CauseFormer: Interpretable Anomaly Detection With Stepwise Attention for Cloud Service

The anomaly detection techniques for cloud service focus on alerting the operation engineers about the anomalous running state. However, their shortcoming of anomaly interpretability is an obstacle to understanding and further removing the anomalies. To overcome the abovementioned challenge, we propose a tree-like attention-based detection framework CauseFormer that provides both the metric and sample interpretations. Firstly, we develop stepwise attention based on the multi-head attention mechanism, which imitates the rule-based tree formation process. This network block extracts the higher-order features and generates the metric contribution that can be regarded as metric interpretation. Meanwhile, we design the hyper-circle loss function rather than cross-entropy-based approaches to optimize the representation. Then we introduce the majority voting rule into the classifier. This neighbor classification criterion raises the alarms of anomalies and achieves the sample interpretation. Finally, we conduct extensive experiments in four datasets collected from cloud application cases. The experimental results reveal the superiority of CauseFormer in improving detection accuracy and embodying practical interpretability.