Distributed system call chain and log fusion anomaly detection method

Abstract

The invention belongs to the technical field of software engineering and cloud computing, and particularly relates to a distributed system call chain and log fusion anomaly detection method. The method comprises the following steps: constructing a call chain event relation graph according to a call chain and log data on the basis of the call chain and log data during operation of a distributed system, and learning a call chain event relation graph mode during normal operation of the system by utilizing a graph neural network and a single-classification deep learning method; detecting a newly generated call chain event relation graph in real time during online use, and identifying a call chain generating an abnormal behavior; the method specifically comprises the steps of log event analysis, call chain event analysis, event vectorization, call chain event relation graph construction, graph neural network model training and online anomaly detection. According to the invention, operation and maintenance personnel and developers can be helped to quickly discover system exceptions, corresponding alarm information is generated, the speed of fault positioning and online problem solving is accelerated, and the labor cost is reduced.

Description

technical field [0001] The invention belongs to the technical field of software engineering and cloud computing, and in particular relates to a distributed system call chain and a log anomaly detection method. Background technique [0002] The distributed system decomposes the application program into multiple independent modules, each module has its own process and operating environment, and the processes communicate through the network. The microservice architecture developed from distributed systems has become an important part of cloud native technology. Microservices are based on fine-grained functional division and distributed operating environment, enabling applications to be independently developed, independently deployed, and flexibly scaled. Most enterprises have Implement applications using a distributed or microservices architecture. [0003] Anomaly detection is an important part of system runtime monitoring. Fast and accurate anomaly detection and discovery ca...

AI Technical Summary

Problems solved by technology

There is cross-process interaction in distributed systems, which makes traditional log anomaly detection techniques ineffective

The emergence of distributed tracing enables operation and maintenance and developers to observe the cross-process interaction mode of distributed systems, but distributed tracing systems focus on the interaction between processes, and it is difficult to effectively combine logs and distributed tracing to make distributed systems Anomaly detection encounters great difficulties

Images