CHAINLSTM catches silent microservice path anomalies with chain-aware encoding

Researchers Yiliu Xu, Ziwei Hong, Zhongheng Yang, Xinjin Li, and Yu Ma (arXiv, July 2026) introduce CHAINLSTM, a lightweight dual-task LSTM for online microservice trace anomaly detection. The core insight: existing sequence models like DeepLog treat each API endpoint as a context-free token, ignoring that the same endpoint may behave normally in one invocation chain but anomalously in another. For example, a payment flow that silently skips a risk check returns normal per-span metrics but is structurally faulty. CHAINLSTM solves this by encoding each event as an (endpoint, root-to-span invocation chain) pair. This simple change makes next-event predictions context-conditional and flags unseen chains without any model inference.

On the TrainTicket microservice benchmark, CHAINLSTM achieves a 94.3% F1 score—a 5.3 percentage point improvement over DeepLog—while maintaining comparable latency recall and 99.1% path recall. Case analysis reveals that chain-aware encoding shifts the median prediction probability for path anomalies from 0.91 (deep in the normal range) down to 0.002, creating a wide separation margin for threshold-based detection. This means subtle control-flow deviations—like omitted steps or reordered calls—become easily detectable outliers. The approach is lightweight and suitable for production deployments, offering operators a practical way to catch silent, structurally incorrect traces that bypass traditional monitors.