Service exception state alarm method and device, computer device, readable storage medium and program product

Abstract

The application relates to a service exception state alarm method and device, equipment, a storage medium and a program product, and relates to the technical field of big data. The method can realize adaptive alarm adjustment of a micro-service system and improve the accuracy of state detection. The method comprises the following steps: recording high-frequency log data to each time node of call chain data to obtain a graph structure; combining user response information and the graph structure according to a time sequence to obtain initial graph structure data; adopting a correlation calculation method to perform combined calculation on the initial graph structure data to obtain target graph structure data with internal and external correlation indexes; obtaining an attention vector, performing residual correction on a predicted value by using a rolling residual factor in a long short-term memory model to obtain a current time state prediction value; performing same-cycle data fluctuation calculation on the current time state prediction value and a historical state prediction value, and generating alarm information in the case where it is identified that a calculation result meets an alarm threshold condition.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to a service anomaly alarm method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] In microservice systems, there are complex and intricate call relationships between basic services, core services, functional components, and middleware. Because microservice systems are prone to ripple effects from fault propagation, system crashes and equipment downtime due to upstream and downstream impacts are frequent occurrences. To prevent service failures from causing business interruptions, service anomaly warning systems are a commonly used system fault prevention method, playing a crucial role in application observability domains.

[0003] In traditional technologies, call chain analysis mainly includes three granularities: components, interfaces, and methods. These granularities range from coarse to fine. Currently, most research focuses on reducing system complexity and improving analysis efficiency, but is limited to interface-level research. It does not explore the execution flow and state changes of methods within services, and ignores influencing factors such as inter-method and user-side factors. The analysis results do not truly reflect the characteristics of inter-service calls. Anomaly detection methods are divided into two main categories: supervised learning and unsupervised learning. Both types of methods require statistical analysis based on the call relationships of service components, and cannot perform finer-grained and multi-dimensional analysis of the detected objects. They often suffer from problems such as low state detection accuracy and lack of adaptive capabilities. Summary of the Invention

[0004] Therefore, it is necessary to provide a service abnormal status alarm method, device, computer equipment, computer-readable storage medium, and computer program product to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for alerting service anomalies, including:

[0006] Obtain the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data into each time node of the call chain data to obtain a graph structure;

[0007] Based on the call chain data and the service log, user response information is calculated and then combined with the graph structure in a time sequence to obtain initial graph structure data.

[0008] The initial graph structure data is combined and calculated using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators.

[0009] Obtain the attention vector, combine the attention vector with the target graph structure data using a long short-term memory model to obtain a predicted value with long dependence, and use the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value.

[0010] The current state prediction value and the historical state prediction value are compared and calculated for year-on-year and month-on-month data fluctuation. If the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

[0011] In one embodiment, before performing combined calculations on the initial graph structure data using the correlation calculation method, the method further includes:

[0012] Based on the preset value of call type relevance, the call chain data is subjected to external relevance judgment and internal relevance judgment to obtain external relevance and internal relevance; based on the user response information, the weight of the external relevance is adjusted, and based on the high-frequency log data, the weight of the internal relevance is adjusted to obtain external relevance weight and internal relevance weight.

[0013] The step of using a correlation calculation method to perform combined calculations on the initial graph structure data further includes:

[0014] Based on the external correlation weights and the internal correlation weights, the initial graph structure data are combined and calculated using the correlation coefficient and rescaled range analysis method.

[0015] In one embodiment, after using the current state prediction value as the alarm threshold for the next alarm cycle, the method further includes:

[0016] If the user does not clear the alarm for a long time, reduce the proportion of the external correlation in the prediction attention mechanism and increase the proportion of the internal correlation in the prediction attention mechanism; the current period prediction value does not consider residual correction, and the preset value of the call type correlation is reduced according to the relevant volatility index to complete the adaptive adjustment of the alarm threshold of the micro service system.

[0017] In one embodiment, obtaining the attention vector includes:

[0018] In the target graph structure data, each time point is treated as a node, and the node is divided into time sequence edges and related feature edges. The time sequence edges are input into the long short-term memory model to obtain medium- and long-term dependencies, resulting in a hidden state sequence. The related feature edges are weighted by an attention mechanism in conjunction with the user response information. The hidden state sequence is then weighted and summed according to the attention weights to obtain the attention vector.

[0019] In one embodiment, the step of using the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value includes:

[0020] Obtain the residual sequence at preset continuous time points, and perform Fourier transform denoising on the residual sequence according to the prediction time window; compensate for the random error of the microservice system according to the Fourier transform denoising result; use the rolling residual factor to perform residual correction on the Fourier transform denoising result and the predicted value to obtain the current time state prediction value based on the rolling residual correction.

[0021] In one embodiment, before combining the user response information with the graph structure in a time series to obtain the initial graph structure data, the method further includes:

[0022] The user response information is parsed from the call chain of the authentication service, and the time period between the occurrence of the user alarm and the triggering of the authentication service is counted, as well as the number of logs and the number of logs at each level within the time period. Based on the statistical results, the alarm reduction effect of the user response is characterized by weighted calculation, and the weight ratio of the alarm reduction effect is reduced when the response time is less than the second alarm cycle.

[0023] Secondly, this application also provides a service anomaly alarm device, comprising:

[0024] The information acquisition module is used to acquire the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data into each time node of the call chain data to obtain a graph structure.

[0025] The information combination module is used to calculate user response information based on the call chain data and the service log, and combine the user response information with the graph structure in a time sequence to obtain initial graph structure data.

[0026] The combined calculation module is used to perform combined calculations on the initial graph structure data using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators.

[0027] The residual correction module is used to obtain the attention vector, combine the attention vector with the target graph structure data using a long short-term memory model to obtain a prediction value with long dependence, and use the rolling residual factor in the long short-term memory model to perform residual correction on the prediction value to obtain the current state prediction value.

[0028] The anomaly alarm module is used to perform year-on-year and month-on-month data fluctuation calculations on the current state prediction value and the historical state prediction value. If the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

[0029] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0030] The process involves: acquiring call chain data and service logs of the target service in the microservice system; classifying the service logs according to their importance to obtain high-frequency log data; recording the high-frequency log data into each time node of the call chain data to obtain a graph structure; calculating user response information based on the call chain data and service logs; combining the user response information with the graph structure in a time series to obtain initial graph structure data; using a correlation calculation method to combine and calculate the initial graph structure data to obtain target graph structure data with internal and external correlation indicators; acquiring an attention vector; combining the attention vector with the target graph structure data using a long short-term memory model to obtain a predicted value with long dependencies; using the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value; calculating the year-on-year and month-on-month data fluctuation of the current state prediction value and the historical state prediction value; generating an alarm message when the calculation result meets the alarm threshold condition; and using the current state prediction value as the alarm threshold for the next alarm cycle.

[0031] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0032] The process involves: acquiring call chain data and service logs of the target service in the microservice system; classifying the service logs according to their importance to obtain high-frequency log data; recording the high-frequency log data into each time node of the call chain data to obtain a graph structure; calculating user response information based on the call chain data and service logs; combining the user response information with the graph structure in a time series to obtain initial graph structure data; using a correlation calculation method to combine and calculate the initial graph structure data to obtain target graph structure data with internal and external correlation indicators; acquiring an attention vector; combining the attention vector with the target graph structure data using a long short-term memory model to obtain a predicted value with long dependencies; using the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value; calculating the year-on-year and month-on-month data fluctuation of the current state prediction value and the historical state prediction value; generating an alarm message when the calculation result meets the alarm threshold condition; and using the current state prediction value as the alarm threshold for the next alarm cycle.

[0033] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0034] The process involves: acquiring call chain data and service logs of the target service in the microservice system; classifying the service logs according to their importance to obtain high-frequency log data; recording the high-frequency log data into each time node of the call chain data to obtain a graph structure; calculating user response information based on the call chain data and service logs; combining the user response information with the graph structure in a time series to obtain initial graph structure data; using a correlation calculation method to combine and calculate the initial graph structure data to obtain target graph structure data with internal and external correlation indicators; acquiring an attention vector; combining the attention vector with the target graph structure data using a long short-term memory model to obtain a predicted value with long dependencies; using the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value; calculating the year-on-year and month-on-month data fluctuation of the current state prediction value and the historical state prediction value; generating an alarm message when the calculation result meets the alarm threshold condition; and using the current state prediction value as the alarm threshold for the next alarm cycle.

[0035] The aforementioned service anomaly alarm methods, devices, computer equipment, computer-readable storage media, and computer program products transform the call dependencies between functional methods and components within a microservice system into a graph structure. They hierarchically classify the call chain information, combine detailed call information within each method to construct a comprehensive call relationship topology, and, based on this topology, perform spatial and temporal correlation analysis using high-frequency log data and user response status. Considering both external correlations and internal fluctuation patterns, they calculate relevant volatility indicators and characterize the trend of microservice status using time-series data, providing foundational data for subsequent microservice application status prediction. Furthermore, they also address... Existing Long Short-Term Memory (LSTM) models suffer from low prediction accuracy for long time series, poor identification of key time step information, and lag in predicted data. This paper introduces a self-attention mechanism, using the correlation volatility index between data as a constraint, to dynamically adjust the prediction weights of the LTM model in different system warning indicators, achieving effective prediction of complex data. Furthermore, a rolling residual factor based on a time window is introduced to enhance the model's ability to capture and process prediction errors, enabling real-time correction of the LTM model and improving the accuracy of state detection. This allows the system to dynamically adjust alarm thresholds based on actual operating conditions, exhibiting strong adaptive adjustment capabilities, reducing human intervention, and improving the intelligence level and robustness of the microservice system. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a diagram illustrating the application environment of a service anomaly alerting method in one embodiment.

[0038] Figure 2 This is a flowchart illustrating a service anomaly alerting method in one embodiment;

[0039] Figure 3 This is a flowchart illustrating the steps for obtaining attention vectors in one embodiment;

[0040] Figure 4 This is a flowchart illustrating a service anomaly alerting method in a specific embodiment.

[0041] Figure 5 This is a flowchart illustrating a service anomaly alert method in an application embodiment.

[0042] Figure 6This is a structural block diagram of a service anomaly alarm device in one embodiment;

[0043] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0045] The service anomaly alarm method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown depicts a scenario where the terminal communicates with the server via a network. The data storage system stores the data that the server needs to process. This data storage system can be integrated onto the server, or it can be hosted in the cloud or on other network servers.

[0046] Specifically, the service abnormality alarm method provided in this application embodiment can be executed by the server.

[0047] For example, the server obtains the call chain data and service logs of the target service in the microservice system, classifies the service logs according to their importance to obtain high-frequency log data, and records the high-frequency log data into each time node of the call chain data to obtain a time sequence graph structure. The server calculates user response information based on the call chain data and service logs, and combines the user response information with the time sequence graph structure in a time series manner to obtain initial graph structure data. The server uses a correlation calculation method to combine and calculate the initial graph structure data to obtain target graph structure data with internal and external correlation indicators. The server obtains the attention vector, combines the attention vector with the target graph structure data using a preset long short-term memory model to obtain a predicted value with long dependencies, and uses the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value. The server calculates the year-on-year and month-on-month data fluctuation of the current state prediction value and the historical state prediction value. If the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

[0048] In such Figure 1 In the application environment shown, the terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. The server can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0049] In one embodiment, such as Figure 2As shown, a service anomaly status alarm method is provided, which can be applied to... Figure 1 Taking the server in the example, the following steps are included:

[0050] Step S201: Obtain the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data into each time node of the call chain data to obtain the time sequence diagram structure.

[0051] Call chain data can be data that tracks and records the execution path of requests in a microservice system. It is mainly used for monitoring, diagnosis, troubleshooting and performance optimization, especially for tracking the flow of requests between various services or modules in complex systems.

[0052] Service logs are log files that record various events, operations, and error information during the operation of a microservice system. They are typically used to track the health status of the system, diagnose problems, monitor performance, and ensure the stability of services.

[0053] Specifically, the server obtains the call chain data and service logs of the target service in the microservice system, classifies the service logs according to their importance to obtain high-frequency log data, and records the high-frequency log data to each time node of the call chain data to initially construct a graph structure.

[0054] Step S202: Calculate user response information based on call chain data and service logs, and combine the user response information with the time sequence graph structure according to time series to obtain the initial graph structure data.

[0055] User response information can include feedback information generated when users interact with the microservice system. This feedback information can include user input, clicks, selections, and the content of submitted forms.

[0056] Specifically, user response information is calculated from call chain data and service logs. User response information is parsed from the call chain of the authentication service, and the time from the occurrence of user alarm to the triggering of the authentication service is counted. Finally, the user response information is combined with the graph structure in time series to complete the initial data collection and obtain the initial graph structure data.

[0057] Step S203: Using the correlation calculation method, the initial graph structure data is combined and calculated to obtain the target graph structure data with internal and external correlation indicators.

[0058] Among them, correlation calculation methods can be correlation coefficient and rescaled range analysis. The correlation coefficient focuses on the strength and direction of the linear relationship between data, while the rescaled range analysis is a technique for standardizing data, usually used to eliminate scale differences between features. In practical applications, they can be used together to help us analyze the relationship between data more accurately.

[0059] Specifically, the server uses a combination of correlation coefficient and rescaled range analysis to perform combined calculations on the initial graph structure data, and finally outputs the target graph structure data with internal and external correlation indicators in time series, which consists of call chains.

[0060] Step S204: Obtain the attention vector, combine the attention vector with the target graph structure data using a preset long short-term memory model to obtain a prediction value with long dependence, and use the rolling residual factor in the long short-term memory model to perform residual correction on the prediction value to obtain the current state prediction value.

[0061] Attention vectors are a widely used concept in the field of deep learning. They originate from the "attention mechanism" and aim to mimic the way humans "attention" when processing information. That is, when humans process a large amount of information, they always selectively focus on some important parts and ignore other unimportant parts.

[0062] Among them, the Long Short-Term Memory (LSTM) model can be a type of time-recurrent neural network that addresses the long-term dependency problem inherent in recurrent neural networks.

[0063] Specifically, the server combines the attention vector with the temporal graph structure data and outputs prediction data with long dependencies through the fully connected layer. To improve the accuracy of the prediction model, it collects the continuous residual sequence of the first twenty time steps, sets a time window of length 5, performs Fourier transform noise reduction on the residual sequence, compensates for the random error of the system, and performs residual correction on the noise-reduced data and the corresponding time step prediction value. Finally, it obtains the current time step state prediction value based on rolling residual correction.

[0064] Step S205: Calculate the year-on-year and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. If the calculation result meets the alarm threshold condition, generate alarm information and use the current state prediction value as the alarm threshold for the next alarm cycle.

[0065] Among them, the alarm threshold condition can be that the predicted value fluctuates significantly compared with the data from X, Y, and Z days ago and the residual is large (X < Y < Z).

[0066] Specifically, based on the service key indicator prediction data (response time, request rate, and error rate), if the current state prediction value fluctuates significantly compared with the data from X days, Y days, and Z days ago, and the residual is large, it is considered that the service is abnormal at the current time, and the system issues an alarm. This prediction value is used as the alarm threshold for the next alarm cycle (X < Y < Z).

[0067] The aforementioned service anomaly alerting method transforms the functional methods and component call dependencies within the microservice system into a graph structure, hierarchically classifies the call chain information, and constructs a comprehensive call relationship topology by combining detailed call information within each method. Based on this topology, it utilizes high-frequency log data and user response status for spatial and temporal correlation analysis, comprehensively considering the impact of external correlations and internal fluctuation patterns to calculate relevant volatility indicators. These indicators are then used to characterize the trend of the microservice status through time-series data, providing foundational data for subsequent microservice application status prediction. Furthermore, it addresses the limitations of existing long short-term memory models for long-term... To address issues such as low sequence prediction accuracy, poor identification of key time step information, and lag in prediction data, a self-attention mechanism is introduced. Using the correlation volatility index between data as a constraint, the prediction weights of the Long Short-Term Memory (LSTM) model in different system warning indicators are dynamically adjusted to achieve effective prediction of complex data. Furthermore, a rolling residual factor based on a time window is introduced to enhance the model's ability to capture and process prediction errors, enabling real-time correction of the LSTM model and improving the accuracy of state detection. This allows the system to dynamically adjust alarm thresholds based on actual operating conditions, exhibiting strong adaptive adjustment capabilities, reducing human intervention, and improving the intelligence level and robustness of the microservice system.

[0068] In one embodiment, before performing combined calculations on the initial graph structure data using a correlation calculation method, the method of this application further includes the following steps:

[0069] Based on the preset value of call type relevance, external relevance and internal relevance are judged on the call chain data to obtain external relevance and internal relevance; based on user response information, the weight of external relevance is adjusted, and based on high-frequency log data, the weight of internal relevance is adjusted to obtain external relevance weight and internal relevance weight.

[0070] In step S203 above, the correlation calculation method is used to perform combined calculations on the initial graph structure data, specifically including the following steps:

[0071] Based on external correlation weights and internal correlation weights, the correlation coefficient and rescaled range analysis method are used to perform combined calculations on the initial graph structure data.

[0072] It should be noted that microservice call chain data exhibits characteristics such as self-similarity, periodicity, and burstiness. This application, based on the idea of ​​judging the internal and external correlations of time series data, performs external correlation judgment and internal pattern judgment on call chain information. Calls between services and between interfaces are considered external correlations, while calls between methods and between methods and functional components are considered internal correlations. The weights for each type of correlation are preset by the user, as shown in Table 1 below, and are subsequently dynamically adjusted through a prediction model.

[0073] Table 1. Preset values ​​for call type relevance

[0074]

[0075] To further explore the relationships between services, high-frequency log data and user response status are quantified as influencing factors to characterize the call weight of microservices within different time intervals. High-frequency log data is used to compensate for the lack of internal correlation, and is directly linked to internal correlation in scenarios with surges in traffic, thus increasing the weight of internal correlation. User response status affects the calculation of external correlation; response efficiency and alarm deflation jointly determine the importance of the target service. When user response metrics are low, the target service has weak external correlation and strong internal correlation, and vice versa. The final output is a target graph structure data composed of call chains with time-series internal and external correlation metrics.

[0076] In one embodiment, after using the current state prediction value as the alarm threshold for the next alarm cycle, the method of this application further includes the following steps:

[0077] If users do not clear alarms for an extended period, the proportion of external correlation in the prediction attention mechanism is reduced, while the proportion of internal correlation is increased. The current periodic prediction value does not consider residual correction, and the preset value of call type correlation is reduced based on relevant volatility indicators to achieve adaptive adjustment of alarm thresholds in the microservice system.

[0078] Specifically, when the server detects that a user has not cleared the alarm for a long time, it reduces the proportion of external correlation in the prediction attention mechanism and increases the proportion of internal correlation in the prediction attention mechanism; and it makes the current periodic prediction value not consider residual correction, and reduces the preset value of call type correlation according to relevant volatility indicators, so as to complete the adaptive adjustment of the alarm threshold of the microservice system.

[0079] In one embodiment, such as Figure 3 As shown, in step S204 above, obtaining the attention vector specifically includes the following steps:

[0080] Step S301: In the target graph structure data, each time point is treated as a node, and the node is divided into time sequence edges and related feature edges.

[0081] Step S302: Input the time sequence edge into the long short-term memory model to obtain the medium- and long-term dependencies and obtain the hidden state sequence.

[0082] In step S303, the attention weights of the relevant feature edges are calculated by combining the user response information with the attention mechanism. The hidden state sequence is then weighted and summed according to the attention weights to obtain the attention vector.

[0083] Specifically, the server combines the target graph structure data and treats each time point as a node. Each node is further divided into time sequence edges and related feature edges. The time sequence edges are input into the long short-term memory model to obtain medium- and long-term dependencies, resulting in a hidden state sequence. The related feature edges are weighted by the attention mechanism in conjunction with the user's response state. The attention weights are used to perform a weighted summation on the hidden state sequence to obtain an attention vector. The attention vector is combined with the time sequence graph structure data and output through a fully connected layer to produce prediction data with long dependencies.

[0084] In one embodiment, step S204 above involves using the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value. This specifically includes the following steps:

[0085] Obtain the residual sequence at preset continuous time points, and perform Fourier transform denoising on the residual sequence according to the prediction time window; compensate for the random error of the microservice system based on the Fourier transform denoising result; use the rolling residual factor to perform residual correction on the Fourier transform denoising result and the predicted value to obtain the current time state prediction value based on the rolling residual correction.

[0086] Specifically, the server obtains the continuous residual sequence of the first twenty time points, sets a time window of length 5, performs Fourier transform on the residual sequence to reduce noise, compensates for the random error of the system, and performs residual correction on the denoised data and the corresponding time point prediction value, and finally obtains the current time point state prediction value based on rolling residual correction, thereby effectively improving the accuracy of the prediction model.

[0087] In one embodiment, before combining user response information with the graph structure in a time series to obtain initial graph structure data, the method of this application further includes the following steps:

[0088] The system parses user response information from the authentication service call chain, counts the time period between the occurrence of a user alarm and the triggering of the authentication service, as well as the number of logs and the number of logs at each level within the time period. Based on the statistical results, it uses weighted calculation to characterize the alarm reduction effect of the user response, and reduces the weight of the alarm reduction effect when the response time is less than the secondary alarm cycle.

[0089] Specifically, user response information can be calculated jointly from call chain data and service logs. User response information is parsed from the authentication service call chain, and the time from the occurrence of a user alarm to the triggering of the authentication service is statistically analyzed. This time period characterizes the user's response efficiency to the current service alarm. Simultaneously, the number of logs and the number of logs at each level at that moment are statistically analyzed. A weighted calculation is used to characterize the alarm reduction effect of the user's response. When the response time is less than the secondary alarm cycle, the response efficiency is considered high, and the weight of the alarm reduction effect is reduced; conversely, the weight of the alarm reduction effect in the calculation of user response information is increased. Finally, the user response information is combined with a graph structure according to the time series to complete the initial data collection.

[0090] In one embodiment, such as Figure 4 As shown, a service anomaly status alarm method is provided in a specific embodiment, which specifically includes the following steps:

[0091] Step S401: Obtain the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data to each time node of the call chain data to obtain a graph structure.

[0092] Step S402: Calculate user response information based on call chain data and service logs, and combine the user response information with the graph structure in time series to obtain initial graph structure data.

[0093] Step S403: Based on the preset value of call type relevance, perform external relevance judgment and internal relevance judgment on the call chain data to obtain external relevance and internal relevance; adjust the weight of external relevance based on user response information, and adjust the weight of internal relevance based on high-frequency log data to obtain external relevance weight and internal relevance weight.

[0094] Step S404: Based on the external correlation weight and the internal correlation weight, the correlation coefficient and rescaled range analysis method are used to combine and calculate the initial graph structure data to obtain the target graph structure data with internal and external correlation indicators.

[0095] Step S405: In the target graph structure data, each time point is treated as a node, and the node is divided into time sequence edges and related feature edges. The time sequence edges are input into the long short-term memory model to obtain medium- and long-term dependencies, thus obtaining the hidden state sequence. The related feature edges are calculated by the attention mechanism in combination with user response information. The hidden state sequence is weighted and summed according to the attention weights to obtain the attention vector.

[0096] Step S406: The attention vector is combined with the target graph structure data using a preset long short-term memory model to obtain a prediction value with long-term dependence.

[0097] Step S407: Obtain the residual sequence of preset continuous time periods, and perform Fourier transform noise reduction on the residual sequence according to the prediction time window; compensate for the random error of the microservice system according to the Fourier transform noise reduction result; use the rolling residual factor to perform residual correction on the Fourier transform noise reduction result and the predicted value to obtain the current time state prediction value based on the rolling residual correction.

[0098] Step S408: Calculate the year-on-year and month-on-month data fluctuations of the current state prediction value and the historical state prediction value. If the calculation result meets the alarm threshold condition, generate alarm information and use the current state prediction value as the alarm threshold for the next alarm cycle.

[0099] The beneficial effects of the above embodiments are as follows:

[0100] This application proposes a service anomaly alerting method, which aims to quickly and accurately identify anomalies in microservice systems. Based on the anomaly status and the user's historical response patterns, the method dynamically adjusts the system fault warning threshold to solve the problems of alarm overload and poor accuracy, improve warning quality and service observability, and thus ensure the stable operation of microservice systems.

[0101] To more clearly illustrate the service anomaly alerting method provided in this application embodiment, the following detailed description uses an application embodiment. In one embodiment, as follows... Figure 5 As shown, this application also provides a service anomaly status alarm method, which specifically includes the following steps:

[0102] Step 1: To supplement the data association between the call chain, service logs, and user response information, service logs are classified according to importance: info, warn, and error. The error level corresponds to error logs, while the info and warn levels correspond to request rates. The classified high-frequency log data is recorded in each time node of the call chain time-series data, initially constructing a graph structure. User response information is calculated jointly from call chain information and service logs. User information is parsed from the authentication service call chain, and the time from the occurrence of a user alarm to the triggering of the authentication service is statistically analyzed. This time period represents the user's response efficiency to the current service alarm. The number of logs and the number of logs at each level at this moment are statistically analyzed, and a weighted calculation is used to represent the alarm reduction effect of the user's response. When the response time is less than the secondary alarm cycle, the response efficiency is considered high, and the weight of the alarm reduction effect is reduced; conversely, the weight of the alarm reduction effect in the calculation of user response information is increased. User response information and the graph structure are combined in time series to complete the initial data collection.

[0103] Step Two: The correlation calculation method combines correlation coefficient and rescaled range analysis. To further explore the correlation between services, high-frequency log data and user response status are quantified as influencing factors to characterize the call weight of microservices in each time interval. High-frequency log data is used to compensate for the lack of internal correlation and is directly linked to internal correlation in scenarios with traffic surges, thus increasing the weight of internal correlation. User response status affects the calculation of external correlation. Response efficiency and alarm suppression effect jointly determine the importance of the target service. When the user response index is low, the external correlation of the target service is weak and the internal correlation is strong, and vice versa. The final output is a time-series graph structure data composed of call chains with internal and external correlation indicators.

[0104] Step 3: Combining the time series graph structure data described above, each time point is treated as a node. Each node is further subdivided into time sequence edges and related characteristic edges. The time sequence edges are input into a Long Short-Term Memory (LSTM) model to obtain medium- to long-term dependencies, resulting in a hidden state sequence. Related characteristic edges are weighted using an attention mechanism based on user response states. These attention weights are then used to weight and sum the hidden state sequences to obtain an attention vector. This attention vector is combined with the time series graph structure data and output through a fully connected layer to generate prediction data with long dependencies. To improve the accuracy of the prediction model, continuous residual sequences from the first twenty time points are collected. A time window of length 5 is set, and Fourier transform is applied to the residual sequences for noise reduction to compensate for random errors in the system. The denoised data is then compared with the predicted values ​​at the corresponding time points for residual correction, ultimately yielding the current state prediction value based on rolling residual correction.

[0105] Step 4: Based on the predicted data of the aforementioned key indicators, when the predicted value shows significant fluctuations and large residuals compared to data from 1, 3, and 7 days ago, the system considers the current service abnormal and issues an alarm. This predicted value serves as the alarm threshold for the next alarm cycle. If the user does not clear the alarm for an extended period, the proportion of external correlation in the prediction attention mechanism is reduced, while the impact of internal correlation is increased. The predicted value for the current cycle does not consider residual correction, and the correlation preset value is reduced based on relevant volatility indicators, thus completing the adaptive adjustment of the system alarm threshold.

[0106] The beneficial effects of the above embodiments are as follows:

[0107] To address the current issues of alarm proliferation, severe noise, poor alarm correlation, insufficient observability, and lack of adaptive adjustment capabilities in microservice systems, this application proposes a service anomaly state alarm method. First, based on observable call chains, the functional methods and inter-component call dependencies within the microservice system are hierarchically classified and transformed into a graph structure. Second, spatial and temporal correlation analysis is performed using high-frequency log data and user response status to characterize the microservice state trend as time-series data. Finally, an improved Long Short-Term Memory (LSTM) model is used to predict the microservice state, and a rolling residual factor is designed to compensate for the accumulated error caused by response lag in the prediction model by capturing the effective movement trend of the sequence. Ultimately, the alarm threshold is dynamically adjusted based on the prediction results, achieving adaptive alarm adjustment for the microservice system and improving alarm quality. This application is applicable to microservice fire suppression graph governance scenarios, adaptively adjusting thresholds for the massive alarms generated by microservice systems, effectively avoiding alarm proliferation while improving alarm quality, thereby achieving early prevention and remediation of service failures.

[0108] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0109] Based on the same inventive concept, this application also provides a service anomaly alarm device for implementing the service anomaly alarm method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more service anomaly alarm device embodiments provided below can be found in the limitations of the service anomaly alarm method described above, and will not be repeated here.

[0110] In one exemplary embodiment, such as Figure 6 As shown, a service anomaly alarm device is provided, comprising:

[0111] The information acquisition module 601 is used to acquire the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data into each time node of the call chain data to obtain a graph structure.

[0112] The information combination module 602 is used to calculate based on the call chain data and the service log to obtain user response information, and to combine the user response information with the graph structure in a time sequence to obtain initial graph structure data.

[0113] The combined calculation module 603 is used to perform combined calculations on the initial graph structure data using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators.

[0114] The residual correction module 604 is used to obtain the attention vector, combine the attention vector with the target graph structure data using a preset long short-term memory model to obtain a prediction value with long dependence, and use the rolling residual factor in the long short-term memory model to perform residual correction on the prediction value to obtain the current state prediction value.

[0115] The abnormal alarm module 605 is used to perform year-on-year and month-on-month data fluctuation calculations on the current state prediction value and the historical state prediction value. When the calculation result is found to meet the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

[0116] In one embodiment, the service anomaly alarm device further includes a weight adjustment module, which is used to perform external correlation judgment and internal correlation judgment on the call chain data according to the call type correlation preset value to obtain external correlation and internal correlation; adjust the weight of the external correlation according to the user response information, and adjust the weight of the internal correlation according to the high-frequency log data to obtain external correlation weight and internal correlation weight.

[0117] The combined calculation module 603 is also used to perform combined calculations on the initial graph structure data based on the external correlation weights and the internal correlation weights, using the correlation coefficient and rescaled range analysis method.

[0118] In one embodiment, the service anomaly alarm device further includes a threshold adjustment module, which is used to reduce the proportion of the external correlation in the prediction attention mechanism and increase the proportion of the internal correlation in the prediction attention mechanism when the user has not cleared the alarm for a long time; the current periodic prediction value does not consider residual correction, and the preset value of the call type correlation is reduced according to the relevant volatility index to complete the adaptive adjustment of the alarm threshold of the service system.

[0119] In one embodiment, the residual correction module 604 is further configured to treat each time point as a node in the target graph structure data, and divide the node into time sequence edges and related feature edges; input the time sequence edges into the long short-term memory model to obtain medium- and long-term dependencies, thereby obtaining a hidden state sequence; the related feature edges are calculated by an attention mechanism in combination with the user response information to obtain attention weights, and the hidden state sequence is weighted and summed according to the attention weights to obtain the attention vector.

[0120] In one embodiment, the residual correction module 604 is further configured to acquire a residual sequence of preset continuous time intervals, and perform Fourier transform noise reduction on the residual sequence according to the prediction time window; compensate for the random error of the microservice system according to the Fourier transform noise reduction result; and use the rolling residual factor to perform residual correction on the Fourier transform noise reduction result and the predicted value to obtain the current time state prediction value based on the rolling residual correction.

[0121] In one embodiment, the service anomaly alarm device further includes an effect characterization module, which is used to parse the user response information from the call chain of the authentication service, count the time period between the time of the user alarm occurrence and the time of triggering the authentication service, as well as the number of logs and the number of logs at each level during the time period; based on the statistical results, the alarm reduction effect of the user response alarm is characterized by weighted calculation, and the weight ratio of the alarm reduction effect is reduced when the response time is less than the secondary alarm cycle.

[0122] Each module in the aforementioned service anomaly alarm device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0123] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores storage service logs and call chain data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a service anomaly alarm method.

[0124] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0125] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0126] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0127] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0129] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0130] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0131] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for alarming abnormal service status, characterized in that, The method includes: Obtain the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data into each time node of the call chain data to obtain a time sequence diagram structure; Based on the call chain data and the service log, user response information is calculated and then combined with the time sequence graph structure in a time sequence to obtain initial graph structure data. The initial graph structure data is combined and calculated using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators. In the target graph structure data, each time point is treated as a node, and the node is divided into temporal sequence edges and related feature edges. The temporal sequence edges are input into a long short-term memory model to obtain medium- and long-term dependencies, resulting in a hidden state sequence. The related feature edges are weighted by an attention mechanism combined with the user response information. The hidden state sequence is then weighted and summed according to the attention weights to obtain an attention vector. The attention vector is then combined with the target graph structure data using the long short-term memory model to obtain a predicted value with long-term dependencies. Finally, the predicted value is residual-corrected using the rolling residual factor in the long short-term memory model to obtain the current state prediction value. The current state prediction value and the historical state prediction value are compared and calculated for year-on-year and month-on-month data fluctuation. If the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

2. The method according to claim 1, characterized in that, Before performing the combined calculation on the initial graph structure data using the correlation calculation method, the method further includes: Based on the preset value of call type relevance, the call chain data is subjected to external relevance judgment and internal relevance judgment to obtain external relevance and internal relevance; Based on the user response information, the weight of the external correlation is adjusted, and based on the high-frequency log data, the weight of the internal correlation is adjusted to obtain the external correlation weight and the internal correlation weight. The step of using a correlation calculation method to perform combined calculations on the initial graph structure data further includes: Based on the external correlation weights and the internal correlation weights, the initial graph structure data are combined and calculated using the correlation coefficient and rescaled range analysis method.

3. The method according to claim 2, characterized in that, After using the current state prediction value as the alarm threshold for the next alarm cycle, the method further includes: If the user does not clear the alarm for a long time, reduce the proportion of the external correlation in the prediction attention mechanism and increase the proportion of the internal correlation in the prediction attention mechanism. The current periodic forecast value does not consider residual correction. Based on relevant volatility indicators, the preset value of the call type correlation is reduced to complete the adaptive adjustment of the alarm threshold of the micro-service system.

4. The method according to claim 1, characterized in that, The step of using the rolling residual factor in the long short-term memory model to perform residual correction on the predicted value to obtain the current state prediction value includes: Obtain the residual sequence at preset consecutive time points, and perform Fourier transform noise reduction on the residual sequence according to the prediction time window; Based on the Fourier transform noise reduction results, the random errors of the microservice system are compensated. Using the rolling residual factor, the Fourier transform denoising result and the predicted value are subjected to residual correction to obtain the current state prediction value based on the rolling residual correction.

5. The method according to any one of claims 1 to 4, characterized in that, Before combining the user response information with the graph structure in a time series to obtain the initial graph structure data, the method further includes: The user response information is parsed from the call chain of the authentication service, and the time period between the time of the user alarm and the time of triggering the authentication service is counted, as well as the number of logs and the number of logs at each level within the time period. Based on the statistical results, the alarm cancellation effect of user response is characterized by weighted calculation, and the weight ratio of the alarm cancellation effect is reduced when the response time is less than the second alarm cycle.

6. A service anomaly alarm device, characterized in that, The device includes: The information acquisition module is used to acquire the call chain data and service logs of the target service in the microservice system, classify the service logs according to their importance to obtain high-frequency log data, and record the high-frequency log data into each time node of the call chain data to obtain a time sequence diagram structure. The information combination module is used to calculate user response information based on the call chain data and the service log, and combine the user response information with the time sequence graph structure in a time sequence to obtain the initial graph structure data. The combined calculation module is used to perform combined calculations on the initial graph structure data using a correlation calculation method to obtain target graph structure data with internal and external correlation indicators. The residual correction module is used to treat each time point as a node in the target graph structure data, and divide the node into temporal sequence edges and related feature edges; input the temporal sequence edges into a long short-term memory model to obtain medium- and long-term dependencies, thereby obtaining a hidden state sequence; the related feature edges are calculated by an attention mechanism in combination with the user response information, and the hidden state sequence is weighted and summed according to the attention weights to obtain an attention vector; the attention vector is combined with the target graph structure data using the long short-term memory model to obtain a predicted value with long-term dependencies; and the predicted value is residual-corrected using the rolling residual factor in the long short-term memory model to obtain the current state prediction value. The anomaly alarm module is used to perform year-on-year and month-on-month data fluctuation calculations on the current state prediction value and the historical state prediction value. If the calculation result meets the alarm threshold condition, an alarm message is generated, and the current state prediction value is used as the alarm threshold for the next alarm cycle.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images