A cloud platform-related microservice fault warning method and device

Abstract

The present invention discloses a cloud platform associated microservice fault warning method and device, which relates to the field of cloud computing technology; aligning logs and indicator data in operating data according to timestamps to obtain data to be processed; obtaining cross-modal features in the data to be processed, calculating the cosine similarity between cross-modal features in different time periods, and performing anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data; adding positioning tags to abnormal data to obtain pre-processed data, performing a true-false screening operation to determine pseudo-data in the abnormal data; according to the positioning tags of the pseudo-data, the pseudo-data in the pre-processed data is eliminated to obtain target data and to issue an early warning. Adding positioning tags to abnormal data and performing true-false screening can eliminate pseudo-data, reduce false alarms and unnecessary waste of resources. The advantage of pseudo-data judgment is that it improves the accuracy of early warning, reduces the possibility of misjudgment, and enhances the stability and reliability of the microservice system.

Description

Technical Field

[0001] The present invention belongs to the technical field of cloud computing, and in particular relates to a cloud platform associated microservice fault early warning method and device. Background Art

[0002] The cloud platform is closely linked to microservices. By integrating and coordinating multiple small, independent service units, the cloud platform enables efficient and flexible application development and deployment. Each service in the microservice architecture can run, update, and expand independently, greatly improving the maintainability and scalability of the system, while the cloud platform provides the necessary resources and environment to support the rapid deployment and efficient management of these services. This connection not only optimizes the software development process, but also promotes continuous business innovation and rapid response to market demand.

[0003] The implementation of cloud platform-associated microservice fault warning mainly relies on a comprehensive monitoring and alarm system. The system collects and analyzes key performance indicators of microservices, such as response time, error rate, resource usage, etc., through comprehensive monitoring tools. Mechanisms such as health checks, real-time log management and analysis, and traffic parsing and tracking also play an important role, which together build a powerful fault detection and early warning system. When the monitoring system detects any abnormality or indicators that exceed the preset threshold, it will immediately trigger the alarm mechanism. Such a fault early warning system improves the stability and reliability of the microservice system.

[0004] Patent CN116450399B This invention proposes a method for fault diagnosis and root cause location of a microservice system. By constructing and training multiple anomaly detection models, a fault diagnosis model is constructed, and the causal relationship between fault nodes is learned to construct an anomaly propagation graph. This method uses a pre-training mechanism to select the model that is most suitable for detecting key anomalies for cascading, realizes fault diagnosis of real-time monitoring data, and locates the cause of the fault through anomaly propagation graphs and diagnosis results. The system operation data obtained does not take into account whether there is abnormal interference in the data, resulting in inaccurate results of model training and reduced efficiency of the detection system. Summary of the invention

[0005] The purpose of the present invention is to solve the problem that the system operation data obtained from the cloud platform associated microservices does not take into account whether there is abnormal interference in the data, resulting in inaccurate model training results and reduced detection system efficiency, and propose a cloud platform associated microservice fault warning method and device.

[0006] In a first aspect of the implementation of the present invention, a cloud platform associated microservice fault early warning method is first proposed, the method comprising:

[0007] Obtaining the operation data of the microservice system, and aligning the log and indicator data in the operation data according to timestamps to obtain the data to be processed;

[0008] Obtaining cross-modal features in the data to be processed, calculating cosine similarities between the cross-modal features in different time periods, and performing anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data;

[0009] Adding a positioning tag to the abnormal data to obtain preprocessed data, and performing a true-false screening operation on the preprocessed data to determine false data in the abnormal data;

[0010] The pseudo data in the preprocessed data is removed according to the positioning tag of the pseudo data to obtain the target data, and an early warning is issued if the target data exists.

[0011] Optionally, performing anomaly detection on the data to be processed corresponding to the cross-modal feature to obtain normal data and abnormal data, the method includes:

[0012] Input the data to be processed into a graph neural network model to capture spatial features, and then input the spatial features into a recurrent neural network to obtain temporal features;

[0013] Acquire cross-modal features in the temporal features and integrate data representations of different modalities;

[0014] The cosine similarity between cross-modal features in different time periods is calculated. If the cosine similarity in any time period is lower than the abnormal threshold, the data to be processed at the current moment is determined to be abnormal data.

[0015] Optionally, performing a true-false screening operation on the preprocessed data to determine a location label of the false data in the abnormal data, the method comprising:

[0016] The abnormal data is input into the channel attention branch and the spatial attention branch respectively to obtain a channel attention map and a spatial attention map, and the channel attention map and the spatial attention map are fused in series to obtain a target feature map;

[0017] Input the target feature map into the fl atten function, and convert the running data into a one-dimensional vector through the fl atten function;

[0018] Input the one-dimensional vector into a convolutional neural network model, and use the output of the neural network model as a probability vector; the probability vector corresponds to the input data one by one;

[0019] If the probability of the probability vector exceeds the true or false threshold, it is determined that the running data corresponding to the current probability vector belongs to the false data category.

[0020] Optionally, the method for confirming model parameters of the convolutional neural network model includes:

[0021] Obtaining historical training samples and historical actual samples as a model training set, and inputting the model training set into the convolutional neural network model for training;

[0022] The difference between the loss training sample and the actual sample is calculated by a cross entropy loss function, and the model parameters of the convolutional neural network model are determined according to the difference; the actual sample is the preset data used to compare the training sample during the model training process, and the actual sample corresponds to the training sample one by one;

[0023]

[0024] Where n is the number of training samples, m is the number of types of training samples, A represents the actual sample, and B represents the training sample.

[0025] Optionally, after issuing an early warning if the target data exists, the method further includes:

[0026] If the target data exists, fault location is performed;

[0027] Initialize a candidate causal graph by a greedy equivalent search algorithm, perform iterative search to optimize the candidate causal graph, and output a directed acyclic graph when a preset maximum number of iterations is reached;

[0028] Assigning an initial score to each abnormal node in the directed acyclic graph by using a graph centrality algorithm, and performing a weighted summation of any abnormal node and adjacent abnormal nodes in the directed acyclic graph to obtain a score;

[0029] According to the abnormal nodes whose scores exceed a preset threshold, the positions of the abnormal nodes in the abnormal distribution table are determined; the positions in the abnormal distribution table are fault location information in the microservice system.

[0030] In a second aspect of the present invention, a cloud platform-related microservice fault warning device is proposed, including: the device includes: a to-be-processed data module, an anomaly detection module, a true-false screening module and a warning module:

[0031] The to-be-processed data module is used to obtain the operating data of the microservice system, and align the log and indicator data in the operating data according to the timestamps to obtain the to-be-processed data;

[0032] The anomaly detection module is used to obtain the cross-modal features in the data to be processed, calculate the cosine similarity between the cross-modal features in different time periods, and perform anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data;

[0033] The authenticity screening module is used to add a positioning tag to the abnormal data to obtain pre-processed data, and perform an authenticity screening operation on the pre-processed data to determine the false data in the abnormal data;

[0034] The early warning module is used to remove the pseudo data in the pre-processed data according to the positioning tags of the pseudo data to obtain the target data, and to issue an early warning if the target data exists.

[0035] Optionally, the anomaly detection module includes: a feature capture module, a modality integration module and an abnormal data judgment module:

[0036] The feature capture module is used to input the data to be processed into the graph neural network model to capture spatial features, and then input the spatial features into the recurrent neural network to obtain temporal features;

[0037] The modality integration module is used to obtain cross-modality features in the time features and integrate data representations of different modalities;

[0038] The abnormal data judgment module is used to calculate the cosine similarity between cross-modal features in different time periods. If the cosine similarity in any time period is lower than the abnormal threshold, the data to be processed at the current moment is determined to be abnormal data.

[0039] Optionally, the authenticity screening module includes: a feature map fusion module, a feature map conversion module, a probability vector output module and an authenticity data judgment module:

[0040] The feature map fusion module is used to input the abnormal data into the channel attention branch and the spatial attention branch respectively to obtain a channel attention map and a spatial attention map, and to fuse the channel attention map and the spatial attention map in series to obtain a target feature map;

[0041] The feature map conversion module is used to input the target feature map into a fl atten function, and convert the operating data into a one-dimensional vector through the fl atten function;

[0042] The probability vector output module is used to input the one-dimensional vector into the convolutional neural network model, and use the output of the neural network model as the probability vector; the probability vector corresponds to the input data one by one;

[0043] The true or false data judgment module is used to determine that the running data corresponding to the current probability vector belongs to the false data category if the probability of the probability vector exceeds the true or false threshold.

[0044] Optionally, the probability vector output module includes: a model training module and a model parameter confirmation module:

[0045] The model training module is used to obtain historical training samples and historical actual samples as a model training set, and input the model training set into the convolutional neural network model for training;

[0046] The model parameter confirmation module is used to calculate the difference between the loss training sample and the actual sample through the cross entropy loss function, and determine the model parameters of the convolutional neural network model according to the difference; the actual sample is the preset data used to compare the training sample during the model training process, and the actual sample corresponds to the training sample one by one;

[0047]

[0048] Where n is the number of training samples, m is the number of types of training samples, A represents the actual sample, and B represents the training sample.

[0049] Optionally, the early warning module includes: a positioning confirmation module, a directed acyclic graph module, a node scoring module and a fault positioning module:

[0050] The positioning confirmation module is used to locate the fault if the target data exists;

[0051] The directed acyclic graph module is used to initialize the candidate causal graph through a greedy equivalent search algorithm, perform iterative search to optimize the candidate causal graph, and output the directed acyclic graph when a preset maximum number of iterations is reached;

[0052] The node scoring module is used to assign an initial score to each abnormal node in the directed acyclic graph through a graph centrality algorithm, and to obtain a score by performing a weighted summation on any abnormal node and adjacent abnormal nodes in the directed acyclic graph;

[0053] The fault location module is used to determine the position of the abnormal node in the abnormal distribution table according to the abnormal node whose score exceeds the preset threshold; the position in the abnormal distribution table is the fault location information in the microservice system.

[0054] Beneficial effects of the present invention:

[0055] The present invention proposes a cloud platform associated microservice fault warning method, which aligns the log and indicator data in the running data according to the timestamp to obtain the data to be processed; obtains the cross-modal features in the data to be processed, calculates the cosine similarity between the cross-modal features in different time periods, and performs anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data; adds positioning tags to the abnormal data to obtain pre-processed data, performs a true-false screening operation to determine the pseudo-data in the abnormal data; removes the pseudo-data in the pre-processed data according to the positioning tags of the pseudo-data to obtain the target data and issue an early warning. Adding positioning tags to the abnormal data and performing true-false screening can eliminate pseudo-data, reduce false alarms and unnecessary waste of resources. The advantage of pseudo-data judgment is that it improves the accuracy of early warning, reduces the possibility of misjudgment, and enhances the stability and reliability of the microservice system. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The present invention will be further described below in conjunction with the accompanying drawings.

[0057] Figure 1 A flowchart of a cloud platform-associated microservice fault warning method is provided for an embodiment of the present invention;

[0058] Figure 2 A structural schematic diagram of a cloud platform associated microservice fault warning device is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the present invention, the description of "first", "second", etc. is only used for descriptive purposes, and cannot be understood as indicating or implying its relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in the field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0060] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of the present invention.

[0061] The embodiment of the present invention provides a cloud platform associated microservice fault warning method. Figure 1 , Figure 1 A flowchart of a cloud platform-associated microservice fault warning method provided by an embodiment of the present invention. The method comprises the following steps:

[0062] S101, obtain the operation data of the microservice system, align the log and indicator data in the operation data according to the timestamp to obtain the data to be processed.

[0063] S102, obtaining cross-modal features in the data to be processed, calculating the cosine similarity between the cross-modal features in different time periods, and performing anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data.

[0064] S103, adding positioning tags to the abnormal data to obtain pre-processed data, and performing a true-false screening operation on the pre-processed data to determine the false data in the abnormal data.

[0065] S104, according to the positioning label of the pseudo data, the pseudo data in the pre-processed data is removed to obtain the target data, and an early warning is issued if the target data exists.

[0066] Based on a cloud platform-related microservice fault warning method provided by an embodiment of the present invention, by adding location tags to abnormal data and screening for authenticity, false data can be eliminated, reducing false alarms and unnecessary waste of resources. The advantage of false data judgment is that it improves the accuracy of warnings, reduces the possibility of misjudgment, and enhances the stability and reliability of the microservice system.

[0067] In one implementation, pseudo data means that the detection system can identify it but it actually has no impact on the system; for example, if the CPU utilization is abnormally high, but other related indicators such as memory usage are normal, then this abnormality is considered pseudo data. The identification and monitoring of pseudo data can reduce the possibility of misjudgment by the detection system, reduce energy consumption, and allocate limited system resources to appropriate places.

[0068] In one implementation, modality refers to different sources or types of data or information as a single data concept. For example, modalities include error logs, debugging information, access records, or CPU usage, memory usage, request response time, etc. Cross-modality is the integration of data or information of different modalities in order to understand the relationship between data. Cross-modality refers to a process or system that involves or integrates multiple different types of information modalities or sensory channels. In the field of machine learning and artificial intelligence, it generally involves integrating data from different modalities in order to build a system that can process and understand multiple types of inputs; the core of cross-modality is to integrate data or information from different modalities for unified processing and analysis, and to learn to focus on the implicit relationship between different modalities to improve the performance of the model.

[0069] In one implementation, during the abnormal data processing, a positioning tag is added to the abnormal data, and then a true-false screening operation is performed, and the pseudo data in the preprocessed data is eliminated based on the positioning tag of the pseudo data; in subsequent operations, the data processing is irreversible, resulting in the pseudo data being determined but not easily eliminated, and the positioning tag cannot be modified, which is conducive to eliminating the pseudo data after the true-false screening operation is performed.

[0070] In one implementation, the log and indicator data in the running data are aligned according to the timestamp to obtain the data to be processed, and the timestamp units or units of the log and indicator data are checked to see if they are consistent. If they are different, timestamp conversion is required. The date and time library or tool in the programming language can be used to implement timestamp parsing and conversion. By aligning the log and indicator data on the timestamp, the log data and indicator data can be linked on the same timeline, which makes it easier to identify abnormal patterns or related events in time, and helps to quickly discover system problems.

[0071] In one embodiment, step S102 includes:

[0072] The data to be processed is input into the graph neural network model to capture spatial features, and then the spatial features are input into the recurrent neural network to obtain temporal features.

[0073] Capture cross-modal features in temporal features and integrate data representations of different modalities.

[0074] The cosine similarity between cross-modal features in different time periods is calculated. If the cosine similarity in any time period is lower than the abnormal threshold, the data to be processed at the current moment is determined to be abnormal data.

[0075] In one implementation, in graph neural networks such as GCN and GAT, GCN is used to capture the spatial features of different variables, while GAT is used to analyze the semantic relationship between different logs; graph neural networks can effectively process graph structure data, and the dependency relationship between microservices can be represented as a graph structure. Through graph neural networks, complex spatial relationships between microservices can be captured, such as call relationships, dependency relationships, etc., and then the intimate features of the data can be identified, laying the foundation for subsequent processing.

[0076] In one implementation, log and indicator data in microservices are usually time series data, which contains information that changes over time. Through recurrent neural networks, such as time recursive neural networks, the changing trends of these spatial features over time, i.e., time features, can be captured. This helps to identify the evolution of faults in the time dimension, so as to more accurately locate the time and cause of the fault. Recurrent neural networks can also process variable-length sequence data and adapt to log and indicator sequences of different lengths in microservice systems.

[0077] In one implementation, the attention mechanism is used to obtain cross-modal features in temporal features and integrate data representations of different modalities. The attention mechanism calculates cross-modal interactive features from indicator data to logs and from logs to indicator data. This mechanism allows the model to interactively learn the high-level feature representation of another modality under the guidance of extracting hidden layer features of one modality data, thereby achieving effective fusion between different modal data; in addition, it also includes eliminating differences between modalities; indicators and logs provide information on different aspects of the system respectively. Indicators are usually quantitative and time series, while logs are qualitative and event-driven. Both data modalities play an important role in anomaly detection, but their differences may make it difficult for the model to accurately capture comprehensive information about the system status. Eliminating these differences helps the system to fuse indicator and log data and improve the accuracy of anomaly detection.

[0078] In one implementation, cosine similarity is measured by calculating the cosine value of the angle between two vectors, which can evaluate the stability and consistency of these features over time. If the cosine similarity in a certain time period is lower than the anomaly threshold, it indicates that the data in that time period is anomaly.

[0079] In one embodiment, step S103 includes:

[0080] The abnormal data are input into the channel attention branch and the spatial attention branch respectively to obtain the channel attention map and the spatial attention map. The channel attention map and the spatial attention map are fused in series to obtain the target feature map.

[0081] The target feature map is input into the fl atten function, and the running data is converted into a one-dimensional vector through the fl atten function.

[0082] The one-dimensional vector is input into the convolutional neural network model, and the output of the neural network model is used as the probability vector; the probability vector corresponds one-to-one to the input data.

[0083] If the probability of the probability vector exceeds the true or false threshold, it is determined that the running data corresponding to the current probability vector belongs to the false data category.

[0084] In one implementation, by introducing the channel attention branch and the spatial attention branch, the importance of data in different channels and spatial positions can be paid attention to respectively. This attention mechanism can highlight important features related to faults and increase the relevance of information; the target feature map obtained by merging the channel attention map and the spatial attention map in series can comprehensively consider the important information of the data in both channel and spatial dimensions. This fusion method enables the model to understand the characteristics of the data more comprehensively, which helps to more accurately identify and locate faults in microservices.

[0085] In one implementation, the fl atten function converts the target feature map into a one-dimensional vector for subsequent input into the convolutional neural network model. This conversion method retains all the information in the feature map while simplifying the input structure of the model, making it easier for the model to process and analyze data and improve operating efficiency.

[0086] In one implementation, the convolutional neural network model can automatically learn the feature representation of the data and output a probability vector that corresponds to the input data one by one. This probability vector can reflect the possibility that each running data point belongs to the pseudo data category, providing a basis for subsequent anomaly detection; by setting a true and false threshold, the probability value in the probability vector can be compared with the threshold to determine whether the running data corresponding to the current probability vector belongs to the pseudo data category. This determination method has clear boundaries and helps reduce the possibility of misjudgment.

[0087] In one embodiment, step S103 further includes:

[0088] Historical training samples and historical actual samples are obtained as model training sets, and the model training sets are input into the convolutional neural network model for training.

[0089] The difference between the loss training sample and the actual sample is calculated through the cross entropy loss function, and the model parameters of the convolutional neural network model are determined according to the difference; the actual sample is the preset data used to compare the training sample during the model training process, and the actual sample corresponds to the training sample one by one.

[0090]

[0091] Where n is the number of training samples, m is the number of types of training samples, A represents the actual sample, and B represents the training sample.

[0092] In one implementation, model training uses the correspondence between historical training samples and actual samples to enable the convolutional neural network model to learn and identify key features and patterns in the data. This process not only improves the model's prediction accuracy for new data, but also enhances its generalization ability, enabling the model to make reasonable predictions when faced with data in different scenarios. With sufficient training, the model can better adapt to complex and changing data environments, reduce the risk of overfitting, and thus improve overall performance.

[0093] In one implementation, during the model training process, the application of the cross entropy loss function can accurately measure the difference between the predicted probability distribution and the actual probability distribution, and determine the guidance direction for the optimization of the model, where the predicted probability distribution corresponds to the training sample and the actual probability distribution corresponds to the actual sample; the cross entropy loss function has a good gradient property, which helps the model to quickly converge to the optimal solution during the training process. It can also effectively handle unbalanced data sets, balance the contribution of different categories to the loss function by adjusting the category weights, and improve the model's recognition ability for minority categories.

[0094] In one embodiment, step S104 includes:

[0095] If the target data exists, fault location is performed.

[0096] The candidate causal graph is initialized through the greedy equivalent search algorithm, and the candidate causal graph is optimized by iterative search. When the preset maximum number of iterations is reached, a directed acyclic graph is output.

[0097] An initial score is assigned to each abnormal node in the directed acyclic graph through the graph centrality algorithm, and the score is obtained by weighted summing of any abnormal node and its adjacent abnormal nodes in the directed acyclic graph.

[0098] According to the abnormal nodes whose scores exceed the preset threshold, the position of the abnormal nodes in the abnormal distribution table is determined; the position in the abnormal distribution table is the fault location information in the microservice system.

[0099] In one implementation, initialization is performed first, and an empty graph is set as a candidate causal graph; all possible edges are added to the candidate causal graph, that is, all possible connections between microservices. Each edge represents a possible causal relationship. Perform iterative optimization, select an edge to add to the candidate causal graph, so that the causal relationship of the candidate causal graph after addition is optimal. Or delete an edge in the candidate causal graph, so that the causal relationship of the candidate causal graph after deletion is optimal. Stop the iteration until the preset maximum number of iterations is met, ensure that the algorithm converges within a limited number of steps, and update the candidate causal graph to a directed acyclic graph. In each iteration, it is necessary to ensure that the added edges do not cause loops to appear in the graph. Describes the fault propagation relationship between microservices.

[0100] In one implementation, for each abnormal node, the initial scores between any node and its adjacent abnormal nodes are weighted and summed to obtain a score. The weight can be determined based on the historical fault correlation and the degree of danger to the system. By weighted summing of adjacent abnormal nodes, a more accurate score can be obtained.

[0101] Based on the same inventive concept, the embodiment of the present invention also provides a cloud platform associated microservice fault warning device. Figure 2 , Figure 2 A schematic diagram of the structure of a cloud platform-related microservice fault warning device provided by an embodiment of the present invention includes: a data module to be processed, an anomaly detection module, a authenticity screening module and an early warning module:

[0102] The data module to be processed is used to obtain the operation data of the microservice system and align the log and indicator data in the operation data according to the timestamp to obtain the data to be processed;

[0103] The anomaly detection module is used to obtain cross-modal features in the data to be processed, calculate the cosine similarity between the cross-modal features in different time periods, and perform anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data;

[0104] A true-false screening module is used to add a positioning tag to the abnormal data to obtain pre-processed data, and perform a true-false screening operation on the pre-processed data to determine the false data in the abnormal data;

[0105] The early warning module is used to remove the pseudo data in the preprocessed data according to the location label of the pseudo data to obtain the target data, and issue an early warning if the target data exists.

[0106] Based on a cloud platform-related microservice fault warning device provided by an embodiment of the present invention, by adding location tags to abnormal data and screening for authenticity, false data can be eliminated, reducing false alarms and unnecessary waste of resources. The advantage of false data judgment is that it improves the accuracy of warnings, reduces the possibility of misjudgment, and enhances the stability and reliability of the microservice system.

[0107] In one embodiment, the anomaly detection module includes: a feature capture module, a modality integration module and an abnormal data judgment module:

[0108] The feature capture module is used to input the data to be processed into the graph neural network model to capture the spatial features, and then input the spatial features into the recurrent neural network to obtain the temporal features;

[0109] Modality integration module, used to obtain cross-modal features in temporal features and integrate data representations of different modalities;

[0110] The abnormal data judgment module is used to calculate the cosine similarity between cross-modal features in different time periods. If the cosine similarity in any time period is lower than the abnormal threshold, the data to be processed at the current moment is judged to be abnormal data.

[0111] In one embodiment, the authenticity screening module includes: a feature map fusion module, a feature map conversion module, a probability vector output module and an authenticity data judgment module:

[0112] The feature map fusion module is used to input the abnormal data into the channel attention branch and the spatial attention branch to obtain the channel attention map and the spatial attention map, and then fuse the channel attention map and the spatial attention map in series to obtain the target feature map;

[0113] The feature map conversion module is used to input the target feature map into the fl atten function, and convert the running data into a one-dimensional vector through the fl atten function;

[0114] The probability vector output module is used to input the one-dimensional vector into the convolutional neural network model and use the output of the neural network model as the probability vector; the probability vector corresponds to the input data one by one;

[0115] The true or false data judgment module is used to determine whether the running data corresponding to the current probability vector belongs to the false data category if the probability of the probability vector exceeds the true or false threshold.

[0116] In one embodiment, the probability vector output module includes: a model training module and a model parameter confirmation module:

[0117] A model training module is used to obtain historical training samples and historical actual samples as model training sets, and input the model training sets into the convolutional neural network model for training;

[0118] The model parameter confirmation module is used to calculate the difference between the loss training sample and the actual sample through the cross entropy loss function, and determine the model parameters of the convolutional neural network model according to the difference; the actual sample is the preset data used to compare the training sample during the model training process, and the actual sample corresponds to the training sample one by one;

[0119]

[0120] Where n is the number of training samples, m is the number of types of training samples, A represents the actual sample, and B represents the training sample.

[0121] In one embodiment, the early warning module includes: a location confirmation module, a directed acyclic graph module, a node scoring module and a fault location module:

[0122] A positioning confirmation module is used to locate the fault if the target data exists;

[0123] A directed acyclic graph module is used to initialize the candidate causal graph through a greedy equivalent search algorithm, perform iterative search to optimize the candidate causal graph, and output a directed acyclic graph when the preset maximum number of iterations is reached;

[0124] The node scoring module is used to assign an initial score to each abnormal node in the directed acyclic graph through the graph centrality algorithm, and to obtain a score by weighted summing of any abnormal node and its adjacent abnormal nodes in the directed acyclic graph;

[0125] The fault location module is used to determine the position of the abnormal node in the abnormal distribution table according to the abnormal node whose score exceeds the preset threshold; the position in the abnormal distribution table is the fault location information in the microservice system.

[0126] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A cloud platform-related microservice fault early warning method, characterized in that: The method comprises: Obtaining the operation data of the microservice system, and aligning the log and indicator data in the operation data according to timestamps to obtain the data to be processed; Obtaining cross-modal features in the data to be processed, calculating cosine similarities between the cross-modal features in different time periods, and performing anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data; Adding a positioning tag to the abnormal data to obtain preprocessed data, and performing a true-false screening operation on the preprocessed data to determine false data in the abnormal data; The pseudo data in the preprocessed data is removed according to the positioning tag of the pseudo data to obtain the target data, and an early warning is issued if the target data exists; Performing a true-false screening operation on the preprocessed data to determine a location label of the false data in the abnormal data, the method comprising: The abnormal data is input into the channel attention branch and the spatial attention branch respectively to obtain a channel attention map and a spatial attention map, and the channel attention map and the spatial attention map are fused in series to obtain a target feature map; Input the target feature map into a flatten function, and convert the operating data into a one-dimensional vector through the flatten function; Input the one-dimensional vector into a convolutional neural network model, and use the output of the neural network model as a probability vector; the probability vector corresponds to the input data one by one; If the probability of the probability vector exceeds the true or false threshold, it is determined that the running data corresponding to the current probability vector belongs to the false data category.

2. A cloud platform-associated microservice fault early warning method according to claim 1, characterized in that: Performing anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data, the method comprising: Input the data to be processed into a graph neural network model to capture spatial features, and then input the spatial features into a recurrent neural network to obtain temporal features; Acquire cross-modal features in the temporal features and integrate data representations of different modalities; The cosine similarity between cross-modal features in different time periods is calculated. If the cosine similarity in any time period is lower than the abnormal threshold, the data to be processed at the current moment is determined to be abnormal data.

3. A cloud platform-associated microservice fault early warning method according to claim 1, characterized in that: The model parameter confirmation method of the convolutional neural network model includes: Obtaining historical training samples and historical actual samples as a model training set, and inputting the model training set into the convolutional neural network model for training; The difference between the loss training sample and the actual sample is calculated by the cross entropy loss function, and the model parameters of the convolutional neural network model are determined according to the difference; the actual sample is the preset data used to compare the training sample during the model training process, and the actual sample corresponds to the training sample one by one; Where n is the number of training samples, m is the number of types of training samples, A represents actual samples, and B represents training samples.

4. A cloud platform-associated microservice fault early warning method according to claim 1, characterized in that: After issuing an early warning if the target data exists, the method further includes: If the target data exists, fault location is performed; Initialize a candidate causal graph by a greedy equivalent search algorithm, perform iterative search to optimize the candidate causal graph, and output a directed acyclic graph when a preset maximum number of iterations is reached; Assigning an initial score to each abnormal node in the directed acyclic graph by using a graph centrality algorithm, and performing a weighted summation of any abnormal node and adjacent abnormal nodes in the directed acyclic graph to obtain a score; According to the abnormal nodes whose scores exceed a preset threshold, the positions of the abnormal nodes in the abnormal distribution table are determined; the positions in the abnormal distribution table are fault location information in the microservice system.

5. A cloud platform-related microservice fault warning device, characterized in that: The device comprises: a data module to be processed, an anomaly detection module, a true and false screening module and an early warning module: The to-be-processed data module is used to obtain the operation data of the microservice system, and align the log and indicator data in the operation data according to the timestamps to obtain the to-be-processed data; The anomaly detection module is used to obtain the cross-modal features in the data to be processed, calculate the cosine similarity between the cross-modal features in different time periods, and perform anomaly detection on the data to be processed corresponding to the cross-modal features to obtain normal data and abnormal data; The authenticity screening module is used to add a positioning tag to the abnormal data to obtain pre-processed data, and perform an authenticity screening operation on the pre-processed data to determine the false data in the abnormal data; The early warning module is used to remove the pseudo data in the pre-processed data according to the positioning tag of the pseudo data to obtain the target data, and issue an early warning if the target data exists; The authenticity screening module includes: a feature map fusion module, a feature map conversion module, a probability vector output module and an authenticity data judgment module: The feature map fusion module is used to input the abnormal data into the channel attention branch and the spatial attention branch respectively to obtain a channel attention map and a spatial attention map, and to fuse the channel attention map and the spatial attention map in series to obtain a target feature map; The feature map conversion module is used to input the target feature map into a flatten function, and convert the operating data into a one-dimensional vector through the flatten function; The probability vector output module is used to input the one-dimensional vector into the convolutional neural network model, and use the output of the neural network model as the probability vector; the probability vector corresponds to the input data one by one; The true or false data judgment module is used to determine that the running data corresponding to the current probability vector belongs to the false data category if the probability of the probability vector exceeds the true or false threshold.

6. A cloud platform associated microservice fault early warning device according to claim 5, characterized in that: The anomaly detection module includes: a feature capture module, a modality integration module and an abnormal data judgment module: The feature capture module is used to input the data to be processed into the graph neural network model to capture spatial features, and then input the spatial features into the recurrent neural network to obtain temporal features; The modality integration module is used to obtain cross-modality features in the time features and integrate data representations of different modalities; The abnormal data judgment module is used to calculate the cosine similarity between cross-modal features in different time periods. If the cosine similarity in any time period is lower than the abnormal threshold, the data to be processed at the current moment is determined to be abnormal data.

7. A cloud platform associated microservice fault early warning device according to claim 5, characterized in that: The probability vector output module includes: a model training module and a model parameter confirmation module: The model training module is used to obtain historical training samples and historical actual samples as a model training set, and input the model training set into the convolutional neural network model for training; The model parameter confirmation module is used to calculate the difference between the loss training sample and the actual sample through the cross entropy loss function, and determine the model parameters of the convolutional neural network model according to the difference; the actual sample is the preset data used to compare the training sample during the model training process, and the actual sample corresponds to the training sample one by one; Where n is the number of training samples, m is the number of types of training samples, A represents actual samples, and B represents training samples.

8. A cloud platform associated microservice fault early warning device according to claim 5, characterized in that: The early warning module includes: a positioning confirmation module, a directed acyclic graph module, a node scoring module and a fault positioning module: The positioning confirmation module is used to locate the fault if the target data exists; The directed acyclic graph module is used to initialize the candidate causal graph through a greedy equivalent search algorithm, perform iterative search to optimize the candidate causal graph, and output the directed acyclic graph when a preset maximum number of iterations is reached; The node scoring module is used to assign an initial score to each abnormal node in the directed acyclic graph through a graph centrality algorithm, and to obtain a score by performing a weighted summation on any abnormal node and adjacent abnormal nodes in the directed acyclic graph; The fault location module is used to determine the position of the abnormal node in the abnormal distribution table according to the abnormal node whose score exceeds the preset threshold; the position in the abnormal distribution table is the fault location information in the microservice system.

Images