Benchmarking Deep Learning Models for Anomaly Detection in Real-World Cloud Telemetry

arXiv:2610.15818v1 [cs.LG] 11 Oct 2026

Benchmarking Deep Learning Models for Anomaly Detection in Real-World Cloud Telemetry Sumit Dhyani

Sougata Mukherjea

Electrical Engineering Department Indian Institute of Technology Delhi, India eet242364@ee.iitd.ac.in

Electrical Engineering Department Indian Institute of Technology Delhi, India sougatam@iitd.ac.in

Abstract—Modern cloud platforms generate high-dimensional, noisy telemetry from thousands of microservices. Unlike classical anomaly detection benchmarks, cloud anomalies are short-lived, irregular, and largely non-periodic, making timely detection challenging. We present an empirical benchmark of deep learning models for anomaly detection using a real-world IBM Cloud Console dataset containing 39,000+ time steps, 117,000 service–feature combinations, and 25 labeled anomaly windows. We evaluate GRU, Transformer, TimesNet, and Autoformer architectures using the Numenta Anomaly Benchmark (NAB), a timing-aware metric that accounts for early detection and false alarms. TimesNet achieves the highest NAB scores due to strong early-detection sensitivity. Transformer models also detect anomalies early but incur higher false-positive rates. An improved GRU autoencoder, incorporating robust scoring and persistence rules, achieves competitive performance with a more stable false-alarm profile. Overall, the modest performance differences suggest that real cloud anomalies are dominated by short-term deviations rather than persistent periodic structure, emphasizing the importance of timing-aware evaluation and robust post-processing. Index Terms—Cloud anomaly detection, Deep learning, Realworld cloud telemetry, Numenta Anomaly Benchmark (NAB), Transformer models, GRU autoencoder, Time-series analytics

I. I NTRODUCTION Modern cloud platforms operate as highly distributed ecosystems composed of thousands of microservices deployed across multiple regions and data centers. These systems generate high-dimensional and noisy telemetry streams that capture performance and reliability indicators. Detecting anomalous behavior in such environments is critical for maintaining system availability and preventing service degradation. Unlike classical anomaly detection benchmarks, cloud anomalies are typically short-lived, irregular, and largely nonperiodic. They are influenced by deployment changes, autoscaling, transient workload bursts, and network jitter, and are often partially mitigated by self-healing mechanisms. As a result, techniques that perform well on clean, periodic industrial datasets often struggle when applied to realistic cloud telemetry. Another key challenge is the operational cost of false positives. Frequent spurious alerts can trigger unnecessary auto-scaling actions and lead to alert fatigue among Site Reliability Engineers (SREs). Therefore, anomaly detection in cloud environments must emphasize not only accuracy but

also early detection and low false-alarm rates. Traditional point-wise metrics such as F1-score and ROC-AUC fail to capture these requirements. We therefore adopt the Numenta Anomaly Benchmark (NAB) [1], which explicitly rewards early detection while penalizing late detections and false positives. In this work, we conduct a large-scale empirical benchmark of deep learning models for anomaly detection using realworld production telemetry from the IBM Cloud Console [2]. The dataset is high-dimensional, noisy, and non-seasonal, providing a realistic testbed for cloud anomaly detection. We evaluate recurrent reconstruction-based models (GRU autoencoder) [3], attention-based models (Anomaly Transformer) [4], and periodicity-oriented forecasting models (TimesNet [5] and Autoformer [6]). We also introduce an improved GRU-based detector incorporating log-scaled reconstruction error, MADbased normalization, and persistence–cooldown rules. Our results show that TimesNet achieves the highest NAB scores, primarily due to strong early-detection sensitivity. Transformer-based models also detect anomalies early but incur higher false-positive rates in noisy telemetry streams. The improved GRU remains competitive while offering a more stable trade-off between early detection and false alarms. These findings suggest that real cloud anomalies are dominated by short-term deviations rather than persistent periodic structure, limiting the practical gains from increasingly complex architectures. Contributions. Our contributions are as follows: A comprehensive benchmark of recurrent, attentionbased, and periodicity-oriented models on large-scale real-world cloud telemetry. • A timing-aware evaluation framework using NAB aligned with operational cloud monitoring. • An improved GRU-based detection pipeline with robust scoring and post-processing. • Empirical evidence that higher model complexity does not necessarily yield proportionally better operational performance in noisy, non-seasonal cloud environments. We release our evaluation models to facilitate future research in https://github.com/Sumit2399/Anomaly-Det ection-in-Cloud-Systems-A-Deep-Learning-Perspective. •

The remainder of this paper is organized as follows. Section II reviews related work. Section III describes the models and methodology. Section IV presents experimental results. Section V concludes the paper. II. R ELATED W ORK Anomaly detection has been widely studied in time-series analysis across domains such as industrial monitoring, finance, and cyber-physical systems [7]. However, much of the existing literature relies on structured, low-noise, and often periodic datasets that differ significantly from realistic cloud telemetry. A. Traditional Time-Series Benchmarks Common benchmarks for multivariate time-series anomaly detection include SMD [8] and MSL/SMAP [9]. These datasets exhibit relatively stable and periodic behavior, enabling models to detect anomalies as deviations from welldefined baselines. While useful for controlled algorithmic validation, they do not capture the high noise, non-stationarity, and scale of modern cloud systems. B. IBM Cloud Console Dataset The IBM Cloud Console study [2] introduced one of the first large-scale real-world cloud telemetry datasets. The data spans 4.5 months across seven data centers and contains 39,365 time steps with 117,448 service–feature combinations aggregated at five-minute intervals. Twenty-five labeled anomaly windows derived from operational incidents are provided for evaluation. Compared to classical benchmarks, the dataset is highly noisy, non-periodic, and extremely high-dimensional, making it a realistic and challenging testbed for cloud anomaly detection. C. Deep Learning for Time-Series Anomaly Detection Reconstruction-based models using LSTM and GRU architectures remain widely used for time-series anomaly detection [8], [10]. These models learn representations of normal behavior and identify anomalies via reconstruction error. Transformer-based approaches, such as the Anomaly Transformer [4], leverage self-attention to model long-range dependencies. Forecasting and periodicity-oriented models, including TimesNet [5] and Autoformer [6], explicitly model seasonal and trend components and have demonstrated strong performance on structured datasets. However, their effectiveness on irregular and non-seasonal cloud telemetry remains less explored. D. Anomaly Detection in Cloud Systems Cloud environments introduce additional challenges due to distributed microservice architectures, dynamic scaling, and automated remediation mechanisms [11]. The IBM Cloud study [2] highlighted the limitations of basic GRU-based detection under such conditions. Other works have explored machine learning for cloud monitoring and anomaly detection [12], though many rely on simplified evaluation protocols or synthetic anomalies.

E. Evaluation Metrics Traditional evaluation metrics such as accuracy, precision, recall, F1-score, and ROC-AUC treat anomaly detection as a point-wise classification problem and ignore detection timing. In operational cloud environments, early detection and low false-alarm rates are critical. The Numenta Anomaly Benchmark (NAB) [1] addresses this limitation by rewarding early detections within anomaly windows while penalizing late detections and false positives. In this work, we report both the Standard and Low-FN NAB profiles. F. Positioning of This Work Unlike prior studies, this work provides a timing-aware benchmark of reconstruction-based, attention-based, and periodicity-oriented models on large-scale real cloud telemetry. By evaluating diverse architectures under NAB, we examine which modeling assumptions hold in noisy, non-seasonal cloud environments and demonstrate that increased model complexity does not necessarily yield proportionally better operational performance. III. M ODELS AND M ETHODOLOGY This section describes the deep learning models evaluated in this work and outlines how each model is adapted to the IBM Cloud Console dataset. Representative result plots are included to illustrate reconstruction behavior, anomaly detection timelines, and qualitative performance characteristics. A. GRU Autoencoder (Improved) The GRU (Gated Recurrent Unit) autoencoder is a reconstruction-based anomaly detector. It learns to encode and reconstruct normal telemetry patterns, and anomalies are identified as time steps with high reconstruction error. We improved the GRU autoencoder presented in [2] by: • Robust scoring using logarithmic scaled mean squared error (MSE). • MAD-based normalization (Median Absolute Deviation) to improve robustness against outliers. • Persistence and cooldown rules to suppress transient false alarms and enforce temporal consistency.

(a) Sum of 5XX count (normalized) with ground truth and predicted anomalies.

(b) Reconstruction error and likelihood.

Fig. 1: Improved GRU autoencoder results on the IBM Cloud Console dataset (Data from Mar 12–13, 2024).

Figure 1 illustrates the anomaly detection behavior of the improved GRU autoencoder. Figure 1(a) shows how elevated 5XX error rates align with ground-truth anomaly windows and predicted alerts, demonstrating that the detector primarily triggers during sustained service failures rather than transient error spikes. On the other hand, figure 1(b) illustrates how anomalies emerge as a consistent increase in reconstruction error and anomaly likelihood alongside rising 5XX errors, highlighting the temporal progression from raw telemetry deviation to confident anomaly detection. During normal operation, reconstruction error remains low and stable, indicating effective learning of regular cloud telemetry patterns. • Within ground-truth anomaly windows, reconstruction error increases significantly, reflecting deviations caused by sustained service disruptions and elevated 5XX errors. • MAD-based normalization and persistence rules suppress short-lived fluctuations, ensuring that only persistent anomalies are detected.

•

B. Transformer (Baseline) The Anomaly Transformer [4] employs self-attention to model temporal dependencies across multivariate telemetry data. It is used as a reconstruction-based anomaly detector, where deviations between predicted and observed values form the anomaly score. Despite the lack of strong periodicity in the dataset, the Transformer can capture local and medium-range dependencies, often leading to earlier anomaly detections compared to recurrent models.

(a) Sum of 5XX count (normalized) with ground truth and predicted anomalies.

•

This suggests that reconstruction-based attention alone is insufficient to reliably distinguish noise from sustained service degradation.

C. Transformer (Improved) The improved Transformer incorporates association-based anomaly detection concepts. Instead of relying solely on reconstruction error, it evaluates association discrepancy, defined as deviations in learned relationships between telemetry metrics. Key enhancements include • Association discrepancy scoring to capture relational changes between metrics. • Filtering of anomalous inputs to improve model stability and reduce error propagation. The effect of association discrepancy–based scoring are as follows: • Anomaly scores increase primarily when the relationships between telemetry metrics change, rather than due to fluctuations in isolated values. • Compared to the baseline Transformer, false positives are reduced and detections are more temporally consistent. • The detected anomaly windows align closely with the sustained degradation of system performance. D. TimesNet TimesNet [5] is a temporal modeling framework designed to capture multi-periodic patterns using a two-dimensional representation and convolutional operations.Although effective for periodic datasets, IBM Cloud Console telemetry exhibits irregular and non-periodic behavior, limiting the advantage of the model. Despite this, TimesNet achieves the highest NAB score in our evaluation. This indicates that the model is effective at triggering early detections within anomaly windows, which is strongly rewarded by the NAB metric. However, the improvement over non-seasonal models is modest and largely comparable to Transformer-based approaches, suggesting that the weak and irregular seasonality of cloud telemetry constrains the additional benefit expected from explicit periodic modeling.

(b) Reconstruction error and likelihood.

Fig. 2: Baseline Transformer anomaly detection results (Data from Mar 12–13, 2024).

(a) Sum of 5XX count (normalized) with ground truth and predicted anomalies.

Figure 2 shows the anomaly detection behavior of the baseline Transformer model. The attention mechanism captures local and mediumrange temporal dependencies, producing early rises in anomaly scores. • Several detections appear outside of ground-truth anomaly windows, indicating sensitivity to transient telemetry noise. •

(b) Reconstruction error and likelihood.

Fig. 3: TimesNet behavior on non-seasonal cloud telemetry (Data from Mar 12–13, 2024).

Figure 3 illustrates the behavior of TimesNet on cloud telemetry. • The absence of strong periodic patterns prevents a clear separation between normal and anomalous regions. • Anomaly scores exhibit limited contrast, leading to missed or unstable detections. • This indicates that multi-periodic modeling is less suitable for event-driven cloud environments. E. Autoformer Autoformer is a transformer-based forecasting model that explicitly decomposes time series into trend and seasonal components. It is often effective for long-range forecasting in datasets with strong seasonality. In this work, Autoformer is applied as a forecasting-based anomaly detector. Deviations between predicted and observed values are used as anomaly scores. The Autoformer anomaly detection behavior is as follows: • Trend–seasonal decomposition provides limited benefit due to the non-seasonal and noisy nature of the telemetry. • Forecast deviations occur during anomalies, but the anomaly boundaries are less clearly defined. • Consequently, Autoformer offers only modest improvements over simpler forecasting-based approaches. IV. R ESULTS A. NAB scores Model GRU (Baseline [2]) GRU (Improved) Anomaly Transformer (Baseline) Anomaly Transformer (Improved) TimesNet Autoformer

NAB (Standard)

NAB (Low-FN)

17.00 ± 0.42 21.27 ± 0.36 26.52 ± 0.71 26.68 ± 0.63 29.05 ± 0.28 26.56 ± 0.66

18.74 ± 0.45 23.44 ± 0.39 28.79 ± 0.68 28.89 ± 0.61 30.48 ± 0.24 28.82 ± 0.64

TABLE I: Mean and standard deviation of NAB scores over multiple runs on the IBM Cloud Console dataset. Table I summarizes the NAB scores obtained by the different models under standard and low-FN profiles. Several important insights emerge from these results: • Transformers detect anomalies earlier: Both the baseline and the improved Transformer models achieve high NAB scores, indicating better timing and early detection capability. However, this sensitivity often leads to increased false positives due to the noisy nature of cloud telemetry. • GRU remains competitive: Despite its simpler architecture, the improved GRU autoencoder achieves strong and stable NAB performance. This suggests that many cloud anomalies manifest as short-term local deviations rather than long-range temporal patterns. • Performance of periodicity-based models: TimesNet and Autoformer are designed to exploit periodic or longrange structures. TimesNet achieves the highest NAB scores, largely due to its strong sensitivity to early

deviations within anomaly windows. However, both the models do not consistently outperform simpler models. This reinforces the conclusion that cloud anomalies lack strong seasonality. • Impact of robust scoring and rules: The large improvement of the GRU model compared to the baseline of the original paper [2] (from 6.06/14.57 to 21.27/23.44) highlights the importance of improved scoring functions and post-processing rules in practical anomaly detection. • Experimental Stability: To account for randomness arising from model initialization and training dynamics, each experiment was repeated multiple times using different random seeds. We report the mean and standard deviation of the NAB scores across runs. The relatively small variance observed for all models indicates stable and reproducible performance trends, strengthening the reliability of the reported comparisons. B. Confusion Matrix Analysis Model

TP

FP

FN

TN

GRU (Baseline) GRU (Improved) Transformer (Baseline) Transformer (Improved) TimesNet Autoformer

4 5 6 6 6 6

121 66 163 155 110 151

14 13 12 12 12 12

25451 25548 25199 25180 25469 25215

TABLE II: Window-based confusion matrix statistics for anomaly detection. 1) Window-Based Confusion Matrix: Table II reports the confusion matrix statistics computed at the level of the anomaly-window, which better reflects the requirements of incident detection in the real-world. Transformer-based models achieve the highest number of true positives, confirming their ability to detect most anomaly events. However, this performance comes at the cost of increased false positives, which can lead to alert fatigue in operational monitoring systems. The improved GRU model exhibits a more balanced tradeoff, significantly reducing false positives while maintaining comparable true positive detection. This demonstrates the effectiveness of robust scoring and temporal persistence mechanisms in stabilizing anomaly predictions. Model

TP

FP

FN

TN

GRU (Baseline) GRU (Improved) Transformer (Baseline) Transformer (Improved) TimesNet Autoformer

8 5 25 26 8 26

163 66 320 339 114 304

865 868 844 843 865 843

25451 25548 25199 25180 25469 25215

TABLE III: Per-timestamp confusion matrix statistics for different models. 2) Per-Timestamp Confusion Statistics: The Per-timestamp confusion statistics in Table III provide fine-grained insight into model sensitivity at individual time steps. All models

exhibit a large number of true negatives due to the strong class imbalance in time-series anomaly detection. Transformer-based models achieve higher per-timestamp true positives, indicating responsiveness to short-lived deviations. However, this also results in a substantial increase in false positives. In contrast, the improved GRU model adopts a more conservative detection strategy, trading sensitivity for improved stability and reduced spurious alerts. 3) Summary of Error Trade-offs: Taken together, the window-based and per-timestamp analyses reveal consistent trends. Transformer-based models prioritize early and sensitive detection but incur higher false alarm rates, whereas the improved GRU model achieves a more balanced trade-off through robust scoring and temporal consistency constraints. These results emphasize that effective anomaly detection in cloud environments requires not only expressive models but also carefully designed scoring and post-processing mechanisms. C. Threshold Sensitivity and Operating Point Selection The performance of anomaly detection systems in operational environments is strongly influenced by the choice of detection threshold. While the Numenta Anomaly Benchmark (NAB) provides a timing-aware evaluation framework, it does not prescribe a specific threshold selection strategy. Consequently, reporting results at a single threshold without analyzing the sensitivity can lead to overly optimistic or fragile conclusions. To address this, we conducted a systematic threshold sensitivity analysis to examine how detection performance and false alarm behavior evolve across a wide range of thresholds. This analysis serves two purposes: (i) to assess the robustness of the model under varying sensitivity levels, and (ii) to justify the selection of a principled operating point for reporting final results.

Fig. 4: Normalized NAB score as a function of the anomaly detection threshold. The selected operating threshold lies within a stable region where performance remains high across small threshold variations. Figure 4 illustrates the variation of the normalized NAB score with respect to the detection threshold. We observe a stable plateau around the selected threshold value (0.9973), indicating that the detector’s performance is robust to minor perturbations in threshold selection. Lower thresholds can increase NAB scores by favoring early detections, but this

effect is driven by a significant rise in false positive events and is therefore undesirable in practice. Excessively high thresholds, on the other hand, reduce recall and miss anomaly windows. The observed stable region suggests that strong performance is achievable without aggressive threshold tuning.

Fig. 5: False positive event count as a function of the detection threshold. Lower thresholds significantly increase the number of spurious alerts, while the selected operating point maintains a low false positive rate. Figure 5 presents the number of false positive events as a function of the detection threshold. As expected, reducing the threshold increases the detector sensitivity but causes a sharp rise in spurious alerts. In cloud operational settings, such false positives can trigger unnecessary auto-scaling actions, increase infrastructure costs, and contribute to alert fatigue among Site Reliability Engineers (SREs). The chosen operating threshold achieves a favorable balance by maintaining a low false positive rate while preserving strong event-level detection performance. Together, these results motivate the selection of a threshold of 0.9973 for all subsequent experiments. This operating point lies within a stable high-performance region of the NAB curve and simultaneously minimizes false positive events, aligning well with the operational priorities of large-scale cloud systems. By explicitly analyzing threshold sensitivity, we ensure that reported results are robust, reproducible, and reflective of realistic deployment constraints rather than being driven by a narrowly tuned threshold choice. D. Ablation Study of the Improved GRU Autoencoder To quantify the contribution of each proposed enhancement in the improved GRU autoencoder, we performed a systematic ablation study. Starting from the baseline GRU configuration, we selectively enabled or disabled the following three components: • Log-scaled reconstruction error (Log-MSE): applying a log(1 + st ) transformation to stabilize large reconstruction error values. • Robust likelihood estimation: replacing mean–variance statistics with median and MAD-based normalization when computing anomaly likelihood. • Persistence and cooldown rules: enforcing k-of-m persistence and a cooldown interval to suppress transient spikes and repeated alerts.

Tables IV and V report the per-timestamp confusion statistics and the window-based NAB scores, respectively, for different ablation settings. Configuration

TP

FP

FN

TN

Baseline (no improvements) Log-MSE only Robust likelihood only Persistence only All components enabled

10 10 125 2 5

250 250 3318 47 66

863 863 748 871 868

25364 25364 22296 25567 25548

TABLE IV: Per-timestamp confusion matrix statistics for different GRU ablation configurations.

Configuration Baseline (no improvements) Log-MSE only Robust likelihood only Persistence only All components enabled

NAB (Standard)

NAB (Low-FN)

17.03 17.03 41.24 8.48 21.27

18.76 18.76 44.16 9.36 23.44

TABLE V: Window-based normalized NAB scores for different GRU ablation configurations. a) Effect of Log-Scaled Reconstruction Error.: Applying logarithmic scaling to the reconstruction error alone does not significantly affect detection performance. Confusion statistics and NAB scores remain close to the baseline GRU, indicating that log-scaling primarily improves numerical stability rather than anomaly separability. b) Effect of Robust Likelihood Estimation.: Using MADbased likelihood estimation substantially increases the NAB score by improving sensitivity and enabling earlier detections. However, this gain comes at the cost of a sharp rise in false positives, resulting in an overly sensitive detector that is less practical for operational deployment. c) Effect of Persistence and Cooldown Rules.: Persistence and cooldown rules effectively suppress false positives but also reduce true anomaly detections, leading to lower recall and degraded NAB performance. This indicates that temporal smoothing must be applied to well-calibrated anomaly scores. d) Combined Effect of All Improvements.: When all components are combined, the improved GRU achieves a balanced trade-off between early detection and false-alarm control. Although the NAB score is slightly lower than the robust-only configuration, the false positive rate is dramatically reduced. Overall, the ablation results show that the modifications are complementary: robust likelihood improves sensitivity, persistence restores precision, and log-scaling enhances numerical stability, together yielding a practically deployable detection pipeline. V. C ONCLUSION This paper presented a timing-aware empirical study of deep learning models for anomaly detection in real-world cloud telemetry from the IBM Cloud Console. Unlike classical benchmarks, cloud telemetry is highly noisy, non-periodic, and

high-dimensional, requiring evaluation and modeling strategies aligned with operational constraints. Using the Numenta Anomaly Benchmark (NAB), we compared GRU, Transformer, TimesNet, and Autoformer architectures under a timing-sensitive evaluation framework. TimesNet achieved the highest NAB scores due to strong early-detection sensitivity, while Transformer models also detected anomalies early, but incurred higher false-positive rates. The improved GRU model remained competitive, offering a more stable trade-off between early detection and false alarms. Overall, this work highlights the importance of domainspecific datasets, evaluation metrics, and modeling assumptions for cloud anomaly detection. It establishes a foundation for future research on dependency-aware, streaming, and causally-informed methods capable of operating at the scale and complexity of modern cloud platforms. R EFERENCES [1] A. Lavin and S. Ahmad, “Evaluating Real-Time Anomaly Detection Algorithms – The Numenta Anomaly Benchmark,” in Proceedings of the 14th IEEE International Conference on Machine Learning and Applications (ICMLA), 2015. [2] M. S. Islam, M. S. Rakha, W. Pourmajidi, J. Sivaloganathan, J. Steinbacher, and A. Miranskyy, “Anomaly Detection in Large-Scale Cloud Systems: An Industry Case and Dataset,” in 2025 IEEE/ACM 47th International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP). [3] K. Cho, B. van Merrienboer, D. Bahdanau, and Y. Bengio, “Learning Phrase Representations Using RNN Encoder–Decoder for Statistical Machine Translation,” arXiv preprint arXiv:1406.1078, 2014. [4] J. Xu, H. Wu, J. Wang, and M. Long, “Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy,” in International Conference on Learning Representations (ICLR), 2022. [5] H. Wu, T. Hu, Y. Liu, H. Zhou, J. Wang, and M. Long, “TimesNet: Temporal 2D-Variation Modeling for Time Series,” in International Conference on Learning Representations (ICLR), 2023. [6] X. Shang, J. Zhang, X. Jiang, and H. Luo, “Anomaly Detection for Multivariate Time Series Based on Contrastive Learning and Autoformer,” in 27th International Conference on Computer Supported Cooperative Work in Design (CSCWD), 2024. [7] V. Chandola, A. Banerjee, and V. Kumar, “Anomaly Detection: A Survey,” ACM Computing Surveys, vol. 41, no. 3, Jul. 2009. [8] Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun, and D. Pei, “Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network,” in Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD), 2019. [9] K. Hundman, V. Constantinou, C. Laporte, I. Colwell, and T. Soderstrom, “Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding,” in Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2018. [10] P. Malhotra, L. Vig, G. M. Shroff, and P. Agarwal, “Long Short Term Memory Networks for Anomaly Detection in Time Series,” in The European Symposium on Artificial Neural Networks (ESANN), 2015. [11] J. Soldani and A. Brogi, “Anomaly Detection and Failure Root Cause Analysis in (Micro) Service-Based Cloud Applications: A Survey,” ACM Computing Surveys, vol. 55, no. 3, 2022. [12] A. M. Abdallah, A. Saif Rashed Obaid Alkaabi, G. Bark Nasser Douman Alameri, S. H. Rafique, N. S. Musa, and T. Murugan, “Cloud Network Anomaly Detection Using Machine Learning and Deep Learning Techniques,” IEEE Access, vol. 12, 2024.

Related documents

• Benchmarking Deep Learning Models for Anomaly Detection in Real-World Cloud Telemetry#1327068
• Exploring how deep learning decodes anomalous diffusion via Grad-CAM.#221183
• Can We Predict Anomaly Detection Performance from Embedding-Space Geometry?#1062351
• Can We Predict Anomaly Detection Performance from Embedding-Space Geometry?#1043104
• No Scale Left Behind: Multi-Scale Autoencoder with Bi-directional Attention for Time Series Anomaly Detection#1142305