# Anomaly Detection in Microservice-Based Systems
## 3 Model and Results
### Evaluating Classifier Performance  
Application-level anomaly detection: In the application-level anomalies dataset, there are 3430 records, among which 1715 are control records, and 1715 are abnormal records. The validation results are shown in Table 3.  
Regarding the validation results in Table 3, the mean values of accuracy, precision, recall, F1-score, and false positive ratio (FPR) from 10 validation runs were 71%, 69%, 78%, 73%, and 0.06, respectively. Of these metrics, recall stands out as the highest, with a mean value of 78%, indicating that the model could correctly identify a high percentage of \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Run** & **Train.\({}^{5}\) Acc.\({}^{1}\)** & **Val. \({}^{6}\) Acc.\({}^{2}\)** & **Train.** & **Val.** & **Train.** & **Val.** & **Train.** & **Val.** & **Val.** \\  & **Acc.\({}^{1}\)** & **Acc.** & **Prec.\({}^{2}\)** & **Prec.\({}^{3}\)** & **Rec.\({}^{3}\)** & **Rec.\({}^{4}\)** & **F1 \({}^{4}\)** & **F1** & **FPR** \\ \hline
1 & 0.72 & 0.70 & 0.66 & 0.66 & 0.87 & 0.88 & 0.75 & 0.75 & 0.37 \\
2 & 0.75 & 0.73 & 0.78 & 0.77 & 0.70 & 0.64 & 0.74 & 0.70 & 0.31 \\
3 & 0.69 & 0.67 & 0.65 & 0.62 & 0.86 & 0.85 & 0.74 & 0.71 & 0.44 \\
4 & 0.72 & 0.70 & 0.66 & 0.65 & 0.89 & 0.89 & 0.76 & 0.75 & 0.36 \\
5 & 0.74 & 0.73 & 0.66 & 0.65 & 0.98 & 0.96 & 0.79 & 0.78 & 0.27 \\
6 & 0.70 & 0.67 & 0.71 & 0.69 & 0.68 & 0.66 & 0.69 & 0.67 & 0.41 \\
7 & 0.72 & 0.69 & 0.66 & 0.64 & 0.90 & 0.87 & 0.76 & 0.74 & 0.41 \\
8 & 0.75 & 0.76 & 0.77 & 0.74 & 0.73 & 0.75 & 0.75 & 0.75 & 0.28 \\
9 & 0.72 & 0.72 & 0.73 & 0.75 & 0.69 & 0.68 & 0.71 & 0.71 & 0.41 \\
10 & 0.73 & 0.72 & 0.76 & 0.77 & 0.67 & 0.62 & 0.72 & 0.69 & 0.32 \\ \hline Max & 0.75 & 0.76 & 0.78 & 0.77 & 0.98 & 0.96 & 0.79 & 0.78 & 0.44 \\ Min & 0.69 & 0.67 & 0.65 & 0.62 & 0.67 & 0.62 & 0.69 & 0.67 & 0.27 \\ Mean & 0.72 & 0.71 & 0.70 & 0.69 & 0.80 & 0.78 & 0.74 & 0.73 & 0.36 \\ Std.dev. & 0.02 & 0.03 & 0.05 & 0.06 & 0.11 & 0.12 & 0.03 & 0.03 & 0.06 \\ \hline \hline \end{tabular}  
* Accuracy \({}^{2}\) Precision \({}^{3}\) Recall \({}^{4}\) F1-score \({}^{5}\) Training \({}^{6}\) Validation.  
\end{table} 
Table 3: Validation results of the application-level anomaly datasets. anomalies. On the other hand, FPR had the lowest mean value of 0.06%, indicating that the model had a low rate of false positives. The variability from the mean of the metric results across the ten validation runs ranged from 0.02 to 0.11, showing that the model's performance was consistent across multiple runs. In addition, the model achieved a maximum F1 score of 98% in the validation phase, indicating high accuracy and recall. The minimum F1 score obtained was 96%, demonstrating that the model consistently performed well on this metric. Taking as an example the run that obtained the highest F1-score metric value in the validation phase, the MLP hyperparameters chosen by the GridSearch algorithm (Section 3.2) chose the ReLU function as the network activation function. Set the L2 penalty parameter to a value of 0.001. It defined three hidden layers, each with 100, 25, and 25 neurons. Furthermore, it defined the Adam as the optimization algorithm used by the neural network. Figure 4(a) displays the confusion matrix for the average results of the ten validation runs for the application-level anomaly dataset, shown in Table 3. The matrix indicates that, on average, there were 266.6 TP, 219.8 TN, 124.3 FP, and 75.3 FN cases. In comparison, the false negative rate was 11%, indicating that 11% of cases were incorrectly identified as negative. Service-level anomaly detection: The service-level anomalies dataset consists of 2074 records, of which 1031 are anomalous and 1043 are control. Table 4 presents the validation results for the service-level anomalies dataset, where the mean values of accuracy, precision, recall, F1-score, and false positive ratio (FPR) from ten runs were 97%, 95%, 98%, 97%, and 0.01, respectively.