Microservice fault positioning method and device based on causal inference and knowledge graph

Abstract

The invention relates to the field of computers, in particular to a micro-service fault positioning method and device based on causal inference and a knowledge graph. The method comprises the following steps: firstly, collecting an original calling link, a multi-dimensional time sequence index and log data of a micro-service system, analyzing the correlation of micro-service indexes by using a partial correlation algorithm, then inferring the causal relationship of the indexes by using a structural causal model, and mapping the causal relationship of the indexes to specific service calling by using a principal component analysis method. And constructing a service dependency relationship. And then defining a knowledge graph ontology, constructing a fault dependency graph according to an index causal relationship and a service dependency relationship, and fusing the fault dependency graph with a calling link graph to form a complete fault dependency knowledge graph with multi-level influence. And finally, storing the graph in a graph database, taking exception as a service node starting point, and outputting a fault root cause candidate set through exception detection, random walk and node score calculation. According to the invention, the efficiency and accuracy of fault positioning are improved, and the stable operation of the micro-service system is ensured.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a microservice fault location method based on causal inference and knowledge graph, and its corresponding computer program product and computer device. Background Art

[0002] With the rapid development of information technology, the microservice architecture has been widely used in cloud computing environments. By splitting complex business systems into multiple independent microservices, it achieves high availability and scalability of the system. However, the complexity of the microservice architecture also brings new challenges, especially in the aspect of business application fault location. A microservice system usually consists of a large number of independent services, which cooperate with each other through complex call chains to form a huge distributed system. When a fault occurs in the system, traditional fault troubleshooting methods often have difficulty quickly and accurately locating the root cause of the fault, resulting in an extended system recovery time and affecting business continuity. Specifically, fault location in the microservice architecture faces multiple difficulties: First, the call relationships between microservices are complex and dynamically changing, and a fault in one service propagates to other services through the call chain, making it difficult to trace the fault propagation path. Second, the amount of logs, performance metrics, and call chain data generated by the microservice system is huge and diverse in type, and traditional analysis methods are difficult to effectively process and mine the fault information in these data. Finally, the manifestation forms of microservice faults are diverse and are affected by multiple factors, resulting in unclear fault characteristics and making it difficult to directly identify. Summary of the Invention

[0003] In order to solve the problems that the manifestation forms of microservice faults are diverse and it is relatively difficult to identify and locate faults, the present invention provides a microservice fault location method based on causal inference and knowledge graph, and its corresponding computer program product and computer device.

[0004] The technical solutions provided by the present invention are as follows: A microservice fault location method based on causal inference and knowledge graph, which includes the following steps: Construct a fault impact knowledge graph representing the fault impact relationship within the microservice, which is divided into three levels: a time series metric layer, an index causality layer, and a service interaction layer; Real-time capture the call chain data of the microservice system through a distributed tracing tool, record the call relationships, response times, and status codes between service nodes; and use the Prometheus monitoring system to collect multi-dimensional time series metrics of each service; dynamically update the service interaction layer according to the collected call chain data, delete the invalid edges contained therein, and obtain a service call relationship graph; use a sliding window method to sample the monitoring values of the time series metric indicators; perform error analysis on the collected data to identify and delete abnormal nodes in the time series metric layer and the index causality layer; Model the causal relationships of various nodes in the index causal layer, use partial correlation analysis to identify the pseudo-correlations between indices, generate an index dependency graph, and then use causal inference methods to construct a fault dependency graph for indices at different levels; thereby obtaining an updated fault impact knowledge graph; the edges of the fault dependency graph are used to represent the abnormal propagation paths of microservices; Import the updated fault impact knowledge graph into the Neo4j database, and then start from the abnormal service nodes and perform a random walk with restart in the fault impact knowledge graph to achieve fault location.

[0005] As a further improvement of the present invention, the methods for identifying abnormal nodes in the time series metric layer and the index causal layer are as follows: For any multi-dimensional time series index I i , use the following ARIMA model to generate its current predicted value : ; In the above formula, respectively represent the autoregressive coefficients of the first - p terms; respectively represent the moving average coefficients of the first - p terms; respectively represent the actual observed values of the multi-dimensional time series index I at the t- 1st to t-p th time steps; respectively represent the random error terms of the t- 1st to t-q th time steps; p and q represent the preset model orders.

[0006] Calculate the deviation ratio of the actual value and the predicted value for each sampling data, and then form a historical deviation data set ; n represents the number of elements in the historical deviation data set; .

[0007] Generate a cumulative distribution function based on the historical deviation data set, smooth it to obtain a continuous curve g ( z ), and calculate the curvature g ( z ) of K g ( z ):

[0008] In the above formula, z represents the independent variable characterizing the smooth curve corresponding to the cumulative distribution function.

[0009] Take g ( z ), and set the corresponding dynamic threshold with the point of the maximum curvature in it as the mutation position of the deviation distribution z 0, and make the following judgments: If the current , then determine that the corresponding multi-dimensional time series index I i is an abnormal index and remove it.

[0010] As a further improvement of the present invention, the values of the model orders p and q are determined by the following AIC function:

[0011] In the above formula, k is the total number of parameters, L is the value of the model likelihood function.

[0012] As a further improvement of the present invention, the construction method of the index dependence graph is as follows: For the i th index in any component c, use the following formula to perform Z-Score processing on it to eliminate the dimension difference: .

[0013] In the above formula, , are respectively 's mean and standard deviation, represents the value of the standardized index .

[0014] For the i-th index in any component c, select a random component l 's j th index and the u th index h in the component with a call relationship , and then use the following partial correlation algorithm to calculate the correlation between the indexes of each component :

[0015] In the above formula, is the correlation coefficient between the index and the index , For the index and the index The correlation coefficient between them For the index and the index The correlation coefficient between them

[0016] When It is determined that and There is a direct association, keep the edge between the two in the complete directed graph, otherwise the corresponding edge, and then obtain the required index dependency graph

[0017] As a further improvement of the present invention, the method for constructing a fault dependency graph is as follows For two associated indexes and in the index dependency graph, taking the index value with time delay as the independent variable, fit the following regression equation

[0018] In the above formula and Are the estimated coefficients preset for each link ; Is a time-varying error term

[0019] Combined with the dynamically adjusted Judge whether the test p-value at time t is less than 0.05. If so, it is determined that is the cause is the result, and add a directed edge in the index dependency graph, and set the edge weight to

[0020] Map the causal relationship of the indexes to specific service calls to obtain a fault dependency graph

[0021] As a further improvement of the present invention, the process of mapping the causal relationship of the indexes to specific service calls to obtain a fault dependency graph includes 1. Standardize the m index matrices associated with service S, calculate the covariance matrix, extract the eigenvalues and the corresponding eigenvectors; select the first E principal components with a cumulative contribution rate exceeding 85%

[0022] 2. Combine the call link data and map the principal components to the service call relationship graph, including If service A calls service B, and the index of A affects the index of B through the causal edge, then establish a cross-level edge in the knowledge graph and attach the attribute: {index pair: ​, Weight: }。

[0023] Thirdly, perform adaptive double-threshold alignment on subgraphs at multiple levels, and calculate the similarity and of nodes :

[0024] In the above formula, and are the neighbor node sets of nodes and respectively.

[0025] Fourthly, set a reference threshold , and calculate the dynamically adjusted offset and of nodes through the following formula:

[0026] In the above formula, and represent the orders of the nodes respectively.

[0027] Fifthly, based on the similarity between any two nodes and the preset reference threshold , make the following decisions: If , then merge the two nodes; if is in the interval, then trigger the manual review process; otherwise, retain and as independent nodes.

[0028] As a further improvement of the present invention, the process of realizing fault location through random walk includes: Define the initial transition probability from the abnormal node to the cause node which is determined by the correlation coefficient between the abnormal node and the cause node .

[0029] Calculate the value of , and generate the random walk probability from to as according to the preset rules. In the preset rules, at each step, there is a 15% probability of jumping back to the initial abnormal node to avoid the walk deviating from the key area.

[0030] After traversing the entire fault impact knowledge graph, several nodes with the highest access frequency are identified as the root causes of the fault.

[0031] As a further improvement of the present invention, the abnormal node and the cause node The correlation coefficient The calculation formula is as follows:

[0032] In the above formula, represents the covariance of the corresponding indicators of node and node ; and are respectively the standard deviations of the corresponding indicators of node and node .

[0033] The present invention also includes a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the micro-service fault location method based on causal inference and knowledge graph as described above are implemented, and then the faults in the micro-service are located according to the state data during the operation of the micro-service.

[0034] The present invention also includes a storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the micro-service fault location method based on causal inference and knowledge graph as described above are implemented, and then the faults in the micro-service are located according to the state data during the operation of the micro-service.

[0035] The present invention also includes a computer device, which includes a memory, a processor, and a computer program stored on the memory and running on the processor. When the computer program is executed by the processor, the steps of the micro-service fault location method based on causal inference and knowledge graph as described above are implemented, and then the faults in the micro-service are located according to the state data during the operation of the micro-service.

[0036] The present invention has the following beneficial effects: The micro-service fault location method based on causal inference and knowledge graph provided by the present invention can significantly improve the efficiency and accuracy of micro-service fault location through multi-source data fusion, multi-level causal relationship inference, and multi-level knowledge graph construction. In this solution, the partial correlation algorithm and the structural causal model are used to capture complex abnormal propagation paths, and the adaptive entity alignment technology is combined to dynamically adjust the alignment conditions to ensure that the fault propagation is fully reflected. Dynamic anomaly detection based on the cumulative distribution function and curvature analysis, and the anomaly threshold can be adaptively adjusted to accurately identify abnormal mutations; finally, combined with the multi-level random walk algorithm, the transfer probability is optimized using the correlation coefficient to avoid interference from low-correlation nodes and quickly locate the root cause.

[0037] In addition, the present invention combines fault location with the "index-free adjacency" feature of the Neo4j database, thereby significantly improving the computational efficiency of large-scale knowledge graphs and enhancing the system scalability. This makes the solution of the present invention superior to the prior art in terms of comprehensiveness, efficiency, accuracy, and adaptability, providing strong support for microservice fault location. Brief Description of the Drawings

[0038] Figure 1 It is a flowchart of the steps of the microservice fault location method based on causal inference and knowledge graph provided in Embodiment 1 of the present invention. Detailed Embodiment

[0039] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention belongs. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The term "or / and" used herein includes any and all combinations of one or more of the related listed items.

[0041] Embodiment 1 This embodiment provides a microservice fault location method based on causal inference and knowledge graph. This method is used to combine multi-source data during the operation of the microservice system to locate the faults that occur during the operation of the microservice, so as to assist the operation and maintenance personnel in code inspection and fault troubleshooting. The overall idea of the solution provided in this embodiment is as follows: First, collect the original call chain, multi-dimensional time series metrics, and log data of the microservice system. Analyze the correlation of microservice metrics using the partial correlation algorithm, then infer the causal relationship of metrics using the structural causal model, and then perform the principal component analysis to map the causal relationship of metrics to specific service calls to construct service dependencies. Secondly, taking the call chain and preprocessed metric data as input, define the ontology structure of the knowledge graph, extract knowledge to form triples representing the call relationships between nodes and store them in the graph. And according to the causal relationship of metrics and service dependencies, construct a fault dependency graph and fuse it with the call chain graph to form a fault dependency knowledge graph containing complete multi-level impacts. Finally, store the constructed fault dependency knowledge graph in the graph database, starting from the abnormal service node, design a dynamic anomaly degree algorithm based on the cumulative distribution function using the knowledge graph metrics to detect abnormal metrics. Randomly walk from the abnormal metrics in the graph, calculate the node access times according to the rules, comprehensively calculate the scores with multi-attribute weighting, and output the candidate set of the root cause of the fault.

[0042] Specifically, as Figure 1 shown, the microservice fault location method based on causal inference and knowledge graph provided in this embodiment includes the following steps: S1: Construct a fault impact knowledge graph representing the fault impact relationship within the microservice; the fault impact knowledge graph is divided into three levels: the time series measurement layer, the metric causal layer, and the service interaction layer. Among them, the initialized time series measurement layer and the metric causal layer are a complete directed graph with multi-dimensional time series metrics I i as nodes; the initialized service interaction layer is a complete directed graph with each component with independent functions as nodes.

[0043] S2: Real-time capture the call chain data of the microservice system through a distributed tracing tool, record the call relationships, response times, and status codes between service nodes; and use the Prometheus monitoring system to collect multi-dimensional time series metrics of each service, including: CPU utilization rate, memory occupancy rate, network throughput, request latency, and error rate. In this embodiment, when a fault occurs during the operation of the microservice, the values of the above multi-dimensional time series metrics usually change suddenly, which can provide discriminant information for fault identification.

[0044] S3: Dynamically update the service interaction layer according to the collected call chain data, delete the invalid edges contained therein, and obtain the service call relationship graph.

[0045] S4: Preset a window width , and use the sliding window method to sample the monitored values of each time series measurement metric; perform error analysis on the collected data; combine the analysis results to identify the abnormal nodes in the time series measurement layer and the metric causal layer and delete them.

[0046] In the solution of this embodiment, the method for identifying abnormal nodes is as follows: S41: For any multi-dimensional time series index I i , use the following ARIMA model to generate its current predicted value : ; In the above formula, respectively represent the autoregressive coefficients of the 1- p th terms; respectively represent the moving average coefficients of the 1- p th terms; respectively represent the multi-dimensional time series index I at the t- 1st to t-p th time steps of the actual observed values; respectively represent the t- 1st to t-q th time steps of the random error terms; p and q represent the preset model orders.

[0047] The values of the model orders p and q can be determined by the following AIC function:

[0048] In the above formula, k is the total number of parameters, L is the value of the model likelihood function.

[0049] S42: Calculate the deviation ratio between the actual value of each sampling data and the predicted value , and then form a historical deviation data set ; n represents the number of elements in the historical deviation data set; .

[0050] S43: Generate a cumulative distribution function based on the historical deviation data set, perform smoothing processing on it to obtain a continuous curve g ([[]] z ), and calculate the curvature g ([[]] z ) of K g ([[]] z ): .

[0051] In the above formula, z represents the independent variable characterizing the smoothed curve corresponding to the cumulative distribution function.

[0052] S44: Take the point with the maximum curvature in g () as the mutation position of the deviation distribution and set the corresponding dynamic threshold z 0, and make the following judgment: z If the current , then determine that the corresponding multi-dimensional time series index i I is an abnormal index and remove it.

[0053] S5: Model the index causal relationship for each node in the index causal layer. Use the partial correlation analysis method to identify the pseudo-correlation between indexes, generate an index dependency graph, and then use the causal inference method to construct a fault dependency graph for indexes at different levels; thus, obtain an updated fault impact knowledge graph. In the fault impact knowledge graph, the edges in the fault dependency graph are used to represent the abnormal propagation path of the microservice.

[0054] In this embodiment, the method for constructing the index dependency graph includes the following process: i (i) For the i th index in any component c, perform Z-Score processing on it using the following formula to eliminate the dimension difference: .

[0055] In the above formula, , are the mean and standard deviation of respectively, and represents the value of the standardized index .

[0056] (ii) For the i-th index in any component c, select the l th index j in a randomly selected component and the u th index h in the component with a call relationship, and then calculate the correlation between the indexes of each component using the following partial correlation algorithm :

[0057] In the above formula, is the correlation coefficient between the index and the index , is the correlation coefficient between the index and the index , is the index The correlation coefficient with the metric between them.

[0058] (iii)Based on the calculated correlation between the metrics , make the following decision: When , determine that and are directly related, retain the edge between the two in the complete directed graph, otherwise the corresponding edge, and thus obtain the required metric dependency graph.

[0059] In this embodiment, the method for constructing the fault dependency graph is as follows: (1)For two related metrics and in the metric dependency graph, using the metric values with a time lag as independent variables, fit the following regression equation:

[0060] In the above formula, and are the preset estimated coefficients for each link, ; is a time-varying error term.

[0061] (2)Combined with the dynamically adjusted to determine whether the test p-value at time t is less than 0.05. If so, determine that is the cause and is the effect, and add a directed edge in the metric dependency graph, and set the edge weight to .

[0062] (3)Map the causal relationship of the metrics to specific service calls to obtain the fault dependency graph. The process includes: (3.1)Standardize the m metric matrices associated with service S, calculate the covariance matrix, extract the eigenvalues and corresponding eigenvectors; select the first E principal components with a cumulative contribution rate exceeding 85%.

[0063] (3.2)Combined with the call link data, map the principal components to the service call relationship graph, including: If service A calls service B, and the metric of A affects the metric of B through the causal edge, then establish a cross-level edge in the knowledge graph and attach the attributes: {metric pair: , weight: }.

[0064] (3.3)Then perform adaptive double-threshold alignment on the subgraphs of multiple levels, calculate the node and similarity :

[0065] In the above formula, and are respectively the neighbor node sets of nodes and .

[0066] (3.4) Set a reference threshold , and calculate the dynamically adjusted offset and of nodes through the following formula :

[0067] In the above formula, and respectively represent the orders of the nodes.

[0068] (3.5) Based on the similarity between any two nodes and the preset reference threshold , make the following decisions: If , then merge the two nodes; if is in the interval, then trigger the manual review process; otherwise, retain and as independent nodes.

[0069] The aforementioned metric dependency graph and fault dependency graph can reflect the causal relationship between different metrics in each service node during the operation of microservices. Based on this, in the further optimized solution of this embodiment, in order to better represent this causality between service nodes, a Bayesian network can also be constructed in the service interaction layer, and then the joint probability distribution can be used in the Bayesian network to represent the probability relationship of all microservices in the network. There are n nodes in the Bayesian network, where Pa ( X i ) represents the set of parent nodes of node X i . According to the conditional independence assumption of the Bayesian network, the joint probability distribution of the entire network is expressed as:

[0070] Given the parent nodes of node V, node V is conditionally independent of any other node outside its parent nodes. It is expressed by the formula as:

[0071] Among them, V is a node in the Bayesian network, Pa (V) is the parent node set of node V, Q is the parent node set except V and Pa Any other set of nodes except (V).

[0072] Since the Bayesian network is constructed based on the previously inferred causal relationship of the indicators, then for the node X i , its conditional probability Determined based on the cause-effect relationship of the indicator.

[0073] S6: Import the updated fault impact knowledge graph into the Neo4j database. In the solution of this embodiment, the Neo4j database oriented to the property graph is selected for knowledge storage, mainly to improve knowledge management and computing efficiency by using its "index-free adjacency" feature. Among them, the node attributes in the updated fault impact knowledge graph include service name, component, and real-time status, and the edge attributes include causal weight, call frequency, and timestamp range.

[0074] On this basis, this embodiment starts from the abnormal service node and performs a random walk with restart in the fault impact knowledge graph to achieve fault location. In detail, the fault location process includes the following steps: (1) Define the abnormal node To the cause node The initial transition probability By abnormal node With cause node Correlation coefficient Sure.

[0075] (2) Calculated by the following formula The value of arrive The random walk probability of In the preset rules, each step jumps back to the initial abnormal node with a probability of 15% , avoid wandering away from key areas.

[0076] , In the above formula, Representation Node With Node The covariance of the corresponding indicators; and Node With Node The standard deviation of the corresponding indicator.

[0077] (3) After traversing the entire fault impact knowledge graph, several nodes that are visited most frequently are identified as the root causes of the fault.

[0078] Example 2 To better apply the microservice fault localization method based on causal inference and knowledge graph provided in Example 1, this example further provides a computer program product, a storage medium, and a corresponding computer device that can implement the above method.

[0079] Specifically, the computer program product provided in this example includes a computer program. When the computer program is executed by a processor, it implements the steps of the microservice fault localization method based on causal inference and knowledge graph as described above, and then locates faults in the microservice according to the status data during the operation of the microservice.

[0080] The storage medium provided in this example stores a computer program. When the computer program is executed by a processor, it implements the steps of the microservice fault localization method based on causal inference and knowledge graph as described above, and then locates faults in the microservice according to the status data during the operation of the microservice.

[0081] The computer device provided in this example includes a memory, a processor, and a computer program stored on the memory and running on the processor. When the computer program is executed by the processor, it implements the steps of the microservice fault localization method based on causal inference and knowledge graph as described above, and then locates faults in the microservice according to the status data during the operation of the microservice.

[0082] In the actual application process, this computer device can adopt an embedded device and be deployed in various terminal devices to support data processing and interaction. It can also be used as an independent computer device to support data processing requirements in certain scenarios. Such a non-embedded computer device can be a laptop computer, a tablet computer, a desktop computer, or a medium-to-large computer device such as a rack-mounted server, a blade server, a tower server, or a cabinet server (including an independent server or a server cluster composed of multiple servers) that can execute computer programs.

[0083] Specifically, the computer device in this embodiment includes at least, but is not limited to, a memory and a processor that can communicate with each other through a system bus. In this embodiment, the memory (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory may be an internal storage unit of the computer device, such as the hard disk or memory of the computer device. In other embodiments, the memory may also be an external storage device of the computer device, such as a plug-in hard disk equipped on the computer device, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc. Of course, the memory may also include both the internal storage unit and the external storage device of the computer device. In this embodiment, the memory is generally used to store the operating system installed on the computer device and various application software. In addition, the memory can also be used to temporarily store various types of data that have been output or will be output.

[0084] In some embodiments, the processor may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor is generally used to control the overall operation of the computer device.

[0085] Performance Test In order to verify the performance of the solution of the present invention, the technical personnel designed corresponding test experiments. In the test experiments, experimental studies were carried out respectively for three types of faults: service data loss, service response timeout, and service configuration error, aiming to accurately identify the fault nodes and the root causes of their key indicators, and finally generate a set of the top ten root cause sequences with the highest root cause probabilities.

[0086] Subsequently, the set of root cause sequences was compared with the preset fault types and the actual positions of the fault service nodes, and the effectiveness of the fault location method was verified through three evaluation indicators: accuracy, recall rate, and F1 value. The performance performance in the test experiments of the solution provided by the present invention is shown in the following table respectively: Table 1: Evaluation Results of the Effectiveness of the Solution of the Present Invention

[0087] It can be found by analyzing the experimental data in the above table: The precision rate and F1 value of the positioning result of the technical solution provided by the present invention are both higher than 0.9, which indicates that the root cause positioning method used can effectively find out the faulty service nodes and the root causes of indicators. In terms of the recall rate, since the data loss failure of microservices is affected by multiple links such as data storage and transmission, its internal influence relationship is more complicated than that of service response timeout and service configuration error failures. Therefore, the recall rate only reaches 0.879 at the lowest.

[0088] The above-described embodiments only represent one implementation manner of the present invention. The description is relatively specific and detailed, but it cannot be construed as a limitation on the scope of the invention. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present invention, several modifications and improvements can be made, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the appended claims.

Claims

1. A microservice fault localization method based on causal inference and knowledge graph, characterized in that, It includes: Construct a fault impact knowledge graph representing the fault impact relationship within microservices, which is divided into three levels: a time series metric layer, an index causality layer, and a service interaction layer; Real-time capture the call link data of the microservice system through a distributed tracing tool, and record the call relationship, response time, and status code between service nodes; And use the Prometheus monitoring system to collect multi-dimensional time series metrics of each service; dynamically update the service interaction layer according to the collected call link data, delete the invalid edges contained therein, and obtain a service call relationship graph; use the sliding window method to sample the monitoring values of the time series metric indicators; Perform error analysis on the collected data to identify and delete abnormal nodes in the time series metric layer and the index causality layer; Conduct index causality relationship modeling for each node in the index causality layer, use the partial correlation analysis method to identify the pseudo-correlation between indicators, generate an index dependency graph, and then use the causal inference method to construct a fault dependency graph for indicators at different levels; thus obtain an updated fault impact knowledge graph; the edges of the fault dependency graph are used to represent the abnormal propagation path of microservices; Import the updated fault impact knowledge graph into the Neo4j database, and then start from the abnormal service node, and perform a random walk with restart in the fault impact knowledge graph to achieve fault location.

2. The microservice fault localization method based on causal inference and knowledge graph according to claim 1, characterized in that: The method for identifying abnormal nodes in the time series metric layer and the index causality layer is as follows: For any multi-dimensional time series metric I i , its current predicted value is generated using the following ARIMA model :[[]] ； In the above formula, respectively represent the autoregressive coefficients for the 1st - p terms; respectively represent the moving average coefficients for the 1st - p terms; respectively represent the multi - dimensional time series indicators I at the t- 1st to t - p th time steps of the actual observed values; respectively represent the t- 1st to t - q th time steps of the random error terms; p and q represent the preset model orders; Calculate the actual value of each sampled data by the following formula and the predicted value to obtain the deviation ratio , thereby forming a historical deviation data set ; n denotes the number of elements in the historical deviation data set; ； Generate a cumulative distribution function based on the historical deviation dataset, smooth it to obtain a continuous curve g ( z ), and calculate g ( z ) curvature K g ( z ): ； In the above formula, z represents the independent variable of the smooth curve corresponding to the cumulative distribution function; Take g the point with the maximum curvature in z as the mutation position of the deviation distribution to set the corresponding dynamic threshold z 0, and make the following judgment: If the current , then it is determined that the corresponding multi-dimensional time series index I i is an abnormal index and it is removed.

3. The microservice fault localization method based on causal inference and knowledge graph according to claim 2, characterized in that, The values of the model orders p and q are determined by the following AIC function: ； In the above formula, k is the total number of parameters, L is the value of the model likelihood function.

4. The microservice fault localization method based on causal inference and knowledge graph according to claim 1, characterized in that, The method for constructing the index dependency graph is as follows: For the i th index in any component c, the following formula is used to perform Z-Score processing on it to eliminate the dimensional difference: ; In the above formula, , are respectively 's mean value and standard deviation, represents the value of the standardized index . For the i-th metric in any component c , select a random component l in the j -th metric and the component with a call relationship u in the h -th metric , and then calculate the correlation between the metrics of each component using the following partial correlation algorithm : ； In the above formula, is the index and the index The correlation coefficient between is the index and the index The correlation coefficient between is the index and the index The correlation coefficient between; When is determined and are directly related, retain the edge between the two in the complete directed graph; otherwise, for the corresponding edge, so as to obtain the required index dependence graph.

5. The microservice fault localization method based on causal inference and knowledge graph according to claim 4, characterized in that, The method for constructing the fault dependency graph is as follows: For two related metrics in the metric dependency graph and , using the metric value with time lag as the independent variable, the following regression equation is fitted: ； In the above formula, and are the estimated coefficients preset for each link, ; is a time-varying error term; Combined with dynamic adjustment Judge whether the test p-value at time t is less than 0.

05. If so, it is determined that is the cause, is the result, and a directed edge is added to the index dependency graph , and the edge weight is set to ; Map the causal relationship of the indicators to specific service calls to obtain a fault dependency graph.

6. The microservice fault location method based on causal inference and knowledge graph according to claim 5, wherein: The process of mapping the causal relationship of the indicators to specific service calls to obtain a fault dependency graph includes: First, standardize the m index matrices associated with service S, calculate the covariance matrix, extract the eigenvalues and corresponding eigenvectors; select the first E principal components with a cumulative contribution rate exceeding 85%; Second, combine the call link data and map the principal components to the service call relationship graph, including: If service A calls service B, and the metrics of A affect the metrics of B through causal edges , then create a cross-level edge in the knowledge graph and attach the attributes: {metric pair: , weight: }; III. Next, perform adaptive double-threshold alignment on subgraphs at multiple levels and calculate the similarity between nodes and : ​ ； In the above formula, and are respectively the neighbor node sets of nodes and ; IV. Set the reference threshold , calculate the dynamic adjustment offset of node and through the following formula : ； In the above formula, and respectively represent the order of the node; V. Based on the similarity between any two nodes and a preset reference threshold , make the following decisions: If , then merge the two nodes; if is in interval, then trigger the manual review process; otherwise, retain and as independent nodes.

7. The microservice fault location method based on causal inference and knowledge graph according to claim 1, wherein: The process of achieving fault location through random walk includes: Define the initial transition probability from the abnormal node to the cause node is determined by the correlation coefficient between the abnormal node and the cause node which is determined; Calculate the value of, and generate a random walk probability from to as . In the preset rules, at each step, there is a 15% probability of jumping back to the initial abnormal node to avoid the walk deviating from the key area; After traversing the entire fault impact knowledge graph, identify the most frequently visited several nodes as the root causes of the fault.

8. The microservice fault location method based on causal inference and knowledge graph according to claim 7, wherein: Abnormal node and the cause node correlation coefficient The calculation formula is as follows: ； In the above formula, represents the covariance of the corresponding indicators of node and node ; and are respectively the standard deviations of the corresponding indicators of node and node .

9. A computer program product, comprising a computer program, wherein: When the computer program is executed by the processor, it implements the steps of the microservice fault location method based on causal inference and knowledge graph as described in any one of claims 1 - 8, and further locates the faults in the microservice according to the status data during the operation of the microservice.

10. A computer device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein: When the computer program is executed by the processor, it implements the steps of the microservice fault location method based on causal inference and knowledge graph as described in any one of claims 1 - 8, and further locates the faults in the microservice according to the status data during the operation of the microservice.

Images