Learned Execution Graphs for Anomaly Detection & Drift in APIs — Ritvik Pandya, JP Morgan Chase
This talk details using short-lived execution graphs (DAGs) to monitor API request processing for advanced anomaly and drift detection. Instead of relying on traditional service level monitoring (SLM) that reports 'healthy' averages, this method models the entire request flow as a Directed Acyclic Graph (DAG). By comparing the actual execution graph against a learned baseline, it can pinpoint performance issues or skipped steps to specific nodes, drastically reducing root cause analysis time. The system differentiates between transient anomalies and persistent drift—categorizing drift into structural, volume, and covariate types—to ensure accurate alerting and proactive system re-baselining.
Key takeaways
-
Execution Graphs for Monitoring
Representing API request processing as a DAG allows holistic tracking of middleware steps, context passing, and execution order. This provides granular visibility beyond simple endpoint latency checks.
-
Anomaly vs. Drift Detection
12:13
The system distinguishes between sudden anomalies (e.g., traffic spikes) and slow drift—a gradual change in performance or pattern over time—which requires updating the baseline itself.
-
Three Types of Drift
14:15
Drift is categorized into structural (new/removed nodes), volume (expected request load changes), and covariate (changes in input data distribution, e.g., different currency types).