Service abnormal state alarm method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a service abnormal state alarm method and device, equipment, a storage medium and a program product, and relates to the technical field of big data. By adopting the method, the self-adaptive alarm adjustment of the micro-service system can be realized, and the accuracy of state detection can be improved. The method comprises the following steps: recording high-frequency log data into each time node of call chain data to obtain a graph structure; combining the user response information with the graph structure according to a time sequence to obtain initial graph structure data; performing combined calculation on the initial graph structure data by adopting a correlation calculation method to obtain target graph structure data with internal and external correlation indexes; acquiring an attention vector, and performing residual correction on the predicted value by using a rolling residual factor in the long-short-term memory model to obtain a state predicted value at the current moment; and performing same-cycle-ratio data fluctuation calculation on the current state prediction value and the historical state prediction value, and generating alarm information under the condition that a calculation result is recognized to meet an alarm threshold condition.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a service abnormality status alarm method, device, computer equipment, computer-readable storage medium and computer program product. Background Art

[0002] In microservice systems, there are complex and cumbersome calling relationships between basic services, core services, functional components and middleware. Since microservice systems are prone to fault propagation ripple effects, microservice systems are often affected by upstream and downstream, resulting in system crashes and equipment downtime. In order to prevent service failures from causing business interruptions, service abnormal status warnings, as a common means of preventing system failures, play an important role in the field of application observability.

[0003] In traditional technology, call chain analysis mainly includes three granularities: components, interfaces and methods. These granularities range from coarse to fine. At present, most of the research is limited to interface-level research to reduce system complexity and improve analysis efficiency. The execution process and state changes of internal service methods are not explored, and the influencing factors such as method-to-method and user-side are ignored. The analysis results do not truly reflect the call characteristics between services. Anomaly detection methods are divided into two categories: supervised learning and unsupervised learning. Both methods require statistical analysis based on the call relationship of service components, and cannot perform more fine-grained and multi-dimensional analysis on the detection object. There are often problems such as low state detection accuracy and lack of adaptive capabilities. Summary of the invention

[0004] Based on this, it is necessary to provide a service abnormal status alarm method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides a method for warning of abnormal service status, comprising:

[0006] Obtain call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance, obtain high-frequency log data, and record the high-frequency log data at each time node of the call chain data to obtain a graph structure;

[0007] Calculate according to the call chain data and the service log to obtain user response information, and combine the user response information with the graph structure in time series to obtain initial graph structure data;

[0008] Using a correlation calculation method, the initial graph structure data is combined and calculated to obtain target graph structure data with internal and external correlation indicators;

[0009] Acquire an attention vector, combine the attention vector with the target graph structure data using a long short-term memory model to obtain a prediction value with long dependency, and perform residual correction on the prediction value using a rolling residual factor in the long short-term memory model to obtain a current state prediction value;

[0010] The current state prediction value and the historical state prediction value are calculated for year-on-year and month-on-month data fluctuations. When it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

[0011] In one embodiment, before the combination calculation of the initial graph structure data using the correlation calculation method, the method further includes:

[0012] According to the preset value of call type correlation, the call chain data is subjected to external correlation judgment and internal correlation judgment to obtain external correlation and internal correlation; according to the user response information, the weight of the external correlation is adjusted, and according to the high-frequency log data, the weight of the internal correlation is adjusted to obtain the external correlation weight and the internal correlation weight;

[0013] The method of using the correlation calculation method to perform combined calculation on the initial graph structure data also includes:

[0014] Based on the external correlation weight and the internal correlation weight, the initial graph structure data is combined and calculated using the correlation coefficient and re-standardized range analysis method.

[0015] In one of the embodiments, after taking the current state prediction value as the alarm threshold of the next alarm cycle, the method further includes:

[0016] When the user does not cancel the alarm for a long time, the proportion of the external correlation in the prediction attention mechanism is reduced, and the proportion of the internal correlation in the prediction attention mechanism is increased; the current period prediction value does not consider the residual correction, and the call type correlation preset value is reduced according to the relevant volatility index to complete the adaptive adjustment of the alarm threshold of the micro service system.

[0017] In one embodiment, obtaining the attention vector includes:

[0018] In the target graph structure data, each time point is taken as a node, and the nodes are divided into time sequence edges and related feature edges; the time sequence edges are input into the long short-term memory model to obtain medium- and long-term dependencies to obtain a hidden state sequence; the attention weights of the related feature edges are calculated by the attention mechanism in combination with the user response information, and the hidden state sequence is weighted and summed according to the attention weights to obtain the attention vector.

[0019] In one embodiment, the method of performing residual correction on the predicted value by using the rolling residual factor in the long short-term memory model to obtain the current state prediction value includes:

[0020] Obtain a residual sequence of preset continuous moments, and perform Fourier transform denoising on the residual sequence according to a prediction time window; compensate for the random error of the microservice system according to the Fourier transform denoising result; and perform residual correction on the Fourier transform denoising result and the predicted value using the rolling residual factor to obtain the current moment state prediction value based on the rolling residual correction.

[0021] In one embodiment, before combining the user response information with the graph structure in time series to obtain initial graph structure data, the method further includes:

[0022] Parse the user response information from the call chain of the authentication service, and count the time period from the time the user alarm occurs to the time the authentication service is triggered, as well as the number of logs and the number of log levels within the time period; based on the statistical results, characterize the alarm elimination effect of the user response alarm through weighted calculation, and reduce the weight ratio of the alarm elimination effect when the response time is less than the secondary alarm cycle.

[0023] In a second aspect, the present application also provides a service abnormality status alarm device, including:

[0024] An information acquisition module is used to obtain the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance, obtain high-frequency log data, and record the high-frequency log data at each time node of the call chain data to obtain a graph structure;

[0025] An information combining module, used to perform calculations based on the call chain data and the service log to obtain user response information, and combine the user response information with the graph structure in time series to obtain initial graph structure data;

[0026] A combination calculation module, used to perform combination calculation on the initial graph structure data by using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators;

[0027] A residual correction module is used to obtain an attention vector, combine the attention vector with the target graph structure data using a long short-term memory model to obtain a prediction value with long dependency, and perform residual correction on the prediction value using a rolling residual factor in the long short-term memory model to obtain a current state prediction value;

[0028] The abnormal alarm module is used to calculate the same-month and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. When it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated and the current state prediction value is used as the alarm threshold of the next alarm cycle.

[0029] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0030] The call chain data and service log of the target service in the microservice system are obtained, and the service log is graded according to the importance to obtain high-frequency log data, and the high-frequency log data is recorded in each time node of the call chain data to obtain a graph structure; the user response information is calculated according to the call chain data and the service log, and the user response information is combined with the graph structure in time series to obtain the initial graph structure data; the initial graph structure data is combined and calculated by a correlation calculation method to obtain the target graph structure data with internal and external correlation indicators; the attention vector is obtained, and the attention vector is combined with the target graph structure data by using a long short-term memory model to obtain a prediction value with long dependency, and the rolling residual factor in the long short-term memory model is used to perform residual correction on the prediction value to obtain the current state prediction value; the current state prediction value and the historical state prediction value are calculated for year-on-year and month-on-month data fluctuations, and when it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold of the next alarm cycle.

[0031] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0032] The call chain data and service log of the target service in the microservice system are obtained, and the service log is graded according to the importance to obtain high-frequency log data, and the high-frequency log data is recorded in each time node of the call chain data to obtain a graph structure; the user response information is calculated according to the call chain data and the service log, and the user response information is combined with the graph structure in time series to obtain the initial graph structure data; the initial graph structure data is combined and calculated by a correlation calculation method to obtain the target graph structure data with internal and external correlation indicators; the attention vector is obtained, and the attention vector is combined with the target graph structure data by using a long short-term memory model to obtain a prediction value with long dependency, and the rolling residual factor in the long short-term memory model is used to perform residual correction on the prediction value to obtain the current state prediction value; the current state prediction value and the historical state prediction value are calculated for year-on-year and month-on-month data fluctuations, and when it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold of the next alarm cycle.

[0033] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0034] The call chain data and service log of the target service in the microservice system are obtained, and the service log is graded according to the importance to obtain high-frequency log data, and the high-frequency log data is recorded in each time node of the call chain data to obtain a graph structure; the user response information is calculated according to the call chain data and the service log, and the user response information is combined with the graph structure in time series to obtain the initial graph structure data; the initial graph structure data is combined and calculated by a correlation calculation method to obtain the target graph structure data with internal and external correlation indicators; the attention vector is obtained, and the attention vector is combined with the target graph structure data by using a long short-term memory model to obtain a prediction value with long dependency, and the rolling residual factor in the long short-term memory model is used to perform residual correction on the prediction value to obtain the current state prediction value; the current state prediction value and the historical state prediction value are calculated for year-on-year and month-on-month data fluctuations, and when it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold of the next alarm cycle.

[0035] The above-mentioned service abnormal status alarm method, device, computer equipment, computer-readable storage medium and computer program product convert the call dependency relationship between the functional methods and components in the microservice system into a graph structure, hierarchically and graded the call chain information, and combined with the detailed call information in each method to form a comprehensive call relationship topology. On the basis of the call relationship topology, high-frequency log data and user response status are used to perform correlation analysis in spatial and temporal dimensions, and the influence of external correlation and internal fluctuation law is comprehensively considered to calculate relevant volatility indicators, and each indicator is used to characterize the trend of the microservice status in the form of time series data, so as to provide basic data for subsequent microservice application status prediction; in addition, it also targets The existing long short-term memory model has problems such as low prediction accuracy for long time series, poor ability to identify key time step information and lag in predicted data. The self-attention mechanism is introduced to dynamically adjust the prediction weights of the long short-term memory model in different system warning indicators based on the correlation volatility index between data to achieve effective prediction of complex data. The rolling residual factor based on time window is introduced to enhance the model's ability to capture and process prediction errors, realize real-time correction of the long short-term memory model, and improve the accuracy of state detection. The system can dynamically adjust the alarm threshold according to the actual operating conditions, has strong adaptive adjustment capabilities, reduces human intervention, and improves the intelligence level of the microservice system and the robustness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 This is an application environment diagram of a service abnormality status alarm method in an embodiment;

[0038] Figure 2 A flowchart of a method for warning of abnormal service status in one embodiment;

[0039] Figure 3 A schematic diagram of a flow chart of a step of obtaining an attention vector in one embodiment;

[0040] Figure 4 It is a flowchart of a method for warning of abnormal service status in a specific embodiment;

[0041] Figure 5 A schematic diagram of a flow chart of a service abnormality status alarm method in an application embodiment;

[0042] Figure 6It is a structural block diagram of a service abnormal state alarm device in one embodiment;

[0043] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] The service abnormal status alarm method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal communicates with the server through the network. The data storage system can store the data that the server needs to process. The data storage system can be integrated on the server or placed on the cloud or other network servers.

[0046] Specifically, the service abnormal status alarm method provided in the embodiment of the present application can be executed by a server.

[0047] Exemplarily, the server obtains the call chain data and service log of the target service in the microservice system, grades the service log according to the degree of importance, obtains high-frequency log data, and records the high-frequency log data in each time node of the call chain data to obtain a timing graph structure; the server calculates according to the call chain data and the service log to obtain user response information, and combines the user response information with the timing graph structure in a time series to obtain initial graph structure data; the server uses a correlation calculation method to perform combined calculations on the initial graph structure data to obtain target graph structure data with internal and external correlation indicators; the server obtains an attention vector, combines the attention vector with the target graph structure data using a preset long short-term memory model to obtain a prediction value with long dependency, and uses the rolling residual factor in the long short-term memory model to perform residual correction on the prediction value to obtain the current state prediction value; the server performs a year-on-year data fluctuation calculation on the current state prediction value and the historical state prediction value, and generates an alarm message when it is identified that the calculation result meets the alarm threshold condition, and uses the current state prediction value as the alarm threshold for the next alarm cycle.

[0048] In such Figure 1 In the application environment shown, the terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, and tablet computers. The server can be implemented as an independent server or a server cluster consisting of multiple servers.

[0049] In one embodiment, Figure 2As shown, a service abnormal state alarm method is provided, which is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0050] Step S201, obtain the call chain data and service log of the target service in the microservice system, classify the service log according to the importance, obtain high-frequency log data, and record the high-frequency log data to each time node of the call chain data to obtain a timing graph structure.

[0051] Among them, call chain data can be data that tracks and records the execution path of requests in a microservice system. It is mainly used for monitoring, diagnosis, troubleshooting, and performance optimization, especially for tracking the flow of requests between various services or modules in complex systems.

[0052] Among them, the service log can be a log file that records various events, operations and error information during the operation of the microservice system. It is usually used to track the health status of the system, diagnose problems, monitor performance and ensure the stability of the service.

[0053] Specifically, the server obtains the call chain data and service logs of the target service in the microservice system, classifies the service logs according to their importance, obtains high-frequency log data, and records the high-frequency log data at each time node of the call chain data to preliminarily construct a graph structure.

[0054] Step S202, calculate according to the call chain data and the service log to obtain user response information, and combine the user response information with the timing graph structure in time series to obtain initial graph structure data.

[0055] The user response information may include feedback information generated when the user interacts with the microservice system, such as the user's input, clicks, selections, and content of submitted forms.

[0056] Specifically, the user response information is obtained by calculating the call chain data and the service log. The user response information is parsed from the call chain of the authentication service, and the time from the user alarm occurrence to the time of triggering the authentication service is counted. Finally, the user response information is combined with the graph structure in time series to complete the preliminary data collection and obtain the initial graph structure data.

[0057] Step S203, using a correlation calculation method, performs combined calculation on the initial graph structure data to obtain target graph structure data with internal and external correlation indicators.

[0058] Among them, the correlation calculation method can be the correlation coefficient and the rescaled range analysis method. The correlation coefficient focuses on the strength and direction of the linear relationship between data, while the rescaled range analysis method is a technology for standardizing data, which is usually used to eliminate the scale differences between features. In practical applications, they can be used in combination to help us analyze the relationship between data more accurately.

[0059] Specifically, the server uses a combination of correlation coefficient and rescaled range analysis to perform combined calculations on the initial graph structure data, and ultimately outputs target graph structure data consisting of a call chain sequence with internal and external correlation indicators.

[0060] Step S204, obtain the attention vector, use the preset long short-term memory model to combine the attention vector with the target graph structure data to obtain a prediction value with long dependency, and use the rolling residual factor in the long short-term memory model to perform residual correction on the prediction value to obtain the current state prediction value.

[0061] Among them, attention vector is a concept widely used in the field of deep learning. It comes from the "attention mechanism" and aims to imitate the way humans "pay attention" when processing information. That is, when humans process a large amount of information, they always selectively focus on certain important parts and ignore other unimportant parts.

[0062] Among them, the long short-term memory model can be a time recurrent neural network that solves the long-term dependency problem existing in recurrent neural networks.

[0063] Specifically, the server combines the attention vector with the time series graph structure data, and outputs the prediction data with long dependencies through the fully connected layer. In order to improve the accuracy of the prediction model, the continuous residual sequence of the previous twenty moments is collected, and the time window is set with a length of 5. The residual sequence is denoised by Fourier transform to compensate for the random error of the system, and the residual correction is performed on the denoised data and the prediction value at the corresponding moment, and finally the current moment state prediction value based on the rolling residual correction is obtained.

[0064] Step S205, calculate the same-month and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. When it is identified that the calculation result meets the alarm threshold condition, generate alarm information and use the current state prediction value as the alarm threshold for the next alarm cycle.

[0065] Among them, the alarm threshold condition can be that the predicted value fluctuates greatly compared with the data X days, Y days, or Z days ago and the residual is large (X<Y<Z).

[0066] Specifically, the server predicts data based on key service indicators (response time, request rate, and error rate). If the current status prediction value fluctuates significantly compared with the data X days, Y days, or Z days ago and the residual is large, it is considered that the current service is abnormal and the system issues an alarm. The predicted value serves as the alarm threshold for the next alarm cycle (X<Y<Z).

[0067] In the above-mentioned service abnormal status alarm method, the call dependency relationship between the functional methods and components in the microservice system is converted into a graph structure, the call chain information is hierarchical and graded, and a comprehensive call relationship topology is formed by combining the detailed call information in each method. On the basis of the call relationship topology, high-frequency log data and user response status are used to perform correlation analysis in spatial and temporal dimensions, and the influence of external correlation and internal fluctuation law is comprehensively considered to calculate relevant volatility indicators. The trend of each indicator in the microservice status is represented by time series data, which provides basic data for subsequent microservice application status prediction. In addition, the existing long-short-term memory model is used for long-term In order to solve the problems of low sequence prediction accuracy, poor ability to identify key time step information and lag in predicted data, a self-attention mechanism is introduced. The prediction weights of the long short-term memory model in different system warning indicators are dynamically adjusted based on the correlation volatility indicators between data to achieve effective prediction of complex data. A rolling residual factor based on a time window is introduced to enhance the model's ability to capture and process prediction errors, realize real-time correction of the long short-term memory model, and improve the accuracy of state detection. The system can dynamically adjust the alarm threshold according to the actual operating conditions, has strong adaptive adjustment capabilities, reduces human intervention, and improves the intelligence level of the microservice system and the robustness of the system.

[0068] In one embodiment, before the initial graph structure data is combined and calculated using the correlation calculation method, the method of the present application further includes the following steps:

[0069] According to the preset value of call type correlation, external correlation and internal correlation are judged on the call chain data to obtain external correlation and internal correlation; according to the user response information, the weight of the external correlation is adjusted, and according to the high-frequency log data, the weight of the internal correlation is adjusted to obtain the external correlation weight and the internal correlation weight;

[0070] In the above step S203, a correlation calculation method is used to perform combined calculation on the initial graph structure data, which specifically includes the following steps:

[0071] Based on the external correlation weight and the internal correlation weight, the initial graph structure data are combined and calculated using the correlation coefficient and rescaled range analysis method.

[0072] It should be noted that the microservice call chain data has certain characteristics such as self-similarity, periodicity, and burstiness. This application is based on the idea of ​​judging the internal and external correlation of the time series, and makes external correlation judgments and internal regularity judgments on the call chain information. The calls between services and interfaces belong to external correlations, and the calls between methods and methods, and the calls between methods and functional components belong to internal correlations. The weights of each type of correlation are preset by the user. The preset information is shown in Table 1 below, and is subsequently dynamically adjusted through the prediction model.

[0073] Table 1 Call type dependency preset values

[0074]

[0075] To further explore the correlation between services, high-frequency log data and user response status are quantified as influencing factors to characterize the call weight of microservices in each time interval. High-frequency log data is used to compensate for the lack of internal correlation. In the scenario of traffic surge, it is directly linked to the internal correlation to increase the internal correlation weight; the user response status affects the external correlation calculation. The response efficiency and the alarm elimination effect jointly determine the importance of the target service. When the user response index is low, the external correlation of the target service is weak and the internal correlation is strong. Conversely, the external correlation is strong and the internal correlation is weak. The final output is the target graph structure data composed of the call chain sequence with internal and external correlation indicators.

[0076] In one embodiment, after the current state prediction value is used as the alarm threshold of the next alarm cycle, the method of the present application further includes the following steps:

[0077] When the user does not cancel the alarm for a long time, the proportion of external correlation in the prediction attention mechanism is reduced, and the proportion of internal correlation in the prediction attention mechanism is increased; the current period prediction value does not consider the residual correction, and the call type correlation preset value is reduced according to the relevant volatility indicators to complete the adaptive adjustment of the alarm threshold of the microservice system.

[0078] Specifically, when the server recognizes that the user has not cleared the alarm for a long time, it reduces the proportion of external correlation in the prediction attention mechanism and increases the proportion of internal correlation in the prediction attention mechanism; and makes the current cycle prediction value not consider the residual correction, and reduces the call type correlation preset value according to the relevant volatility index, so as to complete the adaptive adjustment of the alarm threshold of the microservice system.

[0079] In one embodiment, if Figure 3 As shown, in the above step S204, obtaining the attention vector specifically includes the following steps:

[0080] Step S301: In the target graph structure data, each time point is regarded as a node, and the nodes are divided into time sequence edges and related feature edges.

[0081] Step S302: input the time sequence edges into the long short-term memory model to obtain medium- and long-term dependencies, and obtain a hidden state sequence.

[0082] Step S303: The attention weights of the relevant feature edges are calculated by the attention mechanism in combination with the user response information, and the hidden state sequence is weighted and summed according to the attention weights to obtain the attention vector.

[0083] Specifically, the server combines the target graph structure data and takes each time point as a node. The nodes are subdivided into time sequence edges and related feature edges. The time sequence edges are input into the long short-term memory model to obtain medium- and long-term dependencies to obtain a hidden state sequence. The related feature edges are calculated by the attention mechanism in combination with the user response state to calculate the attention weights. The attention weights are used to perform weighted summation on the hidden state sequence to obtain the attention vector. The attention vector is combined with the time series graph structure data and output through the fully connected layer to produce predicted data with long dependencies.

[0084] In one embodiment, in the above step S204, residual correction is performed on the predicted value using the rolling residual factor in the long short-term memory model to obtain the current state prediction value, which specifically includes the following steps:

[0085] Obtain the residual sequence of preset continuous moments, and perform Fourier transform denoising on the residual sequence according to the prediction time window; compensate for the random error of the microservice system based on the Fourier transform denoising result; use the rolling residual factor to perform residual correction on the Fourier transform denoising result and the predicted value to obtain the current state prediction value based on the rolling residual correction.

[0086] Specifically, the server obtains the continuous residual sequence of the previous twenty moments, sets a time window of length 5, performs Fourier transform denoising on the residual sequence, compensates for the random error of the system, performs residual correction on the denoised data and the predicted value at the corresponding moment, and finally obtains the current moment state prediction value based on the rolling residual correction, thereby effectively improving the accuracy of the prediction model.

[0087] In one embodiment, before combining the user response information with the graph structure in time series to obtain the initial graph structure data, the method of the present application further includes the following steps:

[0088] Parse the user response information from the call chain of the authentication service, count the time period from the time the user alarm occurs to the time the authentication service is triggered, as well as the number of logs and the number of log levels within the time period; based on the statistical results, weighted calculation is used to characterize the alarm elimination effect of the user response alarm, and when the response time is less than the secondary alarm cycle, reduce the weight of the alarm elimination effect.

[0089] Specifically, user response information can be obtained by jointly calculating the call chain data and service logs. User response information is parsed from the call chain of the authentication service, and the time from the occurrence of the user alarm to the triggering of the authentication service is counted. This time period represents the user's response efficiency to the current service alarm. At the same time, the number of logs at that moment and the number of logs at each level are counted, and the effect of eliminating the alarm by the user's response alarm is represented by weighted calculation. When the response time is less than the secondary alarm cycle, the response efficiency is considered high, and the weight of the elimination effect is reduced. On the contrary, the calculation weight of the elimination effect in the user response information is increased. Finally, the user response information is combined with the graph structure in a time series to complete the preliminary data collection.

[0090] In one embodiment, Figure 4 As shown, a method for warning of abnormal service status in a specific embodiment is provided, which specifically includes the following steps:

[0091] Step S401, obtain the call chain data and service log of the target service in the microservice system, classify the service log according to the importance, obtain high-frequency log data, and record the high-frequency log data to each time node of the call chain data to obtain a graph structure.

[0092] Step S402, calculate according to the call chain data and the service log to obtain user response information, and combine the user response information with the graph structure in time series to obtain initial graph structure data.

[0093] Step S403, according to the preset value of call type correlation, external correlation judgment and internal correlation judgment are performed on the call chain data to obtain external correlation and internal correlation; according to the user response information, the weight of the external correlation is adjusted, and the weight of the internal correlation is adjusted according to the high-frequency log data to obtain the external correlation weight and the internal correlation weight.

[0094] Step S404, based on the external correlation weight and the internal correlation weight, the initial graph structure data is combined and calculated using the correlation coefficient and re-calibrated range analysis method to obtain the target graph structure data with internal and external correlation indicators.

[0095] Step S405: In the target graph structure data, each time point is regarded as a node, and the nodes are divided into time sequence edges and related feature edges; the time sequence edges are input into the long short-term memory model to obtain medium- and long-term dependencies to obtain a hidden state sequence; the related feature edges are calculated by the attention mechanism in combination with the user response information to calculate the attention weight, and the hidden state sequence is weighted and summed according to the attention weight to obtain the attention vector.

[0096] Step S406, using a preset long short-term memory model to combine the attention vector with the target graph structure data to obtain a prediction value with long dependency.

[0097] Step S407, obtain the residual sequence of preset continuous moments, and perform Fourier transform denoising on the residual sequence according to the prediction time window; compensate for the random error of the microservice system according to the Fourier transform denoising result; use the rolling residual factor to perform residual correction on the Fourier transform denoising result and the predicted value, and obtain the current state prediction value based on the rolling residual correction.

[0098] Step S408, calculate the same-month and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. When it is identified that the calculation result meets the alarm threshold condition, generate alarm information and use the current state prediction value as the alarm threshold for the next alarm cycle.

[0099] The beneficial effects brought by the above embodiments are as follows:

[0100] This application proposes a service abnormal status alarm method, which aims to quickly and accurately identify the abnormal status of the microservice system, dynamically adjust the system fault warning threshold according to the abnormal status and the user's historical response method, solve the problems of alarm flooding and poor accuracy, improve the warning quality and service observability, and thus ensure the stable operation of the microservice system.

[0101] In order to more clearly illustrate the service abnormality status alarm method provided by the embodiment of the present application, the service abnormality status alarm method is specifically described below with an application embodiment. Figure 5 As shown, the present application also provides a service abnormal status alarm method, which specifically includes the following steps:

[0102] Step 1: To realize the data association and supplement of call chain, service log and user response information, the service log is graded according to the importance: info, warn, error. The error level corresponds to the error log, and the info and warn levels correspond to the request rate. The graded high-frequency log data is recorded in each time node of the call chain time series data, and the graph structure is initially constructed; the user response information is obtained by calculating the call chain information and the service log. The user information is parsed from the call chain of the authentication service, and the time from the user alarm occurrence to the time of triggering the authentication service is counted. This time period represents the user's response efficiency to the current service alarm. The number of logs and the number of logs at each level at this moment are counted, and the alarm elimination effect of the user response alarm is represented by weighted calculation. When the response time is less than the secondary alarm cycle, the response efficiency is considered high, and the weight of the alarm elimination effect is reduced. On the contrary, the calculation weight of the alarm elimination effect in the user response information is increased. The user response information is combined with the graph structure in time series to complete the preliminary data collection.

[0103] Step 2: The correlation calculation method uses a combination of correlation coefficient and re-scaled range analysis to complete the calculation. In order to further explore the correlation between services, high-frequency log data and user response status are quantified as influencing factors to characterize the call weight of microservices in each time interval. High-frequency log data is used to compensate for the lack of internal correlation. In the scenario of traffic surge, it is directly linked to the internal correlation to increase the internal correlation weight; the user response status affects the external correlation calculation. The response efficiency and the alarm elimination effect jointly determine the importance of the target service. When the user response index is low, the external correlation of the target service is weak and the internal correlation is strong. Conversely, the external correlation is strong and the internal correlation is weak. The final output is a time series graph structure data composed of a call chain with internal and external correlation indicators.

[0104] Step 3: Combined with the above-mentioned time-series graph structure data, each time point is taken as a node, and the node is subdivided into time sequence edges and related feature edges. The time sequence is input into the long short-term memory model to obtain medium- and long-term dependencies, and the hidden state sequence is obtained. The attention weights of the related feature edges are calculated by the attention mechanism combined with the user response state. The attention weights are used to weight the hidden state sequence to obtain the attention vector. The attention vector is combined with the time-series graph structure data, and the prediction data with long dependencies is output through the fully connected layer. In order to improve the accuracy of the prediction model, the continuous residual sequence of the first twenty moments is collected, and the time window is set according to the length of 5. The residual sequence is Fourier transformed to reduce noise, compensate for the random error of the system, and the noise-reduced data is residually corrected with the corresponding moment prediction value, and finally the current moment state prediction value based on the rolling residual correction is obtained.

[0105] Step 4: Based on the forecast data of the above key indicators, when the forecast value fluctuates greatly compared with the data 1 day, 3 days, or 7 days ago and the residual is large, the service at the current moment is considered abnormal, and the system issues an alarm. The forecast value is used as the alarm threshold for the next alarm cycle. If the user does not clear the alarm for a long time, the proportion of external correlation in the forecast attention mechanism is reduced, the impact of internal correlation is increased, the forecast value of the current cycle does not consider the residual correction, and the preset value of correlation is reduced according to the relevant volatility index to complete the adaptive adjustment of the system alarm threshold.

[0106] The beneficial effects brought by the above embodiments are as follows:

[0107] In view of the problems of alarm flooding, serious noise, poor alarm correlation, insufficient observability, and lack of adaptive adjustment capabilities in the current microservice system alarms, this application proposes a service abnormal status alarm method. First, based on the observable call chain, the functional methods and call dependencies between components in the microservice system are classified and classified and converted into a graph structure. Secondly, the correlation analysis of the spatial and temporal dimensions is carried out in combination with high-frequency log data and user response status, and the trend of the microservice status is characterized in the form of time series data. Finally, the microservice status is predicted based on the improved long short-term memory model, and the rolling residual factor is designed. By capturing the effective movement trend of the sequence, the cumulative error caused by the response lag of the prediction model is compensated. Finally, the alarm threshold is dynamically adjusted according to the prediction result, and the adaptive alarm adjustment of the microservice system is realized to improve the alarm quality. This application is suitable for the microservice fire-fighting map governance scenario. It performs adaptive threshold adjustment for the massive alarms generated by the microservice system, effectively avoiding the alarm flooding problem while improving the alarm quality, thereby realizing the early prevention and rectification of service failures.

[0108] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0109] Based on the same inventive concept, the embodiment of the present application also provides a service abnormal state alarm device for implementing the service abnormal state alarm method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more service abnormal state alarm device embodiments provided below can refer to the limitations of the service abnormal state alarm method above, and will not be repeated here.

[0110] In an exemplary embodiment, Figure 6 As shown, a service abnormal state alarm device is provided, comprising:

[0111] The information acquisition module 601 is used to obtain the call chain data and service log of the target service in the microservice system, classify the service log according to the importance, obtain high-frequency log data, and record the high-frequency log data to each time node of the call chain data to obtain a graph structure;

[0112] An information combining module 602 is used to perform calculations based on the call chain data and the service log to obtain user response information, and combine the user response information with the graph structure in time series to obtain initial graph structure data;

[0113] A combination calculation module 603 is used to perform combination calculation on the initial graph structure data using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators;

[0114] The residual correction module 604 is used to obtain an attention vector, combine the attention vector with the target graph structure data using a preset long short-term memory model to obtain a prediction value with a long dependency, and perform residual correction on the prediction value using a rolling residual factor in the long short-term memory model to obtain a current state prediction value;

[0115] The abnormal alarm module 605 is used to calculate the same-month and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. When it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated and the current state prediction value is used as the alarm threshold of the next alarm cycle.

[0116] In one embodiment, the service abnormal status alarm device further includes a weight adjustment module, which is used to perform external correlation judgment and internal correlation judgment on the call chain data according to the preset value of call type correlation, and obtain external correlation and internal correlation; according to the user response information, adjust the weight of the external correlation, and according to the high-frequency log data, adjust the weight of the internal correlation, and obtain the external correlation weight and the internal correlation weight;

[0117] The combined calculation module 603 is further used to perform combined calculation on the initial graph structure data based on the external correlation weight and the internal correlation weight by using the correlation coefficient and re-standardized range analysis method.

[0118] In one embodiment, the service abnormal status alarm device also includes a threshold adjustment module, which is used to reduce the proportion of the external correlation in the prediction attention mechanism and increase the proportion of the internal correlation in the prediction attention mechanism when the user does not cancel the alarm for a long time; the current period prediction value does not consider the residual correction, and reduces the call type correlation preset value according to the relevant volatility index to complete the adaptive adjustment of the alarm threshold of the micro service system.

[0119] In one embodiment, the residual correction module 604 is also used to treat each time point as a node in the target graph structure data, and divide the node into a time sequence edge and a related feature edge; the time sequence edge is input into the long short-term memory model to obtain medium- and long-term dependencies to obtain a hidden state sequence; the related feature edge is calculated by the attention mechanism in combination with the user response information for attention weights, and the hidden state sequence is weighted summed according to the attention weights to obtain the attention vector.

[0120] In one embodiment, the residual correction module 604 is also used to obtain the residual sequence of preset continuous moments, and perform Fourier transform denoising on the residual sequence according to the prediction time window; compensate for the random error of the microservice system according to the Fourier transform denoising result; and use the rolling residual factor to perform residual correction on the Fourier transform denoising result and the predicted value to obtain the current moment state prediction value based on the rolling residual correction.

[0121] In one embodiment, the service abnormal status alarm device also includes an effect characterization module, which is used to parse the user response information from the call chain of the authentication service, count the time period from the time when the user alarm occurs to the time when the authentication service is triggered, and the number of logs and the number of logs at each level within the time period; based on the statistical results, the alarm elimination effect of the user response alarm is characterized by weighted calculation, and when the response time is less than the secondary alarm cycle, the weight ratio of the alarm elimination effect is reduced.

[0122] Each module in the above-mentioned service abnormal status alarm device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0123] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store service logs and call chain data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a service abnormality state alarm method is implemented.

[0124] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0125] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0126] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0127] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0129] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0130] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0131] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A service abnormality status alarm method, characterized in that: The method comprises: Obtain call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance, obtain high-frequency log data, and record the high-frequency log data to each time node of the call chain data to obtain a timing graph structure; Calculate according to the call chain data and the service log to obtain user response information, and combine the user response information with the timing graph structure in time series to obtain initial graph structure data; Using a correlation calculation method, the initial graph structure data is combined and calculated to obtain target graph structure data with internal and external correlation indicators; Acquire an attention vector, combine the attention vector with the target graph structure data using a preset long short-term memory model to obtain a prediction value with long dependency, and perform residual correction on the prediction value using a rolling residual factor in the long short-term memory model to obtain a current state prediction value; The current state prediction value and the historical state prediction value are calculated for year-on-year and month-on-month data fluctuations. When it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

2. The method according to claim 1, characterized in that Before the combination calculation of the initial graph structure data using the correlation calculation method, the method further includes: According to the preset value of call type correlation, external correlation judgment and internal correlation judgment are performed on the call chain data to obtain external correlation and internal correlation; According to the user response information, the weight of the external correlation is adjusted, and according to the high-frequency log data, the weight of the internal correlation is adjusted to obtain the external correlation weight and the internal correlation weight; The method of using the correlation calculation method to perform combined calculation on the initial graph structure data also includes: Based on the external correlation weight and the internal correlation weight, the initial graph structure data is combined and calculated using the correlation coefficient and re-standardized range analysis method.

3. The method according to claim 2, characterized in that After taking the current state prediction value as the alarm threshold of the next alarm cycle, the method further includes: When the user does not cancel the alarm for a long time, the proportion of the external correlation in the prediction attention mechanism is reduced, and the proportion of the internal correlation in the prediction attention mechanism is increased; The current cycle forecast value does not take into account the residual correction, and reduces the preset value of the call type correlation according to the relevant volatility index, completing the adaptive adjustment of the alarm threshold of the micro service system.

4. The method according to claim 1, characterized in that: The obtaining of the attention vector comprises: In the target graph structure data, each time point is regarded as a node, and the node is divided into a time sequence edge and a related feature edge; Inputting the time sequence edge into the long short-term memory model to obtain medium- and long-term dependency relationships, thereby obtaining a hidden state sequence; The attention weight of the relevant feature edge is calculated by the attention mechanism in combination with the user response information, and the hidden state sequence is weighted summed according to the attention weight to obtain the attention vector.

5. The method according to claim 1, characterized in that The method of performing residual correction on the predicted value by using the rolling residual factor in the long short-term memory model to obtain the current state prediction value includes: Obtaining a residual sequence of preset continuous moments, and performing Fourier transform denoising on the residual sequence according to a prediction time window; Compensating for random errors of the microservice system according to the Fourier transform noise reduction result; The rolling residual factor is used to perform residual correction on the Fourier transform denoising result and the predicted value to obtain the current state prediction value based on the rolling residual correction.

6. The method according to any one of claims 1 to 5, characterized in that: Before combining the user response information with the graph structure in time series to obtain initial graph structure data, the method further includes: Parse the user response information from the call chain of the authentication service, count the time period from the time when the user alarm occurs to the time when the authentication service is triggered, and the number of logs and the number of logs at each level within the time period; According to the statistical results, the alarm elimination effect of the user's response to the alarm is characterized by weighted calculation, and when the response time is less than the secondary alarm cycle, the weight ratio of the alarm elimination effect is reduced.

7. A service abnormality status alarm device, characterized in that: The device comprises: An information acquisition module is used to obtain the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance, obtain high-frequency log data, and record the high-frequency log data to each time node of the call chain data to obtain a timing diagram structure; An information combining module, used to perform calculations based on the call chain data and the service log to obtain user response information, and combine the user response information with the timing graph structure in a time series to obtain initial graph structure data; A combination calculation module, used to perform combination calculation on the initial graph structure data by using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators; A residual correction module is used to obtain an attention vector, combine the attention vector with the target graph structure data using a preset long short-term memory model to obtain a prediction value with long dependency, and perform residual correction on the prediction value using a rolling residual factor in the long short-term memory model to obtain a current state prediction value; The abnormal alarm module is used to calculate the same-month and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. When it is identified that the calculation result meets the alarm threshold condition, an alarm message is generated and the current state prediction value is used as the alarm threshold of the next alarm cycle.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images