Microservice call chain anomaly detection method based on Nested GNN and VAE

Abstract

The invention discloses a micro-service call chain anomaly detection method based on a Nested GNN and a VAE, and relates to the technical field of data processing. The method mainly comprises the steps of dividing an inner graph and an outer graph based on a call chain in a call chain data set; assigning an initial vector representation to nodes of each inner graph and each outer graph; a call chain reconstruction model based on the nested graph neural network and the variational auto-encoder is constructed, the call chain reconstruction model comprises an input layer, a graph structure layer, a sampling layer and a reconstruction layer, the graph structure layer comprises the nested graph neural network used as an encoder, and the reconstruction layer comprises a multi-layer perceptron used as a decoder; training the call chain reconstruction model by using the normal call chain data; to-be-detected call chain data are input into the call chain reconstruction model, if the reconstruction error exceeds a preset threshold range, the call chain is judged to be abnormal, and otherwise, the call chain is judged to be normal. According to the method, finer-grained service internal exceptions can be detected, and meanwhile, the accuracy of call chain exception detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a microservice call chain anomaly detection method based on Nested GNN and VAE. Background Art

[0002] In a microservice application system, the microservice call chain describes the entire process of a user's request going through multiple services and local calls within the service to complete the request. When the system encounters a failure, analyzing the abnormal situation in the call chain to identify and locate the source of the failure is crucial to ensure the stable operation of the system. This method has become an important direction of research and practice in the field of intelligent operation and maintenance. However, the call chain structure involved in a microservice application system is complex and large in scale, and it is very difficult to detect anomalies in the call chain. Splitting the call chain to simplify its structure is an effective way to reduce the complexity of the call chain structure and help improve the efficiency of call chain anomaly detection.

[0003] At present, the mainstream microservice call chain anomaly detection methods include statistics-based methods, traditional machine learning-based methods, and deep learning-based methods.

[0004] Microservice call chain anomaly detection method based on statistics. This type of method detects anomalies by analyzing historical data. It relies on specific assumptions and identifies data that does not conform to the assumptions as anomalies through statistical analysis. For example, call chain anomaly detection methods based on offline control flow graph (CFG), call path similarity (CPD) and response time distribution are all statistical methods. This type of method has the advantages of fast anomaly detection speed and strong interpretability. However, with the continuous increase in the number of microservices in the application system and the continuous improvement of system throughput (Transactions Per Second, TPS), the complexity of the microservice call process and the volatility of the response time also increase. In this case, the assumptions required for analysis based on statistical methods are increasingly difficult to adapt to the complex anomalies that occur in microservice application systems in dynamic and uncertain network environments.

[0005] Microservice call chain anomaly detection methods based on traditional machine learning. This type of method has gradually replaced the call chain anomaly detection methods based on statistics due to its automatic feature extraction, nonlinear modeling capabilities and better generalization capabilities. For example, some related studies use the Tree Edit Distance (TED) algorithm to compare the differences between call chains to detect call chain structural anomalies, use Principal Component Analysis (PCA) and Coefficient of Variation (CV) to mark abnormal microservices with large response time fluctuations, and use matrix sketches to detect anomalies in call chain tracking flows. These methods are all based on traditional machine learning. This type of method can automatically extract features from data and has the advantage of establishing nonlinear models. However, this type of method is sensitive to parameter settings and is more suitable for systems with stable structures and relatively simple functions. In microservice application systems with complex structures and rapid functional iterations, this type of method is often not very effective in anomaly detection.

[0006] Microservice call chain anomaly detection method based on deep learning. This type of method can process complex and high-dimensional data, has real-time processing capabilities, good adaptability and scalability, and has become a hot research direction in the field of intelligent operation and maintenance. For example, some related studies use deep Bayesian networks (DBN) to detect response time and call path anomalies, and use long short-term memory networks (LSTM) to fuse call chain response time and structural features to detect microservice anomalies. These methods are all based on deep learning. Most of the existing deep learning-based methods require vectorization of call chains, which may cause the loss of important structural information, thereby reducing anomaly detection performance. Therefore, some studies propose to use graph neural networks (GNN) to better learn the structural pattern of call chains. However, the current method of using graph neural networks is to input the entire call chain structure graph into the network to reconstruct the graph adjacency matrix, and then detect anomalies based on the reconstruction error. However, since the call chain structure graph is very large and the adjacency matrix is ​​extremely sparse, the model cannot accurately reconstruct the call chain data; in addition, directly inputting the entire call chain into the model will cause the model to lack effective learning of the local structural information within the service.

[0007] In summary, the current method of detecting anomalies in call chain data still has the following problems:

[0008] (1) The problem of low call chain reconstruction accuracy. Since the call chain structure graph is usually very large and the adjacency matrix is ​​extremely sparse, it is difficult for the model to accurately reconstruct the call chain data, resulting in low call chain reconstruction accuracy. When call chain anomaly detection is performed on this basis, the accuracy of anomaly detection will also be low.

[0009] (2) Insufficient extraction of local structural information within the service of the call chain. Directly inputting the entire call chain into the neural network for analysis often makes it difficult for the model to accurately capture and utilize the association relationship between local nodes within the service, making it difficult for the model to detect more fine-grained internal service anomalies, further affecting the accuracy of call chain anomaly detection. Summary of the invention

[0010] In view of the problems of low call chain reconstruction accuracy and insufficient extraction of local structural information of the call chain in the prior art, a microservice call chain anomaly detection method based on Nested GNN and VAE is provided. The present invention first divides the inner graph and the outer graph according to the call relationship between the nodes. Then, the Nested GNN and VAE models are used to learn the potential representation of the inner graph and the outer graph in the call chain, capture the node features and structural information of the inner graph and the outer graph, and reconstruct the graph structure of the inner graph and the outer graph in the call chain. Finally, the reconstruction error of the inner graph and the outer graph of the call chain is calculated, and the reconstruction error is regarded as the anomaly score to determine whether the call chain is abnormal. The present invention can detect more fine-grained internal service anomalies and improve the accuracy of call chain anomaly detection.

[0011] The technical means adopted by the present invention are as follows:

[0012] The present invention discloses a microservice call chain anomaly detection method based on Nested GNN and VAE, comprising the following steps:

[0013] Obtain a call chain data set, and divide the call chains in the call chain data set into an inner graph and an outer graph, wherein the inner graph is a graph formed by linking adjacent span nodes in the call chain that have a call relationship and belong to the same service according to the call relationship between the nodes, and the outer graph is a graph formed by merging an inner graph into a service node according to the service to which the node belongs, and linking the service nodes merged into the inner graph according to the call relationship between the microservices in the call chain;

[0014] Assign an initial vector representation to each node of the inner graph and the outer graph, wherein the vector representation includes four dimensions: execution time, waiting time, local execution time and relative start time;

[0015] Construct a call chain reconstruction model based on a nested graph neural network and a variational autoencoder, wherein the call chain reconstruction model includes an input layer, a graph structure layer, a sampling layer, and a reconstruction layer, wherein the graph structure layer includes a nested graph neural network used as an encoder, and the reconstruction layer includes a multi-layer perceptron used as a decoder;

[0016] Use normal call chain data to train the call chain reconstruction model and obtain the call chain anomaly score threshold;

[0017] The call chain data to be detected is input into the call chain reconstruction model. If the reconstruction error exceeds a preset threshold range, the call chain is determined to be abnormal, otherwise the call chain is determined to be normal.

[0018] Furthermore, the step of dividing the inner graph includes:

[0019] (1) Obtaining a tree structure of call chain data, and taking the root node of the tree structure as the current node;

[0020] (2) Construct an inner graph containing only the current node;

[0021] (3) Visit all subtrees that have not been visited by the current node in order from left to right. When a subtree is visited, take the root node of the current subtree as the current node and determine whether the serviceCode attribute information of the current node and its parent node are the same: if they are the same, add the current node to the inner graph where its parent node is located, and establish an edge between the parent node and the child node, and execute step (4); if they are not the same, execute step (2);

[0022] (4) Determine whether all nodes of the tree have been visited. If so, end; otherwise, continue to step (3).

[0023] Furthermore, the graph structure layer includes an inner layer, a nested layer and an outer layer;

[0024] The inner layer takes the adjacency matrix and node feature vector matrix of all inner graphs of the call chain as input, and updates all inner graph node feature vector matrices;

[0025] The nested layer provides a connection between the inner graph and the outer graph in the call chain, inputs the inner graph node feature vector matrix set generated by the inner layer and the initial outer graph node feature vector matrix, and obtains a new outer graph node feature vector matrix by performing pooling and merging operations;

[0026] The outer layer inputs the outer graph node feature vector matrix and the outer graph adjacency matrix updated by the nested layer, and outputs the final outer graph node feature vector matrix.

[0027] Furthermore, the inner layer takes the adjacency matrix and node feature vector matrix of all inner graphs of the call chain as input, and updates the feature vector matrix of all inner graph nodes including:

[0028] Use graph convolutional networks to learn the global and local structures of the inner graph and capture the node and structural information of the inner graph;

[0029] A graph attention network is used to dynamically assign weights to the relative importance of nodes in the inner graph, adaptively learn the importance of neighbors of each adjacent node, and capture the complex relationships between nodes.

[0030] Furthermore, the sampling layer uses the outputs of the inner and outer graph layers in the graph structure layer to construct hidden variables of all inner and outer graph nodes in the call chain, including:

[0031] Two GCN networks are used for the inner and outer graphs of the call chain to generate the latent variable distribution parameters of all inner and outer graph nodes;

[0032] The reparameterization technique is used to sample and obtain the latent variables of all inner and outer graph nodes.

[0033] Furthermore, the reconstruction layer reconstructs the adjacency matrix of the inner graph and the outer graph using the latent variables of the inner graph and the outer graph nodes obtained by the sampling layer, including:

[0034] Construct node pair representation vectors of all inner and outer graphs in the call chain;

[0035] The node pair representation vector is input into the multi-layer perceptron network to obtain the probability that an edge exists for each pair of nodes.

[0036] Furthermore, the call chain reconstruction model is trained, including: optimizing the model through the reconstruction error of the inner graph and the outer graph in the call chain and the KL divergence of the latent variable distribution; the reconstruction error is used to measure the difference between the reconstructed adjacency matrices; the KL divergence is used to measure the difference between the latent variable and the prior distribution.

[0037] Furthermore, obtaining the call chain anomaly score threshold includes the following steps:

[0038] After completing the training of the call chain reconstruction model, the call chain reconstruction error of the last training cycle is used as the abnormality score of each call chain;

[0039] The anomaly scores of all call chains in the training set are used to determine the threshold of the call chain anomaly score by the percentile method.

[0040] Aiming at the problem that it is difficult to perform structural modeling and anomaly detection on microservice call chains in microservice application systems due to their complex structure and large scale, the present invention proposes a microservice call chain anomaly detection method based on Nested GNN (Nested Graph Neural Network) and VAE (Variational Autoencoder). The method first links adjacent span nodes in the call chain that have a call relationship and belong to the same service according to the call relationship between the nodes to form an inner graph, merges an inner graph into a service node according to the service to which the nodes belong, and links the service nodes merged into the inner graph according to the call relationship between the microservices in the call chain to form an outer graph. Then, the Nested GNN and VAE models are used to learn the potential representation of the inner graph and the outer graph in the call chain, capture the node features and structural information of the inner graph and the outer graph, and reconstruct the graph structure of the inner graph and the outer graph in the call chain. Finally, the reconstruction error of the inner graph and the outer graph of the call chain is calculated, and the reconstruction error is regarded as an anomaly score to determine whether the call chain is abnormal.

[0041] Compared with the prior art, the present invention has the following advantages:

[0042] Using the invented method to detect anomalies in the call chain is beneficial to the extraction of local features of microservice local calls on the one hand, and can detect more fine-grained internal service anomalies; on the other hand, reconstructing the internal and external graphs of the call chain can effectively reduce the reconstruction error and improve the accuracy of call chain anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0044] Figure 1 This is a flow chart of a microservice call chain anomaly detection method based on Nested GNN and VAE in the present invention.

[0045] Figure 2 Schematic diagram of the call chain structure in an embodiment of the present invention.

[0046] Figure 3 This is a schematic diagram of the result of calling the chain inner graph and outer graph division in an embodiment of the present invention.

[0047] Figure 4 Schematic diagram of time-related features in an embodiment of the present invention.

[0048] Figure 5 This is the call chain reconstruction model architecture based on Nested GNN and VAE in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] The present invention proposes a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE. The method solves the problems of low call chain reconstruction accuracy and insufficient extraction of local structural information of the call chain. The flowchart of the method is as follows Figure 1 The specific steps are as follows:

[0051] Step 1: Divide each call chain in the call chain dataset into an inner graph and an outer graph.

[0052] A trace consists of multiple spans. A trace represents the complete processing of a transaction or request, and a span represents a service instance call in the processing. Figure 2 What is shown is a real call chain data structure, which is a tree structure, in which each node is a span. The serviceCode attribute of the span refers to the name of the service to which the span belongs, and the endpointName attribute of the span refers to an accessible path or operation of the service instance.

[0053] In the present invention, an inner graph refers to a graph formed by linking adjacent span nodes in a call chain that have a call relationship and belong to the same service according to the call relationship between the nodes; an outer graph refers to a graph formed by merging an inner graph into a service node according to the services to which its nodes belong and linking the service nodes merged into the inner graph according to the call relationship between the microservices in the call chain.

[0054] The present invention uses the idea of ​​pre-order traversal of a tree to divide the graph in the call chain, and the rules are as follows:

[0055] (1) Take the root node of the tree as the current node;

[0056] (2) Construct an inner graph containing only the current node;

[0057] (3) Visit all subtrees that have not been visited by the current node in order from left to right. When a subtree is visited, take the root node of the subtree as the current node and determine whether the serviceCode attribute information of the current node is the same as that of its parent node: if they are the same, add the node to the inner graph where its parent node is located, and establish an edge between the parent node and the child node, and execute step (4); if they are not the same, execute step (2).

[0058] (4) Determine whether all nodes of the tree have been visited. If so, end; otherwise, continue to step (3).

[0059] The outer graph division rules are as follows: merge an inner graph into a service node according to the services to which its nodes belong, and link the service nodes merged into an outer graph according to the call relationship between microservices in the call chain.

[0060] For example, Figure 2 In the example, ts-basic-service calls ts-train-service once and ts-station-service twice. The spans in each service form an inner graph, and ts-station-service is called twice, which is considered as two inner graphs. Figure 3 As shown, Figure 2 The call chain structure in the code constructs four inner graphs {a,b,c,d},{e,f,g,h},{i,j,k,o},{p,q,i,s} according to the link relationship between spans and the relationship between the services they belong to, and constructs an outer graph {ts-basic-service,ts-train-service,ts-station-service,ts-station-service} according to the call relationship between span services.

[0061] Step 2: Assign initial vectors to the inner graph nodes and outer graph nodes in the call chain.

[0062] Each node in the inner graph is a span, which records the call start time and call end time. Each node in the outer graph represents a microservice, and the call start time and call end time of the node are consistent with the call start time and call end time of the root span in the inner graph contained in the node. In order to better detect time-related anomalies, the following four time-related features can be derived from the two time records:

[0063] (1) Execution time: Indicates the execution time of a span or microservice.

[0064] (2) Waiting time: Indicates the time to wait for other operations or responses from other microservices.

[0065] (3) Local execution time: It indicates the time of local execution of the span or microservice itself, excluding waiting time.

[0066] (4) Relative start time: This indicates the difference between the call start time of the current span or microservice and the call start time of its root span or root microservice.

[0067] Figure 4 An example of computing time-related features is shown. In the figure, Node_a is the parent node of Node_b and Node_c, and Node_b is the parent node of Node_d. The timestamp axis also shows the call start timestamp and call end timestamp of each node. For Node_a, the execution time is t 8 -t 1 ; Waiting time is (t 5 -t 2 )+(t 7 -t 6 ), which is the sum of the execution time of Node_b and Node_c; the local execution time is (t 2 -t 1 )+(t 6 -t 5 )+(t 8 -t 7 ); the relative start time is 0, because Node_a is the root node; for Node_d, the execution time is t 4 -t 3 , the waiting time is 0, because the node does not call other nodes, and the local execution time is also t 4 -t 3 , the relative start time is t 3 -t 1 .

[0068] Step 3: Use the Nested GNN and VAE models to reconstruct the inner and outer graphs of the call chain.

[0069] The present invention proposes a call chain reconstruction model based on Nested GNN and VAE. The model uses the VAE model to reconstruct the call chain. The encoder uses the Nested GNN model, which can effectively capture the relationship between the nodes of the inner and outer graphs and the structural characteristics of the graph; the decoder uses the MLP model to reconstruct the adjacency matrix of the inner and outer graphs. Figure 5 shown.

[0070] Figure 5The call chain reconstruction model based on Nested GNN and VAE shown in the figure consists of four layers, namely, input layer, graph structure layer, sampling layer and reconstruction layer, in which the graph structure layer is further divided into three levels: inner layer, nested layer and outer layer.

[0071] (1) Input layer

[0072] Assume that the call chain set is T = {T 1 ,T 2 ,...,T i ,...,T Z},1≤i≤Z, where Z is the number of call chains, T i is the i-th call chain; let Indicates that chain T will be called i Divide into an outer graph G i and n inner graphs Where n is the number of inner graphs, and its size is similar to the outer graph G. i The number of nodes is the same.

[0073] exist Figure 5 In the call chain T i Input into the model, Among them A i and represents the adjacency matrix of the outer graph and the adjacency matrix of the jth inner graph, H i and Represents the node feature vector matrix of the outer graph and the node feature vector matrix of the jth inner graph. The input layer inputs the inner graph and the outer graph in the call chain into the model for subsequent reconstruction.

[0074] (2) Graph structure layer

[0075] 1) Inner layer

[0076] The inner layer takes the adjacency matrix and node feature vector matrix of all inner graphs of the call chain as input and updates the node feature vector matrices of all inner graphs.

[0077] First, the global and local structures of the inner graph are learned using a graph convolutional network (GCN) in the inner layer to capture the node and structural information of the inner graph. The present invention regards the call chain as an undirected graph, which can better capture the mutual influence relationship between nodes and is not limited to a single information transmission direction, which is conducive to the learning of GCN. The definition of GCN is shown in formula (1).

[0078]

[0079] Among them, H (l) represents the node feature vector matrix of the lth layer, H (l+1)represents the node feature vector matrix of the l+1th layer, The adjacency matrix A of the graph plus the identity matrix I is used to add self-loops to the adjacency matrix. represents a diagonal matrix, W (l) represents the weight matrix of the lth layer, which needs to be learned through training, and σ(.) represents the activation function.

[0080] Then, in the inner layer, Graph Attention Networks (GAT) is used to dynamically assign weights to the relative importance of the inner graph nodes, adaptively learn the importance of the neighbors of each adjacent node, and capture the complex relationship between nodes. The definition formula of GAT is shown in formula (2).

[0081] v r ′=∑ t∈N(r) a rt W r (2)

[0082] Among them, v r 、v t is the input feature vector of node r and node t, W represents the weight matrix to be learned, v r ′ is the output feature vector of node r, N(r) represents the set of neighbor nodes of node r, a rt is the normalized attention weight between node r and node t, and its calculation formula is shown in formula (3).

[0083]

[0084] Where W and Both represent learnable parameters, and LeakReLU(.) represents the activation function.

[0085] For the call chain T i , input the adjacency matrix and node feature vector matrix of all inner graphs in the call chain into the inner layer, and its input is and Indicates that represents the set of adjacency matrices of all inner graphs, Represents the set of feature vector matrices of all inner graph nodes, and finally outputs the updated set of feature vector matrices of inner graph nodes Specifically, the call chain T i The node eigenvector matrix of the jth inner graph in (where m represents the number of nodes in the inner graph, 1≤x≤m, and d represents the feature dimension of the inner graph nodes), input the inner layer to obtain a new node feature vector matrix Its calculation formula is shown in formula (4), where GAT inner (GCNinner (.)) represents the function of updating the eigenvector matrix of the internal graph nodes.

[0086]

[0087] exist Figure 5 In the call chain T i All images Input to the inner layer, update the inner graph node feature vector matrix, and get the new inner graph

[0088] 2) Nested layers

[0089] The nested layer provides the connection between the inner graph and the outer graph in the call chain. The inner graph node feature vector matrix set generated by the inner layer and the initial outer graph node feature vector matrix are input, and a new outer graph node feature vector matrix is ​​obtained by performing pooling and merging operations.

[0090] The nested layer performs two operations, namely pooling and merging. The pooling operation aggregates the feature vectors of all nodes in each inner graph into a single vector representing the global vector of the inner graph. i , the set of all inner graph node feature vector matrices After the pooling operation, the global vector matrix of all internal images is obtained in For the call chain T i Specifically, the call chain T i The node eigenvector matrix of the jth inner graph in After the pooling operation, the global vector is obtained The calculation formula is shown in formula (5), where Pooling avg (.) indicates average pooling.

[0091]

[0092] The merge operation merges the initial outer graph node feature vector with the corresponding inner graph global vector to obtain a new outer graph node vector. i , the global vector matrix ψ of all inner graphs and the feature vector matrix of the outer graph nodes (where n represents the number of nodes in the outer graph, 1≤j≤n, and D represents the feature dimension of the outer graph nodes) are merged to obtain a new outer graph node feature vector matrix Specifically, the call chain T i The feature vector of node j in the Chinese and foreign graphs and the corresponding j-th internal graph global vector After merging, we get the new external graph node feature vector The calculation formula is shown in formula (6), where Concat(.) represents the consolidation function.

[0093]

[0094] exist Figure 5 In the call chain T i The set of inner graph node feature vector matrices and the external graph node feature vector matrix H i Input to the nested layer, update the outer graph node feature vector matrix, and obtain the new outer graph G i ′.

[0095] 3) Outer layer

[0096] The outer layer inputs the outer graph node feature vector matrix and the outer graph adjacency matrix updated by the nested layer, and outputs the final outer graph node feature vector matrix. The architecture of the outer layer is as follows Figure 5 shown.

[0097] The outer layer also uses a combination of graph convolutional network and graph attention network. For specific formulas, refer to formula (1) and formula (2). i , the external graph node feature vector matrix H i ′ and the external graph adjacency matrix A i Input to the outer layer to obtain the final outer graph node feature vector matrix H i ″, the calculation formula is shown in formula (7), where GAT outer (GCN outer (.)) is used to represent the function of generating a new outer graph node feature vector matrix.

[0098] H i″ =GAT outer (GCN outer (A i ,H i′ )) (7)

[0099] exist Figure 5 In the call chain T i External image G i′ Input to the outer layer, update the outer graph node feature vector matrix, and get the final outer graph G i″ .

[0100] (3) Sampling layer

[0101] The sampling layer uses the outputs of the inner and outer graph layers in the graph structure layer to construct the hidden variables of all inner and outer graph nodes in the call chain.

[0102] First, two GCN networks are used for the inner and outer graphs of the call chain to generate the latent variable distribution parameters of all inner and outer graph nodes, namely the mean and standard deviation. Figure 5 In the sampling layer, the call chain T is constructed i The hidden variable distribution parameter of all inner and outer graph nodes in , that is, the mean Standard Deviation Where n all represents the sum of the number of nodes in all inner graphs, n represents the number of nodes in the outer graph, and f represents the size of the latent variable dimension. The calculation formula is shown in formula (8).

[0103]

[0104] Then, the reparameterization technique is used to sample the latent variables of all inner and outer graph nodes. Figure 5 In the sampling layer, the call chain T is generated i The latent variable matrix of all internal graph nodes in and the hidden variable matrix of the outer graph nodes The calculation formula is shown in formula (9), where ε 1 ,ε 2 ~N(0,1) is the noise matrix sampled from the standard normal distribution, and ⊙ represents the element-wise product.

[0105]

[0106] (4) Reconstruction layer

[0107] The reconstruction layer uses the latent variables of the inner and outer graph nodes obtained by the sampling layer to reconstruct the adjacency matrix of the inner and outer graphs.

[0108] First, we construct the node pair representation vectors of all inner and outer graphs in the call chain. Node pair representation means merging the latent variables of any two nodes in a graph into a representation vector. Specifically, for the call chain T i The jth inner graph in A set of node pairs r and t are obtained by merging the latent variables of these two nodes to obtain the node pair representation vector The calculation formula is shown in formula (10), where Indicates internal image The hidden variable of node r, Indicates internal image Hidden variables of node t.

[0109]

[0110] Then, the node pair representation vector is input into the MLP network to obtain the probability of the existence of an edge between each pair of nodes. MLP consists of multiple hidden layers and uses a nonlinear activation function ReLU. The last layer uses a Sigmoid function to ensure that the output value is between 0 and 1. The purpose of using MLP is to learn complex patterns from the representation of node pairs and map them to an output value that represents the probability of the existence of an edge between node pairs. Specifically, the node pair representation vector Input into the MLP network to get the inner graph The probability that there is an edge between node r and node t The calculation formula is shown in formula (11).

[0111]

[0112] exist Figure 5 In the call chain T i By calculating the probability that each pair of nodes in each inner graph and outer graph have an edge, we can get the outer graph reconstruction adjacency matrix A. i ′ and each inner graph reconstructs the adjacency matrix set

[0113] Step 4: Train and optimize the call chain reconstruction model.

[0114] During the model training process, the model is optimized by calling the reconstruction error of the inner and outer graphs in the chain and the KL divergence of the latent variable distribution. The specific loss function consists of two parts:

[0115] (1) Reconstruction error. It is used to measure the difference between the reconstructed adjacency matrices and is calculated using binary cross entropy loss. Formula (12) represents the sum of the reconstruction error losses of an external graph and n internal graphs in the call chain, where a j [rt] is the edge between node r and node t in the original adjacency matrix of the jth inner graph (1 if there is an edge, otherwise 0), A[rt] is the edge between node r and node t in the original adjacency matrix of the outer graph, and a j ′[rt] is the probability that there is an edge between node r and node t in the reconstructed adjacency matrix of the jth inner graph, and A′[rt] is the probability that there is an edge between node r and node t in the reconstructed adjacency matrix of the outer graph.

[0116]

[0117] (2) KL divergence. It is used to measure the difference between the latent variable and the prior distribution. Formula (13) is the calculation formula of the KL divergence of the call chain during the training process, where n all and n represents the sum of all inner graph nodes and outer graph nodes in the call chain, f represents the size of the hidden variable dimension, μ inner [pq] and σinner [pq] are the mean and standard deviation of the hidden variables of the pth node in all inner graph nodes in the qth dimension, μ outer [pq] and σ outer [pq] are the mean and standard deviation of the hidden variable of the p-th node in the outer graph in the q-th dimension.

[0118]

[0119] The comprehensive loss function of the model is the sum of the reconstruction error and the KL divergence, that is, L = L recon +L KL , and the model is trained by minimizing L on the training data. The data of the training set comes from the call chain information collected by the system under normal operation, and the Stochastic Gradient Descent (SGD) method is used to train the model on these data. The pseudo code description of the call chain reconstruction model training process based on Nested GNN and VAE is shown in Algorithm 1.

[0120]

[0121] Step 5: Determine the call chain anomaly score threshold based on the call chain reconstruction error

[0122] After completing the training of the call chain reconstruction model, the call chain reconstruction error of the last training cycle (epoch) is used as the anomaly score of each call chain. Then, the anomaly scores of all call chains in the training set are used to determine the threshold of the call chain anomaly score by the percentile method. The formula for determining the threshold is shown in formula (14), where θ represents the determined anomaly score threshold, P p (.) means taking the pth percentile in the anomaly score list, {s 1 ,s 1 ,...,s Z} represents the set of anomaly scores for all call chains in the training set, and p is the selected percentile (such as the 99% quantile), which allows a small amount of normal data to be misjudged, thereby ensuring that most anomaly data can be detected.

[0123] θ=P p ({s 1 ,s 1 ,...,s Z}) (14)

[0124] Step 6: Perform anomaly detection on the call chain based on the call chain reconstruction model and anomaly score threshold.

[0125] Input the call chain data into the trained call chain reconstruction model, and the model will output the corresponding call chain anomaly score. Then, compare the anomaly score of the call chain with the pre-set anomaly score threshold. If the anomaly score of the call chain is greater than the pre-set anomaly score threshold, it will be marked as an abnormal call chain; conversely, if the anomaly score does not exceed the anomaly score threshold, the call chain will be classified as a normal call chain.

[0126] The effectiveness of the method of the present invention is verified from two aspects. On the one hand, because the model used in the present invention belongs to the traditional VGAE (Variational Graph Auto-Encoders) model without dividing the call chain data into inner and outer graphs, the method of the present invention is experimentally compared with the method of call chain anomaly detection using the traditional VGAE model; on the other hand, three popular call chain anomaly detection methods are selected for experimental comparison with the method of the present invention. Both of them demonstrate the experimental results through three widely used evaluation indicators.

[0127] PyTorch is used to implement the model of the present invention, and then the model and the comparison model are trained on the server of RTX4060 GPU.

[0128] (1) Datasets and Experimental Evaluation Indicators

[0129] The present invention uses two data sets for evaluation. One is a public data set released by the 2022 AIOPs Challenge; the other is a call chain data set collected by this project team by deploying the TrainTicket system in a real ARM server cluster. This project team uses Kubernetes to deploy the TrainTicket system on a cluster consisting of 4 ARM servers, each with 32GB ARM and 8-core CPU, uses Apache SkyWalking as a distributed tracing system to collect call chains, and uses Elasticsearch to store call chains for analysis. In order to obtain abnormal call chains, nine types of faults are injected into the cluster using ChaosMesh. The specific fault types are shown in Table 1.

[0130] Table 1 Fault categories in the TrainTicket dataset

[0131]

[0132] The evaluation indicators used in the comparative experiments are precision, recall and F1-Score. These three indicators are usually used to evaluate the performance of classification models in binary or multi-classification tasks.

[0133] 1) Precision. Precision refers to the proportion of samples that are actually positive among all samples predicted by the system to be positive. It measures the ability of the model to predict positive samples. Its calculation formula is shown in formula (15), where TP represents true positive samples and FP represents false positive samples.

[0134]

[0135] 2) Recall. Recall refers to the proportion of samples that are actually positive that are correctly predicted as positive by the system. It measures the ability of the model to find all positive samples. Its calculation formula is shown in formula (16), where FN represents false negative examples.

[0136]

[0137] 3) F1-Score. The F1 score is the harmonic mean of precision and recall, which is used to comprehensively reflect the accuracy and robustness of the model. A higher F1 score indicates that the model performs better in these two aspects. Its calculation formula is shown in formula (17).

[0138]

[0139] (2) Comparative experiment

[0140] The effectiveness of the method of the present invention is verified from two aspects below.

[0141] 1) The method of the present invention is compared with the traditional VGAE method in the case of not dividing the call chain data into inner and outer graphs to perform a call chain anomaly detection experiment to verify whether dividing the call chain into inner and outer graphs can improve the accuracy of call chain anomaly detection. The experimental results are shown in Table 2.

[0142] Table 2 Experimental comparison between the method of the present invention and the traditional VGAE method

[0143]

[0144] It can be seen from the experimental results in Table 2 that the method of the present invention has very high precision, recall rate and F1 score in both data sets when the call chain is divided into inner graph and outer graph. The method using traditional VGAE achieves 100% precision on both data sets when the call chain is not divided into inner graph and outer graph, but the recall rate (41.14% and 77.82% respectively) and F1 score (58.30% and 87.53% respectively) are relatively low, indicating that the model regards a large number of normal call chains as abnormal call chains when the call chain is not divided into inner graph and outer graph, and the overall effect is not good. The experimental results confirm the effectiveness of dividing the call chain into inner graph and outer graph for call chain anomaly detection.

[0145] 2) Experimentally compare the call chain anomaly detection model of the present invention with three popular call chain anomaly detection models. The following three call chain anomaly detection methods are selected as comparison methods.

[0146] TraceAnomaly: It trains a variational autoencoder based model based on a sequence of service calls from a normal call chain.

[0147] TraceVAE: It performs unsupervised anomaly detection on call chains using a bivariate graph variational autoencoder based model.

[0148] GTrace: It uses a Tree-LSTM-based encoder and decoder model to detect structural anomalies in call chains; it uses a graph neural network-based encoder and MLP decoder to detect temporal anomalies in call chains.

[0149] Table 3 Experimental comparison of the call chain anomaly detection method of the present invention with other three methods

[0150]

[0151] The experimental results are shown in Table 3. The method of the present invention is named NTrace. It can be seen from the table that the accuracy (97.18% and 99.94% respectively) and F1 score (96.57% and 92.89% respectively) of NTrace on the two datasets are the highest compared with the other three methods, while the recall rate is lower than that of TraceAnomaly and GTrace methods on the TrainTicket dataset, and lower than that of TraceAnomaly, TraceVAE and GTrace methods on the AIOPs dataset. Overall, the method of the present invention is better than the other three methods in call chain anomaly detection on the TrainTicket and AIOPs datasets.

[0152] Experiments show that the method proposed in the present invention has obvious advantages in call chain anomaly detection and can effectively improve the performance of call chain anomaly detection.

[0153] Since the call chain can accurately reconstruct the user request path, the call chain is widely used to detect anomalies in distributed microservice systems. However, the current mainstream call chain-based anomaly detection method inputs the entire call chain into the graph neural network model for reconstruction, which often faces the problems of low reconstruction accuracy and insufficient extraction of local structural information inside the service, and no effective solution has been proposed. The present invention proposes a microservice call chain anomaly detection method based on Nested GNN and VAE, which divides the call chain into an inner graph and an outer graph, and then uses the Nested GNN and VAE model to learn the potential representation of the inner graph and the outer graph in the call chain, capture the node features and structural information of the inner graph and the outer graph, and reconstruct the graph structure of the inner graph and the outer graph in the call chain, effectively solving the problems of low call chain reconstruction accuracy and insufficient extraction of local structural information inside the service of the call chain. It can be seen from the experiment that the method of the present invention is not only significantly better than the traditional VGAE method, but also shows obvious advantages in comparison with the mainstream call chain anomaly detection method.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A microservice call chain anomaly detection method based on Nested GNN and VAE, characterized in that: The following steps are involved: Obtain a call chain data set, and divide the call chains in the call chain data set into an inner graph and an outer graph, wherein the inner graph is a graph formed by linking adjacent span nodes in the call chain that have a call relationship and belong to the same service according to the call relationship between the nodes, and the outer graph is a graph formed by merging an inner graph into a service node according to the service to which the node belongs, and linking the service nodes merged into the inner graph according to the call relationship between the microservices in the call chain; Assign an initial vector representation to each node of the inner graph and the outer graph, wherein the vector representation includes four dimensions: execution time, waiting time, local execution time and relative start time; Construct a call chain reconstruction model based on a nested graph neural network and a variational autoencoder, wherein the call chain reconstruction model includes an input layer, a graph structure layer, a sampling layer, and a reconstruction layer, wherein the graph structure layer includes a nested graph neural network used as an encoder, and the reconstruction layer includes a multi-layer perceptron used as a decoder; Use normal call chain data to train the call chain reconstruction model and obtain the call chain anomaly score threshold; The call chain data to be detected is input into the call chain reconstruction model. If the reconstruction error exceeds a preset threshold range, the call chain is determined to be abnormal, otherwise the call chain is determined to be normal.

2. According to claim 1, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE, characterized in that: The inner graph division step comprises: (1) Obtaining a tree structure of call chain data, and taking the root node of the tree structure as the current node; (2) Construct an inner graph containing only the current node; (3) Visit all subtrees that have not been visited by the current node in order from left to right. When a subtree is visited, take the root node of the current subtree as the current node and determine whether the serviceCode attribute information of the current node and its parent node are the same: if they are the same, add the current node to the inner graph where its parent node is located, and establish an edge between the parent node and the child node, and execute step (4); if they are not the same, execute step (2); (4) Determine whether all nodes of the tree have been visited. If so, end; otherwise, continue to step (3).

3. According to claim 1, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE, characterized in that: The graph structure layer includes an inner layer, a nested layer and an outer layer; The inner layer takes the adjacency matrix and node feature vector matrix of all inner graphs of the call chain as input, and updates all inner graph node feature vector matrices; The nested layer provides a connection between the inner graph and the outer graph in the call chain, inputs the inner graph node feature vector matrix set generated by the inner layer and the initial outer graph node feature vector matrix, and obtains a new outer graph node feature vector matrix by performing pooling and merging operations; The outer layer inputs the outer graph node feature vector matrix and the outer graph adjacency matrix updated by the nested layer, and outputs the final outer graph node feature vector matrix.

4. According to claim 3, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE is characterized in that: The inner layer takes the adjacency matrix and node feature vector matrix of all inner graphs of the call chain as input, and updates the feature vector matrix of all inner graph nodes including: Use graph convolutional networks to learn the global and local structures of the inner graph and capture the node and structural information of the inner graph; A graph attention network is used to dynamically assign weights to the relative importance of nodes in the inner graph, adaptively learn the importance of neighbors of each adjacent node, and capture the complex relationships between nodes.

5. According to claim 3, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE is characterized in that: The sampling layer uses the output of the inner and outer graph layers in the graph structure layer to construct hidden variables of all inner and outer graph nodes in the call chain, including: Two GCN networks are used for the inner and outer graphs of the call chain to generate the latent variable distribution parameters of all inner and outer graph nodes; The reparameterization technique is used to sample and obtain the latent variables of all inner and outer graph nodes.

6. According to claim 5, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE is characterized in that: The reconstruction layer reconstructs the adjacency matrix of the inner graph and the outer graph using the latent variables of the inner graph and the outer graph nodes obtained by the sampling layer, including: Construct node pair representation vectors of all inner and outer graphs in the call chain; The node pair representation vector is input into the multi-layer perceptron network to obtain the probability that an edge exists for each pair of nodes.

7. According to claim 1, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE, characterized in that: The call chain reconstruction model is trained, including: optimizing the model through the reconstruction error of the inner graph and the outer graph in the call chain and the KL divergence of the latent variable distribution; the reconstruction error is used to measure the difference between the reconstructed adjacency matrices; the KL divergence is used to measure the difference between the latent variable and the prior distribution.

8. According to claim 1, a method for detecting anomalies in a microservice call chain based on Nested GNN and VAE, characterized in that: The acquisition of the call chain anomaly score threshold includes the following steps: After completing the training of the call chain reconstruction model, the call chain reconstruction error of the last training cycle is used as the abnormality score of each call chain; The anomaly scores of all call chains in the training set are used to determine the threshold of the call chain anomaly score by the percentile method.

Images