The dynamic nature of microservice architectures necessitates robust few-shot anomaly detection (AD) systems to prevent cascading failures. However, current multimodal approaches remain inadequate for cold-start scenarios due to their dependence on extensive training data. The fundamental challenge in few-shot AD lies in two critical aspects: (1) effective feature extraction from intra-modalities, and (2) the alignment of heterogeneous multimodal representations, particularly the distribution discrepancy between discrete token embeddings from logs and continuously evolving representations from traces and metrics. To overcome these challenges, we present FuseGuard, an LLM-enhanced framework that pioneers quality-aware multimodal fusion for few-shot AD. First, our intra-modal feature extraction employs a Dynamic Sparse Correlation Attention mechanism for metrics, Spatio-temporal Encoding for traces, and LLM-enhanced semantic-frequency encoding for logs, enabling adaptive representation of time-evolving patterns. Second, we introduce hierarchical cross-modal alignment via token projection, layer-wise distillation, and consistency learning to preserve modality-specific features while enabling effective knowledge transfer. Finally, a quality-aware fusion mechanism dynamically weights modalities based on uncertainty estimation. Evaluated on three open-source platforms (MSDS, GAIA, TrainTicket) and a production system, FuseGuard's few-shot capability outperforms SOTA by 19.69%-77.07% F1-score across four datasets.

Microservices architecture has become increasingly popular in modern software systems, yet its complexity also poses challenges for failure diagnosis. Existing literature has deficiencies in multimodal data mining, mainly in two aspects: first, the mining of multimodal data is insufficient, failing to fully exploit the rich information contained in different types of data; second, the analysis of spatiotemporal features of multimodal data is not thorough, failing to fully explore the potential associations of data in the temporal and spatial dimensions. To address these issues, this paper proposes a new method for anomaly detection in microservices. We transform three types of modal data into the wavelet domain and achieve fusion among modalities based on an attention mechanism, fully utilizing the inherent characteristics of multimodal data in the frequency and temporal domains. This fusion process can extract new information that does not exist in the original modalities, thereby enhancing the model's ability to detect anomalies. In addition, we propose a new diffusion probabilistic model (DDPM) based on spatiotemporal graphs, which combines spatiotemporal learning capabilities with the uncertainty measurement of DDPM to generate future samples in a non-autoregressive manner, achieving multi-horizon prediction. Experimental results show that our method significantly improves anomaly detection performance on three public datasets and a real-world production system, demonstrating its effectiveness in microservices anomaly detection.