A method for detecting anomalies in online and real-time microservice call chains

Abstract

The present invention discloses an online real-time microservice call chain anomaly detection method, firstly, the microservice call chain is modeled as a natural language sequence, the events recorded in the call chain are parsed, and the events are extracted as semantic sequences and response time sequences; then the vectorized representation of the events in the call chain is extracted using a vocabulary embedded representation algorithm, and the call chain is represented as a numerical vector sequence arranged in time sequence, and finally a double-layer long short-term memory deep neural network based on an attention mechanism is used to simultaneously detect the microservice instance call path anomaly and performance anomaly in the call chain. The present invention can not only simultaneously detect two types of anomalies in the call chain, but also improve the speed and accuracy of detection, and reduce the false positives and false negatives of anomalies.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an online real-time microservice call chain anomaly detection method. Background Art

[0002] The development of cloud computing and service-oriented software development methods has accelerated the process of migrating large-scale business applications to the cloud, greatly improving the development, expansion and operation and maintenance efficiency of large-scale applications. Microservice architecture has gradually become the mainstream design architecture for large-scale cloud applications and the development direction of service-oriented software development methods. It further decentralizes the traditional service-oriented development model and splits complex monolithic applications into a series of microservices with single functions, independent deployment and high cohesion and low coupling. However, the complex dependencies between microservice instances not only increase the frequency of failures, but also increase the difficulty of fault diagnosis. In particular, when a microservice in the microservice call topology fails, the failure will spread along the call chain and affect other microservices deployed on the same container or physical machine as itself (even if there is no call relationship between the two, but they share CPU, memory and other resources), thereby causing "fault propagation", that is, generating a large number of abnormal alarms in a short time interval. Therefore, in order to avoid the wide spread of faults in the system, it is necessary to detect and locate the root cause of the fault as soon as possible when a small number of faults occur. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides an online and real-time microservice call chain anomaly detection method. The call chain data records the call relationship, execution path and performance parameters of the microservice level in a graph-like structure. When a system failure occurs, the microservice instance affected by the failure and its network element (container or physical machine) can be detected early, and the root cause location of the failure can be started subsequently, thereby improving the response speed of the fault response.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] A method for detecting anomalies in an online and real-time microservice call chain, the method comprising the following steps:

[0006] S1, obtain the call chain data, which consists of events sorted in time sequence; model the microservice call chain as a natural language sequence, parse the events recorded in the call chain, and extract the events into semantic sequences and response time sequences;

[0007] S2, using the vocabulary embedded representation algorithm to extract the vectorized representation of the events in the call chain, and represent the call chain as a sequence of numerical vectors arranged in time order;

[0008] S3, extracts a subsequence of length N from the numerical vector sequence according to the time window size, takes the first N-1 items as reference values, and the Nth item as the observation value. A two-layer long short-term memory deep neural network based on the attention mechanism is used to predict the event template and corresponding response time of the observation value, and compares the predicted results with the actual observed results to simultaneously detect the call path anomalies and performance anomalies of the microservice instance in the call chain.

[0009] To optimize the above technical solutions, the specific measures taken also include:

[0010] Furthermore, in step S1, the event includes eight fields: call type, timestamp, response time, call chain unique identifier, event unique identifier, parent event unique identifier, calling network element unique identifier and microservice name;

[0011] The process of extracting events into semantic sequences and response time sequences includes the following sub-steps:

[0012] Select the call type, the calling network element unique identifier and the microservice name from the eight fields included in the event to form an event template, and select the response time from the eight fields included in the event as the microservice response time;

[0013] wherein the microservice response time is standardized to obtain a standardized microservice response time of the microservice response time;

[0014] After the call chain data is parsed, the call chain T with a length of N is [e0, e1, ..., e N-1 ] is represented as two sequences sorted by timestamp, namely the event template sequence T ρ =[ρ0,ρ1,...,ρ N-1 ] and the response time series T η =[η0,η1,...,η N-1 ], where e i Represents the events recorded in the call chain, ρ i represents the event template obtained after data parsing, η i Represents the response time of the microservice recorded in each event.

[0015] Furthermore, in step S2, the vectorized representation of the events in the call chain is extracted using the vocabulary embedded representation algorithm, and the process of representing the call chain as a sequence of numerical vectors arranged in time sequence includes the following steps:

[0016] S21, consider the call chain as a statement, the event as a word in the statement, and the call relationship between events as grammar to obtain the event template set S = {ρ0, ρ i , ..., ρ V-1}, V represents the number of unique event templates;

[0017] S22, preprocess the event templates, map each event template ρ in the set S to a vector o with a dimension of V using a one-hot encoding method, encode the event template into a one-hot vector, and obtain a one-hot encoding vector set O corresponding to the set S = {o0, o1, ..., o V-1},in o i Representative event i The corresponding one-hot encoded vector;

[0018] S23, for a given call chain event template sequence T ρ =[ρ0,ρ1,...,ρ N-1 ], by querying the set O, ρ Mapping to T o =[o0, o1, ..., o N-1 ],in o k Representative event k The corresponding one-hot encoding vector; the event template ρ i The corresponding one-hot vector is input into the vocabulary embedded representation model, and the output of the vocabulary embedded representation model is the event template ρ i The one-hot vector ρ corresponding to the context b ∈{...,ρ i-1 , ρ i+1 , ρ i+2 , ...}; wherein the vocabulary embedded representation model is an autoencoder whose decoder and encoder are both fully connected neural networks; after the autoencoder is trained, the one-hot vector of the event template is input into the encoder to obtain the semantic vector of the event template; the semantic vector contains the context information of the corresponding event template in the call chain.

[0019] Further, in step S23, the event template p i The corresponding one-hot vector is input into the vocabulary embedded representation model, and the output of the vocabulary embedded representation model is the event template ρ i The one-hot vector ρ corresponding to the context b ∈{...,ρ i-1 , ρ i+1 , ρ i+2 , ...} process includes the following sub-steps:

[0020] S231, ρ i The corresponding o i Map it to the low-dimensional space and calculate the low-dimensional representation h. The calculation formula is as follows:

[0021]

[0022] in, Representative i A low-dimensional representation of , and D < V, are the parameters of the hidden layer in the vocabulary embedded representation model;

[0023] S232, predict ρ from h b , the calculation formula is as follows:

[0024] y = softmax(W′) V×D h)

[0025] P(ρ b =ρ k |ρ i )=y k , k∈[0,V-1]

[0026] Where y is the output of the vocabulary embedded representation model, W′ V×D is the parameter of the output layer in the vocabulary embedded representation model, softmax() is the normalized exponential function, P(ρ b =ρ k |ρ i ) is the vocabulary embedded representation model under a given ρ i Under the condition of b =ρ k The probability of

[0027] S233, assuming that the optimization goal of the model is to maximize the given event template ρ i The probability of generating a context event template is equivalent to minimizing the loss function. The loss function is calculated as follows:

[0028]

[0029] Where C is ρ i The number of corresponding context event templates, ρ i′ Represents ρ i The corresponding context in the call chain;

[0030] S231, after the model converges, calculate the event template ρ i The corresponding semantic vector v i , the calculation formula is as follows:

[0031]

[0032] Furthermore, in step S3, a process of using a two-layer long short-term memory deep neural network based on an attention mechanism to predict an event template of an observed value and a corresponding response time includes the following steps:

[0033] S31, representing the call chain data of length N as a semantic vector sequence T v =[v0, v1, ..., v N-1 ] and the response time series T η =[η0,η1,...,η N-1 ]; concatenate the above sequences element by element into a bimodal vector sequence T v =[V0, V1, ..., V N-1 ] as the input of the bidirectional LSTM based on the attention mechanism, where V i =[v i , η i ];

[0034] S32, subsequence T of length l l =[V t-l+1 , V t-l+2 , ..., V t-1 , V t ] is used as the input of a two-layer long short-term memory deep neural network to mine the information contained in the subsequence from both the forward and backward directions, and each LSTM block outputs a latent vector H to obtain the corresponding bidirectional LSTM output;

[0035] S33, the weight of each event at each moment is obtained from the output H of each LSTM block, and the calculation formula is as follows:

[0036]

[0037] in is the parameter of the first fully connected layer in the attention layer, t represents the time point corresponding to the LSTM block, l represents the number of LSTM blocks in each layer, that is, the time window size, and H i Represents the output of each LSTM block;

[0038] S34, the output of the attention layer is obtained by the output H of the LSTM block corresponding to each moment and the corresponding weight λ, and the calculation formula is as follows:

[0039]

[0040] Where pred = [u, η pred ], w′ is the parameter of the second fully connected layer in the attention layer;

[0041] S35, taking u as the multi-classification result predicted by the model, η pred The response time of the event corresponding to the time t+1 predicted by the model is calculated as follows:

[0042] P(ρ t+1 =ρ i ,|ρt-l+1 , ..., ρ t )=u i′ , i′∈[0,V-1].

[0043] Furthermore, in step S3, the predicted result is compared with the actually observed result to simultaneously detect the microservice instance call path anomaly and performance anomaly in the call chain.

[0044] If the predicted value of the event template is different from the actual event template in the observed value, it is determined that there is a call path abnormality in the call chain where the observed value is located; if the predicted value of the response time is different from the actual response time in the observed value, it is determined that there is a microservice performance abnormality in the call chain where the observed value is located.

[0045] Furthermore, if the event template prediction value is different from the actual event template in the observation value, the process of determining whether there is a call path anomaly in the call chain where the observation value is located includes:

[0046] The occurrence probabilities of multiple event templates contained in the event template prediction value are sorted in descending order; based on the probability sorting result, the event template set that is most likely to appear at the next moment is selected; if the observed value is not in the event template set that may appear at the next moment, it is determined that there is a call path anomaly in the call chain where the observed value is located.

[0047] Furthermore, if the predicted response time value is different from the actual response time in the observed value, the process of determining whether there is a microservice performance anomaly in the call chain where the observed value is located includes:

[0048] The response time corresponding to the next event template contained in the predicted value is compared with the response time contained in the observed value, and the root mean square error between the two is calculated; if the root mean square error is greater than a dynamic threshold, it is determined that there is a microservice performance anomaly in the call chain where the predicted value is located; wherein the dynamic threshold is obtained from the call chain anomaly detection model after the validation set input converges.

[0049] Furthermore, the dynamic threshold is obtained from the call chain anomaly detection model after the validation set input converges, and the process of obtaining the dynamic threshold includes the following steps:

[0050] A31, obtain the call chain data generated during the normal operation of the system for a period of time and divide it into a training set and a validation set according to a certain ratio; in the model training stage, based on the training set, the sum of multi-classification cross entropy loss and mean square error loss is used as the overall loss function of the model, and the stochastic gradient descent algorithm is used under the guidance of this loss function to update the model parameters, and L2 regularization is used for the model parameters; after the model converges, the validation set is input into the model, and the response time prediction value η of the model is used predand the observed value η at time t+1 t+1 Calculate the mean square error r, the calculation formula is as follows:

[0051] r=(η pred -η t+1 ) 2 ;

[0052] A32, calculate the mean μ and standard deviation σ of r, according to Cantley's inequality,

[0053]

[0054] Replace ε with ε=βσ, where β is the confidence level, and the calculation formula is as follows:

[0055]

[0056] A33, using r in the process of microservice performance anomaly detection threshold =μ+βσ as the dynamic threshold to determine whether r is abnormal; if the model's predicted value η pred The actual observed value η t+1 The mean square error r>r threshold , it is determined that the microservice responding to this event has performance anomalies.

[0057] The beneficial effects of the present invention are:

[0058] The online real-time microservice call chain anomaly detection method of the present invention uses a deep learning model to learn the behavior pattern of a normal call chain, while considering the dependency between events and the response time, and adopts a bidirectional LSTM model based on an attention mechanism to simultaneously detect call path anomalies and performance anomalies, thereby improving the accuracy of call chain anomaly detection and avoiding false positives and negative negatives of anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a flow chart of an online and real-time microservice call chain anomaly detection method according to an embodiment of the present invention.

[0060] Figure 2 The figure is a schematic diagram of the architecture of the microservice call chain anomaly detection model according to an embodiment of the present invention.

[0061] Figure 3 It is a schematic diagram of the structure of the semantic vectorization model of the microservice call chain provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The present invention will now be described in further detail with reference to the accompanying drawings.

[0063] It should be noted that the terms such as "upper", "lower", "left", "right", "front", "back", etc. cited in the invention are only for the convenience of description and are not used to limit the scope of implementation of the present invention. Changes or adjustments in their relative relationships should be regarded as the scope of implementation of the present invention without substantially changing the technical content.

[0064] Figure 1 This is a flow chart of an online real-time microservice call chain anomaly detection method according to an embodiment of the present invention. Figure 1 , the anomaly detection method comprises the following steps:

[0065] S1, obtain the call chain data, which consists of events sorted in time sequence; model the microservice call chain as a natural language sequence, parse the events recorded in the call chain, and extract the events into semantic sequences and response time sequences.

[0066] S2, uses the vocabulary embedded representation algorithm to extract the vectorized representation of events in the call chain, and represents the call chain as a sequence of numerical vectors arranged in time order.

[0067] S3, extracts a subsequence of length N from the numerical vector sequence according to the time window size, takes the first N-1 items as reference values, and the Nth item as the observation value. A two-layer long short-term memory deep neural network based on the attention mechanism is used to predict the event template and corresponding response time of the observation value, and compares the predicted results with the actual observed results to simultaneously detect the call path anomalies and performance anomalies of the microservice instance in the call chain.

[0068] 1. Extracting events into semantic sequences and response time sequences

[0069] Get call chain data. Figure 2 As shown, the call chain consists of a series of events with timestamps (hereinafter collectively referred to as events), and each event contains eight fields: call type, timestamp, response time, call chain unique identifier, event unique identifier, parent event unique identifier, calling network element unique identifier, and microservice name. Among these eight fields, CallType represents the call type of the event. StartTime represents the call initiation time of the event, that is, the timestamp of the event. ElapsedTime represents the response time of the event. TraceId is the unique identifier of this call chain. SpanId is the unique identifier of the event in the call chain. Pid represents the SpanId of the parent event of this event in the call chain. Cmdb_id represents the unique identifier of the network element that initiated this call. ServiceName represents the service network element that responds to this call. Each call chain has the TraceId field as its unique identifier, and the call chain T is represented as an event sequence [e0, e1,..., e1] sorted by the timestamp StartTime.N-1 ], that is, T = [e0, e1, ..., e N-1 ], where N represents the length of the call chain T.

[0070] In order to ensure that the behavior of the event can be accurately described in the form of a numerical vector in the semantic vectorization step, the call type, the calling network element unique identifier and the microservice name are selected from the eight fields contained in the event to form an event template, and the response time is selected from the eight fields contained in the event as the microservice response time; wherein, the microservice response time is standardized to obtain the standardized microservice response time of the microservice response time. Specifically, this embodiment uses the three fields of CallType, Cmdb_id and ServiceName to classify events, and the above three fields are combined into a regular expression CallType_Cmdb_id_ServiceName as a marker for the event category, which is called an event template. After completing the call chain data parsing, a call chain T=[e0, e1,..., e N-1 ] can be represented as two sequences sorted by timestamp, namely event template sequence T ρ =[ρ0,ρ1,...,ρ N-1 ] and the response time series T η =[η0,η1,...,η N_1 ].

[0071] 2. Represent the call chain as a sequence of numerical vectors arranged in time order

[0072] like Figure 3 As shown in the figure, the idea of ​​natural language processing is adopted, and the word2vec word embedded representation method is used to extract the contextual semantic information in the event sequence and convert the event template into a fixed-dimensional numerical vector (referred to as semantic vectorization in this article). In addition, due to the small number of unique event templates, the negative sampling process in the original algorithm is omitted. The word2vec word embedded algorithm mainly includes two models, namely the skip-gram model and the continuous word model (CBOW). This article uses the skip-gram model to implement the semantic vectorization of event templates, which mainly includes two steps:

[0073] Step 1: Event template preprocessing. After completing the call chain data analysis, an event template set S = {ρ0, ρ1, ..., ρ V-1}, V represents the number of unique event templates. This embodiment uses one-hot encoding to map each event template ρ in the set S to a vector o with a dimension of V, thereby obtaining a one-hot encoding vector set O corresponding to the set S = {o0, o1, ..., o V-1},in

[0074] Step 2: Extracting semantic information. The semantic vector describing the event template needs to meet two requirements: distinguishability and comparability. Distinguishability means that the semantic vector can highly distinguish different event templates, while comparability means that similar events should have similar semantic vectors. Therefore, in order to meet the above two requirements, this embodiment extracts semantic information from a given event template sequence T in a call chain. ρ =[ρ0,ρ1,...,ρ N-1 ], by querying the set O, ρ Mapping to T o =[o0, o1, ..., o N-1 ],in Then, in the skip-word model, an event template ρ is used i To predict its context ρ b ∈{...,ρ i-1 , ρ i+1 , ρ i+2 , ...} to complete the semantic vectorization of event templates. The specific process is as follows:

[0075] First, ρ i The corresponding o i Map it to the low-dimensional space and calculate the low-dimensional representation h. The calculation formula is as follows:

[0076]

[0077] in, Representative i A low-dimensional representation of , and D < V. Then h predicts ρ b , the calculation formula is as follows:

[0078] y = softmax(W′) V×D h)

[0079] P(ρ b =ρ k |ρ i )=y k , k∈[0,V-1]

[0080] Where y is the output of the vocabulary embedded representation model, P(ρ b =ρ k |ρ i ) is the vocabulary embedded representation model under a given ρ i Under the condition of b =ρ k probability.

[0081] The optimization goal of the model is to maximize the given event template ρ iThe probability of generating a context event template is equivalent to minimizing the loss function shown in the following formula. The calculation formula of the loss function is as follows:

[0082]

[0083] Where C is ρ i The number of corresponding context event templates.

[0084] After the model converges, calculate the event template ρ i The corresponding semantic vector v i , the calculation formula is as follows:

[0085]

[0086] Predict the next possible event template and the corresponding response time.

[0087] like Figure 2 As shown in the figure, a bidirectional LSTM based on the attention mechanism is used as the call chain anomaly detection model. In addition to the difficulty of call chain anomaly detection caused by the complex call relationship between microservices, how to simultaneously detect call path anomalies and microservice performance anomalies is also one of the challenges faced by call chain anomaly detection. The main reasons are as follows: (i) Even in the absence of anomalies, the response time of microservices will fluctuate within a large range. This is because the response time of microservices includes not only its own response time, but also the response time of all its sub-calls. Due to the diversity of microservice call paths, the method of using only the response time of microservices for anomaly detection will produce many false positives. Therefore, when considering the response time to detect microservice performance anomalies, the corresponding call path of the microservice should also be considered. (ii) Some faults may cause some microservices in the call chain to go offline (for example, the physical machine crashes, causing the microservice deployed on it to go offline, or the database rejects access requests due to too many visitors). The abnormal call path and the normal call path may have the same structure. In this case, the two can only be distinguished by their response time. Therefore, the microservice call chain anomaly detection model proposed in this embodiment can learn the correlation between the microservice call path and the response time, thereby simultaneously detecting the call path anomaly and the response time anomaly in the call chain.

[0088] 3. Microservice instance call path anomaly and performance anomaly detection

[0089] After data parsing and semantic vectorization, the call chain of length N is represented as a semantic vector sequence T v =[v0, v1, ..., v N-1 ] and the response time series T η =[η0,η1,...,η N-1], in order to detect both call path anomalies and microservice performance anomalies, the above sequence is concatenated element by element into a bimodal vector sequence T v =[V0, V1, ..., V N-1 ] as the input of the bidirectional LSTM based on the attention mechanism, where V i =[v i , η i ].

[0090] The bidirectional LSTM accepts a subsequence T of length l. l =[V t-l+1 , V t-l+2 , ..., V t-1 , V t ] as input, the information contained in the subsequence is mined from both forward and backward directions, and each LSTM block outputs a latent vector H.

[0091] After obtaining the output of the bidirectional LSTM, the attention mechanism is used to automatically apply different weights to different events in the subsequence. In this embodiment, the weight of each moment event is first obtained from the output H of each LSTM block, and the calculation formula is as follows:

[0092]

[0093] in is the parameter of the first fully connected layer in the attention layer. Then, the output of the attention layer is obtained by the output H of the LSTM block corresponding to each moment and the corresponding weight λ. The calculation formula is as follows:

[0094]

[0095] Where pred = [u, η pred ], w′ is the parameter of the second fully connected layer in the attention layer, u is used as the multi-classification result predicted by the model, η pred The response time of the event corresponding to the time t+1 predicted by the model is calculated as follows:

[0096] P(ρ t+1 =ρ i′ |ρ t-l+1 , ..., ρ i )=u i′ , i′∈[0,V-1]

[0097] The predicted results are compared with the actual observed results to determine anomalies.

[0098] The event template and response time in the observed value are predicted according to the actual event template and response time in the reference value, and the event template prediction value and response time prediction value are obtained respectively. If the event template prediction value is different from the actual event template in the observed value, it is determined that there is a call path anomaly in the call chain where the observed value is located; if the response time prediction value is different from the actual response time in the observed value, it is determined that there is a microservice performance anomaly in the call chain where the observed value is located.

[0099] For example, the observation value extracted from the numerical vector is input into the call chain anomaly detection model to obtain the model's prediction value; the prediction value includes the probability distribution of the next event template and the response time corresponding to the next event template. The call chain anomaly detection model is trained by a bidirectional LSTM neural network model based on the attention mechanism. The probability distribution includes the probability of multiple event templates appearing at the next moment; the response time corresponds to the response time corresponding to the next event template that may appear. The occurrence probabilities of multiple event templates included in the event template prediction value are sorted in descending order; according to the probability sorting result, the event template set that is most likely to appear at the next moment is selected; if the observation value is not in the event template set that may appear at the next moment, it is determined that there is a call path anomaly in the call chain where the observation value is located. Compare the response time corresponding to the next event template included in the prediction value with the response time included in the observation value, and calculate the root mean square error between the two; if the root mean square error is greater than the dynamic threshold, it is determined that there is a microservice performance anomaly in the call chain where the prediction value is located; wherein the dynamic threshold is obtained from the call chain anomaly detection model after the validation set input converges. The process of obtaining a dynamic threshold from a call chain anomaly detection model after the validation set input converges includes: extracting part of the data from the call chain anomaly detection model training set as a validation set; extracting reference values ​​and observation values ​​from the validation set; inputting the reference values ​​in the validation set into the call chain anomaly detection model to obtain a response time prediction value; calculating the mean and standard deviation of the response time prediction values ​​corresponding to all samples in the validation set; and calculating the dynamic threshold using the Cantelli inequality based on the mean and standard deviation.

[0100] Taking the above model as an example, the call chain data generated during the normal operation of the system for a period of time is obtained and divided into a training set and a validation set according to a certain ratio. In the model training stage, based on the training set, the sum of multi-classification cross entropy loss and mean square error loss is used as the overall loss function of the model. Under the guidance of this loss function, the stochastic gradient descent algorithm is used to update the model parameters, and L2 regularization is used for the model parameters. After the model converges, the validation set is input into the model, and the response time prediction value η of the model is used pred and the observed value η at time t+1 t+1 Calculate the mean square error r, the calculation formula is as follows:

[0101] r=(η pred -η t+1 ) 2 .

[0102] Then we calculate the mean μ and standard deviation σ of r. According to the Cantelli inequality,

[0103]

[0104] Substituting ε for ε=βσ, the calculation formula is as follows:

[0105]

[0106] Since the validation set contains normal call chain data, most of the mean square error r values ​​will be very close to the mean μ. In the process of microservice performance anomaly detection, r is used. threshold =μ+βσ is used as the threshold to judge whether r is abnormal. If the predicted value η pred The actual observed value η t+1 The mean square error r>r threshold , it can be determined that the microservice responding to this event has performance anomalies.

[0107] According to the probability of occurrence of each event predicted by the model, the m most likely candidate events are selected. If the actual observed value is not among these m candidate events, it is judged that there is a call path anomaly.

[0108] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A method for detecting anomalies in an online and real-time microservice call chain, characterized in that: The anomaly detection method comprises the following steps: S1, obtain the call chain data, which consists of events sorted in time sequence; model the microservice call chain as a natural language sequence, parse the events recorded in the call chain, and extract the events into semantic sequences and response time sequences; S2, using the vocabulary embedded representation algorithm to extract the vectorized representation of the events in the call chain, and representing the call chain as a sequence of numerical vectors arranged in time order; specifically includes the following steps: S21, consider the call chain as a statement, the event as a word in the statement, and the call relationship between events as grammar to obtain the event template set , Represents the number of unique event templates; S22, pre-process the event template and use the one-hot encoding method to convert the set Each event template in Mapped to a dimension Vector , encode the event template into a one-hot vector, and get the set The corresponding one-hot encoded vector set ,in , Representative events The corresponding one-hot encoded vector; S23, event template sequence for a given call chain , by querying the collection Will Mapping ,in , Representative events The corresponding one-hot encoding vector; the event template The corresponding one-hot vector is input into the vocabulary embedded representation model, and the vocabulary embedded representation model outputs the event template The one-hot vector corresponding to the context ; wherein the vocabulary embedded representation model is an autoencoder whose decoder and encoder are both fully connected neural networks; after the autoencoder is trained, the one-hot vector of the event template is input into the encoder to obtain the semantic vector of the event template; the semantic vector contains the context information of the corresponding event template in the call chain; S3, extracts a subsequence of length N from the numerical vector sequence according to the time window size, takes the first N-1 items as reference values, and the Nth item as the observation value. A two-layer long short-term memory deep neural network based on the attention mechanism is used to predict the event template and corresponding response time of the observation value, and compares the predicted result with the actual observed result to simultaneously detect the call path anomalies and performance anomalies of the microservice instance in the call chain; Among them, a two-layer long short-term memory deep neural network based on the attention mechanism is used to predict the event template of the observed value and the corresponding response time, including: S31, the length is The call chain data is represented as a sequence of semantic vectors and the response time series ; Concatenate the above sequences element by element into a bimodal vector sequence As the input of the bidirectional LSTM based on the attention mechanism, ; S32, the length is subsequence of As the input of a two-layer long short-term memory deep neural network, the information contained in the subsequence is mined from both the forward and backward directions, and each LSTM block outputs a hidden vector , get the corresponding bidirectional LSTM output; S33, the output of each LSTM block Get the weight of the event at each moment, the calculation formula is as follows: ； in are the parameters of the first fully connected layer in the attention layer, Represents the time point corresponding to the LSTM block, Represents the number of LSTM blocks in each layer, that is, the time window size, Represents the output of each LSTM block; S34, the output of the LSTM block corresponding to each moment And the corresponding weights Get the output of the attention layer, the calculation formula is as follows: ； in, , are the parameters of the second fully connected layer in the attention layer; S35, As the multi-classification result predicted by the model, As the model predicts The response time of the event corresponding to the time is calculated as follows: 。 2. The online real-time microservice call chain anomaly detection method according to claim 1 is characterized in that: In step S1, the event contains eight fields: call type, timestamp, response time, call chain unique identifier, event unique identifier, parent event unique identifier, calling network element unique identifier and microservice name; The process of extracting events into semantic sequences and response time sequences includes the following sub-steps: Select the call type, the calling network element unique identifier and the microservice name from the eight fields included in the event to form an event template, and select the response time from the eight fields included in the event as the microservice response time; wherein the microservice response time is standardized to obtain a standardized microservice response time of the microservice response time; After the call chain data is parsed, the length is The call chain Represented as two sequences sorted by timestamp, namely the event template sequence And the response time series ,in Represents the events recorded in the call chain, Represents the event template obtained after data parsing is completed. Represents the response time of the microservice recorded in each event.

3. The online real-time microservice call chain anomaly detection method according to claim 1 is characterized in that: In step S23, the event template The corresponding one-hot vector is input into the vocabulary embedded representation model, and the vocabulary embedded representation model outputs the event template The one-hot vector corresponding to the context The process consists of the following sub-steps: S231, will Corresponding Map to low-dimensional space and calculate low-dimensional representation , the calculation formula is as follows: ； in, represent A low-dimensional representation of , are the parameters of the hidden layer in the vocabulary embedded representation model; S232, by predict , the calculation formula is as follows: ； ； in is the output of the vocabulary embedded representation model, is the parameter of the output layer in the vocabulary embedded representation model, softmax() is the normalized exponential function, For the vocabulary embedded representation model, given Under the condition of probability; S233, assuming that the optimization goal of the model is to maximize the given event template The probability of generating a context event template is equivalent to minimizing the loss function. The loss function is calculated as follows: ； in for The number of corresponding context event templates, represent The corresponding context in the call chain; S231, after the model converges, calculate the event template The corresponding semantic vector , the calculation formula is as follows: 。 4. The online real-time microservice call chain anomaly detection method according to claim 1 is characterized in that: In step S3, the predicted results are compared with the actually observed results to simultaneously detect the microservice instance call path anomalies and performance anomalies in the call chain. If the predicted value of the event template is different from the actual event template in the observed value, it is determined that there is a call path abnormality in the call chain where the observed value is located; if the predicted value of the response time is different from the actual response time in the observed value, it is determined that there is a microservice performance abnormality in the call chain where the observed value is located.

5. The online real-time microservice call chain anomaly detection method according to claim 4 is characterized in that: If the event template prediction value is different from the actual event template in the observed value, the process of determining whether there is a call path anomaly in the call chain where the observed value is located includes: The occurrence probabilities of multiple event templates contained in the event template prediction value are sorted in descending order; based on the probability sorting result, the event template set that is most likely to appear at the next moment is selected; if the observed value is not in the event template set that may appear at the next moment, it is determined that there is a call path anomaly in the call chain where the observed value is located.

6. The online real-time microservice call chain anomaly detection method according to claim 4 is characterized in that: If the predicted response time value is different from the actual response time in the observed value, the process of determining whether there is a microservice performance anomaly in the call chain where the observed value is located includes: The response time corresponding to the next event template contained in the predicted value is compared with the response time contained in the observed value, and the root mean square error between the two is calculated; if the root mean square error is greater than a dynamic threshold, it is determined that there is a microservice performance anomaly in the call chain where the predicted value is located; wherein the dynamic threshold is obtained from the call chain anomaly detection model after the validation set input converges.

7. The online real-time microservice call chain anomaly detection method according to claim 6 is characterized in that: The dynamic threshold is obtained from the call chain anomaly detection model after the validation set input converges. The process of obtaining the dynamic threshold includes the following steps: A31, obtain the call chain data generated during the normal operation of the system for a period of time and divide it into a training set and a validation set according to a certain ratio; in the model training stage, based on the training set, the sum of multi-classification cross entropy loss and mean square error loss is used as the overall loss function of the model. Under the guidance of this loss function, the stochastic gradient descent algorithm is used to update the model parameters, and L2 regularization is used for the model parameters; after the model converges, the validation set is input into the model, and the response time prediction value of the model is used and Observed value at time Calculate mean square error , the calculation formula is as follows: ； A32, calculated The mean and standard deviation According to Cantley's inequality, : ； Will Alternative ,in is the confidence level, calculated as follows: ； A33, used in the process of microservice performance anomaly detection As a judgment Dynamic threshold for abnormality; if the model's predicted value The actual observed value The mean square error , it is determined that the microservice responding to this event has performance anomalies.

Images