CALL FLOW-BASED ANOMALY DETECTION FOR LAYERED SOFTWARE SYSTEMS

Techniques for implementing call flow-based anomaly detection in a layered software system are provided. According to one set of embodiments, a service instance in the layered software system can receive an invocation message indicating invocation of an application programming interface (API) exposed by the service instance. The service instance can further create a log entry including information pertaining to the invocation of the API and a call flow tag, where the call flow tag includes an identifier of a call flow to which the invocation of the API belongs and an ordered series of one or more sub-identifiers indicating a position of the invocation within the call flow. The service instance can then write the log entry to a log store of the layered software system.