Microservice system abnormal root cause positioning method based on space-time diagram convolutional neural network and thermal diffusion model

Abstract

The invention relates to a microservice system abnormal root cause positioning method based on a space-time diagram convolutional neural network and a thermal diffusion model, and the method mainly comprises the following steps: S1, collecting the performance index data of a service node and calling metadata through Prometheus, carrying out the anomaly detection through a sliding time window mechanism, and outputting an abnormal node and a time window; s2, constructing a node cascade propagation feature vector, and obtaining an abnormal time window service call directed weighted dependency graph in combination with a GAT mechanism; s3, constructing a space-time diagram convolutional neural network, extracting space-time features of node anomalies, and depicting an anomaly cascade propagation effect by adopting a thermal diffusion mechanism to obtain space-time diffusion features; and S4, calculating an abnormal score based on the node cascade propagation characteristics and the space-time diffusion characteristics, constructing a propagation matrix by adopting PageRank, and outputting an abnormal root cause node list. According to the method, the abnormal spatial-temporal characteristics and cascade propagation effects of the micro-service nodes are modeled, so that the root cause positioning accuracy in a complex service scene is effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of service computing and intelligent operation and maintenance technology, specifically involving an unsupervised root cause localization method for microservice systems based on spatiotemporal graph convolutional neural networks (T-GCN) and heat spread models, aiming to improve the accuracy and real-time performance of fault diagnosis and root cause localization in distributed microservice architectures. Background Technology

[0002] With the widespread adoption of cloud computing, container technology, and DevOps principles, microservice architecture has gradually replaced traditional monolithic architecture, becoming the mainstream approach for building modern enterprise software systems. This architecture significantly improves system flexibility, maintainability, and fault tolerance by breaking down complex applications into multiple autonomous service units, each responsible for independent functional modules and possessing independent development, deployment, and scaling capabilities. Services interact through lightweight communication mechanisms (such as REST API, gRPC, or message queues), while containerization technologies (such as Docker) and orchestration platforms (such as Kubernetes) further simplify service deployment and scheduling processes, providing technical support for rapid system iteration and elastic scaling.

[0003] However, as microservice systems grow in scale and the number of services surges, the dependencies between services become increasingly complex, and the system's operational state exhibits highly dynamic and changeable characteristics. In this context of high coupling and dynamic interaction, the manifestations of system failures become more complex and unpredictable. Once a service instance experiences an anomaly, its impact may not be limited to that node itself but can spread cascadingly along the call chain, affecting multiple upstream and downstream service components, thus triggering a chain reaction. Due to the highly uncertain and frequently changing call paths between microservices, traditional troubleshooting methods based on static configuration or manual experience are often insufficient to meet actual operational needs.

[0004] Root cause localization has thus become one of the key issues in the operation and maintenance of microservice systems. When faced with system anomalies, the primary task for operations and maintenance personnel is to quickly and accurately identify the source service causing the failure so that timely remedial measures can be taken to prevent the problem from spreading further. However, existing root cause localization methods generally face three challenges: First, many methods rely heavily on a large number of pre-labeled historical fault samples, but in real production environments, high-quality fault labels are very scarce and it is difficult to cover all potential anomaly types; Second, some methods focus too much on the performance metric fluctuations of individual services, ignoring the propagation paths and cascading characteristics between services, resulting in a lack of system perspective and contextual reasoning ability in determining the root cause; Third, in large-scale microservice systems, there are numerous call chain paths, high data dimensionality, and frequent changes in service responses, making traditional localization algorithms computationally expensive and unable to meet the dual requirements of real-time performance and generalization ability.

[0005] Therefore, there is an urgent need for an intelligent root cause localization method that can integrate system call topology, temporal runtime status, and fault propagation mechanisms. This method should possess anomaly modeling capabilities without manual annotation, automatically capture dependency paths between services and their propagation characteristics, and accurately identify potential root cause services within the system. A fusion approach based on graph structure modeling and unsupervised learning offers a novel solution. By constructing service call graphs, mining cascading fault propagation paths, and introducing spatiotemporal modeling mechanisms, root cause localization tasks can be achieved more effectively. This invention addresses these issues by proposing an unsupervised microservice fault root cause localization method that integrates T-GCN and a heat spread model. This method overcomes the shortcomings of traditional methods in terms of data dependency, propagation modeling, and real-time performance, providing a more practical and robust fault analysis solution for microservice systems. Summary of the Invention

[0006] This invention provides a root cause localization method for microservice systems based on a spatiotemporal graph convolutional neural network (T-GCN) and a heat propagation model, aiming to solve the problems of insufficient root cause localization accuracy and inadequate modeling of cascading fault propagation in existing microservice systems. This method integrates multi-source monitoring data perception, graph neural network modeling, fault propagation behavior simulation, and random walk sorting mechanisms, achieving more efficient and interpretable root cause localization capabilities in complex service dependency structures and dynamic operating environments.

[0007] Specifically, the system first uses monitoring tools such as Prometheus to collect key performance indicator data for each node of the microservice system, including CPU utilization, memory usage, and average response time. To accurately characterize changes in service behavior, a sliding window mechanism is introduced to dynamically segment the time series. Combined with the residual sum of squares and a multi-indicator adaptive threshold algorithm, joint anomaly detection of multiple indicators is achieved. The window size is adaptively adjusted based on historical load and anomaly density to improve detection sensitivity and generalization ability.

[0008] Once an anomaly is detected, the system automatically triggers a distributed tracing tool (such as Jaeger) to obtain call chain data between services and constructs a directed graph of call dependencies within the corresponding time window. Service edge weights are modeled using multiple cascading features, including node proximity (measuring the strength of dependency between node calls), node activity (measuring the operational activity of nodes within the microservice system), and node performance metric similarity (measuring the correlation of anomalies between nodes). A graph attention mechanism (GAT) is introduced to weightedly fuse these heterogeneous features, dynamically learning the association strength of service edges, improving the accuracy of topology modeling, and enhancing sensitivity to anomaly propagation paths.

[0009] To capture the spatiotemporal characteristics of each node during anomaly events, a spatiotemporal graph convolutional neural network (T-GCN) is constructed to fuse the temporal evolution trends of service topology and performance metrics. Spatial dependency features of service nodes are extracted through graph convolution operations, and historical behavior patterns are modeled using gated recurrent units (GRUs) to form multi-dimensional node representation vectors. This structure possesses strong temporal modeling and graph structure awareness capabilities, facilitating the capture of potential system behavioral anomalies.

[0010] Furthermore, considering the cascading propagation of faults in microservice systems, a heat diffusion model is introduced to simulate the propagation of abnormal signals in order to characterize the cascading propagation behavior of faults in microservice systems. This model uses the service call topology constructed by GAT as the propagation basis. After performing multiple rounds of single-point faults on each node of the sockshop microservice, it analyzes the frequency of each node's occurrence in the fault propagation chain to obtain the node vulnerability vector. This vector, along with the spatiotemporal embedding features output by T-GCN, is used as input to perform multiple rounds of heat diffusion iterations, estimating the propagation path and intensity of the abnormal impact in the network, and obtaining the heat diffusion state of each node. This effectively integrates propagation dynamics into the problem of fault root cause localization, and the number of diffusion rounds K can be flexibly set according to network scale or real-time business requirements.

[0011] In the anomaly scoring and root cause ranking stages, node-level aggregation of node affinity and performance index similarity, combined with node activity to form cascaded features, is input into the anomaly scoring function along with the spatiotemporal diffusion vector output by heat diffusion, generating anomaly scores for each service node. To enhance the global perspective and path interpretability of root cause ranking, the system introduces the PageRank random walk algorithm based on the above anomaly scoring, ultimately outputting a list of candidate root cause nodes ranked highest by anomaly scores, serving as the basis for automatic system alerts or self-healing scheduling.

[0012] Compared with traditional methods, the present invention has the following advantages:

[0013] 1) Multi-source data fusion: It can simultaneously process heterogeneous information from multiple sources, such as indicator sequences, call chains, and topology structures, providing more comprehensive information coverage.

[0014] 2) Good modeling mechanism: Based on graph neural network and time modeling structure, it realizes the joint expression of structural dependence and temporal evolution.

[0015] 3) Cascade effect based on thermal diffusion model: The thermal diffusion model intuitively reflects the propagation path and intensity of anomalies, closely resembling the dynamic behavior of actual systems.

[0016] 4) The scoring mechanism and path ranking complement each other: Combining the anomaly scoring function with PageRank ranking makes the results more interpretable and robust.

[0017] 5) High generalization: It supports deployment on mainstream microservice platforms such as Kubernetes and Istio. The structure is pluggable and can be extended to replace modules such as GraphSAGE and Temporal GNN in the future.

[0018] In summary, the method of this invention has good accuracy, scalability and deployment flexibility, and is suitable for online fault diagnosis and root cause tracing tasks of large-scale, heterogeneous microservice systems, with broad engineering application prospects and practical value. Attached Figure Description

[0019] The present invention will be further described below with reference to the accompanying drawings and specific embodiments: Figure 1 This is a schematic diagram of a microservice anomaly detection and root cause localization process according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the construction process of a weighted dependency graph according to an embodiment of the present invention. Figure 3 This is a flowchart of the anomaly score calculation and root cause ranking in an embodiment of the present invention. Detailed Implementation

[0020] The following will refer to the appendices in the embodiments of the present invention. Figure 1The technical solutions in the embodiments of the present invention will be clearly and completely described.

[0021] This model consists of two phases: anomaly detection and root cause localization. The anomaly detection phase checks the performance metrics of each node in the microservice system, using a dynamic threshold method to determine if the performance metrics are normal. If anomalies are detected in a node's metrics, the root cause localization phase is triggered. The model extracts cascading features from trace data and extracts the spatiotemporal feature vectors of each node. By fusing cascading propagation characteristics and employing multimodal comprehensive scoring and random walks, the final root cause is located.

[0022] To facilitate understanding, the method of this invention will be explained in detail below using the SockShop microservice platform as an example. A root cause localization method for microservice systems based on spatiotemporal graph convolutional neural networks and a heat diffusion model, such as... Figure 1 As shown, the method includes:

[0023] S1: Real-time monitoring of the sock shop microservice system using Prometheus, collecting performance metrics and service topology of each service node, constructing a multi-dimensional performance metric time series dataset and service call metadata; and performing anomaly detection based on a sliding time window mechanism and a multi-metric joint analysis strategy to obtain anomaly time windows.

[0024] S11: The open-source tool Prometheus is used to monitor the key performance indicators of each service node in the microservice system in real time. The sampling frequency is set and performance indicators such as CPU utilization (recorded as the percentage of cores used per second), memory utilization (including the percentage of memory used and RSS value), and average response time are collected. At the same time, by setting performance thresholds, call tracing tools (such as Jaeger and OpenTelemetry) are triggered to obtain the call chain logs between services and extract the service topology and call metadata. The call metadata includes: (1) trace_id: a unique identifier of a complete request chain; (2) span_id: a unique number that identifies the current service call and is used to distinguish different service calls under the same trace; (3) parent_span_id: the direct upstream call of the current call; (4) service name and instance identifier; (5) call timestamp information.

[0025] S12: Using t as the sliding time window, perform a weighted moving average operation on the performance indicator time series dataset obtained in step S1, and conduct joint anomaly analysis of multiple indicators based on the residual sum of squares and a dynamic threshold mechanism to determine the time window in which anomalies occur. Specifically, the system samples at a time step t, dividing each performance indicator sequence into a sliding window of fixed length T. Each window represents the recent operating state of the node, and the multi-dimensional indicators within the window are weighted and smoothed to reduce short-term fluctuations and noise interference. Then, the joint deviation of the residuals of each indicator is calculated. The system automatically sets a dynamic threshold based on the historical deviation distribution. When a node continuously exceeds the threshold, the time window is determined to be an anomaly window, and the system enters the root cause localization stage. The specific implementation steps are as follows:

[0026] (1) Sliding time window and weighted moving average calculation

[0027] The system samples at a time step of 30 seconds, dividing each indicator sequence into a sliding window of fixed length T:

[0028] W t ={x t-T+1 ,x t-T+2 ,…,x t}

[0029] Where: x t ∈R 3 A three-dimensional index vector representing time t (CPU utilization, memory usage, average response time); T: sliding window size (10 sampling points).

[0030] To reduce the impact of short-term noise fluctuations, a weighted moving average (WMA) is used to smooth each indicator within the window. The weighted average of the k-th indicator (e.g., CPU) at time t is defined as:

[0031]

[0032] in: w represents the observed value of the k-th index at time t; i Time weights, satisfying w0>w1>…>w T-1 If the value is greater than 0, the system uses exponentially decaying weights, making the system more sensitive to the latest indicators.

[0033] w i =α i (0 < α < 1)

[0034] (2) Calculation of residual sum of squares

[0035] To simultaneously reflect the degree of anomalies in CPU, memory, and response time, the system calculates the sum of squared residuals S for these three metrics. t :

[0036]

[0037] Where: k=1: CPU utilization, k=2: memory utilization, k=3: average response time; S t The larger the value, the more severely the three performance indicators deviate from the normal trend.

[0038] (3) Dynamic threshold mechanism based on mean-standard deviation

[0039] The system uses the mean and standard deviation of historical residuals from a sliding window to construct a dynamic threshold, thereby improving its adaptability to different load stages.

[0040] Calculate the mean and standard deviation of the residuals:

[0041]

[0042] The dynamic threshold is defined as:

[0043] θ t =μ t +λ·σ t

[0044] Where λ is the adjustment factor (usually taken as 2 to 3).

[0045] (4) Abnormal window judgment rules

[0046] When the sum of squared residuals exceeds the threshold twice consecutively, the system determines that there is a joint anomaly in the current window:

[0047] If the condition is met, the window [t-T+1,t] is marked as the abnormal time window set, and the corresponding abnormal node list is finally output, triggering the root cause localization stage:

[0048]

[0049] S2: As per the instruction manual Figure 2 As shown, based on the service call metadata within the abnormal time window obtained in step S1 and the performance indicators of each node, three types of cascading propagation features, namely node affinity, node activity, and performance indicator similarity, are calculated to construct a cascading feature vector; and edge weights are calculated in conjunction with GAT to construct a directed weighted dependency graph of service calls within the abnormal time window.

[0050] S21: Based on the service call metadata within the abnormal time window obtained in step S1, and the performance indicators of each node, calculate the following respectively: (1) Node intimacy I(u,v): Count the number of calls from service node u to v, divide by the total number of calls from u to obtain the degree of call correlation between the two; (2) Node activity Act(u): Count the number of Spans corresponding to service node u, divide by the total number of traces in the entire link to measure the activity of the node in the link; (3) Node performance indicator similarity S(u,v): Calculate the correlation coefficient between nodes u and v under each indicator dimension, and then take the average of these K correlation coefficients to quantify the similarity of their performance characteristics. Among them, the three types of cascaded features are as follows:

[0051] 1) Intimacy between nodes I(u,v):

[0052]

[0053] 2) Node activity Act(u):

[0054]

[0055] 3) Performance index similarity S(u,v):

[0056]

[0057] The above features are concatenated into a concatenated feature vector of edges:

[0058] f ij =[I ij ,Act i ,Act j ,S ij ]∈R 4

[0059] S22: The graph attention mechanism GAT is used to encode and weight the propagation features of edge calls between nodes. By learning the importance score of each edge, edge weights reflecting the propagation strength are generated, forming a directed weighted dependency graph that can be represented by a weighted adjacency matrix, denoted as A∈R. M×M Where M represents the total number of nodes participating in the service call within the abnormal time window, and A i,j This indicates the propagation strength of the call from node i to node j.

[0060] Specifically, when constructing the Graph Attention (GAT) mechanism, the features fij = [Iij,Act] are directly propagated in a cascaded manner along each edge (i,j). i ,Act j ,S ij As input to the GAT, it adopts a structure similar to the standard GAT, and f ijAfter mapping to a higher-dimensional space, attention weights are calculated by concatenating the propagation features of the source and target nodes to capture the differences in importance of different propagation paths. The attention weights for each edge are calculated as follows:

[0061]

[0062] in and Let f represent the propagation characteristics of the source and target nodes on edge (i,j) respectively (which can be regarded as f). ij (Two representations).

[0063] S3: Construct a spatiotemporal graph neural network T-GCN, based on the multidimensional performance index time series data obtained in step S1 and the directed weighted dependency graph obtained in S2, to extract the spatial dependency and temporal dynamic features between service nodes and form a service node vector representation; and introduce a heat diffusion mechanism to characterize the cascading propagation effect of faults between microservices, perform K rounds of iterative propagation, and fuse the upstream and downstream influences of nodes to obtain the spatiotemporal diffusion feature vector.

[0064] S31: Construct a spatiotemporal graph neural network T-GCN, which consists of graph convolutional modules and temporal convolutional modules; input the performance index data X∈R of each node over the past N time steps. N×M×F And the graph adjacency matrix A∈R between service nodes M×M Where N is the number of time steps, M is the number of service nodes, and F is the number of performance metrics for each node; the spatiotemporal embedding features H of each service node are obtained. out This provides a foundation for subsequent anomaly identification and root cause localization.

[0065] In S31, the input performance index sequence X∈R N×M×F , representing the historical monitoring value of each node within the time window [t-T+1,t]; the service call graph adjacency matrix A∈R M×M : where a ij ≠0 indicates that node i has a calling relationship with node j.

[0066] T-GCN is based on a fusion graph structure and temporal dependencies. This network extracts the temporal trend changes of each node's indicators through 1D convolution operations and extracts the structural dependencies between nodes based on the adjacency matrix A. At each time step n, it performs a function on the node feature matrix X. n Calculate its spatial features using GCN:

[0067]

[0068] in For adjacency matrices with self-loops, H is the corresponding degree matrix. (l)Let W be the input feature of the l-th layer, σ be the ReLU nonlinear activation function, and W be the input feature of the l-th layer. (l) These are learnable weights.

[0069] Finally, T-GCN outputs the spatiotemporal embedding features H of each service node. out ∈R M×d This serves as a fundamental feature for subsequent propagation simulations.

[0070] S32: Introduce the thermal diffusion model, whose inputs include: the nodal spatiotemporal features H obtained in step S31. out Graph adjacency matrix A, node vulnerability vector V i The node vulnerability vector V i The system obtains the vulnerability value of each node by injecting multiple rounds of single-point faults into each node through chaos mesh. During each round of fault propagation, the system records the number of times each node is affected by the anomaly and generates the node vulnerability value based on the statistical results. The heat diffusion model performs K rounds of iteration and finally outputs the spatiotemporal diffusion characteristics H_diffused of each service node.

[0071] In S32, for the input features of T-GCN, where H out The service node's current state is embedded; the service dependency graph is a weighted adjacency matrix A, representing the dependencies between nodes; the node vulnerability vector is: V = [v1, v2, ..., v M ] T This indicates the susceptibility of each node to being affected by a failure.

[0072] The acquisition of the node vulnerability vector is specifically as follows: inject single-point faults into each node multiple times, record all nodes that are affected by the fault, and use the abnormal call chain data to count the number of times each node is affected by the anomaly and normalize it as the node vulnerability value.

[0073] The diffusion iteration formula is as follows:

[0074]

[0075] Among them, H (0) =H out ; represents the heat value vector after the k-th round of propagation. Let represent the normalized adjacency matrix, α∈[0,1] represent the diffusion coefficient, and diag(V) represent the diagonal matrix of vulnerability used to scale the source features. k is the number of diffusion rounds, and the final output is the spatiotemporal diffusion feature vector H of each node. diffused =H (K) .

[0076] S4: As per the instruction manual Figure 3As shown, the cascade propagation features of each service node in step S2 are aggregated at the node level and weighted and fused with the spatiotemporal diffusion feature vector obtained in step S3 to obtain the anomaly score of each service node and normalize it. Then, a propagation matrix is ​​constructed based on PageRank random walk to achieve convergence and sorting of the anomaly root cause service nodes and output a list of anomaly root cause service nodes.

[0077] S41: Since the cascading propagation features are composed of node intimacy I(u,v), node activity Act(u), and node performance similarity S(u,v), and node intimacy I(u,v) and node performance similarity S(u,v) reflect the degree of association between nodes, node-level aggregation is required to better reflect node anomalies. Therefore, the system performs statistics on the neighbor set N(i) of each service node i to obtain the three aggregated features of that node:

[0078] 1) Average node intimacy I i : Represents the average dependency strength between a node and its neighbors, defined as follows:

[0079]

[0080] 2) Node average performance index similarity S i This measures the similarity of a node to its neighboring nodes in terms of performance trends, and is defined as follows:

[0081]

[0082] 3) Node activity vector Act i This value directly inherits the node's own activity level and does not require aggregation.

[0083] Finally, the node-level cascaded feature vector C is obtained. i definition:

[0084] C i =[I i ,S i A i ]∈R 3

[0085] S42: To accurately measure the degree of anomaly of a node, the node cascade feature C from the previous step is used. i The spatiotemporal diffusion feature H_diffused obtained in step S3 is fused with the feature, where the spatiotemporal diffusion embedding vector of the i-th node is H. i ∈R d The cascade propagation feature vector is C. i =[I i ,S i A i ]∈R 3The concatenation results in the fusion vector F. i =Concat(C i H i )∈R d+3 A trainable linear transformation function is introduced for mapping and to predict node anomaly scores.

[0086] In S42, the anomaly score formula is:

[0087] α i =σ(w T F i +b)

[0088] Where: w∈R d+3 Let be the weight vector; b∈R be the bias term; σ(·) be the activation function, choosing ReLU(x)=max(0,x), and applying it to all α i Perform min-max normalization so that

[0089]

[0090] S43: Construct a propagation transition probability matrix M∈R based on node affinity I(i,j). N×N Each row represents the probability of information propagation from service node i to neighbor node j. In the PageRank iteration, the anomaly score vector... The initial influencing factor distribution is used as the basis for multiple rounds of propagation and convergence through the transition probability matrix, ultimately yielding a root cause service node ranking list.

[0091] In S43, the transition probability matrix M∈R is defined using the affinity between nodes I(i,j). N×N If j∈N(i), then:

[0092]

[0093] Where I(i,j) represents the affinity between nodes i and j, and N(i) is the set of neighboring nodes of i. Finally, a PageRank-style iterative diffusion process is adopted to propagate the anomaly's influence through multiple rounds until convergence, thereby obtaining the comprehensive influence score of each node in the anomaly propagation, and ranking the root cause nodes accordingly.

Claims

1. A method for locating the root cause of anomalies in a microservice system based on a spatiotemporal graph convolutional neural network and a heat diffusion model, comprising the following steps: S1. Real-time monitoring of the sock shop microservice system using Prometheus, collecting performance metrics and service topology of each service node, and constructing a multi-dimensional performance metric time-series dataset and service call metadata; Anomaly detection is performed based on a sliding time window mechanism and a multi-indicator joint analysis strategy to obtain anomaly time windows; S2. Based on the service call metadata within the abnormal time window obtained in step S1, and the performance indicators of each node, calculate three types of cascading propagation features, namely, node affinity, node activity, and performance indicator similarity, and construct a cascading feature vector; and combine it with GAT to calculate edge weights and construct a directed weighted dependency graph of service calls within the abnormal time window. S3. Construct a spatiotemporal graph neural network T-GCN, based on the multidimensional performance index time series data obtained in step S1 and the directed weighted dependency graph obtained in S2, to extract the spatial dependency and temporal dynamic features between service nodes and form a vector representation of service nodes. Furthermore, a heat diffusion mechanism is introduced to characterize the cascading propagation effect of faults between microservices, and K rounds of iterative propagation are performed to obtain a spatiotemporal diffusion feature vector by integrating the upstream and downstream influences of nodes. S4. Perform node-level aggregation on the cascade propagation features of each service node in step S2, and weightedly fuse them with the spatiotemporal diffusion feature vector obtained in step S3 to obtain the anomaly score of each service node and normalize it. Then, construct the propagation matrix based on PageRank random walk to achieve convergence and sorting of the anomaly root cause service nodes, and output the list of anomaly root cause service nodes.

2. The method according to claim 1, characterized in that... S1 specifically includes: S11: The open-source tool Prometheus is used to monitor the key performance indicators of each service node in the microservice system in real time. The sampling frequency is set and performance indicators such as CPU utilization (recorded as the percentage of cores used per second), memory utilization (including the percentage of memory used and RSS value), and average response time are collected. At the same time, by setting performance thresholds, call tracing tools (such as Jaeger and OpenTelemetry) are triggered to obtain the call chain logs between services and extract the service topology and call metadata. The call metadata includes: (1) trace_id: a unique identifier of a complete request chain; (2) span_id: a unique number that identifies the current service call and is used to distinguish different service calls under the same trace; (3) parent_span_id: the direct upstream call of the current call; (4) service name and instance identifier; (5) call timestamp information. S12: Using t as the sliding time window, a weighted moving average is performed on the performance index time series dataset obtained in step S1. Based on the residual sum of squares and a dynamic threshold mechanism, multi-index joint anomaly analysis is conducted to determine the time window in which anomalies occur. Specifically, the system samples at a time step t, dividing each performance index sequence into a sliding window of fixed length T. Each window represents the recent operating state of that node, and the multi-dimensional indices within the window are weighted and smoothed to reduce short-term fluctuations and noise interference. Subsequently, the joint deviation of the residuals of each index is calculated. The system automatically sets a dynamic threshold based on the historical deviation distribution. When a node continuously exceeds the threshold, the time window is determined to be an anomaly window, and the system enters the root cause localization stage.

3. The method according to claim 1, characterized in that... S2 specifically includes: S21: Based on the service call metadata within the abnormal time window obtained in step S1, and the performance indicators of each node, calculate the following respectively: (1) Node intimacy I(u,v): Count the number of calls from service node u to v, divide by the total number of calls from u, to obtain the degree of call association between the two; (2) Node activity Act(u): Count the number of Spans corresponding to service node u, divide by the total number of traces in the entire link, to measure the activity of the node in the link; (3) Node performance indicator similarity S(u,v): Calculate the correlation coefficient between nodes u and v under each indicator dimension, and then take the average of these K correlation coefficients to quantify the similarity of their performance characteristics; and construct a cascaded feature vector f. ij As shown in the following formula: f ij =[I(i,j),A(i),S(i,j)] S22: The graph attention mechanism GAT is used to encode and weight the propagation features of edge calls between nodes. By learning the importance score of each edge, edge weights reflecting the propagation strength are generated, forming a directed weighted dependency graph that can be represented by a weighted adjacency matrix, denoted as A∈R. M×M Where M represents the total number of nodes participating in the service call within the abnormal time window, and A i,j This indicates the propagation strength of the call from node i to node j.

4. The method according to claim 1, characterized in that... In S3, the details are as follows: S31: Construct a spatiotemporal graph neural network T-GCN, which consists of graph convolutional modules and temporal convolutional modules; input the performance index data X∈R of each node over the past N time steps. N×M×F And the graph adjacency matrix A∈R between service nodes M×M Where N is the number of time steps, M is the number of service nodes, and F is the number of performance metrics for each node; the spatiotemporal embedding features H of each service node are obtained. out This provides a foundation for subsequent anomaly identification and root cause localization; S32: Introduce the thermal diffusion model, whose inputs include: the nodal spatiotemporal features H obtained in step S31. out Graph adjacency matrix A, node vulnerability vector V i Where the node vulnerability vector V i The system obtains the vulnerability value of each node by injecting multiple rounds of single-point faults into each node through chaos mesh. During each round of fault propagation, the system records the number of times each node is affected by the anomaly and generates the node vulnerability value based on the statistical results. The heat diffusion model performs K rounds of iteration and finally outputs the spatiotemporal diffusion characteristics H_diffused of each service node.

5. The method according to claim 1, characterized in that, In step S4: S41: The system performs statistics on the neighbor set N(i) of each service node i to obtain three aggregate features of that node: 1) Average node intimacy I i : Represents the average dependency strength between a node and its neighbors; 2) Node average performance similarity S i : Measures the similarity of a node's performance trends with those of its neighbors; 3) Node activity A(i): Represents the frequency of a node's appearance in the call chain, and is directly inherited. Finally, the three are aggregated into a node-level concatenated feature vector C. i :C i =[I i ,S i A i ]∈R 3 S42: Cascade the node features C from the previous step. i Feature fusion is performed with the spatiotemporal diffusion feature H_diffused obtained in step S3: F i =[C i |H i For each node ∈ R, a trainable linear transformation function is introduced for mapping, and the node anomaly score is predicted, as shown in the following equation: Where w is the weight vector, b is the bias term, and σ is the ReLU activation function; Then for all a i Perform min-max normalization to obtain the standardized anomaly score vector. As the initial heat vector for subsequent PageRank propagation; S43: Construct a propagation transition probability matrix M∈R based on node affinity I(i,j). N×N Each row represents the probability of information propagation from service node i to neighbor node j. In the PageRank iteration, the anomaly score vector... The initial influencing factor distribution is used as the basis for multiple rounds of propagation and convergence through the transition probability matrix, ultimately yielding a root cause service node ranking list.

6. The method of claim 1, further comprising a verification step: injecting known types of faults into the microservice system, comparing the actual propagation path with the location results, calculating the location accuracy and false alarm rate, to evaluate the effectiveness and stability of the method.

Images