Microservice systems (MSS) have become a predominant architectural style for cloud services. Yet the community still lacks high-quality, publicly available datasets for anomaly detection (AD) and root cause analysis (RCA) in MSS. Most benchmarks emphasize performance-related faults and provide only one or two monitoring modalities, limiting research on broader failure modes and cross-modal methods. To address these gaps, we introduce a new multimodal anomaly dataset built on two open-source microservice systems: SocialNetwork and TrainTicket. We design and inject four categories of anomalies (Ano): performance-level, service-level, database-level, and code-level, to emulate realistic anomaly modes. For each scenario, we collect five modalities (Mod): logs, metrics, distributed traces, API responses, and code coverage reports, offering a richer, end-to-end view of system state and inter-service interactions. We name our dataset, reflecting its unique properties, as AnoMod. This dataset enables (1) evaluation of cross-modal anomaly detection and fusion/ablation strategies, and (2) fine-grained RCA studies across service and code regions, supporting end-to-end troubleshooting pipelines that jointly consider detection and localization.

Modern software systems produce vast amounts of logs, serving as an essential resource for anomaly detection. Artificial Intelligence for IT Operations (AIOps) tools have been developed to automate the process of log-based anomaly detection for software systems. Three practical challenges are widely recognized in this field: data labeling costs, evolving logs in dynamic systems, and adaptability across different systems. In this paper, we propose CroSysLog, an AIOps tool for log-event level anomaly detection, considering these challenges. Following prior approaches, CroSysLog uses a neural representation approach to gain a nuanced understanding of logs and generate representations for individual log events accordingly. CroSysLog can be trained on source systems with sufficient labeled logs from open datasets to achieve robustness, and then efficiently adapt to target systems with a few labeled log events for effective anomaly detection. We evaluate CroSysLog using open datasets of four large-scale distributed supercomputing systems: BGL, Thunderbird, Liberty, and Spirit. We used random log splits, maintaining the chronological order of consecutive log events, from these systems to train and evaluate CroSysLog. These splits were widely distributed across a one/two-year span of each system's log collection duration, capturing the evolving nature of the logs in each system. Our results show that, after training CroSysLog on Liberty and BGL as source systems, CroSysLog can efficiently adapt to target systems Thunderbird and Spirit using a few labeled log events from each target system, effectively performing anomaly detection for these target systems. The results demonstrate that CroSysLog is a practical, scalable, and adaptable tool for log-event level anomaly detection in operational and maintenance contexts of software systems.

Due to the strong non-linear fitting ability of deep neural networks, deep multi-view clustering has become a popular topic in the fields of signal processing and machine learning. Multi-view clustering based on deep auto-encoder can effectively capture the nonlinear features of high-dimensional data. However, the existing methods still have the following problems: 1) most autoencoder-based deep multi-view clustering methods ignore the differences between cross-view data and lose view-diversity features by using the same encoder structure for different views, and 2) many current deep multi-view techniques rely on single-lane neural networks for extracting feature data from each view. The current approach has limitations in its capability to accurately analyze comprehensive complementary information and multilevel features. To address these issues, we introduce a new clustering method Architecture Alternative Deep Multi-view Clustering (AADMC). Specifically, AADMC proposes a dynamic encoder network to adapt the encoder structure of each view according to the diversities of different views. Subsequently, AADMC proposes utilizing the HilbertSchmidt Independent Criterion (HSIC) to analyze the diversity of information between each encoder output. Moreover, AADMC integrates high-order and low-order information of the data into a shared connection matrix. To be more specific, the lowrank constraint is employed in order to effectively investigate and utilize the consensus information derived from all available views. The effectiveness and superiority of AADMC are demonstrated through experimental results conducted on various public datasets.