Novel micro-service performance anomaly detection and root cause positioning system and method thereof

Abstract

The invention relates to the technical field of micro-service system operation and maintenance, and discloses a novel micro-service performance anomaly detection and root cause positioning system and method. The system is composed of a monitoring data aggregation module, a data preprocessing module, a call chain level anomaly detection module, a fine grit anomaly detection module, a root cause promotion module and a fault visualization module. According to the method, the control variable method is combined, the container features causing the call chain exception are judged step by step through normal value replacement, exception positioning is refined to the container level from the call chain level, more detailed exception positioning information is provided, and the beneficial effect of improving the accuracy and fineness of exception detection is achieved.

Description

Technical Field

[0001] The present invention relates to the field of microservice system operation and maintenance technology, and specifically to a novel system and method for detecting microservice performance anomalies and locating root causes. Background Art

[0002] Microservice architecture is a new software architecture style that advocates dividing a monolithic application into a group of small services (called microservices), each of which runs in an independent process. The advantages of microservices such as high cohesion, low coupling, high availability, and scalability have made multi-service application architecture gradually become the benchmark for IT application delivery.

[0003] However, the numerous and complex component interactions make it extremely difficult to find anomalies and locate their root causes in a large microservice cluster, and conventional anomaly detection and root cause location methods are not applicable in a microservice environment. On the one hand, the complexity of the microservice architecture makes the performance indicator monitoring data or log records extremely large, and the same microservice may exist in multiple call chains to execute different business logics, so that each microservice may have multiple normal performance indicator intervals or log templates. This makes it impossible to apply conventional anomaly detection methods to the microservice architecture. On the other hand, once an exception occurs in a microservice or underlying component, the exception will propagate in the call direction of the call chain, causing a large number of microservices to exhibit performance anomalies. However, these microservices that exhibit performance anomalies are not all the root causes of the failure. How to locate the root cause of the anomaly from the existing information is one of the difficulties in the automated operation and maintenance of microservice clusters. The current industrial methods have problems such as loss of call chain structure information, coarse root cause location granularity, and inapplicability to scenarios with low cross-rate of call chain trajectories, which are insufficient to solve the technical difficulties faced by microservice performance anomaly diagnosis in production environments. Summary of the invention

[0004] Technical issues solved:

[0005] In view of the deficiencies of the prior art, the present invention provides a novel system and method for microservice performance anomaly detection and root cause location, which has the advantages of improving the accuracy and precision of anomaly detection, realizing fine-grained anomaly location, providing comprehensive root cause location, visualizing fault propagation trajectories, adapting to complex production environments, and visualizing dynamic configuration and management, thereby solving the problems of the above-mentioned technologies.

[0006] Technical solution:

[0007] To achieve the above objectives, the present invention provides the following technical solutions: a novel system for microservice performance anomaly detection and root cause location, the system consisting of a monitoring data aggregation module, a data preprocessing module, a call chain level anomaly detection module, a fine-grained anomaly detection module, a root cause promotion module and a fault visualization module:

[0008] The monitoring data aggregation module is used to obtain the tracking data, performance indicators and logs of microservices through monitoring tools, and aggregate them into the database for unified storage;

[0009] The data preprocessing module is used to uniformly convert monitoring data of different types and structures into call event representation, and construct these call events and their relationships into a call chain tree diagram as a feature vector;

[0010] The call chain level anomaly detection module includes an unsupervised anomaly detection model (GAT-VAE) based on a graph attention network (GAT) and a variational autoencoder (VAE), which is used to perform anomaly detection on the call chain tree graph feature vector and locate the anomaly at the call chain level;

[0011] The fine-grained anomaly detection module uses a control variable method to detect whether the characteristics of each microservice container are abnormal on the abnormal call chain, and locates the anomaly from the call chain level to the container level;

[0012] The root cause promotion module constructs dependencies between components through a component dependency graph, and uses a voting mechanism to accurately promote container-level anomalies to the component level, thereby achieving global root cause positioning in the microservice architecture.

[0013] The fault visualization module visualizes the fault propagation trajectory and performance indicators through the front-end page of the system, providing detailed positioning basis for operation and maintenance personnel.

[0014] Preferably, the call chain level anomaly detection performs anomaly detection on the call chain tree diagram feature vector through the GAT-VAE model. GAT adopts the self-attention mechanism to fuse and extract the features of the call chain. The VAE encoder and decoder structure is used to learn the distribution of normal data features and measure data anomalies by reconstructing the probability.

[0015] Preferably, the fine-grained anomaly detection module detects whether each container feature in the abnormal call chain is abnormal by using a control variable method.

[0016] Preferably, the root cause promotion module constructs dependencies between components in the microservice architecture through a component dependency graph, uses a voting mechanism to promote container-level anomalies to the component level, and calculates anomaly scores of each component to achieve global root cause location.

[0017] Preferably, the fault visualization module displays the fault propagation trajectory and the timing diagram of the performance indicators through the front-end page, and provides the fault repair record collection and matching function.

[0018] Preferably, the data preprocessing module sorts and numbers all types of call chains in the database, the type number is recorded as R, the number of event nodes in the longest chain is recorded as L, and a feature matrix with a length of R+L-1 and all values ​​of -1 or 0 is used as a template. The feature matrix constructed above is filled into the template, and the first R bits of the template are the filling bits of the root node. The root node features in the feature matrix are filled into the corresponding sequence number positions according to the sequence numbers of the previous call chain type sorting. The L-1 position to the bottom R+L-1 position in the template are the filling positions of the remaining nodes. The node features in the feature matrix except the root node are filled into the remaining node filling bits in order, and the insufficient positions are filled with -1 or 0.

[0019] Preferably, in the fine-grained anomaly detection module, an unsupervised anomaly detection model is constructed by using a graph attention network and a variational autoencoder, and the unsupervised anomaly detection model training process is:

[0020] Reconstruction loss:

[0021]

[0022] Where: h i is the actual data of the i-th sample, μ' i and σ' i are the mean and standard deviation of the reconstructed data;

[0023] KL divergence:

[0024]

[0025] in: and is the mean and variance of the latent variable Z;

[0026] Total loss: Loss = RL + KL.

[0027] Preferably, the dependency relationship in the root cause promotion module is a dependency matrix (D):

[0028] D=[d iJ ]

[0029] Where: d ij 1 means component C i Depends on component C j , otherwise 0;

[0030] Container-level anomaly score A c: Obtained through fine-grained anomaly detection, this anomaly score is propagated to the component level, and the root cause is accurately located through the voting mechanism. Each component C i It will decide whether to report an exception based on its dependencies and exception propagation, using P i To represent component C i The abnormal probability is:

[0031] The exception propagation expression is:

[0032]

[0033] Where: P i It is component C i The abnormal probability of A j It is component C j The anomaly score of

[0034] The anomaly probabilities of all components are obtained by propagating anomaly scores from bottom to top, and the component with the highest anomaly probability is selected as the global root cause:

[0035] Select the component with the highest abnormal probability as the root cause:

[0036] C root =Sorted(S)

[0037] Where: S is the set of abnormal probabilities of all components.

[0038] Preferably, the fault propagation trajectory expression in the fault visualization module is:

[0039] T fault =(t1,t2,…,t n )

[0040] Where: T fault is the complete fault propagation trajectory, consisting of a series of time points t i composition.

[0041] A novel system and method for detecting microservice performance anomalies and locating root causes, wherein the method steps are as follows:

[0042] Step 1: Aggregate monitoring data: Obtain monitoring data such as tracking data, performance indicators, and logs of microservices through monitoring tools, and aggregate them into the database for unified storage;

[0043] Step 2: Data preprocessing: Convert the trace data, performance indicators and log data of different types and structures into call event representation, and construct the call chain tree diagram of these call events and their relationships as feature vectors;

[0044] Step 3: Call chain level anomaly detection: Use the GAT-VAE model to perform anomaly detection on the call chain tree graph feature vector, thereby locating the anomaly at the call chain level;

[0045] Step 4: Fine-grained anomaly detection: Use the control variable method to replace the abnormal call chain with normal values, and use the GAT-VAE model to gradually determine the container features that cause the call chain abnormality, thereby achieving fine-grained anomaly detection;

[0046] Step 5: Root cause promotion: Build the dependency relationship between microservice architecture components through the component dependency graph, and use the voting mechanism to accurately promote container-level exceptions to the component level from the bottom up, thereby achieving global root cause positioning of the microservice architecture;

[0047] Step 6: Fault visualization: Through the system's front-end page, the entire fault propagation trajectory and performance indicators are visualized to provide detailed positioning basis for operation and maintenance personnel.

[0048] Compared with the prior art, the present invention provides a novel system and method for detecting microservice performance anomalies and locating root causes, which has the following beneficial effects:

[0049] 1. The present invention combines the control variable method to gradually determine the container features that cause the call chain exception through normal value replacement, refines the exception location from the call chain level to the container level, provides more detailed exception location information, and achieves the beneficial effect of improving the accuracy and precision of exception detection.

[0050] 2. The present invention establishes dependency relationships between components through component dependency graphs and voting mechanisms, and can promote container-level exceptions to the component level from the bottom up, thereby realizing global root cause positioning of the microservice architecture, quickly and accurately finding the root causes of the exceptions, and achieving the beneficial effect of realizing fine-grained exception positioning.

[0051] 3. The present invention visualizes the fault propagation trajectory and performance indicators through the front-end page, provides detailed fault location clues and basis, and facilitates operation and maintenance personnel to quickly diagnose and handle abnormalities, achieving the beneficial effect of visualizing the fault propagation trajectory.

[0052] 4. The present invention is suitable for complex production environments by systematically monitoring, processing, detecting and locating microservice performance anomalies, can effectively reduce operation and maintenance costs and downtime, improve the stability and reliability of the microservice system, and achieve the beneficial effect of adapting to complex production environments.

[0053] 5. The present invention allows users to select monitoring data types, anomaly detection models and configure parameters on the front-end page, so as to conveniently and quickly check fault records and visualize fault propagation, thereby realizing dynamic configuration and management of the system, improving operation and maintenance efficiency, and achieving the beneficial effects of visualized dynamic configuration and management. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a schematic diagram of the overall flow chart of the system of the present invention;

[0055] Figure 2 This is a schematic diagram of the network structure diagram of the GAT-VAE anomaly detection model of the present invention;

[0056] Figure 3 It is a schematic diagram of a fine-grained anomaly detection algorithm based on control variables of the present invention;

[0057] Figure 4 This is a schematic diagram of the root cause generalization algorithm of the present invention;

[0058] Figure 5 This is a schematic diagram of the front-end configuration page of the system of the present invention;

[0059] Figure 6 This is a schematic diagram of the root cause location log page of the system of the present invention. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] See also Figure 1-6 This embodiment uses the Kubernetes microservice platform to detect microservice performance anomalies and locate root causes. The following steps are performed:

[0062] Monitoring tool deployment and configuration: Deploy SkyWalking and Istio monitoring tools and Prometheus database in the kubernetes microservice platform, and configure the fault location system on the front-end page. Figure 5 shown.

[0063] Monitoring data aggregation and processing: Monitoring data from different sources are aggregated uniformly, and different types of data are processed and converted to construct feature vectors. Heterogeneous data is uniformly converted into call event representations. For example, container A calling container B is represented as an event A->B, where the performance indicators, response time, and log monitoring data of this event are used as features. Multiple events are constructed as a call chain tree diagram as a feature vector by tracking the call information of the data. In order to make the constructed feature vector adapt to the multi-trace environment, the feature matrix and adjacency matrix constructed above are processed. First, all types of call chains in the platform are sorted and numbered, the number of types is recorded as R, and the number of event nodes in the longest chain is recorded as L. This paper uses a feature matrix with a length of R+L-1 and all values ​​of -1 or 0 as a template, and fills the above constructed feature matrix into the template. The first R bits of the template are the filling bits of the root node. The root node features in the above feature matrix are filled into the corresponding number position according to the sequence number of the previous call chain type sorting. The L-1 position to the bottom R+L-1 position in the template are the filling positions of the remaining nodes. The node features except the root node in the above feature matrix are filled into the remaining node filling positions in order, and the insufficient positions are filled with -1 or 0.

[0064] Anomaly detection: An unsupervised anomaly detection model is constructed by using graph attention network and variational autoencoder to detect anomalies in tree graphs. The model framework is as follows: Figure 2 As shown in the figure. The hidden layer of the GAT_VAE model uses the graph attention network (GAT) to fuse and extract the features of the call chain. GAT uses the self-attention mechanism to aggregate the features of each node and its adjacent nodes in the graph. The features of the two sub-chains are only aggregated at their root nodes, which eliminates many redundant associations and gives the model better fitting effects and faster convergence speed. The model learns the distribution of normal data features through the VAE encoder and decoder structure, and constructs a measure of data anomalies through reconstruction probability, thereby achieving accurate anomaly detection. During the training process, the regularization term (KL) and reconstruction loss (RL) are used to form the Loss function, thereby performing gradient descent.

[0065]

[0066] Loss=RL+KL

[0067] Fine-grained anomaly detection: The fine-grained anomaly detection algorithm of this system adopts the control variable method to replace normal variables to eliminate the influence of other features on the call chain, thereby realizing fine-grained anomaly detection. In general, the general process of the fine-grained anomaly detection algorithm is to restore the characteristics of all containers except one container (controlled variable, also called target container) in the call chain to their normal values ​​(the container previously determined by the algorithm to be normal does not need to be restored). The child nodes of the target container will affect their ancestor nodes (the ancestor nodes mentioned later all contain descendant nodes) due to the change of characteristic values, so this influence needs to be eliminated in the ancestor nodes. Finally, the restored call chain is re-input into the anomaly detection model to calculate the anomaly value of the call chain. If the anomaly value exceeds the given threshold, the target container is marked as abnormal. Set each container in the call chain as a controlled variable and repeat this process. Among them, the overall judgment is achieved by treating the entire branch as a node, thereby reducing many unnecessary judgments through pruning and improving the timeliness of the judgment of the entire system. Specifically, Figure 3 As shown in the figure, the location algorithm first recursively detects anomalies from the root node to the leaf node in the call chain tree diagram layer by layer. The algorithm divides each layer into two cases: single-node layer or multi-node layer. Figure 3 (a) shows the situation of a single node layer. The algorithm first detects the root node of the first layer as the target node to determine the possibility of an abnormality in the target node. To this end, the algorithm replaces the features of all descendant nodes of the target node with normal baseline values, and uses the median or mean of the microservice features at the corresponding position in the same call chain type within a period of time before the first detection of the abnormality as the normal baseline value. The algorithm then accumulates the difference between the response time of the child nodes of the target node and the normal value as the impact value P. The D set is the child nodes of the target node, and T i is the response time of node i, M i is the normal baseline value of node response time obtained by calculating the above average value. For example, Figure 3In (a), we detect whether the node "→A" is the factor that causes the call chain abnormality. First, replace the response time characteristics of the child nodes of the target node with normal baseline values. The response times of nodes "A→B" and "A→E" are 215 and 69, which are replaced by the normal baseline values ​​36 and 60 obtained by the above mean calculation. The impact value P is the sum of the differences between the response time of the two nodes and the normal baseline value, 188. Then, the target node and all its ancestor nodes eliminate the influence of the descendant nodes by subtracting the impact value of P. Finally, the replaced tree call chain feature vector is re-input into the anomaly detection model to calculate the anomaly value. The anomaly value is compared with the threshold to determine whether the target node is abnormal. If the target node is abnormal, add the container ID of its node and its anomaly value to the problem subset, and then modify the response time of the abnormal target node to the sum of its normal baseline value and the impact value P. The difference between the original response time and the modified response time of the abnormal target node is recorded as the impact value P. Ab , the ancestor nodes of the abnormal target node are all deducted from the influence value P Ab , the response time of other nodes is restored to the original value, and then enter the next layer. If the target node is not abnormal, all the nodes modified this time are restored to the original value and directly enter the next layer of detection. Figure 3 In the example (a), if the abnormal value of →A node detected by the model is lower than the threshold, then →A node is judged to be a normal node, and then all the nodes modified in the call chain tree diagram are restored to their original values ​​to enter the next layer. When there are multiple nodes in a layer, the algorithm uses each node in the layer as a subtree root node and performs detection on the subtree as the detection unit. The algorithm uses pruning to simplify the complexity of the algorithm. The algorithm checks each subtree in turn to see if there is an abnormality, such as Figure 3 (b) is shown. The detection method of multiple nodes is similar to that of single nodes, except that the detection target is expanded from a single node to a single subtree. It is constructed by replacing the response time of other subtrees outside the target subtree with the normal benchmark value and excluding the influence value P of the root nodes of other subtrees on their ancestor nodes. Among them, ST is the root node set of other subtrees. The algorithm accumulates the difference between the root node response time of the ST set and the normal benchmark value as the influence value P of its ancestor node. All ancestor nodes eliminate the influence of the subtree by subtracting the corresponding influence value P. The feature vector of the replaced tree call chain is re-input into the anomaly detection model, and the anomaly value is compared with the threshold to determine whether the target subtree is abnormal. If it is abnormal, the root node of the target subtree is used as the next single node layer for further detection, without restoring the feature values ​​of each node in the call chain. If there is no abnormality, the target subtree is skipped, that is, pruning. Figure 3The second layer of (b) has two subtrees. The subtrees are checked one by one, and the abnormal values ​​are obtained through the anomaly detection model for judgment. Subtree 2 is judged to be normal and subtree 1 is abnormal. The root node of the abnormal subtree is taken as the next single node layer for detection. The positioning algorithm presents a recursive structure as a whole. The abnormal microservice containers in each abnormal subtree are detected through the recursion of the subtrees, and the abnormalities at the call chain level are accurately detected at the container level.

[0068] Anomaly score calculation: This paper uses the spectrum method to calculate the anomaly score of the container. tf represents the number of times the target container appears in the problem set, N tp Indicates the number of times the target container appears in the normal call chain within the detection time window, N of Represents the total number of occurrences of other containers in the problem set that does not contain the target container.

[0069] The anomaly scores of all problem set containers are calculated using the Ochiai spectrum formula.

[0070]

[0071] Root cause promotion: The root cause promotion algorithm promotes container-level anomalies to the microservice or underlying component level. The algorithm first builds a cluster component graph and establishes the relationship between microservices, containers, and underlying components. Figure 4 As shown in the component diagram in the figure. The algorithm obtains relevant information by calling the API of the container management platform, such as Kuboardapi of Kubernetes. There are a large number of component relationships in the component diagram, such as microservices contain multiple container instances, containers are deployed on corresponding servers, there are dependencies between containers and their underlying supporting components, and external service interfaces accessed by containers. The algorithm uses the container anomaly score obtained in the root cause location algorithm and uses a voting mechanism to determine the components that may be abnormal. If an underlying component is abnormal, it will not only affect a single microservice, but also only some containers of these microservices may be abnormal. The algorithm assumes that each abnormal container has a set of associated components, such as the abnormal container belongs to a certain microservice, is deployed in a certain server, or depends on a certain underlying component (middleware, file I / O). The algorithm first constructs an abnormal component table through the component diagram, and then uses a voting mechanism to vote with the container anomaly score as the weight. Take the anomaly score of each abnormal container as the number of votes to vote for its associated components. After counting the votes of all abnormal containers in the problem set, the votes obtained by each component are calculated to obtain the final voting result. If the container does not exist in the problem set, the anomaly score is 0. The final component anomaly score of the component is obtained by averaging the votes. The component with the highest score is the component most likely to have problems. This effectively promotes anomaly location from the container level to the component level.

[0072] Fault visualization: When the positioning system locates a fault, the propagation trajectory of the fault will be visualized on the front-end page, and the performance indicator time series diagram of each container can be viewed. This provides a complete analysis of the fault for the operation and maintenance personnel, enhancing the credibility of the entire fault location. It also provides fault repair record collection and matching. Figure 6 As shown, the system will display the repair records of similar faults that have occurred before to the operation and maintenance personnel for their reference and repair.

[0073] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and alterations may be made to the embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A novel system for detecting and locating root causes of microservice performance anomalies, characterized in that: The system consists of a monitoring data aggregation module, a data preprocessing module, a call chain level anomaly detection module, a fine-grained anomaly detection module, a root cause promotion module, and a fault visualization module: The monitoring data aggregation module is used to obtain the tracking data, performance indicators and logs of microservices through monitoring tools, and aggregate them into the database for unified storage; The data preprocessing module is used to uniformly convert monitoring data of different types and structures into call event representation, and construct these call events and their relationships into a call chain tree diagram as a feature vector; The call chain level anomaly detection module includes an unsupervised anomaly detection model (GAT-VAE) based on a graph attention network (GAT) and a variational autoencoder (VAE), which is used to perform anomaly detection on the call chain tree graph feature vector and locate the anomaly at the call chain level; The fine-grained anomaly detection module uses a control variable method to detect whether the characteristics of each microservice container are abnormal on the abnormal call chain, and locates the anomaly from the call chain level to the container level; The root cause promotion module constructs dependencies between components through a component dependency graph, and uses a voting mechanism to accurately promote container-level anomalies to the component level, thereby achieving global root cause positioning in the microservice architecture. The fault visualization module visualizes the fault propagation trajectory and performance indicators through the front-end page of the system, providing detailed positioning basis for operation and maintenance personnel.

2. A novel microservice performance anomaly detection and root cause location system according to claim 1, characterized in that: The call chain level anomaly detection performs anomaly detection on the call chain tree diagram feature vector through the GAT-VAE model. GAT adopts the self-attention mechanism to fuse and extract the features of the call chain. The VAE encoder and decoder structure is used to learn the distribution of normal data features and measure data anomalies by reconstructing the probability.

3. A novel microservice performance anomaly detection and root cause location system according to claim 2, characterized in that: The fine-grained anomaly detection module detects whether each container feature in the abnormal call chain is abnormal by using a control variable method.

4. A novel microservice performance anomaly detection and root cause location system according to claim 3, characterized in that: The root cause promotion module constructs the dependency relationship between components in the microservice architecture through the component dependency graph, adopts a voting mechanism to promote container-level anomalies to the component level, and calculates the anomaly score of each component to achieve global root cause positioning.

5. A novel microservice performance anomaly detection and root cause location system according to claim 4, characterized in that: The fault visualization module displays the fault propagation trajectory and the timing diagram of the performance indicators through the front-end page, and provides the fault repair record collection and matching function.

6. A novel microservice performance anomaly detection and root cause location system according to claim 5, characterized in that: The data preprocessing module sorts and numbers all types of call chains in the database, the number of types is recorded as R, the number of event nodes in the longest chain is recorded as L, and a feature matrix with a length of R+L-1 and all values ​​of -1 or 0 is used as a template. The feature matrix constructed above is filled into the template. The first R bits of the template are the filling bits of the root node. The root node features in the feature matrix are filled into the corresponding sequence number positions according to the sequence numbers of the previous call chain type sorting. The L-1 position to the bottom R+L-1 position in the template are the filling positions of the remaining nodes. The node features except the root node in the feature matrix are filled into the remaining node filling bits in order, and the insufficient positions are filled with -1 or 0.

7. A novel microservice performance anomaly detection and root cause location system according to claim 6, characterized in that: In the fine-grained anomaly detection module, an unsupervised anomaly detection model is constructed by using a graph attention network and a variational autoencoder. The training process of the unsupervised anomaly detection model is as follows: Reconstruction loss: Where: h i is the actual data of the i-th sample, μ' i and σ' i are the mean and standard deviation of the reconstructed data; KL divergence: in: and is the mean and variance of the latent variable Z; Total loss: Loss = RL + KL.

8. A novel microservice performance anomaly detection and root cause location system according to claim 7, characterized in that: The dependency relationship in the root cause promotion module is a dependency matrix (D): D=[d ij ] Where: d ij 1 means component C i Depends on component C j , otherwise 0; Container-level anomaly score A c : Obtained through fine-grained anomaly detection, this anomaly score is propagated to the component level, and the root cause is accurately located through the voting mechanism. Each component C i It will decide whether to report an exception based on its dependencies and exception propagation, using P i To represent component C i The abnormal probability is: The exception propagation expression is: Where: P i It is component C i The abnormal probability of A j It is component C j The anomaly score of The anomaly probabilities of all components are obtained by propagating anomaly scores from bottom to top, and the component with the highest anomaly probability is selected as the global root cause: Build a global root cause list by sorting the anomaly probability from large to small: C root =Sorted(S) Where: S is the set of abnormal probabilities of all components.

9. A novel microservice performance anomaly detection and root cause location system according to claim 8, characterized in that: The fault propagation trajectory expression in the fault visualization module is: T fault =(t1,t2,…,t n ) Where: T fault is the complete fault propagation trajectory, consisting of a series of time points t i composition.

10. A novel method for detecting and locating the root cause of microservice performance anomalies, characterized in that: The method is used for the system according to claim 1, and the method steps are: Step 1: Aggregate monitoring data: Obtain monitoring data such as tracking data, performance indicators, and logs of microservices through monitoring tools, and aggregate them into the database for unified storage; Step 2: Data preprocessing: Convert the trace data, performance indicators and log data of different types and structures into call event representation, and construct the call chain tree diagram of these call events and their relationships as feature vectors; Step 3: Call chain level anomaly detection: Use the GAT-VAE model to perform anomaly detection on the call chain tree graph feature vector, thereby locating the anomaly at the call chain level; Step 4: Fine-grained anomaly detection: Use the control variable method to replace the abnormal call chain with normal values, and use the GAT-VAE model to gradually determine the container features that cause the call chain abnormality, thereby achieving fine-grained anomaly detection; Step 5: Root cause promotion: Build the dependency relationship between microservice architecture components through the component dependency graph, and use the voting mechanism to accurately promote container-level exceptions to the component level from the bottom up, thereby achieving global root cause positioning of the microservice architecture; Step 6: Fault visualization: Through the system's front-end page, the entire fault propagation trajectory and performance indicators are visualized to provide detailed positioning basis for operation and maintenance personnel.

Images