Training method and device for call chain anomaly detection model based on incremental training

Abstract

The present invention provides a method and device for training a call chain anomaly detection model based on incremental training. The method comprises: dividing a preset first time period into multiple time segments; using the earliest time segment as the first time segment; obtaining first historical call chain information and obtaining a first call chain information set based on the first historical call chain information; using the first call chain information set to train a call chain anomaly detection model to obtain an initial call chain anomaly detection model; using other time segments as second time segments; obtaining second historical call chain information and obtaining a second call chain information set based on the second historical call chain information; using the second call chain information set to incrementally train the initial call chain anomaly detection model to obtain a call chain anomaly detection model; and storing the call chain anomaly detection model on a server. The present invention can shorten the time required for model training and effectively improve the model training efficiency.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of microservice anomaly monitoring, and in particular to a training method and device for a call chain anomaly detection model based on incremental training. Background Art

[0002] Unlike traditional monolithic service architectures, microservice architectures use a modular approach, dividing service instances into small, independent units that can be independently deployed and scaled. The scalability, reusability, and independent deployment advantages of microservice architectures have made them a mainstream feature of software development. Systems based on microservice architectures are typically composed of thousands or tens of thousands of services that share limited hardware and software resources. Microservices communicate with each other through a lightweight messaging protocol (hereinafter referred to as the call chain). The call chain contains a large amount of call relationships and execution information between different microservices. By evaluating whether the microservice call chain is abnormal, we can discover and diagnose microservice anomalies, and further determine the type of microservice anomaly based on the characteristics of certain specific indicators in the call chain data, which can better help us more accurately identify problems in the software system.

[0003] As microservice systems continue to expand, the amount of call chain information between microservices is also growing exponentially, with the amount of call chain information generated daily reaching millions, tens of millions, or even hundreds of millions. This increasing volume of call chain information and the increasingly complex microservice call relationships pose significant challenges for operations personnel in identifying anomalies and locating faults. Existing call chain anomaly detection methods are mostly automated and based on machine learning, specifically training call chain anomaly detection models.

[0004] However, the existing training methods of call chain anomaly detection models ignore the problem of long training time caused by using large-scale historical data for model training, resulting in low model training efficiency. Summary of the Invention

[0005] An embodiment of the present invention provides a training method and device for a call chain anomaly detection model based on incremental training to solve the problem that the existing training method of the call chain anomaly detection model ignores the use of large-scale historical data for model training, resulting in long training time and low model training efficiency.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present invention provides a method for training a call chain anomaly detection model based on incremental training, comprising:

[0008] Division step: dividing the preset first time period into multiple time segments;

[0009] The first acquisition step: taking the earliest time segment among all the time segments obtained in this division as the first time segment; obtaining first historical call chain information of the monitored microservice system generated in the first time segment, and obtaining a first call chain information set based on the first historical call chain information;

[0010] A first training step: using the first call chain information set to train a call chain anomaly detection model to obtain an initial call chain anomaly detection model;

[0011] A second acquisition step: taking all other time segments except the first time segment in all the time segments as second time segments; acquiring second historical call chain information of the monitored microservice system generated in the second time segments, and obtaining a second call chain information set corresponding to each second time segment based on the second historical call chain information;

[0012] A second training step: performing incremental training on the initial call chain anomaly detection model using the second call chain information set to obtain the call chain anomaly detection model;

[0013] Execution step: storing the call chain anomaly detection model on the server.

[0014] Optionally,

[0015] The anomaly detection model is a graph variational autoencoder (VGAE) model.

[0016] Optionally, the first training step may include:

[0017] Classify the call chains of the monitored microservice system according to the root node microservice, call chain depth, and microservices associated with the call chain;

[0018] Verifying whether the first call chain information set includes information of all categories of call chains, and obtaining a verification result;

[0019] If the verification result is information including call chains of all categories, continue to perform the first training step;

[0020] If the verification result is information that does not include call chains of all categories, a division parameter setting instruction is sent to the user terminal associated with the user; after receiving the division parameters sent by the user terminal, the second time segment is re-divided according to the division parameters to obtain multiple new time segments, and the first acquisition step is returned until the verification result is information that includes call chains of all categories.

[0021] Optionally,

[0022] Acquiring historical call chain information generated in the first time segment according to a first quantity ratio to obtain a first call chain information set; and acquiring historical call chain information generated in the second time segment according to the first quantity ratio to obtain a second call chain information set;

[0023] The method for determining the first quantity ratio includes:

[0024] Classify the call chains of the monitored microservice system according to the root node microservice, call chain depth, and microservices associated with the call chain;

[0025] The quantity ratio between the call chains of each category is determined to be the first quantity ratio.

[0026] Optionally,

[0027] The EWC loss function is used as the loss function for incremental training of the initial anomaly detection model.

[0028] Optionally, the executing step further includes:

[0029] Every second preset time period, obtaining call chain data of the monitored microservice system within the second time period;

[0030] Obtaining from the server the call chain anomaly detection model with the smallest interval between the storage time and the current time as a target model, and inputting the call chain data into the target model to obtain an anomaly score;

[0031] Determining an anomaly score threshold of the anomaly score obtained this time, and determining whether the anomaly score exceeds the anomaly score threshold;

[0032] If the abnormality score threshold is exceeded, it is determined that the monitored microservice is abnormal.

[0033] Optionally,

[0034] The anomaly score threshold is determined using the P-value method, where the significance level parameter of the P-value in the P-value method is 0.001.

[0035] In a second aspect, an embodiment of the present invention provides a training device for a call chain anomaly detection model, comprising:

[0036] A division module, configured to divide the first preset time period into a plurality of time segments;

[0037] An acquisition module, configured to: in a first acquisition step, take the earliest time segment among all the time segments obtained in the current division as a first time segment; obtain first historical call chain information of the monitored microservice system generated within the first time segment, and obtain a first call chain information set based on the first historical call chain information;

[0038] A training module, configured for a first training step: training a call chain anomaly detection model using the first call chain information set to obtain an initial call chain anomaly detection model;

[0039] The acquisition module is further configured to perform a second acquisition step: using all time segments except the first time segment as second time segments; acquiring second historical call chain information of the monitored microservice system generated within the second time segments; and obtaining a set of second call chain information corresponding one-to-one to each second time segment based on the second historical call chain information;

[0040] The training module is further used in a second training step: performing incremental training on the initial call chain anomaly detection model using the second call chain information set to obtain the call chain anomaly detection model;

[0041] The execution module is used to execute the step of storing the call chain anomaly detection model on the server.

[0042] In a third aspect, an embodiment of the present invention provides an electronic device comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, the steps in the training method of the call chain anomaly detection model based on incremental training as described in any one of the first aspects are implemented.

[0043] In a fourth aspect, an embodiment of the present invention provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps in the training method of the call chain anomaly detection model based on incremental training as described in any one of the first aspects are implemented.

[0044] In an embodiment of the present invention, the first time period is divided into multiple time segments through the steps, and then through the first acquisition step and the first training step, the first call chain information set is determined and the training of the initial call chain anomaly detection model is realized; further, through the second acquisition step and the second training step, on the basis of obtaining the initial call chain anomaly detection model, the second call chain information in the second call chain information set is used as an increment of the training sample, and the incremental (learning) training method is adopted to realize the update iteration of the initial call chain anomaly detection model, which can shorten the time required for training the model and effectively improve the training efficiency of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0046] Figure 1 Schematic diagram of a flow chart of a method for training a call chain anomaly detection model based on incremental training according to an embodiment of the present invention;

[0047] Figure 2 This is a diagram of the call chain of the monitored microservice system;

[0048] Figure 3A To correspond to Figure 2 Schematic diagram of the TFM matrix of the call chain;

[0049] Figure 3B To correspond to Figure 2 Schematic diagram of the adjacency matrix of the call chain;

[0050] Figure 4 This is a schematic diagram of the VGAE model architecture;

[0051] Figure 5 This is a diagram showing the number of nodes minus the number of call chains.

[0052] Figure 6 This is a diagram of the call chain structure;

[0053] Figure 7 Schematic diagram of the EWC loss function principle;

[0054] Figure 8 This is a principle block diagram of a training device for a call chain anomaly detection model based on incremental training according to an embodiment of the present invention;

[0055] Figure 9 This is a principle block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0057] The embodiment of the present invention provides a training method for a call chain anomaly detection model based on incremental training, see Figure 1 As shown, Figure 1This is a flow chart of a method for training a call chain anomaly detection model based on incremental training according to an embodiment of the present invention. The training method includes:

[0058] Dividing step 11: dividing the preset first time period into multiple time segments;

[0059] First acquisition step 12: taking the earliest time segment among all the time segments obtained in this division as the first time segment; obtaining first historical call chain information of the monitored microservice system generated in the first time segment, and obtaining a first call chain information set based on the first historical call chain information;

[0060] First training step 13: using the first call chain information set to train the call chain anomaly detection model to obtain an initial call chain anomaly detection model;

[0061] Second acquisition step 14: taking all time segments except the first time segment in all time segments as second time segments; obtaining second historical call chain information generated in the monitored microservice system within the second time segment, and obtaining a second call chain information set corresponding to each second time segment based on the second historical call chain information;

[0062] Second training step 15: incrementally training the initial call chain anomaly detection model using the second call chain information set to obtain a call chain anomaly detection model;

[0063] Execute step 16: store the call chain anomaly detection model on the server.

[0064] In an embodiment of the present invention, the first time period can be set by the user based on the user's own need to update and iterate the call chain anomaly recognition model. For example, the first time period is the time period obtained by tracing back 7 natural days (7×24 hours) from the start of training. In practical applications, the setting of the first time period is also related to the operating status of the monitored service system. For example, if the average daily operating time of the monitored microservice system is short, the first time period can be increased to ensure that the first time period can cover sufficient call chain information, thereby improving the recognition accuracy of the trained call chain anomaly detection model.

[0065] In some embodiments, the division of the first time period in step 11 is random.

[0066] In some embodiments, the division scheme of step 11 can also be set by the user. For example, the first time period is the time period obtained by tracing back 7 natural days (7×24h) from the start of training. The user determines that a better effect can be achieved when the first time segment is A natural purposes based on the user's own long-term experience in monitoring the monitored microservice system (a better effect, that is, the call chain information of A natural purposes already contains the information of call chains of all categories, and the data is complete; incremental training on this basis can reduce the training time to the maximum (that is, the adjustment of the internal parameters of the model is the least). Incremental training has the lowest cost for model adjustment), then the user can set the earliest time segment to A natural days (that is, the first time segment is A natural days). In some embodiments, the first time segment can specifically be 3 natural days.

[0067] In this embodiment of the present invention, the initial call chain anomaly detection model is trained through a first acquisition step 12 and a first training step 13. Based on the initial call chain anomaly detection model, a second acquisition step 14 and a second training step 15 are performed. The second call chain information in the second call chain information set is used as an increment of training samples, and incremental (learning) training is used to iterate the initial call chain anomaly detection model. Incremental training refers to a learning system that continuously learns new knowledge from new samples while retaining most of the previously learned knowledge. Incremental training is very similar to the human learning model. As people grow, they learn and absorb new things every day, and learning occurs gradually. Furthermore, humans generally do not forget what they have learned. Because it does not require the storage of historical data, it reduces storage space usage. Furthermore, incremental training fully utilizes historical training results in current sample training, significantly reducing subsequent training time. This embodiment of the present invention utilizes incremental (learning) training to iterate the initial call chain anomaly detection model, shortening the time required to train the model and effectively improving model training efficiency.

[0068] The following is a detailed description of the technical effects of the embodiments of the present invention in combination with the actual measurement results:

[0069] Table 1 shows a comparison of the training results of different model training methods. The training information set is obtained from the call chain information of the monitored microservice system over the past seven days (tracing back seven natural days (7 × 24 hours) from the start of training). Based on this training information set, the call chain anomaly detection model is trained using various model training methods shown in Table 1. During the training process, the loss function of each model training method is the same. CFG, CPD, TraceCRL, and other existing call chain anomaly detection model methods are used, while TraceSieve is the incremental training-based training method for the call chain anomaly detection model according to an embodiment of the present invention. As shown in Table 1, compared with existing call chain anomaly detection model training methods, the present invention significantly reduces training time and improves training efficiency. Furthermore, it significantly outperforms existing call chain anomaly detection model training methods in terms of P (precision), R (recall), and F1 (F1-score). The present invention can train an anomaly detection model with high recognition accuracy for call chain anomalies.

[0070] Table 1 Comparison of training effects of different model training methods

[0071]

[0072] In an embodiment of the present invention, the first time period is divided into multiple time segments through step 11, and then through the first acquisition step 12 and the first training step 13, the first call chain information set is determined and the training of the initial call chain anomaly detection model is realized; further, through the second acquisition step 14 and the second training step 15, on the basis of obtaining the initial call chain anomaly detection model, the second call chain information in the second call chain information set is used as an increment of the training sample, and the incremental (learning) training method is adopted to realize the update iteration of the initial call chain anomaly detection model, which can shorten the time required for training the model and effectively improve the training efficiency of the model.

[0073] In some embodiments of the present invention, optionally,

[0074] The anomaly detection model is the graph variational autoencoder VGAE model.

[0075] The Graph Variational Autoencoder (VGAE) is a deep learning model for graph data. It combines the ideas of autoencoders and variational autoencoders (VAEs) for graph embedding and graph generation tasks. The main goal of VGAE is to map the nodes in the graph to a low-dimensional continuous vector space, thereby preserving the relationships between the nodes and the graph structure.

[0076] In the embodiment of the present invention, obtaining the first historical call chain information of the monitored microservice system generated in the first time segment may be performed by sampling. The sampling acquisition method is specifically described below with reference to an example:

[0077] See also Figure 2 As shown, Figure 2 This is a call chain diagram of the monitored microservice system, where: Figure 2 The left side shows the overall structure of the call request. The solid arrows and the dotted arrows both show the call process. For each microservice call request, there are two paired call processes. The call chain records the processing time of each service, as well as the execution time of the request and response. Figure 2 The right side shows detailed call chain information for two call chains: Execution 2 and Execution 8 of microservice C. This information includes trace ID, execution ID, parent ID, start time, end time, function name, and end service name. By analyzing this call chain information, users can identify anomalies and locate their root causes.

[0078] Each call chain contains time signatures (start time and end time). The start time indicates when the service sends the request, and the end time indicates when the service receives the response. Using these time signatures, we can calculate the service's processing time and waiting time during execution using the following formula:

[0079] PT(X)=ST(j)-ET(i)

[0080] WT(i)=ET(i)-ST(i)

[0081] Where X represents microservice X; PT(X) represents the execution time of microservice X; i is the calling process of microservice X; j is another calling process of microservice X relative to calling process i; ST(j) represents the start time of calling process j; ET(i) represents the end time of calling process i; ST(i) represents the start time of calling process i; WT(i) represents the waiting time of calling process i.

[0082] For example, in a specific calculation, it corresponds to Figure 2 The call chain information shown above can be calculated as follows:

[0083] PT(E)=ST(6)-ET(5)

[0084] WT(5)=ET(5)-ST(5)

[0085] Among them, ST(5) and ST(6) represent Figure 2 ET(5) represents the start time of calling process 5 and the start time of calling process 6 of microservice E, and ET(5) represents the end time of calling process 5. PT(E) represents the execution time of microservice E.

[0086] For each call chain, three types of features (processing time, call structure, and waiting time) are extracted to represent a call chain. The present invention introduces a call chain feature matrix (TFM), which is used to store the features extracted from the call chain. The execution time of each call chain is calculated according to the call path (for example: Figure 2 The order of the calling procedures 1 to 10 in the process is stored in the first dimension of the TFM matrix.

[0087] Furthermore, the waiting time of the call chain of each microservice is determined and stored in the second dimension of the TFM matrix in the same order as the execution time (i.e., the call path order).

[0088] The call structure is represented using a sparse matrix (also known as an adjacency matrix). In the adjacency matrix, the endpoint services in each call chain are stored in the order of the call path. During VGAE model training, when a call chain is converted into a call graph, each service acts as a node in the graph, and calls between two services correspond to non-zero elements in the adjacency matrix.

[0089] For example, see Figure 3A and Figure 3B As shown, Figure 3A To correspond to Figure 2 Schematic diagram of the TFM matrix of the call chain in , where waiting time is the waiting time and processing time is the execution time. For a microservice with multiple execution tasks, the microservice will have multiple execution times, distinguished by subscripts, for example: pT1(E), PT2(E), PT3(E). Figure 3B To correspond to Figure 2 Schematic diagram of the adjacency matrix of the call chain in , where the non-zero element 1 represents the call between two microservices.

[0090] See also Figure 4 As shown, Figure 4The following is a schematic diagram of the VGAE model architecture, where A represents the adjacency matrix of the call chain, F represents the TFM matrix of the call chain, and N represents the number of services involved in each call chain. In the encoder part, the embodiment of the present invention uses a graph convolutional neural network to encode A and F into hidden features Z. Subsequently, the hidden features are passed to the encoder to obtain the variational posterior distribution Afterwards, a fully connected network is used to decode the hidden features Z, convert the hidden features Z into node-level features, and use these node-level features to generate the reconstructed adjacency matrix and the reconstructed TFM matrix Reconstructed adjacency matrix and the reconstructed TFM matrix This is the call chain feature learned by the VGAE model.

[0091] In practical applications, the loss function is used to constrain the training of the VGAE model. The loss function of the VGAE model is as follows:

[0092]

[0093] in, is the encoder of the principal variational autoencoder (VAE); p θ (A|Z) is the decoder of the principal variational autoencoder (VAE); p θ (z) Learned RealNVP prior; for and p θ (z) KLD loss function; γ is a hyperparameter used to balance the KL divergence; for Relative p θ Cross entropy of (A|Z).

[0094] In an embodiment of the present invention, the first call chain information set is used to perform unsupervised training on the VGAE model. The VGAE model learns the characteristics (processing time, call structure and waiting time) of the first call chain information in the first call chain information set, realizes fine-grained feature learning, and is conducive to improving the recognition accuracy of the call chain anomaly detection model.

[0095] In some embodiments of the present invention, optionally, the first training step 13 includes:

[0096] Step a: Classify the call chains of the monitored microservice system according to the root node microservice, call chain depth, and microservices associated with the call chain;

[0097] Step b: Verify whether the first call chain information set includes information of all categories of call chains, and obtain a verification result;

[0098] Step c: If the verification result is information about call chains including all categories, continue to execute the first training step 13;

[0099] Step d: If the verification result is information that does not include call chains of all categories, send a division parameter setting instruction to the user terminal associated with the user; after receiving the division parameters sent by the user terminal, re-divide the second time segment according to the division parameters to obtain multiple new time segments, and return to the first acquisition step 12 until the verification result is information that includes call chains of all categories.

[0100] In actual applications, the distribution of call chain information is extremely uneven. Figure 5 As shown, Figure 5 This is a diagram of the number of nodes-number of call chains, where the number of nodes on the horizontal axis represents the number of microservice nodes in a call chain. Figure 5 It can be seen that the number of call chains at different nodes is unevenly distributed, and random sampling is very likely to miss some types of call chains. Using the first call chain information set with missing categories to train the call chain anomaly detection model will cause the initial call chain anomaly detection model to insufficiently learn features. Furthermore, in subsequent training, the initial call chain anomaly detection model will be unable to incrementally learn all categories of call chains, resulting in a low recognition accuracy rate for call chain anomalies by the call chain anomaly detection model obtained in the second training step 15.

[0101] To solve the above problem, the embodiment of the present invention performs steps a, b, c, and d before executing the first training step 13 to verify whether the first call chain information set includes information on call chains of all categories. If the verification result is that the information includes all categories of call chains, the first training step 13 is continued; if the verification result is that the information does not include all categories of call chains, a division parameter setting instruction is sent to the user terminal associated with the user; after receiving the division parameters sent by the user terminal, the second time segment is re-divided according to the division parameters to obtain multiple new time segments, and the first acquisition step 12 is returned until the verification result is that the information includes all categories of call chains. The embodiment of the present invention can ensure that the first call chain information set includes information on call chains of all categories, thereby ensuring that the initial call chain anomaly detection model fully learns the features; further, it ensures that the call chain anomaly detection model obtained in the second training step 15 has a high recognition accuracy rate for call chain anomalies.

[0102] In some embodiments of the present invention, optionally,

[0103] Acquiring historical call chain information generated in a first time segment according to a first quantity ratio to obtain a first call chain information set; and acquiring historical call chain information generated in a second time segment according to the first quantity ratio to obtain a second call chain information set;

[0104] The method for determining the first quantity ratio includes:

[0105] Classify the call chains of the monitored microservice systems according to the root node microservice, call chain depth, and microservices associated with the call chain;

[0106] The quantity ratio between the call chains of each category is determined as a first quantity ratio.

[0107] In an embodiment of the present invention, a first call chain information set is obtained by obtaining historical call chain information generated within a first time segment according to a first quantity ratio; and a second call chain information set is obtained by obtaining historical call chain information generated within a second time segment according to the first quantity ratio. In the process of obtaining historical call chain information, the embodiment of the present invention ensures that all categories of call chain information are obtained. In addition, the embodiment of the present invention also ensures that the quantity between each category of call chain data meets the first quantity ratio that matches the monitored microservice system, further fitting the actual application scenario of the anomaly detection model from the perspective of training samples, and further improving the recognition accuracy of the call chain anomaly detection model obtained in the second training step 15.

[0108] It should be noted that the embodiment of the present invention can be combined with the aforementioned embodiment (i.e., step a to step d). The aforementioned embodiment verifies whether the first call chain information set includes information on call chains of all categories and ensures that the first call chain information set includes information on call chains of all categories before executing the first training step 13; forming a double guarantee with the embodiment of the present invention, it can avoid the interference of accidental factors on training, ensure that the first call chain information set includes information on call chains of all categories, ensure that the initial call chain anomaly detection model fully learns the features, and ensure that the call chain anomaly detection model obtained in the second training step 15 has a high recognition accuracy rate for call chain anomalies. In addition, on the basis of double guarantees, the embodiment of the present invention starts from the dimension of ensuring that the number of call chain data of each category meets the first number ratio that matches the monitored microservice system, and further fits the actual application scenario of the call chain anomaly detection model from the perspective of training samples, which can achieve the technical effect of further improving the recognition accuracy of the call chain anomaly detection model obtained in the second training step 15.

[0109] The following is a detailed explanation with examples:

[0110] See also Figure 6 As shown, Figure 6This is a diagram of the call chain structure. The solid arrows indicate the corresponding call chain's wait time, and the rectangles indicate the microservice name and execution time. The root node span of the call chain corresponds to the microservice ali_geass_server, with a call depth of 6. Based on the microservice corresponding to the root node span, the call depth, and all the microservices in the call chain, a triple (ali_geass_server, 6, {ali_geass_server, ali_geass_pay, ...}) can be formed. The specific sampling process includes the following two parts: first, the sampling quantity is defined according to the overall number of call chains in the data set; then, the call chains are divided into different categories according to the classification method of triples (i.e., root node microservice, call chain depth and call chain-associated microservices) (i.e., equivalent to classifying the call chains of the monitored microservice system according to the root node microservice, call chain depth and call chain-associated microservices in the embodiment of the present invention), and the call chains of each category are sampled according to the ratio between the number of call chains in different categories (i.e., the first quantity ratio) (equivalent to obtaining the historical call chain information generated in the first time segment according to the first quantity ratio in the embodiment of the present invention to obtain the first call chain information set; and obtaining the historical call chain information generated in the second time segment according to the first quantity ratio to obtain the second call chain information set).

[0111] In some embodiments of the present invention, optionally,

[0112] The EWC loss function is used as the loss function for incremental training of the initial anomaly detection model.

[0113] In practical applications, continuous learning can lead to forgetting. Specifically, in the case of continuous learning, when a neural network is trained to learn a new task, it may forget the previously learned task because weight updates may cause the performance of the old task to degrade. Taking the embodiment of the present invention as an example, the call chain anomaly detection model trained in the second training step 15 forgets the old knowledge learned previously (for example, the old knowledge can be the parameters trained for the old task. The old knowledge can include: the knowledge learned in the first training step 13 (old task), which is gradually forgotten as continuous learning proceeds; the old knowledge can also include: the knowledge in the second call chain information set (old task) used for incremental training in the second training step 15, which is gradually forgotten as the model continuously learns the second call chain information set (new task) used for incremental training). It retains more new knowledge (the parameters trained for the new task) from the subsequent call chain set (new task) used for training. This forgetting problem can cause the call chain anomaly detection model trained in the second training step 15 to have low recognition accuracy. To improve recognition accuracy, users need to relearn the call chain anomaly detection model, which wastes time. This forgetting problem also reduces training efficiency.

[0114] EWC (Elastic Weight Consolidation) is a theory used to address the forgetting problem that occurs in continuous learning of neural networks. Its core idea is to add a regularization term to avoid excessive updates to parameters that are heavily correlated with old tasks, without requiring additional storage space or increasing model parameters. In the case of continuous learning, when a neural network is trained to learn a new task, it may forget the previously learned task because weight updates may cause performance on the old task to degrade. The goal of EWC is to protect the parameters of the old task when learning a new one to prevent forgetting. Based on this goal, EWC can be used for incremental training of models to minimize training time.

[0115] After using the EWC regularization method (i.e., using the EWC loss function as the loss function for incremental training of the initial anomaly detection model), when the old model is used to train new data, the model will not forget the knowledge learned from the old data. Figure 7 As shown in , after learning the first task (ie, the old task), the model parameters are If we take the gradient step size (corresponding to Figure 7 The arrow marked with “no penalty” in the figure will minimize the loss of task B, but destroy the knowledge learned from task A. Figure 7The arrow marked "L2" in the figure constrains each weight. The restriction imposed is too severe, and only task A can be remembered without learning task B. The EWC method can learn the knowledge of task B without having a big impact on the knowledge of task A (corresponding to Figure 7 The EWC loss function is expressed as follows:

[0116]

[0117] Among them, λ is a hyperparameter, usually set to 0.5; Parameters trained for the old task; θ i The parameters obtained by training for the current task; F i is the Fisher information matrix, which is used to evaluate the importance of parameters; L B (θ) is the loss function of the current task.

[0118] In an embodiment of the present invention, by adopting the EWC loss function as the loss function for incremental training of the initial anomaly detection model, the forgetting problem in incremental training can be effectively avoided, the recognition accuracy of the call chain anomaly detection model can be improved, and the training efficiency of the training method of the call chain anomaly detection model based on incremental training in an embodiment of the present invention can be improved.

[0119] In some embodiments of the present invention, optionally, step 16 is performed, followed by:

[0120] Step e: every second preset time period, obtaining the call chain data of the monitored microservice system in the second time period;

[0121] Step f: Obtain the call chain anomaly detection model with the smallest interval between the storage time and the current time from the server as the target model, and input the call chain data into the target model to obtain the anomaly score;

[0122] Step g: determining an anomaly score threshold of the anomaly score obtained this time, and determining whether the anomaly score exceeds the anomaly score threshold;

[0123] Step h: If the abnormal score threshold is exceeded, the monitored microservice is determined to be abnormal.

[0124] After completing model training, embodiments of the present invention can also periodically (at intervals of a preset second time period) perform anomaly detection on the monitored microservice system. In each detection, the latest call chain anomaly detection model (i.e., the call chain anomaly detection model with the smallest interval between the storage time and the current time obtained from the server is used as the target model) is used to detect the call chain data obtained in step e. Using the latest call chain anomaly detection model can effectively avoid the problem of newly generated abnormal calls in the monitored microservice system not being detected by the old anomaly detection model, thereby achieving high-accuracy detection.

[0125] In some embodiments of the present invention, optionally,

[0126] The P-value method was used to determine the anomaly score threshold, and the significance level parameter of the P-value in the P-value method was 0.001.

[0127] The P value is a parameter used to determine the results of a hypothesis test. It can also be used to compare different distributions using the critical region of the distribution. It was first proposed by R.A. Fisher.

[0128] The P value is the probability of a more extreme result than the sample observation occurring when the null hypothesis is true. A small P value indicates a low probability of the null hypothesis occurring. However, if the null hypothesis occurs, the principle of small probability provides reason to reject the null hypothesis. The smaller the P value, the stronger the reason for rejecting the null hypothesis. In short, the smaller the P value, the more significant the result. However, whether the test result is "significant," "moderately significant," or "highly significant" depends on the size of the P value and the actual problem.

[0129] In the embodiment of the present invention, the significance level parameter of the P value is 0.001, which means that 0.1% of the results are low-probability events. The significance level parameter of the P value is 0.001, which can ensure high-accuracy abnormality judgment.

[0130] The embodiment of the present invention provides a training device for a call chain anomaly detection model based on incremental training, see Figure 8 As shown, Figure 8 This is a principle block diagram of a training device for a call chain anomaly detection model based on incremental training according to an embodiment of the present invention. The training device 80 includes:

[0131] A division module 81 is used for a division step: dividing a preset first time period into a plurality of time segments;

[0132] Acquisition module 82 is configured to perform a first acquisition step: using the earliest time segment among all the time segments obtained in the current division as a first time segment; acquiring first historical call chain information of the monitored microservice system generated within the first time segment, and obtaining a first call chain information set based on the first historical call chain information;

[0133] A training module 83 is used for a first training step: using the first call chain information set to train a call chain anomaly detection model to obtain an initial call chain anomaly detection model;

[0134] The acquisition module 82 is further configured to perform a second acquisition step: using all time segments except the first time segment as second time segments; acquiring second historical call chain information of the monitored microservice system generated within the second time segments; and obtaining a set of second call chain information corresponding to each second time segment based on the second historical call chain information.

[0135] The training module 83 is further used in a second training step: performing incremental training on the initial call chain anomaly detection model using the second call chain information set to obtain the call chain anomaly detection model;

[0136] The execution module 84 is used to execute the step of storing the call chain anomaly detection model on the server.

[0137] In some embodiments of the present invention, optionally,

[0138] The anomaly detection model is a graph variational autoencoder (VGAE) model.

[0139] In some embodiments of the present invention, optionally,

[0140] The training module 83 is further configured to classify the call chains of the monitored microservice system according to the root node microservice, the call chain depth, and the microservices associated with the call chain;

[0141] The training module 83 is further configured to verify whether the first call chain information set includes information of all types of call chains, and obtain a verification result;

[0142] The training module 83 is further configured to continue executing the first training step if the verification result is information including call chains of all categories;

[0143] The training module 83 is also used to send a partition parameter setting instruction to a user terminal associated with the user if the verification result is information that does not include call chains of all categories; after receiving the partition parameters sent by the user terminal, re-divide the second time segment according to the partition parameters to obtain multiple new time segments, and return to the first acquisition step until the verification result is information that includes call chains of all categories.

[0144] In some embodiments of the present invention, optionally,

[0145] The acquisition module 82 is further configured to acquire historical call chain information generated within the first time segment according to a first quantity ratio to obtain a first call chain information set; and acquire historical call chain information generated within the second time segment according to the first quantity ratio to obtain a second call chain information set; wherein the method for determining the first quantity ratio includes:

[0146] Classify the call chains of the monitored microservice system according to the root node microservice, call chain depth, and microservices associated with the call chain;

[0147] The quantity ratio between the call chains of each category is determined to be the first quantity ratio.

[0148] In some embodiments of the present invention, optionally,

[0149] The training module 83 is further configured to use the EWC loss function as a loss function for incremental training of the initial anomaly detection model.

[0150] In some embodiments of the present invention, optionally,

[0151] The execution module 84 is further configured to obtain call chain data of the monitored microservice system within a preset second time period at intervals;

[0152] The execution module 84 is further configured to obtain the call chain anomaly detection model with the smallest interval between the storage time and the current time from the server as a target model, and input the call chain data into the target model to obtain an anomaly score;

[0153] The execution module 84 is further configured to determine an anomaly score threshold of the anomaly score obtained this time, and determine whether the anomaly score exceeds the anomaly score threshold;

[0154] The execution module 84 is further configured to determine that the monitored microservice is abnormal if the abnormality score threshold is exceeded.

[0155] In some embodiments of the present invention, optionally,

[0156] The execution module 84 is further configured to determine the abnormal score threshold using a P-value method, where the significance level parameter of the P-value in the P-value method is 0.001.

[0157] The training device of the call chain anomaly detection model based on incremental training provided by the embodiment of the present application can achieve Figures 1 to 7 The various processes implemented by the method embodiment achieve the same technical effect and are not described here again to avoid repetition.

[0158] An embodiment of the present invention provides an electronic device 90, see Figure 9 As shown, Figure 9 This is a principle block diagram of an electronic device 90 according to an embodiment of the present invention, which includes a processor 91, a memory 92, and a program or instruction stored in the memory 92 and executable on the processor 91. When the program or instruction is executed by the processor, the steps of the training method of the call chain anomaly detection model based on incremental training of the present invention are implemented.

[0159] An embodiment of the present invention provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the embodiments of the training method of the call chain anomaly detection model based on incremental training as described above are implemented, and the same technical effects are achieved. To avoid repetition, they are not described here. The readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0160] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are protected by the present invention.

Claims

1. A training method for a call chain anomaly detection model based on incremental training, characterized in that: include: Division step: dividing the preset first time period into multiple time segments; The first acquisition step: taking the earliest time segment among all the time segments obtained in this division as the first time segment; Acquire first historical call chain information of the monitored microservice system generated within the first time segment, and obtain a first call chain information set based on the first historical call chain information; A first training step: using the first call chain information set to train a call chain anomaly detection model to obtain an initial call chain anomaly detection model; A second acquisition step: taking all other time segments in the time segments except the first time segment as second time segments; Acquire second historical call chain information of the monitored microservice system generated within the second time segment, and obtain a second call chain information set corresponding to each second time segment according to the second historical call chain information; A second training step: performing incremental training on the initial call chain anomaly detection model using the second call chain information set to obtain the call chain anomaly detection model; Execution steps: storing the call chain anomaly detection model on the server; The first training step previously includes: Classify the call chains of the monitored microservice system according to the root node microservice, call chain depth, and microservices associated with the call chain; Verifying whether the first call chain information set includes information of all categories of call chains, and obtaining a verification result; If the verification result is information including call chains of all categories, continue to perform the first training step; If the verification result is information that does not include call chains of all categories, a division parameter setting instruction is sent to the user terminal associated with the user; after receiving the division parameters sent by the user terminal, the second time segment is re-divided according to the division parameters to obtain multiple new time segments, and the first acquisition step is returned until the verification result is information that includes call chains of all categories.

2. The training method according to claim 1, wherein: The anomaly detection model is a graph variational autoencoder (VGAE) model.

3. The training method according to claim 1 or 2, characterized in that: Acquiring historical call chain information generated in the first time segment according to a first quantity ratio to obtain a first call chain information set; and acquiring historical call chain information generated in the second time segment according to the first quantity ratio to obtain a second call chain information set; The method for determining the first quantity ratio includes: Classify the call chains of the monitored microservice system according to the root node microservice, call chain depth, and microservices associated with the call chain; The quantity ratio between the call chains of each category is determined to be the first quantity ratio.

4. The training method according to claim 1, characterized in that The EWC loss function is used as the loss function for incremental training of the initial anomaly detection model.

5. The training method according to claim 1, wherein: The execution steps then include: Every second preset time period, obtaining call chain data of the monitored microservice system within the second time period; Obtaining from the server the call chain anomaly detection model with the smallest interval between the storage time and the current time as a target model, and inputting the call chain data into the target model to obtain an anomaly score; Determining an anomaly score threshold of the anomaly score obtained this time, and determining whether the anomaly score exceeds the anomaly score threshold; If the abnormality score threshold is exceeded, it is determined that the monitored microservice is abnormal.

6. The training method according to claim 5, characterized in that: The anomaly score threshold is determined using the P-value method, where the significance level parameter of the P-value in the P-value method is 0.

001.

7. A training device for a call chain anomaly detection model based on incremental training, characterized in that: include: A division module, configured to divide the first preset time period into a plurality of time segments; An acquisition module, configured to: in a first acquisition step, take the earliest time segment among all the time segments obtained in this division as a first time segment; Acquire first historical call chain information of the monitored microservice system generated within the first time segment, and obtain a first call chain information set based on the first historical call chain information; A training module, configured for a first training step: training a call chain anomaly detection model using the first call chain information set to obtain an initial call chain anomaly detection model; The acquisition module is further configured to perform a second acquisition step: using all time segments except the first time segment as second time segments; acquiring second historical call chain information of the monitored microservice system generated within the second time segments; and obtaining a set of second call chain information corresponding one-to-one to each second time segment based on the second historical call chain information; The training module is further used in a second training step: performing incremental training on the initial call chain anomaly detection model using the second call chain information set to obtain the call chain anomaly detection model; An execution module is used to execute the steps of: storing the call chain anomaly detection model on a server; The training module is further used to classify the call chain of the monitored microservice system according to the root node microservice, the call chain depth and the microservices associated with the call chain; The training module is further configured to verify whether the first call chain information set includes information of all categories of call chains, and obtain a verification result; The training module is further configured to continue executing the first training step if the verification result is information including call chains of all categories; The training module is also used to send a division parameter setting instruction to a user terminal associated with the user if the verification result is information that does not include call chains of all categories; after receiving the division parameters sent by the user terminal, re-divide the second time segment according to the division parameters to obtain multiple new time segments, and return to the first acquisition step until the verification result is information that includes call chains of all categories.

8. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps in the training method of the call chain anomaly detection model based on incremental training are implemented as described in any one of claims 1 to 6.

9. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, which, when executed by a processor, implements the steps in the training method of the call chain anomaly detection model based on incremental training as described in any one of claims 1 to 6.

Images