OpenTelemetry AIOps Benchmark Dataset: ML-based Anomaly Detection across Traces, Metrics, and Logs (v2, eight-model study)

Companion dataset and analysis artifacts for the paper "Evaluating ML-based anomaly detection on unified OpenTelemetry telemetry: an empirical study across traces, metrics, and logs" (IEEE Access resubmission, v11). Telemetry was collected from microservice testbeds (Weaveworks Sock Shop and the OpenTelemetry Demo) instrumented with OpenTelemetry and deployed on AWS EKS, then used to benchmark semi-supervised anomaly detection across three OTel signals (distributed traces, infrastructure metrics, application logs). Experiment design. A 24-hour normal baseline was followed by a fault-injection campaign (network delay, HTTP 500 errors, CPU stress, memory stress, and four compound service cascades) using Chaos Mesh, with cooldown windows excluded from evaluation to avoid penalizing models during post-fault recovery. Models evaluated (eight semi-supervised, plus a supervised reference). Isolation Forest, One-Class SVM, LSTM Autoencoder, Transformer Autoencoder, 1D-CNN Autoencoder, LSTM-VAE, Deep SVDD, and DAGMM, with a supervised Random Forest baseline. Evaluated with five-fold cross-validation by repetition and 2,550 Optuna hyperparameter-optimization trials. Key findings. Under the primary engineered-feature representation, detection splits primarily by scoring mechanism rather than by signal type: the two density-based deep models (DAGMM, Deep SVDD) discriminate on every signal, whereas the four reconstruction-based autoencoders collapse to predict-all-anomaly on most signals. DAGMM is the strongest semi-supervised model on every signal under that representation (metrics F1 = 0.906, AUC-ROC = 0.960) and, under a matched cooldown-included comparison, equals or exceeds the supervised Random Forest F1 without using anomaly labels in training. The reconstruction collapse is a score-distribution inversion that density-based scoring avoids; because it produces high F1 at near-random AUC-ROC, AUC-ROC is recommended as the metric of record. A log-representation sensitivity study shows the log ranking is representation-dependent: a Drain/TF-IDF/PCA-21 representation lifts the Transformer Autoencoder above DAGMM on logs (the Drain/TF-IDF/PCA representation is fit unsupervised on the full corpus, a transductive caveat disclosed in the paper). An exploratory window-size sensitivity check (10/30/60 s) finds the qualitative conclusions stable across the granularities tested. Contents. otel-aiops-benchmark-dataset.zip (base v1 deposit): processed Parquet feature files, per-model/signal/fold results, raw anomaly scores, fusion, significance, prevalence, episode, feature-ablation, and supervised-baseline result files, plus chaos-experiment configs, pipeline code, and figure scripts. paper5_v11_analysis_supplement.zip (new in v2): v11 analysis scripts and result CSVs for the window-size sensitivity study, the Drain/TF-IDF/PCA log-representation comparison, threshold robustness, metric reconciliation, prevalence-normalized comparison, inference-cost benchmark, the log-aggregate feature ablation, and the Friedman ranking, with a README mapping each artifact to its manuscript table/section. Bulky regenerable intermediates (raw .npy score arrays, SageMaker output archives, feature parquets) are omitted and reproducible from the included scripts plus the base dataset. v2.0.1 note. Helper and pipeline scripts were edited to remove internal configuration identifiers (cloud account identifiers and execution-role ARNs are now read from environment variables with neutral placeholders) and to drop raw training console logs. No dataset, feature, result, or analysis value was changed; only configuration boilerplate in the code was sanitized.本数据集为论文《针对统一OpenTelemetry（开放遥测）遥测数据的基于机器学习的异常检测评估：跨追踪、指标与日志的实证研究》（IEEE Access 重新提交版，版本11）的配套数据集与分析工件。遥测数据采集自搭载OpenTelemetry工具并部署于AWS EKS的微服务测试环境（Weaveworks Sock Shop与OpenTelemetry Demo），随后被用于针对三类OpenTelemetry信号（分布式追踪、基础设施指标、应用日志）的半监督异常检测基准测试。 实验设计：首先采集24小时的正常基线数据，随后通过Chaos Mesh（混沌网格）开展故障注入实验，包含网络延迟、HTTP 500错误、CPU压力、内存压力以及四类复合服务级联故障；评估阶段排除冷却窗口，以避免模型在故障后恢复阶段被误判扣分。 评估模型：共评估8种半监督模型与1种监督参考模型，分别为孤立森林（Isolation Forest）、一类支持向量机（One-Class SVM）、LSTM自编码器（LSTM Autoencoder）、Transformer自编码器（Transformer Autoencoder）、1D-CNN自编码器（1D-CNN Autoencoder）、LSTM变分自编码器（LSTM-VAE）、深度支持向量数据描述（Deep SVDD）以及深度自编码高斯混合模型（DAGMM），监督基线模型为随机森林（Random Forest）。评估采用重复五次的交叉验证策略，以及2550次Optuna超参数优化试验。 关键发现： 1. 在主流工程化特征表征方式下，异常检测的性能差异主要由评分机制决定，而非信号类型：两类基于密度的深度模型（DAGMM、Deep SVDD）在所有信号上均具备优异的区分能力，而四类基于重构的自编码器在多数信号上均出现"全预测为异常"的失效现象。 2. 该表征方式下，DAGMM是所有信号上表现最优的半监督模型（指标F1值为0.906，AUC-ROC值为0.960）；在包含冷却窗口的对等对比实验中，无需在训练阶段使用异常标签的DAGMM，其F1值达到甚至超越了监督随机森林模型。 3. 重构型自编码器的失效源于评分分布反转，而基于密度的评分机制可规避该问题；由于该类模型在AUC-ROC接近随机的情况下仍能获得较高F1值，因此推荐将AUC-ROC作为记录指标。 4. 日志表征敏感性研究显示，日志模型的性能排序依赖于表征方式：采用Drain/TF-IDF/PCA-21表征时，Transformer自编码器在日志任务上的表现超越DAGMM（该Drain/TF-IDF/PCA表征是在全语料上无监督拟合得到，论文中已披露该直推式学习的局限性）。 5. 针对窗口大小的探索性敏感性测试（10/30/60秒）显示，定性结论在测试的所有粒度下均保持稳定。 数据集内容： 1. `otel-aiops-benchmark-dataset.zip`（基础版本1存档）：包含处理后的Parquet（帕克尔列式存储格式）特征文件、按模型/信号/折划分的结果文件、原始异常评分文件、融合结果、显著性检验结果、异常样本占比文件、事件片段文件、特征消融实验结果文件以及监督基线模型结果文件，同时包含混沌实验配置文件、流水线代码与绘图脚本。 2. `paper5_v11_analysis_supplement.zip`（版本2新增内容）：包含版本11的分析脚本与对应结果CSV文件，覆盖窗口大小敏感性研究、Drain/TF-IDF/PCA日志表征对比、阈值鲁棒性分析、指标一致性校验、异常样本占比归一化对比、推理成本基准测试、日志聚合特征消融实验以及Friedman秩和排序分析，附带README文件用于说明每个工件对应手稿的表格与章节。大型可复现中间文件（原始.npy（NumPy二进制数组格式）评分数组、SageMaker输出存档、特征Parquet（帕克尔列式存储格式）文件）已省略，可通过附带脚本与基础数据集复现。 3. v2.0.1版本说明：对辅助脚本与流水线代码进行了编辑，移除了内部配置标识符（云账户标识符与执行角色ARN现已通过环境变量读取，使用中性占位符替代），并删除了原始训练控制台日志。未对数据集、特征、结果或分析价值进行任何修改，仅对代码中的配置样板进行了脱敏处理。