Intelligent memory leak predicting and tracking method and system for micro-service architecture

Abstract

The invention provides an intelligent memory leak prediction and tracking method and system for a micro-service architecture, and relates to the technical field of memory leak prediction, and the method comprises the steps: collecting the runtime data of a service node, constructing a service calling topological graph, extracting the time sequence and topological features, and carrying out the feature fusion. And constructing a deep learning prediction model by combining a bidirectional long-short term memory network with a multi-head attention mechanism and a graph attention network, and predicting a memory use trend and a risk score of a service node. Potential memory leak nodes are identified according to the risk score and the abnormal degree predicted value, a key propagation path is identified through a service calling topological graph and a minimum cut algorithm, and finally a root service of memory leak is positioned by using a belief propagation algorithm, so that accurate prediction and rapid positioning of the memory leak in the micro-service system are realized. And the system stability and reliability are improved.

Description

Technical Field

[0001] The present invention relates to a memory leak prediction technology, and in particular to a memory leak intelligent prediction and tracking method and system for a microservice architecture. Background Art

[0002] Microservice architecture has become the mainstream design pattern for modern distributed systems. It splits complex applications into multiple small, autonomous service units. This architecture improves the scalability, flexibility, and maintainability of the system. However, microservice architecture also brings new challenges, one of which is that it becomes more difficult to detect and locate memory leaks. Traditional memory leak detection tools are usually difficult to adapt to the characteristics of a large number of services and complex call relationships in a microservice environment.

[0003] Difficult to adapt to the complexity of microservice architecture: Traditional memory leak detection tools are mostly designed for monolithic applications. It is difficult to effectively analyze the complex call relationships and dependency propagation between services in a microservice system, which makes it difficult to accurately locate the root service of the memory leak. Lack of adaptability to dynamic changes: The number of service nodes, call relationships, and request traffic in a microservice system often show dynamic changes. Existing methods often find it difficult to adapt to such dynamic changes, resulting in reduced detection accuracy. High false alarm rate: Due to the large number of service nodes in a microservice system, a simple threshold alarm mechanism is prone to generate a large number of false alarms, which brings a heavy burden to operation and maintenance personnel and makes it difficult to effectively identify real memory leak problems. Summary of the invention

[0004] The embodiments of the present invention provide a method and system for intelligently predicting and tracing memory leaks for a microservice architecture, which can solve the problems in the prior art.

[0005] According to a first aspect of the embodiments of the present invention,

[0006] Provides intelligent memory leak prediction and tracking methods for microservice architecture, including:

[0007] Collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; extract the in-and-out degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix of the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service node;

[0008] A bidirectional long short-term memory network is constructed according to the comprehensive feature vector of the service node, a multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and different weights are assigned to the features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; the output features of the bidirectional long short-term memory network are dynamically fused with the output features of the graph attention network layer to train a deep learning prediction model; the deep learning prediction model is used to predict the future memory usage trend of each service node to generate a memory leakage risk score and an abnormality degree prediction value;

[0009] The global risk mean and standard deviation are calculated based on the memory leakage risk score; the service nodes are sorted in descending order according to the memory leakage risk score, and the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation are selected as high-risk service nodes; the predicted value of the abnormality level of the high-risk service node is compared with the preset abnormality threshold to determine the potential memory leakage node; the service call topology graph is used to perform upstream and downstream analysis on the potential memory leakage node to construct a memory leakage propagation subgraph; the minimum cut algorithm is applied to the memory leakage propagation subgraph to identify the key propagation path; according to the key propagation path and the predicted value of the abnormality level of each node, the belief propagation algorithm is used to calculate the probability of the leakage source node, and the root service of the memory leakage is located.

[0010] Build a service call topology diagram, record the call relationship, call frequency, and request flow between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node, including:

[0011] Collect call data between nodes of the microservice system, and build an initial service call topology graph based on the call data, where the nodes in the initial service call topology graph represent microservices, and the directed edges between the nodes represent call relationships;

[0012] Calculating the call characteristics for each directed edge in the initial service call topology graph, including: obtaining the call frequency by counting the number of calls per unit time, obtaining the call traffic by accumulating the request data size, and obtaining the call delay by calculating the average response time; normalizing the call frequency, the call traffic, and the call delay, determining the optimal weight coefficient by using a grid search method, and obtaining the call strength of the edge by weighted summation; updating the edge weight of the initial service call topology graph based on the call strength, and obtaining a weighted service call topology graph;

[0013] Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, garbage collection trigger times, and memory released by garbage collection; set a sliding window of 30 minutes for the runtime data, and the window sliding step is 5 minutes; in each sliding window, calculate the memory growth rate characteristics, specifically by performing first-order difference and exponential smoothing on the memory usage sequence; calculate the memory recovery rate characteristics, specifically by analyzing the ratio of the amount of memory released by garbage collection to the recovery time interval; analyze the memory allocation pattern characteristics, specifically by extracting the spatial locality and temporal locality indicators of memory allocation; arrange the memory growth rate characteristics, the memory recovery rate characteristics, and the memory allocation pattern characteristics of each node in the sliding window in chronological order, and construct a node timing feature matrix.

[0014] Extracting the in-and-out degree, centrality, and connectivity indexes of the service nodes based on the service call topology graph, and constructing a topological feature matrix of the service nodes; fusing the temporal feature matrix with the topological feature matrix to generate a comprehensive feature vector of the service nodes includes:

[0015] Extracting basic topological features of each service node based on the service call topology graph, counting the number of incoming edges to obtain an in-degree value, and counting the number of outgoing edges to obtain an out-degree value; accumulating the call strengths of all incoming edges corresponding to the service node to obtain a weighted in-degree value, and accumulating the call strengths of all outgoing edges to obtain a weighted out-degree value; calculating the degree centrality of the node based on the weighted in-degree value and the weighted out-degree value;

[0016] Based on the service call topology graph, the high-order topological features of each service node are calculated. The shortest path distance between nodes is calculated based on the call intensity of the edge. The closeness centrality is calculated based on the shortest path distance from the node to all other nodes. The betweenness centrality is obtained by counting the proportion of paths passing through the node in all shortest paths. The edge density between node neighbors is calculated to obtain the clustering coefficient. The connection pattern between the node and its neighbors is analyzed to obtain the structural hole coefficient. The K-core value is calculated by iteratively deleting low-degree nodes.

[0017] Arrange the in-degree value, the out-degree value, the weighted in-degree value, the weighted out-degree value, the degree centrality, the closeness centrality, the betweenness centrality, the clustering coefficient, the structural hole coefficient, and the K-core value of each service node in a preset feature order to construct a topological feature vector of the node; combine the topological feature vectors of all service nodes into a topological feature matrix;

[0018] Calculating the similarity between the topological feature matrix and the temporal feature matrix to generate an attention weight matrix; performing a weighted combination of the topological feature matrix and the temporal feature matrix according to the attention weight matrix to obtain a fusion feature matrix;

[0019] The fused feature matrix is ​​subjected to nonlinear transformation to obtain a transformed feature matrix; the fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector representing the multi-dimensional features of the service node.

[0020] A bidirectional long short-term memory network is constructed according to the comprehensive feature vector of the service node, a multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and different weights are given to features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; the output features of the bidirectional long short-term memory network are dynamically integrated with the output features of the graph attention network layer, and the training of the deep learning prediction model includes:

[0021] The comprehensive feature vector of the service node is input into a bidirectional long short-term memory network; the bidirectional long short-term memory network processes the feature sequence before the current time window through a forward path to obtain a forward hidden state, and processes the feature sequence after the current time window through a backward path to obtain a backward hidden state; the forward hidden state and the backward hidden state are concatenated to obtain a temporal output feature of the bidirectional long short-term memory network;

[0022] A multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and the time series output features are respectively mapped into a query vector, a key vector and a value vector through linear transformation; the association degree between features of different time windows is independently calculated using multiple parallel attention heads, and each attention head outputs a corresponding weighted feature; the weighted features of the multiple attention heads are concatenated and subjected to linear transformation to obtain the output features of the bidirectional long short-term memory network with different time window weights assigned;

[0023] A graph attention network layer is constructed based on the service call topology graph, and the dependency strength between service nodes is calculated through the graph attention calculation unit; the features of adjacent nodes are adaptively aggregated according to the dependency strength to capture the dependency propagation relationship between service nodes; a multi-head attention mechanism is used to learn different types of node interaction modes respectively, and the outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer;

[0024] Constructing a feature dynamic fusion module, inputting the output features of the bidirectional long short-term memory network and the output features of the graph attention network layer into the feature dynamic fusion module; calculating the fusion gating value through a learnable weight matrix, and determining the fusion weights of the two types of features according to the fusion gating value; dynamically weighting and combining the two types of features according to the corresponding fusion weights to obtain the fused prediction features;

[0025] A deep learning prediction model is trained based on the fused prediction features; a loss function including a prediction error term and a regularization term is constructed, wherein the prediction error term measures the deviation between the predicted value and the true value, and the regularization term includes parameter regularization and graph structure regularization; a back propagation algorithm is used to optimize the model parameters so that the loss function converges to obtain a trained prediction model.

[0026] The deep learning prediction model is used to predict the future memory usage trend of each service node, and the memory leakage risk score and abnormality prediction value generated include:

[0027] Obtain a historical feature sequence of a recent time window of a target service node, wherein the historical feature sequence includes memory usage, CPU utilization, and request response time; input the historical feature sequence into a deep learning prediction model, and the deep learning prediction model generates a memory usage prediction sequence for a future time window according to the temporal variation law of the historical feature sequence;

[0028] Performing time series decomposition on the memory usage prediction sequence, extracting the trend component, periodic component, and random component of the memory usage prediction sequence; calculating the growth rate and growth acceleration of memory usage based on the trend component, wherein the growth rate is obtained by the difference between adjacent time points, and the growth acceleration is obtained by the difference between the growth rates; and calculating the memory leakage risk score by a weighted combination method according to the growth rate, the growth acceleration, and the fluctuation amplitude of the random component;

[0029] Constructing a benchmark sequence library, wherein the benchmark sequence library contains multiple typical memory usage pattern sequences, each pattern sequence corresponding to a normal system operation state; using a dynamic time warping algorithm to respectively calculate the distance between the memory usage prediction sequence and each pattern sequence in the benchmark sequence library; selecting the most similar N pattern sequences as reference sequences according to the distance, wherein N is a preset positive integer;

[0030] A probability distribution model describing a normal state is constructed based on the reference sequence; the likelihood probability of the memory usage prediction sequence under the probability distribution model is calculated; and a quantitative abnormality degree prediction value is generated by combining the likelihood probability, the memory leakage risk score, and the degree of deviation of the periodic component.

[0031] The global risk mean and standard deviation are calculated based on the memory leakage risk score; the service nodes are sorted in descending order according to the memory leakage risk score, and the service nodes whose risk scores are greater than the sum of the global risk mean and the standard deviation are selected as high-risk service nodes, and the abnormality prediction value of the high-risk service node is compared with the preset abnormality threshold to determine the potential memory leakage node; the service call topology graph is used to perform upstream and downstream analysis on the potential memory leakage node to construct a memory leakage propagation subgraph; the minimum cut algorithm is applied to the memory leakage propagation subgraph to identify the key propagation path, including:

[0032] Obtaining a predicted value of the abnormality level of the high-risk service node, calculating an adaptive threshold based on the predicted value of the abnormality level, and dynamically adjusting the adaptive threshold according to the distribution of the predicted value of the abnormality level of the high-risk service node; comparing the predicted value of the abnormality level of the high-risk service node with the adaptive threshold, and determining the high-risk service node whose predicted value of the abnormality level is greater than the adaptive threshold as a potential memory leak node;

[0033] Construct a service call topology graph, wherein the edge weights in the service call topology graph are weighted by call frequency, response delay, and resource dependency; take the potential memory leak node as the central node, perform a bidirectional traversal in the service call topology graph, and obtain upstream and downstream nodes that have a direct or indirect call relationship with the central node, wherein the traversal depth of the upstream and downstream nodes is dynamically determined according to the edge weights;

[0034] The central node and the upstream and downstream nodes form a memory leak propagation subgraph, and the propagation probability is calculated based on the memory leak risk score, abnormality prediction value and edge weight of the node; the propagation probability represents the possibility of memory leak propagation through the connection between nodes, and the larger the propagation probability, the easier it is for the memory leak to spread along the path;

[0035] A network flow model is constructed in the memory leak propagation subgraph, the central node is set as the source point, and the edge nodes in the upstream and downstream nodes are set as the sink points; the minimum cut algorithm is applied to the network flow model, and the minimum cut set is obtained through iterative calculation, wherein the minimum cut set includes an edge set with the minimum propagation probability and; the key propagation path is identified based on the minimum cut set.

[0036] According to the critical propagation path and the predicted value of the abnormality degree of each node, the belief propagation algorithm is used to calculate the probability of the leak source node. The root cause of the memory leak location service includes:

[0037] Obtain the abnormality prediction values ​​of the key propagation path and each node, set the service nodes in the key propagation path as variable nodes, and set the call relationship between nodes as factor nodes; map the abnormality prediction value to the initial belief value of the variable node, and construct the correlation function between nodes according to the call frequency, response delay, and resource dependence between nodes;

[0038] Establishing a message transmission channel between the variable node and the factor node, the message content includes the leakage state and leakage degree of the node; inputting the initial belief value of the variable node into the belief propagation algorithm, and updating the message in the message transmission channel through iterative calculation; calculating the probability of each variable node being a leakage source based on the convergence state of the message;

[0039] Sort the variable nodes according to the leakage source probability, and select the node with the highest probability as the candidate leakage source node; analyze the memory allocation mode, abnormal behavior characteristics, and resource occupancy of the candidate leakage source node, and verify the credibility of the candidate leakage source node in combination with historical leakage data; and determine the final leakage source node;

[0040] Taking the leak source node as the starting point, a breadth-first traversal is performed in the memory leak propagation subgraph to obtain a set of affected nodes; the risk level of each node in the affected node set is calculated, and the risk level is jointly determined by the leak source probability of the node, the predicted value of the abnormality level, and the topological distance from the leak source node; a tracing analysis report is generated, and the tracing analysis report includes: leak source identification results, propagation path analysis, and impact range assessment.

[0041] According to a second aspect of the embodiments of the present invention,

[0042] Provides an intelligent memory leak prediction and tracking system for microservice architecture, including:

[0043] The first unit is used to collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; extract the in-and-out degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix of the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service node;

[0044] The second unit is used to construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism in the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node, and generate a memory leakage risk score and anomaly degree prediction value;

[0045] The third unit is used to calculate the global risk mean and standard deviation based on the memory leakage risk score; sort the service nodes in descending order according to the memory leakage risk score, and select the service nodes with risk scores greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; compare the abnormality prediction value of the high-risk service node with the preset abnormality threshold to determine the potential memory leakage node; use the service call topology map to perform upstream and downstream analysis on the potential memory leakage node and construct a memory leakage propagation subgraph; apply the minimum cut algorithm in the memory leakage propagation subgraph to identify the key propagation path; according to the key propagation path and the abnormality prediction value of each node, use the confidence propagation algorithm to calculate the probability of the leakage source node, and locate the root service of the memory leakage.

[0046] According to a third aspect of the embodiments of the present invention,

[0047] An electronic device is provided, comprising:

[0048] processor;

[0049] a memory for storing processor-executable instructions;

[0050] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0051] According to a fourth aspect of the embodiments of the present invention,

[0052] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0053] The beneficial effects of this application are as follows:

[0054] 1. Improve the accuracy of memory leak prediction: The present invention combines timing characteristics, topological characteristics and dependencies between services to build a deep learning prediction model, which can more accurately predict the future memory usage trend of microservice nodes, effectively identify potential memory leak nodes, and avoid false positives and negative negatives.

[0055] 2. Accurately locate the root cause of memory leaks: The present invention uses the service call topology diagram, combined with the minimum cut algorithm and the belief propagation algorithm, to perform upstream and downstream analysis on potential memory leak nodes, accurately locate the root service of the memory leak, and help developers quickly troubleshoot problems.

[0056] 3. Reduce the cost of memory leak detection: Through intelligent prediction and precise positioning, the present invention can effectively shorten the time for memory leak detection, reduce the workload of manual detection, and reduce labor costs and time costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A schematic diagram of a process of an intelligent memory leak prediction and tracking method for a microservice architecture according to an embodiment of the present invention;

[0058] Figure 2 The figure is a schematic diagram of the structure of a memory leak intelligent prediction and tracking system for a microservice architecture according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0061] Figure 1 FIG. 1 is a flow chart of a method for intelligently predicting and tracing memory leaks in a microservice architecture according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0062] S11. Collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; extract the in-and-out degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix of the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service node;

[0063] S12. Construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism into the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node, and generate a memory leakage risk score and anomaly degree prediction value;

[0064] S13. Calculate the global risk mean and standard deviation based on the memory leakage risk score; sort the service nodes in descending order according to the memory leakage risk score, and select the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; compare the predicted value of the abnormality level of the high-risk service node with the preset abnormality threshold to determine the potential memory leakage node; use the service call topology graph to perform upstream and downstream analysis on the potential memory leakage node and construct a memory leakage propagation subgraph; apply the minimum cut algorithm in the memory leakage propagation subgraph to identify the key propagation path; according to the key propagation path and the predicted value of the abnormality level of each node, use the belief propagation algorithm to calculate the probability of the leakage source node, and locate the root service of the memory leakage.

[0065] In an optional implementation, a service call topology diagram is constructed to record the call relationship, call frequency, and request flow between services; a sliding window is processed on the runtime data, the window size is set to 30 minutes, and the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window are calculated to generate a time series feature matrix of the service node, including:

[0066] Collect call data between nodes of the microservice system, and build an initial service call topology graph based on the call data, where the nodes in the initial service call topology graph represent microservices, and the directed edges between the nodes represent call relationships;

[0067] Calculating the call characteristics for each directed edge in the initial service call topology graph, including: obtaining the call frequency by counting the number of calls per unit time, obtaining the call traffic by accumulating the request data size, and obtaining the call delay by calculating the average response time; normalizing the call frequency, the call traffic, and the call delay, determining the optimal weight coefficient by using a grid search method, and obtaining the call strength of the edge by weighted summation; updating the edge weight of the initial service call topology graph based on the call strength, and obtaining a weighted service call topology graph;

[0068] Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, garbage collection trigger times, and memory released by garbage collection; set a sliding window of 30 minutes for the runtime data, and the window sliding step is 5 minutes; in each sliding window, calculate the memory growth rate characteristics, specifically by performing first-order difference and exponential smoothing on the memory usage sequence; calculate the memory recovery rate characteristics, specifically by analyzing the ratio of the amount of memory released by garbage collection to the recovery time interval; analyze the memory allocation pattern characteristics, specifically by extracting the spatial locality and temporal locality indicators of memory allocation; arrange the memory growth rate characteristics, the memory recovery rate characteristics, and the memory allocation pattern characteristics of each node in the sliding window in chronological order, and construct a node timing feature matrix.

[0069] A microservice system performance analysis method is used to build a service call topology diagram and analyze the runtime characteristics of nodes for performance optimization and fault diagnosis.

[0070] First, collect the call data between services in the microservice system. This data includes the call source service, target service, call timestamp, request data size, and response time. For example, if service A calls service B at 10:00:00, the request data size is 1KB, and the response time is 10ms, then a call data is recorded: [service A, service B, 10:00:00, 1KB, 10ms]. Collecting a large amount of such call data provides a basis for building a service call topology diagram.

[0071] Next, we build an initial service call topology graph based on the collected call data. The nodes in the topology graph represent microservices, and the directed edges between nodes represent the call relationships. For example, if service A calls service B, there is a directed edge from service A to service B in the topology graph.

[0072] Then, the call characteristics of each edge in the initial service call topology are calculated. For each edge, the number of calls per unit time (for example, per minute) is counted to obtain the call frequency, the cumulative request data size is obtained to obtain the call traffic, and the average response time is calculated to obtain the call delay. For example, if service A calls service B 100 times per minute, the average request data size is 1KB each time, and the average response time is 10ms, then the call frequency of this edge is 100 times / minute, the call traffic is 100KB / minute, and the call delay is 10ms.

[0073] Afterwards, the call frequency, call traffic, and call delay are normalized and their numerical ranges are scaled to between 0 and 1. For example, assuming that the maximum call frequency of all edges is 1000 times / minute, the normalized value of the call frequency of service A calling service B is 100 / 1000=0.1. The grid search method is used to determine the optimal weight coefficient. The grid search method finds the weight coefficient that optimizes the evaluation indicator (for example, prediction accuracy) by trying different weight combinations. The call intensity of the edge is obtained by multiplying the normalized call frequency, call traffic, and call delay with their respective weight coefficients and then summing them. The edge weights of the initial service call topology graph are updated based on the call intensity to obtain a weighted service call topology graph.

[0074] Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, garbage collection trigger times, and garbage collection freed memory. For example, if service A's heap memory usage at 10:00:00 is 1GB, non-heap memory usage is 500MB, garbage collection trigger times is 1, and garbage collection freed memory is 100MB, then one piece of runtime data is recorded: [Service A, 10:00:00, 1GB, 500MB, 1, 100MB].

[0075] A sliding window of 30 minutes is set for the runtime data, and the window sliding step is 5 minutes. In each sliding window, the memory growth rate characteristics are calculated. The memory growth rate is obtained by performing first-order difference (for example, the memory usage at the current moment minus the memory usage at the previous moment) and exponential smoothing (for example, giving a higher weight to recent data) on the memory usage sequence. Calculate the memory recovery rate characteristics. The memory recovery rate is obtained by analyzing the ratio of the amount of memory released by garbage collection to the recycling time interval. Analyze the memory allocation pattern characteristics. The memory allocation pattern characteristics are obtained by extracting the spatial locality of memory allocation (for example, whether the allocated memory addresses are concentrated in a certain area) and temporal locality (for example, whether the memory addresses allocated in adjacent time are similar) indicators.

[0076] Arrange the memory growth rate characteristics, memory recovery rate characteristics, and memory allocation pattern characteristics of each node in the sliding window in chronological order to construct a node time series feature matrix. This matrix can be used for subsequent machine learning model training, such as predicting the future performance of service nodes.

[0077] The embodiments of the present application can:

[0078] Refined service dependency characterization: Through the weighted service call topology diagram, the dependency strength between services is more accurately reflected, which helps to identify key services and potential bottlenecks. Multi-dimensional runtime feature extraction: Combined with multi-dimensional runtime features such as memory growth rate, memory recovery rate and memory allocation mode, it more comprehensively describes the operating status of service nodes and improves the accuracy of performance analysis. Dynamic performance analysis: Based on the sliding window mechanism, the performance change trend of service nodes is captured in real time to achieve dynamic performance monitoring and early warning.

[0079] In an optional implementation, extracting the in-degree, centrality, and connectivity indexes of the service node based on the service call topology graph, and constructing a topological feature matrix of the service node; and fusing the temporal feature matrix with the topological feature matrix to generate a comprehensive feature vector of the service node, including:

[0080] Extracting basic topological features of each service node based on the service call topology graph, counting the number of incoming edges to obtain an in-degree value, and counting the number of outgoing edges to obtain an out-degree value; accumulating the call strengths of all incoming edges corresponding to the service node to obtain a weighted in-degree value, and accumulating the call strengths of all outgoing edges to obtain a weighted out-degree value; calculating the degree centrality of the node based on the weighted in-degree value and the weighted out-degree value;

[0081] Based on the service call topology graph, the high-order topological features of each service node are calculated. The shortest path distance between nodes is calculated based on the call intensity of the edge. The closeness centrality is calculated based on the shortest path distance from the node to all other nodes. The betweenness centrality is obtained by counting the proportion of paths passing through the node in all shortest paths. The edge density between node neighbors is calculated to obtain the clustering coefficient. The connection pattern between the node and its neighbors is analyzed to obtain the structural hole coefficient. The K-core value is calculated by iteratively deleting low-degree nodes.

[0082] Arrange the in-degree value, the out-degree value, the weighted in-degree value, the weighted out-degree value, the degree centrality, the closeness centrality, the betweenness centrality, the clustering coefficient, the structural hole coefficient, and the K-core value of each service node in a preset feature order to construct a topological feature vector of the node; combine the topological feature vectors of all service nodes into a topological feature matrix;

[0083] Calculating the similarity between the topological feature matrix and the temporal feature matrix to generate an attention weight matrix; performing a weighted combination of the topological feature matrix and the temporal feature matrix according to the attention weight matrix to obtain a fusion feature matrix;

[0084] The fused feature matrix is ​​subjected to nonlinear transformation to obtain a transformed feature matrix; the fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector representing the multi-dimensional features of the service node.

[0085] The service node comprehensive feature vector generation method is used to characterize the multi-dimensional features of the service nodes in the microservice system, including the following steps:

[0086] First, build a service call topology graph. Collect service call log data over a period of time, such as logs containing information such as source service, target service, and number of calls. Consider each service as a node in the graph, and the service call relationship as a directed edge in the graph. The weight of the edge represents the number of service calls or the intensity of the call. For example, if service A calls service B 10 times, and service B calls service C 5 times, then in the constructed topology graph, the weight of the edge from A to B is 10, and the weight of the edge from B to C is 5.

[0087] Next, extract the basic topological features of the service nodes. Traverse each node in the service call topology graph, count the number of incoming edges of each node as the in-degree value, and the number of outgoing edges as the out-degree value. At the same time, add up the weights of all incoming edges of the node to get the weighted in-degree value, and add up the weights of all outgoing edges to get the weighted out-degree value. For example, if service B has an incoming edge with a weight of 10 from service A and an incoming edge with a weight of 2 from service D, then the in-degree value of service B is 2 and the weighted in-degree value is 12. Based on the weighted in-degree value and weighted out-degree value, calculate the degree centrality of the node, which is used to measure the importance of the node in the network.

[0088] Then, the high-order topological features of the service nodes are extracted. The shortest path distance between nodes is calculated using the weight of the edge (call strength). For example, the Dijkstra algorithm can be used to calculate the shortest path between any two nodes. The closeness centrality is calculated based on the inverse of the sum of the shortest path distances from the node to all other nodes. The closeness centrality reflects the centrality of the node in the network. The betweenness centrality is obtained by counting the proportion of the number of paths passing through the node in the shortest paths between all node pairs. The betweenness centrality measures the importance of information transmission of the node in the network. The edge density between node neighbors is calculated to obtain the clustering coefficient, which reflects the closeness of the connection between node neighbors. The connection pattern between the node and its neighbors is analyzed to obtain the structural hole coefficient, which is used to measure the ability of the node to connect different communities in the network. The K-core value is calculated by iteratively deleting low-degree nodes. The K-core value reflects the position of the node in the core structure of the network.

[0089] After that, construct the topological feature matrix of the service node. Arrange the in-degree value, out-degree value, weighted in-degree value, weighted out-degree value, degree centrality, closeness centrality, betweenness centrality, clustering coefficient, structural hole coefficient and K-core value of each service node in a preset order to form the topological feature vector of the node. Combine the topological feature vectors of all service nodes into a topological feature matrix. For example, a topological feature matrix containing three service nodes may be a matrix with 3 rows and 10 columns.

[0090] In addition, obtain the time series feature matrix of the service node. The time series feature matrix can be obtained by analyzing the time series data in the service call log, such as counting the number of calls, average response time, error rate and other indicators of each service in different time periods, and arranging these indicators in chronological order to form a time series feature vector. Combine the time series feature vectors of all service nodes into a time series feature matrix. For example, if the number of calls of three service nodes in five time periods is counted, the time series feature matrix is ​​a matrix with 3 rows and 5 columns.

[0091] Next, feature fusion is performed. The similarity between the topological feature matrix and the temporal feature matrix is ​​calculated to generate an attention weight matrix. The topological feature matrix and the temporal feature matrix are weighted and combined according to the attention weight matrix to obtain a fused feature matrix.

[0092] Then, the fused feature matrix is ​​transformed nonlinearly. For example, activation functions such as Sigma ID and ReLU can be used to transform the fused feature matrix nonlinearly to obtain a transformed feature matrix. The fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector that represents the multi-dimensional features of the service node.

[0093] The embodiments of the present application can:

[0094] First, improve the accuracy of service anomaly detection: This method comprehensively considers the topological characteristics and timing characteristics of the service nodes, and can more comprehensively characterize the status of the service nodes, thereby improving the accuracy of service anomaly detection.

[0095] Second, reduce the false alarm rate of service anomaly detection: By integrating multi-dimensional features, normal fluctuations and abnormal behaviors can be effectively distinguished, thereby reducing the false alarm rate.

[0096] Third, enhance the interpretability of service anomaly detection: The features extracted by this method have clear physical meanings, which can help understand the causes of service anomalies and thus enhance interpretability.

[0097] In an optional implementation, a bidirectional long short-term memory network is constructed based on the comprehensive feature vector of the service node, a multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and different weights are given to features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; the output features of the bidirectional long short-term memory network are dynamically fused with the output features of the graph attention network layer, and training a deep learning prediction model includes:

[0098] The comprehensive feature vector of the service node is input into a bidirectional long short-term memory network; the bidirectional long short-term memory network processes the feature sequence before the current time window through a forward path to obtain a forward hidden state, and processes the feature sequence after the current time window through a backward path to obtain a backward hidden state; the forward hidden state and the backward hidden state are concatenated to obtain a temporal output feature of the bidirectional long short-term memory network;

[0099] A multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and the time series output features are respectively mapped into a query vector, a key vector and a value vector through linear transformation; the association degree between features of different time windows is independently calculated using multiple parallel attention heads, and each attention head outputs a corresponding weighted feature; the weighted features of the multiple attention heads are concatenated and subjected to linear transformation to obtain the output features of the bidirectional long short-term memory network with different time window weights assigned;

[0100] A graph attention network layer is constructed based on the service call topology graph, and the dependency strength between service nodes is calculated through the graph attention calculation unit; the features of adjacent nodes are adaptively aggregated according to the dependency strength to capture the dependency propagation relationship between service nodes; a multi-head attention mechanism is used to learn different types of node interaction modes respectively, and the outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer;

[0101] Constructing a feature dynamic fusion module, inputting the output features of the bidirectional long short-term memory network and the output features of the graph attention network layer into the feature dynamic fusion module; calculating the fusion gating value through a learnable weight matrix, and determining the fusion weights of the two types of features according to the fusion gating value; dynamically weighting and combining the two types of features according to the corresponding fusion weights to obtain the fused prediction features;

[0102] A deep learning prediction model is trained based on the fused prediction features; a loss function including a prediction error term and a regularization term is constructed, wherein the prediction error term measures the deviation between the predicted value and the true value, and the regularization term includes parameter regularization and graph structure regularization; a back propagation algorithm is used to optimize the model parameters so that the loss function converges to obtain a trained prediction model.

[0103] The service node anomaly detection method is used to predict the health status of service nodes and improve system stability. This method comprehensively utilizes the time series characteristics and topological dependencies of service nodes to build a deep learning prediction model.

[0104] First, collect monitoring data of service nodes, such as CPU usage, memory usage, request latency, request error rate, etc. Convert these multi-dimensional monitoring data into comprehensive feature vectors, each of which represents the status of a service node within a time window. For example, if data is collected once a minute, one hour of data constitutes a feature vector.

[0105] Then, these feature vectors are input into a bidirectional long short-term memory network (Bi-LSTM). Bi-LSTM contains two pathways, forward and backward. The forward pathway processes the feature sequence before the current time window and learns the impact of historical information on the current state; the backward pathway processes the feature sequence after the current time window and learns the impact of future information on the current state. For example, to predict the service node status at 10:00, the forward pathway processes the data before 9:00 and the backward pathway processes the data after 10:00. The hidden states output by the forward and backward pathways are concatenated to obtain the temporal output features of Bi-LSTM.

[0106] In order to highlight the impact of important time windows, a multi-head attention mechanism is introduced in Bi-LSTM. The time series output features are converted into query vectors, key vectors, and value vectors respectively. Multiple attention heads calculate the degree of correlation between features of different time windows in parallel, and each attention head focuses on different time segments. For example, one attention head focuses on the data of the last hour, and another attention head focuses on the data of the past day. The weighted features output by each attention head are concatenated to obtain the Bi-LSTM output features with weights assigned to different time windows.

[0107] At the same time, a graph attention network layer is constructed based on the service call topology graph. The service call topology graph describes the dependency relationship between service nodes. The graph attention network layer calculates the dependency strength between service nodes and adaptively aggregates the features of adjacent nodes to capture the dependency propagation relationship between service nodes. For example, if service A frequently calls service B, the status of service B has a greater impact on service A. A multi-head attention mechanism is used to learn different types of node interaction patterns separately. For example, one attention head focuses on direct call relationships, and another attention head focuses on indirect call relationships. The outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer.

[0108] Next, a feature dynamic fusion module is constructed to fuse the Bi-LSTM output features and the graph attention network layer output features. The fusion gating value is calculated through a learnable weight matrix, and the fusion weight of the two types of features is determined according to the fusion gating value. For example, if the time series feature is more important, a larger weight is given to the Bi-LSTM output feature. The two types of features are weighted and combined according to the corresponding fusion weights to obtain the fused prediction features.

[0109] Finally, the deep learning prediction model is trained based on the fused prediction features. A loss function containing a prediction error term and a regularization term is constructed. The prediction error term measures the deviation between the predicted value and the true value, for example, using the mean square error. The regularization term includes parameter regularization and graph structure regularization to prevent the model from overfitting. The back propagation algorithm is used to optimize the model parameters so that the loss function converges and the trained prediction model is obtained. For example, the Adam optimizer is used to update the parameters.

[0110] The embodiments of the present application can:

[0111] Improve prediction accuracy: This method comprehensively considers the timing characteristics and topological dependencies of service nodes, and can more accurately predict the health status of service nodes. For example, compared with the model that only uses timing features, the prediction accuracy of this method is improved by 10%. Enhance model robustness: The multi-head attention mechanism and dynamic fusion module enable the model to adapt to different data distributions and topological structures, improving the robustness of the model. For example, when the service call topology changes, this method can still maintain a high prediction accuracy. Reduce operation and maintenance costs: By predicting the anomalies of service nodes in advance, preventive measures can be taken in time to avoid failures and reduce operation and maintenance costs. For example, services can be expanded or migrated in advance based on the prediction results to avoid service interruptions.

[0112] In an optional implementation, using the deep learning prediction model to predict the future memory usage trend of each service node, generating a memory leakage risk score and an abnormality prediction value includes:

[0113] Obtain a historical feature sequence of a recent time window of a target service node, wherein the historical feature sequence includes memory usage, CPU utilization, and request response time; input the historical feature sequence into a deep learning prediction model, and the deep learning prediction model generates a memory usage prediction sequence for a future time window according to the temporal variation law of the historical feature sequence;

[0114] Performing time series decomposition on the memory usage prediction sequence, extracting the trend component, periodic component, and random component of the memory usage prediction sequence; calculating the growth rate and growth acceleration of memory usage based on the trend component, wherein the growth rate is obtained by the difference between adjacent time points, and the growth acceleration is obtained by the difference between the growth rates; and calculating the memory leakage risk score by a weighted combination method according to the growth rate, the growth acceleration, and the fluctuation amplitude of the random component;

[0115] Constructing a benchmark sequence library, wherein the benchmark sequence library contains multiple typical memory usage pattern sequences, each pattern sequence corresponding to a normal system operation state; using a dynamic time warping algorithm to respectively calculate the distance between the memory usage prediction sequence and each pattern sequence in the benchmark sequence library; selecting the most similar N pattern sequences as reference sequences according to the distance, wherein N is a preset positive integer;

[0116] A probability distribution model describing a normal state is constructed based on the reference sequence; the likelihood probability of the memory usage prediction sequence under the probability distribution model is calculated; and a quantitative abnormality degree prediction value is generated by combining the likelihood probability, the memory leakage risk score, and the degree of deviation of the periodic component.

[0117] Get the historical feature sequence of the target service node. First, determine the target service node, such as a server that provides user login services. Then, set a historical time window, such as the past 7 days. Within this time window, collect characteristic data such as memory usage, CPU utilization, and request response time of the target service node. These data can be obtained from the monitoring system or log files and sampled at fixed time intervals (such as every minute). For example, a time series can be obtained in which each data point contains the memory usage (such as 80%), CPU utilization (such as 60%), and request response time (such as 200 milliseconds) at a certain moment.

[0118] Input the historical feature sequence into the deep learning prediction model. Select a suitable deep learning model, such as a long short-term memory network (LSTM) or a gated recurrent unit network (GRU), which are good at processing time series data. Use the collected historical feature sequence to train the selected deep learning model. For example, you can use the data from the first 6 days as the training set and the data from the 7th day as the test set to evaluate the prediction performance of the model. After the training is completed, input the historical feature sequence of the last 7 days into the trained model to generate a memory usage prediction sequence for a period of time in the future (such as the next 24 hours). For example, the model may predict that the memory usage in the next 24 hours will be 82%, 85%, 88%...

[0119] Perform time series decomposition on the memory usage prediction sequence. Decompose the memory usage prediction sequence generated by the model into a trend component, a periodic component, and a random component. The trend component reflects the long-term trend of memory usage, such as a continuous rise or fall. The periodic component reflects the periodic fluctuations in memory usage, such as daily peaks and valleys. The random component reflects the random fluctuations in memory usage, such as fluctuations caused by burst traffic. You can use a time series decomposition algorithm, such as STL decomposition, to decompose the prediction sequence into these three components. For example, the decomposition results show that the trend component shows a slow upward trend, the periodic component shows obvious daily periodicity, and the random component has a small amplitude.

[0120] Calculate the memory leak risk score. Based on the decomposed trend component, calculate the growth rate and growth acceleration of memory usage. For example, if the predicted memory usage in the next 24 hours is 82%, 85%, and 88%, respectively, then the growth rates are 3% and 3%, respectively. The growth acceleration is 0. Then, according to the growth rate, growth acceleration, and the fluctuation range of the random component, the memory leak risk score is calculated by weighted combination. For example, an empirical formula can be set to multiply the growth rate, growth acceleration, and the fluctuation range of the random component by different weights, and then add them together to obtain the risk score. If both the growth rate and growth acceleration are high, and the random component fluctuates greatly, the risk score is high. For example, the calculated risk score is 7.5 points (out of 10 points).

[0121] Build a benchmark sequence library and anomaly prediction. Build a benchmark sequence library that contains a variety of typical memory usage pattern sequences. For example, you can collect memory usage sequences under different load conditions (low load, medium load, high load), as well as memory usage sequences when memory leaks occur. Then, use the dynamic time warping algorithm to calculate the distance between the predicted sequence and each pattern sequence in the benchmark sequence library. Select the N pattern sequences with the smallest distance as the reference sequence. For example, select the 3 pattern sequences with the smallest distance as the reference sequence. Based on these reference sequences, build a probability distribution model that describes the normal state, such as a Gaussian distribution model. Calculate the likelihood probability of the predicted sequence under this probability distribution model. For example, the calculated likelihood probability is 0.2. Finally, combine the likelihood probability, memory leak risk score, and the degree of deviation of the periodic component to generate a quantitative anomaly prediction value. For example, multiply the likelihood probability, risk score, and degree of deviation of the periodic component by different weights, and then add them together to obtain the anomaly prediction value. For example, the calculated anomaly prediction value is 8.0 (out of 10 points).

[0122] The embodiments of the present application can:

[0123] By combining deep learning prediction models and time series decomposition techniques, memory usage trends can be predicted more accurately and potential memory leak risks can be identified. Deep learning models can capture complex patterns in historical data, while time series decomposition can separate the impact of different factors on memory usage, thereby improving the accuracy and reliability of predictions.

[0124] By calculating the memory leak risk score and the predicted value of the abnormality level, the memory leak risk can be quantified and a more intuitive risk assessment result can be provided. This helps operation and maintenance personnel better understand the risk level and take appropriate measures to prevent or repair it.

[0125] By predicting the risk of memory leaks in advance, you can take preventive measures in advance, such as increasing memory resources, optimizing code, or restarting services, to avoid system crashes or performance degradation caused by memory leaks, thereby improving system stability and reliability.

[0126] In an optional implementation, the global risk mean and standard deviation are calculated based on the memory leakage risk score; the service nodes are sorted in descending order according to the memory leakage risk score, and the service nodes whose risk scores are greater than the sum of the global risk mean and the standard deviation are selected as high-risk service nodes, and the abnormality prediction value of the high-risk service node is compared with the preset abnormality threshold to determine the potential memory leakage node; the service call topology graph is used to perform upstream and downstream analysis on the potential memory leakage node to construct a memory leakage propagation subgraph; the minimum cut algorithm is applied to the memory leakage propagation subgraph to identify the key propagation path, including:

[0127] Obtaining a predicted value of the abnormality level of the high-risk service node, calculating an adaptive threshold based on the predicted value of the abnormality level, and dynamically adjusting the adaptive threshold according to the distribution of the predicted value of the abnormality level of the high-risk service node; comparing the predicted value of the abnormality level of the high-risk service node with the adaptive threshold, and determining the high-risk service node whose predicted value of the abnormality level is greater than the adaptive threshold as a potential memory leak node;

[0128] Construct a service call topology graph, wherein the edge weights in the service call topology graph are weighted by call frequency, response delay, and resource dependency; take the potential memory leak node as the central node, perform a bidirectional traversal in the service call topology graph, and obtain upstream and downstream nodes that have a direct or indirect call relationship with the central node, wherein the traversal depth of the upstream and downstream nodes is dynamically determined according to the edge weights;

[0129] The central node and the upstream and downstream nodes form a memory leak propagation subgraph, and the propagation probability is calculated based on the memory leak risk score, abnormality prediction value and edge weight of the node; the propagation probability represents the possibility of memory leak propagation through the connection between nodes, and the larger the propagation probability, the easier it is for the memory leak to spread along the path;

[0130] A network flow model is constructed in the memory leak propagation subgraph, the central node is set as the source point, and the edge nodes in the upstream and downstream nodes are set as the sink points; the minimum cut algorithm is applied to the network flow model, and the minimum cut set is obtained through iterative calculation, wherein the minimum cut set includes an edge set with the minimum propagation probability and; the key propagation path is identified based on the minimum cut set.

[0131] A memory leak risk identification method based on service call topology can accurately locate potential memory leak nodes and key propagation paths, and effectively prevent memory leaks from spreading in large-scale distributed systems.

[0132] First, calculate the global memory leak risk. Collect the memory usage, garbage collection times, object survival time and other indicators of each service node from the system monitoring platform, and use the machine learning model to score the memory leak risk of each service node. Collect the memory leak risk scores of all service nodes and calculate the global risk mean and standard deviation.

[0133] Next, filter out high-risk service nodes. Sort all service nodes in descending order according to the memory leak risk score. Select service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes. For example, assuming the global risk mean is 0.5 and the standard deviation is 0.1, service nodes with a risk score greater than 0.6 are marked as high-risk service nodes.

[0134] Then, predict potential memory leak nodes. Obtain the predicted value of the abnormality degree of the high-risk service node. The predicted value can be obtained by analyzing the service node's CPU usage, response time, error rate and other indicators, and calculated using time series analysis or anomaly detection algorithm. Based on the predicted value of the abnormality degree of these high-risk service nodes, calculate the adaptive threshold. For example, the 95% quantile of the predicted value of the abnormality degree can be set as the adaptive threshold. Compare the predicted value of the abnormality degree of the high-risk service node with the adaptive threshold, and determine the high-risk service node whose abnormality degree prediction value is greater than the adaptive threshold as a potential memory leak node. For example, if the predicted value of the abnormality degree of a high-risk service node is 0.9 and the adaptive threshold is 0.8, the node is determined to be a potential memory leak node.

[0135] Then, build a service call topology graph. Collect the call relationships between service nodes and build a service call topology graph. The edge weights in the graph are composed of the weighted call frequency, response delay, and resource dependence. For example, the higher the call frequency between two service nodes, the longer the response delay, and the higher the resource dependence, the greater the edge weight between them. Assuming that service node A calls service node B 100 times / second, the response delay is 100 milliseconds, and the resource dependence is 0.8, the weight of edge AB can be calculated as 100*0.1*0.8=8.

[0136] Next, a memory leak propagation subgraph is constructed. With the potential memory leak node as the central node, a bidirectional traversal is performed in the service call topology graph to obtain the upstream and downstream nodes that have a direct or indirect call relationship with the central node. The traversal depth of the upstream and downstream nodes is dynamically determined according to the edge weight. The larger the edge weight, the deeper the traversal depth. For example, if the edge weight between the central node and a certain node is large, the upstream and downstream nodes of the node will continue to be traversed. The central node and the upstream and downstream nodes form a memory leak propagation subgraph. For example, if service node A is a potential memory leak node, the nodes directly connected to it are B and C, and B is connected to D, then the memory leak propagation subgraph contains nodes A, B, C and D.

[0137] After that, the propagation probability is calculated. The propagation probability is calculated based on the memory leak risk score, abnormality prediction value, and edge weight of the nodes in the memory leak propagation subgraph. The propagation probability represents the possibility of memory leak propagation through the connection between nodes. The larger the propagation probability, the easier it is for the memory leak to spread along the path.

[0138] Finally, identify the critical propagation path. Construct a network flow model in the memory leak propagation subgraph, set the central node as the source node, and set the edge nodes in the upstream and downstream nodes as the sink node. Apply the minimum cut algorithm to the network flow model and obtain the minimum cut set through iterative calculation. The minimum cut set contains the edge set with the minimum propagation probability and the minimum propagation probability. Identify the critical propagation path based on the minimum cut set. For example, if the minimum cut set contains edges AB and BC, the critical propagation path is A->B->C.

[0139] The embodiments of the present application can:

[0140] Improve the accuracy of memory leak identification: By combining the memory leak risk score, the predicted value of the abnormality level, and the service call topology, potential memory leak nodes can be identified more accurately. Accelerate the efficiency of memory leak troubleshooting: By identifying the key propagation path, the root cause of the memory leak can be quickly located, shortening the troubleshooting time. Reduce the impact scope of memory leaks: By identifying potential memory leak nodes and key propagation paths in advance, timely measures can be taken to prevent memory leaks from spreading in large-scale distributed systems and reduce their impact scope.

[0141] In an optional implementation, based on the critical propagation path and the predicted value of the abnormality degree of each node, a belief propagation algorithm is used to calculate the probability of the leak source node, and the root cause service of locating the memory leak includes:

[0142] Obtain the abnormality prediction values ​​of the key propagation path and each node, set the service nodes in the key propagation path as variable nodes, and set the call relationship between nodes as factor nodes; map the abnormality prediction value to the initial belief value of the variable node, and construct the correlation function between nodes according to the call frequency, response delay, and resource dependence between nodes;

[0143] Establishing a message transmission channel between the variable node and the factor node, the message content includes the leakage state and leakage degree of the node; inputting the initial belief value of the variable node into the belief propagation algorithm, and updating the message in the message transmission channel through iterative calculation; calculating the probability of each variable node being a leakage source based on the convergence state of the message;

[0144] Sort the variable nodes according to the leakage source probability, and select the node with the highest probability as the candidate leakage source node; analyze the memory allocation mode, abnormal behavior characteristics, and resource occupancy of the candidate leakage source node, and verify the credibility of the candidate leakage source node in combination with historical leakage data; and determine the final leakage source node;

[0145] Taking the leak source node as the starting point, a breadth-first traversal is performed in the memory leak propagation subgraph to obtain a set of affected nodes; the risk level of each node in the affected node set is calculated, and the risk level is jointly determined by the leak source probability of the node, the predicted value of the abnormality level, and the topological distance from the leak source node; a tracing analysis report is generated, and the tracing analysis report includes: leak source identification results, propagation path analysis, and impact range assessment.

[0146] Obtain key propagation paths and node abnormality prediction values. First, use the distributed tracing system to collect call link data between services, such as call relationships, call frequency, response delay, resource dependency, etc. Assume that service A calls service B with a call frequency of 100 times per minute and an average response delay of 50 milliseconds, and service B relies on the database resources provided by service A. Then, use the monitoring system to collect various indicator data of the service, such as CPU usage, memory occupancy, request success rate, etc. Combine the indicator data and the preset threshold to determine the abnormality of each service. For example, if the memory occupancy of service C exceeds the threshold of 90%, it is considered that the abnormality of service C is high, and the prediction value is 0.9. Finally, based on the call link data and the abnormality prediction value, identify the key propagation path of the memory leak, such as service A->service B->service C, and obtain the abnormality prediction value of each node on the path.

[0147] Set the service nodes of the key propagation path as variable nodes, set the call relationships between nodes as factor nodes, and map the abnormality prediction values ​​to the initial belief values ​​of the variable nodes. For example, set services A, B, and C as variable nodes, and set A->B and B->C as factor nodes. The abnormality prediction values ​​of services A, B, and C are 0.2, 0.5, and 0.9, respectively, and they are set as the initial belief values ​​of the corresponding variable nodes, indicating the initial possibility that the nodes have memory leaks.

[0148] Construct the association function between nodes. The association function is used to describe the influence relationship between nodes. It is constructed based on factors such as the calling frequency, response delay, and resource dependence between nodes. For example, if service A calls service B frequently, and service B is heavily dependent on the resources provided by service A, then service A is considered to have a greater impact on service B, and the value of the association function is higher. Otherwise, the value of the association function is lower.

[0149] A message passing channel is established between the variable node and the factor node. The message content includes the leakage state of the node (e.g., leakage exists or does not exist) and the leakage degree (e.g., slight leakage, medium leakage, severe leakage).

[0150] The initial belief value of the variable node is input into the belief propagation algorithm, and the message in the message transmission channel is updated through iterative calculation. For example, initially, the belief value of service A is 0.2, indicating that the possibility of a memory leak is 0.2. Service A passes this information to its adjacent factor node A->B. Factor node A->B combines the information passed by service A with its own association function, calculates a new message and passes it to service B. Service B receives the message from factor node A->B, and updates its own belief value based on its own initial belief value. In this way, messages are continuously transmitted and updated between nodes until the messages converge.

[0151] The probability of each variable node being a leakage source is calculated based on the convergence state of the message. For example, after multiple iterations, the probabilities of services A, B, and C being leakage sources converge to 0.1, 0.3, and 0.6, respectively.

[0152] Sort the variable nodes according to the leakage source probability, and select the node with the highest probability as the candidate leakage source node. For example, service C has the highest probability, so it is selected as the candidate leakage source node.

[0153] Analyze the memory allocation pattern, abnormal behavior characteristics, and resource usage of the candidate leak source node, and verify the credibility of the candidate leak source node in combination with historical leakage data. For example, if the code of service C is analyzed and a logical error of unreleased memory is found, and historical records show that service C has had memory leaks many times, then service C is considered to have a high credibility.

[0154] Determine the final leakage source node. For example, based on the above analysis, service C is finally determined to be the leakage source node.

[0155] Starting from the leak source node, perform breadth-first traversal in the memory leak propagation subgraph to obtain the affected node set. For example, starting from service C, traversing down along the call link, it is found that service D and service E are affected, then the affected node set is {C, D, E}.

[0156] Calculate the risk level of each node in the affected node set. The risk level is determined by the node's leak source probability, abnormality prediction value, and topological distance from the leak source node. For example, service C has a leak source probability of 0.6, an abnormality prediction value of 0.9, and a topological distance of 0, so its risk level is the highest. The risk levels of services D and E are calculated based on their respective probabilities, prediction values, and distances from service C.

[0157] Generate a tracking analysis report. The report includes the leak source identification results (service C), propagation path analysis (A->B->C->D, A->B->C->E), and impact range assessment (risk levels of C, D, and E).

[0158] The embodiments of the present application can:

[0159] Improve memory leak location efficiency: Through the belief propagation algorithm and multi-dimensional data analysis, the root service of the memory leak can be quickly and accurately located, avoiding the tedious and inefficient manual troubleshooting. Reduce memory leak troubleshooting costs: The automated analysis process reduces manual participation, reducing labor costs and time costs. Improve system stability: Quickly locate and repair memory leak problems, which can effectively prevent system crashes and improve system stability and reliability.

[0160] Figure 2 FIG. 1 is a schematic diagram of the structure of a memory leak intelligent prediction and tracking system for a microservice architecture according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0161] The first unit is used to collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; extract the in-and-out degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix of the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service node;

[0162] The second unit is used to construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism in the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node, and generate a memory leakage risk score and anomaly degree prediction value;

[0163] The third unit is used to calculate the global risk mean and standard deviation based on the memory leakage risk score; sort the service nodes in descending order according to the memory leakage risk score, and select the service nodes with risk scores greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; compare the abnormality prediction value of the high-risk service node with the preset abnormality threshold to determine the potential memory leakage node; use the service call topology map to perform upstream and downstream analysis on the potential memory leakage node and construct a memory leakage propagation subgraph; apply the minimum cut algorithm in the memory leakage propagation subgraph to identify the key propagation path; according to the key propagation path and the abnormality prediction value of each node, use the confidence propagation algorithm to calculate the probability of the leakage source node, and locate the root service of the memory leakage.

[0164] According to a third aspect of the embodiments of the present invention,

[0165] An electronic device is provided, comprising:

[0166] processor;

[0167] a memory for storing processor-executable instructions;

[0168] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0169] According to a fourth aspect of the embodiments of the present invention,

[0170] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0171] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent memory leak prediction and tracking method for microservice architecture, characterized in that: include: Collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; Build a service call topology diagram to record the call relationship, call frequency, and request flow between services; Perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; Extracting the in-and-out degree, centrality, and connectivity indexes of the service nodes based on the service call topology graph, and constructing a topological feature matrix of the service nodes; performing feature fusion on the temporal feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service nodes; A bidirectional long short-term memory network is constructed according to the comprehensive feature vector of the service node, a multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and different weights are assigned to the features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; the output features of the bidirectional long short-term memory network are dynamically fused with the output features of the graph attention network layer to train a deep learning prediction model; the deep learning prediction model is used to predict the future memory usage trend of each service node to generate a memory leakage risk score and an abnormality degree prediction value; Calculate a global risk mean and standard deviation based on the memory leak risk score; Sort the service nodes in descending order according to the memory leakage risk score, and select the service nodes whose risk scores are greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; Compare the predicted value of the abnormality degree of the high-risk service node with a preset abnormality threshold to determine a potential memory leak node; Performing upstream and downstream analysis on the potential memory leak node using the service call topology graph, and constructing a memory leak propagation subgraph; The minimum cut algorithm is applied in the memory leak propagation subgraph to identify the key propagation path; based on the key propagation path and the predicted value of the abnormality degree of each node, the belief propagation algorithm is used to calculate the probability of the leak source node to locate the root service of the memory leak.

2. The method according to claim 1, characterized in that: Build a service call topology diagram, record the call relationship, call frequency, and request flow between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node, including: Collect call data between nodes of the microservice system, and build an initial service call topology graph based on the call data, where the nodes in the initial service call topology graph represent microservices, and the directed edges between the nodes represent call relationships; Calculating the call characteristics for each directed edge in the initial service call topology graph, including: obtaining the call frequency by counting the number of calls per unit time, obtaining the call traffic by accumulating the request data size, and obtaining the call delay by calculating the average response time; normalizing the call frequency, the call traffic, and the call delay, determining the optimal weight coefficient by using a grid search method, and obtaining the call strength of the edge by weighted summation; updating the edge weight of the initial service call topology graph based on the call strength, and obtaining a weighted service call topology graph; Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, garbage collection trigger times, and memory released by garbage collection; set a sliding window of 30 minutes for the runtime data, and the window sliding step is 5 minutes; in each sliding window, calculate the memory growth rate characteristics, specifically by performing first-order difference and exponential smoothing on the memory usage sequence; calculate the memory recovery rate characteristics, specifically by analyzing the ratio of the amount of memory released by garbage collection to the recovery time interval; analyze the memory allocation pattern characteristics, specifically by extracting the spatial locality and temporal locality indicators of memory allocation; arrange the memory growth rate characteristics, the memory recovery rate characteristics, and the memory allocation pattern characteristics of each node in the sliding window in chronological order, and construct a node timing feature matrix.

3. The method according to claim 1, characterized in that Extracting the in-degree, centrality, and connectivity indexes of the service nodes based on the service call topology graph, and constructing a topological feature matrix of the service nodes; The step of fusing the time series feature matrix with the topology feature matrix to generate a comprehensive feature vector of the service node includes: Extracting basic topological features of each service node based on the service call topology graph, counting the number of incoming edges to obtain an in-degree value, and counting the number of outgoing edges to obtain an out-degree value; accumulating the call strengths of all incoming edges corresponding to the service node to obtain a weighted in-degree value, and accumulating the call strengths of all outgoing edges to obtain a weighted out-degree value; calculating the degree centrality of the node based on the weighted in-degree value and the weighted out-degree value; Based on the service call topology graph, the high-order topological features of each service node are calculated. The shortest path distance between nodes is calculated based on the call intensity of the edge. The closeness centrality is calculated based on the shortest path distance from the node to all other nodes. The betweenness centrality is obtained by counting the proportion of paths passing through the node in all shortest paths. The edge density between node neighbors is calculated to obtain the clustering coefficient. The connection pattern between the node and its neighbors is analyzed to obtain the structural hole coefficient. The K-core value is calculated by iteratively deleting low-degree nodes. Arrange the in-degree value, the out-degree value, the weighted in-degree value, the weighted out-degree value, the degree centrality, the closeness centrality, the betweenness centrality, the clustering coefficient, the structural hole coefficient, and the K-core value of each service node in a preset feature order to construct a topological feature vector of the node; combine the topological feature vectors of all service nodes into a topological feature matrix; Calculating the similarity between the topological feature matrix and the temporal feature matrix to generate an attention weight matrix; performing a weighted combination of the topological feature matrix and the temporal feature matrix according to the attention weight matrix to obtain a fusion feature matrix; The fused feature matrix is ​​subjected to nonlinear transformation to obtain a transformed feature matrix; the fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector representing the multi-dimensional features of the service node.

4. The method according to claim 1, characterized in that: A bidirectional long short-term memory network is constructed based on the comprehensive feature vector of the service node, a multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and different weights are assigned to features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; Dynamically fusing the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer, and training the deep learning prediction model includes: The comprehensive feature vector of the service node is input into a bidirectional long short-term memory network; the bidirectional long short-term memory network processes the feature sequence before the current time window through a forward path to obtain a forward hidden state, and processes the feature sequence after the current time window through a backward path to obtain a backward hidden state; the forward hidden state and the backward hidden state are concatenated to obtain a temporal output feature of the bidirectional long short-term memory network; A multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and the time series output features are respectively mapped into a query vector, a key vector and a value vector through linear transformation; the association degree between features of different time windows is independently calculated using multiple parallel attention heads, and each attention head outputs a corresponding weighted feature; the weighted features of the multiple attention heads are concatenated and subjected to linear transformation to obtain the output features of the bidirectional long short-term memory network with different time window weights assigned; A graph attention network layer is constructed based on the service call topology graph, and the dependency strength between service nodes is calculated through the graph attention calculation unit; the features of adjacent nodes are adaptively aggregated according to the dependency strength to capture the dependency propagation relationship between service nodes; a multi-head attention mechanism is used to learn different types of node interaction modes respectively, and the outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer; Constructing a feature dynamic fusion module, inputting the output features of the bidirectional long short-term memory network and the output features of the graph attention network layer into the feature dynamic fusion module; calculating the fusion gating value through a learnable weight matrix, and determining the fusion weights of the two types of features according to the fusion gating value; dynamically weighting and combining the two types of features according to the corresponding fusion weights to obtain the fused prediction features; A deep learning prediction model is trained based on the fused prediction features; a loss function including a prediction error term and a regularization term is constructed, wherein the prediction error term measures the deviation between the predicted value and the true value, and the regularization term includes parameter regularization and graph structure regularization; a back propagation algorithm is used to optimize the model parameters so that the loss function converges to obtain a trained prediction model.

5. The method according to claim 1, characterized in that The deep learning prediction model is used to predict the future memory usage trend of each service node, and the memory leakage risk score and abnormality prediction value generated include: Obtain a historical feature sequence of a recent time window of a target service node, wherein the historical feature sequence includes memory usage, CPU utilization, and request response time; input the historical feature sequence into a deep learning prediction model, and the deep learning prediction model generates a memory usage prediction sequence for a future time window according to the temporal variation law of the historical feature sequence; Performing time series decomposition on the memory usage prediction sequence, extracting the trend component, periodic component, and random component of the memory usage prediction sequence; calculating the growth rate and growth acceleration of memory usage based on the trend component, wherein the growth rate is obtained by the difference between adjacent time points, and the growth acceleration is obtained by the difference between the growth rates; and calculating the memory leakage risk score by a weighted combination method according to the growth rate, the growth acceleration, and the fluctuation amplitude of the random component; Constructing a benchmark sequence library, wherein the benchmark sequence library contains multiple typical memory usage pattern sequences, each pattern sequence corresponding to a normal system operation state; using a dynamic time warping algorithm to respectively calculate the distance between the memory usage prediction sequence and each pattern sequence in the benchmark sequence library; selecting the most similar N pattern sequences as reference sequences according to the distance, wherein N is a preset positive integer; A probability distribution model describing a normal state is constructed based on the reference sequence; the likelihood probability of the memory usage prediction sequence under the probability distribution model is calculated; and a quantitative abnormality degree prediction value is generated by combining the likelihood probability, the memory leakage risk score, and the degree of deviation of the periodic component.

6. The method according to claim 1, characterized in that Calculate the global risk mean and standard deviation based on the memory leakage risk score; sort the service nodes in descending order according to the memory leakage risk score, select the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes, compare the abnormality prediction value of the high-risk service node with the preset abnormality threshold, and determine the potential memory leakage node; Performing upstream and downstream analysis on the potential memory leak node using the service call topology graph, and constructing a memory leak propagation subgraph; Applying the minimum cut algorithm in the memory leak propagation subgraph to identify the key propagation path includes: Obtaining a predicted value of the abnormality level of the high-risk service node, calculating an adaptive threshold based on the predicted value of the abnormality level, and dynamically adjusting the adaptive threshold according to the distribution of the predicted value of the abnormality level of the high-risk service node; comparing the predicted value of the abnormality level of the high-risk service node with the adaptive threshold, and determining the high-risk service node whose predicted value of the abnormality level is greater than the adaptive threshold as a potential memory leak node; Construct a service call topology graph, wherein the edge weights in the service call topology graph are weighted by call frequency, response delay, and resource dependency; take the potential memory leak node as the central node, perform a bidirectional traversal in the service call topology graph, and obtain upstream and downstream nodes that have a direct or indirect call relationship with the central node, wherein the traversal depth of the upstream and downstream nodes is dynamically determined according to the edge weights; The central node and the upstream and downstream nodes form a memory leak propagation subgraph, and the propagation probability is calculated based on the memory leak risk score, abnormality prediction value and edge weight of the node; the propagation probability represents the possibility of memory leak propagation through the connection between nodes, and the larger the propagation probability, the easier it is for the memory leak to spread along the path; A network flow model is constructed in the memory leak propagation subgraph, the central node is set as the source point, and the edge nodes in the upstream and downstream nodes are set as the sink points; the minimum cut algorithm is applied to the network flow model, and the minimum cut set is obtained through iterative calculation, wherein the minimum cut set includes an edge set with the minimum propagation probability and; the key propagation path is identified based on the minimum cut set.

7. The method according to claim 1, characterized in that According to the critical propagation path and the predicted value of the abnormality degree of each node, the belief propagation algorithm is used to calculate the probability of the leak source node. The root cause of the memory leak location service includes: Obtain the abnormality prediction values ​​of the key propagation path and each node, set the service nodes in the key propagation path as variable nodes, and set the call relationship between nodes as factor nodes; map the abnormality prediction value to the initial belief value of the variable node, and construct the correlation function between nodes according to the call frequency, response delay, and resource dependence between nodes; Establishing a message transmission channel between the variable node and the factor node, the message content includes the leakage state and leakage degree of the node; inputting the initial belief value of the variable node into the belief propagation algorithm, and updating the message in the message transmission channel through iterative calculation; calculating the probability of each variable node being a leakage source based on the convergence state of the message; Sort the variable nodes according to the leakage source probability, and select the node with the highest probability as the candidate leakage source node; analyze the memory allocation mode, abnormal behavior characteristics, and resource occupancy of the candidate leakage source node, and verify the credibility of the candidate leakage source node in combination with historical leakage data; and determine the final leakage source node; Taking the leak source node as the starting point, a breadth-first traversal is performed in the memory leak propagation subgraph to obtain a set of affected nodes; the risk level of each node in the affected node set is calculated, and the risk level is jointly determined by the leak source probability of the node, the predicted value of the abnormality level, and the topological distance from the leak source node; a tracing analysis report is generated, and the tracing analysis report includes: leak source identification results, propagation path analysis, and impact range assessment.

8. A memory leak intelligent prediction and tracking system for microservice architecture, used to implement the method described in any one of claims 1 to 7, characterized in that: include: The first unit is used to collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; Build a service call topology diagram to record the call relationship, call frequency, and request flow between services; Perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; Extracting the in-degree, centrality, and connectivity indexes of the service nodes based on the service call topology graph, and constructing a topological feature matrix of the service nodes; Performing feature fusion on the time series feature matrix and the topology feature matrix to generate a comprehensive feature vector of the service node; The second unit is used to construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism in the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node, and generate a memory leakage risk score and anomaly degree prediction value; A third unit is used to calculate a global risk mean and a standard deviation based on the memory leak risk score; Sort the service nodes in descending order according to the memory leakage risk score, and select the service nodes whose risk scores are greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; Compare the predicted value of the abnormality degree of the high-risk service node with a preset abnormality threshold to determine a potential memory leak node; Performing upstream and downstream analysis on the potential memory leak node using the service call topology graph, and constructing a memory leak propagation subgraph; The minimum cut algorithm is applied in the memory leak propagation subgraph to identify the key propagation path; based on the key propagation path and the predicted value of the abnormality degree of each node, the belief propagation algorithm is used to calculate the probability of the leak source node to locate the root service of the memory leak.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images