DAIMS: a distributed multi-agent framework for explainable anomaly detection in web services using machine learning and semantic reasoning
摘要
Modern web-based distributed systems are becoming increasingly complex and scaled up, making real-time anomaly detection more challenging and essential for ensuring trust and quality of services that support modern society. Traditional monitoring approaches lack coordination between components, semantic interpretation and adaptability, leading to high false positive rates and insufficient explanations. These are critical issues in complex microservice environments, which require rapid incident response. This paper introduces a Distributed Agent-based Intelligent Monitoring System (DAIMS) to address these challenges. The framework combines machine learning (ML) with semantic reasoning through a novel four-layer architecture. Intelligent agents monitor service metrics locally and detect anomalies using XGBoost models. These agents collaborate via a message bus and semantically enrich detected events with a lightweight OWL ontology. Simultaneously, SWRL rules are applied by a central reasoner to identify system-wide problems, root causes and propagation chains. Experimental results demonstrate that DAIMS outperforms baseline methods on the TrainTicket benchmark. It achieves an F1-score of 0.91, a detection rate of 94% and a false positive rate of 5%, with moderate overhead and low inference latency (85 ms). The significance of these improvements was confirmed by statistical tests. Explainability is one of the key contributions of DAIMS. It provides semantic explanations for the vast majority of detected anomalies with an Explanation Completeness Score of 0.87. DAIMS achieves superior detection accuracy, responsiveness and explainability while requiring acceptable computational overhead. These results demonstrate that the synergy between ML and semantic reasoning enhances anomaly detection, fault explainability and robustness in distributed web environments.