 .937	0.762	0.762	0.758	0.631	0.750	0.733
TAN	0.899	1.000	0.947	0.820	0.821	0.818	0.655	0.798	0.779

Table 3: Comparison with alternative normalization methods on D1 and D2. Bold indicates the best result per column. TAN and SAN (ours) achieve the best or near-best performance across all settings, confirming the effectiveness of context-conditioned adaptive normalization over static alternatives.

Datasets	Methods	AD			FT			RCL
Datasets	Methods	Precision	Recall	F1-score	Precision	Recall	F1-score	Top-1	Top-3	AVG@5
D1	Baseline	0.899	0.990	0.942	0.836	0.809	0.812	0.667	0.810	0.776
	w/o TAN	0.907	0.990	0.946	0.822	0.821	0.819	0.655	0.821	0.786
	w/o SAN	0.899	1.000	0.947	0.820	0.821	0.818	0.655	0.798	0.779
	STAR	0.916	1.000	0.956	0.864	0.881	0.870	0.679	0.798	0.793
D2	Baseline	0.877	0.960	0.917	0.851	0.796	0.802	0.722	0.889	0.870

Table 4: The experiment results of ablation study on AD, FT, and RCL tasks. The best results are highlighted in bold.

Panel of Figure 4 — Figure 4: The experimental results for the hyperparameters number of scales ( $N_{s}$ ) and maximum degree ( $D$ ).

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Feature magnitude distribution (violin) and per-channel feature heterogeneity (bar) for D1 (e-commerce) and D2 (banking). KS test confirms a statistically significant distributional shift between datasets ( $p<0.001$ ).

Figure 6: Rolling mean and standard deviation of instance feature norms over normalized time. D2 exhibits markedly higher temporal variation (CV), confirming the motivation for Temporal Adaptive Normalization (TAN).

Figure 7: In-degree distributions of the service call graphs in D1 (e-commerce, left) and D2 (banking, right). Both datasets exhibit heterogeneous topologies with skewed degree distributions. D2 shows a heavier tail and higher degree variance, motivating degree-aware Spatial Adaptive Normalization (SAN) to prevent high-degree hub nodes from dominating graph-level statistics. Dashed lines indicate the mean in-degree; inset statistics report node/edge counts, maximum degree, and degree standard deviation.

Datasets	D1			D2
Task	AD	FT	RCL	AD	FT	RCL
Maximum Degree $D$	100	125	175	125	50	150

Appendix

Table 5: The hyperparameter setting table of maximum degree

D

Datasets	D1			D2
Tasks	AD	FT	RCL	AD	FT	RCL
Runtime (s)	12.52	7.64	23.73	27.28	3.50	10.09

Appendix

Table 6: End-to-end runtime (in seconds) of STAR for each task on the D1 and D2 datasets.

Figure 8: t-SNE visualization of intermediate representations before and after Temporal Adaptive Normalization (TAN, left two columns) and Spatial Adaptive Normalization (SAN, right two columns) on D1 and D2. After normalization, fault-type clusters (colored) become more compact and better separated from normal traffic (gray), validating that TAN and SAN produce more discriminative representations.

Explore similar work

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality
Mar 26, 2026Wenzhuo Qian, Hailiang Zhao, Ziqi Wang +4Root Cause Analysis Multimodal Anomaly Detection
Zhejiang University, Hangzhou, China
Anomaly Detection and Root Cause Analysis for Microservice Systems
Jun 8, 2026Luan PhamSoftware Engineering Microservice Architecture
Viet Nam National University Ho Chi Minh City - University of Technology (HCMUT) · School of Computing Technologies, College of Science, Technology, Engineering and Maths, Royal Melbourne Institute of Technology (RMIT University), Melbourne, Victoria, Australia
EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems
May 1, 2026Luan Pham, Victor Nicolet, Joey Dodds +2Online Anomaly Detection Anomaly Localization
RMIT University, Australia · Amazon Web Services, United States

Mar 26, 2026J/K move · Enter open · S save

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality

Wenzhuo Qian, Hailiang Zhao, Ziqi Wang, Zhipeng Gao+3

Zhejiang University, Hangzhou, China

Root Cause Analysis Multimodal Anomaly Detection Missing-Modality Learning Anomaly Localization Self-Supervised Learning Microservice Architecture

Open paper AskPDF arXiv

Automated incident management is critical for microservice reliability. While recent unified frameworks leverage multimodal data for joint optimization, they unrealistically assume perfect data completeness. In practice, network fluctuations and agent failures frequently cause missing modalities. Existing approaches relying on static placeholders introduce imputation noise that masks anomalies and degrades performance. To address this, we propose ARMOR, a robust self-supervised framework designed for missing modality scenarios. ARMOR features: (i) a modality-specific asymmetric encoder that isolates distribution disparities among metrics, logs, and traces; and (ii) a missing-aware gated fusion mechanism utilizing learnable placeholders and dynamic bias compensation to prevent cross-modal interference from incomplete inputs. By employing self-supervised auto-regression with mask-guided reconstruction, ARMOR jointly optimizes anomaly detection (AD), failure triage (FT), and root cause localization (RCL). AD and RCL require no fault labels, while FT relies solely on failure-type annotations for the downstream classifier. Extensive experiments demonstrate that ARMOR achieves state-of-the-art performance under complete data conditions and maintains robust diagnostic accuracy even with severe modality loss.

Abstract

Explore similar work

ARMOR: A Robust Self-Supervised Framework for Root Cause Analysis in Microservices under Missing Modality

Anomaly Detection and Root Cause Analysis for Microservice Systems

EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems