# AnoMod

Canonical source: <https://arxiv.org/abs/2601.22881>
Official dataset: <https://zenodo.org/records/18342898>
Official code: <https://github.com/EvoTestOps/AnoMod>
Introducing source: [AnoMod](../../wiki/sources/anomod-2026.md)

## Dataset Type

AnoMod is a multimodal anomaly-detection and root-cause-analysis dataset for microservice systems. It is built on SocialNetwork and TrainTicket and adds two behavior modalities, API responses and code coverage reports, to the usual logs, metrics, and traces.

## System Structure

SocialNetwork has 21 services. TrainTicket is a larger railway ticketing system with 41 microservices. The dataset uses system dependencies to choose anomaly injection targets, and traces expose request propagation and service dependencies.

## Anomaly Design

AnoMod defines four anomaly levels:

- Performance-level anomalies for resource issues.
- Service-level anomalies for inter-service communication or request handling.
- Database-level anomalies for data-layer disruptions.
- Code-level anomalies for logic or implementation defects.

The paper reports 24 anomaly cases across SocialNetwork and TrainTicket.

## Data Structure

The five modalities are:

- Logs: timestamped textual container records.
- Metrics: Prometheus time-series metrics.
- Distributed traces: Jaeger for SocialNetwork and SkyWalking for TrainTicket.
- API responses: status codes, end-to-end latency, headers, and response bodies.
- Code coverage reports: gcov for C++ and JaCoCo for Java.

## Reported Scale

- TrainTicket: 444.6K log lines, 831 log templates, 63975 traces, 33 collected metrics, 98073 API requests, and average code coverage rate 0.417.
- SocialNetwork: 3958.5K log lines, 29 log templates, 2635 traces, 29 collected metrics, 1950 API requests, and average code coverage rate 0.682.
- Zenodo record: one `AnoMod.zip` file of 201917396 bytes.

## Inputs And Outputs

Inputs are the five collected modalities. Outputs support anomaly detection, cross-modal fusion/ablation studies, fine-grained RCA, service-level localization, and code-region localization.

## Actions Or Interventions

Anomaly injections are controlled benchmark events. They are not a logged operator-action or remediation channel.

## Access And License Notes

The Zenodo dataset record lists CC-BY-4.0. The GitHub collection-scripts repository uses MIT. This knowledge base records metadata only and does not mirror the dataset archive.