Multivariate time series anomaly detection (MTSAD) plays a critical role in the Internet of Things (IoT) by identifying malfunctions and attacks. Graph Neural Networks (GNNs) have been widely employed in MTSAD to capture spatial features but require predefined and explicit graph structures. Graph Structure Learning (GSL) addresses this limitation by jointly learning the graph structure and downstream tasks. However, existing GSL-based MTSAD methods fail to effectively leverage prior knowledge and struggle with insufficient GNN depth, limiting their ability to capture long-range dependencies. To address these challenges, we propose a multivariate time series anomaly detection method based on a learnable spatio-temporal graph ordinary differential equation network (STGODE), named MAD-ODE. Our approach leverages hybird graph learning, which includes two types of graph structures: a static similarity graph and a learnable graph. The static similarity graph is constructed using prior knowledge and provides a stable, interpretable representation of sensor dependencies. In contrast, the learnable graph captures complex relationships between sensors by optimizing its structure through backpropagation. This hybird graph learning effectively incorporates both prior knowledge and learned dependencies, ensuring robust and flexible modeling of sensor relationships. Furthermore, we design a STGODE predictor, which operates on both graph structures and employs continuous graph convolutional networks, enabling it to capturing long-range spatio-temporal dependencies for forecasting the next timestamp. Extensive experiments conducted on five datasets demonstrate that MAD-ODE achieves the best average performance and maintains stable results compared to existing methods.

Microservice architecture decomposes complex applications into multiple small, independent services, enabling independent deployment and scaling. However, microservice systems introduce complex and dynamic interactions between service instances. When a service instance fails, it can significantly degrade the performance of the entire system, harm the user experience, and cause substantial economic losses. Therefore, effective anomaly detection for service instances is crucial to ensure system reliability. Metrics, logs, and traces provide complementary insights into microservice operations, and recent approaches have attempted to jointly exploit these modalities for anomaly detection. However, the varying data volumes per interval and heterogeneous data types across modalities, combined with the complex and elusive relationships between them, make effective representation and learning challenging. To address these limitations, we propose MGFusion, an unsupervised, end-to-end multimodal anomaly detection method for microservice systems using Grassmann manifolds-based graph fusion. MGFusion employs a robust method to unify metrics, logs, and traces into time series, enabling consistent processing across modalities. It leverages multiple graph structure learning (GSL) techniques to explore multi-view relationships between the modalities. To mitigate the impact of data noise, we further introduce prior knowledge based on the Adamic-Adar Index (AAI) and employ a Grassmann manifolds-based graph fusion method to combine multiple basic graph structures. Finally, anomaly detection is achieved using Diffusion Convolutional Recurrent Neural Network (DCRNN) predictors and anomaly score calculation. Extensive experiments on a public dataset demonstrate that MGFusion effectively fuses multimodal data and captures complex relationships, significantly improving the accuracy and efficiency of anomaly detection. Compared to the state-of-the-art unsupervised multimodal anomaly detection method, AnoFusion, MGFusion achieves an improvement in the F1 score ranging from 11.1% to 15.3%.