Workflow-Aware Detection of Structural Deviations in Reconstructed Service-Interaction Traces

Résumé fourni par la source

Cloud-native systems increasingly rely on multi-step service workflows whose correctness depends not only on individual service invocations, but also on the structural consistency of their ordering, dependencies, repetitions, and progression across reconstructed sessions. This paper studies workflow-aware structural deviation detection over reconstructed service-interaction traces and proposes a lightweight detection framework with a branch-aware workflow-completeness extension. The method represents each reconstructed session as an ordered service-interaction sequence and extracts explicit structural signals, including transition probability, trigram regularity, prefix validity, structural deviation, inferred prerequisite consistency, and completeness-aware workflow statistics. The approach is evaluated on interaction traces derived from the Alibaba Microservices Trace 2021 dataset (MSCallGraph), comprising 12 486 634 raw service-interaction records reconstructed into 15 000 ordered sessions. Since the original trace corpus does not provide naturally labeled workflow-abuse incidents, controlled structural-deviation scenarios were generated over reconstructed sessions, including invalid transitions, repeated sensitive operations, premature jumps, and step-skipping patterns. These scenarios are used as controlled structural stress cases rather than as statistically validated replicas of production misuse. The evaluation shows that workflow-aware structural modeling outperforms the evaluated coarse session-summary baseline and expanded session-summary variants in the evaluated proxy service-trace setting. In the main experimental setting, ET_structural_completeness achieved the strongest overall balance among the selected main models, with F1 = 0.7884 and ROC-AUC = 0.9221. The strongest pure structural tree baseline, ET_structural, achieved F1 = 0.7822 and ROC-AUC = 0.9167, while MLP_structural_completeness remained competitive with F1 = 0.7858 and ROC-AUC = 0.9026. Additional analyses show that prefix validity and structural deviation are the strongest individual signals, and that feature extraction, rather than model prediction, dominates the measured computational overhead. The results support the value of lightweight structural workflow signals for detecting explicit transition irregularities in reconstructed service-interaction sessions. However, omission-style deviations such as step skipping remain notably harder to detect than explicit transition anomalies, and cross-workflow transfer remains unreliable under the present formulation. Accordingly, the proposed method should be interpreted as a lightweight structural workflow detector and empirical reference baseline for reconstructed service-interaction traces, not as a validated detector for client-facing REST API traffic or as a complete workflow-completeness verification mechanism.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.