# Anomaly Detection in Microservice-Based Systems
## 4 Discussion  
The presented results demonstrate the performance of supervised machine learning models, in this case, a Multi-Layer Perceptron (MLP), in detecting anomalies at two levels: application and service. The models were trained on datasets with a balanced number of normal and abnormal records, and their accuracy, precision, recall, F1 score, and false positive rate (FPR) validation metrics were reported. Among various techniques used for anomaly detection [69], including Random Forest [70], and SVM [71], MLP emerges as a strong candidate for anomaly detection in \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Run**} & **Train.\({}^{\text{5}}\)** & **Val.\({}^{\text{6}}\)** & **Train.** & **Val.** & **Train.** & **Val.** & **Train.** & **Val.** & **Val.** \\  & **Acc.\({}^{\text{1}}\)** & **Acc.** & **Prec.\({}^{\text{2}}\)** & **Prec.\({}^{\text{2}}\)** & **Rec.\({}^{\text{3}}\)** & **Rec.** & **F1\({}^{\text{4}}\)** & **F1** & **FPR** \\ \hline
1 & 0.98 & 0.97 & 0.96 & 0.95 & 0.99 & 0.99 & 0.98 & 0.97 & 0.00 \\
2 & 0.97 & 0.97 & 0.97 & 0.97 & 0.98 & 0.98 & 0.97 & 0.97 & 0.00 \\
3 & 0.97 & 0.96 & 0.95 & 0.94 & 0.99 & 0.99 & 0.97 & 0.96 & 0.00 \\
4 & 0.96 & 0.96 & 0.94 & 0.93 & 0.98 & 0.98 & 0.96 & 0.96 & 0.01 \\
5 & 0.96 & 0.97 & 0.94 & 0.94 & 0.98 & 0.99 & 0.96 & 0.97 & 0.02 \\
6 & 0.96 & 0.96 & 0.95 & 0.94 & 0.98 & 0.98 & 0.96 & 0.96 & 0.01 \\
7 & 0.97 & 0.97 & 0.97 & 0.96 & 0.98 & 0.98 & 0.97 & 0.97 & 0.00 \\
8 & 0.98 & 0.97 & 0.97 & 0.96 & 0.98 & 0.98 & 0.98 & 0.97 & 0.00 \\
9 & 0.98 & 0.96 & 0.97 & 0.97 & 0.98 & 0.96 & 0.98 & 0.96 & 0.00 \\
10 & 0.97 & 0.98 & 0.96 & 0.98 & 0.98 & 0.98 & 0.97 & 0.98 & 0.02 \\ \hline Max & 0.98 & 0.98 & 0.97 & 0.98 & 0.99 & 0.99 & 0.98 & 0.98 & 0.02 \\ Min & 0.96 & 0.96 & 0.94 & 0.93 & 0.98 & 0.96 & 0.96 & 0.96 & 0.00 \\ Mean & 0.97 & 0.97 & 0.96 & 0.95 & 0.98 & 0.98 & 0.97 & 0.97 & 0.01 \\ Std.dev. & 0.01 & 0.01 & 0.01 & 0.02 & 0.00 & 0.01 & 0.01 & 0.01 & 0.01 \\ \hline \hline \end{tabular}  
* Accuracy \({}^{\text{2}}\) Precision \({}^{\text{3}}\) Recall \({}^{\text{4}}\) F1-score \({}^{\text{5}}\) Training \({}^{\text{6}}\) Validation.  
\end{table} 
Table 4: Validation results of the service-level anomaly datasetsmicroservices-based systems. The complexity of relationships in microservice architectures requires a model that can effectively capture intricate patterns and dependencies. MLPs are known for their ability to handle complex nonlinear relationships [42], making them suitable for these scenarios. Additionally, MLPs excel at feature extraction and representation learning, automatically discovering meaningful, multidimensional representations observed in microservice architectures. Furthermore, the adaptability of MLPs to dynamic environments aligns well with the nature of microservice architectures, which often undergo changes in service behavior and interactions over time. The positive results of MLPs in intrusion detection systems [72] also suggest their potential effectiveness in anomaly detection across various domains. In the context of the presented study, the application-level anomaly detection model achieved an overall average accuracy of 71%, with an average F1 score of 73%. The recall value, which measures the proportion of actual anomalies correctly identified by the model, was the highest among the reported metrics, indicating that the model can detect most anomalies. The proportion of FP was low, indicating that the model produced very few FP. These results suggest that the model can detect anomalies based on anomalies injected at the application level, which is critical to ensuring the safety and reliability of these system operators. On the other hand, the anomaly detection model with the service-level anomalies performed even better than the application level, achieving an average accuracy of 97% and an average F1 score of 97%. The recall value was the highest among the reported metrics, indicating that the model can detect most application anomalies.