Intelligent prediction and tracking method and system for memory leaks in microservice architecture

Abstract

The present invention provides a method and system for intelligent memory leak prediction and tracking for a microservice architecture, which relates to the field of memory leak prediction technology, including collecting runtime data of service nodes and constructing a service call topology map, extracting timing and topology features, and performing feature fusion. A bidirectional long short-term memory network is combined with a multi-head attention mechanism and a graph attention network to construct a deep learning prediction model to predict the memory usage trend and risk score of service nodes. Potential memory leak nodes are identified based on the risk score and the predicted value of the abnormality level, and the key propagation path is identified through the service call topology map and the minimum cut algorithm. Finally, the root service of the memory leak is located using the belief propagation algorithm, thereby achieving accurate prediction and rapid location of memory leaks in the microservice system, improving system stability and reliability.

Description

Technical Field

[0001] The present invention relates to memory leak prediction technology, and in particular to a memory leak intelligent prediction and tracking method and system for a microservice architecture. Background Art

[0002] The microservices architecture has become a mainstream design pattern for modern distributed systems. It breaks complex applications into multiple small, autonomous service units. This architecture improves system scalability, flexibility, and maintainability. However, it also introduces new challenges, one of which is the increased difficulty in detecting and locating memory leaks. Traditional memory leak detection tools often struggle to adapt to the large number of services and complex call relationships in a microservices environment.

[0003] Difficulty adapting to the complexity of microservice architectures: Traditional memory leak detection tools are mostly designed for monolithic applications. They struggle to effectively analyze the complex calling relationships and dependency propagation between services in a microservice system, making it difficult to accurately locate the root cause of the memory leak. Lack of adaptability to dynamic changes: The number of service nodes, calling relationships, and request traffic in a microservice system often exhibit dynamic changes. Existing methods often struggle to adapt to such dynamic changes, resulting in decreased detection accuracy. High false alarm rate: Due to the large number of service nodes in a microservice system, simple threshold alarm mechanisms are prone to generating a large number of false alarms, placing a heavy burden on operations and maintenance personnel and making it difficult to effectively identify true memory leak issues. Summary of the Invention

[0004] The embodiments of the present invention provide a method and system for intelligently predicting and tracing memory leaks for a microservice architecture, which can solve the problems in the prior art.

[0005] According to a first aspect of the embodiments of the present invention,

[0006] Provides intelligent memory leak prediction and tracking methods for microservice architecture, including:

[0007] Collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, with the window size set to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix for the service node; extract the in-degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix for the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector for the service node;

[0008] A bidirectional long short-term memory network is constructed based on the comprehensive feature vectors of the service nodes. A multi-head attention mechanism is introduced into the bidirectional long short-term memory network to assign different weights to features of different time windows. A graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes. The output features of the bidirectional long short-term memory network are dynamically fused with the output features of the graph attention network layer to train a deep learning prediction model. The deep learning prediction model is used to predict the future memory usage trend of each service node to generate a memory leakage risk score and anomaly degree prediction value.

[0009] Based on the memory leak risk score, the global risk mean and standard deviation are calculated; the service nodes are sorted in descending order according to the memory leak risk score, and the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation are selected as high-risk service nodes; the abnormality degree prediction value of the high-risk service node is compared with the preset abnormality threshold to determine the potential memory leak node; the service call topology graph is used to perform upstream and downstream analysis on the potential memory leak node to construct a memory leak propagation subgraph; the minimum cut algorithm is applied to the memory leak propagation subgraph to identify the key propagation path; based on the key propagation path and the abnormality degree prediction value of each node, the belief propagation algorithm is used to calculate the probability of the leakage source node to locate the root service of the memory leak.

[0010] Build a service call topology diagram, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix for the service node, including:

[0011] Collect call data between nodes of the microservice system, and build an initial service call topology graph based on the call data. The nodes in the initial service call topology graph represent microservices, and the directed edges between the nodes represent call relationships.

[0012] Calculating call characteristics for each directed edge in the initial service call topology graph, including: calculating the number of calls per unit time to obtain a call frequency, accumulating the size of request data to obtain a call flow, and calculating the average response time to obtain a call delay; normalizing the call frequency, the call flow, and the call delay, determining an optimal weight coefficient using a grid search method, and obtaining an edge call strength through weighted summation; and updating the edge weights of the initial service call topology graph based on the call strength to obtain a weighted service call topology graph;

[0013] Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, number of garbage collection triggers, and amount of memory released by garbage collection; set a sliding window of 30 minutes for the runtime data, and a window sliding step of 5 minutes; in each sliding window, calculate the memory growth rate characteristics, specifically by performing first-order difference and exponential smoothing on the memory usage sequence; calculate the memory recovery rate characteristics, specifically by analyzing the ratio of the amount of memory released by garbage collection to the recovery time interval; analyze the memory allocation pattern characteristics, specifically by extracting the spatial locality and temporal locality indicators of memory allocation; arrange the memory growth rate characteristics, the memory recovery rate characteristics, and the memory allocation pattern characteristics of each node in the sliding window in chronological order to construct a node timing feature matrix.

[0014] Extracting the in-degree, centrality, and connectivity indicators of the service nodes based on the service call topology graph to construct a topological feature matrix of the service nodes; fusing the temporal feature matrix with the topological feature matrix to generate a comprehensive feature vector of the service nodes includes:

[0015] Extracting basic topological features of each service node based on the service call topology graph, counting the number of incoming edges to obtain an in-degree value, and counting the number of outgoing edges to obtain an out-degree value; accumulating the call strengths of all incoming edges corresponding to the service node to obtain a weighted in-degree value, and accumulating the call strengths of all outgoing edges to obtain a weighted out-degree value; calculating the degree centrality of the node based on the weighted in-degree value and the weighted out-degree value;

[0016] Based on the service call topology graph, the high-order topological features of each service node are calculated. The shortest path distance between nodes is calculated based on the call intensity of the edges. The closeness centrality is calculated based on the shortest path distance from the node to all other nodes. The betweenness centrality is obtained by counting the proportion of paths passing through the node in all shortest paths. The clustering coefficient is obtained by calculating the edge density between node neighbors. The structural hole coefficient is obtained by analyzing the connection pattern between the node and its neighbors. The K-core value is calculated by iteratively deleting low-degree nodes.

[0017] Arrange the in-degree value, out-degree value, weighted in-degree value, weighted out-degree value, degree centrality, closeness centrality, betweenness centrality, clustering coefficient, structural hole coefficient, and K-core value of each service node in a preset feature order to construct a topological feature vector of the node; combine the topological feature vectors of all service nodes into a topological feature matrix;

[0018] Calculating the similarity between the topological feature matrix and the temporal feature matrix to generate an attention weight matrix; performing a weighted combination of the topological feature matrix and the temporal feature matrix according to the attention weight matrix to obtain a fusion feature matrix;

[0019] The fused feature matrix is ​​subjected to nonlinear transformation to obtain a transformed feature matrix; the fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector representing the multidimensional features of the service node.

[0020] A bidirectional long short-term memory network is constructed based on the comprehensive feature vector of the service node, and a multi-head attention mechanism is introduced into the bidirectional long short-term memory network to assign different weights to features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; the output features of the bidirectional long short-term memory network are dynamically integrated with the output features of the graph attention network layer, and training a deep learning prediction model includes:

[0021] Inputting the comprehensive feature vector of the service node into a bidirectional long short-term memory network; the bidirectional long short-term memory network processes the feature sequence before the current time window through a forward path to obtain a forward hidden state, and processes the feature sequence after the current time window through a backward path to obtain a backward hidden state; splicing the forward hidden state and the backward hidden state to obtain a temporal output feature of the bidirectional long short-term memory network;

[0022] A multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and the time series output features are mapped into a query vector, a key vector, and a value vector respectively through linear transformation; multiple parallel attention heads are used to independently calculate the degree of association between features in different time windows, and each attention head outputs a corresponding weighted feature; the weighted features of the multiple attention heads are spliced ​​and subjected to linear transformation to obtain the bidirectional long short-term memory network output features assigned weights to different time windows;

[0023] A graph attention network layer is constructed based on the service call topology graph. The dependency strength between service nodes is calculated using the graph attention calculation unit. Adaptively aggregate the features of adjacent nodes based on the dependency strength to capture the dependency propagation relationship between service nodes. A multi-head attention mechanism is used to learn different types of node interaction patterns, and the outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer.

[0024] Constructing a dynamic feature fusion module, inputting the output features of the bidirectional long short-term memory network and the output features of the graph attention network layer into the dynamic feature fusion module; calculating the fusion gating value through a learnable weight matrix, and determining the fusion weight of the two types of features according to the fusion gating value; dynamically weighting and combining the two types of features according to the corresponding fusion weights to obtain the fused prediction features;

[0025] A deep learning prediction model is trained based on the fused prediction features; a loss function is constructed that includes a prediction error term and a regularization term, wherein the prediction error term measures the deviation between the predicted value and the true value, and the regularization term includes parameter regularization and graph structure regularization; a backpropagation algorithm is used to optimize the model parameters so that the loss function converges to obtain a trained prediction model.

[0026] The deep learning prediction model is used to predict the future memory usage trend of each service node, and the memory leak risk score and abnormality prediction value are generated, including:

[0027] Obtain a historical feature sequence of the target service node in the most recent time window, the historical feature sequence including memory usage, CPU utilization, and request response time; input the historical feature sequence into a deep learning prediction model, and the deep learning prediction model generates a memory usage prediction sequence for future time windows based on the temporal variation pattern of the historical feature sequence;

[0028] Performing time series decomposition on the memory usage prediction sequence to extract the trend component, periodic component, and random component of the memory usage prediction sequence; calculating the growth rate and growth acceleration of memory usage based on the trend component, wherein the growth rate is obtained by differencing adjacent time points, and the growth acceleration is obtained by differencing the growth rates; and calculating a memory leak risk score using a weighted combination method based on the growth rate, the growth acceleration, and the fluctuation amplitude of the random component;

[0029] Constructing a benchmark sequence library containing multiple typical memory usage pattern sequences, each pattern sequence corresponding to a normal system operating state; using a dynamic time warping algorithm to calculate the distance between the memory usage prediction sequence and each pattern sequence in the benchmark sequence library; selecting the most similar N pattern sequences as reference sequences based on the distances, where N is a preset positive integer;

[0030] A probability distribution model describing a normal state is constructed based on the reference sequence; the likelihood probability of the memory usage prediction sequence under the probability distribution model is calculated; and a quantitative abnormality degree prediction value is generated by combining the likelihood probability, the memory leakage risk score, and the degree of deviation of the periodic component.

[0031] Calculating a global risk mean and standard deviation based on the memory leak risk score; sorting the service nodes in descending order according to the memory leak risk score, selecting service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes, comparing the predicted abnormality level of the high-risk service nodes with a preset abnormality threshold, and determining potential memory leak nodes; performing upstream and downstream analysis on the potential memory leak nodes using the service call topology graph to construct a memory leak propagation subgraph; applying a minimum cut algorithm to the memory leak propagation subgraph to identify key propagation paths, including:

[0032] Obtaining a predicted abnormality level value of the high-risk service node, calculating an adaptive threshold based on the predicted abnormality level value, and dynamically adjusting the adaptive threshold according to the distribution of the predicted abnormality level values ​​of the high-risk service node; comparing the predicted abnormality level value of the high-risk service node with the adaptive threshold, and determining the high-risk service node whose predicted abnormality level value is greater than the adaptive threshold as a potential memory leak node;

[0033] Construct a service call topology graph, where the edge weights in the graph are weighted by call frequency, response latency, and resource dependency. With the potential memory leak node as the central node, perform a bidirectional traversal in the graph to obtain upstream and downstream nodes that have direct or indirect call relationships with the central node. The traversal depth of the upstream and downstream nodes is dynamically determined based on the edge weights.

[0034] The central node and the upstream and downstream nodes are combined into a memory leak propagation subgraph, and the propagation probability is calculated based on the node's memory leak risk score, abnormality prediction value, and edge weight. The propagation probability represents the possibility of the memory leak propagating through the connection between nodes. The larger the propagation probability, the more likely the memory leak is to spread along the path.

[0035] A network flow model is constructed in the memory leak propagation subgraph, the central node is set as the source point, and the edge nodes in the upstream and downstream nodes are set as the sink points; a minimum cut algorithm is applied to the network flow model, and a minimum cut set is obtained through iterative calculation, wherein the minimum cut set includes a set of edges with the minimum propagation probability and the minimum propagation probability; and a key propagation path is identified based on the minimum cut set.

[0036] Based on the critical propagation paths and the predicted abnormality levels of each node, a belief propagation algorithm is used to calculate the probability of the leak source node. Services for locating the root cause of the memory leak include:

[0037] Obtain the abnormality prediction values ​​of the key propagation path and each node, set the service nodes in the key propagation path as variable nodes, and the call relationship between the nodes as factor nodes; map the abnormality prediction values ​​to the initial belief values ​​of the variable nodes, and construct the correlation function between the nodes based on the call frequency, response delay, and resource dependence between the nodes;

[0038] A message transmission channel is established between the variable node and the factor node, wherein the message content includes the leakage state and leakage degree of the node; the initial belief value of the variable node is input into the belief propagation algorithm, and the message in the message transmission channel is updated through iterative calculation; the probability of each variable node being a leakage source is calculated based on the convergence state of the message;

[0039] Sort the variable nodes according to the leak source probability and select the node with the highest probability as the candidate leak source node; analyze the memory allocation pattern, abnormal behavior characteristics, and resource usage of the candidate leak source node, and verify the credibility of the candidate leak source node in combination with historical leakage data; and determine the final leak source node;

[0040] Starting from the leak source node, a breadth-first traversal is performed in the memory leak propagation subgraph to obtain a set of affected nodes; the risk level of each node in the affected node set is calculated, and the risk level is determined by the leak source probability of the node, the predicted value of the abnormality level, and the topological distance from the leak source node; a tracing analysis report is generated, and the tracing analysis report includes: leak source identification results, propagation path analysis, and impact range assessment.

[0041] According to a second aspect of the embodiments of the present invention,

[0042] Provides an intelligent memory leak prediction and tracking system for microservice architecture, including:

[0043] The first unit is used to collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, with the window size set to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; extract the in-degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix of the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service node;

[0044] The second unit is used to construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism into the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node to generate a memory leakage risk score and anomaly degree prediction value;

[0045] The third unit is used to calculate the global risk mean and standard deviation based on the memory leak risk score; sort the service nodes in descending order according to the memory leak risk score, and select the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; compare the abnormality prediction value of the high-risk service node with the preset abnormality threshold to determine the potential memory leak node; use the service call topology graph to perform upstream and downstream analysis on the potential memory leak node and construct a memory leak propagation subgraph; apply the minimum cut algorithm in the memory leak propagation subgraph to identify the key propagation path; according to the key propagation path and the abnormality prediction value of each node, use the belief propagation algorithm to calculate the probability of the leakage source node and locate the root service of the memory leak.

[0046] According to a third aspect of the embodiments of the present invention,

[0047] An electronic device is provided, comprising:

[0048] processor;

[0049] a memory for storing processor-executable instructions;

[0050] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0051] According to a fourth aspect of the embodiments of the present invention,

[0052] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0053] The beneficial effects of this application are as follows:

[0054] 1. Improve the accuracy of memory leak prediction: This paper combines timing characteristics, topological characteristics and inter-service dependencies to build a deep learning prediction model, which can more accurately predict the future memory usage trend of microservice nodes, effectively identify potential memory leak nodes, and avoid false positives and missed reports.

[0055] 2. Accurately locate the root cause of memory leaks: This invention uses the service call topology diagram, combined with the minimum cut algorithm and the belief propagation algorithm, to perform upstream and downstream analysis of potential memory leak nodes, accurately locate the root service of the memory leak, and help developers quickly troubleshoot problems.

[0056] 3. Reduce the cost of memory leak detection: Through intelligent prediction and precise positioning, the present invention can effectively shorten the time of memory leak detection, reduce the workload of manual detection, and reduce labor costs and time costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flow chart of a method for intelligently predicting and tracing memory leaks in a microservice architecture according to an embodiment of the present invention;

[0058] Figure 2 This is a structural diagram of a memory leak intelligent prediction and tracking system for microservice architecture according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0060] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0061] Figure 1 This is a flow chart of a method for intelligently predicting and tracing memory leaks in a microservice architecture according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0062] S11. Collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, recording the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, setting the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix for the service node; extract the in-degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix for the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector for the service node;

[0063] S12. Construct a bidirectional long short-term memory (LSTM) network based on the comprehensive feature vectors of the service nodes, introduce a multi-head attention mechanism into the BLSTM network, and assign different weights to features in different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the BLSTM network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node and generate a memory leak risk score and anomaly degree prediction value;

[0064] S13. Calculate the global risk mean and standard deviation based on the memory leak risk score; sort the service nodes in descending order according to the memory leak risk score, and select the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; compare the abnormality prediction value of the high-risk service node with the preset abnormality threshold to determine the potential memory leak node; use the service call topology graph to perform upstream and downstream analysis on the potential memory leak node and construct a memory leak propagation subgraph; apply the minimum cut algorithm in the memory leak propagation subgraph to identify the key propagation path; use the belief propagation algorithm to calculate the probability of the leak source node based on the critical propagation path and the abnormality prediction value of each node, and locate the root service of the memory leak.

[0065] In an optional embodiment, a service call topology diagram is constructed to record the call relationship, call frequency, and request traffic between services; a sliding window is processed on the runtime data, with the window size set to 30 minutes, and the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window are calculated to generate a time series feature matrix of the service node, including:

[0066] Collect call data between nodes of the microservice system, and build an initial service call topology graph based on the call data. The nodes in the initial service call topology graph represent microservices, and the directed edges between the nodes represent call relationships.

[0067] Calculating call characteristics for each directed edge in the initial service call topology graph, including: calculating the number of calls per unit time to obtain a call frequency, accumulating the size of request data to obtain a call flow, and calculating the average response time to obtain a call delay; normalizing the call frequency, the call flow, and the call delay, determining an optimal weight coefficient using a grid search method, and obtaining an edge call strength through weighted summation; and updating the edge weights of the initial service call topology graph based on the call strength to obtain a weighted service call topology graph;

[0068] Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, number of garbage collection triggers, and amount of memory released by garbage collection; set a sliding window of 30 minutes for the runtime data, and a window sliding step of 5 minutes; in each sliding window, calculate the memory growth rate characteristics, specifically by performing first-order difference and exponential smoothing on the memory usage sequence; calculate the memory recovery rate characteristics, specifically by analyzing the ratio of the amount of memory released by garbage collection to the recovery time interval; analyze the memory allocation pattern characteristics, specifically by extracting the spatial locality and temporal locality indicators of memory allocation; arrange the memory growth rate characteristics, the memory recovery rate characteristics, and the memory allocation pattern characteristics of each node in the sliding window in chronological order to construct a node timing feature matrix.

[0069] A microservice system performance analysis method is used to build a service call topology diagram and analyze the runtime characteristics of nodes for performance optimization and fault diagnosis.

[0070] First, collect call data between services in the microservice system. This data includes the source service, target service, call timestamp, request size, and response time. For example, if service A calls service B at 10:00:00 with a 1KB request and a 10ms response time, a call record will be recorded: [Service A, Service B, 10:00:00, 1KB, 10ms]. Collecting a large amount of this call data provides the foundation for building a service call topology map.

[0071] Next, we construct an initial service call topology graph based on the collected call data. The nodes in the topology graph represent microservices, and the directed edges between nodes represent call relationships. For example, if service A calls service B, there will be a directed edge from service A to service B in the topology graph.

[0072] Next, calculate the call characteristics of each edge in the initial service call topology. For each edge, count the number of calls per unit time (e.g., per minute) to obtain the call frequency, accumulate the request data size to obtain the call traffic, and calculate the average response time to obtain the call latency. For example, if service A calls service B 100 times per minute, with an average request data size of 1 KB and an average response time of 10 ms, then the call frequency of this edge is 100 times / minute, the call traffic is 100 KB / minute, and the call latency is 10 ms.

[0073] Afterwards, the call frequency, call traffic, and call delay are normalized and their numerical range is scaled to between 0 and 1. For example, assuming that the maximum call frequency among all edges is 1000 times / minute, the normalized value of the call frequency of service A calling service B is 100 / 1000=0.1. The grid search method is used to determine the optimal weight coefficient. The grid search method finds the weight coefficient that optimizes the evaluation indicator (for example, prediction accuracy) by trying different weight combinations. The call strength of the edge is obtained by multiplying the normalized call frequency, call traffic, and call delay with their respective weight coefficients and then summing them. The edge weights of the initial service call topology graph are updated based on the call strength to obtain a weighted service call topology graph.

[0074] Collect weighted runtime data for each node in the weighted service call topology, including heap memory usage, non-heap memory usage, garbage collection trigger count, and memory freed by garbage collection. For example, if service A's heap memory usage at 10:00:00 is 1GB, non-heap memory usage is 500MB, garbage collection trigger count is 1, and memory freed by garbage collection is 100MB, then one runtime data entry is recorded: [Service A, 10:00:00, 1GB, 500MB, 1, 100MB].

[0075] A 30-minute sliding window is set for the runtime data, with a window sliding step of 5 minutes. Within each sliding window, the memory growth rate characteristics are calculated. The memory growth rate is obtained by performing first-order difference (for example, current memory usage minus previous memory usage) and exponential smoothing (for example, giving more weight to recent data) on the memory usage series. Memory recovery rate characteristics are calculated. The memory recovery rate is obtained by analyzing the ratio of the amount of memory released by garbage collection to the recycling time interval. Memory allocation pattern characteristics are analyzed. Memory allocation pattern characteristics are obtained by extracting the spatial locality (for example, whether the allocated memory addresses are concentrated in a certain area) and temporal locality (for example, whether the memory addresses allocated in adjacent time periods are similar) indicators of memory allocation.

[0076] The memory growth rate, memory recovery rate, and memory allocation pattern characteristics of each node within the sliding window are arranged in chronological order to construct a node time series feature matrix. This matrix can be used for subsequent machine learning model training, such as predicting the future performance of service nodes.

[0077] The embodiments of the present application can:

[0078] Refined Service Dependency Characterization: A weighted service call topology map more accurately reflects the strength of inter-service dependencies, helping to identify key services and potential bottlenecks. Multi-dimensional Runtime Feature Extraction: Combining multi-dimensional runtime features such as memory growth rate, memory recovery rate, and memory allocation pattern, it more comprehensively describes the operating status of service nodes and improves the accuracy of performance analysis. Dynamic Performance Analysis: Based on a sliding window mechanism, it captures performance trends of service nodes in real time, enabling dynamic performance monitoring and early warning.

[0079] In an optional embodiment, extracting the in-degree, centrality, and connectivity indicators of the service nodes based on the service call topology graph to construct a topological feature matrix of the service nodes; and fusing the temporal feature matrix with the topological feature matrix to generate a comprehensive feature vector of the service nodes includes:

[0080] Extracting basic topological features of each service node based on the service call topology graph, counting the number of incoming edges to obtain an in-degree value, and counting the number of outgoing edges to obtain an out-degree value; accumulating the call strengths of all incoming edges corresponding to the service node to obtain a weighted in-degree value, and accumulating the call strengths of all outgoing edges to obtain a weighted out-degree value; calculating the degree centrality of the node based on the weighted in-degree value and the weighted out-degree value;

[0081] Based on the service call topology graph, the high-order topological features of each service node are calculated. The shortest path distance between nodes is calculated based on the call intensity of the edges. The closeness centrality is calculated based on the shortest path distance from the node to all other nodes. The betweenness centrality is obtained by counting the proportion of paths passing through the node in all shortest paths. The clustering coefficient is obtained by calculating the edge density between node neighbors. The structural hole coefficient is obtained by analyzing the connection pattern between the node and its neighbors. The K-core value is calculated by iteratively deleting low-degree nodes.

[0082] Arrange the in-degree value, out-degree value, weighted in-degree value, weighted out-degree value, degree centrality, closeness centrality, betweenness centrality, clustering coefficient, structural hole coefficient, and K-core value of each service node in a preset feature order to construct a topological feature vector of the node; combine the topological feature vectors of all service nodes into a topological feature matrix;

[0083] Calculating the similarity between the topological feature matrix and the temporal feature matrix to generate an attention weight matrix; performing a weighted combination of the topological feature matrix and the temporal feature matrix according to the attention weight matrix to obtain a fusion feature matrix;

[0084] The fused feature matrix is ​​subjected to nonlinear transformation to obtain a transformed feature matrix; the fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector representing the multidimensional features of the service node.

[0085] The method for generating comprehensive feature vectors of service nodes is used to characterize the multi-dimensional features of service nodes in a microservice system. It includes the following steps:

[0086] First, construct a service call topology graph. This is done by collecting service call log data over a period of time, such as logs containing information such as the source service, target service, and call count. Each service is considered a node in the graph, and the service call relationship is considered a directed edge. The edge weight represents the number of service calls or call intensity. For example, if service A calls service B 10 times and service B calls service C 5 times, then in the constructed topology graph, the edge weight from A to B is 10, and the edge weight from B to C is 5.

[0087] Next, we extract the basic topological features of the service nodes. We traverse each node in the service call topology graph and count the number of incoming edges as the in-degree value and the number of outgoing edges as the out-degree value. We also sum the weights of all incoming edges to get the weighted in-degree value, and sum the weights of all outgoing edges to get the weighted out-degree value. For example, if service B has an incoming edge from service A with a weight of 10 and an incoming edge from service D with a weight of 2, then service B's in-degree value is 2 and its weighted in-degree value is 12. Based on these weighted in-degree and out-degree values, we calculate the node's degree centrality, which measures the importance of a node in the network.

[0088] Then, the high-order topological features of the service nodes are extracted. The weight of the edge (call strength) is used to calculate the shortest path distance between nodes. For example, the Dijkstra algorithm can be used to calculate the shortest path between any two nodes. The closeness centrality is calculated based on the inverse of the sum of the shortest path distances from the node to all other nodes. The closeness centrality reflects the centrality of the node in the network. The betweenness centrality is obtained by counting the proportion of the number of paths passing through the node in the shortest paths between all node pairs. The betweenness centrality measures the importance of information transmission of the node in the network. The edge density between node neighbors is calculated to obtain the clustering coefficient. The clustering coefficient reflects the closeness of the connection between node neighbors. The connection pattern between the node and its neighbors is analyzed to obtain the structural hole coefficient. The structural hole coefficient is used to measure the ability of the node to connect different communities in the network. The K-core value is calculated by iteratively deleting low-degree nodes. The K-core value reflects the position of the node in the core structure of the network.

[0089] Next, a topological feature matrix for the service nodes is constructed. Each service node's in-degree, out-degree, weighted in-degree, weighted out-degree, degree centrality, closeness centrality, betweenness centrality, clustering coefficient, structural hole coefficient, and K-core value are arranged in a predetermined order to form the node's topological feature vector. The topological feature vectors of all service nodes are combined into a topological feature matrix. For example, a topological feature matrix containing three service nodes might be a matrix with three rows and ten columns.

[0090] In addition, obtain the time series feature matrix of the service nodes. This can be obtained by analyzing the time series data in the service call logs. For example, count metrics such as the number of calls, average response time, and error rate for each service in different time periods, and arrange these metrics in chronological order to form a time series feature vector. The time series feature vectors of all service nodes are combined into a time series feature matrix. For example, if the number of calls to three service nodes in five time periods is counted, the time series feature matrix is ​​a matrix with three rows and five columns.

[0091] Next, feature fusion is performed. The similarity between the topological feature matrix and the temporal feature matrix is ​​calculated to generate an attention weight matrix. Based on the attention weight matrix, the topological feature matrix and the temporal feature matrix are weighted and combined to obtain a fused feature matrix.

[0092] The fused feature matrix is ​​then nonlinearly transformed. Activation functions such as Sigma ID and ReLU can be used to perform nonlinear transformations on the fused feature matrix to obtain a transformed feature matrix. The fused feature matrix and the transformed feature matrix are residually connected and layer-normalized to generate a comprehensive feature vector representing the multidimensional features of the service node.

[0093] The embodiments of the present application can:

[0094] First, improve the accuracy of service anomaly detection: This method comprehensively considers the topological characteristics and timing characteristics of service nodes, and can more comprehensively characterize the status of service nodes, thereby improving the accuracy of service anomaly detection.

[0095] Second, reduce the false alarm rate of service anomaly detection: By integrating multi-dimensional features, normal fluctuations and abnormal behaviors can be effectively distinguished, thereby reducing the false alarm rate.

[0096] Third, enhance the explainability of service anomaly detection: The features extracted by this method have clear physical meanings, which can help understand the causes of service anomalies and thus enhance explainability.

[0097] In an optional embodiment, a bidirectional long short-term memory network is constructed based on the comprehensive feature vector of the service node, a multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and different weights are assigned to features of different time windows; a graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes; the output features of the bidirectional long short-term memory network are dynamically integrated with the output features of the graph attention network layer, and training a deep learning prediction model includes:

[0098] Inputting the comprehensive feature vector of the service node into a bidirectional long short-term memory network; the bidirectional long short-term memory network processes the feature sequence before the current time window through a forward path to obtain a forward hidden state, and processes the feature sequence after the current time window through a backward path to obtain a backward hidden state; splicing the forward hidden state and the backward hidden state to obtain a temporal output feature of the bidirectional long short-term memory network;

[0099] A multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and the time series output features are mapped into a query vector, a key vector, and a value vector respectively through linear transformation; multiple parallel attention heads are used to independently calculate the degree of association between features in different time windows, and each attention head outputs a corresponding weighted feature; the weighted features of the multiple attention heads are spliced ​​and subjected to linear transformation to obtain the bidirectional long short-term memory network output features assigned weights to different time windows;

[0100] A graph attention network layer is constructed based on the service call topology graph. The dependency strength between service nodes is calculated using the graph attention calculation unit. Adaptively aggregate the features of adjacent nodes based on the dependency strength to capture the dependency propagation relationship between service nodes. A multi-head attention mechanism is used to learn different types of node interaction patterns, and the outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer.

[0101] Constructing a dynamic feature fusion module, inputting the output features of the bidirectional long short-term memory network and the output features of the graph attention network layer into the dynamic feature fusion module; calculating the fusion gating value through a learnable weight matrix, and determining the fusion weight of the two types of features according to the fusion gating value; dynamically weighting and combining the two types of features according to the corresponding fusion weights to obtain the fused prediction features;

[0102] A deep learning prediction model is trained based on the fused prediction features; a loss function is constructed that includes a prediction error term and a regularization term, wherein the prediction error term measures the deviation between the predicted value and the true value, and the regularization term includes parameter regularization and graph structure regularization; a backpropagation algorithm is used to optimize the model parameters so that the loss function converges to obtain a trained prediction model.

[0103] A service node anomaly detection method is used to predict the health status of service nodes and improve system stability. This method uses the timing characteristics and topological dependencies of service nodes to build a deep learning prediction model.

[0104] First, we collect monitoring data from service nodes, such as CPU usage, memory usage, request latency, and request error rate. We convert this multi-dimensional monitoring data into comprehensive feature vectors, where each feature vector represents the status of a service node within a time window. For example, if we collect data every minute, one hour of data will constitute one feature vector.

[0105] These feature vectors are then input into a bidirectional long short-term memory (Bi-LSTM) network. The Bi-LSTM consists of two pathways: a forward pathway and a backward pathway. The forward pathway processes the feature sequence before the current time window, learning the influence of historical information on the current state. The backward pathway processes the feature sequence after the current time window, learning the influence of future information on the current state. For example, to predict the service node status at 10:00 AM, the forward pathway processes data before 9:00 AM, and the backward pathway processes data after 10:00 AM. The hidden states output by the forward and backward pathways are concatenated to produce the Bi-LSTM's time series output features.

[0106] To highlight the influence of important time windows, a multi-head attention mechanism is introduced into the Bi-LSTM. The time series output features are converted into query vectors, key vectors, and value vectors. Multiple attention heads concurrently calculate the correlation between features from different time windows, with each head focusing on a different time segment. For example, one attention head focuses on data from the last hour, while another focuses on data from the past day. The weighted features output by each attention head are concatenated to produce Bi-LSTM output features weighted for different time windows.

[0107] At the same time, a graph attention network layer is constructed based on the service call topology graph. The service call topology graph describes the dependencies between service nodes. The graph attention network layer calculates the dependency strength between service nodes and adaptively aggregates the features of adjacent nodes to capture the dependency propagation relationship between service nodes. For example, if service A frequently calls service B, the status of service B will have a greater impact on service A. A multi-head attention mechanism is used to learn different types of node interaction patterns. For example, one attention head focuses on direct call relationships, while another focuses on indirect call relationships. The outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer.

[0108] Next, a dynamic feature fusion module is constructed to fuse the Bi-LSTM output features with the output features of the graph attention network layer. A learnable weight matrix is ​​used to calculate the fusion gating value, and the fusion weights of the two feature types are determined based on the fusion gating value. For example, if the time series features are more important, the Bi-LSTM output features are given a greater weight. The two feature types are then weighted together according to the corresponding fusion weights to obtain the fused prediction features.

[0109] Finally, the deep learning prediction model is trained based on the fused prediction features. A loss function is constructed that includes a prediction error term and a regularization term. The prediction error term measures the deviation between the predicted value and the true value, for example, using mean squared error. Regularization terms include parameter regularization and graph structure regularization to prevent model overfitting. The model parameters are optimized using a backpropagation algorithm to achieve convergence of the loss function, resulting in a trained prediction model. For example, the Adam optimizer is used for parameter updates.

[0110] The embodiments of the present application can:

[0111] Improve prediction accuracy: This method comprehensively considers the timing characteristics and topological dependencies of service nodes, and can more accurately predict the health status of service nodes. For example, compared with the model that only uses timing features, the prediction accuracy of this method is improved by 10%. Enhance model robustness: The multi-head attention mechanism and dynamic fusion module enable the model to adapt to different data distributions and topological structures, improving the robustness of the model. For example, when the service call topology changes, this method can still maintain a high prediction accuracy. Reduce operation and maintenance costs: By predicting service node anomalies in advance, preventive measures can be taken in time to avoid failures and reduce operation and maintenance costs. For example, services can be expanded or migrated in advance based on the prediction results to avoid service interruptions.

[0112] In an optional embodiment, using the deep learning prediction model to predict the future memory usage trend of each service node to generate a memory leak risk score and an abnormality degree prediction value includes:

[0113] Obtain a historical feature sequence of the target service node in the most recent time window, the historical feature sequence including memory usage, CPU utilization, and request response time; input the historical feature sequence into a deep learning prediction model, and the deep learning prediction model generates a memory usage prediction sequence for future time windows based on the temporal variation pattern of the historical feature sequence;

[0114] Performing time series decomposition on the memory usage prediction sequence to extract the trend component, periodic component, and random component of the memory usage prediction sequence; calculating the growth rate and growth acceleration of memory usage based on the trend component, wherein the growth rate is obtained by differencing adjacent time points, and the growth acceleration is obtained by differencing the growth rates; and calculating a memory leak risk score using a weighted combination method based on the growth rate, the growth acceleration, and the fluctuation amplitude of the random component;

[0115] Constructing a benchmark sequence library containing multiple typical memory usage pattern sequences, each pattern sequence corresponding to a normal system operating state; using a dynamic time warping algorithm to calculate the distance between the memory usage prediction sequence and each pattern sequence in the benchmark sequence library; selecting the most similar N pattern sequences as reference sequences based on the distances, where N is a preset positive integer;

[0116] A probability distribution model describing a normal state is constructed based on the reference sequence; the likelihood probability of the memory usage prediction sequence under the probability distribution model is calculated; and a quantitative abnormality degree prediction value is generated by combining the likelihood probability, the memory leakage risk score, and the degree of deviation of the periodic component.

[0117] Obtain the historical feature sequence of the target service node. First, determine the target service node, such as a server that provides user login services. Then, set a historical time window, such as the past 7 days. Within this time window, collect characteristic data such as memory usage, CPU utilization, and request response time of the target service node. This data can be obtained from the monitoring system or log file and sampled at fixed time intervals (such as every minute). For example, a time series can be obtained in which each data point contains the memory usage (such as 80%), CPU utilization (such as 60%), and request response time (such as 200 milliseconds) at a certain moment.

[0118] Input the historical feature sequences into the deep learning prediction model. Select an appropriate deep learning model, such as a long short-term memory network (LSTM) or a gated recurrent unit network (GRU), which excels at processing time series data. Train the selected deep learning model using the collected historical feature sequences. For example, you can use the previous six days' data as the training set and the seventh day's data as the test set to evaluate the model's predictive performance. After training is complete, input the last seven days' historical feature sequences into the trained model to generate a sequence of memory usage predictions for the next period (e.g., the next 24 hours). For example, the model might predict memory usage for the next 24 hours to be 82%, 85%, 88%, etc.

[0119] Perform time series decomposition on the memory usage prediction series. Decompose the memory usage prediction series generated by the model into a trend component, a cyclical component, and a random component. The trend component reflects the long-term trend of memory usage, such as a continuous increase or decrease. The cyclical component reflects periodic fluctuations in memory usage, such as daily peaks and valleys. The random component reflects random fluctuations in memory usage, such as fluctuations caused by traffic bursts. You can use a time series decomposition algorithm, such as STL decomposition, to decompose the prediction series into these three components. For example, the decomposition results show that the trend component shows a slowly increasing trend, the cyclical component exhibits a clear daily periodicity, and the random component has a small amplitude.

[0120] Calculate the memory leak risk score. Based on the decomposed trend components, calculate the growth rate and growth acceleration of memory usage. For example, if the predicted memory usage for the next 24 hours is 82%, 85%, and 88%, respectively, then the growth rates are 3% and 3%, respectively. The growth acceleration is 0. Then, based on the growth rate, growth acceleration, and the fluctuation range of the random component, a weighted combination is used to calculate the memory leak risk score. For example, an empirical formula can be set to multiply the growth rate, growth acceleration, and fluctuation range of the random component by different weights, and then add them together to obtain the risk score. If both the growth rate and growth acceleration are high, and the random component fluctuates greatly, the risk score is higher. For example, the calculated risk score is 7.5 points (out of 10 points).

[0121] Build a benchmark sequence library and predict anomaly severity. Build a benchmark sequence library containing various typical memory usage pattern sequences. For example, you can collect memory usage sequences under different load conditions (low load, medium load, and high load), as well as memory usage sequences when a memory leak has occurred. Then, use the dynamic time warping algorithm to calculate the distance between the predicted sequence and each pattern sequence in the benchmark sequence library. Select the N pattern sequences with the smallest distances as reference sequences. For example, select the three pattern sequences with the smallest distances as reference sequences. Based on these reference sequences, build a probability distribution model that describes normal conditions, such as a Gaussian distribution model. Calculate the likelihood of the predicted sequence under this probability distribution model. For example, the calculated likelihood is 0.2. Finally, combine the likelihood, the memory leak risk score, and the deviation degree of the periodic component to generate a quantitative anomaly severity prediction value. For example, multiply the likelihood, risk score, and deviation degree of the periodic component by different weights and add them together to obtain the anomaly severity prediction value. For example, the calculated anomaly severity prediction value is 8.0 (out of 10).

[0122] The embodiments of the present application can:

[0123] By combining deep learning prediction models with time series decomposition techniques, we can more accurately predict memory usage trends and identify potential memory leak risks. Deep learning models can capture complex patterns in historical data, while time series decomposition can isolate the impact of different factors on memory usage, thereby improving the accuracy and reliability of predictions.

[0124] By calculating the memory leak risk score and the predicted abnormality level, the memory leak risk can be quantified and a more intuitive risk assessment result can be provided. This helps operations personnel better understand the risk level and take appropriate preventive or remedial measures.

[0125] By predicting memory leak risks in advance, you can take preventive measures in advance, such as increasing memory resources, optimizing code, or restarting services, to avoid system crashes or performance degradation caused by memory leaks, thereby improving system stability and reliability.

[0126] In an optional embodiment, a global risk mean and standard deviation are calculated based on the memory leak risk score; the service nodes are sorted in descending order according to the memory leak risk score, and service nodes with a risk score greater than the sum of the global risk mean and the standard deviation are selected as high-risk service nodes. The predicted abnormality level of the high-risk service node is compared with a preset abnormality threshold to determine a potential memory leak node; the service call topology graph is used to perform upstream and downstream analysis on the potential memory leak node to construct a memory leak propagation subgraph; and a minimum cut algorithm is applied to the memory leak propagation subgraph to identify the key propagation path, including:

[0127] Obtaining a predicted abnormality level value of the high-risk service node, calculating an adaptive threshold based on the predicted abnormality level value, and dynamically adjusting the adaptive threshold according to the distribution of the predicted abnormality level values ​​of the high-risk service node; comparing the predicted abnormality level value of the high-risk service node with the adaptive threshold, and determining the high-risk service node whose predicted abnormality level value is greater than the adaptive threshold as a potential memory leak node;

[0128] Construct a service call topology graph, where the edge weights in the graph are weighted by call frequency, response latency, and resource dependency. With the potential memory leak node as the central node, perform a bidirectional traversal in the graph to obtain upstream and downstream nodes that have direct or indirect call relationships with the central node. The traversal depth of the upstream and downstream nodes is dynamically determined based on the edge weights.

[0129] The central node and the upstream and downstream nodes are combined into a memory leak propagation subgraph, and the propagation probability is calculated based on the node's memory leak risk score, abnormality prediction value, and edge weight. The propagation probability represents the possibility of the memory leak propagating through the connection between nodes. The larger the propagation probability, the more likely the memory leak is to spread along the path.

[0130] A network flow model is constructed in the memory leak propagation subgraph, the central node is set as the source point, and the edge nodes in the upstream and downstream nodes are set as the sink points; a minimum cut algorithm is applied to the network flow model, and a minimum cut set is obtained through iterative calculation, wherein the minimum cut set includes a set of edges with the minimum propagation probability and the minimum propagation probability; and a key propagation path is identified based on the minimum cut set.

[0131] A memory leak risk identification method based on service call topology can accurately locate potential memory leak nodes and key propagation paths, effectively preventing memory leaks from spreading in large-scale distributed systems.

[0132] First, calculate the global memory leak risk. We collect metrics such as memory usage, garbage collection times, and object lifetime for each service node from the system monitoring platform. We then use a machine learning model to assign a memory leak risk score to each service node. We then collect the memory leak risk scores for all service nodes and calculate the global mean and standard deviation.

[0133] Next, filter high-risk service nodes. Sort all service nodes in descending order by memory leak risk score. Select service nodes with a risk score greater than the sum of the global risk mean and standard deviation as high-risk service nodes. For example, if the global risk mean is 0.5 and the standard deviation is 0.1, then service nodes with a risk score greater than 0.6 are marked as high-risk service nodes.

[0134] Then, predict potential memory leak nodes. Obtain the predicted value of the abnormality level of high-risk service nodes. This predicted value can be obtained by analyzing indicators such as the CPU usage, response time, error rate, etc. of the service node, and calculated using time series analysis or anomaly detection algorithm. Based on the predicted value of the abnormality level of these high-risk service nodes, calculate the adaptive threshold. For example, the 95% quantile of the predicted value of the abnormality level can be set as the adaptive threshold. Compare the predicted value of the abnormality level of the high-risk service node with the adaptive threshold, and determine the high-risk service node with a predicted value of the abnormality level greater than the adaptive threshold as a potential memory leak node. For example, if the predicted value of the abnormality level of a high-risk service node is 0.9 and the adaptive threshold is 0.8, then the node is determined to be a potential memory leak node.

[0135] Subsequently, a service call topology graph is constructed. Call relationships between service nodes are collected to construct the service call topology graph. The edge weights in the graph are composed of a weighted combination of call frequency, response latency, and resource dependency. For example, the higher the call frequency, the longer the response latency, and the higher the resource dependency between two service nodes, the greater the edge weight between them. Assuming service node A calls service node B 100 times per second, with a response latency of 100 milliseconds and a resource dependency of 0.8, the weight of edge AB can be calculated as 100 * 0.1 * 0.8 = 8.

[0136] Next, a memory leak propagation subgraph is constructed. Taking the potential memory leak node as the central node, a bidirectional traversal is performed in the service call topology graph to obtain upstream and downstream nodes that have direct or indirect call relationships with the central node. The traversal depth of upstream and downstream nodes is dynamically determined based on the edge weight. The greater the edge weight, the deeper the traversal depth. For example, if the edge weight between the central node and a certain node is large, the upstream and downstream nodes of that node will be traversed further. The central node and the upstream and downstream nodes form a memory leak propagation subgraph. For example, if service node A is a potential memory leak node, its directly connected nodes are B and C, and B is connected to D, then the memory leak propagation subgraph contains nodes A, B, C, and D.

[0137] Next, the propagation probability is calculated. This is based on the memory leak risk scores, anomaly predictions, and edge weights of the nodes in the memory leak propagation subgraph. The propagation probability represents the likelihood that a memory leak will propagate through connections between nodes. A larger propagation probability indicates a greater likelihood that the memory leak will spread along that path.

[0138] Finally, identify the critical propagation path. A network flow model is constructed within the memory leak propagation subgraph, with the central node as the source and the edge nodes in the upstream and downstream nodes as the sink. A minimum cut algorithm is applied to the network flow model, and a minimum cut set is obtained through iterative calculation. The minimum cut set consists of the set of edges with the minimum sum of propagation probabilities. Based on the minimum cut set, the critical propagation path is identified. For example, if the minimum cut set contains edges AB and BC, then the critical propagation path is A->B->C.

[0139] The embodiments of the present application can:

[0140] Improve the accuracy of memory leak identification: By combining memory leak risk scores, anomaly predictions, and service call topology, potential memory leak nodes can be more accurately identified. Accelerate memory leak troubleshooting efficiency: By identifying key propagation paths, the root cause of memory leaks can be quickly located, shortening troubleshooting time. Reduce the impact of memory leaks: By identifying potential memory leak nodes and key propagation paths in advance, timely measures can be taken to prevent memory leaks from spreading across large-scale distributed systems and reduce their impact.

[0141] In an optional embodiment, based on the critical propagation path and the predicted value of the abnormality level of each node, a belief propagation algorithm is used to calculate the probability of the leak source node, and the root cause of the memory leak location service includes:

[0142] Obtain the abnormality prediction values ​​of the key propagation path and each node, set the service nodes in the key propagation path as variable nodes, and the call relationship between the nodes as factor nodes; map the abnormality prediction values ​​to the initial belief values ​​of the variable nodes, and construct the correlation function between the nodes based on the call frequency, response delay, and resource dependence between the nodes;

[0143] A message transmission channel is established between the variable node and the factor node, wherein the message content includes the leakage state and leakage degree of the node; the initial belief value of the variable node is input into the belief propagation algorithm, and the message in the message transmission channel is updated through iterative calculation; the probability of each variable node being a leakage source is calculated based on the convergence state of the message;

[0144] Sort the variable nodes according to the leak source probability and select the node with the highest probability as the candidate leak source node; analyze the memory allocation pattern, abnormal behavior characteristics, and resource usage of the candidate leak source node, and verify the credibility of the candidate leak source node in combination with historical leakage data; and determine the final leak source node;

[0145] Starting from the leak source node, a breadth-first traversal is performed in the memory leak propagation subgraph to obtain a set of affected nodes; the risk level of each node in the affected node set is calculated, and the risk level is determined by the leak source probability of the node, the predicted value of the abnormality level, and the topological distance from the leak source node; a tracing analysis report is generated, and the tracing analysis report includes: leak source identification results, propagation path analysis, and impact range assessment.

[0146] Obtain key propagation paths and predicted values ​​for node anomaly levels. First, use a distributed tracing system to collect call link data between services, such as call relationships, call frequency, response latency, and resource dependencies. Suppose service A calls service B 100 times per minute with an average response latency of 50 milliseconds, and service B relies on the database resources provided by service A. Then, use the monitoring system to collect various service metrics, such as CPU usage, memory utilization, and request success rate. Combining these metrics with preset thresholds, determine the anomaly level of each service. For example, if the memory utilization of service C exceeds the threshold of 90%, service C is considered to have a high anomaly level, with a predicted value of 0.9. Finally, based on the call link data and the predicted anomaly level, identify the key propagation path for the memory leak, such as service A->service B->service C, and obtain the predicted anomaly level for each node along the path.

[0147] Set the service nodes in the key propagation path as variable nodes, the call relationships between nodes as factor nodes, and map the predicted anomaly level to the initial belief value of the variable node. For example, set services A, B, and C as variable nodes, and A->B and B->C as factor nodes. If the predicted anomaly levels for services A, B, and C are 0.2, 0.5, and 0.9, respectively, then these values ​​are set as the initial belief values ​​of the corresponding variable nodes, indicating the initial probability that the node has a memory leak.

[0148] Construct an association function between nodes. This function describes the impact relationship between nodes and is based on factors such as call frequency, response latency, and resource dependency. For example, if service A frequently calls service B, and service B relies heavily on the resources provided by service A, service A is considered to have a greater impact on service B, resulting in a higher association function value. Conversely, the association function value is lower.

[0149] A message transmission channel is established between the variable node and the factor node. The message content contains the node's leakage status (e.g., leakage exists or does not exist) and the leakage degree (e.g., slight leakage, moderate leakage, severe leakage).

[0150] The initial belief values ​​of the variable nodes are fed into the belief propagation algorithm, which iterates and updates the messages in the message channel. For example, initially, service A's belief value is 0.2, indicating a 0.2 probability of a memory leak. Service A passes this information to its adjacent factor node, A->B. Factor node A->B combines the information passed by service A with its own correlation function to calculate a new message and pass it to service B. Service B receives the message from factor node A->B and, based on its own initial belief value, updates its own belief value. This process continues, with each node continuously passing and updating messages until the messages converge.

[0151] The probability of each variable node being a leak source is calculated based on the convergence state of the message. For example, after multiple iterations, the probabilities of services A, B, and C being leak sources converge to 0.1, 0.3, and 0.6, respectively.

[0152] Sort the variable nodes according to the leak source probability and select the node with the highest probability as the candidate leak source node. For example, service C has the highest probability, so it is selected as the candidate leak source node.

[0153] Analyze the memory allocation patterns, abnormal behavior characteristics, and resource usage of candidate leak source nodes, and combine them with historical leak data to verify the credibility of candidate leak source nodes. For example, if analyzing the code of service C reveals a logical error in unreleased memory, and historical records show that service C has experienced multiple memory leaks, then service C is considered to be highly trustworthy.

[0154] Determine the final leak source node. For example, based on the above analysis, service C is ultimately determined to be the leak source node.

[0155] Starting from the leak source node, perform a breadth-first traversal in the memory leak propagation subgraph to obtain the set of affected nodes. For example, starting from service C and traversing down the call chain, we find that services D and E are affected. The set of affected nodes is {C, D, E}.

[0156] Calculate the risk level for each node in the affected node set. The risk level is determined by the node's leak source probability, predicted anomaly level, and topological distance from the leak source node. For example, service C has a leak source probability of 0.6, a predicted anomaly level of 0.9, and a topological distance from itself of 0, giving it the highest risk level. The risk levels of services D and E are calculated based on their respective probabilities, predicted values, and distances from service C.

[0157] Generate a tracking analysis report. The report includes leak source identification results (Service C), propagation path analysis (A->B->C->D, A->B->C->E), and impact scope assessment (risk levels of C, D, and E).

[0158] The embodiments of the present application can:

[0159] Improve memory leak location efficiency: Through the belief propagation algorithm and multi-dimensional data analysis, we can quickly and accurately locate the root cause of memory leaks, eliminating the tedious and inefficient manual troubleshooting. Reduce memory leak troubleshooting costs: The automated analysis process reduces manual intervention, reducing both labor and time costs. Improve system stability: Rapidly locating and fixing memory leaks effectively prevents system crashes and improves system stability and reliability.

[0160] Figure 2 FIG. 1 is a schematic diagram of the structure of a memory leak intelligent prediction and tracking system for a microservice architecture according to an embodiment of the present invention. Figure 2 As shown, the system includes:

[0161] The first unit is used to collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; construct a service call topology map, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, with the window size set to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix of the service node; extract the in-degree, centrality, and connectivity indicators of the service node based on the service call topology map, and construct a topological feature matrix of the service node; perform feature fusion on the time series feature matrix and the topological feature matrix to generate a comprehensive feature vector of the service node;

[0162] The second unit is used to construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism into the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node to generate a memory leakage risk score and anomaly degree prediction value;

[0163] The third unit is used to calculate the global risk mean and standard deviation based on the memory leak risk score; sort the service nodes in descending order according to the memory leak risk score, and select the service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; compare the abnormality prediction value of the high-risk service node with the preset abnormality threshold to determine the potential memory leak node; use the service call topology graph to perform upstream and downstream analysis on the potential memory leak node and construct a memory leak propagation subgraph; apply the minimum cut algorithm in the memory leak propagation subgraph to identify the key propagation path; according to the key propagation path and the abnormality prediction value of each node, use the belief propagation algorithm to calculate the probability of the leakage source node and locate the root service of the memory leak.

[0164] According to a third aspect of the embodiments of the present invention,

[0165] An electronic device is provided, comprising:

[0166] processor;

[0167] a memory for storing processor-executable instructions;

[0168] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0169] According to a fourth aspect of the embodiments of the present invention,

[0170] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0171] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent memory leak prediction and tracking method for microservice architecture, characterized by: include: Collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; Build a service call topology diagram to record the call relationship, call frequency, and request traffic between services; Perform sliding window processing on the runtime data, with the window size set to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix for the service node; Extracting the in-degree, centrality, and connectivity indicators of the service nodes based on the service call topology graph to construct a topological feature matrix of the service nodes; fusing the temporal feature matrix with the topological feature matrix to generate a comprehensive feature vector of the service nodes; A bidirectional long short-term memory network is constructed based on the comprehensive feature vectors of the service nodes. A multi-head attention mechanism is introduced into the bidirectional long short-term memory network to assign different weights to features of different time windows. A graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes. The output features of the bidirectional long short-term memory network are dynamically fused with the output features of the graph attention network layer to train a deep learning prediction model. The deep learning prediction model is used to predict the future memory usage trend of each service node to generate a memory leakage risk score and anomaly degree prediction value. Calculating a global risk mean and standard deviation based on the memory leak risk score; Sort the service nodes in descending order according to the memory leak risk score, and select the service nodes whose risk scores are greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; Comparing the predicted abnormality level of the high-risk service node with a preset abnormality threshold to determine a potential memory leak node; Performing upstream and downstream analysis on the potential memory leak node using the service call topology graph to construct a memory leak propagation subgraph; The minimum cut algorithm is applied in the memory leak propagation subgraph to identify the key propagation path; based on the key propagation path and the predicted value of the abnormality degree of each node, the belief propagation algorithm is used to calculate the probability of the leak source node and locate the root service of the memory leak.

2. The method according to claim 1, characterized in that Build a service call topology diagram, record the call relationship, call frequency, and request traffic between services; perform sliding window processing on the runtime data, set the window size to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix for the service node, including: Collect call data between nodes of the microservice system, and build an initial service call topology graph based on the call data. The nodes in the initial service call topology graph represent microservices, and the directed edges between the nodes represent call relationships. Calculating call characteristics for each directed edge in the initial service call topology graph, including: calculating the number of calls per unit time to obtain a call frequency, accumulating the size of request data to obtain a call flow, and calculating the average response time to obtain a call delay; normalizing the call frequency, the call flow, and the call delay, determining an optimal weight coefficient using a grid search method, and obtaining an edge call strength through weighted summation; and updating the edge weights of the initial service call topology graph based on the call strength to obtain a weighted service call topology graph; Collect weighted runtime data of each node in the weighted service call topology diagram, including heap memory usage, non-heap memory usage, number of garbage collection triggers, and amount of memory released by garbage collection; set a sliding window of 30 minutes for the runtime data, and a window sliding step of 5 minutes; in each sliding window, calculate the memory growth rate characteristics, specifically by performing first-order difference and exponential smoothing on the memory usage sequence; calculate the memory recovery rate characteristics, specifically by analyzing the ratio of the amount of memory released by garbage collection to the recovery time interval; analyze the memory allocation pattern characteristics, specifically by extracting the spatial locality and temporal locality indicators of memory allocation; arrange the memory growth rate characteristics, the memory recovery rate characteristics, and the memory allocation pattern characteristics of each node in the sliding window in chronological order to construct a node timing feature matrix.

3. The method according to claim 1, characterized in that Extracting the in-degree, centrality, and connectivity indicators of the service nodes based on the service call topology graph, and constructing a topological feature matrix of the service nodes; Fusing the time series feature matrix with the topology feature matrix to generate a comprehensive feature vector of the service node includes: Extracting basic topological features of each service node based on the service call topology graph, counting the number of incoming edges to obtain an in-degree value, and counting the number of outgoing edges to obtain an out-degree value; accumulating the call strengths of all incoming edges corresponding to the service node to obtain a weighted in-degree value, and accumulating the call strengths of all outgoing edges to obtain a weighted out-degree value; calculating the degree centrality of the node based on the weighted in-degree value and the weighted out-degree value; Based on the service call topology graph, the high-order topological features of each service node are calculated. The shortest path distance between nodes is calculated based on the call intensity of the edges. The closeness centrality is calculated based on the shortest path distance from the node to all other nodes. The betweenness centrality is obtained by counting the proportion of paths passing through the node in all shortest paths. The clustering coefficient is obtained by calculating the edge density between node neighbors. The structural hole coefficient is obtained by analyzing the connection pattern between the node and its neighbors. The K-core value is calculated by iteratively deleting low-degree nodes. Arrange the in-degree value, out-degree value, weighted in-degree value, weighted out-degree value, degree centrality, closeness centrality, betweenness centrality, clustering coefficient, structural hole coefficient, and K-core value of each service node in a preset feature order to construct a topological feature vector of the node; combine the topological feature vectors of all service nodes into a topological feature matrix; Calculating the similarity between the topological feature matrix and the temporal feature matrix to generate an attention weight matrix; performing a weighted combination of the topological feature matrix and the temporal feature matrix according to the attention weight matrix to obtain a fusion feature matrix; The fused feature matrix is ​​subjected to nonlinear transformation to obtain a transformed feature matrix; the fused feature matrix is ​​residually connected with the transformed feature matrix, and layer normalization is performed to finally generate a comprehensive feature vector representing the multidimensional features of the service node.

4. The method according to claim 1, wherein A bidirectional long short-term memory network is constructed based on the comprehensive feature vector of the service node. A multi-head attention mechanism is introduced into the bidirectional long short-term memory network to assign different weights to features of different time windows. A graph attention network layer is constructed based on the service call topology graph to capture the dependency propagation relationship between service nodes. Dynamically fusing the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer, and training the deep learning prediction model includes: Inputting the comprehensive feature vector of the service node into a bidirectional long short-term memory network; the bidirectional long short-term memory network processes the feature sequence before the current time window through a forward path to obtain a forward hidden state, and processes the feature sequence after the current time window through a backward path to obtain a backward hidden state; splicing the forward hidden state and the backward hidden state to obtain a temporal output feature of the bidirectional long short-term memory network; A multi-head attention mechanism is introduced into the bidirectional long short-term memory network, and the time series output features are mapped into a query vector, a key vector, and a value vector respectively through linear transformation; multiple parallel attention heads are used to independently calculate the degree of association between features in different time windows, and each attention head outputs a corresponding weighted feature; the weighted features of the multiple attention heads are spliced ​​and subjected to linear transformation to obtain the bidirectional long short-term memory network output features assigned weights to different time windows; A graph attention network layer is constructed based on the service call topology graph. The dependency strength between service nodes is calculated using the graph attention calculation unit. Adaptively aggregate the features of adjacent nodes based on the dependency strength to capture the dependency propagation relationship between service nodes. A multi-head attention mechanism is used to learn different types of node interaction patterns, and the outputs of multiple attention heads are combined to obtain the output features of the graph attention network layer. Constructing a dynamic feature fusion module, inputting the output features of the bidirectional long short-term memory network and the output features of the graph attention network layer into the dynamic feature fusion module; calculating the fusion gating value through a learnable weight matrix, and determining the fusion weight of the two types of features according to the fusion gating value; dynamically weighting and combining the two types of features according to the corresponding fusion weights to obtain the fused prediction features; A deep learning prediction model is trained based on the fused prediction features; a loss function is constructed that includes a prediction error term and a regularization term, wherein the prediction error term measures the deviation between the predicted value and the true value, and the regularization term includes parameter regularization and graph structure regularization; a backpropagation algorithm is used to optimize the model parameters so that the loss function converges to obtain a trained prediction model.

5. The method according to claim 1, wherein The deep learning prediction model is used to predict the future memory usage trend of each service node, and the memory leak risk score and abnormality prediction value are generated, including: Obtain a historical feature sequence of the target service node in the most recent time window, the historical feature sequence including memory usage, CPU utilization, and request response time; input the historical feature sequence into a deep learning prediction model, and the deep learning prediction model generates a memory usage prediction sequence for future time windows based on the temporal variation pattern of the historical feature sequence; Performing time series decomposition on the memory usage prediction sequence to extract the trend component, periodic component, and random component of the memory usage prediction sequence; calculating the growth rate and growth acceleration of memory usage based on the trend component, wherein the growth rate is obtained by differencing adjacent time points, and the growth acceleration is obtained by differencing the growth rates; and calculating a memory leak risk score using a weighted combination method based on the growth rate, the growth acceleration, and the fluctuation amplitude of the random component; Constructing a benchmark sequence library containing multiple typical memory usage pattern sequences, each pattern sequence corresponding to a normal system operating state; using a dynamic time warping algorithm to calculate the distance between the memory usage prediction sequence and each pattern sequence in the benchmark sequence library; selecting the most similar N pattern sequences as reference sequences based on the distances, where N is a preset positive integer; A probability distribution model describing a normal state is constructed based on the reference sequence; the likelihood probability of the memory usage prediction sequence under the probability distribution model is calculated; and a quantitative abnormality degree prediction value is generated by combining the likelihood probability, the memory leakage risk score, and the degree of deviation of the periodic component.

6. The method according to claim 1, characterized in that Calculating a global risk mean and standard deviation based on the memory leak risk score; sorting the service nodes in descending order according to the memory leak risk score, selecting service nodes with a risk score greater than the sum of the global risk mean and the standard deviation as high-risk service nodes, and comparing the predicted abnormality level of the high-risk service nodes with a preset abnormality threshold to determine potential memory leak nodes; Performing upstream and downstream analysis on the potential memory leak node using the service call topology graph to construct a memory leak propagation subgraph; Applying the minimum cut algorithm in the memory leak propagation subgraph to identify the key propagation path includes: Obtaining a predicted abnormality level value of the high-risk service node, calculating an adaptive threshold based on the predicted abnormality level value, and dynamically adjusting the adaptive threshold according to the distribution of the predicted abnormality level values ​​of the high-risk service node; comparing the predicted abnormality level value of the high-risk service node with the adaptive threshold, and determining the high-risk service node whose predicted abnormality level value is greater than the adaptive threshold as a potential memory leak node; Construct a service call topology graph, where the edge weights in the graph are weighted by call frequency, response latency, and resource dependency. With the potential memory leak node as the central node, perform a bidirectional traversal in the graph to obtain upstream and downstream nodes that have direct or indirect call relationships with the central node. The traversal depth of the upstream and downstream nodes is dynamically determined based on the edge weights. The central node and the upstream and downstream nodes are combined into a memory leak propagation subgraph, and the propagation probability is calculated based on the node's memory leak risk score, abnormality prediction value, and edge weight. The propagation probability represents the possibility of the memory leak propagating through the connection between nodes. The larger the propagation probability, the more likely the memory leak is to spread along the path. A network flow model is constructed in the memory leak propagation subgraph, the central node is set as the source point, and the edge nodes in the upstream and downstream nodes are set as the sink points; a minimum cut algorithm is applied to the network flow model, and a minimum cut set is obtained through iterative calculation, wherein the minimum cut set includes a set of edges with the minimum propagation probability and the minimum propagation probability; and a key propagation path is identified based on the minimum cut set.

7. The method according to claim 1, characterized in that Based on the critical propagation paths and the predicted abnormality levels of each node, a belief propagation algorithm is used to calculate the probability of the leak source node. Services for locating the root cause of the memory leak include: Obtain the abnormality prediction values ​​of the key propagation path and each node, set the service nodes in the key propagation path as variable nodes, and the call relationship between the nodes as factor nodes; map the abnormality prediction values ​​to the initial belief values ​​of the variable nodes, and construct the correlation function between the nodes based on the call frequency, response delay, and resource dependence between the nodes; A message transmission channel is established between the variable node and the factor node, wherein the message content includes the leakage state and leakage degree of the node; the initial belief value of the variable node is input into the belief propagation algorithm, and the message in the message transmission channel is updated through iterative calculation; the probability of each variable node being a leakage source is calculated based on the convergence state of the message; Sort the variable nodes according to the leak source probability and select the node with the highest probability as the candidate leak source node; analyze the memory allocation pattern, abnormal behavior characteristics, and resource usage of the candidate leak source node, and verify the credibility of the candidate leak source node in combination with historical leakage data; and determine the final leak source node; Starting from the leak source node, a breadth-first traversal is performed in the memory leak propagation subgraph to obtain a set of affected nodes; the risk level of each node in the affected node set is calculated, and the risk level is determined by the leak source probability of the node, the predicted value of the abnormality level, and the topological distance from the leak source node; a tracing analysis report is generated, and the tracing analysis report includes: leak source identification results, propagation path analysis, and impact range assessment.

8. A memory leak intelligent prediction and tracking system for microservice architecture, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The first unit is used to collect runtime data of each service node in the microservice system, including heap memory usage, non-heap memory usage, garbage collection frequency, and memory allocation rate; Build a service call topology diagram to record the call relationship, call frequency, and request traffic between services; Perform sliding window processing on the runtime data, with the window size set to 30 minutes, calculate the memory growth rate, memory recovery rate, and memory allocation pattern characteristics within the window, and generate a time series feature matrix for the service node; Extracting the in-degree, centrality, and connectivity indicators of the service nodes based on the service call topology graph, and constructing a topological feature matrix of the service nodes; Performing feature fusion on the time series feature matrix and the topology feature matrix to generate a comprehensive feature vector of the service node; The second unit is used to construct a bidirectional long short-term memory network based on the comprehensive feature vector of the service node, introduce a multi-head attention mechanism into the bidirectional long short-term memory network, and assign different weights to the features of different time windows; construct a graph attention network layer based on the service call topology graph to capture the dependency propagation relationship between service nodes; dynamically fuse the output features of the bidirectional long short-term memory network with the output features of the graph attention network layer to train a deep learning prediction model; use the deep learning prediction model to predict the future memory usage trend of each service node to generate a memory leakage risk score and anomaly degree prediction value; A third unit is configured to calculate a global risk mean and a standard deviation based on the memory leak risk score; Sort the service nodes in descending order according to the memory leak risk score, and select the service nodes whose risk scores are greater than the sum of the global risk mean and the standard deviation as high-risk service nodes; Comparing the predicted abnormality level of the high-risk service node with a preset abnormality threshold to determine a potential memory leak node; Performing upstream and downstream analysis on the potential memory leak node using the service call topology graph to construct a memory leak propagation subgraph; The minimum cut algorithm is applied in the memory leak propagation subgraph to identify the key propagation path; based on the key propagation path and the predicted value of the abnormality degree of each node, the belief propagation algorithm is used to calculate the probability of the leak source node and locate the root service of the memory leak.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images