Technical Summary: OrEdge – Efficient Multi-Modal Anomaly Detection via Orthogonal-Domain Learning

1. Problem Statement

The widespread adoption of distributed microservices has increased system scalability but also operational complexity, making timely anomaly detection critical for reliability. While recent multi-modal approaches (jointly analyzing logs, metrics, and traces) using Graph Neural Networks (GNNs) and Transformers have improved detection accuracy, they introduce substantial computational and memory overhead. These heavy architectures are often unsuitable for real-time deployment on resource-constrained edge devices (e.g., IoT, connected vehicles, UAVs).

Existing lightweight detectors are efficient but typically limited to single-modality data, failing to capture cross-modal dependencies. Conversely, multi-modal frameworks capture richer dependencies but at the cost of high complexity. The core challenge addressed by this work is developing an accurate multi-modal anomaly detection framework that maintains low computational costs suitable for edge deployment without sacrificing the ability to model heterogeneous observability signals.

2. Methodology: The OrEdge Framework

OrEdge (Orthogonal-Edge) is a lightweight framework designed for real-time anomaly detection in distributed software systems. It jointly analyzes logs, metrics, and traces by projecting heterogeneous monitoring signals into orthogonal temporal representations. This approach reduces redundancy while preserving informative temporal patterns, avoiding the computational expense of graph message passing and large Transformer attention mechanisms.

Key Architectural Components

• Pre-processing and Graph Flattening:

  • Metrics and Logs: Parsed and normalized via min-max scaling.
  • Traces: Aggregated into service-level interaction features (frequency, latency) to form a service dependency graph.
  • Flattening: Instead of using Graph Neural Networks for message passing, OrEdge converts the service dependency graph into temporal sequences. Metric and log features are arranged as sequences, while trace features are organized as interaction sequences between service pairs. This preserves temporal and structural patterns while bypassing expensive graph operations.

• Multi-Modal Reconstruction Block:

  • OrEdge employs a unified reconstruction framework where each modality (metrics, logs, traces) is first projected into a latent space via lightweight linear encoders.
  • A Shared Reconstruction Module processes these representations. Unlike methods that process modalities independently, OrEdge uses Linear Attention to model interactions between dense temporal signals (metrics and logs) and maintains trace information as structural dependency features.
  • The architecture separates modality-specific representation learning from shared temporal reconstruction, enabling efficient interaction between complementary observability sources.

• OrEdgeCore (The Core Engine):

  • This is a lightweight orthogonal-domain reconstruction module.
  • Reversible Normalization (RevIN): Applied to reduce non-stationarity in input series.
  • Orthogonal Projection: The normalized data is projected into an orthogonal domain (e.g., Legendre, Fourier, Chebyshev bases). This transformation separates temporal patterns into compact components.
  • Constrained Linear Modeling: The projected data passes through NormLin (a constrained linear layer) to learn stable feature interactions, followed by Low-Pass Filtering (LPF) to suppress transient noise.
  • Inverse Projection: The signal is mapped back to the original time domain.
  • This design captures recurring temporal patterns while suppressing transient variations, using significantly fewer parameters than attention-based models.

• Loss Function:

  • OrEdge follows a semi-supervised formulation, jointly optimizing:
    1. Reconstruction Loss: Includes a time-domain loss and an orthogonal-domain loss (FreDF) to preserve temporal patterns beyond the time domain.
    2. Classification Loss: A weighted cross-entropy loss for available anomaly labels to handle class imbalance.

3. Key Contributions

1. OrEdge Framework: A lightweight, orthogonal-domain framework for multi-modal anomaly detection that jointly models logs, metrics, and traces through compact temporal representations.
2. OrEdgeCore: An orthogonal reconstruction module that drastically reduces model complexity (using linear projections and linear attention) while maintaining competitive detection performance.
3. Comprehensive Evaluation: Extensive experiments on three real-world microservice datasets (MSDS, SN, TT) evaluating detection accuracy, computational efficiency, orthogonal basis selection, and architectural ablations.
4. Edge Deployment Validation: Demonstration of practical deployment on resource-constrained Raspberry Pi platforms (Pi 3 and Pi 5), showing sub-second inference and significant latency reductions compared to existing methods.

4. Experimental Results

The authors evaluated OrEdge against state-of-the-art baselines (including Eadro, AnoFusion, MSTGAD, Art, and Medicine) across three datasets.

• Detection Accuracy: OrEdge achieves competitive performance. On the MSDS dataset, it achieved the highest F1-score (0.966) and Recall (0.982), outperforming graph-based methods. On SN and TT, it achieved F1-scores of 0.965 and 0.952 respectively, slightly trailing the highest-performing graph-based models (e.g., Art at 0.983 on SN) but with a fraction of the complexity.
• Model Complexity: OrEdge reduces the reconstruction model size to 2.2K parameters on the SN dataset, 5.6K on TT, and 9.6K on MSDS, compared to 20K–143K parameters in existing multi-modal methods.
• Computational Efficiency:
  • FLOPs: OrEdge requires up to an order of magnitude fewer FLOPs (e.g., 33.8M on SN vs. 1725.7M for MSTGAD).
  • Inference Latency: On Raspberry Pi 5, OrEdge achieves inference times of 30–125 ms per sample, reducing latency by up to 64× compared to MSTGAD. On Raspberry Pi 3, it maintains sub-second inference (210–802 ms), whereas heavier models like MSTGAD fail to deploy due to memory constraints.
• Ablation Studies:
  • Removing the orthogonal-domain objective (FreDF loss) or linear attention components degraded performance, confirming their necessity.
  • Legendre basis was found to be the most stable and effective orthogonal projection across datasets compared to Hermite, Chebyshev, or Fourier bases.
  • Sensitivity analysis showed that a compact linear attention dimension (e.g., 10) is sufficient for capturing temporal dependencies.

5. Significance and Claims

The paper claims that OrEdge demonstrates that orthogonal-domain temporal modeling provides an effective alternative to computationally intensive attention- and graph-based architectures.

The primary significance lies in achieving a favorable balance between detection accuracy and computational efficiency. By leveraging orthogonal representations, OrEdge enables accurate, real-time multi-modal anomaly detection on edge devices where traditional high-performance models are infeasible. The authors emphasize that this approach allows for the deployment of sophisticated multi-modal analysis on resource-constrained platforms (like Raspberry Pi) without relying on expensive graph construction or large Transformer architectures, making it a practical solution for the expanding landscape of edge computing in IoT and distributed systems.

The code is made available to ensure reproducibility, and the work is positioned as a step toward efficient, scalable anomaly detection in modern distributed software systems.