Unsupervised micro-service Trace anomaly detection method based on graph attention network

Abstract

The invention belongs to the technical field of microservice system anomaly detection, and discloses a Trace anomaly detection method under a microservice architecture based on a graph attention network. A service operation graph (SOG) is constructed to serve as a mesoscopic layer trace representation method, and the graph representation granularity and efficiency of an existing method are balanced. Meanwhile, a group of delay-related features and error propagation modes are extracted as multi-dimensional edge features to be integrated into the SOG, and interaction information between services is fully utilized to improve the accuracy of anomaly detection. In order to capture various index data generated in the service and a calling relation between the services, the characteristics of nodes and edges of SOG are learned through GAT, and a graph embedding vector of a trace is obtained. And a hypersphere loss function training model is utilized to avoid dependence on labels, normal traces are gathered to a hypersphere center, and traces far away from the hypersphere center are regarded as anomalies.

Description

Technical Field

[0001] The present invention belongs to the technical field of microservice system anomaly detection, and is an unsupervised microservice trace anomaly detection method based on a graph attention network. Background Art

[0002] With the rapid development and expansion of modern internet services, the microservices architecture has become a mainstream choice for building highly available and scalable distributed systems. Microservices decompose complex business processes into multiple small service modules, each of which can be independently developed, deployed, and maintained. They support dynamic scaling on demand, offering strong flexibility and maintainability. However, the distributed nature of microservices significantly increases system complexity, creating challenges for fault diagnosis, performance monitoring, and anomaly detection. For example, a service failure can trigger a chain reaction through the service call chain; anomalies can propagate across multiple services, making it difficult to trace the root cause; and anomalies can manifest in various forms, such as latency, incorrect status codes, and abnormal resource usage. Therefore, implementing real-time and accurate anomaly detection in microservices systems is crucial. This not only affects the maintenance of system health but also directly impacts service quality and user experience. Effective anomaly detection mechanisms can provide early warning of potential issues, prevent failures, significantly reduce recovery time, optimize operational efficiency, and fundamentally improve system performance and reliability.

[0003] In a microservices system, when a user initiates a business function request (for example, clicking "Unfollow" on a social networking platform), multiple service instances respond to the request and perform a series of operations. During this process, each called service instance creates a new span. This span records detailed information about the corresponding service instance's execution, such as the span's timestamp and operation name. These calls and their relationships constitute a call chain (trace). Based on this data, a trace can clearly describe the response time of each span and the call relationships between services, providing valuable insights for system performance analysis and troubleshooting. A trace typically consists of three fields: TraceID, Spans, and Processes. Together, these three fields provide a detailed view of the request lifecycle. 1) TraceID: This uniquely identifies a request in a microservices system. It helps track the flow of requests between services in a microservices architecture, enabling comprehensive monitoring of the entire system. 2) Spans: Each span represents a single execution of a service instance and has a unique SpanID. A span contains the following information: SpanID, a unique identifier for the span; OperationName, the name of the span's operation, representing the specific task of each microservice. References: The ID of the parent span, used to identify the parent span that called the current span, reflecting the calling relationship between the parent and child spans. StartTime and Latency: The start time and duration of the current span, respectively. Tags: Additional contextual information, such as HTTP status codes. ProcessID: The identifier of the corresponding service instance. 3) Processes: Records information about the service instance.

[0004] The following table shows a trace collected using Jaegertracing in SocialNetwork (a broadcast-based social network). Its trace ID is 1dedfb058429aa77. Table 1a shows the contents of the Spans in this trace, and Table 1b shows the contents of the Processes. This structured data record provides a comprehensive view of the request, including the processing time of each service, the call sequence, and the dependencies between services.

[0005] surface a Example of Spans for a trace collected via Jaeger

[0006]

[0007] Table 1b. Processes example of trace collected by Jaeger

[0008]

[0009] Graph Attention Networks (GAT) are advanced graph neural network models specifically designed to process graph-structured data, learn feature representations from graph-structured data, and perform various tasks such as node and graph classification. By incorporating an attention mechanism and performing weighted aggregation of neighboring nodes, GAT automatically learns and optimizes the connectivity between nodes. GAT assigns different weights to each node's neighbors, which are independent of the graph structure and depend entirely on the node's characteristics. This mechanism not only improves the model's expressiveness but also enables GAT to excel at handling directed and dynamic graphs. Furthermore, GAT's attention mechanism imparts a degree of interpretability to the model, making it more adaptable to complex graph-structured data.

[0010] The core of trace anomaly detection lies in the representation of trace data. Trace representation methods are mainly divided into two categories: serialized representation and graph representation. Serialized representation mainly includes feature vector representation and deep sequence modeling. Graph representation, on the other hand, mainly includes service graphs and span graphs. Graph representation is the most commonly used technique because it effectively represents the call relationships between services. These techniques construct a graph structure by using services or spans as nodes and call relationships as edges. They then analyze the graph's characteristics to identify abnormal call patterns.

[0011] Deep learning can extract patterns and features from data to automatically distinguish erroneous traces. To automatically extract features, deep learning is applied to trace anomaly detection. Because traces contain large amounts of delayed data, many methods use methods such as variational autoencoders to detect abnormal behavior. For example, the core idea of ​​TraceAnomaly (call chain anomaly detection) is to encode the trace into a service call chain vector (STV). Using a variational autoencoder, the method automatically learns the overall normal pattern of the trace to detect whether a new trace is an anomaly.

[0012] The main problems with the existing technology are:

[0013] (1) Trace graphs have an unbalanced granularity. In a service graph, nodes represent services, and all spans of the same service are aggregated into one node to reduce complexity. This does not distinguish between specific operations within the service, and therefore cannot reflect performance bottlenecks within a single service. In a span graph, each node represents a span. While this can capture fine-grained information, the number of nodes in a span graph can be very large in large-scale systems. This significantly increases the complexity of the graph, making analysis more difficult. Furthermore, multiple spans for the same operation generate a large amount of duplicate information, adding unnecessary analysis overhead.

[0014] (2) Insufficient utilization of interaction information between services. Some methods ignore important information contained in the interaction between services, such as delay and error status code. On the other hand, some methods average and aggregate the interaction information and use it as node features, resulting in insufficient utilization of information and limited anomaly detection effect.

[0015] (3) Strong label dependence. Most deep learning methods rely on a large amount of labeled data for training. However, in actual microservice systems, the amount of trace data is huge, which makes the cost of trace data labeling extremely high. Summary of the Invention

[0016] Existing trace graph representation methods have limited granularity, underutilize inter-service interaction information, and rely on labels. This paper proposes an unsupervised trace anomaly detection method based on graph attention networks (SOG-AD) to address these issues.

[0017] The purpose of the present invention is to deduce how the present invention achieves the following:

[0018] This invention is a trace anomaly detection method for a microservice architecture based on a graph neural network. By constructing a service operation graph (SOG) as a meso-level trace representation method, it balances the granularity and efficiency of existing methods. It also extracts a set of latency-related features and error propagation patterns as multidimensional edge features and integrates them into the SOG, leveraging inter-service interaction information to improve anomaly detection accuracy. To capture the various metrics generated within services and the call relationships between services, the node and edge features of the SOG are learned through GAT to obtain a graph embedding vector for the trace. The model is trained using a hypersphere loss function to avoid reliance on labels, clustering normal traces at the center of the hypersphere and treating traces far from the center as anomalies.

[0019] The technical solution adopted in the present invention is as follows:

[0020] An unsupervised trace anomaly detection method based on graph attention network includes the following steps:

[0021] Step 1: Build a Trace anomaly detection model

[0022] For online trace anomaly detection, trace data comes from real-time data generated by the microservice system. The trace data set T in a time window is T = {t1, t2, ..., t n}, contains n traces, where the traces in the data set T are all data when the system is operating normally. Use T to train a classifier Y: t i →[0, 1], to determine whether the new trace is abnormal, where 0 is normal and 1 is abnormal.

[0023] Establish four modules: data preprocessing, service operation graph construction, GAT-based graph embedding learning, and hypersphere-based anomaly detection, such as Figure 1 shown.

[0024] First, perform feature extraction, data cleaning and normalization on the original trace data; then construct SOG to represent the trace data, and convert each trace data into the corresponding SOG Indicates that Represents a collection of nodes, representing service operations; Represents an edge set, i.e., the call relationship between service operations; Represents the node feature matrix, each node i has a feature vector ; Represents the edge feature matrix, each edge e i,j With characteristic vector The entire trace data is represented by G = {g1, g2, g3, ..., g n} means that g i Indicates that The SOG constructed by the trace; GAT learns the features of nodes and edges, and each node in the graph g There are node feature vectors h i , each edge e i,j Both have edge eigenvector y ij , and then the trace graph embedding vector v is obtained through average pooling i ; Then use the hypersphere loss function to train the model and gather normal traces to the center of the hypersphere; for new traces, construct their corresponding SOG and input them into the trained model to calculate their anomaly score. If it is greater than 0, it is judged as abnormal, otherwise it is normal.

[0025] Step 2: Data Preprocessing

[0026] Data cleansing and standardization are performed on the trace and metric data generated by the microservice system for subsequent analysis. Five types of metrics are extracted from the raw data: compute resource metrics, memory resource metrics, network resource metrics, time dimension metrics (latency), and status metrics (HTTP status). Compute resource metrics (CRM) include "CPU system utilization," "CPU total utilization," and "CPU user utilization"; memory resource metrics (MRM) include "memory utilization" and "working set memory"; and network resource metrics (NRM) include "received bytes (rx bytes)" and "sent bytes (tx bytes)."

[0027] Because different feature types have different value ranges and distribution characteristics, different normalization strategies are employed. Normalization strategies are categorized into two types based on continuous and discrete data values: 1) Continuous Features: Continuous features such as CRM, MRM, NRM, and Latency are normalized using the MinMaxScaler. A normalizer is fitted to each service operation, mapping feature values ​​to the [0, 1] range, preserving the relative variation information necessary for anomaly detection. 2) Discrete Features: For the normalization of discrete HTTP status codes, a custom encoding method is employed, as shown in Table 2. For example, 5xx status codes, such as 500 (Internal Server Error) and 502 (Gateway Error), indicate server processing issues. These status codes are mapped to 1.0, with the exception of 503 (Service Unavailable). The 503 status code indicates that the server is temporarily unavailable, possibly due to maintenance or server overload, and is specifically mapped to 0.8. This encoding method converts the status code into a form suitable for numerical computation while preserving its semantic information. Missing feature values ​​in each trace are padded with zeros.

[0028] surface HTTP status code encoding

[0029]

[0030] Step 3: Service Operation Graph Construction

[0031] After processing the data, we need to construct graph data and input it into GAT to learn the data features generated by the microservice system, so as to detect whether the trace is abnormal. The trace data is effectively represented by the service operation graph (SOG). SOG is defined as a four-tuple , where the V node set represents the specific operation of the service; spans with the same operation in the same service are aggregated into one node; represents the edge set, i.e., the call relationship between service operations; X represents the node feature matrix, each node With characteristic vector ; Y represents the edge feature matrix, each edge e i,j With characteristic vector The process of building a service operation graph can be divided into the following steps:

[0032] 1) Global Graph Construction: Due to the dynamic nature of microservice systems, different traces may involve different service call paths. To ensure the consistency and comparability of anomaly detection, a global graph is first constructed as a unified structural template. Specifically, a global graph G = {V, E} is extracted from historical trace data to describe the call relationship between service operations. Specifically, V is a node set, |V| = N, where is the number of microservice operations; E is an edge set, represents an edge from i to j, i.e. i has called j at least once in history.

[0033] 2) Node feature construction: The feature vector of each node contains CRM, MRM, NRM, Latency, and Status. Considering that the same service operation may be called multiple times in a trace, an average strategy is used to aggregate the features. For nodes that do not appear in the current trace of the global graph, their features are filled with zero. , its initial eigenvector is defined as follows:

[0034] (1)

[0035] 3) Edge Feature Construction: A set of call features are derived from the trace to capture the interaction characteristics between services. These features include three time-related features and error propagation features. The execution time relative to start (ETS) is the execution time of the caller before the callee starts. The execution time relative to end (ETE) is the execution time of the caller after the callee ends. The latency difference (LD) is the latency difference between the caller and the callee.

[0036] (2)

[0037] (3)

[0038] (4)

[0039] (5)

[0040] Among them, ETS ij , ETE ij LD ijThey represent the relative start execution time, relative end execution time and delay difference from node i to node j respectively. Indicates the number of calls from node i to node j in a trace, 、 、 The error propagation feature (EP) tracks the propagation of exceptions in the trace by status code. If the caller or callee receives a 4xx or 5xx error status code, the feature value is set to 1, otherwise it is 0.

[0041] (6)

[0042] (7)

[0043] Among them EP ij represents the error propagation characteristic value from node i to node j. It is the nth call , Is an indicator function judgment or Is it an error status code (4xx or 5xx), if so is set to 1 otherwise, 0.

[0044] Then for edge e i,j , its eigenvector is defined as follows:

[0045] (8)

[0046] Step 4: GAT-based graph embedding learning

[0047] After building SOG, it is necessary to learn a low-dimensional vector representation that can effectively capture the structure and feature information of the graph. Due to the heterogeneity and dynamics of interactions between services, the graph attention network (GAT) is used as the core model for graph representation learning. Compared with traditional graph neural networks, GAT can adaptively assign importance weights to different adjacent nodes, which makes it particularly suitable for modeling complex call relationships in microservice systems. In order to make full use of the multi-dimensional features of nodes and edges, the calculation of attention weights takes into account not only edge features but also adjacent nodes, so that the model can better understand the interaction patterns and call relationships between services. Each node First, the attention scores of its neighboring nodes are calculated to i and edge feature y ij Indicates their importance. In the layer, the attention score is calculated as follows:

[0048] (9)

[0049] (10)

[0050] in is the result of concatenating node features and edge features. is the attention score from node i to node j, is the learnable attention weight, || represents the feature concatenation operation, and are the linear transformation matrices of node features and edge features respectively, and LeakyReLU is an activation function with a negative slope used to introduce nonlinearity.

[0051] The attention scores of i’s neighbors are normalized using the softmax function:

[0052] (11)

[0053] in is the attention weight from node i to node j, and N(i) represents the set of neighbor nodes of node i.

[0054] To enhance the stability and expressiveness of representation learning, a multi-head attention mechanism is employed. Each attention head independently learns a set of attention weights and feature transformations. By stacking l layers of graph attention, the final representation of node i is obtained through the multi-head attention mechanism, and the outputs of all heads in each layer are concatenated:

[0055] (12)

[0056] Where || represents the concatenation operation, σ is the activation function (such as ELU), and denote the attention weight and feature representation of the kth head respectively, and K is the number of attention heads. After concatenation, the feature dimension of node i becomes , where is the output feature dimension of each head.

[0057] By stacking multiple layers of GAT, the model can capture higher-order service interaction patterns layer by layer. The embedding representation of the entire service operation graph is obtained through the global average pooling operation: (13)

[0058] in is the graph embedding representation of the service operation graph g, is the number of nodes in g, is the final vector representation of the output node i.

[0059] Step 5: Hypersphere-based anomaly detection

[0060] After obtaining the graph embedding representation of the service operation graph, an effective mechanism is needed to identify abnormal traces. Considering the scarcity of anomaly labeled data in real-world environments, an unsupervised anomaly detection method based on Deep Support Vector Data Description (Deep SVDD) is adopted. The core idea of ​​this method is to learn a compact hypersphere in the feature space, so that the embedding representations of normal samples are clustered at the center of the hypersphere, while anomalous samples deviate from this area. Specifically, the target hypersphere loss function is defined as: (14)

[0061] in is the set of all graph embedding vectors, It represents the graph embedding vector obtained by iterative conversion of the i-th trace into a graph. c is the center of the initialized hypersphere. The choice of center point c has a significant impact on model performance. The center point is initialized using historical normal trace samples: (15)

[0062] Where N is the total number of trace graphs in a batch.

[0063] During the training process, the mini-batch stochastic gradient descent method is used to optimize the model parameters, and the validation set is used to select the optimal radius value.

[0064] In the anomaly detection phase, given a new trace g, we first construct its SOG representation and then obtain the graph embedding vector through the trained model. We calculate its anomaly score: (16)

[0065] in is the graph representation vector of trace g, r is the final radius of the known hypersphere, and the validation set is used to select the best radius value. If If it is greater than 0, g is considered abnormal.

[0066] Compared with existing methods, SOG-AD of the present invention achieves a good balance between granularity and efficiency in trace graph representation, and innovatively constructs SOG as a meso-level trace representation method. As a meso-level trace representation method, SOG can effectively balance global call dependencies and fine-grained operation characteristics, and realize comprehensive information capture and dimensionality reduction processing. GAT is used to automatically fuse the multi-dimensional features of nodes and edges, and the self-attention mechanism is used to improve the representation ability of graph embedding and the accuracy of anomaly detection. The Deep SVDD unsupervised anomaly detection mechanism is introduced to aggregate normal trace data to the center of the hypersphere, effectively identify abnormal behavior, and avoid dependence on manual labeling. The present invention combines the unsupervised learning framework of GAT and Deep SVDD, which can train the model without anomaly labels and can also obtain good detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 SOG-AD framework diagram;

[0068] Figure 2 Example diagram of edge feature calculation;

[0069] Figure 3 SOG example diagram;

[0070] Figure 4 Influence diagram of hidden layer dimensions;

[0071] Figure 5 GAT layer number impact diagram; Figure 6 Batchsize impact diagram. DETAILED DESCRIPTION

[0072] The specific embodiments of the present invention are described in detail below in conjunction with the technical solutions and drawings.

[0073] 1. SOG Construction

[0074] First, a global graph is constructed based on historical trace data. For example, for Table 1 trace, the global graph constructed by it contains 6 nodes (social-graph-service (unfollow_with_username_server) and user-service (get_user_id_server)) and 5 edges (social-graph-service (unfollow_with_username_server) -> user-service (get_user_id_server)). Then, node features and edge features are constructed based on the trace data in Table 1a. For example, the latency of the node social-graph-service (unfollow_server) is 653 and the status is 200. Next, the corresponding edge features are calculated for each edge. Figure 2 This figure shows an example of calculating edge features for the trace in Table 1. Spans of the same color are aggregated and represented as nodes in the SOG, with different levels representing the call relationships between them. In this example, span1 is the parent span of span2, and span2 is the parent span of span3, span4, and span5. The timestamps of the start and end of these spans are displayed. By aggregating span3 and span4 with the same service operation, we can obtain a directed edge from the social-graph-service (unfollow_with_username_server) to the user-service (get_user_id_server) in the SOG. The ETS of this edge is [(t3-t2)+(t4-t2)] / 2; ETE is [(t9-t5)+(t9-t6)] / 2; LD is {[(t9-t2)-(t5-t3)]+[(t9-t2)-(t6-t4)]} / 2; EP is f(200,200)+f(200,200)] / 2. Fill all node features and edges in the global graph into the global graph to obtain the SOG corresponding to the trace. Figure 3 The SOG corresponding to the trace in Table 1 is shown.

[0075] 2. In this embodiment, two public real-world datasets are used: TrainTicket (TT) and SocialNetwork (SN).

[0076] TT provides a railway ticketing service, allowing users to query, book, and pay for train tickets. The system consists of 41 actively interacting microservices, 27 of which are business-related. SN implements a broadcast-style social networking platform, where users can create, read, bookmark, and forward posts. Microservices in this system communicate via Thrift RPCs. SN has 21 microservices, 14 of which are business-related. TT contains 8,563 traces, 321 of which are anomalous; SN contains 24,464 traces, 1,626 of which are anomalous. Three types of faults were injected into both systems: CPU exhaustion, network latency, and packet loss. All faults were injected, with 162 and 72 fault injections conducted in TT and SN, respectively. In TT, each fault lasted 10 minutes, with an injection interval of 2 minutes; in SN, each fault lasted 2 minutes, with an injection interval of 30 seconds. Each fault was injected into only one microservice; the difference in setup is primarily due to the difference in processing power between the two systems. The traces were randomly divided into training, validation, and test sets in a ratio of 6:1:3. Detailed information about the two datasets is shown in Table 3.

[0077] Table 3 Dataset overview

[0078]

[0079] To verify the rationality and advancement of the method, the following trace anomaly detection methods are used as comparison benchmarks:

[0080] TraceAnomaly: This method trains a variational autoencoder (VAE) model to detect abnormal calls based on the service trace vector (STV), which maps response time and call path information into a unified vector space.

[0081] MultimodalTrace: This method trains a multimodal long short-term memory (LSTM) model based on span sequences and response time series to learn the timing patterns of normal traces.

[0082] MS-RF-AD, MS-SVM-AD, MS-LSTM, and MS-DCC: This paper proposes four methods based on multi-source data (metrics, logs, and traces) for further comparison. All data sources are converted into time series and learning-based algorithms are used for state inference. The first two methods are machine learning methods: random forest (RF) and support vector machine (SVM); the latter two are deep learning methods: LSTM and one-dimensional dilated causal convolution (DCC).

[0083] Eadro: This approach integrates multimodal (metrics, logs, and trace) representations and uses GAT to capture dependencies and exception propagation between microservices.

[0084] Among them, TraceAnomaly and MultimodalTrace are unsupervised methods, while MS-RF-AD, MS-SVM-AD, MS-LSTM, MS-DCC and Eadro are supervised methods.

[0085] 3. SOG-AD was implemented using Python 3.8 and PyTorch 1.10.2. All experiments were conducted on a server with a 4080 Ti GPU, 32GB of RAM, and a 16-core 13700F processor. For hyperparameters, the hidden layer dimension was 64, the number of GAT layers was set to 2, a 4-head mechanism was used for the GAT attention layer, and a batch size of 128. Training was performed for 50 epochs using the Adam algorithm with a learning rate of 0.001. Performance analysis was performed using precision, recall, F1-score, and training time, as shown in the following formulas.

[0086]

[0087] (17)

[0088]

[0089] in represents the actual detected anomaly, represents an exception that was detected incorrectly, represents the correctly identified normal samples, Indicates incorrectly identified normal samples.

[0090] Let’s explain it in detail from the following aspects:

[0091] RQ1 (Anomaly Detection Effectiveness): How does SOG-AD perform in anomaly detection?

[0092] RQ2 (Ablation Experiment): What is the impact of the ablation experiment?

[0093] RQ3 (Graph Structure Comparison): What is the impact of different graph structures?

[0094] RQ4 (Hyperparameter Sensitivity): What is the impact of hyperparameters?

[0095] 4. The results are as follows

[0096] (1) RQ1: Anomaly Detection Effectiveness

[0097] Table 4 shows the results of SOG-AD and baseline methods on the anomaly detection task. SOG-AD achieved very high precision (0.952 and 0.975, respectively), recall (0.916 and 0.920, respectively), and F1 score (0.933 and 0.947, respectively) on both datasets. SOG-AD significantly outperformed two unsupervised methods (TraceAnomaly and MultimodalTrace) in terms of precision, recall, and F1 score. The latter achieved lower F1 scores on both datasets. TraceAnomaly uses STV as a trace representation, but this method has limitations in capturing global call dependencies. MultimodalTrace, on the other hand, treats traces as sequences of spans and response times. This approach makes it difficult to capture the topological structure and dynamic interactions between services and also ignores the status code information contained in spans.

[0098] Furthermore, SOG-AD outperforms two supervised methods, namely MS-RF-AD and MS-RF-AD. SOG-AD's advantage lies in its ability to capture complex dependencies between microservices by employing SOG. However, MS-RF-AD and MS-RF-AD cannot directly model graph-structured data and have shortcomings in leveraging global topology information.

[0099] The introduction of SOG enables SOG-AD to fully utilize detailed information at the operational level within services, significantly improving its ability to perceive complex anomaly propagation paths. The introduction of edge features enhances the ability to identify anomaly propagation, addressing the problem of existing methods ignoring dynamic interactions between services. Furthermore, the use of the attention mechanism effectively improves the model's perception of complex dependencies, enabling it to more accurately distinguish normal from abnormal patterns in high-dimensional feature spaces. SOG-AD combines the frameworks of GAT and Deep SVDD to accurately identify abnormal behavior in unsupervised scenarios, thus overcoming the reliance of traditional supervised learning methods on high-quality labeled data.

[0100] Table 4 Method performance comparison results (2)

[0102] (3) RQ2: Ablation experiment

[0103] To verify the effectiveness of each component, detailed ablation experiments were conducted and the following variants were obtained:

[0104] SOG-AD w / o EP: The error propagation feature (EP) is removed from the edge features, and only three time-related features (ETS, ETE, and LD) are retained.

[0105] SOG-AD w / o E: Remove all edge features and use only node features for modeling.

[0106] SOG-AD w / o A: The attention mechanism is removed and GAT is replaced by graph convolutional network (GCN).

[0107] The parameter settings of all three variants remain unchanged. Table 5 shows the results of the ablation experiments.

[0108] 1) Influence of edge features

[0109] After removing all edge features (SOG-AD without E), the F1 scores of SOG-AD without E dropped by 2.25% and 6.55% on the two datasets (TT and SN), respectively. In particular, the recall dropped from 0.920 to 0.824, and the F1 score dropped from 0.947 to 0.885 in the SN dataset, demonstrating a more significant performance degradation. Since the SN dataset contains more latency and status code anomalies, this suggests that removing edge features compromises the model's ability to capture inter-service interactions and anomaly propagation paths, compromising cross-service anomaly detection.

[0110] When only the error propagation feature (SOG-AD without EP) is removed, the recall and F1 score decrease slightly, but the impact is still significant: in TT, the recall drops from 0.916 to 0.907, and the F1 score drops from 0.933 to 0.922; in SN, the recall drops from 0.920 to 0.887, and the F1 score drops from 0.947 to 0.923. This demonstrates that the error propagation feature plays a significant role in capturing complex exception propagation chains and cross-service anomalies. For example, a service failure or performance bottleneck may cause anomalies in its callers or callees, and this anomaly propagation chain determines the health of the entire system.

[0111] In summary, edge features can effectively capture the dynamic interaction characteristics between services and are of great significance for anomaly detection tasks.

[0112] 2) Impact of the Attention Mechanism

[0113] After removing the attention mechanism, the F1 scores on the TT and SN datasets dropped by 4.29% and 49.2%, respectively. The recall and F1 score on the SN dataset dropped particularly significantly, with the recall dropping to 0.328 and the F1 score dropping to 0.481. While the recall on the TT dataset only dropped from 0.916 to 0.860, the precision and F1 score still declined.

[0114] Social networking platforms often contain complex indirect dependencies, such as extended service call chains and frequent and complex mutual calls between services. GAT dynamically adjusts the contribution weights of neighboring nodes to the target node, enabling the model to more flexibly capture complex interactions between service operations. This makes it particularly suitable for microservice systems like SN, which have frequent dynamic interactions and diverse service call paths. In contrast, GCN struggles to accurately distinguish the importance of each node when faced with complex anomaly patterns, such as latency anomaly propagation involving multiple nodes.

[0115] Table 5 Ablation experiment results (4)

[0117] (5) RQ3: Graph Structure Comparison

[0118] To verify SOG's advantage in balancing information granularity and computational efficiency, we compared and analyzed the differences in topological complexity, time efficiency, and anomaly detection performance among three graph structures (Span graph, service graph, and SOG). The experiments were based on two real-world microservice datasets (TT and SN). Span graphs, service graphs, and SOG-AD without Evolution (SOG-AD w / o Evolution) all ignored edge features. Span graphs did not aggregate node features, while service graphs aggregated service-level node features, and SOG-AD with Evolution (SOG-AD w / o Evolution) aggregated service-operation-level node features. We also compared the performance and time overhead of SOG-AD and SOG-AD without Evolution (SOG-AD w / o Evolution). The main difference between the two lies in whether additional edge features are introduced into the graph edges. Table 6 shows the detailed comparison results.

[0119] Span graphs performed well in terms of precision, reaching 0.973 on SN. SOG-AD w / o E slightly outperformed span graphs in terms of recall, while service graphs had significantly lower recall, indicating that the latter was insufficient in capturing anomalies. In terms of both precision and recall, SOG-AD w / o E performed relatively well compared to span graphs, but service graphs performed relatively poorly. Experimental results show that SOG-AD further improved overall performance after introducing edge features. On SN, SOG-AD's precision increased to 0.975, its recall to 0.920, and its F1 score to 0.947. This demonstrates that the introduction of edge features helps capture more fine-grained anomaly information, thereby improving detection performance.

[0120] The service graph, due to its smaller number of nodes and edges, is the fastest to build; the span graph, due to its more complex structure, takes the longest to build. SOG-AD w / o E is slightly faster than the service graph. In terms of training time, the service graph is the fastest, while the span graph is the slowest. SOG-AD w / o E maintains good performance while maintaining a reasonable training time.

[0121] After introducing edge features, SOG-AD has a certain increase in construction, training, and testing time. For example, on SN, its training time increases from 53.83 seconds / epoch for SOG-AD without E to 64.16 seconds / epoch, indicating that the introduction of edge features in the model requires additional computing resources to learn complex anomaly patterns.

[0122] In summary, while the Service graph has lower computational complexity, its performance is lower. While the Span graph offers better performance, its computational cost is higher, making it potentially inefficient for large-scale applications. SOG-AD w / o E achieves a good balance between performance and time. Although the introduction of edge features increases the time overhead, SOG-AD achieves a significant improvement in overall performance, particularly in recall and F1 score.

[0123] Table 6 Comparison of graph structures (6)

[0125] (7) RQ4: Hyperparameter sensitivity

[0126] Evaluate the impact of three important configurations: hidden layer dimension, number of GAT layers, and batch size on the effectiveness of SOG-AD.

[0127] 1) Hidden layer dimension: The hidden layer dimension is a key parameter that determines the feature representation capability. The hidden layer dimensions are set to 16, 32, 64, 128, and 256 respectively. Figure 4 Figure 2 shows the impact of different hidden layer dimensions on performance. The results show that as the dimension increases, model performance initially improves rapidly and then levels off. The model achieves optimal performance when the hidden layer dimension is 64. This is because when the dimension is too small, the network's representational capabilities are limited, making it unable to fully encode the complex characteristics of service operations. However, when the dimension is too large, redundant information may be introduced, increasing computational cost and potentially leading to overfitting, which in turn affects the model's generalization ability.

[0128] 2) Number of GAT layers: The number of GAT layers determines the number of GAT layers that SOG passes through, which has a significant impact on the performance of the trained model. The number of GAT layers is set to 1, 2, 3, 4, and 5 respectively. Figure 5 As shown in the figure, as the number of layers increases, model performance initially improves and then significantly decreases. When the number of GAT layers is 2, the model achieves optimal performance in terms of the F1 score. This is because when the number of GAT layers is small, information transfer between different nodes may be insufficient, resulting in the model failing to fully learn features. When the number of GAT layers is too large, the trained model may become overly smoothed, making it difficult to distinguish between representations learned in different graphs.

[0129] 3) Batchsize: Batchsize affects the stability and convergence speed of model training. Set Batchsize to 32, 64, 128, 256 and 512 respectively. Figure 6 As shown in the figure, the model performs best when the batch size is 128. This is because when the batch size is too small, the variance of the gradient estimation is large, which leads to unstable training and affects model convergence. When the batch size is too large, although it can provide more accurate gradient estimation, it may fall into a local optimum, significantly increasing memory overhead and reducing training efficiency.

[0130] Based on the above analysis, we ultimately selected a configuration with 2 GAT layers, 64 hidden layer dimensions, and a batch size of 128 as the optimal parameter combination. This set of parameters achieves a good balance between model performance and computational efficiency.

Claims

1. An unsupervised trace anomaly detection method based on graph attention network, Its characteristics include the following steps: Step 1: Build a trace anomaly detection model; Step 2: Data preprocessing; Step 3: Service operation diagram construction; Step 4: GAT-based graph embedding learning; Step 5: Hypersphere-based anomaly detection.

2. The unsupervised trace anomaly detection method according to claim 1, characterized in that: The step 1 is specifically as follows: For online trace anomaly detection, trace data comes from real-time data generated by the microservice system; the trace data set T in a time window is T = {t1, t2, ..., t n }, contains n traces, where the traces in the data set T are all data when the system is operating normally. Use T to train a classifier Y: t i →[0, 1], to determine whether the new trace is abnormal, where 0 is normal and 1 is abnormal; First, perform feature extraction, data cleaning and normalization on the original trace data; then construct SOG to represent the trace data, and convert each trace data into the corresponding SOG Indicates that Represents a collection of nodes, representing service operations; Represents an edge set, i.e., the call relationship between service operations; Represents the node feature matrix, each node i has a feature vector ; Represents the edge feature matrix, each edge e i,j With characteristic vector The entire trace data is represented by G = {g1, g2, g3, ..., g n } means that g i Indicates that The SOG constructed by the trace; GAT learns the features of nodes and edges, and each node in the graph g There are node feature vectors h i , each edge e i,j Both have edge eigenvector y ij , and then the trace graph embedding vector v is obtained through average pooling i ; Then use the hypersphere loss function to train the model and gather normal traces to the center of the hypersphere; for new traces, construct their corresponding SOG and input them into the trained model to calculate their anomaly score. If it is greater than 0, it is judged as abnormal, otherwise it is normal.

3. The unsupervised trace anomaly detection method according to claim 1, characterized in that: The specific contents of step 2 are as follows: The trace and metric data generated by the microservice system is cleaned and standardized for subsequent analysis. Five types of metrics are extracted from the raw data: computing resource metrics, memory resource metrics, network resource metrics, time dimension metrics (latency), and status metrics (HTTP status). Computing resource metrics (CRM): "CPU system utilization," "CPU total utilization," and "CPU user utilization"; memory resource metrics (MRM): "memory utilization" and "working set memory"; and network resource metrics (NRM): "received bytes (rx bytes)" and "sent bytes (tx bytes)." Since different feature types have different value ranges and distribution characteristics, different normalization strategies are used; normalization strategies are divided into two categories based on continuous data and discrete data values: 1) Continuous features: For continuous features such as CRM, MRM, NRM, and Latency, MinMaxScaler is used for normalization. A normalizer is fitted for each service operation to map the feature values ​​to the [0, 1] interval, preserving the relative change information required for anomaly detection. 2) Discrete features: For the standardization of discrete HTTP status codes, a custom encoding method is used, as shown in Table 2. The 503 status code indicates that the server is temporarily unable to provide services, possibly due to maintenance or server overload, and the specific mapping is 0.

8. This encoding method converts the status code into a form that can be used for numerical calculations while retaining the semantic information of the status code. The missing feature values ​​in each trace are filled with zeros, as shown in Table 2. HTTP status code encoding 。 4. The unsupervised trace anomaly detection method according to claim 1, characterized in that: The step 3 is as follows: After processing the data, it is necessary to construct graph data and input it into GAT to learn the data features generated by the microservice system to detect whether the trace is abnormal; use the service operation graph (SOG) to effectively represent the trace data; define SOG as a four-tuple , where the V node set represents the specific operation of the service; spans with the same operation in the same service are aggregated into one node; represents the edge set, i.e., the call relationship between service operations; X represents the node feature matrix, each node With characteristic vector ; Y represents the edge feature matrix, each edge e i,j With characteristic vector ; The construction process of the service operation diagram can be divided into the following steps: 1) Global graph construction: Due to the dynamic characteristics of microservice systems, different traces may involve different service call paths. To ensure the consistency and comparability of anomaly detection, we first construct a global graph as a unified structural template. Specifically, we extract a global graph G = {V, E} from historical trace data to describe the call relationship between service operations. Specifically, V is a node set, |V| = N, where |V| is the number of microservice operations; E is an edge set, represents an edge from i to j, i.e. i has called at least j in history; 2) Node feature construction: The feature vector of each node contains CRM, MRM, NRM, Latency, and Status. Considering that the same service operation may be called multiple times in a trace, an averaging strategy is used to aggregate the features. For nodes that do not appear in the current trace in the global graph, Its features are filled with zero; for nodes , its initial eigenvector is defined as follows: （1） 3) Edge feature construction: A set of call features are derived from the trace to capture the interaction characteristics between services, including three time-related features and error propagation features; The relative start execution time ETS is the execution time of the caller before the callee starts; the relative end execution time ETE is the execution time of the caller after the callee ends; the delay difference LD is the delay difference between the caller and the callee; （2） （3） （4） （5） Among them, ETS ij , ETE ij LD ij They represent the relative start execution time, relative end execution time and delay difference from node i to node j respectively. Indicates the number of calls from node i to node j in a trace, 、 、 Represents the start time, end time, and delay of node i in the nth call, respectively. The error propagation feature (EP) tracks the propagation of exceptions in the trace through status codes. When the caller or callee receives a 4xx or 5xx error status code, the feature value is set to 1, otherwise it is 0. （6） （7） Among them EP ij represents the error propagation eigenvalue from node i to node j; It is the nth call , Is an indicator function judgment or Is it an error status code (4xx or 5xx), if so is set to 1, otherwise 0; Then for edge e i,j , its eigenvector is defined as follows: （8）。 5. The unsupervised trace anomaly detection method according to claim 1, characterized in that: The step 4 is specifically as follows: After building SOG, it is necessary to learn a low-dimensional vector representation that can effectively capture the structure and feature information of the graph. Due to the heterogeneity and dynamics of interactions between services, the graph attention network (GAT) is used as the core model for graph representation learning. Compared with traditional graph neural networks, GAT can adaptively assign importance weights to different adjacent nodes, which makes it particularly suitable for modeling complex call relationships in microservice systems. In order to make full use of the multi-dimensional features of nodes and edges, the calculation of attention weights not only considers edge features, but also adjacent nodes, so that the model can better understand the interaction patterns and call relationships between services. Each node First, the attention scores of its neighboring nodes are calculated to i and edge feature y ij Indicates their importance; in the graph attention layer In the layer, the attention score is calculated as follows: （9） （10） in is the result of concatenating node features and edge features. is the attention score from node i to node j, is the learnable attention weight, || represents the feature concatenation operation, and are the linear transformation matrices of node features and edge features respectively. LeakyReLU is an activation function with a negative slope, which is used to introduce nonlinearity. The attention scores of i’s neighbors are normalized using the softmax function: （11） in is the attention weight from node i to node j, N(i) represents the set of neighbor nodes of node i; To enhance the stability and expressiveness of representation learning, a multi-head attention mechanism is adopted; each attention head independently learns a set of attention weights and feature transformations; by stacking l layers of graph attention layers, the final representation of node i is obtained through the multi-head attention mechanism, and the outputs of all heads in each layer are concatenated: （12） Where || represents the concatenation operation, σ is the activation function (such as ELU), and They represent the attention weight and feature representation of the kth head respectively, and K is the number of attention heads; after splicing, the feature dimension of node i becomes , where is the output feature dimension of each head; By stacking multiple layers of GAT, the model can capture higher-order service interaction patterns layer by layer. The embedding representation of the entire service operation graph is obtained through the global average pooling operation: (13) in is the graph embedding representation of the service operation graph g, is the number of nodes in g, is the final vector representation of the output node i.

6. The unsupervised trace anomaly detection method according to claim 1, characterized in that: The above 5 is as follows: After obtaining the graph embedding representation of the service operation graph, an effective mechanism is needed to identify abnormal traces. Considering the scarcity of anomaly labeled data in real-world environments, an unsupervised anomaly detection method based on Deep Support Vector Data Description (Deep SVDD) is adopted. The core idea of ​​this method is to learn a compact hypersphere in the feature space, so that the embedding representation of normal samples is concentrated in the center of the hypersphere, while anomalous samples deviate from this area. Specifically, the target hypersphere loss function is defined as: (14) in is the set of all graph embedding vectors, It represents the graph embedding vector obtained by iteration after the i-th trace is converted into a graph; c is the center of the initialized hypersphere. The choice of center point c has an important impact on the model performance. The center point is initialized using historical normal trace samples: (15) Where N is the total number of trace graphs in a batch; During the training process, the mini-batch stochastic gradient descent method is used to optimize the model parameters, and the validation set is used to select the optimal radius value; In the anomaly detection stage, given a new trace g, we first construct its SOG representation, then obtain the graph embedding vector through the trained model; and calculate its anomaly score: (16) in is the graph representation vector of trace g, r is the final radius of the known hypersphere, and the validation set is used to select the best radius value; if If it is greater than 0, g is considered abnormal.

Images