Microservice anomaly detection method, device, equipment and medium

Abstract

The embodiment of the invention discloses a micro-service anomaly detection method and device, equipment and a medium. The method comprises the following steps: acquiring multi-modal data of a micro-service system; wherein the multi-modal data comprises index data, log data and call chain data; determining multivariate fusion features according to the index data, the log data and the call chain data; and inputting the multivariate fusion features into an anomaly detection model to obtain an anomaly detection result of the micro-service system. According to the technical scheme, the multi-modal data features are extracted and fused to be input into the anomaly detection model, automatic micro-service anomaly detection can be achieved, and the accuracy of micro-service anomaly detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a microservice anomaly detection method, device, equipment and medium. Background Art

[0002] As the number and scope of microservices increase, the operating environment and service dependencies become more complex, making management and operation more difficult. Faced with cloud-native environments with huge amounts of data, complex operating environments, and numerous monitoring indicators, traditional operation and maintenance methods that rely on manual experience can no longer meet business requirements, and artificial intelligence for IT operations (AIOps) has emerged. In order to ensure the reliability of cloud-native systems, microservice fault detection needs to be performed based on monitoring data.

[0003] At present, microservice systems are usually detected based on collected log data or specific indicator data. However, for some resource-based faults, the log data in the microservice system will not show abnormalities, and for some business-based faults, the indicator data will not show abnormalities. However, existing algorithms cannot comprehensively process different types of data and can only systematically mine scattered information from heterogeneous data such as text and numbers. However, this method of using single-dimensional data for fault detection cannot accurately detect fault problems in microservice systems. Summary of the invention

[0004] The present invention provides a microservice anomaly detection method, device, equipment and medium, which can realize automated microservice anomaly detection and improve the accuracy of microservice anomaly detection by extracting and integrating multimodal data features into an anomaly detection model.

[0005] According to one aspect of the present invention, a microservice anomaly detection method is provided, comprising:

[0006] Obtain multimodal data of the microservice system; wherein the multimodal data includes indicator data, log data, and call chain data;

[0007] Determine a multi-dimensional fusion feature according to the indicator data, the log data, and the call chain data;

[0008] The multi-dimensional fusion features are input into the anomaly detection model to obtain an anomaly detection result of the microservice system.

[0009] According to another aspect of the present invention, a microservice anomaly detection device is provided, comprising:

[0010] A data acquisition module, used to acquire multimodal data of the microservice system; wherein the multimodal data includes indicator data, log data and call chain data;

[0011] A feature determination module, used to determine a multi-dimensional fusion feature according to the indicator data, the log data and the call chain data;

[0012] The anomaly detection module is used to input the multi-dimensional fusion features into the anomaly detection model to obtain an anomaly detection result of the microservice system.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the microservice anomaly detection method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the microservice anomaly detection method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains multimodal data of a microservice system; wherein the multimodal data includes indicator data, log data, and call chain data; determines multivariate fusion features according to the indicator data, the log data, and the call chain data; and inputs the multivariate fusion features into an anomaly detection model to obtain an anomaly detection result of the microservice system. This technical solution can realize automated microservice anomaly detection and improve the accuracy of microservice anomaly detection by extracting and integrating multimodal data features and inputting them into an anomaly detection model.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flow chart of a microservice anomaly detection method provided according to Embodiment 1 of the present invention;

[0022] Figure 2 This is a flow chart of a microservice anomaly detection method provided according to Embodiment 2 of the present invention;

[0023] Figure 3 This is a structural example diagram of an anomaly detection model provided according to Embodiment 2 of the present invention;

[0024] Figure 4 2 is a schematic diagram of the structure of a microservice anomaly detection device provided according to Embodiment 3 of the present invention;

[0025] Figure 5 It is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 This is a flowchart of a microservice anomaly detection method provided according to the first embodiment of the present invention. This embodiment is applicable to the case of detecting a microservice system. The method can be executed by a microservice anomaly detection device. The microservice anomaly detection device can be implemented in the form of hardware and / or software. The microservice anomaly detection device can be configured in an electronic device with data processing capabilities. Figure 1As shown, the method includes:

[0030] S110. Obtain multimodal data of the microservice system.

[0031] Among them, multimodal data includes indicator data, log data and call chain data. The microservice architecture of the microservice system is composed of multiple microservices written in different languages, and users access the entire system through the front-end microservice. To realize a certain function, not only does the front-end service need to call a certain microservice, but it may also require mutual calls between microservices, and the call chain data records the calling process. Each microservice has corresponding container monitoring, and the deployed virtual machine also has corresponding monitoring data, and each indicator is recorded by indicator data. Log data records events that occur at every moment, such as POST and GET requests sent between microservices, and records the calling process from the HTTP protocol level. In this embodiment, multimodal data refers to data from multiple different types or sources. In the field of data analysis and artificial intelligence, the fusion of multimodal data can provide more comprehensive information and help improve the accuracy and depth of analysis.

[0032] Among them, indicator data may refer to various key performance indicator data generated during the operation of each service in the microservice architecture. These data are crucial for monitoring the health status, performance and troubleshooting of the system. Indicator data mainly include business indicators and performance indicators. Log data is important data that records the process events generated by the microservice system, and plays an important role in the operation and maintenance, monitoring, troubleshooting and optimization of the system. Call chain data is usually collected and visualized through distributed tracking systems (such as Zipkin, Jaeger, SkyWalking, etc.). In this embodiment, there are many tools and systems for end-to-end link tracking in distributed applications, such as Dapper, Pinpoin and EagleEye, which can accurately record the call links between services.

[0033] In this embodiment, multimodal operation and maintenance data of microservices deployed on the Kubernetes platform can be obtained. The multimodal data can be composed of three parts: indicator data, log data, and call chain data.

[0034] S120: Determine multi-dimensional fusion features according to indicator data, log data, and call chain data.

[0035] The multi-element fusion feature can be obtained by fusing the feature extracted from the indicator data, log data and call chain data. In this embodiment, the corresponding feature data can be extracted from the indicator data, log data and call chain data respectively, and then the extracted feature data can be fused to obtain the corresponding multi-element fusion feature.

[0036] S130: Input the multi-element fusion features into the anomaly detection model to obtain an anomaly detection result of the microservice system.

[0037] Among them, the anomaly detection model can be a pre-trained neural network model, which can be used to detect whether there is an abnormality in the state of the microservice system. The anomaly detection model in this embodiment can be a convolutional long short-term memory neural network (Convolutional LSTM Network, ConvLSTM). The anomaly detection result can be a normal or abnormal detection result. The anomaly detection model in this embodiment can include at least an input layer, a convolutional layer, and a long short-term memory network layer. The anomaly detection result can be a binary classification result, which can be normal or abnormal.

[0038] In this embodiment, the fused multivariate fusion features can be input into a pre-trained anomaly detection model, so that each convolutional layer and long short-term memory network layer included in the anomaly detection model is processed to output the anomaly detection result of the corresponding microservice system.

[0039] The technical solution of the embodiment of the present invention obtains multimodal data of a microservice system; wherein the multimodal data includes indicator data, log data, and call chain data; determines multivariate fusion features based on the indicator data, log data, and call chain data; and inputs the multivariate fusion features into an anomaly detection model to obtain an anomaly detection result of the microservice system. This technical solution can realize automated microservice anomaly detection and improve the accuracy of microservice anomaly detection by extracting and integrating multimodal data features and inputting them into an anomaly detection model.

[0040] Embodiment 2

[0041] Figure 2 This is a flowchart of a microservice anomaly detection method provided in accordance with the second embodiment of the present invention. This embodiment is optimized based on the above embodiment. The specific optimization is: determining multi-dimensional fusion features based on indicator data, log data, and call chain data, including: extracting features from indicator data, log data, and call chain data, respectively, to obtain indicator time series features, log time series features, and call chain time series features; fusing indicator time series features, log time series features, and call chain time series features to obtain multi-dimensional fusion features. Figure 2 As shown, the method includes:

[0042] S210. Obtain multimodal data of the microservice system.

[0043] Among them, multimodal data includes indicator data, log data and call chain data.

[0044] S220 , extract features from the indicator data, log data, and call chain data respectively to obtain indicator time series features, log time series features, and call chain time series features.

[0045] Among them, the indicator time series feature can be obtained by extracting business indicators and performance indicators from indicator data and processing them to obtain the corresponding indicator time series feature. The log time series feature can be obtained by extracting the corresponding log template and log parameters from each log data and processing them to obtain the corresponding log time series feature. The call chain time series feature can be obtained by extracting public information from the call chain data and processing them to obtain the corresponding call chain time series feature.

[0046] In this embodiment, business indicator characteristics and performance indicator characteristics can be extracted from the indicator data to determine the corresponding indicator timing characteristics, corresponding log parameter characteristics can be extracted from the log data to obtain the corresponding log timing characteristics, and public information can be extracted from the call chain data for processing to obtain the corresponding call chain timing characteristics.

[0047] In this embodiment, optionally, feature extraction is performed on the indicator data, log data and call chain data respectively to obtain indicator timing features, log timing features and call chain timing features, including: extracting business indicator features and performance indicator features from the indicator data, and determining the indicator timing features based on the business indicator features and the performance indicator features; wherein the business indicator features are characterized by time information; using a log parsing algorithm to extract log semantic features from each log data, and determining the log semantic features as log timing features; extracting public information and time information from the call chain data, and determining the call chain timing features based on the public information and the time information.

[0048] Among them, the business indicator feature may refer to the business indicator of the microservice state. In this embodiment, the business indicator feature is represented by time information, and specifically may be represented by the average response time of the business. In this embodiment, the business indicator feature of the microservice state may be represented by selecting the average response time. The performance indicator feature may refer to the performance indicator of the microservice characteristic. In this embodiment, the performance indicator of the microservice characteristic may be represented by selecting KPI indicators at various levels.

[0049] In this embodiment, the average response time can be selected as the business indicator feature of the microservice status, the KPI indicators at each level can be selected as the performance indicator features of the microservice characteristics, and the business indicator features and the performance indicator features can be determined as indicator time series features.

[0050] Among them, the log data carries timestamp information. In this embodiment, each log data has its corresponding time information. The log parsing algorithm can be any algorithm for parsing the log, and it can be any algorithm that can extract the semantic features of the log, and this embodiment is not limited to this. Exemplarily, the Spell log parsing method can be used in this embodiment. The Spell log parsing method is an online streaming log parsing technology based on the longest common subsequence (LCS). It is mainly used to parse unstructured log messages into structured log types and parameters to facilitate log analysis and processing.

[0051] In this embodiment, the specific method of extracting log semantic features from each log data using the log parsing algorithm is to use the Spell log parsing method to extract the log template and log parameters of each log message. TF-IDF semantic features are extracted for the log template; TF-IDF includes two parts: term frequency TF and inverse document frequency IDF; TF refers to the frequency of a word appearing in a document, and IDF refers to the frequency of a word appearing in the entire corpus, and the formula is as follows:

[0052] TFIDF = TF × IDF;

[0053]

[0054] Wherein, n represents the number of times the current word appears in the log template, N represents the total number of words in the log template, M represents the total number of log templates, and m represents the number of log templates containing the current word. In this embodiment, the determined log semantic features can be used as log temporal features.

[0055] Among them, public information usually refers to information in the call chain data that can remain unchanged across multiple services or requests. Time information records information such as the timestamp and time consumed by each service to process the request.

[0056] In this embodiment, the call chain data can be processed by extracting common information to form a template. Different types of sub-chains can be classified, the number of occurrences of different types of sub-chains can be counted by minute, and the average processing time can be calculated to extract common information and time information. After extracting the common information and time information, the various timing features of the call chain can be further determined to obtain the call chain timing features.

[0057] Through such a setting in this embodiment, the time series features of multimodal data can be extracted separately, so as to more comprehensively reflect the key information at all levels of the microservice system.

[0058] S230: Perform fusion processing according to the indicator time series features, the log time series features, and the call chain time series features to obtain a multi-dimensional fusion feature.

[0059] The fusion processing may be simple splicing, weighting or combination processing, etc. In this embodiment, the indicator time series features, log time series features and call chain time series features may be aligned according to the time sequence, and then the indicator time series features, log time series features and call chain time series features corresponding to each time sequence may be spliced ​​to obtain the spliced ​​multivariate fusion features.

[0060] In this embodiment, optionally, a fusion process is performed based on the indicator timing features, log timing features and call chain timing features to obtain a multi-dimensional fusion feature, including: using a sliding window method to align the indicator timing features, log timing features and call chain timing features on the time axis and then perform a fusion process to obtain a multi-dimensional fusion feature.

[0061] Among them, Sliding Window is an algorithm commonly used to process data streams, time series data, or array / list data. It can process data by defining a fixed-size window on the data and sliding the window on the data.

[0062] In this embodiment, the sliding window size and sliding step size can be set to determine the current sliding window, and then the indicator time series features, log time series features, and call chain time series features are aligned on the time axis and spliced ​​to obtain the multi-dimensional fusion features corresponding to each time series moment.

[0063] Through such a setting in this embodiment, by integrating the time series characteristics of the three modes, it is possible to more comprehensively reflect the key information at all levels of the microservice system, reveal the complex characteristics between time series, and thus improve the accuracy and robustness of anomaly detection.

[0064] S240: Input the multi-element fusion features into the anomaly detection model to obtain an anomaly detection result of the microservice system.

[0065] In this embodiment, optionally, the anomaly detection model includes an input layer, a convolutional layer, and a long short-term memory network layer.

[0066] Among them, the input layer can be used to input data. The convolution layer can be used to perform convolution processing on the data input by the input layer. The long short-term memory network layer (LSTM layer) can be composed of multiple long short-term memory modules, which can be used to enhance the expression and learning capabilities of the long short-term memory network layer, so that it can better handle sequence data tasks with multivariate fusion features.

[0067] In addition, in this embodiment, the initial convolutional long short-term memory neural network model (Convolutional LSTM Network, ConvLSTM) can be trained by taking the historical multivariate fusion features as the input of the model until a convolutional long short-term memory neural network model that meets the requirements, that is, an anomaly detection model, is obtained.

[0068] In this embodiment, optionally, the multivariate fusion features are input into the anomaly detection model to obtain the anomaly detection result of the microservice system, including: obtaining the multivariate fusion features of the current moment through the input layer, encoding the spatiotemporal information of the multivariate fusion features through the convolution layer and the long short-term memory network layer to obtain the multivariate fusion features of the next moment; and determining the anomaly detection result of the microservice system according to the multivariate fusion features of the next moment.

[0069] Among them, the multivariate fusion feature at the current moment can be understood as the multivariate fusion feature before the current processing moment. The multivariate fusion feature at the next moment can be the multivariate fusion feature corresponding to the next moment of the current moment that is predicted. In this embodiment, the multivariate fusion feature data at the next moment can be predicted after the multivariate fusion feature at the current moment that is input is processed by the convolution layer and the long short-term memory network layer in the anomaly detection model.

[0070] In this embodiment, the multivariate fusion features are fused according to the time series, and the multivariate fusion features corresponding to different moments can be obtained. Therefore, in this embodiment, the multivariate fusion features at different moments can be respectively input into the anomaly detection model, and the multivariate fusion features corresponding to the current moment are obtained through the input layer of the anomaly detection model. Then, the spatiotemporal information of the multivariate fusion features at the current moment is encoded and processed through the convolutional layer and the long short-term memory network layer in the anomaly detection model, so as to obtain the multivariate fusion features of the next moment.

[0071] In this embodiment, by combining the convolution layer and the LSTM layer, the advantages of the convolutional neural network in spatial feature extraction and the advantages of the LSTM in capturing time dependencies can be fully utilized to achieve encoding and prediction of the spatiotemporal information of multi-dimensional fusion features.

[0072] In this embodiment, optionally, determining the anomaly detection result of the microservice system based on the multivariate fusion features at the next moment includes: generating anomaly probability distribution data by setting an activation function and the multivariate fusion features at the next moment; and obtaining the anomaly detection result of the microservice system based on the anomaly probability distribution data.

[0073] Among them, the activation function can be set as a set activation function, which can be used to classify the multivariate fusion features at the next moment, so as to obtain the corresponding anomaly detection result. In this embodiment, the activation function can be set as a Softmax activation function. The Softmax activation function is usually used in the output layer of a multi-classification task. It converts the multivariate fusion features of the original output at the next moment into a probability distribution, and the sum of these probabilities is 1. In the anomaly detection task, if we want to use Softmax to generate anomaly probability distribution, then we need to redefine the problem as a multi-classification problem, where one category represents normal and one category represents abnormal.

[0074] In this embodiment, the multivariate fusion features at the next moment can be processed by setting an activation function to generate abnormal probability distribution data, and the abnormal detection result can be determined as normal or abnormal based on the abnormal probability distribution data.

[0075] In this embodiment, through such a setting, the activation function is set to determine whether the anomaly detection result of the multi-dimensional fusion feature is normal or abnormal. Based on the anomaly detection model, automated microservice anomaly detection can be achieved, which helps to restore services in time and reduce operation and maintenance costs.

[0076] Specifically, the structure example of the anomaly detection model in this embodiment is shown in FIG. Figure 3 In this embodiment, the multivariate fusion features before the current moment are used as the input of the model, and the spatiotemporal information of the multivariate fusion features is encoded through the convolution module and the LSTM module to generate a set of predicted values ​​of the multivariate fusion features at the next moment, and then the abnormal probability distribution is generated through the Softmax activation function to obtain the abnormal detection result. t is the multi-dimensional fusion feature at time t, y t is the anomaly detection result at time t. Specifically, y t The input is the multivariate fusion feature [X1,X2,…,X t-1 ,X t ]. ConvLSTM is composed of multiple ConvLSTM modules, which have a gating structure similar to LSTM, including input gate i t 、Forget gate t and output gate o t The formula of the ConvLSTM module can be expressed as:

[0077] f t =σ(W xf *X t +W hf *H t-1 +b f );

[0078] i t=σ(W xi *X t +W hi *H t-1 +b i );

[0079]

[0080] o t =σ(W xo *X t +W ho *H t-1 +b o );

[0081]

[0082] Among them, σ and tanh are sigmoid and hyperbolic tangent activation functions respectively, f t ,i t ,C t ,C t ,o t ,H t Represents different gate control units X t Represents input data, H t-1 represents the hidden state of the previous moment, W and b represent weights and biases, * represents convolution, and denote matrix product and Hadamard product respectively.

[0083] In this embodiment, through such a setting, the convolutional long short-term memory neural network inherits the memory unit and gating mechanism of the long short-term memory neural network, and can selectively retain or discard information, thereby effectively realizing the anomaly detection task of the microservice system. By introducing the convolution operation, the spatial information contained in the multivariate time series feature matrix can be extracted, effectively compensating for the insensitivity of the long short-term memory neural network to spatial features.

[0084] The technical solution of the present invention extracts multi-level temporal features from microservice multimodal data, and realizes spatiotemporal information encoding of multi-element fusion features through convolutional long short-term memory neural network, which can realize automated microservice anomaly detection, help timely restore services and reduce operation and maintenance costs.

[0085] The technical solution of the embodiment of the present invention obtains multimodal data of a microservice system; wherein the multimodal data includes indicator data, log data, and call chain data; extracts features from the indicator data, log data, and call chain data respectively to obtain indicator time series features, log time series features, and call chain time series features; performs fusion processing based on the indicator time series features, log time series features, and call chain time series features to obtain multi-dimensional fusion features; inputs the multi-dimensional fusion features into an anomaly detection model to obtain an anomaly detection result of the microservice system. This technical solution can realize automated microservice anomaly detection and improve the accuracy of microservice anomaly detection by extracting and fusing multimodal data features and inputting them into an anomaly detection model.

[0086] Embodiment 3

[0087] Figure 4 Schematic diagram of a microservice anomaly detection device provided according to Embodiment 3 of the present invention. Figure 4 As shown, the device comprises:

[0088] The data acquisition module 410 is used to acquire multimodal data of the microservice system; wherein the multimodal data includes indicator data, log data, and call chain data;

[0089] A feature determination module 420 is used to determine a multi-dimensional fusion feature based on the indicator data, the log data, and the call chain data;

[0090] The anomaly detection module 430 is used to input the multi-element fusion features into the anomaly detection model to obtain the anomaly detection result of the microservice system.

[0091] Optionally, the feature determination module 420 includes:

[0092] A feature extraction unit is used to extract features from the indicator data, log data and call chain data respectively to obtain indicator time series features, log time series features and call chain time series features;

[0093] The feature fusion unit is used to perform fusion processing according to the indicator time series features, log time series features and call chain time series features to obtain multi-dimensional fusion features.

[0094] Optionally, a feature extraction unit is specifically used to extract business indicator features and performance indicator features from the indicator data, and determine the indicator timing features based on the business indicator features and the performance indicator features; wherein the business indicator features are represented by time information; a log parsing algorithm is used to extract log semantic features from each log data, and the log semantic features are determined as log timing features; wherein the log data carries timestamp information; public information and time information are extracted from the call chain data, and the call chain timing features are determined based on the public information and the time information.

[0095] Optionally, a feature fusion unit is specifically used to align the indicator time series features, log time series features and call chain time series features on the time axis by using a sliding window method, and then fuse them to obtain a multi-dimensional fusion feature.

[0096] Optionally, the anomaly detection model includes an input layer, a convolutional layer, and a long short-term memory network layer.

[0097] Optionally, the anomaly detection module 430 includes:

[0098] The feature prediction unit is used to obtain the multivariate fusion features of the current moment through the input layer, encode the spatiotemporal information of the multivariate fusion features through the convolution layer and the long short-term memory network layer, and obtain the multivariate fusion features of the next moment;

[0099] The anomaly detection result determination unit is used to determine the anomaly detection result of the microservice system according to the multi-dimensional fusion features at the next moment.

[0100] Optionally, the anomaly detection result determination unit is specifically used to generate anomaly probability distribution data by setting an activation function and a multivariate fusion feature at the next moment; and obtain an anomaly detection result of the microservice system according to the anomaly probability distribution data.

[0101] A microservice anomaly detection device provided in an embodiment of the present invention can execute a microservice anomaly detection method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0102] Embodiment 4

[0103] Figure 5 1 is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0104] like Figure 5As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0105] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0106] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a microservice anomaly detection method.

[0107] In some embodiments, the microservice anomaly detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the microservice anomaly detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the microservice anomaly detection method in any other appropriate manner (e.g., by means of firmware).

[0108] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0110] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0111] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0112] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0113] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0115] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A microservice anomaly detection method, characterized in that: include: Obtain multimodal data of the microservice system; wherein the multimodal data includes indicator data, log data, and call chain data; Determine a multi-dimensional fusion feature according to the indicator data, the log data, and the call chain data; The multi-dimensional fusion features are input into the anomaly detection model to obtain an anomaly detection result of the microservice system.

2. The method according to claim 1, characterized in that Determining a multi-dimensional fusion feature according to the indicator data, the log data, and the call chain data includes: Extracting features from the indicator data, log data, and call chain data respectively to obtain indicator time series features, log time series features, and call chain time series features; A fusion process is performed according to the indicator time series feature, the log time series feature and the call chain time series feature to obtain a multivariate fusion feature.

3. The method according to claim 2, characterized in that Feature extraction is performed on the indicator data, log data, and call chain data respectively to obtain indicator time series features, log time series features, and call chain time series features, including: Extracting business indicator characteristics and performance indicator characteristics from the indicator data, and determining indicator time series characteristics according to the business indicator characteristics and the performance indicator characteristics; wherein the business indicator characteristics are characterized by time information; A log parsing algorithm is used to extract log semantic features from each log data, and the log semantic features are determined as the log time series features; wherein the log data carries timestamp information; The common information and time information are extracted from the call chain data, and the timing characteristics of the call chain are determined according to the common information and the time information.

4. The method according to claim 2, characterized in that: The indicator time series feature, the log time series feature and the call chain time series feature are fused to obtain a multi-dimensional fusion feature, including: The indicator time series features, the log time series features and the call chain time series features are aligned on the time axis by using a sliding window method and then fused to obtain a multivariate fusion feature.

5. The method according to claim 1, characterized in that: The anomaly detection model includes an input layer, a convolutional layer, and a long short-term memory network layer.

6. The method according to claim 5, characterized in that The multi-element fusion feature is input into the anomaly detection model to obtain the anomaly detection result of the microservice system, including: Acquire the multivariate fusion features at the current moment through the input layer, encode the spatiotemporal information of the multivariate fusion features through the convolution layer and the long short-term memory network layer, and obtain the multivariate fusion features at the next moment; The abnormality detection result of the microservice system is determined according to the multi-element fusion features at the next moment.

7. The method according to claim 6, characterized in that Determining the abnormality detection result of the microservice system according to the multi-element fusion features at the next moment includes: Generate abnormal probability distribution data by setting an activation function and the multivariate fusion features at the next moment; The anomaly detection result of the microservice system is obtained according to the anomaly probability distribution data.

8. A microservice anomaly detection device, characterized in that: include: A data acquisition module, used to acquire multimodal data of the microservice system; wherein the multimodal data includes indicator data, log data and call chain data; A feature determination module, used to determine a multi-dimensional fusion feature according to the indicator data, the log data and the call chain data; The anomaly detection module is used to input the multi-dimensional fusion features into the anomaly detection model to obtain an anomaly detection result of the microservice system.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the microservice anomaly detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the microservice anomaly detection method according to any one of claims 1 to 7 when executed.

Images