Multi-dimensional root cause positioning method and device based on multi-modal learning

Abstract

The invention relates to a multi-dimensional root cause positioning method and device based on multi-modal learning. The method comprises the following steps: acquiring historical multi-modal data generated in a fault interval during operation of a cloud native system; respectively carrying out serialization processing on Metric data, Log data and Trace data in the historical multi-modal data; selecting a service instance and an API as nodes of the hypergraph, and obtaining node features according to the Metric serialization data, the Log serialization data and the Trace serialization data; according to the service instance, the API, the k8s node and the service, constructing hyperedges of the hypergraph from the angles of physics, logic and interaction, and forming a multi-modal hypergraph by the nodes and node features of the hypergraph and the hyperedges of the hypergraph; and inputting the multi-modal hypergraph into a multi-dimensional root cause positioning model based on a hypergraph neural network and a full-connection neural network, and training the multi-dimensional root cause positioning model to obtain a trained multi-dimensional root cause positioning model. According to the method, the problems of insufficient single-mode data modeling, difficulty in complex relation capture, dynamic property, isomerism and the like are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of software engineering, and particularly relates to a multi-dimensional root cause location method and device based on multi-modal learning. Background Art

[0002] Cloud-native systems are application programs or services built based on the architecture and design concepts of cloud computing, and are widely used in key fields such as Internet enterprises, national defense, telecommunications, and electric power, helping enterprises build efficient and reliable applications in the cloud environment and improving development and operation and maintenance efficiency. Such systems are usually implemented through technologies such as containerization, microservices, and automated management, and have characteristics such as rapid iteration, high availability, elasticity, and flexibility.

[0003] Cloud-native systems decompose application programs into multiple independent modules, and the modules communicate with each other through the network. The microservices architecture has become one of the important ways to implement cloud-native systems. The microservices architecture is widely used by most enterprises due to its characteristics such as independent development, independent deployment, and decentralization. Root cause location is one of the important solutions to solve the runtime failures of cloud-native systems, which can quickly and accurately report the root cause of problems and reduce operation and maintenance costs. However, compared with traditional monolithic systems, cloud-native systems have diverse structures and complex interactions, making it extremely difficult to perform root cause location for cloud-native systems.

[0004] With the increase in the scale of cloud-native systems, the number of system components and their interactions have become more complex. There is an urgent need for a method that can quickly and accurately locate the root cause of faults. The current methods can be classified from two perspectives, one is from the perspective of the types of operation and maintenance data used, and the other is from the perspective of data processing. The first category, the types of operation and maintenance data can be divided into single-modal methods and multi-modal methods. In single-modal methods, root cause location is achieved by analyzing a certain type of data in Metric, Log, and Trace and establishing the relationship between the data; multi-modal methods use all three types of data and use graph neural networks or other deep learning networks to model the correlation relationship between the data, which can more comprehensively describe the system state. The second category, from the perspective of data processing, can be divided into serialization methods and event-based methods. Among them, serialization methods process operation and maintenance data into sequence data for unified modeling to solve the problem that it is difficult to unify the modeling of heterogeneous operation and maintenance data; event-based methods regard faults as events and output a list of root causes by comparing the differences between normal and abnormal events.

[0005] Zhejiang University provided a method and system for locating the root cause of microservice exceptions in its patent document "A Method and System for Locating the Root Cause of Microservice Exceptions" (Publication No.: CN119025310A, Application No.: CN202411005152.0, Application Date: July 25, 2024). The invention discloses a method for locating the root cause of microservice exceptions, including the following steps: obtaining a number of Traces from the log library, and removing the abnormal Traces from the number of Traces based on a preset abnormal Trace set to obtain a first preliminary normal Trace set; checking whether each Trace in the first preliminary normal Trace set is complete, and removing the incomplete Traces to obtain a second preliminary normal Trace set; constructing a Trace tree for each Trace in the second preliminary normal Trace set, and calculating the self-execution time of each Span in each Trace tree to obtain a third preliminary normal Trace set; grouping and statistically analyzing the third preliminary normal Trace set based on the service name and Span name to obtain the abnormal Traces in the third preliminary normal Trace set; calculating the abnormal scores of each Span in the abnormal Traces; screening out the Span with the highest abnormal score from each abnormal score as the root cause Span; analyzing the root cause Span to obtain the root cause of the microservice exception. The invention can quickly and accurately locate the root cause of the exception.

[0006] Anhui Sigao Intelligent Technology Co., Ltd. provided a method and device for locating the root cause of microservices in its patent document "A Method and Device for Locating the Root Cause of Microservice Systems Based on Graph Neural Network Models" (Publication No.: CN117560275A, Application No.: CN202311854026.8, Application Date: February 13, 2024). The invention relates to a method and device for locating the root cause of microservice systems based on graph neural network models, including the steps of: constructing a graph neural network model; training the graph neural network model using the historical fault multi-dimensional time series performance indicators to obtain a trained graph neural network model; constructing an instance-level heterogeneous topology graph of the microservice system through the collected real-time microservice topology structure and call relationship; adjusting the abnormal weights of each microservice node in combination with the service request link; inputting the root cause candidate set and the abnormal time window real-time indicator feature data into the graph neural network model, and obtaining the final root cause and root cause abnormal type after feature weighting. The invention can detect quickly and accurately, reduce the positioning granularity to the instance level; by effectively combining the machine learning model with the dynamic graph calculation method, it can well adapt to the dynamic changes of the microservice system.

[0007] When existing methods using single-modal data face cloud-native systems with complex interactions, it is difficult to comprehensively model the complete state of system runtime failures, resulting in false negatives and further increasing the operation and maintenance costs. When existing multi-modal methods face cloud-native systems with diverse component relationships, general graph neural networks can only capture one-to-one relationships, while there are a large number of one-to-many situations in cloud-native systems, making it difficult to comprehensively model the association relationships between system components. Cloud-native systems involve multiple levels (such as the application layer, service layer, and infrastructure layer), and failures may propagate between different levels. Existing methods are usually limited to single-level analysis and lack the ability to model cross-level associations, resulting in an inability to fully understand the failure propagation path, which may lead to misjudgments from a local perspective and increase the complexity of fault diagnosis. In addition, the root cause localization granularity of existing methods only focuses on a single dimension such as the instance or service level. However, for engineers, a single-dimensional root cause does not significantly shorten the fault handling time.

[0008] Therefore, existing root cause localization methods have problems such as not fully considering the complex relationships between components within the system, insufficient single-modal data modeling, difficulty in capturing complex relationships, as well as dynamics, heterogeneity, incomplete software modeling, distortion, etc., resulting in inaccurate root causes obtained. Summary of the Invention

[0009] To solve the above problems existing in the prior art, the present invention provides a multi-dimensional root cause localization method and device based on multi-modal learning. The technical problems to be solved by the present invention are realized through the following technical solutions:

[0010] An embodiment of the present invention provides a multi-dimensional root cause localization method based on multi-modal learning, including the steps of:

[0011] Obtain historical multi-modal data generated during the fault interval of the cloud-native system runtime;

[0012] Perform serialization processing on the Metric data, Log data, and Trace data in the historical multi-modal data respectively to obtain Metric serialized data, Log serialized data, and Trace serialized data;

[0013] Select service instances and APIs as the nodes of the hypergraph, and obtain node features according to the Metric serialized data, Log serialized data, and Trace serialized data; construct hyperedges of the hypergraph from the perspectives of physics, logic, and interaction for service instances, APIs, k8s nodes, and services, and form a multi-modal hypergraph from the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph;

[0014] Input the multi-modal hypergraph into a multi-dimensional root cause localization model based on a hypergraph neural network and a fully connected neural network, and train the multi-dimensional root cause localization model to obtain a trained multi-dimensional root cause localization model;

[0015] Among them, the trained multi-dimensional root cause localization model is deployed in the cloud native system and is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the new fault time interval when a new fault occurs in the cloud native system, so as to obtain multi-dimensional root causes.

[0016] In an embodiment of the present invention, serializing the Metric data, Log data, and Trace data in the historical multi-modal data respectively to obtain Metric serialized data, Log serialized data, and Trace serialized data includes:

[0017] Normalize and regularize the Metric data in sequence, and use the attention mechanism to assign weights to the regularized data to obtain the Metric serialized data;

[0018] Adopt the Drain algorithm to extract the template of the Log data, use the BERT model to perform semantic encoding on the extracted data, and use the attention mechanism to assign weights to the semantically encoded data to obtain the Log serialized data;

[0019] Extract key information from the Trace data, normalize and regularize the key information in sequence, and use the attention mechanism to assign weights to the regularized data to obtain the Trace serialized data.

[0020] In an embodiment of the present invention, obtaining node features according to the Metric serialized data, Log serialized data, and Trace serialized data includes:

[0021] Perform feature splicing on the Metric serialized data, Log serialized data, and Trace serialized data to obtain service instance node features;

[0022] Use the Metric serialized data as API node features.

[0023] In an embodiment of the present invention, the hyperedges include deployment hyperedges representing the deployment relationship between service instances and k8s nodes, subordinate hyperedges representing the subordinate relationship between services and service instances, control hyperedges representing the control relationship between service instances and APIs, bridging hyperedges representing the bridging relationship between APIs, and dependency hyperedges representing the dependency relationships contained in the frequent itemsets mined from Trace data.

[0024] In one embodiment of the present invention, the multi-dimensional root cause localization model includes a hypergraph neural network and a fully connected neural network connected in sequence, where,

[0025] The hypergraph neural network includes a number of convolutional layers connected in sequence;

[0026] The fully connected neural network includes a multi-layer perceptron.

[0027] In one embodiment of the present invention, inputting the multi-modal hypergraph into the multi-dimensional root cause localization model based on the hypergraph neural network and the fully connected neural network, and training the multi-dimensional root cause localization model to obtain a trained multi-dimensional root cause localization model, includes:

[0028] Input the multi-modal hypergraph into the hypergraph neural network, obtain hyper-edge features and node features through multi-layer convolution by the number of convolutional layers, and use an adaptive weight mechanism to adjust the weights of different hyper-edges, and use the hyper-edge features output by the last convolutional layer as the input of the multi-layer perceptron;

[0029] Use a multi-layer perceptron to map the input of the hyper-edge features into a class space to generate a classification score matrix, and convert the classification score matrix into a probability distribution to obtain a class probability matrix of the hyper-edges;

[0030] Use a loss function to calculate the loss between each class probability in the class probability matrix and the true label, and perform backpropagation to update the parameters of the multi-dimensional root cause localization model. After the training is completed, a trained multi-dimensional root cause localization model is obtained.

[0031] In one embodiment of the present invention, in the hypergraph neural network, the node features after convolution of the i-th convolutional layer are:

[0032]

[0033] The hyper-edge features after convolution of the i-th convolutional layer are:

[0034]

[0035] The hyper-edge features output by the last convolutional layer are:

[0036] Y′ = Multi-ConV-Layer(X t , Y t )

[0037] where, X i and Y i respectively represent the node features and hyper-edge features after convolution of the i-th layer, Y′ represents the hyper-edge features output by the last convolutional layer, σ represents a non-linear activation function, D e -1The inverse of the diagonal matrix representing the degree of hyperedges, H represents the incidence matrix, W represents the weight of hyperedges, D v The diagonal matrix representing the node degree, Θ represents the learnable parameters of the hypergraph neural network during the training process, Multi-ConV-Laye() represents obtaining hyperedge features through multi-layer convolution, X t Represents the initial node features, Y t Represents the initial hyperedge features;

[0038] In the fully connected neural network, the class probability matrix of the hyperedges is:

[0039] P = Softmax(h)

[0040] h = ReLU(Z)

[0041] Z = W m Y'+b

[0042] Where P is the class probability matrix of hyperedges, with dimension M*K, M is the number of hyperedges, K is the number of root cause categories, and each row of P i Represents the probability that hyperedge i is the root cause, h is the output after the ReLU activation function processes the classification score matrix Z, Z is the classification score matrix output by the fully connected layer of the multi-layer perceptron, W m Is the parameter learned in the MLP, and b is the bias term.

[0043] In an embodiment of the present invention, the loss function is:

[0044]

[0045] Where, Is the one-hot encoding of the true label of hyperedge i, P (i,k) Is the predicted probability that hyperedge i belongs to category k, M is the number of hyperedges, and K is the number of root cause categories.

[0046] In an embodiment of the present invention, the trained multi-dimensional root cause localization model is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data during the time interval of a new fault in the cloud-native system, to obtain multi-dimensional root causes, including:

[0047] Obtain multi-modal operation and maintenance data during the time interval of a new fault in the cloud-native system;

[0048] Perform serialization processing on the Metric data, Log data, and Trace data in the multi-modal operation and maintenance data respectively to obtain Metric serialization data, Log serialization data, and Trace serialization data during the time interval of the new fault;

[0049] Select service instances and APIs as the nodes of the new hypergraph, and obtain new node features based on the Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval;

[0050] Construct the hyperedges of the new hypergraph from the perspectives of physics, logic, and interaction based on service instances, APIs, k8s nodes, and services. A new multimodal hypergraph is formed by the nodes of the new hypergraph, the new node features, and the hyperedges of the new hypergraph;

[0051] Use the trained multi-dimensional root cause localization model to extract features from the new multimodal hypergraph to obtain multi-dimensional root causes.

[0052] Another embodiment of the present invention provides a multi-dimensional root cause localization device based on multimodal learning, including:

[0053] A multimodal data acquisition module for acquiring multimodal operation and maintenance data generated during the fault interval of the cloud native system runtime;

[0054] A multimodal data vectorization module for respectively performing serialization processing on the Metric data, Log data, and Trace data in the multimodal operation and maintenance data to obtain Metric serialized data, Log serialized data, and Trace serialized data;

[0055] A multimodal data hypergraph construction module for selecting service instances and APIs as the nodes of the hypergraph, and obtaining node features based on the Metric serialized data, Log serialized data, and Trace serialized data; constructing the hyperedges of the hypergraph from the perspectives of physics, logic, and interaction based on service instances, APIs, k8s nodes, and services. A multimodal hypergraph is formed by the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph;

[0056] A root cause localization module for using the trained multi-dimensional root cause localization model to extract features from the multimodal hypergraph to obtain multi-dimensional root causes.

[0057] Compared with the prior art, the beneficial effects of the present invention:

[0058] The method of the present invention first serializes multi-modal data, then constructs nodes and hyperedges to form a hypergraph, and uses the serialized data as node features. After that, the constructed hypergraph is used as the input of a hypergraph neural network to train a root cause localization model. When used online, the multi-modal operation and maintenance data within the fault time interval is serialized and input into this hypergraph neural network model. According to the hyperedge representation, multi-dimensional root causes are output. This method realizes root cause localization through hyperedge classification, achieves accurate and multi-dimensional localization of software runtime faults, improves the stability and reliability of cloud-native systems. At the same time, engineers can analyze multi-dimensional root causes to reduce the fault handling time, significantly reduce the operation and maintenance time, and solve the problems of insufficient single-modal data modeling, difficulty in capturing complex relationships, and dynamicity and heterogeneity. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a schematic flowchart of a multi-dimensional root cause localization method based on multi-modal learning provided by an embodiment of the present invention;

[0060] Figure 2 is a schematic flowchart of another multi-dimensional root cause localization method based on multi-modal learning provided by an embodiment of the present invention;

[0061] Figure 3 is a schematic diagram of a multi-modal hypergraph provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0062] The following further describes the present invention in detail with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0063] Embodiment 1

[0064] This embodiment provides a multi-dimensional root cause localization method and device based on multi-modal learning, which relates to technical fields such as intelligent operation and maintenance of cloud-native systems, artificial intelligence, and data mining, and is applicable to online cloud-native system operation tasks to complete the analysis, application, and modeling of complex interaction relationships of multi-modal operation and maintenance data, achieve accurate and multi-dimensional localization of software runtime faults, and improve the stability and reliability of cloud-native systems.

[0065] Please refer to Figure 1 and Figure 2 , Figure 1 is a schematic flowchart of a multi-dimensional root cause localization method based on multi-modal learning provided by an embodiment of the present invention, Figure 2 is a schematic flowchart of another multi-dimensional root cause localization method based on multi-modal learning provided by an embodiment of the present invention.

[0066] The multi-dimensional root cause localization method of this embodiment includes multi-modal data vectorization, multi-modal data hypergraph construction, and training a multi-dimensional root cause localization model based on a hypergraph neural network and a fully connected neural network. Among them, the trained multi-dimensional root cause localization model is used for online root cause localization. The specific steps are as follows:

[0067] S1. Obtain historical multi-modal data generated during the fault interval of the cloud native system during operation.

[0068] Specifically, collect the historical multi-modal data generated during the fault interval of the cloud native system during operation and label the root cause to obtain a multi-modal data set for training the multi-dimensional root cause localization model.

[0069] S2. Serialize the Metric data, Log data, and Trace data in the historical multi-modal data respectively to obtain Metric serialized data, Log serialized data, and Trace serialized data.

[0070] Specifically, a large amount of multi-modal operation and maintenance data will be generated during the operation of the cloud native system, including three types of data: Metric data, Log data, and Trace data. These three types of data are the key to monitoring and diagnosing system failures. However, the forms and structures of these three types of data are quite different, making it difficult to process them uniformly. Metric data reflects system performance and resource usage, and its manifestation form is serialized data. Log data is the event or status information recorded during the operation of the system or application, usually stored in text form, and is used to record detailed operations and error information. Trace data is used to record the call relationship of requests between multiple services, and each request has a unique Trace ID for easy tracking. The serialization method can convert the three types of data into a unified format for subsequent unified modeling. The specific steps for serialization processing are as follows:

[0071] S21. After normalizing and regularizing the Metric data in sequence, the Metric data features can be obtained. Then, use the attention mechanism to assign weights to the regularized data to highlight the Metric data with important contributions and obtain the Metric serialized data.

[0072] S22. The Drain algorithm is widely used to extract the Log data template. In this embodiment, the Drain algorithm is used to extract the template of the Log data, and the BERT model is used to perform semantic encoding on the extracted data. Then, use the attention mechanism to assign weights to the semantically encoded data to highlight the Log data with important contributions and obtain the Log serialized data.

[0073] S23. Extract key information such as the failure rate and response latency of requests from the Trace data. Treat these key information as time series, then normalize and regularize the key information in sequence, and use the attention mechanism to assign weights to the regularized data to obtain the Trace serialized data.

[0074] In this embodiment, the multi-modal data is uniformly processed and modeled, and the operation and maintenance data can be fully utilized.

[0075] S3. Select service instances and APIs as the nodes of the hypergraph, and obtain node features according to the Metric serialized data, Log serialized data, and Trace serialized data; construct hyperedges of the hypergraph from the perspectives of physics, logic, and interaction based on service instances, APIs, k8s nodes, and services. The multi-modal hypergraph is formed by the nodes of the hypergraph, node features, and hyperedges of the hypergraph.

[0076] Compared with general graph neural networks, hypergraph neural networks have significant advantages in modeling complex relationships. In order to represent the complex relationships of cloud-native systems, this embodiment selects to use a hypergraph to construct the association relationships among k8s nodes, services, service instances, and APIs. This embodiment parses historical multi-modal data, divides the serialized data according to service instances and APIs, and uses it as the feature representation of the nodes, and constructs five types of hyperedges, including the association relationships among various components in the cloud-native system.

[0077] First, perform node selection and construction.

[0078] Specifically, select service instances and APIs as the nodes of the hypergraph because failures often occur centered around these two types of elements. Therefore, features are constructed for service instances and APIs respectively. For service instances, use the Metric, Log, and Trace data within the failure interval as the original features. After each type of data is serialized, the Metric serialized data, Log serialized data, and Trace serialized data are concatenated as the service instance node features. For API nodes, use the Metric data as the original feature. After serialization processing, the Metric serialized data is used as the API node feature.

[0079] Then, perform hyperedge selection and construction.

[0080] Hyperedges play a crucial role in hypergraphs, and the selection of hyperedges determines the representation of nodes. To accurately model the complex node relationships in cloud-native systems, five types of hyperedges are carefully designed in this step, constructed from physical, logical, and interaction perspectives to comprehensively describe the diverse and complex component relationships in cloud-native systems. The hyperedges are shown in Table 1 below, namely deployment hyperedges, subordination hyperedges, control hyperedges, bridging hyperedges, and dependency hyperedges. Among them, deployment hyperedges represent the deployment relationship between service instances and k8s nodes, subordination hyperedges represent the subordination relationship between services and service instances, control hyperedges represent the control relationship between service instances and APIs, bridging hyperedges represent the bridging relationship between APIs, and dependency hyperedges represent the dependency relationships contained in the frequent itemsets mined from Trace data.

[0081] In addition, this embodiment supports adding new hyperedge types to achieve dynamic expansion. That is, in addition to the above five types of hyperedges, engineers can set new hyperedges according to actual needs and expert experience to build comprehensive association relationships.

[0082] Table 1

[0083]

[0084]

[0085] Please refer to Figure 3 , Figure 3 which is a schematic diagram of a multimodal hypergraph provided by an embodiment of the present invention. Figure 3 In the left figure of, the vertical direction represents nodes and the horizontal direction represents hyperedges, and the number 1 indicates that the node is inside the hyperedge; Figure 3 In the right figure of, the circles are nodes and the triangles are hyperedges. Specifically, a multimodal hypergraph G(V, E, W) is formed by the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph, where V, E, and W represent the node set, hyperedge set, and edge weight set respectively. Specifically, by aggregating multimodal data features, the system state within a given time window t is formalized as a hypergraph G = (V, E, H), where the node set V = {v_i} contains entities such as service instances and API endpoints, and the hyperedge set E = {e_j}. The incidence matrix H ∈ {0, 1}^{|V|×|E|} defines the membership relationship between nodes and hyperedges. When H_{i,j} = 1, it means that the node v_i belongs to the hyperedge e_j.

[0086] This embodiment proposes a construction method for five types of hyperedges, which can comprehensively model the association relationships between various components of the system.

[0087] S4. Input the multimodal hypergraph into a multi-dimensional root cause localization model based on a hypergraph neural network and a fully connected neural network, train the multi-dimensional root cause localization model, and obtain a trained multi-dimensional root cause localization model.

[0088] In this embodiment, a multi-dimensional root cause location model based on a hypergraph neural network and a fully connected neural network is trained using a hypergraph. The hypergraph neural network includes a number of convolutional layers connected in sequence, and the fully connected neural network includes a multi-layer perceptron (MLP). Hyperedges are regarded as the root causes, and the fault labels are on the hyperedges. Hyperedges in different dimensions represent root causes in different dimensions. The input form of the hypergraph is G=(V, E, H). The spatial convolution method proposed in the general hypergraph neural network HGNN+ is used to capture the high-order association patterns between components. Finally, the MLP is used to map the hyperedge representation to the class space to achieve multi-dimensional root cause location.

[0089] The specific process of training the multi-dimensional root cause location model includes the following steps:

[0090] S41. Input the multi-modal hypergraph into the hypergraph neural network, obtain hyperedge features and node features through multi-layer convolution by a number of convolutional layers, and use an adaptive weight mechanism to adjust the weights of different hyperedges. Take the hyperedge features output by the last convolutional layer as the input of the multi-layer perceptron.

[0091] Specifically, in HGNN+, hyperedge features and node features are obtained through a two-stage spatial convolution method. To capture the high-order relationships between components, in this embodiment, a deep network is used to model the complex relationships of the microservice system through multi-layer stacking. First, input the node feature X t , with a dimension of N*C, where N is the number of nodes in the node set V and C is the feature dimension; the hypergraph structure is represented by the incidence matrix H, with a dimension of N*M, where M is the number of hyperedges; the initial hyperedge feature is Y. Then, hyperedge features and node features are obtained through multi-layer convolution (such as 2-3 layers), and an adaptive weight mechanism is used to dynamically adjust the importance of different hyperedges using the learnable hyperedge weight We. Finally, select the hyperedge feature Y' output by the last convolutional layer as the input of the MLP.

[0092] Specifically, in the hypergraph neural network, the node feature after convolution in the i-th convolutional layer is:

[0093]

[0094] The hyperedge feature after convolution in the i-th convolutional layer is:

[0095]

[0096] The hyperedge feature output by the last convolutional layer is:

[0097] Y' = Multi-ConV-Layer(X t , Y t )

[0098] where Xi and Y i represent the node features and hyperedge features after the i-th layer of convolution respectively, Y' represents the hyperedge features output by the last convolutional layer, σ represents the non-linear activation function, represents the inverse of the diagonal matrix of the degrees of hyperedges, H represents the incidence matrix, W represents the weights of hyperedges, D v represents the diagonal matrix of node degrees, Θ represents the learnable parameters of the hypergraph neural network during the training process, Multi-ConV-Laye() represents obtaining hyperedge features through multiple layers of convolution, X t represents the initial node features, Y t represents the initial hyperedge features.

[0099] S42. Use a multi-layer perceptron to map the input hyperedge features to the class space to generate a classification score matrix, and convert the classification score matrix into a probability distribution to obtain the class probability matrix of hyperedges.

[0100] Specifically, select a multi-layer perceptron to implement multi-dimensional root cause localization, and use the final hyperedge features Y' as the input of the root cause localization model. First, the MLP maps the features to the hidden layer, then enhances the expression ability through the non-linear activation function, and maps the output of the hidden layer to the class space through the fully connected layer to generate a classification score matrix Z:

[0101] Z = W m Y' + b

[0102] where, W m is the parameter learned in the MLP, and b is the bias term.

[0103] Next, use the ReLU (Rectified Linear Unit) activation function to further process the classification score matrix Z. ReLU is a commonly used activation function, which can introduce non-linearity into the neural network and enhance the expression ability of the model. The matrix after being processed by the ReLU activation function is:

[0104] h = ReLU(Z)

[0105] where, h is the output after the classification score matrix Z is processed by the ReLU activation function.

[0106] Furthermore, after being processed by the activation function, use softmax for normalization operation to convert the classification scores into a probability distribution to obtain the class probability matrix of hyperedges:

[0107] P = Softmax(h)

[0108] where, P is the class probability matrix of hyperedges, with dimensions M * K, and each row of P iIt represents the probability that the hyperedge i is the root cause, M is the number of hyperedges, and K is the number of root cause categories.

[0109] S43. Calculate the loss between each category probability in the category probability matrix and the true label using the loss function, and perform backpropagation to update the parameters of the multi-dimensional root cause localization model until the iteration ends, obtaining a trained multi-dimensional root cause localization model.

[0110] Specifically, the cross-entropy loss function is used as the loss function. Assume that the true label of the hyperedge is Y true (with a dimension of M*1, and each element is the category index of the hyperedge), then the loss function can be defined as:

[0111]

[0112] Among them, is the one-hot encoding of the true label of hyperedge i, and P (i,k) is the predicted probability that hyperedge i belongs to category k.

[0113] Specifically, after obtaining the category probability matrix of the hyperedge through forward propagation, calculate the loss using the loss function, and then perform backpropagation and parameter update to train the multi-dimensional root cause localization model. After the training ends, a trained multi-dimensional root cause localization model is obtained.

[0114] In this embodiment, hyperedge classification is used to train the multi-dimensional root cause localization model to achieve root cause localization. It can achieve multi-dimensional root cause localization, effectively improve the accuracy of root cause localization, and significantly reduce the operation and maintenance time.

[0115] The method of this embodiment first serializes the multi-modal data to fuse the multi-modal data, and after weighted processing, obtains sequence data with different importance; then constructs nodes and hyperedges to form a hypergraph, and uses the serialized data as node features. After that, the constructed hypergraph is used as the input of the hypergraph neural network to train the root cause localization model. When used online, the multi-modal operation and maintenance data within the fault time interval is serialized and input into this hypergraph neural network model. According to the hyperedge representation, multi-dimensional root causes are output. This method uses hyperedge features for downstream task training to achieve root cause localization, realizes accurate and multi-dimensional localization of software runtime faults, improves the stability and reliability of the cloud-native system. At the same time, engineers can analyze multi-dimensional root causes to reduce the fault handling time, significantly reduce the operation and maintenance time, and solve the problems of insufficient single-modal data modeling, difficulty in capturing complex relationships, and dynamicity and heterogeneity.

[0116] Furthermore, the trained multi-dimensional root cause localization model is deployed in the cloud-native system, and online root cause localization is performed whenever a new fault occurs. The online root cause localization includes the following steps:

[0117] S10. Obtain multi-modal operation and maintenance data within the time interval of the occurrence of new faults in the cloud-native system;

[0118] S20. Respectively perform serialization processing on Metric data, Log data, and Trace data in the multi-modal operation and maintenance data to obtain Metric serialized data, Log serialized data, and Trace serialized data within the time interval of the new faults;

[0119] S30. Select service instances and APIs as nodes of the new hypergraph, and obtain new node features according to the Metric serialized data, Log serialized data, and Trace serialized data within the time interval of the new faults;

[0120] S40. Construct hyperedges of the new hypergraph from the perspectives of physics, logic, and interaction based on service instances, APIs, k8s nodes, and services. A new multi-modal hypergraph is formed by the nodes of the new hypergraph, the new node features, and the hyperedges of the new hypergraph;

[0121] S50. Use the trained multi-dimensional root cause localization model to extract features from the new multi-modal hypergraph to obtain multi-dimensional root causes represented by hyperedge features for subsequent root cause localization.

[0122] For the specific implementation manners of steps S10 to S50, please refer to the above introduction and will not be elaborated here.

[0123] This embodiment provides root cause hyperedges to engineers, covering multiple dimensions of the system, thereby realizing accurate and efficient fault root cause localization.

[0124] The embodiment of the present invention also provides a multi-dimensional root cause localization device based on multi-modal learning, including: a multi-modal data acquisition module for obtaining multi-modal operation and maintenance data generated during the fault interval of the operation of the cloud-native system; a multi-modal data vectorization module for respectively performing serialization processing on Metric data, Log data, and Trace data in the multi-modal operation and maintenance data to obtain Metric serialized data, Log serialized data, and Trace serialized data; a multi-modal data hypergraph construction module for selecting service instances and APIs as nodes of the hypergraph, and obtaining node features according to the Metric serialized data, Log serialized data, and Trace serialized data; constructing hyperedges of the hypergraph from the perspectives of physics, logic, and interaction based on service instances, APIs, k8s nodes, and services, and forming a multi-modal hypergraph by the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph; a root cause localization module for using the trained multi-dimensional root cause localization model to extract features from the multi-modal hypergraph to obtain multi-dimensional root causes.

[0125] For the specific implementation of the multi-dimensional root cause localization device based on multi-modal learning, please refer to the above introduction and will not be elaborated here.

[0126] The multi-dimensional root cause localization device and method based on multi-modal learning provided in this embodiment adopt the hypergraph neural network technology, use the multi-modal data generated when the cloud native system fails, serialize the multi-modal data into a unified mode, and the serialized data is the feature of the node in the graph, describing the state of the node during the fault interval; by collecting historical fault data, use the hypergraph neural network to model the complex relationships between the components of the system, and select hypergraph convolution to train the hypergraph neural network model; when used online, serialize the multi-modal data within the fault time interval and input it into the hypergraph neural network model, and according to the hyperedge representation, output the multi-dimensional root cause. Engineers can analyze the multi-dimensional root cause to reduce the fault handling time, solving the problem that the prior art does not fully consider the complex relationships between the components inside the system, resulting in incomplete and distorted software modeling, and thus inaccurate root causes obtained.

[0127] The above content is a further detailed description of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is only limited to these descriptions. For those of ordinary skill in the technical field to which the present invention belongs, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should all be regarded as belonging to the protection scope of the present invention.

Claims

1. A multi-dimensional root cause location method based on multimodal learning, characterized in that: Includes steps: Obtain historical multimodal data generated during the failure interval of the cloud native system runtime; Serializing the metric data, log data, and trace data in the historical multimodal data to obtain metric serialized data, log serialized data, and trace serialized data; Selecting service instances and APIs as nodes of the hypergraph, and obtaining node features according to the metric serialized data, the log serialized data, and the trace serialized data; Constructing hyperedges of a hypergraph from the perspectives of physics, logic, and interaction according to service instances, APIs, k8s nodes, and services, and forming a multimodal hypergraph from the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph; Inputting the multimodal hypergraph into a multidimensional root cause localization model based on a hypergraph neural network and a fully connected neural network, training the multidimensional root cause localization model, and obtaining a trained multidimensional root cause localization model; Among them, the trained multi-dimensional root cause location model is deployed in the cloud native system, and is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the time interval of the new fault when a new fault occurs in the cloud native system, so as to obtain the multi-dimensional root cause.

2. The multi-dimensional root cause location method based on multimodal learning according to claim 1, characterized in that: The metric data, log data, and trace data in the historical multimodal data are serialized respectively to obtain metric serialized data, log serialized data, and trace serialized data, including: Normalizing and regularizing the metric data in sequence, and using an attention mechanism to assign weights to the regularized data to obtain the metric serialized data; The template of the Log data is extracted using the Drain algorithm, and the extracted data is semantically encoded using the BERT model, and the semantically encoded data is weighted using the attention mechanism to obtain the Log serialized data; Key information is extracted from the Trace data, normalized and regularized in turn, and weights are assigned to the regularized data using an attention mechanism to obtain the Trace serialized data.

3. The multi-dimensional root cause location method based on multimodal learning according to claim 1, characterized in that: Obtain node features according to the Metric serialized data, Log serialized data, and Trace serialized data, including: The metric serialized data, the log serialized data and the trace serialized data are concatenated to obtain the service instance node features; The metric serialized data is used as the API node feature.

4. The multi-dimensional root cause location method based on multimodal learning according to claim 1, characterized in that: The hyperedges include deployment-class hyperedges representing the deployment relationship between service instances and k8s nodes, subordinate-class hyperedges representing the subordinate relationship between services and service instances, control-class hyperedges representing the control relationship between service instances and APIs, bridging-class hyperedges representing the bridging relationship between APIs, and dependency-class hyperedges representing the dependency relationship contained in the frequent item set mined from Trace data.

5. The multi-dimensional root cause location method based on multimodal learning according to claim 1, characterized in that: The multi-dimensional root cause location model includes a hypergraph neural network and a fully connected neural network connected in sequence, wherein: The hypergraph neural network includes a plurality of convolutional layers connected in sequence; The fully connected neural network includes a multi-layer perceptron.

6. The multi-dimensional root cause location method based on multimodal learning according to claim 5, characterized in that: Inputting the multimodal hypergraph into a multidimensional root cause location model based on a hypergraph neural network and a fully connected neural network, training the multidimensional root cause location model, and obtaining a trained multidimensional root cause location model, including: Inputting the multimodal hypergraph into the hypergraph neural network, obtaining hyperedge features and node features by performing multi-layer convolution through the plurality of convolutional layers, adjusting weights of different hyperedges by using an adaptive weight mechanism, and using the hyperedge features output by the last convolutional layer as input to the multi-layer perceptron; Using a multi-layer perceptron, mapping the hyperedge feature input to a category space to generate a classification score matrix, and converting the classification score matrix into a probability distribution to obtain a category probability matrix of the hyperedge; The loss function is used to calculate the loss between each category probability and the true label in the category probability matrix, and back propagation is performed to update the parameters of the multi-dimensional root cause localization model. After the training is completed, a trained multi-dimensional root cause localization model is obtained.

7. The multi-dimensional root cause location method based on multimodal learning according to claim 6, characterized in that: In the hypergraph neural network, the node features after convolution of the i-th convolutional layer are: The hyper-edge feature after convolution of the i-th convolutional layer is: The hyperedge features output by the last convolutional layer are: Y′=Multi-ConV-Layer(X t ,Y t ) Among them, X i and Y i They represent the node features and hyperedge features after the i-th convolution layer, Y′ represents the hyperedge features output by the last convolution layer, σ represents the nonlinear activation function, represents the inverse of the diagonal matrix of the hyperedge degree, H represents the incidence matrix, W represents the weight of the hyperedge, D v represents the diagonal matrix of node degree, Θ represents the learnable parameters of the hypergraph neural network during training, Multi-ConV-Laye() represents the hyperedge features obtained through multi-layer convolution, X t represents the initial node feature, Y t represents the initial hyperedge feature; In the fully connected neural network, the category probability matrix of the hyperedge is: P = Softmax(h) h=ReLU(Z) Z=W m Y′+b Among them, P is the category probability matrix of the hyperedge, the latitude is M*K, M is the number of hyperedges, K is the number of root cause categories, and each row of P i represents the probability that hyperedge i is the root cause, h is the output of the ReLU activation function on the classification score matrix Z, Z is the classification score matrix output by the fully connected layer of the multilayer perceptron, W m is the parameter learned in MLP, and b is the bias term.

8. The multi-dimensional root cause location method based on multimodal learning according to claim 6, characterized in that: The loss function is: in, is the one-hot encoding of the true label of hyperedge i, P (i,k) is the predicted probability that hyperedge i belongs to category k, M is the number of hyperedges, and K is the number of root cause categories.

9. The multi-dimensional root cause location method based on multimodal learning according to claim 1, characterized in that: The trained multi-dimensional root cause location model is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the time interval of the new fault when a new fault occurs in the cloud native system, and obtain the multi-dimensional root cause, including: Obtain multimodal operation and maintenance data within the time interval when new failures occur in cloud native systems; Serializing the metric data, log data, and trace data in the multimodal operation and maintenance data to obtain metric serialized data, log serialized data, and trace serialized data within a new fault time interval; Selecting service instances and APIs as nodes of a new hypergraph, and obtaining new node features according to Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval; According to the service instance, API, k8s node and service, a new hypergraph hyperedge is constructed from the physical, logical and interactive perspectives, and a new multimodal hypergraph is formed by the nodes of the new hypergraph, the new node features and the hyperedges of the new hypergraph; The trained multi-dimensional root cause localization model is used to perform feature extraction on the new multi-modal hypergraph to obtain multi-dimensional root causes.

10. A multi-dimensional root cause location device based on multimodal learning, characterized in that: include: The multimodal data acquisition module is used to obtain the multimodal operation and maintenance data generated during the failure interval when the cloud native system is running; A multimodal data vectorization module, used to serialize the metric data, log data, and trace data in the multimodal operation and maintenance data to obtain metric serialized data, log serialized data, and trace serialized data; A multimodal data hypergraph construction module, used to select service instances and APIs as nodes of the hypergraph, and obtain node features according to the metric serialized data, log serialized data, and trace serialized data; Constructing hyperedges of a hypergraph from the perspectives of physics, logic, and interaction according to service instances, APIs, k8s nodes, and services, and forming a multimodal hypergraph from the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph; The root cause localization module is used to extract features from the multimodal hypergraph using a trained multi-dimensional root cause localization model to obtain multi-dimensional root causes.

Images