Anomaly detection data enhancement method for cloud-native microservice system monitoring

Abstract

The application provides an anomaly detection data enhancement method for cloud-native micro-service system monitoring. The method can maintain the consistency of the dependency structure between multivariate indexes and anomaly semantics, effectively solve the structure damage and semantic distortion problems caused by existing enhancement methods, and significantly improve the accuracy, robustness and generalization ability of the anomaly detection model.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an anomaly detection data enhancement method for monitoring cloud-native microservice systems. Background Technology

[0002] Cloud-native microservice architecture, as the core of modern internet infrastructure, is widely used in key areas such as finance, e-commerce, and the industrial internet. Among related technologies, system monitoring constructs a collaborative technology system encompassing perception, transmission, and analysis by collecting multi-source data such as performance metrics, call chain tracing, and log statistics. Specifically, this system relies on deep learning models to jointly model multivariate time-series data to identify abnormal patterns under complex dependencies, ensuring the stable operation of large-scale distributed systems.

[0003] However, existing multivariate indicator data augmentation methods typically apply random transformations directly to independent channels without explicitly constraining the topological dependencies and anomaly propagation semantics between variables. Because they ignore the causal relationships in service call chains, augmentation operations easily disrupt the coupling characteristics between indicators, leading to dependency drift or anomalous morphological distortions in the generated samples. This dual lack of structural and semantic support makes it difficult for downstream detection models to learn realistic fault characteristics, severely limiting the system's robustness and generalization ability in dynamic environments. Summary of the Invention

[0004] Therefore, the first objective of this invention is to propose a multi-indicator anomaly detection data enhancement method for monitoring cloud-native microservice systems.

[0005] To achieve the above objectives, a first aspect of the present invention proposes an anomaly detection data enhancement method for monitoring cloud-native microservice systems, comprising:

[0006] S1. Obtain time-series data of multivariate metrics from cloud-native microservice systems. Based on the asymmetric similarity calculation between time-dimensional feature representation and variable-dimensional feature representation, construct a dependency graph representing the direction and intensity of influence between variables. S2, Based on the dependency graph, an enhancement strategy containing transformation type and transformation intensity is generated, and multi-level enhancement processing is performed on the multivariate index time series data to obtain the enhanced index data; S3, at each level of the multi-level enhancement process, calculate the consistency loss between the dependency graph of the current level and the dependency graph of the previous level. S4. Based on the anomaly detection model, perform semantic discrimination on the enhanced indicator data. The semantic discrimination includes the identification of abnormal patterns and the quantification of the degree of abnormality. Combine the consistency loss to optimize the enhancement strategy to ensure that the enhanced samples maintain the consistency of the original abnormal semantics.

[0007] The method of this invention can maintain the consistency of dependency structure and anomaly semantics among multivariate indicators, effectively solve the problem of augmented data distortion, and significantly improve the accuracy, robustness and generalization ability of anomaly detection models.

[0008] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0009] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a method for dynamic simulation and transient safety analysis of a micro nuclear reactor system provided in this embodiment of the invention; Figure 2 This is an overall structural diagram of Sentinel provided in an embodiment of the present invention; Figure 3 This is a structural diagram of the AD-Chain provided in an embodiment of the present invention; Figure 4 The first verification diagram shows the overall performance of the model provided in this embodiment of the invention. Figure 5 The second verification diagram shows the overall performance of the model provided in this embodiment of the invention. Figure 6 The third verification diagram shows the overall performance of the model provided in this embodiment of the invention. Figure 7 An efficiency comparison chart is provided for embodiments of the present invention. Detailed Implementation

[0010] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0011] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0012] The following describes, with reference to the accompanying drawings, an anomaly detection data enhancement method for monitoring cloud-native microservice systems according to an embodiment of the present invention.

[0013] Figure 1This is a flowchart of an anomaly detection data enhancement for monitoring cloud-native microservice systems, according to an embodiment of the present invention.

[0014] like Figure 1 As shown, anomaly detection data enhancement for monitoring cloud-native microservice systems includes the following steps: S1: Obtain time-series data of multivariate metrics from cloud-native microservice systems. Based on asymmetric similarity calculation between time-dimensional feature representation and variable-dimensional feature representation, construct a dependency graph representing the direction and intensity of influence between variables.

[0015] It is understood that the multivariate metrics include at least two of the following: resource utilization metrics, performance metrics, and call chain metrics for each service instance in the cloud-native microservice system. The resource utilization metrics include at least one of CPU utilization, memory utilization, network bandwidth utilization, and disk I / O throughput. The performance metrics include at least one of request response time, queries per second (QPS), error rate, and throughput. The call chain metrics include at least one of inter-service call latency, call success rate, call chain depth, and call chain topology complexity. This step aims to address the technical challenges of complex, dynamically evolving, and clearly causal relationships among variables in the time-series data of multivariate metrics in cloud-native microservice system monitoring scenarios. By constructing a dependency graph that accurately characterizes the direction and intensity of influence between variables, reliable prior knowledge constraints are provided for subsequent structure-aware data augmentation processing. Its technological innovation lies in abandoning the traditional static dependency modeling method based on symmetric correlation measures such as Pearson correlation coefficient and Spearman rank correlation coefficient, and instead adopting an asymmetric similarity calculation mechanism based on the difference between the feature representations of the time dimension and the variable dimension, thereby effectively mining the potential causal relationship or unidirectional influence pattern between monitoring indicator variables in cloud-native microservice systems.

[0016] Specifically, this method first performs dual-dimensional feature encoding on the acquired multivariate indicator time-series data: on the one hand, a first encoder based on a temporal convolutional network or a long short-term memory network is used to extract the temporal evolution features of each monitoring indicator on the time axis, generating a time-dimensional feature representation matrix that represents the dynamic laws of time; on the other hand, a second encoder based on a multi-head self-attention mechanism or a graph convolutional network is used to extract the spatial correlation features between different monitoring indicator variable channels, generating a variable-dimensional feature representation matrix that represents the coupling mode between variables. Subsequently, asymmetric similarity calculation is performed based on the time-dimensional feature representation matrix and the variable-dimensional feature representation matrix. A difference matrix containing positive and negative numerical elements is obtained through matrix subtraction, where positive numerical elements represent the unidirectional influence strength from one variable to the next, negative numerical elements represent the unidirectional influence strength from the next variable to the previous variable, and zero numerical elements represent the absence of significant directional dependence between variables. Finally, this difference matrix is ​​used as the adjacency matrix of a directed weighted graph to construct a dependency graph with clear directionality. In this dependency graph, nodes correspond to various monitoring metrics in the cloud-native microservice system (such as CPU utilization, memory utilization, request latency, throughput, etc.). The direction of directed edges is determined by the sign of the elements in the adjacency matrix, and the weight of an edge corresponds to the absolute value of the element. This accurately quantifies the asymmetric causal impact of the CPU utilization of an upstream microservice instance on the response latency of a downstream microservice instance. As a specific implementation method, matrix multiplication and transpose-difference operations can be performed on the time-dimensional feature representation and the variable-dimensional feature representation, i.e., using the formula... To generate a directional adjacency matrix, where and Each feature is encoded in a different dimension to accurately characterize the asymmetric impact of upstream service CPU utilization on downstream service latency.

[0017] This step, by introducing an asymmetric similarity computation mechanism based on dual-dimensional feature representation to construct a dependency graph, effectively identifies and preserves the true unidirectional causal dependencies and dynamic coupling structures among multivariate monitoring metrics in cloud-native microservice systems. This avoids the loss of key structural information caused by the inability to distinguish the direction of influence in traditional symmetric correlation modeling methods. This not only provides an accurate structural constraint foundation for subsequent multi-level enhancement strategies guided by the dependency graph, preventing the destruction of the inherent logical relationships between variables due to blind random enhancement, but also significantly improves the structural authenticity and semantic consistency of the generated enhancement data under complex microservice call topologies. This enhances the anomaly detection model's ability to perceive and locate cascading fault propagation paths in microservice systems, providing reliable data support for intelligent operation and maintenance in cloud-native environments.

[0018] S2, an enhancement strategy containing transformation type and transformation intensity is generated based on the dependency graph, and multi-level enhancement processing is performed on the multivariate index time series data to obtain the enhanced index data.

[0019] It is understood that the transformation types of the enhancement strategy include translation transformation, scaling transformation, periodic perturbation transformation, and mutation injection transformation for typical abnormal patterns of cloud-native microservice systems; the multi-level enhancement processing includes two levels: variable-level enhancement and system-level enhancement. The variable-level enhancement determines the propagation path and scope of the enhancement operation in the service call chain based on the adjacency matrix of the dependency graph, while the system-level enhancement coordinates the transformation based on the global dependency structure to maintain the synchronization characteristics and coupling relationship between multi-variable indicators.

[0020] Specifically, the translation transformation is used to simulate the overall performance offset or baseline drift phenomenon at the resource pool level in cloud-native microservice systems. By applying a constant offset to the time-series data of multivariate indicators, it generates enhanced samples reflecting changes in the overall system load. The scaling transformation is used to simulate the proportional fluctuation or performance degradation of service instance resource utilization. By multiplying the time-series data of multivariate indicators by a scaling factor, it generates enhanced samples reflecting resource contention or performance bottlenecks. The periodic perturbation transformation is used to simulate the periodic changes in indicators caused by periodic business load fluctuations or timed task triggers in cloud-native microservice systems. By superimposing sine or cosine perturbation signals on the time-series data of multivariate indicators, it generates enhanced samples reflecting periodic abnormal patterns. The mutation injection transformation is used to simulate the mutation phenomenon of indicators caused by sudden failures, service avalanches, or cascading failures in microservice systems. By injecting step changes or pulse signals into a specific time window of the time-series data of multivariate indicators, it generates enhanced samples reflecting sudden abnormal events.

[0021] The variable-level enhancement specifically includes: based on the adjacency matrix of the dependency graph, identifying service call pairs or indicator variable groups with strong coupling relationships, and applying coordinated transformation operations to the corresponding multivariate indicator time-series data for the strong coupling relationships to ensure that the enhancement operations maintain local dependency consistency among variables along the propagation path of the service call link; the system-level enhancement specifically includes: based on the global topology of the dependency graph, identifying key nodes (such as highly central service instances or core monitoring indicators) and key paths (such as main call links or resource bottleneck paths) in the system, and applying coordinated transformation operations to the multivariate indicator time-series data related to the key nodes and key paths to ensure that the enhancement operations maintain the synchronization characteristics and overall coupling relationship among multivariate indicators at the system global level.

[0022] This step aims to address the technical problem of traditional data augmentation methods in cloud-native microservice system monitoring scenarios, which suffer from distorted augmentation sample structure and semantic inconsistencies due to neglecting the dependency structure between variables. Its core innovation lies in utilizing a pre-constructed dependency graph representing the direction and intensity of influence between variables as a structural prior constraint. An augmentation strategy matching typical anomaly patterns in cloud-native microservice systems is dynamically generated through a learnable decision network and executed systematically within a multi-level augmentation architecture. This ensures that augmentation operations significantly improve data diversity while strictly maintaining the true coupling relationships and causal dependencies between variables.

[0023] Specifically, the method first concatenates the dependency graph with the statistical feature vectors (including mean, variance, kurtosis, skewness, autocorrelation coefficient, and periodicity) of the multivariate index time-series data, and inputs this concatenation into a learnable decision network. The decision network employs a fully connected layer structure and outputs two independent probability distribution vectors: the first vector represents the selection probability of various transformation types such as translation, scaling, jitter, time warp, periodic perturbation, and mutation injection for typical anomaly patterns in cloud-native microservice systems; the second vector represents the continuous numerical intensity parameter corresponding to each transformation type, which is adaptively adjusted based on the coupling strength between variables in the dependency graph. Subsequently, the first probability distribution vector is sampled using the Gumbel-Softmax reparameterization technique to obtain discretized one-hot encodings of the transformation types, and the second probability distribution vector is used as a continuous transformation intensity parameter, thereby achieving end-to-end differentiable optimization of the enhancement strategy.

[0024] After obtaining the enhancement strategy, the system performs multi-level enhancement processing on the multivariate indicator time-series data: At the first level, a global transformation based on statistical features (such as global translation and global scaling) is applied to the original multivariate indicator time-series data to simulate the overall performance fluctuations at the resource pool level in a cloud-native microservice system. At the second level, based on the edge weights in the dependency graph, a collaborative transformation (such as synchronous jittering of associated variables and time distortion of coupled variables) is applied to groups of variables with strong coupling relationships to maintain the inherent logical connections between variables. At the third level, local fine-grained transformations (such as local mutation injection and periodic perturbations) are applied to key nodes identified in the dependency graph (such as monitoring indicators with high centrality) to simulate the propagation effect of local faults in a microservice system. Each level of enhancement processing can be executed serially or in parallel, and the temporal coherence and structural consistency of the enhanced data are ensured through a feature transfer mechanism between levels.

[0025] As a preferred implementation, the multi-level enhancement processing can employ a residual connection structure. This means that some original feature information is retained in the enhancement output of each level, and the enhanced features are combined with the original features through a weighted fusion mechanism. This allows for the introduction of new distributional characteristics while maximizing the preservation of key dependency features of the original data. The resulting enhanced indicator data possesses both rich diversity of anomaly patterns and strictly maintains the true dependency structure between monitoring indicator variables in the cloud-native microservice system. This step, through dependency graph-guided augmentation strategy generation and multi-level processing mechanisms, effectively solves the technical problems of traditional data augmentation methods (such as random noise injection and simple time warping) that lead to distorted augmented samples and semantic inconsistencies due to neglecting the dependency structure between variables. Its beneficial effects are: First, it can significantly expand the scale of training data while ensuring the structural authenticity and semantic consistency of the augmented indicator data in the multi-dimensional time-series space, preventing the destruction of the real coupling relationship between indicators in the microservice system due to blind transformation; Second, through deep transformation exploration of the multi-level augmentation architecture, it can generate high-quality training samples covering a wider distribution of anomaly patterns, significantly improving the downstream anomaly detection model's ability to identify complex anomaly scenarios such as cascading failures, resource bottlenecks, and service avalanches in cloud-native microservice systems; Finally, the adaptive augmentation strategy based on the dependency graph gives the generated augmented samples clear physical meaning and interpretability, providing reliable structural support for the decision-making process of the anomaly detection model, thereby comprehensively improving the model's generalization ability, robustness, and fault location accuracy in complex and dynamic cloud-native environments.

[0026] S3, at each level of the multi-level enhancement process, calculate the consistency loss between the dependency graph of the current level and the dependency graph of the previous level.

[0027] It is understandable that the consistency loss includes topological similarity loss and edge weight distribution loss. By minimizing the dependency structure drift during the constraint enhancement process, the enhanced data is ensured to maintain the causal relationship and coupling strength between the original variables in the cloud-native microservice system.

[0028] Specifically, the topological similarity loss is used to measure the structural consistency of adjacent hierarchical dependency graphs in terms of node connection patterns. Its calculation method includes: in a preferred embodiment, using a graph edit distance metric to measure the minimum editing operation cost required to transform the current hierarchical dependency graph into the previous hierarchical dependency graph, where the editing operations include node insertion, node deletion, edge insertion, and edge deletion; in another preferred embodiment, using a subgraph isomorphism metric to calculate the matching degree of two dependency graphs in local topology, and using the ratio of the number of nodes and edges in the largest common subgraph to the total number of nodes and edges as the topological similarity; in yet another preferred embodiment, using a graph kernel function to measure the similarity of two dependency graphs in a high-dimensional feature space, and using the trace or kernel norm of the graph kernel matrix as the topological similarity loss.

[0029] This step aims to address the technical challenges of progressive shifts in dependency structures and distortion of topological connectivity characteristics caused by continuous transformation operations during multi-level data augmentation in cloud-native microservice system monitoring scenarios. Its core innovation lies in introducing a layer-by-layer stability constraint mechanism based on graph structure evolution. By dynamically monitoring the structural change trajectory of the dependency graph at each level of the augmentation process, it ensures that while significantly improving data diversity, multi-level augmentation operations strictly maintain the true causal dependencies and topological connectivity characteristics between monitoring metric variables in the cloud-native microservice system.

[0030] Specifically, the method performs the following operations at each level of the multi-level enhancement process: First, based on the enhanced multivariate index time-series data of the current level, the dependency graph of the current level is reconstructed using the same asymmetric similarity calculation mechanism as in step S1. This dependency graph represents the direction and intensity of influence between variables in the current level data in the form of a directed weighted adjacency matrix. Subsequently, the dependency graph of the current level is structurally compared with the dependency graph of the previous level, and the consistency loss between the two is calculated. The consistency loss function can adopt various measurement methods: In a preferred embodiment, the Frobenius norm is used to measure the Euclidean distance between two adjacency matrices, that is, the Frobenius norm of the matrix difference is used as the consistency loss; in another preferred embodiment, the KL divergence is used to measure the difference between the probability distributions represented by the two adjacency matrices, that is, the KL divergence is calculated after the adjacency matrix is ​​normalized to a row random matrix and then used as the consistency loss; in yet another preferred embodiment, the graph edit distance is used to measure the structural difference between the two dependency graphs in the node connection pattern, and the minimum edit operation cost required to transform one graph into another is calculated as the consistency loss.

[0031] As a specific implementation method, it can be defined Figure 1 The consistency loss is the norm squared of the difference between the dependency matrices of adjacent levels, i.e. The total dependency loss is calculated cumulatively across all enhancement levels. This serves as a constraint to guide the updating of enhancement parameters.

[0032] By incorporating the consistency loss into the overall optimization objective function and weighting it together with other loss terms such as reconstruction loss and classification loss generated by the enhancement strategy, a multi-objective optimization framework is formed. This framework forces the learnable decision network to consider not only the improvement of data diversity when dynamically adjusting the transformation type and intensity, but also to strictly constrain the evolution trajectory of the dependency structure. This effectively suppresses the cumulative drift phenomenon of the dependency graph during multi-level enhancement, ensuring that the generated enhancement samples maintain structural isomorphism with the coupling rules of the original cloud-native microservice system in the high-dimensional temporal space.

[0033] As a preferred implementation, the consistency loss calculation can adopt a sliding window mechanism, that is, not only calculating the consistency loss between the current level and the previous level, but also calculating the consistency loss between the current level and the previous K levels (K≥2K≥2), and performing a weighted average of the consistency losses between multiple levels, thereby establishing a longer-term structural evolution monitoring mechanism and further enhancing the constraint on structural stability.

[0034] This step effectively solves the technical problems of progressive distortion of dependencies and destruction of topological connectivity caused by the lack of structural monitoring in traditional multi-level data augmentation methods by explicitly introducing a mechanism for constraining the consistency of inter-level dependency structures. Its beneficial effects are as follows: First, it significantly reduces the risk of cumulative shift in dependency structure caused by the superposition of transformation operations, ensuring the structural authenticity and topological consistency of augmented data under the complex coupling relationship of cloud-native microservice systems. Second, through the collaborative constraints of a multi-objective optimization framework, the augmentation strategy can achieve an optimal balance between improving data diversity and maintaining structural stability, generating high-quality training samples that possess rich anomaly patterns while strictly maintaining the original dependency characteristics. Third, the stability constraint mechanism based on graph structure evolution enhances the interpretability and controllability of the data augmentation process, ensuring that each level of augmentation operation has a clear structural preservation objective, avoiding invalid or harmful augmentation operations from damaging key business semantic associations and causal dependencies in cloud-native microservice systems. Finally, this mechanism significantly improves the structural perception capability and robustness of downstream anomaly detection models for multi-dimensional association features, enabling them to more accurately identify the propagation path and impact range of cascading failures in cloud-native microservice systems, providing reliable data support for intelligent operation and maintenance decisions.

[0035] S4. Based on the anomaly detection model, perform semantic discrimination on the enhanced indicator data. The semantic discrimination includes the identification of abnormal patterns and the quantification of the degree of abnormality. Combine the consistency loss to optimize the enhancement strategy to ensure that the enhanced samples maintain the consistency of the original abnormal semantics.

[0036] It is understood that the anomaly detection model includes an anomaly detection network based on deep learning, including but not limited to reconstruction error detectors based on autoencoders, boundary detectors based on deep support vector data description (Deep SVDD), topological anomaly detectors based on graph neural networks (GNN), temporal anomaly detectors based on long short-term memory networks (LSTM), and anomaly detectors based on Transformer attention mechanisms. The anomaly detection model is used to calculate the consistency loss of data before and after enhancement in the anomaly semantic space. The anomaly semantic space includes feature vectors of typical anomaly types and anomaly strength feature vectors in cloud-native microservice systems. The typical anomaly types include sudden increases in metrics, sudden decreases in metrics, periodic instability, service avalanche, and link interruption.

[0037] Specifically, the anomaly semantic space consists of two orthogonal subspaces: an anomaly type feature subspace and an anomaly intensity feature subspace. The anomaly type feature subspace is used to characterize the discriminative features of different anomaly patterns in the cloud-native microservice system. Its feature vector dimension corresponds to the number of typical anomaly types, and the activation level of each dimension reflects the confidence level of the corresponding anomaly type. The anomaly intensity feature subspace is used to quantify the severity of anomaly events. Its feature vector dimension corresponds to the number of anomaly intensity levels, and the activation level of each dimension reflects the confidence level of the corresponding intensity level.

[0038] The specific characteristics of the typical anomaly types are as follows: Sudden spike in metrics: This refers to a sudden surge in monitoring metrics caused by a sudden increase in resource demand or service call peaks in a cloud-native microservice system. Typical characteristics include: resource metrics such as CPU utilization, memory utilization, and network bandwidth rising sharply by more than 300% above the normal baseline within a short period of time (e.g., 1-5 minutes), significantly extended request response time, and abnormal fluctuations in service call QPS. This type of anomaly is commonly seen in scenarios such as sudden traffic surges, malicious attacks, and concentrated triggering of scheduled tasks.

[0039] Sudden Drop in Metrics: This refers to a sudden drop in monitoring metrics caused by abnormal termination of service instances, resource release, or failure of monitoring probes in cloud-native microservice systems. Typical characteristics include: resource metrics such as CPU utilization, memory utilization, and network bandwidth dropping sharply to near zero or below 10% of the baseline level within a short period of time (e.g., 1-3 minutes); request response time returning to zero or showing null values; and a sharp drop in service call QPS. This type of anomaly is commonly seen in scenarios such as service instance crashes, abnormal container exits, and node failures.

[0040] Periodic instability: This refers to the disruption of the periodic patterns of monitoring metrics caused by periodic business loads or abnormal execution of scheduled tasks in cloud-native microservice systems. Typical characteristics include: changes in periodic length, abnormal amplitude, phase shift, or disappearance of the periodicity of metrics that originally exhibited stable periodic fluctuations (such as CPU utilization triggered by scheduled tasks and QPS of periodic business requests). This type of anomaly is commonly seen in scenarios such as incorrect configuration of scheduled tasks, abnormal business scheduling, and periodic task delays caused by resource contention.

[0041] Service avalanche: Characterizes the cascading failure propagation phenomenon caused by a single service failure in a cloud-native microservice system. Its typical characteristics include: downstream dependent services of the failed service successively experience a surge in response time, a spike in error rate, and abnormal resource utilization. The failure spreads exponentially along the service call chain, eventually leading to the paralysis of the entire microservice cluster or business chain. This type of anomaly is common in scenarios such as improper service timeout configuration, circuit breaker failure, and resource pool exhaustion.

[0042] Link interruption: This describes the communication interruption phenomenon in cloud-native microservice systems caused by network failures, service instance anomalies, or configuration errors in the inter-service call chain. Typical characteristics include: service call latency increasing indefinitely or timeout errors occurring, breakpoints appearing in the call chain topology, sudden disappearance of the coupling relationship between upstream and downstream services, and a sharp drop in the weight of the corresponding edge in the dependency graph to near zero. This anomaly type is commonly seen in scenarios such as network partitions, service registry failures, and load balancer configuration errors.

[0043] This step aims to address the technical challenges in data augmentation within cloud-native microservice system monitoring scenarios. These challenges include semantic distortion and the weakening or elimination of key fault features due to transformation operations, leading to misjudgments and missed detections by downstream anomaly detection models. Its core innovation lies in constructing a semantic consistency constraint mechanism based on adversarial learning and multi-objective optimization. By using the anomaly detection model as a differentiable semantic discriminator, it establishes a mapping relationship between augmented and original samples in the anomaly semantic space, transforming semantic fidelity into an optimizable mathematical objective to achieve adaptive optimization of the augmentation strategy.

[0044] Specifically, this method employs a two-stage semantic discrimination mechanism: In the first stage, the enhanced indicator data is input into a pre-trained anomaly detection model, which can be an autoencoder-based reconstruction error detector, a boundary detector based on deep support vector data description, or a graph neural network-based topological anomaly detector. The anomaly detection model performs feature mapping on the enhanced indicator data and outputs anomaly score vectors, where each element corresponds to a quantified value of the anomaly degree at a time step. In the second stage, semantic consistency loss is calculated based on the anomaly score vectors and the anomaly score vectors of the original multivariate indicator time-series data. The semantic consistency loss can be measured in various ways: In a preferred embodiment, cosine similarity is used to measure the directional consistency of the anomaly score vectors before and after enhancement, i.e., the cosine similarity between the two vectors is calculated as the negative value of the semantic consistency loss; In another preferred embodiment, dynamic time warping distance is used to measure the alignment of the anomaly score sequences before and after enhancement in the time dimension, and the cumulative distance under the optimal time warping path is calculated as the semantic consistency loss; In yet another preferred embodiment, adversarial discrimination loss is used, i.e., a binary classifier is trained to distinguish the anomaly score distributions of the enhanced samples and the original samples, and the cross-entropy loss of the discriminator is used as the semantic consistency loss.

[0045] As a specific implementation, the system can generate pseudo-labels for each augmented sample or output semantic embeddings through a downstream detection model, and use the cross-entropy loss function to constrain the prediction consistency of samples before and after augmentation. Its calculation expression is as follows: ,in and These represent the model predictions for the original samples and the augmented samples, respectively. This loss term is then incorporated into the total loss function. China participated in the joint optimization.

[0046] As a preferred implementation, the semantic discrimination process can adopt a course learning strategy, that is, in the early stage of training, the focus is on the consistency between the enhanced sample and the original sample in the overall abnormality score distribution, and in the later stage of training, it is gradually refined to the alignment of abnormal patterns within local time windows, thereby achieving a progressive semantic consistency constraint from coarse-grained to fine-grained.

[0047] This step effectively solves the technical problems of semantic distortion of anomalies and destruction of key fault features caused by the lack of semantic monitoring in traditional data augmentation methods by introducing a semantic discrimination mechanism based on anomaly detection models and a joint optimization framework. Its beneficial effects are as follows: First, it significantly reduces the risk of anomalous semantic drift caused by over-enhancement, ensuring that the generated enhanced samples can truly reflect the essential characteristics of various anomalous behavior patterns (such as resource exhaustion, service avalanche, cascading failures, etc.) in cloud-native microservice systems. Second, through a multi-objective joint optimization mechanism, the enhancement strategy can achieve an optimal balance between improving data diversity, maintaining structural stability, and maintaining semantic consistency, generating high-quality training samples that have both rich anomalous variants and strictly maintain the original fault characteristics. Third, the semantic consistency constraint mechanism based on adversarial learning enhances the adaptability and robustness of the data enhancement process, enabling the enhancement strategy to dynamically adjust the transformation intensity and type according to different types of anomalous patterns, avoiding excessive perturbation of key anomalous features. Finally, this mechanism significantly improves the recognition accuracy and localization capability of downstream anomaly detection models for complex anomaly scenarios in cloud-native microservice systems, effectively reducing false positive and false negative rates, and providing more reliable data support and decision-making basis for intelligent operation and maintenance systems.

[0048] Example 2 This embodiment provides a detailed description of the complete implementation of a multi-metric anomaly detection data augmentation method for monitoring cloud-native microservice systems. This method aims to address the problems of existing technologies that neglect service call chain dependencies, fail to maintain anomaly propagation semantics, and lack adaptability in augmentation strategies when handling multivariate metrics in cloud-native environments. Its Sentinel overall structure and AD-Chain structure are as follows: Figure 2 and Figure 3 As shown: In this embodiment, the system's input data consists of multivariate time-series data generated during the operation of the cloud-native microservice system. This data specifically includes service-level performance metrics (such as CPU utilization and memory utilization), request latency, call chain tracing information, and log statistical characteristics. Because service instances in a microservice architecture have loosely coupled but logically tightly coupled call relationships, anomalies often exhibit cascading propagation characteristics; that is, a performance degradation in an upstream service can lead to increased latency or a higher failure rate in downstream services. Therefore, this embodiment first preprocesses the acquired multivariate time-series data, organizing it into time steps with a time step of [missing information]. The number of variable channels is The matrix form serves as the baseline input for subsequent dependency mining and enhancement processing.

[0049] The core starting step in this embodiment is to construct a dependency graph that characterizes the direction and intensity of influence between variables. This process is performed by the Multivariate Dependency Mining (MDM) module.

[0050] Specifically, the system performs time-dimensional encoding and variable-dimensional encoding on the input multivariate index time-series data. In one possible implementation, a first encoder network is used to extract the temporal evolution features of the data along the time axis, generating a time-dimensional feature representation matrix containing time-step information. Simultaneously, the second encoder network is used to extract spatial correlation features between different variable channels, generating a variable dimension feature representation matrix containing coupling information between variables. The first and second encoder networks can employ a multilayer perceptron structure or a convolutional neural network structure with shared weights to ensure that the two feature representations reside in the same feature space. Subsequently, the system generates a dependency graph based on the asymmetric similarity between the time-dimensional feature representations and the variable-dimensional feature representations.

[0051] The specific calculation process is as follows: Represent the time dimension features as a matrix. With variable dimension feature representation matrix The first similarity matrix is ​​obtained by performing matrix multiplication on the transpose of the matrix, and the variable dimension feature representation matrix is ​​then used. With time dimension feature representation matrix The transpose of the matrix is ​​used to perform matrix multiplication to obtain the second similarity matrix. The asymmetric similarity matrix is ​​then calculated based on the difference between the first and second similarity matrices. This matrix is ​​then used directly as a dependency graph. The calculation formula is as follows:

[0052] in, Representing a dependency graph, The matrix represents the features in the time dimension. The matrix represents the dimensional features of the variables. The difference matrix obtained through matrix subtraction contains positive and negative elements. Positive elements represent the strength of the unidirectional influence from one variable to the next, negative elements represent the strength of the unidirectional influence from the next variable to the previous variable, and zero elements represent the absence of a significant directional dependency between variables. This asymmetric modeling approach can explicitly distinguish between the causal relationship of "variable A affects variable B" and "variable B affects variable A," such as distinguishing whether increased network traffic leads to increased CPU utilization or a CPU bottleneck leads to decreased network throughput, thus providing accurate structural prior knowledge for subsequent enhancement strategies.

[0053] After obtaining the dependency graph, this embodiment generates an enhancement strategy containing transformation type and transformation intensity based on the graph, and performs multi-level enhancement processing on the multivariate index time series data. Specifically, the system concatenates the generated dependency graph with the statistical feature vectors (such as mean, variance, skewness, etc.) of the multivariate index time series data, and inputs this concatenation into a learnable decision network. This decision network contains fully connected layers, used to dynamically output the probability distribution of transformation type selection and transformation intensity parameters for each variable in the multivariate index time series data.

[0054] Specifically, the fully connected layer outputs two independent probability distribution vectors: the first probability distribution vector represents the selection probability of various transformation types such as translation, scaling, jitter, and time warp; the second probability distribution vector represents the continuous numerical intensity parameter corresponding to each transformation type. To achieve end-to-end differentiable optimization of the enhancement strategy, this embodiment uses the Gumbel-Softmax reparameterization technique to sample the first probability distribution vector, obtaining a discretized one-hot encoding of the transformation type, and uses the second probability distribution vector as a continuous transformation intensity parameter. Based on the specific transformation operation type and intensity parameter determined by sampling, the system performs transformation operations on the multivariate index time series data. For example, if the sampling result is "scaling" and the intensity is 1.2, then based on the coupling strength between variables in the dependency graph, co-scaling is applied to strongly correlated variable groups to avoid disrupting the intrinsic dependency structure between variables. The transformed data serves as the input data for the next level of enhancement processing until a preset number of layers (e.g., ...) is completed. The data is processed through multiple layers (layers), and the data output from the last layer is the enhanced indicator data.

[0055] To prevent dependency drift during multi-level enhancement, this embodiment introduces an Augmentation Dependency Chain (AD-Chain) mechanism. At each level of the multi-level enhancement process, the system needs to calculate the consistency loss between the dependency graph of the current level and the dependency graph of the previous level.

[0056] Specifically, in the first After layer enhancement processing, the dependency graph of the current layer is recalculated based on the enhanced data output from the current layer. This process reuses the aforementioned asymmetric similarity calculation formula, namely, extracting the temporal dimension feature representation and variable dimension feature representation of the current level of augmented data, and substituting them into the formula. Perform real-time calculations and assign the results to Simultaneously, the system obtains the dependency graph corresponding to the enhanced data output from the previous level. Next, the dependency graph for the current level is calculated. Dependency graph with the previous level The squared Euclidean distance between them is used as the result for the current level. Figure 1 Sexual damage The calculation formula is as follows:

[0057] The system performs enhancement processing on all levels. Figure 1 The consistency losses are summed to obtain the total dependency loss used for the drift of dependent structures during the constraint enhancement process. The calculation formula is as follows:

[0058] in This represents the total number of levels in the enhancement process, where $D^l$ represents the level of the first level. The data is augmented at each layer. By minimizing this loss, we ensure that the augmentation operation increases data diversity without disrupting key dependency patterns between variables, and forms a monitorable "structural evolution trajectory".

[0059] In addition to structural consistency, this embodiment also ensures that the augmented data maintains semantic consistency with the original data in terms of anomaly detection through a semantic consistency constraint module (SCR). Specifically, the system inputs the original multivariate time-series index data into a pre-trained anomaly detection model (such as Autoformer, KAN-AD, or TimesNet) to obtain the anomaly semantic prediction results of the original data. The results include the probability distributions of normal and abnormal classes. Simultaneously, the enhanced indicator data is input into the same anomaly detection model to obtain the anomaly semantic prediction results for the enhanced data. The system calculates the anomaly semantic prediction results from the raw data. Anomaly semantic prediction results with augmented data The cross-entropy between them is used as the consistency loss. The calculation formula is as follows:

[0060] This constraint mechanism can effectively prevent semantic drift in augmented samples, ensuring that key anomalous patterns such as sudden increases, sudden decreases, and periodic instability are not weakened, smoothed, or eliminated during the augmentation process, thereby avoiding misleading downstream detection models.

[0061] The overall training and optimization process in this embodiment adopts an end-to-end joint optimization strategy. The system constructs a total loss function that includes downstream task loss, dependency structure drift constraint loss, and anomalous semantic consistency loss. The downstream task loss... This represents the reconstruction error or classification error of the anomaly detection model on the enhanced indicator data. The total loss function is expressed as:

[0062] in This indicates losses in downstream tasks. This indicates a loss dependent on structural drift constraints. This represents the loss of semantic consistency due to anomalies. and These are the coefficients that balance the weights of each loss term. During training, the system uses backpropagation based on the total loss function to alternately update the network parameters of the augmentation strategy and the model parameters of the anomaly detection model until the total loss function converges. This process enables the augmentation strategy to adaptively adjust the transformation type, intensity, and probability distribution for different dataset features and downstream model architectures, achieving co-evolution of the augmentation space and the task objective.

[0063] The method described in this embodiment demonstrates significant technical advantages in practical applications. First, by dynamically constructing an asymmetric dependency graph through a multivariate dependency mining module, this method effectively maintains the complex variable coupling relationships in cloud-native microservice systems, avoiding the structural damage caused by traditional independent channel enhancement. Second, the enhanced dependency chain mechanism utilizes multi-level... Figure 1 The consistency loss constraint effectively prevents dependency drift caused by deep augmentation, ensuring the structural authenticity of the generated data. Furthermore, the semantic consistency constraint module utilizes cross-entropy regularization to guarantee the fidelity of augmented samples in anomaly detection semantics, significantly reducing false positive and false negative rates. Finally, this method features a lightweight and efficient modular design; the dependency mining module relies on only two layers of encoding and matrix operations, resulting in low computational complexity. Under different channel counts (e.g., 10 to 100 channels), it adds only a minimal amount of computation time (approximately 0.01 seconds), and the computational complexity increases sublinearly with the number of channels, making it suitable for real-time deployment in large-scale industrial multi-channel time-series monitoring systems. Experimental results show that this method achieves superior F1-Scores compared to baseline methods on multiple public datasets such as MSL, PSM, SMAP, SMD, and SWAT, combined with downstream models of different architectures such as Autoformer, KAN-AD, and TimesNet, demonstrating its outstanding performance in improving the robustness, generalization ability, and stability of anomaly detection models.

[0064] Furthermore, 1. Overall Model Performance: To verify the universality and effectiveness of the proposed Sentinel framework, experiments were conducted on three multivariate anomaly detection models (Autoformer, KAN-AD, and TimesNet). The results are as follows: Figure 4 , Figure 5 ,and Figure 6 As shown. It can be observed that: (1) Overall performance is significantly better than the baseline method: On five public datasets (MSL, PSM, SMAP, SMD, SWAT), Sentinel achieved the highest or second highest F1 score among all models, which shows that Sentinel can maintain stable gains under different model architectures and data characteristics.

[0065] (2) It has good versatility for different model types: Sentinel can improve the performance of Transformer-based Autoformer, CNN-based TimesNet, and KAN-based KAN-AD. This shows that the method is outstanding in terms of model independence and is applicable to different types of time-series downstream models.

[0066] (3) Robust on complex system datasets: Especially on industrial and network system datasets such as SMD and SWAT, Sentinel significantly alleviates the performance fluctuation problem caused by traditional augmentation methods, with a particularly noticeable improvement in F1-score.

[0067] 2. Module Contribution Analysis: To verify the contribution of each key module in the Sentinel framework to the overall performance, this invention conducted ablation experiments. The experiments were conducted on five public datasets (MSL, PSM, SMAP, SMD, SWAT) and three downstream models (Autoformer, KAN-AD, TimesNet), with three core components removed for comparison. (1) Removing the MDM module: In this setting, the enhancement strategy is executed independently across each variable channel, no longer guided by multivariate dependencies. Results show a significant decrease in model performance: on Autoformer, performance drops by 2.78% on the MSL dataset and 5.07% on the SMD dataset; on KAN-AD, performance drops by 4.88% on the SMD dataset and 3.37% on the SMAP dataset; and on TimesNet, performance drops by 6.22% on the MSL dataset and 3.04% on the PSM dataset. This demonstrates the crucial role of the MDM module in capturing inter-variable dependencies and maintaining structural consistency.

[0068] (2) Removing the AD-Chain module: In this setting, the structural constraints between augmentation layers are removed, allowing augmentations of different layers to proceed independently, and dependencies gradually shift across multiple augmentation layers. Results show that on Autoformer, MSL, PSM, and SWAT decrease by an average of 3.3%; on KAN-AD, the SMD dataset decreases by 3.86%; and on TimesNet, the MSL dataset decreases by 7.82%, one of the largest overall decreases. This demonstrates that AD-Chain effectively prevents dependency shifts, maintains structural stability across multiple augmentation layers, and is a key module for ensuring the consistency of augmented data.

[0069] (3) Removal of Semantic Consistency Constraints: After removing the SCR module, the augmented samples no longer maintain semantic alignment with the original samples, and the anomaly discrimination features are prone to shift. The results show that in the Autoformer model, the F1-score on the SMD dataset decreased by 0.76%; on KAN-AD, the SMAP dataset decreased by 3.20%, and the SMD dataset decreased by 4.94%; on TimesNet, the SWAT dataset decreased by 2.78%, and the MSL dataset decreased by 7.74%. This demonstrates that semantic constraints play a crucial role in maintaining anomaly semantic consistency and avoiding semantic drift. See Tables 1, 2, and 3 for details. Table 1

[0070] Table 2

[0071] Table 3

[0072] 3. Model Efficiency and System Deployability: Experiments have verified that the Multivariate Dependency Mining (MDM) module designed in this invention maintains strong dependency modeling capabilities while incurring extremely low computational overhead, exhibiting good operational efficiency and system scalability. In experiments using the MSL dataset and the KAN-AD model, the single-iteration runtime was tested under different numbers of channels (10–100). Figure 7 The results show that: (1) Under all channel settings, introducing the MDM module only increases the computation time by about 0.01 seconds; (2) When the number of channels increases to 100, the running time is still basically the same as the model without the MDM module; (3) The overall computational complexity of the module increases sublinearly with the number of channels and tends to stabilize when the number of channels exceeds 50.

[0073] These results clearly demonstrate that this invention achieves multivariate dependency modeling and structure preservation while minimizing computational burden and achieving high operational efficiency, enabling real-time deployment in industrial-grade multi-channel time-series monitoring systems. Compared to traditional dependency modeling methods, this invention significantly reduces additional computational resource consumption and is applicable to various scenarios such as cloud platforms, edge devices, and online anomaly detection systems, showcasing its engineering advantages of lightweight design, scalability, and ease of integration.

[0074] The anomaly detection data augmentation method for monitoring cloud-native microservice systems presented in this invention maintains the consistency of dependency structure and anomaly semantics among multivariate indicators, effectively solving the structural damage and semantic distortion problems caused by existing augmentation methods, and significantly improving the accuracy, robustness, and generalization ability of the anomaly detection model. It is applicable to various complex scenarios such as network service monitoring, industrial IoT, and financial monitoring.

[0075] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0076] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0077] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for anomaly detection data enhancement for monitoring cloud-native microservice systems, characterized in that, include: Obtain time-series data of multivariate metrics from cloud-native microservice systems, and construct a dependency graph representing the direction and intensity of influence between variables based on asymmetric similarity calculation between time-dimensional feature representation and variable-dimensional feature representation; An enhancement strategy containing transformation type and transformation intensity is generated based on the dependency graph, and multi-level enhancement processing is performed on the multivariate index time series data to obtain the enhanced index data. At each level of the multi-level enhancement process, the consistency loss between the dependency graph of the current level and the dependency graph of the previous level is calculated. The enhanced indicator data is semantically discriminated based on the anomaly detection model. The semantic discrimination includes the identification of abnormal patterns and the quantification of the degree of abnormality. The enhancement strategy is optimized in conjunction with the consistency loss to ensure that the enhanced samples maintain the consistency of the original abnormal semantics.

2. The method as described in claim 1, characterized in that, in, The multivariate metrics include at least two of the following: CPU utilization, memory utilization, network bandwidth, disk I / O, request response time, and service call chain latency of the service instance. The enhancement strategy includes transformation types such as translation transformation, scaling transformation, periodic perturbation transformation and mutation injection transformation for typical abnormal modes of cloud-native microservice systems. The multi-level enhancement processing includes variable-level enhancement and system-level enhancement. Variable-level enhancement determines the propagation path of enhancement operations in the service call chain based on the adjacency matrix of the dependency graph. System-level enhancement coordinates the transformation based on the global dependency structure to maintain the synchronization characteristics and coupling relationship between multi-variable indicators. The consistency loss includes topological similarity loss and edge weight distribution loss. By minimizing the consistency loss constraint during the enhancement process, it is ensured that the enhanced data maintains the causal relationship and coupling strength between the original variables in the cloud-native microservice system. The anomaly detection model includes a deep learning-based anomaly detection network, which calculates the consistency loss of data before and after enhancement in the anomaly semantic space. The anomaly semantic space includes feature vectors of typical anomaly types and anomaly intensity feature vectors in cloud-native microservice systems. The typical anomaly types include sudden increase in indicators, sudden decrease in indicators, periodic instability, service avalanche, and link interruption.

3. The method as described in claim 1, characterized in that, The asymmetric similarity calculation based on time-dimensional feature representation and variable-dimensional feature representation constructs a dependency graph representing the direction and intensity of influence between variables, including: The time series data of the multivariate indicators are encoded in both the time dimension and the variable dimension to generate a time dimension feature representation matrix and a variable dimension feature representation matrix. The first similarity matrix is ​​obtained by performing matrix multiplication on the transpose of the time dimension feature representation matrix and the variable dimension feature representation matrix, and the second similarity matrix is ​​obtained by performing matrix multiplication on the transpose of the variable dimension feature representation matrix and the time dimension feature representation matrix. An asymmetric similarity matrix is ​​calculated based on the difference between the first similarity matrix and the second similarity matrix, and this asymmetric similarity matrix is ​​used as the dependency graph. The formula for calculating the asymmetric similarity matrix is ​​as follows: ,in This represents the dependency graph. This represents the time-dimensional feature representation matrix. The variable dimension feature representation matrix represents the variable.

4. The method as described in claim 1, characterized in that, The enhancement strategy, which includes transformation type and transformation intensity, is generated based on the dependency graph, and multi-level enhancement processing is performed on the multivariate index time series data to obtain the enhanced index data, including: The dependency graph is used as prior knowledge and input into a learnable decision network. The learnable decision network includes a policy generator based on a graph neural network. The learnable decision network dynamically outputs the probability distribution of transformation type selection and transformation intensity parameters for each variable in the multivariate index time series data. The probability distribution of transformation type selection includes the selection probability of translation transformation, scaling transformation, periodic perturbation transformation and mutation injection transformation for typical anomaly patterns of cloud-native microservice systems. Based on the transformation type, the probability distribution sampling is selected to determine the specific transformation operation type of the current level, and based on the transformation intensity parameter, the specific transformation operation intensity of the current level is determined. The transformation intensity parameter is adaptively adjusted according to the weight of the edge in the dependency graph. Based on the determined specific transformation operation type and intensity, the transformation operation is performed on the multivariate index time series data, and the transformed data is used as the input data for the next level of enhancement processing, until the preset number of multi-level enhancement processing is completed, and the data output from the last level is used as the enhanced index data; the number of multi-level enhancement processing is dynamically determined according to the complexity of the cloud-native microservice system.

5. The method as described in claim 3, characterized in that, The calculation of the asymmetric similarity matrix based on the difference between the first similarity matrix and the second similarity matrix includes: The first similarity matrix is ​​subtracted from the second similarity matrix using matrix subtraction to obtain a difference matrix containing positive and negative numerical elements. Positive numerical elements represent the strength of the unidirectional influence from one variable to the next, negative numerical elements represent the strength of the unidirectional influence from the next variable to the previous variable, and zero numerical elements represent the absence of a significant directional dependency between variables. The first similarity matrix is ​​calculated based on time-dimensional feature representation and is used to characterize the similarity of variables in the time series. The second similarity matrix is ​​calculated based on variable-dimensional feature representation and is used to characterize the similarity of variables in the feature space. The difference matrix is ​​directly determined as the asymmetric similarity matrix to explicitly distinguish the asymmetric causal relationship between variable A influencing variable B and variable B influencing variable A in the dependency graph; the asymmetric similarity matrix is ​​used to construct a directed weighted graph, where nodes correspond to monitoring indicator variables in the cloud-native microservice system, the weights of the directed edges correspond to the element values ​​in the asymmetric similarity matrix, and the direction of the edges is determined by the positive or negative sign of the elements.

6. The method as described in claim 4, characterized in that, The learnable decision network dynamically outputs the probability distribution and transformation intensity parameters for the transformation type selection of each variable in the time series data of the multivariate index, including: The dependency graph is concatenated with the statistical feature vector of the multivariate index time series data and then input into the fully connected layer of the learnable decision network; the statistical feature vector includes the mean, variance, kurtosis, skewness, autocorrelation coefficient and periodicity of the cloud-native microservice system monitoring index, which is used to characterize the time series distribution characteristics of each monitoring index. The fully connected layer outputs two independent probability distribution vectors. The first probability distribution vector characterizes the selection probability of various transformation types, such as translation, scaling, jitter, time warp, periodic perturbation, and mutation injection, for typical anomaly patterns in cloud-native microservice systems. These transformation types correspond to common performance anomalies, resource bottlenecks, and service failure modes in cloud-native microservice systems. The second probability distribution vector characterizes the continuous numerical strength parameter corresponding to each transformation type. This strength parameter is adaptively adjusted based on the coupling strength between variables in the dependency graph. The first probability distribution vector is sampled using the Gumbel-Softmax reparameterization technique to obtain a discretized one-hot encoding of the transform type, and the second probability distribution vector is used as a continuous transform intensity parameter to achieve end-to-end differentiable optimization of the enhancement strategy; the end-to-end differentiable optimization enables the enhancement strategy to be dynamically adjusted according to the feedback from the downstream anomaly detection model.

7. The method as described in claim 1, characterized in that, The calculation of the consistency loss between the dependency graph of the current level and the dependency graph of the previous level includes: In the current level of the multi-level enhancement processing, the dependency graph of the current level is recalculated based on the enhancement data output by the current level. And obtain the dependency graph corresponding to the augmented data output from the previous level. ; Calculate the dependency graph of the current level. Dependency graph with the previous level The squared Euclidean distance between them is used as the graph consistency loss for the current level. Its calculation formula is ; The graph consistency loss of all levels in the multi-level enhancement process is summed to obtain the total dependency loss used to constrain dependency structure drift during the enhancement process. Its calculation formula is ,in This indicates the total number of levels in the enhancement process. Indicates the first Data after layer enhancement.

8. The method as described in claim 1, characterized in that, The consistency loss of data in the anomalous semantic space before and after computational enhancement includes: The original multivariate time-series index data is input into a pre-trained anomaly detection model to obtain the anomaly semantic prediction results of the original data. The abnormal semantic prediction results include the probability distributions of normal and abnormal classes; The enhanced indicator data is input into the same anomaly detection model to obtain the anomaly semantic prediction result of the enhanced data. ; Calculate the anomaly semantic prediction result of the original data. Anomaly semantic prediction results with the enhanced data The cross-entropy between them is used as the consistency loss. Its calculation formula is This ensures that the enhanced indicator data maintains consistency with the original data in terms of anomaly discrimination semantics, preventing the drift or loss of abnormal morphological features during the enhancement process.

9. The method as described in claim 1, characterized in that, The optimization of the enhancement strategy by combining the consistency loss includes: constructing a total loss function that includes downstream task loss, dependency structure drift constraint loss and anomaly semantic consistency loss, wherein the downstream task loss is the reconstruction error or classification error of the anomaly detection model on the enhanced index data; The total loss function is expressed as: ,in This indicates the loss of the downstream task. This represents the loss due to the dependent structure drift constraint. This represents the loss of semantic consistency due to the anomaly. and These are the coefficients that balance the weights of each loss term; Based on the total loss function, the backpropagation algorithm is used to alternately update the network parameters of the enhancement strategy and the model parameters of the anomaly detection model until the total loss function converges, thereby obtaining the final enhancement strategy adaptively optimized for the current multivariate index time series data.

10. The method as described in claim 3, characterized in that, The step of performing time-dimensional encoding and variable-dimensional encoding on the time-series data of the multivariate indicators includes: The first encoder network is used to extract the temporal evolution features of the multivariate index time series data on the time axis. The first encoder network adopts a temporal feature extractor based on temporal convolutional network or long short-term memory network. It captures the dynamic change patterns of cloud-native microservice system monitoring indicators at different time scales through a sliding window mechanism, and generates the time dimension feature representation matrix containing time step information. Each row of the time dimension feature representation matrix corresponds to a global temporal feature vector of a time step. The second encoder network is used to extract the spatial correlation features between different variable channels of the multivariate index time series data. The second encoder network adopts a spatial feature extractor based on a multi-head self-attention mechanism or a graph convolutional network. By modeling the interaction relationship between each monitoring index variable in the cloud-native microservice system, the variable dimension feature representation matrix containing the coupling information between variables is generated. Each column of the variable dimension feature representation matrix corresponds to a global spatial feature vector of a monitoring index variable. The first encoder network and the second encoder network adopt a multilayer perceptron structure or a convolutional neural network structure with shared weights. The shared weight mechanism ensures that the time dimension features and the variable dimension features are mapped to the same feature space, so that the asymmetric similarity calculated based on the time dimension feature representation matrix and the variable dimension feature representation matrix can accurately reflect the direction and intensity of the influence between variables in the cloud-native microservice system.

Images