Micro-service system multi-modal anomaly detection method and system thereof

Abstract

The present application relates to a kind of microservice system multimodal anomaly detection method and system with high reliability.The microservice system multimodal anomaly detection method with high reliability includes the following steps: collecting multiple modal data in microservice system, and the multiple modal data is encoded respectively to obtain feature representation, and the feature representation of each modal is respectively sampled and reconstructed using Gaussian distribution representation to understand noisy multimodal content.After obtaining modal features, in order to measure the different contributions of modal content, the present application assigns a fusion weight to each modal data through an adaptive fusion method, and finally combines the fusion weight and the feature representation of modal data and inputs into the anomaly detector to determine whether the microservice system is abnormal, thereby greatly improving the accuracy and reliability of microservice system anomaly detection.

Description

Technical Field

[0001] The present invention relates to the technical field of microservice anomaly detection, and in particular to a multimodal anomaly detection method and system for a microservice system. Background Art

[0002] Microservices architecture has gained widespread adoption in enterprises as a means of developing applications. Using a microservices architecture, a tightly coupled application can be split into several independent services, each with a single function and independent development and deployment processes, coordinated and collaborating through lightweight mechanisms. Compared to traditional software systems, microservices systems offer finer granularity, more flexible scalability, and more frequent program updates and iterations. Industrial microservices systems are typically large-scale distributed systems, running tens to thousands of services across diverse machines. Despite significant effort in quality assurance, anomalies are inevitable due to the scale and complexity of microservices systems. For example, when encountering unpredictable issues (such as network failures or host issues), each microservice may experience performance issues. Furthermore, failures in microservices systems can result in significant financial losses and damage user satisfaction. Therefore, developers must closely monitor the status of microservices through system runtime information (e.g., traces, system logs, and monitoring metrics) to detect anomalies and address potential failures as early as possible.

[0003] Microservice anomaly detection is typically addressed by collecting various types of data that can be monitored within a microservice system and researching efficient, automated anomaly detection techniques to improve its performance. Microservice systems provide three types of data for monitoring system status: service / machine metrics, system logs, and traces (system call chain information). Specifically, metrics are in the form of time series. Microservice systems typically have a set of metrics that provide information about system services or machine status, such as CPU utilization and memory usage. Logs are semi-structured text messages printed by log statements that record the runtime state of the system. A trace consists of multiple spans, each corresponding to a service call. Traces record the process of a microservice system responding to a user request, such as clicking "Create Order" on an online shopping website.

[0004] Some existing studies usually only use a single data source for automated anomaly detection. However, in actual scenarios, a single data source cannot detect all abnormal information of the system. These different modal data often have some complementary relationships. For example, the delay in the trace can indicate the availability of the microservice, but fine-grained information (such as memory usage that reflects the internal state of the service) is unknown. In this case, indicators (indicators record the memory usage of related services in real time) or logs (when there is insufficient memory, there will be relevant abnormal log information) can be used to assist monitoring, that is, using multiple modal data for automated anomaly diagnosis.

[0005] Because each data source in microservice multimodal data has a different representation, effective integration of multimodal data is essential. However, integrated multimodal data is often unreliable, meaning that modalities often contain noise and conflicting information between modalities. For example, when collecting modal data for feature learning, a common approach is to use sliding time windows to collect both normal and abnormal data. However, some time windows containing abnormal data may contain some normal data. Since anomaly detection is typically a binary classification task within a time window, this normal data can be considered noise that affects multimodal anomaly feature learning. Furthermore, unusual metric fluctuations may occur within normal time windows, potentially triggering alerts even when no anomalies are occurring. Furthermore, conflicting information may exist between modalities, primarily manifesting in inconsistent system states reflected by each modality. For example, when configuring a new application (a normal change), the utilization of relevant metrics (such as CPU and memory) may be high. In this case, metric-based methods may detect this as an anomaly, while log and trace-based methods may detect it as normal. Summary of the Invention

[0006] Based on this, it is necessary to provide a multimodal anomaly detection method and system for microservice systems to address the problems of low accuracy and poor reliability of existing technologies for anomaly detection in microservice systems, which provides a feasible solution for maximizing the effectiveness and reliability of anomaly detection in microservice systems.

[0007] A multimodal anomaly detection method for a microservice system comprises the following steps:

[0008] Collect multiple modal data in the microservice system, encode the multiple modal data separately, and model the multiple encoded modal data as Gaussian distribution models respectively, extract the features of each modal data in the range of (μ±nσ) to obtain the feature representation sequence Where m represents the serial number of the modal data, i represents the serial number of the feature in the modal data, and n represents the coefficient;

[0009] Each feature represents a sequence The weight value TCP′ of the corresponding modal data is calculated through the confidence network respectively, and the calculation formula is:

[0010]

[0011] In the formula, FC is the fully connected layer and Sigmoid is the activation function;

[0012] The features of each modal data and the weight value TCP′ are fused as the system state representation value. The fusion formula is:

[0013]

[0014] The system status representation value is input into the anomaly detector to calculate the result value, and the microservice system is judged whether there is an anomaly based on the result value. The calculation formula for the result value is:

[0015] y′=argmax[Softmax(WR+b)]

[0016] Where argmax is the argmax function, Softmax represents the softmax classification function, W and b represent trainable parameters, y′∈{0,1}, 0 represents the normal state, and 1 represents the abnormal state.

[0017] As a preferred example, the multiple modal data include service indicators, system logs, and system call chain information;

[0018] The encoding method of the service indicators includes: treating k indicators in the microservice system as a set of multivariate time series, then using GRU to learn the complex correlation of the multivariate time series, and encoding the multivariate time series;

[0019] The system log encoding method includes: parsing the system log into events through Drain, and then encoding the events using Hawkes process;

[0020] The encoding method of the system call chain information includes: using the length and step size of the sliding window to segment the system call chain information; calculating the average delay time when the system call chain information of each window is called and converting it into a time series; and using GRU to encode the time series.

[0021] As a preferred example, the Gaussian distribution model is expressed as:

[0022]

[0023] In the formula, g(·) represents the feature representation sequence extracted from each modality, The feature representation of the mth mode represents the i-th code in the sequence; N is the Gaussian distribution representation, μ represents the mean vector in the Gaussian distribution, and σ represents the variance vector in the Gaussian distribution.

[0024] As a preferred example, when the microservice system is detected to be in an abnormal state, an alarm mechanism is immediately triggered; the alarm mechanism includes sound reminders and SMS reminders.

[0025] As a preferred example, the multimodal anomaly detection method for a microservice system further includes constructing and training a multimodal anomaly detection model. The method for constructing and training a multimodal anomaly detection model includes the following steps:

[0026] Build a microservice benchmark system and inject multiple faults into each service of the microservice benchmark system. Then collect and store multiple modal data of the microservice benchmark system. The collected modal data is divided into a sliding time window to obtain a dataset.

[0027] After feature extraction of the dataset, input it into the classifier to obtain the label prediction distribution sequence Among them, y represents the label category, represents the probability value of the i-th label category in the m-th mode, K represents the total number of label categories, and the true class probability distribution value TCP is used as the probability prediction score of the label prediction distribution sequence. The calculation formula is:

[0028]

[0029] Where (·) represents the inner product operation, TCP m ∈(0,1);

[0030] A confidence network is used to calculate a weight value TCP′ that approximates the true class probability distribution value TCP; the characteristics of the data set and the weight value TCP′ are fused as a system state representation value; the system state representation value is input into an anomaly detector to calculate a result value; the multimodal anomaly detection model is repeatedly trained on the data set until the accuracy of the predicted result value reaches a preset error range.

[0031] As a preferred example, the functions of the constructed microservice benchmark system include query, reservation, payment and cancellation, and each function generates corresponding modal data when used.

[0032] As a preferred example, the multiple faults injected include: CPU / memory pressure on the container, service / database failure, and network data packet delay and loss.

[0033] A microservice system multimodal anomaly detection system, which uses the above-mentioned microservice system multimodal anomaly detection method; the microservice system multimodal anomaly detection system includes:

[0034] The acquisition module is used to collect and store multiple modal data in the microservice system;

[0035] A feature extraction module is used to encode the modal data, model the encoded modal data as a Gaussian distribution model, and extract features of the modal data within the range of (μ±nσ) to obtain a feature representation sequence;

[0036] The anomaly detection module is used to calculate the weight value according to the feature representation sequence; calculate the system state representation value according to the weight value; and calculate the result value y′ according to the system state representation value, where y′∈{0,1}, 0 represents a normal state and 1 represents an abnormal state.

[0037] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned microservice system multimodal anomaly detection method when executing the computer program.

[0038] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned multimodal anomaly detection method for a microservice system.

[0039] The beneficial effects of the present invention are as follows: the present invention uses multimodal data to learn the discriminative representation of the system state and trains it through labeled data. In order to adapt to noisy scenarios and improve the robustness of the model, the feature representation of each modal data is further learned based on probabilistic latent coding. At the same time, a fusion weight of each modal data is assigned through an adaptive fusion method. Finally, the fusion weight is combined with the feature representation of the modal data to determine whether the microservice system has an anomaly, thereby greatly improving the accuracy and reliability of anomaly detection in the microservice system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Flowchart of the multimodal anomaly detection method for microservice systems. DETAILED DESCRIPTION

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0043] Please refer to Figure 1 This embodiment provides a multimodal anomaly detection method for a microservice system, which includes the following steps:

[0044] S1. Collect multiple modal data in the microservice system, encode the multiple modal data separately, and model the multiple encoded modal data as Gaussian distribution models respectively. Extract the features of each modal data in the range of (μ±nσ) to obtain the feature representation sequence. Where m represents the sequence number of the modal data, i represents the sequence number of the feature in the modal data, and n represents the coefficient.

[0045] In order to adapt to noisy scenarios and improve the robustness of the model, this step robustly learns the feature representation of each modality based on probabilistic latent coding. In this embodiment, the collected modal data is of three types: service indicators, system logs, and system call chain information. First, a modality-specific encoder is applied to learn the information representation of each modal data. Specifically, for system logs, the logs are parsed into events by Drain and then the log events are encoded using the Hawkes process. For service indicators, the k indicators of each microservice are first regarded as a set of multivariate time series, and then GRU (gated recurrent unit) is used to learn the complex correlations of the multivariate time series and encode the multivariate time series. For the system call chain information, the length and step size of the sliding window are used to segment the system call chain information, and then the average delay time when the system call chain information of each window is called is calculated and converted into a time series. Finally, the time series is also encoded using GRU.

[0046] Although the encoded representations of each modal data have been obtained, they are point features and cannot adapt to noisy data. Therefore, the multiple encoded modal data are further modeled as a Gaussian distribution model. Specifically, the probabilistic latent coding module is used to predict the mean vector μ and variance vector σ of each modal data. The mean vector μ represents the feature representation identified by each modal data. The variance vector σ represents the range of each modal data distribution in each dimension. The larger the variance vector σ, the higher the uncertainty of the observable content. The Gaussian distribution model can be expressed as:

[0047]

[0048] In the formula, g(·) represents the feature representation sequence extracted from each modality, The feature representation of the mth mode represents the i-th code in the sequence; N is the Gaussian distribution representation, μ represents the mean vector in the Gaussian distribution, and σ represents the variance vector in the Gaussian distribution.

[0049] S2. Represent each feature as a sequence The weight value TCP′ of the corresponding modal data is calculated through the confidence network respectively, and the calculation formula is:

[0050]

[0051] In the formula, FC is the fully connected layer and Sigmoid is the activation function.

[0052] S3. The features of each modal data and the weight value TCP′ are fused as the system state representation value, that is, the weighted accumulation of the features of each modal data is used as the system state value representation (the feature and the weight value TCP′ can be multiplied and then added together). The fusion formula is:

[0053]

[0054] S4. Input the system status representation value into the anomaly detector to calculate the result value, and determine whether the microservice system has an anomaly within the time window based on the result value; the calculation formula for the result value is:

[0055] y′=argmax[Softmax(WR+b)]

[0056] Where argmax is the argmax function, Softmax is the softmax classification function, W and b are trainable parameters, and the anomaly detector is trained using a supervised approach. y′∈{0,1}, 0 represents the normal state and 1 represents the abnormal state.

[0057] When the microservice system is detected to be in an abnormal state, the alarm mechanism is immediately triggered. The alarm mechanism includes sound reminders and SMS reminders.

[0058] In summary, this multimodal anomaly detection method for microservice systems first collects multiple modal data from the microservice system and encodes each modal data to obtain feature representations. It then uses a Gaussian distribution representation to sample and reconstruct each modal feature representation to understand the noisy multimodal content. After obtaining the modal features, an adaptive fusion method is used to assign fusion weights to each modal data to measure the different contributions of the modal content. Finally, the fusion weights are combined with the feature representations of the modal data and input into the anomaly detector to determine whether the microservice system has anomalies, thereby significantly improving the accuracy and reliability of anomaly detection in microservice systems.

[0059] The models used in the above-mentioned anomaly detection methods are combined to form a multimodal anomaly detection model, which requires training. The training process is similar to that of actual applications. In another embodiment, a method for constructing and training a multimodal anomaly detection model is proposed. The key concept is to use multimodal data to learn a discriminative representation of system state and to train the model using labeled data. In general, when training the model, it is necessary to first build a microservice benchmark system, inject faults into each service, and collect multimodal data. After acquiring the data, the dataset is partitioned using a sliding time window. Feature extraction is then performed on the multimodal data within each time window. To adapt to noisy scenarios and improve the robustness of the model, it is necessary to further learn feature representations for each modal data based on probabilistic latent coding. In addition, after obtaining the uncertainty feature representation of each modal data, an adaptive fusion method is used to assign fusion weights to each modal data. Finally, the fused multimodal features are used as system state representations and input into an anomaly detector, which is then trained using a supervised method. Specifically, the method for constructing and training a multimodal anomaly detection model includes the following steps:

[0060] Build a microservice benchmark system. For example, consider a TrainTicket microservice benchmark system based on the 12306 platform. This system contains 41 microservices, 27 of which are business-related. Users can query, reserve, pay, and cancel train tickets. This benchmark system is deployed using Docker, and a request simulator is developed to simulate user ticket purchase operations.

[0061] To simulate real-world abnormal scenarios, Alibaba's Chaos Blade chaos tool was used to sequentially inject six typical faults into each service in the microservice benchmark system: container CPU / memory pressure, service / database failures (unavailability), and network packet latency and loss. Each fault had a consistent duration, and the system remained operational for a period of time after each injection. After all fault injections were complete, open-source monitoring tools were deployed to collect data. System call traces between microservices were collected in Jaeger. Each service metric was monitored using cAdvisor and Prometheus and stored in the time series database InfluxDB. The service metrics involved included CPU / memory utilization, memory utilization, cumulative network data received, and cumulative network data transmitted. System logs were collected and stored using EFK (Elasticsearch, Flume, and Kibana).

[0062] The modal data collected above is then divided into a data set through a sliding time window. After feature extraction of the data set, it is input into the classifier to obtain a label prediction distribution sequence. Among them, y represents the label category, Represents the probability value of the i-th label category in the m-th mode, and K represents the total number of label categories. The true class probability distribution value TCP is used as the probability prediction score of the label prediction distribution sequence, and the calculation formula is:

[0063]

[0064] Where (·) represents the inner product operation, TCP m ∈(0,1).

[0065] During the training process, the classifier can be regarded as a probabilistic model, which can output a label prediction distribution sequence based on Softmax. Since the labels of the modal data are unknown in the testing phase and the actual application phase, it is impossible to directly use the true class probability distribution value TCP as the fusion weight. Therefore, this step predicts and constructs a weight value TCP′ through the confidence network to approximate the true class probability distribution value TCP. The calculation formula is:

[0066]

[0067] For example, when the approximated values ​​differ by within plus or minus 0.02, the weight value TCP' is regarded as the true class probability distribution value TCP, which is used as the fusion weight of the modal data. The higher the weight value TCP', the more accurate the classification results can be predicted by using the feature representation learned from the modal data. It is worth mentioning that the maximum class probability value (MCP) is usually used as the probability prediction score of the classifier in the prior art. The higher the score, the higher the reliability of the modal data. Its maximum class probability value is defined as However, MCP often leads to overconfidence. For example, when the classifier makes an accurate prediction, TCP is equivalent to MCP, resulting in a high score. When the classifier makes an incorrect prediction, MCP may still produce a high score, while TCP tends to produce a lower score, indicating that the reliability of the modal data is low and may be detrimental to the multimodal classification task. In this case, more attention should be paid to the content of the data in other modalities.

[0068] The dataset's features are combined with the weighted value TCP' to represent the system state. This value is then fed into the anomaly detector to calculate the resulting value. The multimodal anomaly detection model is repeatedly trained using the dataset until the predicted value accuracy falls within a preset error range. This completes the construction and training of the multimodal anomaly detection model.

[0069] In another embodiment, a highly reliable multimodal anomaly detection system for a microservice system is proposed, which utilizes the aforementioned multimodal anomaly detection method for a microservice system. The multimodal anomaly detection system for a microservice system includes an acquisition module, a feature extraction module, and an anomaly detection module. The acquisition module is configured to collect and store data from multiple modalities within the microservice system.

[0070] The feature extraction module is used to encode the modal data, model the encoded modal data as a Gaussian distribution model, and extract the features of the modal data in the range of (μ±nσ) to obtain a feature representation sequence.

[0071] The anomaly detection module is used to calculate a weight value based on the feature representation sequence. The system state representation value is calculated based on the weight value. The result value y′ is calculated based on the system state representation value, where y′∈{0,1}, 0 represents a normal state and 1 represents an abnormal state.

[0072] In other embodiments, an electronic device is provided. The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the aforementioned method for detecting multimodal anomalies in a microservice system are implemented. A computer-readable storage medium is also provided. The computer-readable storage medium stores the computer program. When the processor executes the computer program, the steps of the aforementioned method for detecting multimodal anomalies in a microservice system are implemented.

[0073] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0074] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A multimodal anomaly detection method for a microservice system, characterized in that: It includes the following steps: Collect multiple modal data in the microservice system, encode the multiple modal data separately, and model the multiple encoded modal data as Gaussian distribution models respectively, extract the features of each modal data in the range of (μ±nσ) to obtain the feature representation sequence Wherein, m represents the serial number of the modal data, i represents the serial number of the feature in the modal data, and n represents the coefficient; the Gaussian distribution model is expressed as: In the formula, g(·) represents the feature representation sequence extracted from each modality, The feature representation of the mth mode represents the i-th code in the sequence; N is the Gaussian distribution representation, μ represents the mean vector in the Gaussian distribution, and σ represents the variance vector in the Gaussian distribution; Each feature represents a sequence The weight value TCP′ of the corresponding modal data is calculated through the confidence network respectively, and the calculation formula is: In the formula, FC is the fully connected layer and Sigmoid is the activation function; The features of each modal data and the weight value TCP′ are fused as the system state representation value. The fusion formula is: The system status representation value is input into the anomaly detector to calculate the result value, and the microservice system is judged whether there is an anomaly based on the result value. The calculation formula for the result value is: y′=argmax[Softmax(WR+b)] Where argmax is the argmax function, Softmax represents the Softmax classification function, W and b represent trainable parameters, y′∈{0,1}, 0 represents the normal state, and 1 represents the abnormal state.

2. The multimodal anomaly detection method for a microservice system according to claim 1, characterized in that: Multi-modal data includes service metrics, system logs, and system call chain information; The encoding method of the service indicators includes: treating k indicators in the microservice system as a set of multivariate time series, then using GRU to learn the complex correlation of the multivariate time series, and encoding the multivariate time series; The system log encoding method includes: parsing the system log into events through Drain, and then encoding the events using Hawkes process; The encoding method of the system call chain information includes: using the length and step size of the sliding window to segment the system call chain information; calculating the average delay time when the system call chain information of each window is called and converting it into a time series; and using GRU to encode the time series.

3. The multimodal anomaly detection method for a microservice system according to claim 1, wherein: When the microservice system is detected to be in an abnormal state, an alarm mechanism is immediately triggered; the alarm mechanism includes sound reminders and SMS reminders.

4. The multimodal anomaly detection method for a microservice system according to claim 1, wherein: The multimodal anomaly detection method for a microservice system further includes constructing and training a multimodal anomaly detection model. The method for constructing and training a multimodal anomaly detection model includes the following steps: Build a microservice benchmark system and inject multiple faults into each service of the microservice benchmark system. Then collect and store multiple modal data of the microservice benchmark system. The collected modal data is divided into a sliding time window to obtain a dataset. After feature extraction of the dataset, input it into the classifier to obtain the label prediction distribution sequence Among them, y represents the label category, represents the probability value of the i-th label category in the m-th mode, K represents the total number of label categories; the true class probability distribution value TCP is used as the probability prediction score of the label prediction distribution sequence, and the calculation formula is: Where (·) represents the inner product operation, TCP m ∈(0,1); A confidence network is used to calculate a weight value TCP′ that approximates the true class probability distribution value TCP; the characteristics of the data set and the weight value TCP′ are fused as a system state representation value; the system state representation value is input into an anomaly detector to calculate a result value; the multimodal anomaly detection model is repeatedly trained on the data set until the accuracy of the predicted result value reaches a preset error range.

5. The multimodal anomaly detection method for a microservice system according to claim 4, characterized in that: The functions of the constructed microservice benchmark system include query, reservation, payment and cancellation, and each function generates corresponding modal data when used.

6. The multimodal anomaly detection method for a microservice system according to claim 4, characterized in that: The various faults injected include: cpu / memory pressure on the container, service / database failures, and network packet delay and loss.

7. A multimodal anomaly detection system for a microservice system, characterized in that: It uses the microservice system multimodal anomaly detection method according to any one of claims 1 to 6; The microservice system multimodal anomaly detection system includes: The acquisition module is used to collect and store multiple modal data in the microservice system; A feature extraction module is used to encode the modal data, model the encoded modal data as a Gaussian distribution model, and extract features of the modal data within the range of (μ±nσ) to obtain a feature representation sequence; The anomaly detection module is used to calculate the weight value according to the feature representation sequence; calculate the system state representation value according to the weight value; and calculate the result value y′ according to the system state representation value, where y′∈{0,1}, 0 represents a normal state and 1 represents an abnormal state.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps of the microservice system multimodal anomaly detection method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the microservice system multimodal anomaly detection method according to any one of claims 1 to 6 are implemented.

Images