A multi-dimensional root cause positioning method and device based on multi-modal learning

Abstract

The application relates to a multi-dimensional root cause positioning method and device based on multi-modal learning, which comprises the following steps: obtaining historical multi-modal data generated in a fault interval of a cloud native system runtime; performing serialization processing on Metric data, Log data and Trace data in the historical multi-modal data; selecting service instances and APIs as nodes of a hypergraph, and obtaining node features according to the Metric serialized data, the Log serialized data and the Trace serialized data; constructing hyperedges of the hypergraph from the perspectives of physics, logic and interaction according to the service instances, APIs, k8s nodes and services; forming a multi-modal hypergraph from the nodes of the hypergraph, the node features and the hyperedges of the hypergraph; inputting the multi-modal hypergraph into a multi-dimensional root cause positioning model based on a hypergraph neural network and a fully connected neural network, training the multi-dimensional root cause positioning model, and obtaining a trained multi-dimensional root cause positioning model. The method solves the problems of insufficient single-modal data modeling, difficult complex relationship capturing and dynamicity and heterogeneity.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of software engineering, and particularly relates to a multi-dimensional root cause positioning method and device based on multi-modal learning. BACKGROUND

[0002] Cloud-native systems are applications or services built based on the architecture and design philosophy of cloud computing, widely used in Internet enterprises, national defense, telecommunications, power and other critical fields, helping enterprises build efficient and reliable applications in the cloud environment, and improving development and operation efficiency. Such systems are usually implemented through containerization, microservices, automated management and other technologies, and have characteristics such as rapid iteration, high availability, flexibility, and flexibility.

[0003] Cloud-native systems decompose applications into multiple independent modules, and each module communicates with each other through the network. Microservices architecture has become one of the important ways to implement cloud-native systems, and microservices architecture is widely used by most enterprises due to its independent development, independent deployment, and decentralization. Root cause positioning is one of the important ways to solve the runtime faults of cloud-native systems, which can quickly and accurately report the root cause of the problem and reduce operation and maintenance costs. However, compared with traditional monolithic systems, the structure of cloud-native systems is diverse and the interaction is complex, making it difficult to perform root cause positioning on cloud-native systems.

[0004] With the increase in the size of cloud-native systems, the number of system components and their interactions become increasingly complex, and there is an urgent need for a method that can quickly and accurately locate the root cause of the fault. Current methods can be classified from two angles, one is from the perspective of the type of operation and maintenance data, and the other is from the perspective of data processing. The first type of operation and maintenance data can be divided into single-modal and multi-modal methods. In the single-modal method, the relationship between data is established by analyzing a certain type of data in Metric, Log, and Trace to achieve root cause positioning. The multi-modal method uses three types of data to model the relationship between data using graph neural networks or other deep learning networks, which can more comprehensively describe the system state. The second type of data processing can be divided into sequential and event-based methods. The sequential method processes operation and maintenance data into sequence data for unified modeling, solving the problem of heterogeneous operation and maintenance data that is difficult to model uniformly. The event-based method treats faults as events, and outputs a root cause list by comparing normal and abnormal events.

[0005] Zhejiang University has provided a method and system for locating the root cause of microservice anomalies in its patent application document "A method and system for locating the root cause of microservice anomalies" (Publication No.: CN119025310A, Application No.: CN202411005152.0, Application Date: July 25, 2024). This invention discloses a method for locating the root cause of microservice anomalies, comprising the following steps: obtaining several traces from a log database, and removing abnormal traces from the several traces based on a preset abnormal trace set to obtain a first preliminary normal trace set; checking whether each trace in the first preliminary normal trace set is complete, removing incomplete traces to obtain a second preliminary normal trace set; constructing a trace tree for each trace in the second preliminary normal trace set, and calculating the execution time of each span in each trace tree to obtain a third preliminary normal trace set; grouping and statistically analyzing the third preliminary normal trace set based on the service name and span name to obtain abnormal traces in the third preliminary normal trace set; calculating the anomaly score of each span in the abnormal traces; selecting the span with the highest anomaly score from the anomaly scores as the root cause span; and analyzing the root cause span to obtain the root cause of the microservice anomaly. This invention can quickly and accurately locate the root cause of anomalies.

[0006] Anhui Sigo Intelligent Technology Co., Ltd. has provided a microservice root cause localization method and apparatus in its patent application "Root Cause Localization Method and Apparatus for Microservice Systems Based on Graph Neural Network Model" (Publication No.: CN117560275A, Application No.: CN202311854026.8, Application Date: February 13, 2024). This invention relates to a root cause localization method and apparatus for microservice systems based on a graph neural network model, including the following steps: constructing a graph neural network model; training the graph neural network model using multi-dimensional time-series performance indicators of historical faults to obtain a trained graph neural network model; constructing an instance-level heterogeneous topology graph of the microservice system through collected real-time microservice topology and call relationships; adjusting the anomaly weights of each microservice node in conjunction with the service request chain; inputting the root cause candidate set and real-time indicator feature data of the anomaly time window into the graph neural network model, and obtaining the final root cause and root cause anomaly type after feature weighting. This invention can quickly and accurately detect root causes, reducing the localization granularity to the instance level; and by effectively combining machine learning models with dynamic graph calculation methods, it adapts well to the dynamic changes of microservice systems.

[0007] Existing methods using unimodal data struggle to comprehensively model the complete state of runtime faults in complex cloud-native systems, leading to false negatives and further increasing operational costs. Existing multimodal methods, when dealing with cloud-native systems with diverse component relationships, often only capture one-to-one relationships using typical graph neural networks, while cloud-native systems contain numerous one-to-many relationships, making it difficult to comprehensively model the interrelationships between system components. Cloud-native systems involve multiple layers (e.g., application, service, infrastructure), and faults can propagate across different layers. Existing methods are typically limited to single-layer analysis, lacking cross-layer correlation modeling capabilities, resulting in an inability to fully understand the fault propagation path, potentially leading to misjudgments from a local perspective and increasing the complexity of fault diagnosis. Furthermore, existing methods focus on a single dimension for root cause localization, such as instance or service level; however, for engineers, a single-dimensional root cause analysis does not significantly shorten fault handling time.

[0008] Therefore, existing root cause localization methods suffer from problems such as insufficient consideration of the complex relationships between components within the system, inadequate single-modal data modeling, difficulty in capturing complex relationships, and issues related to dynamism, heterogeneity, incomplete software modeling, and distortion, resulting in inaccurate root causes. Summary of the Invention

[0009] To address the aforementioned problems in the existing technology, this invention provides a multi-dimensional root cause localization method and apparatus based on multimodal learning. The technical problem to be solved by this invention is achieved through the following technical solution:

[0010] This invention provides a multi-dimensional root cause localization method based on multimodal learning, comprising the following steps:

[0011] Acquire historical multimodal data generated within the runtime fault interval of the cloud-native system;

[0012] The Metric data, Log data, and Trace data in the historical multimodal data are serialized to obtain Metric serialized data, Log serialized data, and Trace serialized data, respectively.

[0013] Select service instances and APIs as nodes of the hypergraph, and obtain node features based on the metric serialized data, log serialized data, and trace serialized data; construct the hyperedges of the hypergraph from the perspectives of physical, logical, and interactive aspects based on service instances, APIs, k8s nodes, and services, and form a multimodal hypergraph by the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph;

[0014] The multimodal hypergraph is input into a multidimensional root cause localization model based on a hypergraph neural network and a fully connected neural network to train the multidimensional root cause localization model and obtain a trained multidimensional root cause localization model.

[0015] The trained multi-dimensional root cause localization model is deployed in the cloud-native system. When a new fault occurs in the cloud-native system, it is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the new fault time interval to obtain the multi-dimensional root cause.

[0016] In one embodiment of the present invention, the metric data, log data, and trace data in the historical multimodal data are respectively serialized to obtain metric serialized data, log serialized data, and trace serialized data, including:

[0017] The metric data is normalized and regularized sequentially, and an attention mechanism is used to assign weights to the regularized data to obtain the metric serialized data.

[0018] The template of the Log data is extracted using the Drain algorithm, and the extracted data is semantically encoded using the BERT model. The attention mechanism is used to assign weights to the semantically encoded data to obtain the Log serialized data.

[0019] Key information is extracted from the Trace data, and the key information is then normalized and regularized in sequence. An attention mechanism is used to assign weights to the regularized data to obtain the Trace serialized data.

[0020] In one embodiment of the present invention, obtaining node features based on the Metric serialized data, Log serialized data, and Trace serialized data includes:

[0021] The service instance node features are obtained by concatenating the metric serialized data, log serialized data, and trace serialized data.

[0022] The metric serialized data is used as an API node feature.

[0023] In one embodiment of the present invention, the hyperedge includes a deployment hyperedge representing the deployment relationship between a service instance and a k8s node, a dependency hyperedge representing the dependency relationship between a service and a service instance, a control hyperedge representing the control relationship between a service instance and an API, a bridging hyperedge representing the bridging relationship between APIs, and a dependency hyperedge representing the dependency relationship implied in the frequent itemset mined from the trace data.

[0024] In one embodiment of the present invention, the multi-dimensional root cause localization model includes a hypergraph neural network and a fully connected neural network connected in sequence, wherein,

[0025] The hypergraph neural network includes several convolutional layers connected in sequence;

[0026] The fully connected neural network includes a multilayer perceptron.

[0027] In one embodiment of the present invention, the multimodal hypergraph is input into a multidimensional root cause localization model based on a hypergraph neural network and a fully connected neural network, and the multidimensional root cause localization model is trained to obtain a trained multidimensional root cause localization model, including:

[0028] The multimodal hypergraph is input into the hypergraph neural network, and hyperedge features and node features are obtained by performing multi-layer convolution through several convolutional layers. The weights of different hyperedges are adjusted using an adaptive weight mechanism, and the hyperedge features output by the last convolutional layer are used as the input of the multilayer perceptron.

[0029] Using a multilayer perceptron, the hyperedge feature input is mapped to the category space to generate a classification score matrix, and the classification score matrix is ​​converted into a probability distribution to obtain the category probability matrix of the hyperedge.

[0030] The loss function is used to calculate the loss between the probability of each class in the class probability matrix and the true label, and backpropagation is performed to update the parameters of the multidimensional root cause localization model. After training, the trained multidimensional root cause localization model is obtained.

[0031] In one embodiment of the present invention, the node features after convolution of the i-th convolutional layer in the hypergraph neural network are:

[0032]

[0033] The hyperedge features after the convolution of the i-th convolutional layer are:

[0034]

[0035] The hyperedge features output by the last convolutional layer are:

[0036] Y′=Multi-ConV-Layer(X t Y t )

[0037] Among them, X i and Y i Let Y' represent the node features and hyperedge features after the i-th convolutional layer, respectively; let Y' represent the hyperedge features output by the last convolutional layer; let σ represent the non-linear activation function; and let D... e -1Let H be the inverse of the diagonal matrix representing the degree of the hyperedge, H be the incidence matrix, W be the weight of the hyperedge, and D be the weight of the hyperedge. v The diagonal matrix representing node degree, Θ representing the parameters that the hypergraph neural network can learn during training, Multi-ConV-Laye() representing the hyperedge features obtained after multiple convolutions, and X t Y represents the initial node features. t This represents the initial hyperedge features;

[0038] In the fully connected neural network, the class probability matrix of the hyperedge is:

[0039] P = Softmax(h)

[0040] h = ReLU(Z)

[0041] Z = W m Y′+b

[0042] Where P is the class probability matrix of hyperedges, with dimensions M*K, where M is the number of hyperedges and K is the number of root cause classes. Each row of P... i Let represent the probability that hyperedge i is the root cause, h be the output of the ReLU activation function after processing the classification score matrix Z, Z be the classification score matrix output by the fully connected layer of the multilayer perceptron, and W be the value of W. m Here, b represents the parameters learned in the MLP, and b is the bias term.

[0043] In one embodiment of the present invention, the loss function is:

[0044]

[0045] in, For the one-hot encoding of the true label of superedge i, P (i,k) Let M be the predicted probability that hyperedge i belongs to category k, M be the number of hyperedges, and K be the number of root cause categories.

[0046] In one embodiment of the present invention, the trained multi-dimensional root cause localization model is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the new fault time interval when a new fault occurs in a cloud-native system, to obtain multi-dimensional root causes, including:

[0047] Acquire multimodal operation and maintenance data within the time interval between new faults in cloud-native systems;

[0048] The Metric data, Log data, and Trace data in the multimodal operation and maintenance data are serialized to obtain Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval.

[0049] Select service instances and APIs as nodes in the new hypergraph, and obtain new node characteristics based on the Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval;

[0050] Based on service instances, APIs, Kubernetes nodes, and services, new hyper-edges of a new hypergraph are constructed from physical, logical, and interactive perspectives. A new multimodal hypergraph is formed by the nodes of the new hypergraph, the new node features, and the hyper-edges of the new hypergraph.

[0051] The trained multidimensional root cause localization model is used to extract features from the new multimodal hypergraph to obtain multidimensional root causes.

[0052] Another embodiment of the present invention provides a multi-dimensional root cause localization device based on multimodal learning, comprising:

[0053] The multimodal data acquisition module is used to acquire multimodal operation and maintenance data generated during the fault interval of the cloud-native system during runtime;

[0054] The multimodal data vectorization module is used to serialize the Metric data, Log data, and Trace data in the multimodal operation and maintenance data to obtain Metric serialized data, Log serialized data, and Trace serialized data respectively.

[0055] The multimodal data hypergraph construction module is used to select service instances and APIs as nodes of the hypergraph, and obtain node features based on the metric serialized data, log serialized data, and trace serialized data; it constructs the hyperedges of the hypergraph from the perspectives of physical, logical, and interactive aspects based on the service instances, APIs, k8s nodes, and services, and the multimodal hypergraph is formed by the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph.

[0056] The root cause localization module is used to extract features from the multimodal hypergraph using a trained multidimensional root cause localization model to obtain multidimensional root causes.

[0057] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0058] The method of this invention first serializes multimodal data, then constructs nodes and hyperedges to form a hypergraph, and uses the serialized data as node features. The constructed hypergraph is then used as input to a hypergraph neural network to train a root cause localization model. In online use, multimodal operation and maintenance data within the fault time interval is serialized and input into the hypergraph neural network model. Based on the hyperedge representation, multidimensional root causes are output. This method utilizes hyperedge classification to achieve root cause localization, realizing accurate and multidimensional localization of software runtime faults, improving the stability and reliability of cloud-native systems. Simultaneously, engineers can analyze multidimensional root causes to reduce fault handling time and significantly reduce operation and maintenance time, solving problems such as insufficient single-modal data modeling, difficulty in capturing complex relationships, and dynamic and heterogeneous characteristics. Attached Figure Description

[0059] Figure 1 A flowchart illustrating a multi-dimensional root cause localization method based on multimodal learning, provided in an embodiment of the present invention;

[0060] Figure 2 A flowchart illustrating another multi-dimensional root cause localization method based on multimodal learning provided in an embodiment of the present invention;

[0061] Figure 3 This is a schematic diagram of a multimodal hypergraph provided in an embodiment of the present invention. Detailed Implementation

[0062] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0063] Example 1

[0064] This embodiment provides a multi-dimensional root cause localization method and apparatus based on multimodal learning, which relates to the fields of intelligent operation and maintenance of cloud-native systems and artificial intelligence, data mining and other technical fields. It is applicable to online cloud-native system operation tasks, completes the analysis and application of multimodal operation and maintenance data and the modeling of complex interaction relationships, realizes accurate and multi-dimensional localization of software runtime faults, and improves the stability and reliability of cloud-native systems.

[0065] Please see Figure 1 and Figure 2 , Figure 1 This is a flowchart illustrating a multi-dimensional root cause localization method based on multimodal learning, provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating another multi-dimensional root cause localization method based on multimodal learning provided in an embodiment of the present invention.

[0066] The multi-dimensional root cause localization method in this embodiment includes several parts: multimodal data vectorization, multimodal data hypergraph construction, and training a multi-dimensional root cause localization model based on hypergraph neural networks and fully connected neural networks. The trained multi-dimensional root cause localization model is used for online root cause localization. The specific steps are as follows:

[0067] S1. Obtain historical multimodal data generated during the runtime fault interval of the cloud-native system.

[0068] Specifically, historical multimodal data generated during the runtime fault intervals of cloud-native systems are collected and root causes are labeled to obtain a multimodal dataset for training a multidimensional root cause localization model.

[0069] S2. Serialize the Metric data, Log data, and Trace data in the historical multimodal data to obtain Metric serialized data, Log serialized data, and Trace serialized data respectively.

[0070] Specifically, cloud-native systems generate massive amounts of multimodal operational data during operation, including three types: metric data, log data, and trace data. These three types of data are crucial for monitoring and diagnosing system faults. However, these three types of data differ significantly in form and structure, making unified processing difficult. Metric data reflects system performance and resource usage, and is presented as serialized data. Log data is event or status information recorded during system or application runtime, typically stored in text format, used to record detailed operation and error information. Trace data records the call relationships between multiple services, with each request having a unique Trace ID for easy tracing. Serialization methods can transform these three types of data into a unified format, facilitating subsequent unified modeling. The specific steps for serialization processing are as follows:

[0071] S21. After normalizing and regularizing the metric data in sequence, the metric data features can be obtained. Then, an attention mechanism is used to assign weights to the regularized data to highlight the metric data that makes an important contribution, thus obtaining the metric serialized data.

[0072] The S22 and Drain algorithms are widely used to extract Log data templates. In this embodiment, the Drain algorithm is used to extract Log data templates, and the BERT model is used to perform semantic encoding on the extracted data. Then, an attention mechanism is used to assign weights to the semantically encoded data to highlight the Log data that makes an important contribution, thus obtaining Log serialized data.

[0073] S23. Extract key information such as request failure rate and response latency from the Trace data, treat this key information as a time series, and then normalize and regularize the key information in sequence. Use the attention mechanism to assign weights to the regularized data to obtain Trace serialized data.

[0074] This embodiment processes and models multimodal data in a unified manner, which can make full use of operation and maintenance data.

[0075] S3. Select service instances and APIs as nodes of the hypergraph, and obtain node features based on metric serialized data, log serialized data, and trace serialized data; construct the hyperedges of the hypergraph from the perspectives of physical, logical, and interactive aspects based on service instances, APIs, k8s nodes, and services, and form a multimodal hypergraph from the nodes, node features, and hyperedges of the hypergraph.

[0076] Hypergraph neural networks offer significant advantages over conventional graph neural networks in modeling complex relationships. To represent the complex relationships within cloud-native systems, this embodiment uses a hypergraph to construct the connections between Kubernetes nodes, services, service instances, and APIs. This embodiment parses historical multimodal data, divides the serialized data according to service instances and APIs as feature representations of nodes, and constructs five types of hyperedges, encompassing the connections between various components within the cloud-native system.

[0077] First, select and build the nodes.

[0078] Specifically, service instances and APIs are chosen as nodes in the hypergraph because faults often revolve around these two types of elements. Therefore, features are constructed separately for service instances and APIs. For service instances, Metric, Log, and Trace data within the fault interval are used as raw features. After serialization of each data type, the serialized Metric, Log, and Trace data are concatenated to obtain the service instance node features. For API nodes, Metric data is used as the raw feature, and after serialization, the serialized Metric data is used as the API node features.

[0079] Then, superedge selection and construction are performed.

[0080] Hyperedges play a crucial role in the hypergraph, and their selection determines the representation of nodes. To accurately model the complex node relationships in cloud-native systems, this step meticulously designed five types of hyperedges, constructed from physical, logical, and interactive perspectives to comprehensively describe the diverse and complex component relationships within cloud-native systems. Hyperedges are shown in Table 1 below: deployment hyperedges, dependency hyperedges, control hyperedges, bridging hyperedges, and dependency hyperedges. Deployment hyperedges represent the deployment relationship between service instances and Kubernetes nodes; dependency hyperedges represent the dependency relationship between services and service instances; control hyperedges represent the control relationship between service instances and APIs; bridging hyperedges represent the bridging relationship between APIs; and dependency hyperedges represent the dependency relationships implied in frequent itemsets mined from trace data.

[0081] Furthermore, this embodiment supports adding new hyperedge types, enabling dynamic expansion. That is, in addition to the five types of hyperedges mentioned above, engineers can set new hyperedges based on actual needs and expert experience to build comprehensive relationships.

[0082] Table 1

[0083]

[0084]

[0085] Please see Figure 3 , Figure 3 This is a schematic diagram of a multimodal hypergraph provided in an embodiment of the present invention. Figure 3 In the left image, the vertical axis represents nodes, the horizontal axis represents hyperedges, and the number 1 indicates that the node is inside the hyperedge. Figure 3 In the right-hand diagram, circles represent nodes, and triangles represent hyperedges. Specifically, a multimodal hypergraph G(V, E, W) is formed by the nodes of the hypergraph, the node features, and the hyperedges of the hypergraph, where V, E, and W represent the set of nodes, the set of hyperedges, and the set of edge weights, respectively. Specifically, by aggregating multimodal data features, the system state within a given time window t is formalized as a hypergraph G = (V, E, H), where the node set V = {v_i} contains entities such as service instances and API endpoints, and the hyperedge set E = {e_j}. The association matrix H ∈ {0,1}^{|V|×|E|} defines the membership relationship between nodes and hyperedges; when H_{i,j} = 1, it indicates that node v_i belongs to hyperedge e_j.

[0086] This embodiment proposes five types of hyperedge construction methods, which can comprehensively model the relationships between various components of the system.

[0087] S4. Input the multimodal hypergraph into the multidimensional root cause localization model based on the hypergraph neural network and the fully connected neural network, train the multidimensional root cause localization model, and obtain the trained multidimensional root cause localization model.

[0088] This embodiment uses a hypergraph to train a multi-dimensional root cause localization model based on a hypergraph neural network and a fully connected neural network. The hypergraph neural network includes several sequentially connected convolutional layers, and the fully connected neural network includes a multilayer perceptron (MLP). Hyperedges are used as root causes, with fault labels on the hyperedges. Hyperedges of different dimensions represent root causes of different dimensions. The input form of the hypergraph is G = (V, E, H). The spatial convolution method proposed in the general hypergraph neural network HGNN+ is used to capture high-order correlation patterns between components. Finally, the MLP is used to map the hyperedge representations to the category space, achieving multi-dimensional root cause localization.

[0089] The specific process of training a multidimensional root cause localization model includes the following steps:

[0090] S41. Input the multimodal hypergraph into the hypergraph neural network, obtain hyperedge features and node features through multi-layer convolution by several convolutional layers, and adjust the weights of different hyperedges using an adaptive weight mechanism. Use the hyperedge features output by the last convolutional layer as the input of the multilayer perceptron.

[0091] Specifically, HGNN+ uses a two-stage spatial convolution method to obtain hyperedge features and node features respectively. To capture higher-order relationships between components, this embodiment uses deep networks to model the complex relationships of the microservice system through multi-layer stacking. First, the input node features X... t The MLP has dimensions N*C, where N is the number of nodes in the node set V and C is the feature dimension. The hypergraph structure is represented by the association matrix H, with dimensions N*M, where M is the number of hyperedges. The initial feature of each hyperedge is Y. Then, hyperedge and node features are obtained through multiple convolutional layers (e.g., 2-3 layers), and an adaptive weighting mechanism is used to dynamically adjust the importance of different hyperedges using learnable hyperedge weights We. Finally, the hyperedge feature Y′ output from the last convolutional layer is selected as the input to the MLP.

[0092] Specifically, in a hypergraph neural network, the node features after the convolution of the i-th convolutional layer are:

[0093]

[0094] The hyperedge features after the convolution of the i-th convolutional layer are:

[0095]

[0096] The hyperedge features output by the last convolutional layer are:

[0097] Y′=Multi-ConV-Layer(X t Y t )

[0098] Among them, Xi and Y i Let Y and Y' represent the node features and hyperedge features after the i-th convolutional layer, respectively, Y′ represent the hyperedge features output by the last convolutional layer, and σ represent the non-linear activation function. Let H be the inverse of the diagonal matrix representing the degree of the hyperedge, H be the incidence matrix, W be the weight of the hyperedge, and D be the weight of the hyperedge. v The diagonal matrix representing node degree, Θ representing the parameters that the hypergraph neural network can learn during training, Multi-ConV-Laye() representing the hyperedge features obtained after multiple convolutions, and X t Y represents the initial node features. t This represents the initial hyperedge feature.

[0099] S42. Using a multilayer perceptron, the hyperedge feature input is mapped to the category space to generate a classification score matrix, and the classification score matrix is ​​converted into a probability distribution to obtain the category probability matrix of the hyperedge.

[0100] Specifically, a multilayer perceptron (MLP) is chosen to achieve multi-dimensional root cause localization, with the final hyperedge feature Y′ serving as the input to the root cause localization model. First, the MLP maps the features to hidden layers, then enhances expressive power through a non-linear activation function, and finally maps the hidden layer output to the class space through a fully connected layer, generating a classification score matrix Z.

[0101] Z = W m Y′+b

[0102] Among them, W m Here, b represents the parameters learned in the MLP, and b is the bias term.

[0103] Next, the classification score matrix Z is further processed using the ReLU (Rectified Linear Unit) activation function. ReLU is a commonly used activation function that introduces non-linear characteristics into the neural network, enhancing the model's expressive power. The matrix after ReLU activation is as follows:

[0104] h = ReLU(Z)

[0105] Where h is the output of the ReLU activation function after processing the classification score matrix Z.

[0106] Furthermore, after activation function processing, softmax is used for normalization to convert the classification scores into a probability distribution, resulting in the class probability matrix of the hyperedge:

[0107] P = Softmax(h)

[0108] Where P is the class probability matrix of the hyperedge, with dimensions M*K, and each row of P iLet M represent the probability that hyperedge i is the root cause, M be the number of hyperedges, and K be the number of root cause categories.

[0109] S43. Calculate the loss between the probability of each class and the true label in the class probability matrix using the loss function, and perform backpropagation to update the parameters of the multidimensional root cause localization model until the iteration ends, thus obtaining the trained multidimensional root cause localization model.

[0110] Specifically, the loss function used is the cross-entropy loss function. Assume the true label of the hyperedge is Y. true (With dimension M*1, where each element is the class index of the hyperedge), the loss function can be defined as:

[0111]

[0112] in, For the one-hot encoding of the true label of superedge i, P (i,k) Let be the predicted probability that superedge i belongs to category k.

[0113] Specifically, after obtaining the class probability matrix of the hyperedge through forward propagation, the loss is calculated using the loss function, and then backpropagation and parameter updates are performed to train the multidimensional root cause localization model. After training, the trained multidimensional root cause localization model is obtained.

[0114] This embodiment uses hyperedge classification to train a multi-dimensional root cause localization model to achieve root cause localization. This enables multi-dimensional root cause localization, effectively improves the accuracy of root cause localization, and significantly reduces operation and maintenance time.

[0115] The method in this embodiment first serializes and fuses multimodal data, and then weights it to obtain sequence data of different importance. Next, it constructs nodes and hyperedges to form a hypergraph, using the serialized data as node features. The constructed hypergraph is then used as input to a hypergraph neural network to train a root cause localization model. In online use, multimodal operation and maintenance data within the fault time interval is serialized and input into the hypergraph neural network model. Based on the hyperedge representation, multidimensional root causes are output. This method utilizes hyperedge features for downstream task training to achieve root cause localization, realizing accurate and multidimensional fault localization during software runtime. This improves the stability and reliability of cloud-native systems. Simultaneously, engineers can analyze multidimensional root causes to reduce fault handling time and significantly reduce operation and maintenance time, solving problems such as insufficient single-modal data modeling, difficulty in capturing complex relationships, and dynamic and heterogeneous characteristics.

[0116] Furthermore, the trained multi-dimensional root cause localization model is deployed in a cloud-native system to perform online root cause localization whenever a new fault occurs. Online root cause localization includes the following steps:

[0117] S10. Obtain multimodal operation and maintenance data within the time interval between new faults in cloud-native systems;

[0118] S20. Perform serialization processing on the Metric data, Log data, and Trace data in the multimodal operation and maintenance data to obtain the Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval.

[0119] S30. Select service instances and APIs as nodes in the new hypergraph, and obtain new node characteristics based on the Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval.

[0120] S40. Based on service instances, APIs, Kubernetes nodes and services, construct the hyperedges of a new hypergraph from physical, logical and interactive perspectives. The new hypergraph is formed by the nodes of the new hypergraph, the new node features and the hyperedges of the new hypergraph.

[0121] S50. Use the trained multidimensional root cause localization model to extract features from the new multimodal hypergraph to obtain multidimensional root causes represented by hyperedge features, which can be used for subsequent root cause localization.

[0122] For details on the specific implementation methods of steps S10 to S50, please refer to the above description, which will not be repeated here.

[0123] This embodiment provides engineers with a root cause hyperedge that covers multiple dimensions of the system, thereby enabling accurate and efficient fault root cause localization.

[0124] This invention also provides a multi-dimensional root cause localization device based on multimodal learning, comprising: a multimodal data acquisition module for acquiring multimodal operation and maintenance data generated within the fault interval during the operation of a cloud-native system; a multimodal data vectorization module for serializing the Metric data, Log data, and Trace data in the multimodal operation and maintenance data to obtain Metric serialized data, Log serialized data, and Trace serialized data; a multimodal data hypergraph construction module for selecting service instances and APIs as nodes of the hypergraph and obtaining node features based on the Metric serialized data, Log serialized data, and Trace serialized data; constructing hyperedges of the hypergraph from physical, logical, and interactive perspectives based on service instances, APIs, k8s nodes, and services, forming a multimodal hypergraph from the nodes, node features, and hyperedges of the hypergraph; and a root cause localization module for extracting features from the multimodal hypergraph using a trained multi-dimensional root cause localization model to obtain multi-dimensional root causes.

[0125] For details on the implementation of the multi-dimensional root cause localization device based on multimodal learning, please refer to the above description, which will not be repeated here.

[0126] The multi-dimensional root cause localization device and method based on multimodal learning provided in this embodiment employs hypergraph neural network technology. It utilizes multimodal data generated when a cloud-native system experiences a failure, serializing the multimodal data into a unified pattern. This sequenced data represents the features of nodes in the graph, describing the node's state within the failure interval. By collecting historical failure data, the complex relationships between system components are modeled using a hypergraph neural network, and hypergraph convolution is selected to train the hypergraph neural network model. In online use, the serialized multimodal data within the failure time interval is input into the hypergraph neural network model. Based on the hyperedge representation, multi-dimensional root causes are output. Engineers can analyze these multi-dimensional root causes to reduce failure handling time. This solves the problem that existing technologies do not fully consider the complex relationships between system components, resulting in incomplete and distorted software modeling and inaccurate root causes.

[0127] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A multi-dimensional root cause localization method based on multimodal learning, characterized in that, Including the following steps: Acquire historical multimodal data generated within the runtime fault interval of the cloud-native system; The historical multimodal data, including metric data, log data, and trace data, are serialized to obtain metric serialized data, log serialized data, and trace serialized data, respectively. This includes: normalizing and regularizing the metric data sequentially, and assigning weights to the regularized data using an attention mechanism to obtain the metric serialized data; extracting the template from the log data using the Drain algorithm, semantically encoding the extracted data using the BERT model, and assigning weights to the semantically encoded data using an attention mechanism to obtain the log serialized data; and extracting key information from the trace data, normalizing and regularizing the key information sequentially, and assigning weights to the regularized data using an attention mechanism to obtain the trace serialized data. Service instances and APIs are selected as nodes of the hypergraph, and node features are obtained based on the metric serialized data, log serialized data, and trace serialized data. Hyperedges of the hypergraph are constructed from physical, logical, and interactive perspectives based on service instances, APIs, Kubernetes nodes, and services. A multimodal hypergraph is formed by the nodes, node features, and hyperedges of the hypergraph. The hyperedges include deployment hyperedges representing the deployment relationship between service instances and Kubernetes nodes, dependency hyperedges representing the subordinate relationship between services and service instances, control hyperedges representing the control relationship between service instances and APIs, bridging hyperedges representing the bridging relationship between APIs, and dependency hyperedges representing the dependency relationship implied in the frequent itemsets mined from the trace data. The multimodal hypergraph is input into the multidimensional root cause localization model to train the multidimensional root cause localization model, resulting in a trained multidimensional root cause localization model. The multidimensional root cause localization model includes a hypergraph neural network and a fully connected neural network connected in sequence. The hypergraph neural network includes several convolutional layers connected in sequence, with the multimodal hypergraph as input and hyperedge features representing different root causes as output. The fully connected neural network includes a multilayer perceptron, with hyperedge features representing different root causes as input and hyperedge class probability matrices as output. The trained multi-dimensional root cause localization model is deployed in the cloud-native system. When a new fault occurs in the cloud-native system, it is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the new fault time interval to obtain the multi-dimensional root cause.

2. The multi-dimensional root cause localization method based on multimodal learning according to claim 1, characterized in that, Node features are obtained based on the metric serialized data, log serialized data, and trace serialized data, including: The service instance node features are obtained by concatenating the metric serialized data, log serialized data, and trace serialized data. The metric serialized data is used as an API node feature.

3. The multi-dimensional root cause localization method based on multimodal learning according to claim 1, characterized in that, The multimodal hypergraph is input into a multidimensional root cause localization model based on a hypergraph neural network and a fully connected neural network. The multidimensional root cause localization model is trained to obtain a trained multidimensional root cause localization model, including: The multimodal hypergraph is input into the hypergraph neural network, and hyperedge features and node features are obtained by performing multi-layer convolution through several convolutional layers. The weights of different hyperedges are adjusted using an adaptive weight mechanism, and the hyperedge features output by the last convolutional layer are used as the input of the multilayer perceptron. Using a multilayer perceptron, the hyperedge feature input is mapped to the category space to generate a classification score matrix, and the classification score matrix is ​​converted into a probability distribution to obtain the category probability matrix of the hyperedge. The loss function is used to calculate the loss between the probability of each class in the class probability matrix and the true label, and backpropagation is performed to update the parameters of the multidimensional root cause localization model. After training, the trained multidimensional root cause localization model is obtained.

4. The multi-dimensional root cause localization method based on multimodal learning according to claim 3, characterized in that, In the hypergraph neural network, the first... i The node features after layer convolution are: No. i The hyperedge features after layer convolution are: The hyperedge features output by the last convolutional layer are: in, and They represent the first i Node features and hyperedge features after convolution. This represents the hyperedge feature output by the last convolutional layer. Represents a non-linear activation function. The inverse of the diagonal matrix representing the degree of the hyperedge. Represents the correlation matrix. Indicates the weight of the superedge. A diagonal matrix representing the degree of nodes. This represents the parameters that the hypergraph neural network can learn during training. This indicates that super-edge features are obtained after multiple convolutions. This represents the initial node characteristics. This represents the initial hyperedge features; In the fully connected neural network, the class probability matrix of the hyperedge is: in, It is the class probability matrix of the hyperedge, with dimensions of . , The number of superedges. For each root cause category, there is a number of categories. Indicates the superedge i The probability of being the root cause. The ReLU activation function is applied to the classification score matrix. The processed output, This is the classification score matrix output by the fully connected layer of the multilayer perceptron. These are the parameters learned in the MLP. This is a bias term.

5. The multi-dimensional root cause localization method based on multimodal learning according to claim 3, characterized in that, The loss function is: in, For super-edge i One-hot encoding of the real label, For super-edge Category The predicted probability, The number of superedges. This represents the number of root cause categories.

6. The multi-dimensional root cause localization method based on multimodal learning according to claim 1, characterized in that, The trained multi-dimensional root cause localization model is used to extract features from a new multi-modal hypergraph constructed by serializing multi-modal operation and maintenance data within the new fault time interval when a new fault occurs in the cloud-native system, thereby obtaining multi-dimensional root causes, including: Acquire multimodal operation and maintenance data within the time interval between new faults in cloud-native systems; The Metric data, Log data, and Trace data in the multimodal operation and maintenance data are serialized to obtain Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval. Select service instances and APIs as nodes in the new hypergraph, and obtain new node characteristics based on the Metric serialized data, Log serialized data, and Trace serialized data within the new fault time interval; Based on service instances, APIs, Kubernetes nodes, and services, new hyper-edges of a new hypergraph are constructed from physical, logical, and interactive perspectives. A new multimodal hypergraph is formed by the nodes of the new hypergraph, the new node features, and the hyper-edges of the new hypergraph. The trained multidimensional root cause localization model is used to extract features from the new multimodal hypergraph to obtain multidimensional root causes.

7. A multi-dimensional root cause localization device based on multimodal learning, characterized in that, To implement the multi-dimensional root cause localization method based on multimodal learning as described in any one of claims 1-6, the method comprises: The multimodal data acquisition module is used to acquire multimodal operation and maintenance data generated during the fault interval of the cloud-native system during runtime; The multimodal data vectorization module is used to serialize the Metric data, Log data, and Trace data in the multimodal operation and maintenance data to obtain Metric serialized data, Log serialized data, and Trace serialized data respectively. A multimodal data hypergraph construction module is used to select service instances and APIs as nodes of the hypergraph, and obtain node features based on the metric serialized data, log serialized data, and trace serialized data; construct hyperedges of the hypergraph from physical, logical, and interactive perspectives based on service instances, APIs, Kubernetes nodes, and services, and form a multimodal hypergraph from the nodes, node features, and hyperedges of the hypergraph; wherein, the hyperedges include deployment hyperedges representing the deployment relationship between service instances and Kubernetes nodes, dependency hyperedges representing the subordinate relationship between services and service instances, control hyperedges representing the control relationship between service instances and APIs, bridging hyperedges representing the bridging relationship between APIs, and dependency hyperedges representing the dependency relationship implied in the frequent itemsets mined from the trace data; The root cause localization module is used to extract features from the multimodal hypergraph using a trained multidimensional root cause localization model to obtain multidimensional root causes.

Images