# CL-MMAD: A Contrastive Learning Based Multimodal Software Runtime Anomaly Detection Method
###### Abstract  
Software plays a critical role in the infrastructure of modern society. Due to the increasing complexity, it suffers runtime reliability issues. Online anomaly detection can detect partial failures within the program based on manifestations exhibited internally or externally before serious failures occur in the software system, thus enabling timely intervention by operation and maintenance staff to avoid serious losses. This paper introduces CL-MMAD, a novel anomaly detection method based on contrastive learning using multimodal data sources. CL-MMAD uses ResNet-18 to learn the comprehensive feature spaces of software running status. MSE loss is used as the objective to guide the training process and is taken as the anomaly score. Empirical results highlight the superiority of MSE loss over InfoNCE loss and demonstrate CL-MMAD's effectiveness in detecting both functional failures and performance issues, with a greater ability to detect the latter. software anomaly detection; contrastive learning; multimodal learning; functional failures; performance issues +
Footnote †: journal:  
uncertainty poses a significant risk to the dependability of complex software systems and becomes a bottleneck that limits the level of software runtime reliability. In addition, the deployment and usage environment of modern software service systems require numerous configuration items, and their misconfiguration can also lead to unexpected failures of the software systems during their operation [6]. To reduce the impact of residual defects on software runtime reliability, researchers propose data-driven-based software runtime anomaly detection methods for long-running software systems [7]. These methods utilize previous runtime information to detect faults during software operation, enabling a series of subsequent measures to be taken to reduce the impact of faults detected by the anomaly detection methods. Software anomaly detection refers to the process of finding partial failures that occur in software during operation. Partial failures denote the defects that are triggered and cause a partial loss of software functionality but have not yet caused a total loss of functionality [8]. These partial failures lead to external failures along with a series of \"side effects\" that result in observable representations that can be used for fault detection and failure prediction [9]. Existing methods can only detect performance issues since they mainly use external information for software anomaly detection. External information is most related to performance issues and cannot reveal functional anomalies proven to have strong relationships with internal execution trace information [10]. There is rare research on utilizing multimodal software runtime data for runtime anomaly detection. To detect both functional failures and performance issues, we propose a contrastive learning-based multimodal software runtime anomaly detection (CL-MMAD) method using a combination of internal and external information, which uses contrastive learning to align data from different modalities, followed by representation learning to construct a unified feature space for anomaly detection, and then realizing the detection of anomalous behaviors during software operations. The major contributions of this work are shown as follows:  
* Firstly, we made a combination of program internal and external information to achieve an anomaly detection task. Both functional failure and performance issues can be detected in the detection framework for multimodal data sources. The introduction of internal information can also boost the detection of performance issues. * A contrastive learning-based learning architecture is proposed in CL-MMAD. The detection task was realized under the pattern of self-supervised learning. * An empirical study was conducted in this work to evaluate the performance of CL-MMAD using runtime data collected from a widely used open-source database system named Cassandra, produced by Apache.org.