Microservice system fault root cause positioning method based on graph attention network

Abstract

The invention discloses a micro-service system fault root cause positioning method based on a graph attention network, and relates to the technical field of intelligent software engineering, and the method comprises the steps: constructing a service calling link; acquiring index data corresponding to the service instance in the service calling link according to an index under a preset service measurement index level; according to the index data, extracting an index causal relationship, constructing a service index causal graph, and updating the service index causal graph to obtain an updated service index causal graph; performing feature extraction on the updated service index causality graph and index data by adopting a trained graph attention-based network to obtain an abnormal root cause result; wherein the trained graph-based attention network takes data of a preset category as a training data set, and the initial graph-based attention network is trained to obtain the trained graph-based attention network. The causal result discovery accuracy can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of intelligent software engineering, and specifically relates to a method for locating the root cause of microservice system faults based on a graph attention network. Background Art

[0002] The purpose of locating the root cause of microservice architecture system failures is to accurately trace the failures caused by the system. It is a core task in intelligent operation and maintenance (AIOps) and system reliability engineering, and has important practical significance for improving system reliability and reducing operation and maintenance costs.

[0003] Modern microservices architectures, with their distributed deployment, dynamic scalability, high concurrency, and massive data volumes, improve system flexibility and scalability while also introducing significant operational complexity. This dynamic and variable nature, deep coupling between services, and large-scale cluster management make rapid diagnosis and root cause location of system failures challenging. These challenges include complex service call chains, unclear anomaly propagation paths, inaccurate fault tracing, and poor explainability, all impacting system stability.

[0004] Therefore, there is an urgent need to provide a method for locating the root cause of microservice system failures to improve the above technical problems. Summary of the Invention

[0005] To address the above-mentioned problems in the prior art, the present invention provides a method for locating the root cause of microservice system failures based on a graph attention network. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] In a first aspect, the present invention provides a method for locating the root cause of a microservice system fault based on a graph attention network, comprising:

[0007] Constructing a service call link; the service call link includes multiple service instance groups of different types, and a service instance group of the same type includes at least one service instance;

[0008] Collect the indicator data corresponding to the service instance in the service call link according to the indicators under the preset service measurement indicator level;

[0009] Extract indicator causal relationships based on indicator data; construct a service indicator causal graph based on the indicator causal relationships, and update the service indicator causal graph to obtain an updated service indicator causal graph;

[0010] The trained graph-based attention network is used to extract features from the updated service indicator causal graph and indicator data to obtain the abnormal root cause results; wherein, the trained graph-based attention network uses the preset category data as the training data set to train the initial graph-based attention network.

[0011] Beneficial effects of the present invention:

[0012] The present invention provides a method for locating the root cause of microservice system faults based on a graph attention network. On the one hand, when discovering causal relationships between indicators, by analyzing indicator data at the service instance level, it is possible to more finely capture the dynamics of service behavior and reflect the system status. Moreover, in the process of identifying the parent node of the indicator, by considering the call dependency relationship between services and the propagation influence relationship between indicators of different categories, the computational complexity of the model is reduced, the influence of correlation is reduced, and the accuracy of causal discovery is further improved. On the other hand, the use of instance-level data can better reflect the changes in abnormal characteristics of the system. The attention mechanism can fully combine the indicator causal graph to analyze the fault propagation path, thereby improving the accuracy and interpretability of root cause location. Moreover, training can be performed without abnormal labels. By distinguishing the differences between the characteristics of the system when it is normal and when it is abnormal, unsupervised root cause location can be completed, and new types of faults that may occur in the system can be dealt with.

[0013] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flow chart of a method for locating the root cause of a microservice system fault based on a graph attention network provided by an embodiment of the present invention;

[0015] Figure 2 This is a flow chart of constructing a service call link provided by an embodiment of the present invention;

[0016] Figure 3 This is a flow chart for obtaining a service indicator cause-and-effect diagram provided by an embodiment of the present invention;

[0017] Figure 4 This is a flowchart of a root cause localization method based on a graph attention network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0019] A microservices architecture system breaks down a monolithic application into a set of independently run microservices. Each service is responsible for a single business function and is independently deployed, while services collaborate with each other through lightweight communication. However, the distributed nature of microservices software increases the complexity of software operation, leading to more uncertain failures such as resource contention, environmental configuration, and fault propagation. Furthermore, due to the massive scale of the system architecture and the complex dependencies between components such as databases and containers, single point failures can trigger complex chain reactions, making current manual or automated operations and maintenance models unsuitable. For example, the system contains a massive amount of log and metric data that can be monitored, which places enormous pressure on system management and reduces the ability to process key indicators.

[0020] Existing solutions primarily analyze and model runtime data from microservice-based software, such as metrics, call chains, system logs, and deployment structures, and use machine learning or graph reasoning to locate the root cause of faults. Methods based on vector embedding and neural network models extract anomaly features from runtime data collected through monitoring. Based on inter-service call dependencies and deployment structure relationships, neural networks are trained on historical fault information to construct a baseline model that serves as a basis for determining software fault types and locating the root cause. Methods that build relevant graphical models based on system runtime data generally analyze system data thoroughly, deeply exploring the correlation between system fault characteristics and root causes, and further constructing graphical models such as influence graphs and causal graphs. These models are then used to determine the impact of fault propagation and locate the root cause of the fault. For example, Meng Y et al. proposed a framework, MicroCause, for accurately locating root cause monitoring indicators in microservices. This approach uses an improved PC algorithm to learn the causal relationships between monitoring indicators and proposes a temporal cause-guided random walk algorithm to infer the top N root causes of microservice faults using causal graphs. Wu L et al. continuously collected and tested service quality indicators (SLOs) to determine faults and associated faults with metrics. They then combined service deployment and fault propagation for modeling, constructed a property graph that included services and hosts, and adopted an improved Personalized PageRank algorithm. By calculating the correlation between different nodes based on the Pearson correlation coefficient as the weight in the Personalized PageRank algorithm, they further inferred the root cause and completed the root cause location work.

[0021] Existing methods for mining correlations in historical fault data using neural networks suffer from weak interpretability when performing fault diagnosis. The fusion and embedding of multiple modal data lacks detailed explanations of the fault's cause. Furthermore, while this operational data is large in volume, it is sparse and suffers from issues such as a lack of abnormal data samples, uneven sample distribution, a lack of ground truth labels, and significant noise interference, which severely impacts the quality of operational models. Currently, most fault diagnosis methods based on graph models employ algorithms such as random walks and PageRank. These methods simulate fault propagation behavior by calculating similarities or correlations between nodes to determine a ranking of root causes. However, these methods lack the ability to express graph node features, are limited in their ability to capture global graph properties, and are incapable of adapting to dynamic changes in nodes or edges. Some research has also used service call graphs as a basis. While graph neural networks are used to learn all service metrics as node features, static call graphs are difficult to handle the dynamic and changing service impact relationships, and their localization granularity is coarse, resulting in a lack of interpretability.

[0022] In response to the shortcomings of the above-mentioned prior art, the present invention proposes a method for locating the root cause of microservice system faults based on a graph attention network. First, when discovering the causal relationship of service indicators, factors such as multiple instances of service deployment and service dependencies are considered to establish a comprehensive service indicator causal graph model to realize the mining of complex correlations between service indicators; secondly, the graph attention mechanism can give different weights to neighbor nodes in the causal graph, so that the feature aggregation of each node can be dynamically adjusted according to the relative importance of neighbor nodes, and the key path of anomaly propagation is discovered, thereby improving the flexibility and expression ability of the model. In addition, multiple instances of the service can be used as features in the calculation process to more accurately capture the influence relationship between different nodes and adapt to the feature changes of the microservice system, so as to further identify the system root cause node through feature anomaly scoring and complete the microservice root cause location task.

[0023] See Figure 1 , Figure 1 This is a flowchart of a method for locating the root cause of a microservice system fault based on a graph attention network provided by an embodiment of the present invention. The method for locating the root cause of a microservice system fault based on a graph attention network provided by the present invention includes:

[0024] S101. Construct a service call link. The service call link includes multiple service instance groups of different types, and a service instance group of the same type includes at least one service instance.

[0025] Specifically, in this embodiment, some relatively complete service discovery and link tracking mechanisms already available in the microservice software system are utilized to collect and parse the communication data between microservice components, and obtain the call information (tracing) between microservices. This embodiment records the service call sequence related to a single user request through distributed tracing technology for each microservice instance call relationship and instance deployment relationship, and constructs a service call link to model complex service dependencies. It can be understood that this embodiment uses multi-tuples and directed edges to represent service instances and service call information respectively, so as to more clearly reflect the calling process within the microservice system. The service call link represents the call request of the microservice as a directed graph, and each node in the graph represents a separate microservice request, which originates from a working node instance in the Kubernetes cluster. The information format of each service instance is defined as follows:

[0026] S i =(trace_id,span_id,parent_id,instance_id,service_id,info);

[0027] Among them, trace_id is a globally unique identifier, which represents the execution process of a transaction or request in a distributed system. It can ensure that even between different nodes in the distributed system, each request link can be uniquely identified by using a globally unique identifier to identify the entire request link. span_id represents a single microservice operation or stage. parent_id represents the parent node that records the call of the microservice operation. The call link view of the entire request can be restored by recording the upstream span_id information. instance_id represents the identifier of the service instance group, which identifies the service instance that executes a specific work unit at a specific point in time. It is very useful for distinguishing different instances of the same service, especially in container-based deployments, where multiple instances of the same service may run simultaneously. service_id represents the logical identifier of the service, which identifies the service type that executes the work unit. info represents the specific information of the service instance, which can be represented by a multi-tuple including the service node where the service instance group is deployed, the start and end time of the service instance call, the status code of the request success or failure, and other information. The construction process of the call link in the entire process of system interaction is as follows: Figure 2 As shown, Figure 2This is a flowchart for constructing a service call link provided by an embodiment of the present invention. According to the information collected by the method of the present invention, each service call operation will record its own span_id information and pass the trace_id at each link of the request link. Through a directed acyclic graph composed of multiple span_ids, a complete service call link is constructed.

[0028] S102: Collect indicator data corresponding to service instances in the service call link according to the indicators under the preset service measurement indicator level.

[0029] Specifically, in this embodiment, in a microservice architecture system, monitoring indicators can be divided into multiple categories based on the different layers of the system. Specific indicators within these layers can reflect the system's health, performance, reliability, and business effectiveness from different perspectives. This embodiment divides service metrics into traffic, resource, status, and quality layers based on the different types of faults in the microservice system and the changes in indicators caused by these faults. Each layer includes at least one indicator.

[0030] For the service indicators that need to be collected, this embodiment collects indicator data based on the Prometheus monitoring tool and stores the data in a time series database. The specific data format is defined as follows:

[0031] I t ={tag ID, tag type, collection time, collection value};

[0032] The tag ID indicates the service instance where the current indicator is located, and the tag type indicates the type of the indicator.

[0033] In order to accurately evaluate the performance, resources, business, and reliability of the microservice system and comprehensively reflect the system's operating status and business performance, the present invention selects the KPI indicators shown in Table 1 for monitoring.

[0034] Table 1 System monitoring indicator types

[0035]

[0036] S103. Extract indicator causal relationships based on indicator data; construct a service indicator causal graph based on the indicator causal relationships, and update the service indicator causal graph to obtain an updated service indicator causal graph.

[0037] Specifically, see Figure 3 , Figure 3 This is a flow chart of obtaining a causal graph of service indicators provided by an embodiment of the present invention. In this embodiment, the causal relationship extraction of service indicators refers to the process of recording the service S. The value of the ith metric (e.g., response time, CPU utilization, etc.) of the jth service instance of service S in the tth time period. Set the set Represents the parent node set of the current indicator; calculates the causal relationship between the current indicator and the indicators in the parent node set of the current indicator, expressed as:

[0038] The strength of the causal relationship is measured by using the nonlinear transformation of the polynomial function to measure the strength of the relationship between the child indicator and the parent indicator. ijt Residual is the difference between the actual observed value and the estimated value, which is used to evaluate the accuracy of the model and the goodness of fit of the data. Indicates the value of the i-th metric of the j-th service instance in the t-th time period.

[0039] It is understood that the task of the causal structure estimation algorithm provided above is to identify each metric Parent of and causal functions Given the set of causal parents for each child indicator, the estimator f i Estimate the strength of the relationship between a parent indicator and its child indicators.

[0040] Furthermore, in this embodiment, the service indicator cause-effect graph is updated to obtain an updated service indicator cause-effect graph, including:

[0041] Initialize the service indicator causal graph; calculate the score of the service indicator causal graph using the scoring function; wherein, this embodiment flattens the instance-level data of the current indicator, expands multiple instance indicators of the same service into independent samples, and participates in the calculation as a whole data sequence;

[0042] Using the call dependency relationships obtained from service monitoring, the parent nodes corresponding to the current node in the service indicator causal graph are filtered to add or delete edges and generate a new service indicator causal graph. The new service indicator causal graph is scored using a scoring function.

[0043] Based on the score Score(G,D) of the service indicator causal graph and the score Score(G′,D) of the new service indicator causal graph, calculate the difference ΔS = Score(G′,D) - Score(G,D). If the difference is greater than 0, save the new service indicator causal graph; where G′ represents the new service indicator causal graph, G represents the service indicator causal graph, and D represents the indicator data;

[0044] Repeat this process until the preset number of iterations is reached or the preset requirements are met, and an updated service indicator cause-and-effect diagram is obtained.

[0045] It can be understood that if the score of the new service indicator causal diagram is improved in a certain operation, then ΔS>0, which means that the operation can positively improve the quality of the causal diagram; the new service indicator causal diagram is obtained repeatedly until the score cannot be further improved or the maximum number of iterations is reached, then the operation is terminated to obtain the updated service indicator causal diagram.

[0046] This example uses a penalized version of the Bayesian Information Criterion (BIC) as a scoring function, maximizing this function to select an appropriate causal structure for continuous variables. The scoring function is expressed as:

[0047]

[0048] in, represents the maximum likelihood estimate, k represents the number of parameters, n i It represents the sample size of indicator i, that is, within the data collection time T, the data of indicator i is collected once every interval t to form a sample of indicator i.

[0049] S104. Use the trained graph-based attention network to extract features from the updated service indicator causal graph and indicator data to obtain abnormal root cause results; wherein, the trained graph-based attention network uses preset category data as a training data set to train the initial graph-based attention network.

[0050] Specifically, see Figure 4 , Figure 4 This is a flow chart of a root cause location method based on a graph attention network provided by an embodiment of the present invention. In this embodiment, the trained graph attention network includes a trained feature extraction layer and a trained output layer. The trained graph attention network is used to extract features from the updated service indicator causal graph and indicator data to obtain abnormal root cause results, including:

[0051] S1041. In each abnormal time window of the system, by collecting indicator data separately at fixed time intervals and using them as the time series indicator source data of the current fault, the indicator data on different service instances in the service instance group corresponding to the same indicator are vector-joined to obtain the characteristic vector S′ of the service S indicator i. it , expressed as:

[0052] S′ it ={S1 it ||S2 it ||...||Sj it};

[0053] Among them, Sj it represents the index value of the j-th service instance of service S;

[0054] S1042. Input the updated service indicator causal graph and feature vector into the trained feature extraction layer, calculate the attention coefficient, and aggregate the node neighborhood features to extract the features of each node; wherein, the updated service indicator causal graph G(V,E) is used as the adjacency matrix of the trained graph attention network, and each node V is associated with a feature vector S′ it associated.

[0055] It can be understood that the dependency between nodes is dynamically learned through the attention mechanism, and the feature representations of the nodes are aggregated to update the feature representation of each node.

[0056] In this embodiment, the size of the attention coefficient measures the importance of neighboring nodes to the current node. By assigning different weights to different service indicators, it supports capturing the relationship between certain services that have a greater impact on the overall system, making the model more flexible in dealing with the complex and changing characteristics of microservice systems. The expression for calculating the attention coefficient is:

[0057]

[0058] Among them, a ij represents the attention coefficient, Pa(V i ) represents node V i The parent node set, || represents the feature concatenation operation, LeakyReLU(·) represents the nonlinear activation function operation, W a Represents a trainable weight vector, W represents a learnable parameter matrix for linear transformation of node features, V i (S′ it ) represents node V i The eigenvector S′ it .

[0059] It should be noted that in the service indicator causal graph, the child node is only affected by its parent node. For a child node without a parent node, a is defined as ij =0(j≠i) and a ii =1.

[0060] In this embodiment, considering the causal relationship between service indicators, each node usually contains multiple parent nodes. In order to improve the model's ability to express the system state, a multi-head attention mechanism is introduced to aggregate node features. The above-mentioned attention coefficient is used to perform independent feature aggregation on each head, that is, the representation of each node is calculated as a linear combination of its parent node features. Finally, the representation results of all attention heads are weighted averaged to obtain the feature representation of each node to reflect the system indicator characteristics. Each node V i Extracted features Expressed as:

[0061]

[0062] Where σ represents the activation function, ψ represents the total number of attention heads, Represents node V i With any of its parent nodes V j The attention coefficient between ψ represents the learnable transformation matrix in the attention head, V j (S′ jt ) represents node V j The eigenvector S′ jt .

[0063] S1043. Input the features extracted from each node into the trained multi-layer perceptron in the output layer for operation to obtain the root cause score of each node.

[0064] In this embodiment, after extracting the features of the service indicator causal graph, the system status feature information represented by each node and edge can be obtained. On this basis, the abnormality score of each node is calculated through the node features, and the abnormally serious nodes are found as potential causes. Specifically, a root cause score is calculated for each node through a multi-layer perceptron (MLP). Therefore, the final feature contains the global context information of the node. The present invention uses MLP to learn the mapping relationship between different node features and root cause scores, so that the root cause score can effectively describe the importance or abnormality of each node, thereby quantifying the possibility of each service indicator node as a fault source to support further accurate fault root cause location. The root cause score of each node RootCauseScore i Expressed as:

[0065]

[0066] Here, MLP(·) represents a multi-layer perceptron. The multi-layer perceptron receives the node features generated by the feature extraction layer, undergoes linear transformations in several fully connected layers, and uses the Sigmoid function to normalize the results. This can convert the node features into a scalar to provide an intuitive measurement of the status of each service indicator in the system. Represents the features extracted from each node.

[0067] In this embodiment, the training process of the trained graph attention network includes:

[0068] Obtain data from multiple preset categories as samples, construct a training dataset, and obtain the true labels of the samples in the training dataset; the preset category data includes service indicator cause-and-effect diagrams and indicator data;

[0069] Input some samples in the training data set into the j-th graph-based attention network to be trained for training, and obtain the prediction results output during the j-th training process;

[0070] Calculate the classification loss based on the prediction results output during the j-th training process and the true labels of the samples based on the graph attention network to be trained for the j-th training process, and use it as the classification loss of the j-th training process;

[0071] Backpropagation is performed based on the classification loss of the j-th training process to update the network parameters of the j-th graph-based attention network to be trained, and the j+1-th graph-based attention network to be trained is obtained; this is iterated until the number of training times or the degree of convergence meets the preset conditions, and a trained graph-based attention network is obtained.

[0072] Furthermore, in order to improve the accuracy of the model and better support the representation and discovery of abnormal node features, cross-entropy (CE) is used as the loss function to measure the difference between the system state measured by the model and the true state. The function for calculating the loss is expressed as:

[0073]

[0074] Where n represents the number of samples, m represents the number of different system states (labels), and x ij and y ij are the true value and estimated label, respectively. During training, by minimizing the aforementioned loss function, the model learns root cause scores that are as close to the true value as possible, effectively distinguishing between normal and abnormal node features. This method enables the model to be trained without anomaly labels using data from normal system states, thus achieving unsupervised root cause score calculation.

[0075] Finally, after multiple layers of feature extraction and propagation, node features are updated layer by layer. Attention weights derived from these node features reflect the importance of edges in the anomaly propagation path. Based on the calculated node root cause scores and anomaly propagation paths, the attention weights and node root cause scores of each edge on the constructed causal graph can be analyzed to further identify the source of the fault. The indicator information represented by the abnormal node is output, completing the root cause location task.

[0076] In summary, the present invention provides a method for locating the root cause of microservice system faults based on a graph attention network, which has the following beneficial effects:

[0077] First, the present invention uses instance-level data of services to complete the construction of service indicator causal graphs, which can capture service behavior dynamics more precisely and reflect system status. It can also adapt to the dynamic changes of microservice system characteristics through the attention mechanism, thereby improving the effectiveness and accuracy of fault root cause location.

[0078] Second, the present invention uses existing open source software monitoring technology to obtain operation and maintenance data at low cost, and realizes automatic processing and analysis of operation and maintenance data through root cause location method, thereby reducing the operation and maintenance cost of manual analysis of microservice systems.

[0079] Third, the method of the present invention can be trained without abnormal labels. By distinguishing the differences between the characteristics of the system when it is normal and when it is abnormal, it can complete unsupervised root cause location, can deal with new types of faults that occur in the system, and has strong flexibility.

[0080] Fourth, the final root cause location result of the present invention can assist operation and maintenance personnel in quickly recovering from system failures, thereby achieving a high-quality operation and maintenance process to ensure system stability.

[0081] It should be noted that, in this document, relational terms such as first and second are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not explicitly listed. Without further limitation, an element defined by the phrase "comprising a..." does not preclude the presence of additional identical elements in the article or device comprising the element. Terms such as "connected" or "connected" are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. References to orientations or positional relationships, such as "upper," "lower," "left," and "right," are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate description and simplify the description of the present invention. They do not indicate or imply that the device or element referred to must have, be constructed, or operate in a specific orientation, and are therefore not to be construed as limiting the present invention.

[0082] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0083] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for locating the root cause of microservice system failures based on graph attention network, characterized in that: include: Build a service call link; The service call link includes a plurality of service instance groups of different types, and a service instance group of the same type includes at least one service instance; Collecting indicator data corresponding to the service instance in the service call link according to the indicators under the preset service measurement indicator level; Extracting the indicator causal relationship according to the indicator data; constructing a service indicator causal graph according to the indicator causal relationship, and updating the service indicator causal graph to obtain an updated service indicator causal graph; A trained graph-based attention network is used to perform feature extraction on the updated service indicator causal graph and the indicator data to obtain abnormal root cause results; wherein, the trained graph-based attention network uses preset category data as a training data set to train the initial graph-based attention network.

2. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 1 is characterized in that: The information of the service instance is represented as follows: S i =(trace_id,span_id,parent_id,instance_id,service_id,info); Among them, trace_id represents a globally unique identifier, span_id represents a single microservice operation or stage, parent_id represents the parent node that records the call to the microservice operation, instance_id represents the identifier of the service instance group, service_id represents the logical identifier of the service, and info represents the specific information of the service instance.

3. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 1 is characterized in that: Extracting the causal relationship of the indicators based on the indicator data includes: Setting Collection Represents the parent node set of the current indicator; Calculate the causal relationship between the current indicator and the indicators in the parent node set of the current indicator, expressed as: in, Indicates the strength of the causal relationship between the current indicator of the service and the indicators in the parent node set of the current indicator, e ijt represents the residual, Indicates the value of the i-th indicator of the j-th service instance of service S in the t-th time period.

4. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 1 is characterized in that: The service indicator cause-effect graph is updated to obtain an updated service indicator cause-effect graph, including: Initializing the service indicator causal graph; calculating the score of the service indicator causal graph using a scoring function; Filter the parent node corresponding to the current node in the service indicator causal graph to implement the operation of adding or deleting edges, and generate a new service indicator causal graph; calculate the score of the new service indicator causal graph through the scoring function; According to the score Score(G, D) of the service indicator causal graph and the score Score(G′, D) of the new service indicator causal graph, calculate the difference ΔS=Score(G′, D)-Score(G, D). If the difference is greater than 0, save the new service indicator causal graph; where G′ represents the new service indicator causal graph, G represents the service indicator causal graph, and D represents the indicator data; Repeat this process until the preset number of iterations is reached or the preset requirements are met, and an updated service indicator cause-and-effect diagram is obtained.

5. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 4 is characterized in that: The expression of the scoring function is: in, represents the maximum likelihood estimate, k represents the number of parameters, n i represents the sample size of indicator i.

6. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 1 is characterized in that: The trained graph-based attention network includes a trained feature extraction layer and a trained output layer; The trained graph-based attention network is used to perform feature extraction on the updated service indicator causal graph and the indicator data to obtain abnormal root cause results, including: The indicator data of different service instances in the service instance group corresponding to the same indicator are vector-joined to obtain the characteristic vector S′ of service S indicator i it , expressed as: S′ it ={S1 it ||S2 it ||...||Sj it }; Among them, Sj it represents the index value of the j-th service instance of service S; The updated service indicator causal graph and feature vector are input into the trained feature extraction layer to calculate the attention coefficient and node neighborhood feature aggregation to extract the features of each node; wherein, the updated service indicator causal graph G(V,E) is used as the adjacency matrix of the trained graph attention network, and each node V is associated with a feature vector S′ it associated; The features extracted from each node are input into the trained multi-layer perceptron in the output layer to obtain the root cause score of each node.

7. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 6 is characterized in that: The expression for calculating the attention coefficient is: Among them, a ij represents the attention coefficient, Pa(V i ) represents node V i The parent node set, || represents the feature concatenation operation, LeakyReLU(·) represents the nonlinear activation function operation, W a Represents a trainable weight vector, W represents a learnable parameter matrix for linear transformation of node features, V i (S′ it ) represents node V i The eigenvector S′ it .

8. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 6 is characterized in that: Each node V i The extracted features V i final Expressed as: Where σ represents the activation function, ψ represents the total number of attention heads, Represents node V i With any of its parent nodes V j The attention coefficient between ψ represents the learnable transformation matrix in the attention head, V j (S′ jt ) represents node V j The eigenvector S′ jt .

9. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 6, characterized in that: The root cause score of each node RootCauseScore i Expressed as: RootCauseScore i =MLP(V i final ); Among them, MLP(·) represents a multi-layer perceptron, V i final Represents the features extracted from each node.

10. The method for locating the root cause of a microservice system fault based on a graph attention network according to claim 1, characterized in that: The training process of the trained graph attention network includes: Acquire data of a plurality of preset categories as samples, construct a training data set, and obtain true labels of the samples in the training data set; the data of the preset categories include a service indicator causal diagram and indicator data; Input some samples in the training data set into the j-th graph-based attention network to be trained for training, and obtain the prediction results output during the j-th training process; Calculate the classification loss based on the prediction results output during the j-th training process and the true labels of the samples based on the graph attention network to be trained for the j-th training process, and use it as the classification loss of the j-th training process; Backpropagation is performed according to the classification loss of the j-th training process to update the network parameters of the j-th graph attention-based network to be trained, and the j+1-th graph attention-based network to be trained is obtained; this is iterated until the number of training times or the degree of convergence meets the preset conditions, and the trained graph attention-based network is obtained.

Images