FedHiGraphSAGE: A Hierarchical Graph Neural Network Model for Multi-Level Anomaly Detection in Federated Cloud Environments

Abstract

Anomaly detection in cloud computing environments is increasingly challenging due to the complexity of distributed architectures, the heterogeneity of infrastructure components, and the high volume of monitoring data. Traditional anomaly detection approaches typically provide limited classification capabilities, often failing to identify the specific type and exact location of anomalies within complex cloud infrastructures. This paper introduces a novel multi-level anomaly detection and classification model named Federated Hierarchical Graph Sampling and Aggregation (FedHiGraphSAGE). Our approach transforms log data into graph structures that capture the relationships between different cloud components and employs a five-level hierarchical classification to precisely identify and categorize anomalies. The fine-grained categorization of anomalies is in five levels, which include: <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">anomaly identification</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">type classification</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">domain attribution</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">component localization</i>, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">specific module identification</i>. Experimental evaluation on data collected from a real federated cloud environment demonstrates the effectiveness of our approach, achieving hierarchical precision, recall, and F1 scores exceeding 0.99 across multiple regional deployments. The ablation studies carried out in this work further reveals interesting hierarchical feature interdependencies, where feature utility varies significantly across classification levels. The ablation results indicate that the proposed FedHiGraphSAGE model outperforms traditional graph neural networks by achieving up to 16.3% higher hierarchical F1 scores and 55.7% improvement in path accuracy for complete hierarchical classification.