Microservice system timing anomaly detection method, device, equipment, medium and product

Abstract

The present invention discloses a method, apparatus, device, medium and product for detecting time series anomalies in a microservice system. The method comprises: preprocessing original multivariate time series data and converting it into a sliding window sequence, dividing the sliding window sequence into a plurality of univariate time series channels by channel-independent division, performing period encoding, generating a periodic coding sequence, performing feature analysis on the periodic coding sequence, obtaining local features and global features, fusing the local features with the global features, decoding the features, generating reconstructed time series data, calculating the mean square error between the reconstructed time series data and the original multivariate time series data, obtaining anomaly scores for each time step, performing anomaly detection based on the anomaly scores, accurately distinguishing semantic differences between different variables in the multivariate time series data, fully extracting relational features between different variables in the microservice system, and accurately detecting abnormal fluctuations in the time series of the microservice system.

Description

Technical Field

[0001] The present invention relates to the technical field of time series anomaly detection, and in particular to a method, device, equipment, medium and product for detecting time series anomaly in a microservice system. Background Art

[0002] Time series anomaly detection is a technology that identifies abnormal points or patterns in data arranged in chronological order. Its core is to detect abnormal events that deviate significantly from normal behavior (such as equipment failure, financial fraud, or cyber attacks) by analyzing different characteristics of the data.

[0003] Traditional methods for anomaly detection in microservice system data (such as statistical thresholding, control charts, and VAR models) rely on data stability and normal distribution assumptions, and are poorly adaptable to complex, nonlinear, or dynamically changing data. For example, the 3σ rule struggles with multivariate correlation scenarios, and boxplots are sensitive to noise and unable to capture long-term trend shifts. While machine learning methods have overcome the limitations of traditional assumptions, they face multiple challenges: distance algorithms (such as KNN) are computationally expensive for large-scale data; density algorithms (such as LOF) are effective in low dimensions but lack stability in high-dimensional, noisy scenarios; clustering methods (such as K-means and DBSCAN) are sensitive to initial parameters and have limited performance when handling complex density distributions; and ensemble models (such as Isolation Forest and XGBoost) improve generalization capabilities but suffer from data sparsity interference and model complexity. Current time series anomaly detection suffers from the following issues:

[0004] First, the different semantics and dynamic characteristics of different variables in time series are difficult to pay attention to: in time series anomaly detection, some variables may show longer periodic changes, while others may show shorter periodic changes. Existing methods usually adopt a unified processing method for all variables and cannot distinguish the semantic differences between different variables, resulting in inaccurate identification of abnormal fluctuations.

[0005] Second, in traditional Transformers, the attention matrix may have a low-rank problem, which limits the representation diversity. Low rank may mean that the information in the attention matrix is ​​not rich enough and cannot capture enough dependencies between variables.

[0006] Third, it is difficult to fully extract the relationship features of different variables in multivariate time series: for the extraction of this feature, general methods usually use a single channel independence or channel attention mechanism to handle it, ignoring the correlation or difference between different channels, and cannot effectively deal with the complex intrinsic structure of time series data. Summary of the Invention

[0007] The main purpose of the present invention is to provide a method, device, equipment, medium and product for detecting time series anomalies in a microservice system, aiming to solve the technical problem that the existing technology cannot accurately distinguish the semantic differences between different variables and cannot fully extract the relationship characteristics of different variables in a multivariate time series, resulting in the inability to accurately detect abnormal fluctuations in the time series of a microservice system.

[0008] To achieve the above objectives, the present invention provides a method for detecting time series anomalies in a microservice system. The method is applied to a microservice system and comprises the following steps:

[0009] Preprocessing original multivariate time series data and converting the preprocessed original multivariate time series data into a sliding window sequence, wherein the original multivariate time series data is multivariate time series data of a microservice system collected at different time points, and the preprocessing includes normalizing data corresponding to each time step in the original multivariate time series data;

[0010] Performing channel-independent division processing on the sliding window sequence to generate univariate time series of multiple channels;

[0011] Perform period coding on each univariate time series to generate a period coding sequence;

[0012] Inputting the periodic coding sequence into a pre-built enhanced temporal convolutional network model and a dynamic learning attention module for feature analysis to obtain local feature information and global feature information;

[0013] Fusing the local feature information with the global feature information to obtain fused feature information;

[0014] Decoding the fused feature information to generate reconstructed time series data, and performing mean square error calculation on the reconstructed time series data and the original multivariate time series data to obtain an anomaly score for each time step;

[0015] Anomaly detection is performed on the original multivariate time series data based on the anomaly score.

[0016] Optionally, performing period coding on each univariate time series to generate a period coding sequence includes:

[0017] Perform fast Fourier transform on each univariate time series to obtain frequency domain features:

[0018]

[0019] in, represents a univariate time series, Represents the time index, represents the channel index, Represents frequency domain features;

[0020] Adjusting the shape of the frequency domain feature to generate a first reshaping matrix and a second reshaping matrix;

[0021] Perform matrix multiplication of the first reshaped matrix and the second reshaped matrix to obtain a similarity matrix:

[0022]

[0023] in, represents the similarity matrix, represents the first reshaped matrix, represents the second reshaped matrix;

[0024] Calculate the representative period of each channel based on the similarity matrix:

[0025]

[0026] in, Indicates channel The representative cycle of Represents the front of the similarity matrix Similarity values, Indicates the sequence length;

[0027] Determining a code length of each channel according to the representative period;

[0028] Generate a random starting index based on the encoding length to determine the encoding starting position;

[0029] Periodic encoding is performed based on the encoding start position to generate a periodic encoding sequence.

[0030] Optionally, the enhanced temporal convolutional network model includes multiple enhanced temporal convolution modules and channel attention modules;

[0031] The enhanced temporal convolution module includes a causal convolution layer, a dilated convolution layer and a residual connection layer;

[0032] The causal convolutional layer includes:

[0033]

[0034] in, represents the convolution kernel weight, represents the convolution kernel size, Represents the time point in the time series data received by the input layer The value of Represents the output result of causal convolution;

[0035] The dilated convolutional layer includes:

[0036]

[0037] in, represents the dilated convolution result, represents the expansion rate;

[0038] The residual connection layer includes:

[0039]

[0040] in, represents the output of the enhanced temporal convolution module, Represents the periodic encoded sequence of the original input to the enhanced temporal convolution module;

[0041] The channel attention module is used to perform global average pooling on each channel along the time dimension to generate channel statistics:

[0042]

[0043] in, Indicates channel The channel statistics of represents the sequence length, Indicates the input sequence data The time step Time series of channels;

[0044] The channel attention module is also used to generate channel weights through nonlinear transformation:

[0045]

[0046] in, and Represent the fully connected layer parameters, represent the compression ratio, represents the Relu activation function, represents the Sigmoid function, represents the channel attention weight, Represents the result after global average pooling;

[0047] The channel attention module is further used to multiply the channel attention weight of each channel by the periodic encoding sequence of the original input of the enhanced temporal convolutional network model channel by channel:

[0048]

[0049] in, represents the output of the channel attention module, represents channel-wise multiplication, Represents a periodic encoded sequence of the original input to the enhanced temporal convolutional network model.

[0050] Optionally, the dynamic learning attention module is used to position-encode the periodic encoding sequence to obtain a position-encoded input sequence, and perform a linear transformation on the position-encoded input sequence to obtain a query matrix, a key matrix, and a value matrix:

[0051]

[0052]

[0053]

[0054] in, 、 、 represent the query matrix, key matrix and value matrix respectively, represents the position-encoded input sequence, 、 、 Represent the parameter matrices after training respectively;

[0055] The dynamic learning attention module is also used to calculate the attention score:

[0056]

[0057] in, represents the attention score, represents transpose, represents the scaling factor;

[0058] The dynamic learning attention module is also used to The function normalizes the attention scores to generate an attention weight matrix:

[0059]

[0060] in, represents the attention weight matrix;

[0061] The dynamic learning attention module is also used to combine the attention weight matrix with the The learnable matrices processed by the function are added to obtain the target weight matrix:

[0062]

[0063] in, represents the target weight matrix, represents the learnable matrix, express function;

[0064] The dynamic learning attention module is further used to perform row normalization on the target weight matrix to obtain a normalized matrix, and perform value projection on the normalized matrix to obtain an output result:

[0065]

[0066]

[0067] in, represents the normalized matrix, Represents the target matrix Middle Rank Elements of the column, Indicates the target matrix The sum of all elements in a row, Represents the output of the dynamic learning attention module.

[0068] Optionally, the fusing the local feature information with the global feature information to obtain fused feature information includes:

[0069] Calculate feature fusion weight parameters based on the local feature information and the global feature information:

[0070]

[0071] in, represents the feature fusion weight parameter, and They represent the learnable parameters, represents the output result of the enhanced temporal convolution module, wherein the output result of the enhanced temporal convolution module includes local feature information, represents the output result of the dynamic learning attention module, wherein the output result of the dynamic learning attention module includes global feature information, Indicates the concatenation of local feature information and global feature information;

[0072] The local feature information and the global feature information are linearly combined according to the feature fusion weight parameter to obtain fused feature information:

[0073]

[0074] in, Indicates fusion feature information;

[0075] The gradient parameter of the feature fusion weight parameter is calculated by the loss function, and the feature fusion weight parameter is updated based on the gradient parameter:

[0076]

[0077] in, represents the gradient parameter, represents the loss function, represents the rate of change of the loss function, Represents the time step The fusion feature information, Represents the enhanced temporal convolutional network model with dynamic learning attention module at time step The output difference, Represents the enhanced temporal convolutional network model at time step The output result is, Denotes the dynamic learning attention module at time step The output result;

[0078] The fused feature information is updated based on the updated feature fusion weight parameter to obtain updated fused feature information.

[0079] Optionally, performing anomaly detection on the original multivariate time series data based on the anomaly score includes:

[0080] Determine the initial score threshold based on the preset risk probability;

[0081] Constructing a cumulative distribution function of the anomaly score based on the initial score threshold, the cumulative distribution function comprising:

[0082]

[0083] in, represents the initial score threshold, represents the anomaly score, represents the scale parameter, represents the shape parameter, represents the cumulative distribution function;

[0084] Determine the target score threshold according to the cumulative distribution function and the initial score threshold:

[0085]

[0086] in, represents the total number of data samples in the original multivariate time series data after preprocessing, Indicates that the anomaly score exceeds the initial threshold The number of samples, represents the target score threshold;

[0087] Anomaly detection is performed on the original multivariate time series data based on the target score threshold and the anomaly score.

[0088] In addition, to achieve the above-mentioned purpose, the present invention further proposes a microservice system timing anomaly detection device, which is applied to a microservice system and includes:

[0089] A data processing module is used to preprocess the original multivariate time series data and convert the preprocessed original multivariate time series data into a sliding window sequence. The original multivariate time series data is multivariate time series data of the microservice system collected at different time points. The preprocessing includes standardizing the data corresponding to each time step in the original multivariate time series data.

[0090] A channel division module is used to perform channel-independent division processing on the sliding window sequence to generate univariate time series of multiple channels;

[0091] The period coding module is used to perform period coding on each univariate time series and generate a period coding sequence;

[0092] A feature analysis module is used to input the periodic coding sequence into a pre-built enhanced temporal convolutional network model and a dynamic learning attention module for feature analysis to obtain local feature information and global feature information;

[0093] A feature fusion module, configured to fuse the local feature information with the global feature information to obtain fused feature information;

[0094] An anomaly scoring module is used to decode the fused feature information to generate reconstructed time series data, and calculate the mean square error between the reconstructed time series data and the original multivariate time series data to obtain an anomaly score for each time step;

[0095] An anomaly detection module is used to perform anomaly detection on the original multivariate time series data based on the anomaly score.

[0096] In addition, to achieve the above-mentioned purpose, the present application also proposes a microservice system timing anomaly detection device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the computer program is configured to implement the steps of the microservice system timing anomaly detection method as described above.

[0097] In addition, to achieve the above-mentioned purpose, the present application also proposes a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the microservice system timing anomaly detection method as described above are implemented.

[0098] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the microservice system timing anomaly detection method as described above.

[0099] The present invention preprocesses the original multivariate time series data and converts the preprocessed original multivariate time series data into a sliding window sequence, wherein the original multivariate time series data is multivariate time series data of a microservice system collected at different time points, the preprocessing includes standardizing the data corresponding to each time step in the original multivariate time series data, performing channel independent division processing on the sliding window sequence, generating univariate time series of multiple channels, periodically encoding each univariate time series, generating a periodic coding sequence, inputting the periodic coding sequence into a pre-constructed enhanced time convolutional network model and a dynamic learning attention module for feature analysis, obtaining local feature information and global feature information, performing feature fusion on the local feature information and the global feature information, obtaining fused feature information, decoding the fused feature information, generating reconstructed time series data, and comparing the reconstructed time series data with the original multivariate time series. The mean square error of the data is calculated to obtain the anomaly score of each time step, and anomaly detection is performed on the original multivariate time series data based on the anomaly score; since the present invention generates a periodic coding sequence by preprocessing, sliding window conversion, channel independent division processing and period coding the original multivariate time series of the microservice system, feature analysis is performed on the periodic coding sequence from two branches, and the short-term local pattern and long-term dependency representation in the time series are captured by the enhanced time convolution model, and the perception of key features is enhanced. The global time domain trend and cross-variable pattern representation of the time series are captured through the dynamic learning attention module, and the feature diversity is improved. The features of the two branches are fused and input into the decoder for decoding to reconstruct the sequence, which is compared with the original multivariate time series to accurately distinguish the semantic differences of different variables in the multivariate time series data, and fully extract the relationship features of different variables in the microservice system, thereby accurately detecting the abnormal timing fluctuations during the operation of the microservice system. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0101] Figure 1 Schematic diagram of the structure of a microservice system timing anomaly detection device in a hardware operating environment according to an embodiment of the present invention;

[0102] Figure 2 This is a flow chart of the first embodiment of the method for detecting timing anomalies in a microservice system according to the present invention;

[0103] Figure 3 This is a schematic diagram of the network structure of the enhanced time convolution module in an embodiment of the method for detecting time series anomalies in a microservice system of the present invention;

[0104] Figure 4 This is a schematic diagram of the network structure of the dynamic learning attention module in an embodiment of the microservice system timing anomaly detection method of the present invention;

[0105] Figure 5 This is a structural diagram of the dynamic learning attention layer in an embodiment of the method for detecting time series anomalies in a microservice system of the present invention;

[0106] Figure 6 This is a flow chart of the second embodiment of the method for detecting timing anomalies in a microservice system according to the present invention;

[0107] Figure 7 This is a structural block diagram of the first embodiment of the timing anomaly detection device for a microservice system of the present invention.

[0108] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0109] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0110] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a microservice system timing anomaly detection device in the hardware operating environment involved in the embodiment of the present invention.

[0111] like Figure 1As shown, the microservice system timing anomaly detection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display and an input unit, such as a keyboard. Optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk storage device. The memory 1005 may also be a storage device independent of the processor 1001.

[0112] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the timing anomaly detection device of the microservice system, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0113] like Figure 1 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a microservice system timing anomaly detection program.

[0114] exist Figure 1 In the microservice system timing anomaly detection device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the microservice system timing anomaly detection device of the present invention can be set in the microservice system timing anomaly detection device. The microservice system timing anomaly detection device calls the microservice system timing anomaly detection program stored in the memory 1005 through the processor 1001 and executes the microservice system timing anomaly detection method provided by the embodiment of the present invention.

[0115] The embodiment of the present invention provides a method for detecting time series anomalies in a microservice system. Figure 2 , Figure 2 Schematic diagram of the first embodiment of the method for detecting timing anomalies in a microservice system according to the present invention.

[0116] This embodiment is applied to a microservice system. In this embodiment, the microservice system timing anomaly detection method includes the following steps:

[0117] Step S10: preprocessing the original multivariate time series data, and converting the preprocessed original multivariate time series data into a sliding window sequence.

[0118] It should be noted that this embodiment is applied to time series analysis and anomaly detection of microservice system data in real production environments. It primarily targets anomaly detection in indicator sequence data, primarily encompassing performance metrics and business metrics. These include performance metrics (such as CPU utilization, memory utilization, and network traffic) for operating systems, databases, middleware, and containers, as well as business metrics such as user experience response time, success rate, and throughput. This data is displayed in time format, with each record representing different metrics at the same point in time. This data is highly context-dependent, and in microservice elastic scaling scenarios, the normal fluctuation range of resource metrics (such as container CPU, memory, and network traffic) dynamically changes with load. Consequently, there are often no absolute anomaly detection standards for this data. Therefore, using static thresholds in conventional time series anomaly detection models can result in false positives and false negatives for anomalies.

[0119] To solve the above two problems, the dual-branch structure adopted at the beginning of the model design in this embodiment realizes the acquisition of context-dependent features, and adopts a dynamic threshold method in threshold setting to prevent false positives and false negatives caused by threshold rigidity, and innovates in the internal design of the model to address the problem of anomaly detection.

[0120] It should be understood that the execution subject of this embodiment can be a computing service device with data processing, network communication, and program execution capabilities, such as a tablet computer, personal computer, mobile phone, etc., or a terminal electronic device capable of performing the aforementioned functions. The following uses a microservice system timing anomaly detection device (hereinafter referred to as the detection device) as an example to illustrate this embodiment and the following embodiments.

[0121] It should be noted that the original multivariate time series data is multivariate time series data of the microservice system collected at different time points, and the preprocessing includes standardizing the data corresponding to each time step in the original multivariate time series data.

[0122] In some embodiments, the original multivariate time series data may be KPI data collected by a detection device during the operation of the microservice system.

[0123] It should be noted that KPI data is key indicator data used to measure the operating status of a microservice system. KPI data can include performance indicators (such as CPU utilization, memory utilization, and disk I / O utilization), resource management indicators (such as resource utilization and load balancing), and service quality indicators (such as response time and throughput). These indicators can comprehensively reflect the performance and resource utilization efficiency of a microservice system. By analyzing them, potential problems can be promptly identified and optimized, thereby ensuring the stable and efficient operation of the microservice system.

[0124] In some embodiments, the detection device detects the original multivariate time series data Perform preprocessing, standardize each time step of the input time series, convert the data into a distribution with a mean of 0 and a standard deviation of 1, and obtain the standardized time series , divide the standardized data into training set and test set according to a certain ratio, and use the sliding window to process the time series data. Convert to sliding window sequence , the standardized calculation formula is:

[0125]

[0126] in, Represents a time series after standardization, with a mean of 0 and a variance of 1; Indicates that the input time series is The characteristic value of the moment; Represents time series The mean and variance of .

[0127] In some embodiments, the detection device uses a sliding window to process the processed time series. Convert to sliding window sequence , specifically, the timestamps on the original dataset Upper data point To model the dependency relationship, set the length to The sliding window cuts the time series, and the calculation process is:

[0128]

[0129] in, is the characteristic value of the standardized time series, is the time subsequence with feature information. After the above process, the time series is finally Convert to sliding window , is a sliding window sequence.

[0130] Step S20: performing channel-independent division processing on the sliding window sequence to generate univariate time series of multiple channels.

[0131] It should be noted that channel independence refers to the fact that when processing multi-channel data, the detection device processes the data of each channel separately, without considering the information of other channels. Independent processing can improve the flexibility and scalability of time series analysis and processing, especially when there are significant differences or independence between channels.

[0132] In some embodiments, the detection device detects the sample time series Perform channel independence and process each type of feature separately to form multiple univariate time series .

[0133]

[0134] Step S30: performing period coding on each univariate time series to generate a period coding sequence.

[0135] In some embodiments, the detection device may perform a fast Fourier transform on each univariate time series to extract the representative period of each feature dimension. T . The representative cycle T Used to construct periodic coding sequences , covering up the key area near the current time and improving the accuracy of feature extraction.

[0136] Step S40: Input the periodic coding sequence into the pre-built enhanced temporal convolutional network model and the dynamic learning attention module for feature analysis to obtain local feature information and global feature information.

[0137] In the specific implementation, the detection device performs feature analysis on the periodic coding sequence from two branches, using the enhanced time-domain convolution module to capture the short-term local patterns and long-term dependency representations in the time series; and using the dynamic learning attention module (Dynamic-Learning Encoder) to capture the global time domain trends and cross-variable pattern representations in the time series.

[0138] Furthermore, in order to improve the efficiency of local feature analysis of time series and accurately capture short-term local patterns and long-term dependency representations, in one embodiment, the enhanced temporal convolutional network model includes multiple enhanced temporal convolution modules and channel attention modules;

[0139] It should be noted that the Enhanced Time-domain Convolution model obtains short-term local patterns and long-term dependency representations by constructing a temporal convolutional network and a channel attention mechanism. Its calculation process is as follows:

[0140] First, the entire module consists of multiple enhanced temporal convolution modules ( ) cascade.

[0141]

[0142] in, The calculation process includes input layer, causal convolution layer, dilated convolution layer, residual connection layer, and channel attention module.

[0143] The input layer, used to receive time series data, is usually expressed as: ,in is the value at time t.

[0144] The causal convolutional layer includes:

[0145]

[0146] in, represents the convolution kernel weight, represents the convolution kernel size, Represents the time point in the time series data received by the input layer The value of Represents the output result of causal convolution;

[0147] The dilated convolutional layer includes:

[0148]

[0149] in, represents the dilated convolution result, represents the expansion rate;

[0150] The residual connection layer includes:

[0151]

[0152] in, represents the output of the enhanced temporal convolution module, Represents the periodic encoded sequence of the original input to the enhanced temporal convolution module;

[0153] The channel attention module is used to compress global information, perform global average pooling on each channel along the time dimension, and generate channel statistics:

[0154]

[0155] in, Indicates channel The channel statistics of represents the sequence length, Indicates the input sequence data The time step Time series of channels;

[0156] The channel attention module is also used to generate channel weights through nonlinear transformation, map the weights to the (0, 1) interval, and learn the nonlinear relationship between channels through the bottleneck structure (first dimensionality reduction and then dimensionality increase):

[0157]

[0158] in, and Represent the fully connected layer parameters, represent the compression ratio, represents the Relu activation function, represents the Sigmoid function, represents the channel attention weight, Represents the result after global average pooling;

[0159] The channel attention module is also used to multiply the channel attention weight of each channel with the periodic coding sequence of the original input of the enhanced time convolutional network model channel by channel, to enhance the response of important channels, suppress irrelevant channels, and ensure the output Keep the same dimensions as the input:

[0160]

[0161] in, represents the output of the channel attention module, represents channel-wise multiplication, Represents a periodic encoded sequence of the original input to the enhanced temporal convolutional network model.

[0162] In some embodiments, reference Figure 3 , Figure 3This is a schematic diagram of the network structure of the enhanced temporal convolution module in one embodiment, wherein the input data passes through the dilated causal convolution layer, the weight normalization layer, the ReLu activation function, regularization, the residual connection, the average pooling layer, the linear layer, and the Sigmoid function. The dilated causal convolution layer efficiently captures long-distance dependencies by expanding the receptive field of the convolution kernel, ensuring that "only past / previous information is relied upon" (such as in time series data, the current moment does not look at future moments) to avoid information leakage; the weight normalization layer is used to normalize the weights of the convolution layer to stabilize the training process; the ReLu activation function is used to introduce nonlinearity and enhance the network's expression ability; regularization is used to prevent overfitting and randomly shield some neurons during training; the residual connection is used to directly add the input to the output of the above process to alleviate the gradient vanishing problem while retaining the original information and improving training stability; the average pooling layer is used to perform global average pooling on the features, compress the spatial dimension, and condense the multi-dimensional features into a low-dimensional representation. Figure 3 middle," " means multiple modules are cascaded.

[0163] Furthermore, in order to accurately capture the global temporal trend and cross-variable pattern representation in the time series, in one embodiment, the dynamic learning attention module is used to dynamically learn the attention encoding. Based on the traditional temporal Transformer implementation, the original encoder's self-attention mechanism is replaced by a dynamic learning attention mechanism. Figure 4 , Figure 4 Figure 1 is a schematic diagram of the network structure of a dynamic learning attention module in one embodiment. The dynamic learning attention module includes an embedding layer, a position embedding layer, a dynamic learning attention layer (Dynamic-Learning Attention), a residual connection and layer normalization layer, a feedforward layer, and a linear layer. The embedding layer is used to map the input to a vector space, the position embedding layer is used for position encoding and adding position information to the sequence, the dynamic learning attention layer is used for adaptive learning of attention weights, the residual connection and layer normalization layer are used for residual addition and layer normalization, and the linear layer is used to perform a linear transformation on the output. Figure 4 middle," " means multiple modules are cascaded.

[0164] Reference Figure 5 , Figure 5 Figure 2 is a schematic diagram of the structure of the dynamic-learning attention layer in one embodiment. The calculation process of the dynamic-learning attention mechanism is as follows:

[0165] Periodic Encoding Sequence Successively passed , , and add it as the input to the encoder:

[0166]

[0167]

[0168]

[0169] in, Indicates the position in the sequence, Represents the dimension, Indicates the dimension index of the position vector.

[0170] The encoder module consists of multiple Cascade composition.

[0171]

[0172] in, The calculation process is as follows:

[0173] First, the original self-attention mechanism calculation is performed. The calculation process is as follows:

[0174]

[0175] in, (Query), (Key), (Value) is the three matrices generated by linear transformation of the input sequence, representing query, key and value respectively. is the dimension of the key vector, used to scale the dot product result to prevent the gradient from vanishing, The function normalizes the dot product scores into a probability distribution, which represents the relevance weights between different positions.

[0176] The dynamic learning attention module is used to positionally encode the periodic encoding sequence to obtain a position-encoded input sequence, and linearly transform the position-encoded input sequence to obtain a query matrix, a key matrix, and a value matrix, where the shape is (b, l, d, where b is the batch size, l is the sequence length, and d is the input dimension) through three independent linear layer mappings:

[0177]

[0178]

[0179]

[0180] in, 、 、 represent the query matrix, key matrix and value matrix respectively, represents the position-encoded input sequence, 、 、 They represent the parameter matrices after training.

[0181] The dynamic learning attention module is also used to calculate the attention score by and The dot product measures the similarity between elements in the sequence:

[0182]

[0183] in, represents the attention score, represents transpose, Indicates the scaling factor, scaling factor Prevent the dot product result from being too large The gradient of the function disappears.

[0184] The dynamic learning attention module is also used to The function normalizes the attention scores to generate an attention weight matrix:

[0185]

[0186] in, represents the attention weight matrix.

[0187] The dynamic learning attention module is also used to introduce a learnable matrix , the attention weight matrix and after ( function , ensuring that its elements are positive to prevent zeros from appearing during normalization) Add together to get a new matrix , enhance the representation ability and obtain the target weight matrix:

[0188]

[0189] in, represents the target weight matrix, represents the learnable matrix, express function.

[0190] The dynamic learning attention module is further used to perform row normalization on the target weight matrix to ensure that the sum of each row is 1, obtain a normalized matrix, and perform value projection on the normalized matrix to obtain the output result:

[0191]

[0192]

[0193] in, represents the normalized matrix, Represents the target matrix Middle Rank Elements of the column, Indicates the target matrix The sum of all elements in a row, Represents the output of the dynamic learning attention module.

[0194] In some embodiments, the learnable matrix , is usually randomly initialized during model initialization. Its initial value can be a small random number or a zero matrix, etc. The learning process is as follows:

[0195] (1) Forward propagation

[0196] At each training step, the output of the dynamically learned attention is computed:

[0197]

[0198] This output is used to generate the reconstruction results of the model.

[0199] (2) Backpropagation

[0200] By back propagation, the loss function is calculated for the model parameters (including the learnable matrix ), let the loss function be :

[0201]

[0202]

[0203]

[0204]

[0205]

[0206]

[0207] The above formula is for partial derivatives. Based on the chain rule, both sides of the formula are equal. Represents the loss function For the learnable matrix The partial derivative of represents the output of dynamic learning attention, The derivative is function , Representation matrix The L1 norm of , which is the sum of the absolute values ​​of all elements in the matrix.

[0208] (3) Update parameters

[0209] Update the learnable matrix using gradient descent :

[0210]

[0211] in, Represents the learning rate.

[0212] Step S50: Fusing the local feature information with the global feature information to obtain fused feature information.

[0213] In some embodiments, the output features of the enhanced temporal convolution model are fused with the output features of the dynamic learning attention module model, and feature fusion is performed using weighted summation. Learnable weights are assigned to the outputs of different branches, and the contributions of each branch are balanced by adaptively adjusting the weights.

[0214] Furthermore, in order to reasonably adjust the feature contributions of different branches, in one embodiment, the above step S50 may include:

[0215] Step S501: Calculating feature fusion weight parameters based on the local feature information and the global feature information.

[0216] In the specific implementation, the detection device can output it through the branch, and enhance the output results of the temporal convolution model through the fully connected layer. (local feature information) and the output of the dynamic learning attention module (Global feature information) dimensions remain consistent.

[0217] In some embodiments, trainable weight parameters are introduced , constrain its range through the Sigmoid function, and its calculation process is:

[0218]

[0219] in, represents the feature fusion weight parameter, and represent the learnable parameters, represents the output result of the enhanced temporal convolution module, wherein the output result of the enhanced temporal convolution module includes local feature information, represents the output result of the dynamic learning attention module, wherein the output result of the dynamic learning attention module includes global feature information, Indicates the concatenation of local feature information and global feature information.

[0220] Step S502: linearly combining the local feature information and the global feature information according to the feature fusion weight parameter to obtain fused feature information.

[0221] It is understandable that the detection device linearly combines the output results of the two branches according to the feature fusion weight parameter, referring to the following formula:

[0222]

[0223] in, Indicates fusion feature information;

[0224] Step S503: Calculate the gradient parameter of the feature fusion weight parameter through the loss function, and update the feature fusion weight parameter based on the gradient parameter.

[0225] In some embodiments, the detection device can calculate the gradient through the loss function MSE and back propagate the updated weights. , ensuring that the features of the two branches are balanced and optimized during training, the gradient formula is:

[0226]

[0227] in, represents the gradient parameter, represents the loss function, represents the rate of change of the loss function, Represents the time step The fusion feature information, Represents the enhanced temporal convolutional network model with dynamic learning attention module at time step The output difference, Represents the enhanced temporal convolutional network model at time step The output result is, Denotes the dynamic learning attention module at time step The output result is:

[0228] Step S504 updates the fused feature information based on the updated feature fusion weight parameter to obtain updated fused feature information.

[0229] In some embodiments, the detection device updates the fused feature information based on the updated feature fusion weight parameters by performing a gradient update on the feature fusion weight parameters, and outputs the updated fused feature as the final fused feature information.

[0230] Step S60: Decode the fused feature information to generate reconstructed time series data, and perform mean square error calculation on the reconstructed time series data and the original multivariate time series data to obtain anomaly scores for each time step.

[0231] In some embodiments, the mean square error (MSE) is calculated as follows:

[0232]

[0233] in, Indicates the The true value of the samples; Indicates the The reconstructed value of samples; Represents the total number of samples. The mean square error between the decoder output reconstructed data and the original data input is calculated to obtain the anomaly score.

[0234] Step S70: performing anomaly detection on the original multivariate time series data based on the anomaly score.

[0235] In some embodiments, the detection device calculates the anomaly score of the data points at each time step, marks the data points whose anomaly scores exceed a score threshold as anomaly data points, and marks the data points that do not exceed the score threshold as normal data points.

[0236] Furthermore, in order to accurately detect abnormal data fluctuations in the microservice system, in one embodiment, the above step S70 may include:

[0237] Step S701: Determine an initial score threshold according to a preset risk probability.

[0238] In some embodiments, the initial score threshold may be determined by the quantile q, where q is a custom setting, such as q=0.01 corresponding to the 99% quantile. It is the 99% quantile of the anomaly score in the training set, that is, the anomaly score of 99% of the training samples is less than or equal to .

[0239] Step S702: constructing a cumulative distribution function of the abnormality score based on the initial score threshold.

[0240] It can be understood that, assuming that the tail data of the abnormal score follows the generalized Pareto distribution (GPD), the cumulative distribution function includes:

[0241]

[0242] in, represents the initial score threshold, represents the anomaly score, represents the scale parameter, represents the shape parameter (determines the thickness of the data tail), represents the cumulative distribution function;

[0243] Step S703: determining a target score threshold according to the cumulative distribution function and the initial score threshold.

[0244] In a specific implementation, the detection device can fit the GPD through maximum likelihood estimation (MLE), and the final threshold is calculated by the following formula:

[0245]

[0246] in, represents the total number of data samples in the original multivariate time series data after preprocessing, Indicates that the anomaly score exceeds the initial threshold The number of samples, represents the target score threshold;

[0247] Step S704: performing anomaly detection on the original multivariate time series data based on the target score threshold and the anomaly score.

[0248] In some embodiments, the detection device calculates anomaly scores for both the training dataset and the test dataset during the testing phase, and may adopt a threshold setting method based on extreme value theory (EVT) - the SPOT (Sequential Probability Ratio Test for Online Threshold Selection) algorithm. The core of the SPOT algorithm is to model the tail of the anomaly score through the generalized Pareto distribution (GPD) and dynamically determine the optimal threshold.

[0249] In some embodiments, the detection device can divide the pre-processed original multivariate time series data into a training set and a test set in proportion, and calculate a quantile threshold (such as q = 0.01) for the abnormal score of the training set as the initial threshold for GPD fitting. .

[0250] In some embodiments, the detection device can extract extreme values ​​exceeding the initial threshold in the test set anomaly score for tail modeling, that is, exceeding the initial threshold. The extreme value sequence of .

[0251] Fitting GPD parameters using maximum likelihood estimation (MLE) and :

[0252]

[0253] in, Represents the extreme value sequence, which is the difference between the initial threshold and the initial threshold. Represents the value of a point in the extreme value sequence, Indicates that the anomaly score is greater than the initial threshold The number of samples.

[0254] Dynamically adjust the anomaly score when traversing the test set : If the anomaly score exceeds the current threshold, add the anomaly sequence and use the anomaly sequence to refit the GPD parameters and , update the threshold Finally, the mean of all adjusted thresholds is taken as the final threshold. Values ​​above the threshold are marked as abnormal 1, and values ​​otherwise are marked as normal 0.

[0255] This embodiment preprocesses the original multivariate time series data and converts the preprocessed original multivariate time series data into a sliding window sequence. The original multivariate time series data is multivariate time series data of a microservice system collected at different time points. The preprocessing includes standardizing the data corresponding to each time step in the original multivariate time series data, performing channel-independent division processing on the sliding window sequence, generating univariate time series of multiple channels, periodically encoding each univariate time series to generate a periodic coding sequence, inputting the periodic coding sequence into a pre-built enhanced time convolutional network model and a dynamic learning attention module for feature analysis, obtaining local feature information and global feature information, performing feature fusion on the local feature information and the global feature information to obtain fused feature information, decoding the fused feature information, generating reconstructed time series data, and comparing the reconstructed time series data with the original multivariate time series. The mean square error of the data is calculated to obtain the anomaly score of each time step, and anomaly detection is performed on the original multivariate time series data based on the anomaly score; since this embodiment generates a periodic coding sequence by preprocessing, sliding window conversion, channel independent division processing and period coding the original multivariate time series of the microservice system, feature analysis is performed on the periodic coding sequence from two branches, and the short-term local pattern and long-term dependency representation in the time series are captured by the enhanced time convolution model, and the perception of key features is enhanced. The global time domain trend and cross-variable pattern representation of the time series are captured through the dynamic learning attention module, and the feature diversity is improved. The features of the two branches are fused and input into the decoder for decoding to reconstruct the sequence, which is compared with the original multivariate time series to accurately distinguish the semantic differences of different variables in the multivariate time series data, and fully extract the relationship features of different variables in the microservice system, thereby accurately detecting abnormal timing fluctuations during the operation of the microservice system.

[0256] refer to Figure 6 , Figure 6 2 is a flow chart of the second embodiment of the method for detecting timing anomalies in a microservice system according to the present invention.

[0257] Based on the above first embodiment, in this embodiment, step S30 further includes:

[0258] Step S301: Perform fast Fourier transform on each univariate time series to obtain frequency domain features.

[0259] In some embodiments, the Fast Fourier Transform (FFT) calculation process is as follows:

[0260] Detecting equipment for multiple univariate time series Perform a fast Fourier transform and take the amplitude, the shape is (b, l, c). Where b is the batch size, l is the sequence length, and c is the number of channels. The Fourier transform decomposes the function into its component frequencies. Given a sequence ,in , the discrete Fourier transform (DFT) is defined by the following formula:

[0261]

[0262]

[0263] in, represents a univariate time series, Represents the time index, represents the channel index, represents the frequency domain characteristics, The shape is , set the DC component (the part with frequency 0) to 0.

[0264]

[0265] Step S302: adjusting the shape of the frequency domain feature to generate a first reshaping matrix and a second reshaping matrix.

[0266] In some embodiments, the detection device Adjust the shape, for , for , the two matrices are multiplied to obtain the similarity matrix , the shape is (c, b, b). The following calculation and of norm.

[0267]

[0268]

[0269] Step S303: performing matrix multiplication on the first reshaped matrix and the second reshaped matrix to obtain a similarity matrix.

[0270] It should be noted that the similarity matrix is ​​calculated according to the following formula:

[0271]

[0272] in, represents the similarity matrix, represents the first reshaped matrix, represents the second reshaped matrix.

[0273] Step S304: Calculating the representative period of each channel based on the similarity matrix.

[0274] It is understandable that the detection device can perform similarity matrix Extract the top k most similar indices and values ​​along the last dimension , calculate the representative cycle of each channel , refer to the following formula:

[0275]

[0276] in, Indicates channel The representative cycle of Represents the front of the similarity matrix Similarity values, Indicates the sequence length.

[0277] Step S305: Determine the code length of each channel according to the representative period.

[0278] In some embodiments, let the input sequence be , the shape is (b, l, c), where b is the batch size, l is the sequence length, and c is the number of channels. Based on the representative cycle , encode the length ( Calculation, the encoding length calculation formula is as follows:

[0279]

[0280] Step S306: Generate a random start index based on the encoding length to determine the encoding start position.

[0281] In some embodiments, the detection device may select a random encoding starting position and generate a random starting index for each batch of samples b and channel c: ,in is uniformly distributed.

[0282] Step S307: performing periodic coding based on the coding start position to generate a periodic coding sequence.

[0283] In some embodiments, the detection device may include the input tensor [ The interval values ​​are set to zero:

[0284]

[0285] Get the final periodic code sequence , the output shape remains (b, l, c).

[0286] This embodiment uses periodic coding to address the different semantics and dynamic characteristics of different variables in a time series. It analyzes the frequency components of time series data through fast Fourier transform, dynamically selects the dominant period of each variable, selects the most significant period as the coding length, and generates a coding matrix based on these period lengths. The coding matrix is ​​applied to the time series data to highlight the fluctuation pattern within the reaction time. This method can adaptively adjust the coding length to adapt to the diverse reaction times of different variables, effectively improve the efficiency of contextual analysis of multivariate time series, address the different semantics and dynamic characteristics of different variables in a time series, and accurately capture abnormal fluctuations from the time series data of multiple different variables.

[0287] In addition, an embodiment of the present invention also proposes a computer-readable storage medium, on which a microservice system timing anomaly detection program is stored. When the microservice system timing anomaly detection program is executed by a processor, the steps of the microservice system timing anomaly detection method described above are implemented.

[0288] The computer-readable storage medium provided herein may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including, but not limited to, wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0289] The above-mentioned computer-readable storage medium may be included in the microservice system timing anomaly detection device; or it may exist independently without being assembled into the microservice system timing anomaly detection device.

[0290] In addition, an embodiment of the present invention further provides a computer program product, including a microservice system timing anomaly detection program, which implements the steps of the microservice system timing anomaly detection method described above when executed by a processor.

[0291] The specific implementation of the computer program product of the present invention is basically the same as the embodiments of the above-mentioned microservice system timing anomaly detection method, and will not be repeated here.

[0292] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the timing anomaly detection device for a microservice system of the present invention.

[0293] In this embodiment, the microservice system timing anomaly detection device is applied to the microservice system, such as Figure 7 As shown, the microservice system timing anomaly detection device proposed in an embodiment of the present invention includes:

[0294] The data processing module 10 is used to preprocess the original multivariate time series data and convert the preprocessed original multivariate time series data into a sliding window sequence. The original multivariate time series data is multivariate time series data of the microservice system collected at different time points. The preprocessing includes normalizing the data corresponding to each time step in the original multivariate time series data.

[0295] A channel division module 20 is used to perform channel-independent division processing on the sliding window sequence to generate univariate time series of multiple channels;

[0296] The period coding module 30 is used to perform period coding on each univariate time series to generate a period coding sequence;

[0297] A feature analysis module 40 is used to input the periodic coding sequence into a pre-built enhanced temporal convolutional network model and a dynamic learning attention module for feature analysis to obtain local feature information and global feature information;

[0298] A feature fusion module 50 is configured to fuse the local feature information with the global feature information to obtain fused feature information;

[0299] Anomaly scoring module 60 is used to decode the fused feature information to generate reconstructed time series data, and perform mean square error calculation on the reconstructed time series data and the original multivariate time series data to obtain anomaly scores for each time step;

[0300] The anomaly detection module 70 is configured to perform anomaly detection on the original multivariate time series data based on the anomaly score.

[0301] This embodiment preprocesses the original multivariate time series data and converts the preprocessed original multivariate time series data into a sliding window sequence. The original multivariate time series data is multivariate time series data of a microservice system collected at different time points. The preprocessing includes standardizing the data corresponding to each time step in the original multivariate time series data, performing channel-independent division processing on the sliding window sequence, generating univariate time series of multiple channels, periodically encoding each univariate time series to generate a periodic coding sequence, inputting the periodic coding sequence into a pre-built enhanced time convolutional network model and a dynamic learning attention module for feature analysis, obtaining local feature information and global feature information, performing feature fusion on the local feature information and the global feature information to obtain fused feature information, decoding the fused feature information, generating reconstructed time series data, and comparing the reconstructed time series data with the original multivariate time series. The mean square error of the data is calculated to obtain the anomaly score of each time step, and anomaly detection is performed on the original multivariate time series data based on the anomaly score; since this embodiment generates a periodic coding sequence by preprocessing, sliding window conversion, channel independent division processing and period coding the original multivariate time series of the microservice system, feature analysis is performed on the periodic coding sequence from two branches, and the short-term local pattern and long-term dependency representation in the time series are captured by the enhanced time convolution model, and the perception of key features is enhanced. The global time domain trend and cross-variable pattern representation of the time series are captured through the dynamic learning attention module, and the feature diversity is improved. The features of the two branches are fused and input into the decoder for decoding to reconstruct the sequence, which is compared with the original multivariate time series to accurately distinguish the semantic differences of different variables in the multivariate time series data, and fully extract the relationship features of different variables in the microservice system, thereby accurately detecting abnormal timing fluctuations during the operation of the microservice system.

[0302] The microservice system timing anomaly detection device provided in this application adopts the microservice system timing anomaly detection method in the above-mentioned embodiment, which can solve the technical problem of microservice system timing anomaly detection. Compared with the existing technology, the beneficial effects of the microservice system timing anomaly detection device provided in this application are the same as the beneficial effects of the microservice system timing anomaly detection method provided in the above-mentioned embodiment, and the other technical features of the microservice system timing anomaly detection device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0303] It should be understood that the above is only an example and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any limitation on this.

[0304] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of it according to actual needs to achieve the purpose of the embodiment scheme, and no limitation is made here.

[0305] In addition, for technical details not fully described in this embodiment, please refer to the microservice system timing anomaly detection method provided in any embodiment of the present invention, and will not be repeated here.

[0306] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0307] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0308] Through the above description of the embodiments, those skilled in the art will clearly understand that the above-mentioned embodiments and methods can be implemented by means of software plus the necessary general-purpose hardware platform. Of course, hardware can also be used, but in many cases the former is a more preferred embodiment. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, a magnetic disk, or an optical disk) and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0309] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting time series anomalies in a microservice system, characterized in that: The method is applied to a microservice system, and the microservice system timing anomaly detection method includes: Preprocessing original multivariate time series data and converting the preprocessed original multivariate time series data into a sliding window sequence, wherein the original multivariate time series data is multivariate time series data of a microservice system collected at different time points, and the preprocessing includes normalizing data corresponding to each time step in the original multivariate time series data; Performing channel-independent division processing on the sliding window sequence to generate univariate time series of multiple channels; Perform period coding on each univariate time series to generate a period coding sequence; Inputting the periodic coding sequence into a pre-built enhanced temporal convolutional network model and a dynamic learning attention module for feature analysis to obtain local feature information and global feature information; Fusing the local feature information with the global feature information to obtain fused feature information; Decoding the fused feature information to generate reconstructed time series data, and performing mean square error calculation on the reconstructed time series data and the original multivariate time series data to obtain an anomaly score for each time step; performing anomaly detection on the original multivariate time series data based on the anomaly score; The step of performing period coding on each univariate time series to generate a period coding sequence includes: Perform fast Fourier transform on each univariate time series to obtain frequency domain features: in, represents a univariate time series, Represents the time index, represents the channel index, Represents frequency domain features; Adjusting the shape of the frequency domain feature to generate a first reshaping matrix and a second reshaping matrix; Perform matrix multiplication of the first reshaped matrix and the second reshaped matrix to obtain a similarity matrix: in, represents the similarity matrix, represents the first reshaped matrix, represents the second reshaped matrix; Calculate the representative period of each channel based on the similarity matrix: in, Indicates channel The representative cycle of Represents the front of the similarity matrix Similarity values, Indicates the sequence length; Determining a code length of each channel according to the representative period; Generate a random starting index based on the encoding length to determine the encoding starting position; Perform periodic coding based on the coding start position to generate a periodic coding sequence; The enhanced temporal convolutional network model includes multiple enhanced temporal convolution modules and a channel attention module; The enhanced temporal convolution module includes a causal convolution layer, a dilated convolution layer and a residual connection layer; The causal convolutional layer includes: in, represents the convolution kernel weight, represents the convolution kernel size, Represents the time point in the time series data received by the input layer The value of Represents the output result of causal convolution; The dilated convolutional layer includes: in, represents the dilated convolution result, represents the expansion rate; The residual connection layer includes: in, represents the output of the enhanced temporal convolution module, Represents the periodic encoded sequence of the original input to the enhanced temporal convolution module; The channel attention module is used to perform global average pooling on each channel along the time dimension to generate channel statistics: in, Indicates channel The channel statistics of represents the sequence length, Indicates the input sequence data The time step Time series of channels; The channel attention module is also used to generate channel weights through nonlinear transformation: in, and Represent the fully connected layer parameters, represent the compression ratio, represents the Relu activation function, represents the Sigmoid function, represents the channel attention weight, Represents the result after global average pooling; The channel attention module is further used to multiply the channel attention weight of each channel by the periodic encoding sequence of the original input of the enhanced temporal convolutional network model channel by channel: in, represents the output of the channel attention module, represents channel-wise multiplication, Represents a periodic encoded sequence of the original input to the enhanced temporal convolutional network model.

2. The microservice system timing anomaly detection method according to claim 1, characterized in that: The dynamic learning attention module is used to position-encode the periodic encoding sequence to obtain a position-encoded input sequence, and perform a linear transformation on the position-encoded input sequence to obtain a query matrix, a key matrix, and a value matrix: in, 、 、 represent the query matrix, key matrix and value matrix respectively, represents the position-encoded input sequence, 、 、 Represent the parameter matrices after training respectively; The dynamic learning attention module is also used to calculate the attention score: in, represents the attention score, represents transpose, represents the scaling factor; The dynamic learning attention module is also used to The function normalizes the attention scores to generate an attention weight matrix: in, represents the attention weight matrix; The dynamic learning attention module is also used to combine the attention weight matrix with the The learnable matrices processed by the function are added to obtain the target weight matrix: in, represents the target weight matrix, represents the learnable matrix, express function; The dynamic learning attention module is further used to perform row normalization on the target weight matrix to obtain a normalized matrix, and perform value projection on the normalized matrix to obtain an output result: in, represents the normalized matrix, Represents the target matrix Middle Rank Elements of the column, Indicates the target matrix The sum of all elements in a row, Represents the output of the dynamic learning attention module.

3. The microservice system timing anomaly detection method according to any one of claims 1 or 2, characterized in that: The fusing the local feature information with the global feature information to obtain fused feature information includes: Calculate feature fusion weight parameters based on the local feature information and the global feature information: in, represents the feature fusion weight parameter, and They represent the learnable parameters, represents the output result of the enhanced temporal convolution module, wherein the output result of the enhanced temporal convolution module includes local feature information, represents the output result of the dynamic learning attention module, wherein the output result of the dynamic learning attention module includes global feature information, Indicates the concatenation of local feature information and global feature information; The local feature information and the global feature information are linearly combined according to the feature fusion weight parameter to obtain fused feature information: in, Represents fusion feature information; The gradient parameter of the feature fusion weight parameter is calculated by the loss function, and the feature fusion weight parameter is updated based on the gradient parameter: in, represents the gradient parameter, represents the loss function, represents the rate of change of the loss function, Represents the time step The fusion feature information, Represents the enhanced temporal convolutional network model with dynamic learning attention module at time step The output difference, Represents the enhanced temporal convolutional network model at time step The output result is, Denotes the dynamic learning attention module at time step The output result; The fused feature information is updated based on the updated feature fusion weight parameter to obtain updated fused feature information.

4. The microservice system timing anomaly detection method according to any one of claims 1 or 2, characterized in that: The performing anomaly detection on the original multivariate time series data based on the anomaly score includes: Determine the initial score threshold based on the preset risk probability; Constructing a cumulative distribution function of the anomaly score based on the initial score threshold, the cumulative distribution function comprising: in, represents the initial score threshold, represents the anomaly score, represents the scale parameter, represents the shape parameter, represents the cumulative distribution function; Determine the target score threshold according to the cumulative distribution function and the initial score threshold: in, represents the total number of data samples in the original multivariate time series data after preprocessing, Indicates that the anomaly score exceeds the initial threshold The number of samples, represents the target score threshold; Anomaly detection is performed on the original multivariate time series data based on the target score threshold and the anomaly score.

5. A microservice system timing anomaly detection device, characterized in that: The device is applied to a microservice system, and the microservice system timing anomaly detection device includes: A data processing module is used to preprocess the original multivariate time series data and convert the preprocessed original multivariate time series data into a sliding window sequence. The original multivariate time series data is multivariate time series data of the microservice system collected at different time points. The preprocessing includes standardizing the data corresponding to each time step in the original multivariate time series data. A channel division module is used to perform channel-independent division processing on the sliding window sequence to generate univariate time series of multiple channels; The period coding module is used to perform period coding on each univariate time series and generate a period coding sequence; A feature analysis module is used to input the periodic coding sequence into a pre-built enhanced temporal convolutional network model and a dynamic learning attention module for feature analysis to obtain local feature information and global feature information; A feature fusion module, configured to fuse the local feature information with the global feature information to obtain fused feature information; An anomaly scoring module is used to decode the fused feature information to generate reconstructed time series data, and calculate the mean square error between the reconstructed time series data and the original multivariate time series data to obtain an anomaly score for each time step; an anomaly detection module, configured to perform anomaly detection on the original multivariate time series data based on the anomaly score; The periodic encoding module is also used to perform fast Fourier transform on each univariate time series to obtain frequency domain features: in, represents a univariate time series, Represents the time index, represents the channel index, Represents frequency domain features; The shape of the frequency domain feature is adjusted to generate a first reshaping matrix and a second reshaping matrix; the first reshaping matrix and the second reshaping matrix are matrix multiplied to obtain a similarity matrix: in, represents the similarity matrix, represents the first reshaped matrix, represents the second reshaped matrix; Calculate the representative period of each channel based on the similarity matrix: in, Indicates channel The representative cycle of Represents the front of the similarity matrix Similarity values, Indicates the sequence length; Determine the code length of each channel according to the representative period; generate a random starting index based on the code length to determine the code starting position; perform periodic coding based on the code starting position to generate a periodic code sequence; The enhanced temporal convolutional network model includes multiple enhanced temporal convolution modules and a channel attention module; The enhanced temporal convolution module includes a causal convolution layer, a dilated convolution layer and a residual connection layer; The causal convolutional layer includes: in, represents the convolution kernel weight, represents the convolution kernel size, Represents the time point in the time series data received by the input layer The value of Represents the output result of causal convolution; The dilated convolutional layer includes: in, represents the dilated convolution result, represents the expansion rate; The residual connection layer includes: in, represents the output of the enhanced temporal convolution module, Represents the periodic encoded sequence of the original input to the enhanced temporal convolution module; The channel attention module is used to perform global average pooling on each channel along the time dimension to generate channel statistics: in, Indicates channel The channel statistics of represents the sequence length, Indicates the input sequence data The time step Time series of channels; The channel attention module is also used to generate channel weights through nonlinear transformation: in, and Represent the fully connected layer parameters, represent the compression ratio, represents the Relu activation function, represents the Sigmoid function, represents the channel attention weight, Represents the result after global average pooling; The channel attention module is further used to multiply the channel attention weight of each channel by the periodic encoding sequence of the original input of the enhanced temporal convolutional network model channel by channel: in, represents the output of the channel attention module, represents channel-wise multiplication, Represents a periodic encoded sequence of the original input to the enhanced temporal convolutional network model.

6. A microservice system timing anomaly detection device, characterized in that: The microservice system timing anomaly detection device includes: a memory, a processor, and a microservice system timing anomaly detection program stored in the memory and executable on the processor, wherein the microservice system timing anomaly detection program is configured to implement the microservice system timing anomaly detection method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a microservice system timing anomaly detection program, which, when executed by a processor, implements the microservice system timing anomaly detection method according to any one of claims 1 to 4.

8. A computer program product, characterized in that The computer program product includes a microservice system timing anomaly detection program, which, when executed by a processor, implements the steps of the microservice system timing anomaly detection method according to any one of claims 1 to 4.

Images