Microservice fault location method and equipment based on causal inference and knowledge graph

Abstract

The present invention relates to the field of computers, and in particular to a method and device for locating microservice faults based on causal inference and knowledge graphs. The method first collects the original call links, multi-dimensional time series indicators and log data of the microservice system, uses a partial correlation algorithm to analyze the correlation of microservice indicators, then uses a structural causal model to infer the causal relationship of indicators, and then uses the principal component analysis method to map the causal relationship of indicators to specific service calls to construct service dependencies. Then, a knowledge graph ontology is defined, and based on the indicator causal relationship and service dependency relationship, a fault dependency graph is constructed and integrated with the call link graph to form a complete multi-level impact fault dependency knowledge graph. Finally, the graph is stored in a graph database, and the abnormal service node is used as the starting point. After abnormal detection, random walk and calculation of node scores, a candidate set of root causes of the fault is output. The present invention helps to improve the efficiency and accuracy of fault location and ensure the stable operation of the microservice system.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a microservice fault location method based on causal inference and knowledge graph, and a corresponding computer program product and computer device. Background Art

[0002] With the rapid development of information technology, microservices architecture has been widely adopted in cloud computing environments. By decomposing complex business systems into multiple independent microservices, it achieves high system availability and scalability. However, the complexity of microservices architectures also presents new challenges, particularly in locating business application faults. Microservices systems typically consist of a large number of independent services that collaborate with each other through complex call chains, forming a massive distributed system. When a system failure occurs, traditional troubleshooting methods often struggle to quickly and accurately locate the root cause, resulting in extended system recovery times and impacted business continuity. Specifically, fault locating in a microservices architecture faces multiple challenges: First, the call relationships between microservices are complex and dynamically changing. A service failure can propagate to other services through the call chain, making it difficult to trace the fault propagation path. Second, the volume and diversity of logs, performance metrics, and call chain data generated by microservices systems make it difficult for traditional analysis methods to effectively process and mine the fault information from this data. Finally, microservice failures manifest in diverse ways and are influenced by multiple factors, making fault characteristics unclear and difficult to directly identify. Summary of the Invention

[0003] In order to solve the problem that microservice failures have diverse manifestations and are difficult to identify and locate, the present invention provides a microservice fault location method based on causal inference and knowledge graph, and its corresponding computer program product and computer device.

[0004] The technical solutions provided by the present invention are as follows:

[0005] A microservice fault location method based on causal inference and knowledge graph includes the following steps:

[0006] Construct a fault impact knowledge graph that characterizes the fault impact relationships within microservices. This graph is divided into three layers: the time series measurement layer, the indicator causal layer, and the service interaction layer.

[0007] Distributed tracing tools are used to capture call link data from microservice systems in real time, recording the call relationships, response times, and status codes between service nodes. The Prometheus monitoring system is used to collect multi-dimensional time series metrics for each service. The service interaction layer is dynamically updated based on the collected call link data, and invalid edges are deleted to obtain a service call relationship graph. A sliding window method is used to sample the monitoring values ​​of time series metrics. Error analysis is performed on the collected data to identify and delete abnormal nodes in the time series metric layer and the causal layer.

[0008] In the indicator causal layer, we model the causal relationships of each node, use partial correlation analysis to identify pseudo-correlations between indicators, generate an indicator dependency graph, and then use causal inference to construct fault dependency graphs for indicators at different levels. This results in an updated fault impact knowledge graph. The edges of the fault dependency graph are used to represent the abnormal propagation paths of microservices.

[0009] The updated fault impact knowledge graph is imported into the Neo4j database. Then, starting from the abnormal service node, a random walk with restart is performed in the fault impact knowledge graph to locate the fault.

[0010] As a further improvement of the present invention, the method for identifying abnormal nodes in the time series measurement layer and the indicator causal layer is as follows:

[0011] For any multidimensional time series indicator I i , the following ARIMA model is used to generate its current forecast value :

[0012] ;

[0013] In the above formula, Respectively represent the 1st- p The autoregressive coefficient on the term; Respectively represent the 1st- p Moving average coefficient on the term; Represents multidimensional time series indicators I In the t- 1 to t-p The actual observation value of the time step; Respectively represent t- 1 to t-q The random error term of time steps; p and q Indicates the preset model order.

[0014] The actual value of each sampled data is calculated by the following formula and predicted value Deviation ratio , thus forming a historical deviation dataset ; n Indicates the number of elements in the historical deviation dataset;

[0015] .

[0016] Generate a cumulative distribution function based on the historical deviation data set and smooth it to obtain a continuous curve g ( z ), and calculate g ( z ) curvature K g ( z ):

[0017]

[0018] In the above formula, z represents the independent variable that represents the smooth curve corresponding to the cumulative distribution function.

[0019] Will g ( z ) is used as the point of maximum curvature in the deviation distribution to set the corresponding dynamic threshold z 0, and make the following judgment:

[0020] If the current , then determine the corresponding multi-dimensional time series index I i as abnormal indicators and remove them.

[0021] As a further improvement of the present invention, the values ​​of the model orders p and q are determined by the following AIC function:

[0022]

[0023] In the above formula, k is the total number of parameters, L is the model likelihood function value.

[0024] As a further improvement of the present invention, the method for constructing the indicator dependency graph is as follows:

[0025] For any component c i indicators , the following formula is used to perform Z-Score processing to eliminate the dimension difference:

[0026] .

[0027] In the above formula, 、 They are The mean and standard deviation of Represents the standardized index The value of .

[0028] For the i-th index in any component c , select a random component l The j indicators And components with calling relationships u The h indicators , and then use the following partial correlation algorithm to calculate the correlation between the indicators of each component :

[0029]

[0030] In the above formula, For indicators and indicators The correlation coefficient between For indicators and indicators The correlation coefficient between For indicators and indicators The correlation coefficient between .

[0031] when ,determination and If there is a direct association, the edge between the two in the completely directed graph is retained, otherwise the corresponding edge is retained, and the required indicator dependency graph is obtained.

[0032] As a further improvement of the present invention, the method for constructing the fault dependency graph is as follows:

[0033] For two related indicators in the indicator dependency graph and , with time lag The index value is used as the independent variable and the following regression equation is fitted:

[0034]

[0035] In the above formula, and are the estimated coefficients for each preset of the chain, ; is a time-varying error term.

[0036] Combined with dynamic adjustment Determine whether the test p value at time t is less than 0.05, if so, For the reason, As a result, add directed edges to the indicator dependency graph , the edge weight is set to .

[0037] Map the causal relationship of indicators to specific service calls to obtain the fault dependency graph.

[0038] As a further improvement of the present invention, the process of mapping the causal relationship of the indicators to the specific service calls to obtain the fault dependency graph includes:

[0039] 1. Standardize the m indicator matrices associated with service S, calculate the covariance matrix, extract the eigenvalues ​​and corresponding eigenvectors; and select the top E principal components whose cumulative contribution rate exceeds 85%.

[0040] 2. Combine the call link data and map the principal components to the service call relationship graph, including:

[0041] If service A calls service B, and A's indicator Affecting B's index through causal edges , then create cross-level edges in the knowledge graph and add attributes: {Indicator pair: , weight: }.

[0042] 3. Then, perform adaptive double threshold alignment on the subgraphs at multiple levels and calculate the nodes and Similarity :

[0043]

[0044] In the above formula, and Node and The set of neighbor nodes.

[0045] 4. Setting Benchmark Thresholds , calculate the node by the following formula and Dynamic adjustment offset :

[0046]

[0047] In the above formula, and They represent the order of the nodes respectively.

[0048] 5. Based on the similarity between any two nodes and preset baseline thresholds , make the following decisions:

[0049] like , then merge the two nodes; if in interval, the manual review process is triggered; otherwise, the and As a standalone node.

[0050] As a further improvement of the present invention, the process of implementing fault location by random walk includes:

[0051] Define the abnormal node To the cause node The initial transition probability By abnormal node and cause node Correlation coefficient Sure.

[0052] calculate The value of , and generates according to the preset rules arrive The random walk probability of In the preset rules, each step jumps back to the initial abnormal node with a probability of 15% , to avoid wandering away from key areas.

[0053] After traversing the entire fault impact knowledge graph, several nodes that are visited most frequently are identified as the root causes of the fault.

[0054] As a further improvement of the present invention, abnormal nodes and cause node Correlation coefficient The calculation formula is as follows:

[0055]

[0056] In the above formula, Representation node With node covariance of the corresponding indicators; and Node With node The standard deviation of the corresponding indicator.

[0057] The present invention also includes a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the aforementioned microservice fault location method based on causal inference and knowledge graph, and then locates the fault in the microservice based on the status data of the microservice operation process.

[0058] The present invention also includes a storage medium storing a computer program. When the computer program is executed by a processor, the steps of the aforementioned microservice fault location method based on causal inference and knowledge graph are implemented, and the fault in the microservice is located according to the status data of the microservice operation process.

[0059] The present invention also includes a computer device, which includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the computer program is executed by the processor, the steps of the aforementioned microservice fault location method based on causal inference and knowledge graph are implemented, and the fault in the microservice is located according to the status data of the microservice operation process.

[0060] The present invention has the following beneficial effects:

[0061] The microservice fault location method based on causal inference and knowledge graph provided by the present invention can significantly improve the efficiency and accuracy of microservice fault location through multi-source data fusion, multi-level causal relationship inference and multi-level knowledge graph construction. In this solution, the partial correlation algorithm and structural causal model are used to capture complex anomaly propagation paths, and the alignment conditions are dynamically adjusted in combination with adaptive entity alignment technology to ensure that fault propagation is fully reflected. Dynamic anomaly detection based on cumulative distribution function and curvature analysis can adaptively adjust the anomaly threshold and accurately identify abnormal mutations; finally, combined with a multi-level random walk algorithm, the correlation coefficient is used to optimize the transfer probability, avoid interference from low-correlation nodes, and quickly locate the root cause.

[0062] Furthermore, this invention combines fault location with the "index-free adjacency" feature of the Neo4j database, significantly improving the computational efficiency of large-scale knowledge graphs and enhancing system scalability. This makes the proposed solution superior to existing technologies in terms of comprehensiveness, efficiency, accuracy, and adaptability, providing strong support for microservice fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a flowchart of the steps of the microservice fault location method based on causal inference and knowledge graph provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this invention pertains. The terms used herein in the specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "or / and" as used herein includes any and all combinations of one or more of the associated listed items.

[0066] Example 1

[0067] This embodiment provides a microservice fault location method based on causal inference and knowledge graph. This method is used to combine multi-source data during the operation of the microservice system to locate faults that occur during the operation of the microservice, thereby assisting operation and maintenance personnel in code inspection and troubleshooting. The overall idea of ​​the solution provided by this embodiment is:

[0068] First, the original call links, multi-dimensional time series metrics, and log data of the microservice system are collected. A partial correlation algorithm is used to analyze the correlation of microservice metrics. A structural causal model is then used to infer causal relationships between metrics. Principal component analysis is then used to map these causal relationships to specific service calls and construct service dependencies. Second, the call links and preprocessed metric data are used as input to define a knowledge graph ontology. Knowledge is extracted to form triples representing the call relationships between nodes and stored in the graph. Based on the causal relationships between metrics and service dependencies, a fault dependency graph is constructed and merged with the call link graph to form a fault dependency knowledge graph encompassing a complete multi-level impact. Finally, the constructed fault dependency knowledge graph is stored in a graph database. Starting from the abnormal service node, a dynamic anomaly degree algorithm based on the cumulative distribution function is designed using knowledge graph metrics to detect abnormal metrics. The abnormal metrics are randomly walked through the graph, the number of node visits is calculated according to a rule, and a score is calculated by weighting multiple attributes to output a set of candidate root causes.

[0069] Specifically, if Figure 1 As shown, the microservice fault location method based on causal inference and knowledge graph provided in this embodiment includes the following steps:

[0070] S1: Construct a fault impact knowledge graph that characterizes the fault impact relationship within microservices; the fault impact knowledge graph is divided into three layers: time series measurement layer, indicator causal layer, and service interaction layer. Among them, the initialized time series measurement layer and indicator causal layer are based on multi-dimensional time series indicators. I i The initialized service interaction layer is a complete directed graph with components with independent functions as nodes.

[0071] S2: Use distributed tracing tools to capture the call chain data of the microservice system in real time, recording the call relationships, response times, and status codes between service nodes. Use the Prometheus monitoring system to collect multi-dimensional time series metrics for each service, including CPU utilization, memory usage, network throughput, request latency, and error rate. In this embodiment, when a microservice fails during operation, the values ​​of these multi-dimensional time series metrics typically change suddenly, providing discriminant information for fault identification.

[0072] S3: Dynamically update the service interaction layer based on the collected call link data, delete the invalid edges contained therein, and obtain the service call relationship graph.

[0073] S4: Preset a window width , a sliding window method is used to sample the monitoring value of each time series measurement indicator; error analysis is performed on the collected data; and abnormal nodes in the time series measurement layer and indicator causal layer are identified and deleted based on the analysis results.

[0074] In the solution of this embodiment, the method for identifying abnormal nodes is as follows:

[0075] S41: For any multidimensional time series indicator I i , the following ARIMA model is used to generate its current forecast value :

[0076] ;

[0077] In the above formula, Respectively represent the 1st- p The autoregressive coefficient on the term; Respectively represent the 1st- p Moving average coefficient on the term; Represents multidimensional time series indicators I In the t- 1 to t-p The actual observation value of the time step; Respectively represent t- 1 to t-q The random error term of time steps; p and q Indicates the preset model order.

[0078] The values ​​of model order p and q can be determined by the following AIC function:

[0079]

[0080] In the above formula, k is the total number of parameters, Lis the model likelihood function value.

[0081] S42: Calculate the actual value of each sampled data using the following formula and predicted value Deviation ratio , thus forming a historical deviation dataset ; n Indicates the number of elements in the historical deviation dataset;

[0082] .

[0083] S43: Generate a cumulative distribution function based on the historical deviation data set and smooth it to obtain a continuous curve g ( z ), and calculate g ( z ) curvature K g ( z ):

[0084] .

[0085] In the above formula, z represents the independent variable that represents the smooth curve corresponding to the cumulative distribution function.

[0086] S44: g ( z ) is used as the point of maximum curvature in the deviation distribution to set the corresponding dynamic threshold z 0, and make the following judgment:

[0087] If the current , then determine the corresponding multidimensional time series index I i as abnormal indicators and remove them.

[0088] S5: Model the causal relationships between indicators at each node in the indicator causal layer. Use partial correlation analysis to identify spurious correlations between indicators and generate an indicator dependency graph. Then, use causal inference to construct fault dependency graphs for indicators at different levels. This results in an updated fault impact knowledge graph. In the fault impact knowledge graph, the edges in the fault dependency graph represent the anomaly propagation paths of microservices.

[0089] In this embodiment, the method for constructing the indicator dependency graph includes the following steps:

[0090] (i) For any component c, i indicators , the following formula is used to perform Z-Score processing to eliminate the dimension difference:

[0091] .

[0092] In the above formula, 、 They are The mean and standard deviation of Represents the standardized index The value of .

[0093] (ii) For the i-th index in any component c , select a random component l The j indicators And components with calling relationships u The h indicators , and then use the following partial correlation algorithm to calculate the correlation between the indicators of each component :

[0094]

[0095] In the above formula, For indicators and indicators The correlation coefficient between For indicators and indicators The correlation coefficient between For indicators and indicators The correlation coefficient between .

[0096] (iii) Based on the calculated correlation between indicators , make the following decisions:

[0097] when ,determination and If there is a direct association, the edge between the two in the completely directed graph is retained, otherwise the corresponding edge is retained, and the required indicator dependency graph is obtained.

[0098] In this embodiment, the fault dependency graph is constructed as follows:

[0099] (1) For two related indicators in the indicator dependency graph and , with time lag The index value of is used as the independent variable and the following regression equation is fitted:

[0100]

[0101] In the above formula, and are the estimated coefficients for each preset of the chain, ; is a time-varying error term.

[0102] (2) Combined with dynamic adjustment Determine whether the test p value at time t is less than 0.05, if so, For the reason, As a result, add directed edges to the indicator dependency graph , the edge weight is set to .

[0103] (3) Map the causal relationship of the indicators to specific service calls to obtain the fault dependency graph. The process includes:

[0104] (3.1) Standardize the m indicator matrices associated with service S, calculate the covariance matrix, extract the eigenvalues ​​and corresponding eigenvectors; and select the top E principal components whose cumulative contribution rate exceeds 85%.

[0105] (3.2) Combine the call link data and map the principal components to the service call relationship graph, including:

[0106] If service A calls service B, and A's indicator Affecting B's index through causal edges , then create cross-level edges in the knowledge graph and add attributes: {Indicator pair: , weight: }.

[0107] (3.3) Then perform adaptive double threshold alignment on the subgraphs at multiple levels and calculate the nodes and Similarity :

[0108]

[0109] In the above formula, and Node and The set of neighbor nodes.

[0110] (3.4) Setting baseline thresholds , calculate the node by the following formula and Dynamic adjustment offset :

[0111]

[0112] In the above formula, and They represent the order of the nodes respectively.

[0113] (3.5) According to the similarity between any two nodes and preset baseline thresholds , make the following decisions:

[0114] like , then merge the two nodes; if in interval, the manual review process is triggered; otherwise, the and As a standalone node.

[0115] The aforementioned indicator dependency graph and fault dependency graph can reflect the causal relationship between different indicators in each service node during the operation of the microservice. Based on this, in the further optimized solution of this embodiment, in order to better characterize the causality between such service nodes, a Bayesian network can be constructed in the service interaction layer, and then the joint probability distribution in the Bayesian network is used to represent the probability relationship of all microservices in the network. There are n nodes in the Bayesian network, where Pa ( X i ) represents a node X i The parent node set of . According to the conditional independence assumption of the Bayesian network, the joint probability distribution of the entire network is expressed as:

[0116]

[0117] Given the parent node condition of node V, node V is independent of any other node condition except its parent node. It can be expressed as:

[0118]

[0119] Among them, V is a node in the Bayesian network, Pa (V) is the parent node set of node V, Q is the set of nodes except V and Pa Any other set of nodes other than (V).

[0120] Since the Bayesian network is constructed based on the previously inferred causal relationship of indicators, then for the node X i , its conditional probability Determined based on the cause-effect relationship of indicators.

[0121] S6: Import the updated fault impact knowledge graph into the Neo4j database. This embodiment uses the property graph-oriented Neo4j database for knowledge storage, primarily leveraging its "index-free adjacency" feature to improve knowledge management and computational efficiency. Node attributes in the updated fault impact knowledge graph include service name, component, and real-time status, while edge attributes include causal weight, call frequency, and timestamp range.

[0122] On this basis, this embodiment starts from the abnormal service node and performs a random walk with restart in the fault impact knowledge graph to achieve fault location. In detail, the fault location process includes the following steps:

[0123] (1) Define the abnormal node To the cause node The initial transition probability By abnormal node and cause node Correlation coefficient Sure.

[0124] (2) Calculate by the following formula The value of , and generates according to the preset rules arrive The random walk probability of In the preset rules, each step jumps back to the initial abnormal node with a probability of 15% , to avoid wandering away from key areas.

[0125] ,

[0126] In the above formula, Representation node With node covariance of the corresponding indicators; and Node With node The standard deviation of the corresponding indicator.

[0127] (3) After traversing the entire fault impact knowledge graph, the most frequently visited nodes are identified as the root causes of the fault.

[0128] Example 2

[0129] In order to better apply the microservice fault location method based on causal inference and knowledge graph provided in Example 1, this embodiment further provides a computer program product, a storage medium, and a corresponding computer device that can implement the above method.

[0130] Specifically, the computer program product provided in this embodiment includes a computer program. When the computer program is executed by a processor, it implements the steps of the aforementioned microservice fault location method based on causal inference and knowledge graph, and then locates the fault in the microservice based on the status data of the microservice operation process.

[0131] The storage medium provided in this embodiment stores a computer program. When the computer program is executed by a processor, the steps of the aforementioned microservice fault location method based on causal inference and knowledge graph are implemented, and the fault in the microservice is located according to the status data of the microservice operation process.

[0132] The computer device provided in this embodiment includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the computer program is executed by the processor, the steps of the aforementioned microservice fault location method based on causal inference and knowledge graph are implemented, and the fault in the microservice is located according to the status data of the microservice operation process.

[0133] In actual applications, this computer device can be an embedded device and deployed in various terminal devices to support data processing and interaction. It can also be used as a standalone computer device to support data processing needs in certain scenarios. This non-embedded computer device can be a laptop, tablet, desktop computer, or a medium or large computer device such as a rack-mounted server, blade server, tower server, or cabinet server (including standalone servers or server clusters consisting of multiple servers) capable of executing computer programs.

[0134] Specifically, the computer device of this embodiment includes at least, but is not limited to, a memory and a processor that are communicatively connected to each other via a system bus. In this embodiment, the memory (i.e., readable storage medium) includes flash memory, a hard disk, a multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, magnetic disks, optical disks, and the like. In some embodiments, the memory may be an internal storage unit of the computer device, such as the computer device's hard disk or internal memory. In other embodiments, the memory may also be an external storage device of the computer device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, and the like. Of course, the memory may also include both the internal storage unit and external storage devices of the computer device. In this embodiment, the memory is typically used to store the operating system and various application software installed on the computer device. Furthermore, the memory may also be used to temporarily store various types of data that has been output or is about to be output.

[0135] In some embodiments, the processor may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor is generally used to control the overall operation of a computer device.

[0136] Performance Testing

[0137] To validate the performance of the proposed solution, researchers designed a test experiment. They conducted experiments targeting three types of failures: service data loss, service response timeouts, and service configuration errors. The goal was to accurately identify the faulty nodes and their key root causes, ultimately generating a set of the top ten root cause sequences with the highest probability.

[0138] Subsequently, the root cause sequence set is compared with the preset fault type and the actual location of the faulty service node, and the effectiveness of the fault location method is verified through three evaluation indicators: precision, recall rate, and F1 value. The performance of the solution provided by the present invention in the test experiment is shown in the following table:

[0139] Table 1: Results of effectiveness evaluation of the scheme of the present invention

[0140]

[0141] By analyzing the experimental data in the above table, we can find that:

[0142] The positioning results of the technical solution provided by this invention achieved precision and an F1 score exceeding 0.9, demonstrating that the root cause location method employed can effectively identify faulty service nodes and the root causes of indicators. Regarding recall, microservice data loss failures involve multiple processes, including data storage and transmission, and their internal impact relationships are more complex than those of service response timeouts and service configuration errors. Consequently, the recall rate reached a minimum of only 0.879.

[0143] The above-described embodiment merely represents one embodiment of the present invention. While the description is relatively specific and detailed, it should not be construed as limiting the scope of the invention. It should be noted that a person skilled in the art would be able to make various modifications and improvements without departing from the spirit of the present invention, and these modifications and improvements fall within the scope of the present invention. Therefore, the scope of the present invention shall be determined by the appended claims.

Claims

1. A microservice fault location method based on causal inference and knowledge graph, characterized by: It includes: Construct a fault impact knowledge graph that characterizes the fault impact relationships within microservices. This graph is divided into three layers: the time series measurement layer, the indicator causal layer, and the service interaction layer. Use distributed tracing tools to capture the call chain data of the microservice system in real time, recording the call relationship, response time, and status code between service nodes; The Prometheus monitoring system is used to collect multi-dimensional time series indicators for each service. The service interaction layer is dynamically updated based on the collected call link data, and invalid edges are deleted to obtain a service call relationship graph. The sliding window method is used to sample the monitoring values ​​of the time series metrics. Perform error analysis on the collected data to identify abnormal nodes in the time series measurement layer and indicator causal layer and delete them; In the indicator causal layer, we model the causal relationships of each node, use partial correlation analysis to identify pseudo-correlations between indicators, generate an indicator dependency graph, and then use causal inference to construct fault dependency graphs for indicators at different levels. This results in an updated fault impact knowledge graph. The edges of the fault dependency graph are used to represent the abnormal propagation paths of microservices. The process of mapping the causal relationship of indicators to specific service calls to obtain the fault dependency graph includes:

1. Standardize the m indicator matrices associated with service S, calculate the covariance matrix, extract the eigenvalues ​​and corresponding eigenvectors; select the top E principal components with cumulative contribution rates exceeding 85%; 2. Combine the call link data and map the principal components to the service call relationship graph, including: If service A calls service B, and A's indicator Affecting B's index through causal edges , then create cross-level edges in the knowledge graph and add attributes: {Indicator pair: , weight: }; is the preset estimated coefficient; Represents any component in service A c The first indicator in ; Represents any component in service B l The second indicator in; 3. Then, perform adaptive double threshold alignment on the subgraphs at multiple levels and calculate the nodes and Similarity : In the above formula, and Node and The set of neighbor nodes of 4. Setting Benchmark Thresholds , calculate the node by the following formula and Dynamic adjustment offset : In the above formula, and Represents nodes respectively and The order of 5. Based on the similarity between any two nodes and preset baseline thresholds , make the following decisions: like , then merge the two nodes; if in interval, the manual review process is triggered; otherwise, the and As a standalone node; The updated fault impact knowledge graph is imported into the Neo4j database. Then, starting from the abnormal service node, a random walk with restart is performed in the fault impact knowledge graph to locate the fault.

2. The microservice fault location method based on causal inference and knowledge graph according to claim 1 is characterized by: The method for identifying abnormal nodes in the time series measurement layer and indicator causal layer is as follows: For any multidimensional time series indicator , the following ARIMA model is used to generate its current forecast value : ； In the above formula, Respectively represent the 1st- p The autoregressive coefficient on the term; Represent the moving average coefficients on the 1-q items respectively; Represents multidimensional time series indicators I In the t −1 to t − p The actual observation value of the time step; Respectively represent t -1 to t - q The random error term of time steps; p and q Indicates the preset model order; The actual value of each sampled data is calculated by the following formula and predicted value Deviation ratio , thus forming a historical deviation dataset ; n Indicates the number of elements in the historical deviation dataset; ； Generate a cumulative distribution function based on the historical deviation data set and smooth it to obtain a continuous curve , and calculate Curvature : ； In the above formula, z represents the independent variable that represents the smooth curve corresponding to the cumulative distribution function; Will The point with the maximum curvature in the deviation distribution is used as the mutation position to set the corresponding dynamic threshold , and make the following judgment: If the current , then determine the corresponding multi-dimensional time series index as abnormal indicators and remove them.

3. The microservice fault location method based on causal inference and knowledge graph according to claim 2 is characterized in that: Model order p and q The value of is determined by the AIC function as follows: In the above formula, k is the total number of parameters, L is the model likelihood function value.

4. The microservice fault location method based on causal inference and knowledge graph according to claim 1 is characterized in that: The indicator dependency graph is constructed as follows: For any component c i indicators , the following formula is used to perform Z-Score processing to eliminate the dimension difference: ， In the above formula, 、 They are The mean and standard deviation of Represents the standardized index The value of For the i-th index in any component c Select a random component l The j indicators And components with calling relationships u The h indicators , and then use the following partial correlation algorithm to calculate the correlation between the indicators of each component : In the above formula, For indicators and indicators The correlation coefficient between For indicators and indicators The correlation coefficient between For indicators and indicators The correlation coefficient between when ,determination and If there is a direct association, the edge between the two in the completely directed graph is retained, otherwise the corresponding edge is deleted, and the required indicator dependency graph is obtained.

5. The microservice fault location method based on causal inference and knowledge graph according to claim 4 is characterized in that: The fault dependency graph is constructed as follows: For two related indicators in the indicator dependency graph and , with time lag The index value of is used as the independent variable and the following regression equation is fitted: In the above formula, and are two preset estimated coefficients, ; is a time-varying error term; Combined with dynamic adjustment Determine whether the test p value at time t is less than 0.05, if so, For the reason, As a result, add directed edges to the indicator dependency graph , the edge weight is set to ; Map the causal relationship of indicators to specific service calls to obtain the fault dependency graph.

6. The microservice fault location method based on causal inference and knowledge graph according to claim 1 is characterized in that: The process of fault location through random walk includes: Define the abnormal node To the cause node The initial transition probability By abnormal node and cause node Correlation coefficient Sure; calculate The value of , and generates according to the preset rules arrive The random walk probability of In the preset rules, each step jumps back to the initial abnormal node with a probability of 15% , avoid wandering away from key areas; After traversing the entire fault impact knowledge graph, several most frequently visited cause nodes are identified as the root causes of the fault.

7. The microservice fault location method based on causal inference and knowledge graph according to claim 6 is characterized in that: Abnormal nodes and cause node Correlation coefficient The calculation formula is as follows: ， In the above formula, Indicates abnormal nodes and cause node covariance of the corresponding indicators; and Abnormal nodes and cause node The standard deviation of the corresponding indicator.

8. A computer program product comprising a computer program, characterized in that: When the computer program is executed by a processor, the steps of the microservice fault location method based on causal inference and knowledge graph as described in any one of claims 1 to 7 are implemented, and the fault in the microservice is located according to the status data of the microservice operation process.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the computer program is executed by a processor, the steps of the microservice fault location method based on causal inference and knowledge graph as described in any one of claims 1 to 7 are implemented, and the fault in the microservice is located according to the status data of the microservice operation process.

Images