Cloud native multi-dimensional index anomaly detection and positioning method and device

Abstract

The invention discloses a cloud native multi-dimensional index anomaly detection and positioning method and device, and relates to the technical field of intelligent operation and maintenance. The method comprises the following steps: collecting multi-dimensional time sequence indexes of containers in a cloud native cluster and middleware logs of the containers in the cluster, grouping the multi-dimensional time sequence indexes according to service attributes, encoding the middleware logs to obtain text sequence representation, encoding time information in the grouped multi-dimensional time sequence indexes to obtain index spatial-temporal characteristics, and storing the index spatial-temporal characteristics in a database; according to the method, index spatial-temporal features are coded to obtain index hidden state expressions of all groups, TCN and the index hidden state expressions of all groups are utilized to generate intra-group spatial-temporal expressions of all groups, relevance of the intra-group spatial-temporal expressions of all groups is calculated to obtain index global feature expressions, and cross-modal fusion is carried out on the index global feature expressions and text sequence expressions to obtain index global feature expressions. And according to the cross-modal fusion feature representation, predicting a multi-dimensional time sequence index, and according to an index prediction value, carrying out abnormal index detection and positioning.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent operation and maintenance, in particular to a cloud native multi-dimensional index abnormality detection and positioning method and device. BACKGROUND

[0002] In recent years, with the continuous development of cloud native technology, the containerization rate of applications is continuously improving, and the business volume has also migrated from traditional cloud virtual machines to containers on the cloud. Through intelligent operation and maintenance, automatic detection and positioning of abnormal monitoring indicators of containers can greatly reduce the burden of manual operation and maintenance and significantly improve the efficiency of operation and maintenance.

[0003] In the prior art, the traditional model does not explicitly model the periodic characteristics of the business peak period (such as daily traffic peak), which leads to normal fluctuations being misjudged as abnormal; the traditional model analyzes single-dimensional indicators such as container CPU and thread pool in isolation, ignoring cross-dimensional dynamic correlation (such as database response delay causing blocking); the existing solution cannot quantify the contribution of each indicator to the abnormality, and the operation and maintenance personnel cannot quickly locate the fault source. The operation and maintenance personnel still need to spend a lot of time checking various indicators and logs, and judging whether the indicators are abnormal and the corresponding abnormal reasons according to their own operation and maintenance experience, which is a complex process and requires high technical level of personnel.

[0004] To sum up, how to improve the accuracy of cloud native multi-dimensional index abnormality detection and positioning is a technical problem that needs to be solved by those skilled in the art. SUMMARY

[0005] Therefore, the present application provides a cloud native multi-dimensional index abnormality detection and positioning method and device, which aims to improve the accuracy of cloud native multi-dimensional index abnormality detection and positioning.

[0006] In a first aspect, the present application provides a cloud native multi-dimensional index abnormality detection and positioning method, comprising:

[0007] Collecting multi-dimensional time series indicators of containers in a cloud native cluster and middleware logs of containers in the cluster;

[0008] Grouping the multi-dimensional time series indicators according to business attributes to obtain grouped multi-dimensional time series indicators;

[0009] Encoding the middleware logs to obtain a text sequence representation;

[0010] Time2Vec encoding the time information in the grouped multi-dimensional time series indicators to obtain index space-time features of each group;

[0011] Using a multi-head attention mechanism to encode the index space-time features of each group to obtain index hidden state representations of each group;

[0012] generate an intra-group spatio-temporal representation of each group by using a time convolution network (TCN) and the indicator hidden state representation of each group;

[0013] calculate the relevance of the intra-group spatio-temporal representations of each group based on a cross-attention mechanism to obtain an indicator global feature representation;

[0014] perform cross-modal fusion on the indicator global feature representation and the text sequence representation based on a cross-attention mechanism to obtain a cross-modal fusion feature representation;

[0015] predict the multi-dimensional time series indicators of the containers in the cloud-native cluster according to the cross-modal fusion feature representation to obtain indicator prediction values;

[0016] perform abnormal indicator detection and positioning according to the indicator prediction values.

[0017] Optionally, the collection of the multi-dimensional time series indicators of the containers in the cloud-native cluster and the middleware logs of the containers in the cluster comprises:

[0018] the multi-dimensional time series indicators of the containers in the cloud-native cluster are collected by a Prometheus tool;

[0019] the middleware logs of the containers in the cluster are collected by an Elastic Search engine.

[0020] Optionally, the grouping of the multi-dimensional time series indicators according to the business attributes to obtain the grouped multi-dimensional time series indicators comprises:

[0021] the multi-dimensional time series indicators are divided into resource group multi-dimensional time series indicators, thread group multi-dimensional time series indicators, and database group multi-dimensional time series indicators according to the business attributes.

[0022] Optionally, the encoding of the middleware logs to obtain the text sequence representation comprises:

[0023] the middleware logs are encoded by using a pre-trained language model BERT to obtain the text sequence representation.

[0024] Optionally, the Time2Vec encoding of the time information in the grouped multi-dimensional time series indicators to obtain the indicator spatio-temporal features of each group comprises:

[0025] the Time2Vec encoding of the time information in the grouped multi-dimensional time series indicators is performed to generate multi-scale time features of each group;

[0026] the grouped multi-dimensional time series indicators and the multi-scale time features of each group are spliced and normalized to obtain the indicator spatio-temporal features of each group.

[0027] Optionally, the generating of the intra-group spatio-temporal representation of each group based on the time convolution network (TCN) and the indicator hidden state representation of each group comprises:

[0028] The time convolution network (TCN) is used to enhance the time sequence characteristics of the indicator hidden state representation of each group, and the indicator hidden state representation and the time sequence enhanced representation are fused through a residual connection to obtain the intra-group spatio-temporal representation of each group.

[0029] Optionally, the calculating of the correlation of the intra-group spatio-temporal representation of each group based on the cross-attention mechanism comprises:

[0030] Based on the cross-attention mechanism, the multi-dimensional time sequence indicators of the resource group are taken as queries, the multi-dimensional time sequence indicators of the thread group or the multi-dimensional time sequence indicators of the database group are fused, the correlation of the intra-group spatio-temporal representation of each group is calculated, and the indicator global feature representation is obtained.

[0031] Optionally, the predicting of the multi-dimensional time sequence indicators of the container in the cloud-native cluster based on the cross-modal fusion feature representation to obtain the indicator prediction value comprises:

[0032] The GRU gate recurrent unit network and the TCN time convolution network are used as decoders, the cross-modal fusion feature representation is used to predict the multi-dimensional time sequence indicators of the container in the cloud-native cluster, and the indicator prediction value is obtained.

[0033] Optionally, the performing of the abnormal indicator detection and positioning based on the indicator prediction value comprises:

[0034] A threshold value is set according to the indicator prediction value.

[0035] The actual indicator value is compared with the threshold value to realize the abnormal indicator detection and positioning.

[0036] In a second aspect, the present application provides a cloud-native multi-dimensional indicator abnormality detection and positioning device, comprising:

[0037] A collection module is configured to collect multi-dimensional time sequence indicators of containers in a cloud-native cluster and middleware logs of the containers in the cluster.

[0038] A grouping module is configured to group the multi-dimensional time sequence indicators according to business attributes to obtain grouped multi-dimensional time sequence indicators.

[0039] A first encoding module is configured to encode the middleware logs to obtain a text sequence representation.

[0040] A second encoding module is configured to perform Time2Vec encoding on time information in the grouped multi-dimensional time sequence indicators to obtain indicator spatio-temporal features of each group.

[0041] a third encoding module, configured to encode the indicator spatio-temporal features of the groups by using a multi-head attention mechanism to obtain indicator hidden state representations of the groups;

[0042] a generation module, configured to generate intra-group spatio-temporal representations of the groups by using a time convolution network (TCN) and the indicator hidden state representations of the groups;

[0043] a calculation module, configured to calculate the relevance of the intra-group spatio-temporal representations of the groups based on a cross-attention mechanism to obtain indicator global feature representations;

[0044] a cross-modal fusion module, configured to perform cross-modal fusion on the indicator global feature representations and the text sequence representations based on a cross-attention mechanism to obtain cross-modal fusion feature representations;

[0045] a prediction module, configured to predict the multi-dimensional time series indicators of the containers in the cloud-native cluster according to the cross-modal fusion feature representations to obtain indicator prediction values;

[0046] an abnormal indicator detection and positioning module, configured to perform abnormal indicator detection and positioning according to the indicator prediction values.

[0047] Optionally, the collection module comprises:

[0048] a first collection unit, configured to collect the multi-dimensional time series indicators of the containers in the cloud-native cluster by using a Prometheus tool;

[0049] a second collection unit, configured to collect middleware logs of the containers in the cluster by using an Elastic Search engine.

[0050] Optionally, the grouping module comprises:

[0051] a first encoding unit, configured to perform Time2Vec encoding on time information in the grouped multi-dimensional time series indicators to generate multi-scale time features of the groups;

[0052] a processing unit, configured to perform concatenation and normalization processing on the grouped multi-dimensional time series indicators and the multi-scale time features of the groups to obtain indicator spatio-temporal features of the groups.

[0053] a grouping unit, configured to group the multi-dimensional time series indicators into resource group multi-dimensional time series indicators, thread group multi-dimensional time series indicators, and database group multi-dimensional time series indicators according to the business attributes.

[0054] Optionally, the first encoding module comprises:

[0055] The second encoding unit is configured to encode the middleware log by using a pre-trained language model BERT to obtain the text sequence representation.

[0056] Optionally, the second encoding module comprises:

[0057] Optionally, the generation module comprises:

[0058] The generation unit is configured to perform time series feature enhancement on the indicator hidden state representation of each group by using the time convolution network TCN, and fuse the indicator hidden state representation and the time series enhanced representation through a residual connection to obtain the intra-group space-time representation of each group.

[0059] Optionally, the calculation module comprises:

[0060] The calculation unit is configured to take the multi-dimensional time series indicators of the resource group as a query based on a cross-attention mechanism, fuse the multi-dimensional time series indicators of the thread group or the multi-dimensional time series indicators of the database group, and calculate the relevance of the intra-group space-time representation of each group to obtain the global feature representation of the indicators.

[0061] Optionally, the prediction module comprises:

[0062] The prediction unit adopts a GRU gate recurrent unit network and a TCN time convolution network as a decoder, and uses the cross-modal fusion feature representation to predict the multi-dimensional time series indicators of the containers in the cloud-native cluster to obtain the indicator prediction value.

[0063] Optionally, the abnormal indicator detection and positioning module comprises:

[0064] The setting unit is configured to set a threshold value according to the indicator prediction value.

[0065] The comparison unit is configured to compare the actual indicator value with the threshold value to realize abnormal indicator detection and positioning.

[0066] The application provides a cloud-native multi-dimensional index anomaly detection and positioning method. In the execution of the method, first, multi-dimensional time series indexes of containers in a cloud-native cluster and middleware logs of the containers in the cluster are collected, then the multi-dimensional time series indexes are grouped according to business attributes to obtain grouped multi-dimensional time series indexes, and the middleware logs are encoded to obtain text sequence representations, then, time information in the grouped multi-dimensional time series indexes is encoded by Time2Vec to obtain index space-time features, the index space-time features are encoded by a multi-head attention mechanism to obtain index hidden state representations of each group, then, each group of intra-group space-time representations is generated by using a time convolution network (TCN) and the index hidden state representations of each group, and the relevance of the intra-group space-time representations of each group is calculated based on a cross-attention mechanism to obtain index global feature representations, the index global feature representations and the text sequence representations are fused based on the cross-attention mechanism to obtain cross-modal fusion feature representations, the multi-dimensional time series indexes of the containers in the cloud-native cluster are predicted based on the cross-modal fusion feature representations to obtain index prediction values, and finally, abnormal index detection and positioning are performed according to the index prediction values. In this way, by comprehensively collecting the multi-dimensional time series indexes of the containers in the cloud-native cluster and the middleware logs, comprehensive monitoring of the running state of the containers is realized. The time series indexes are grouped according to business attributes, and the index space-time features and the index hidden state representations are effectively extracted by combining Time2Vec encoding and a multi-head attention mechanism, the intra-group space-time representations are further generated by using a time convolution network (TCN), and the expression ability of the time series features is enhanced. The relevance of the intra-group space-time representations is calculated by a cross-attention mechanism to obtain index global feature representations, and the index global feature representations are fused with the text sequence representations in a cross-modal manner, thereby effectively integrating multi-dimensional data. Index prediction is performed based on the cross-modal fusion feature representations, the accuracy of prediction is improved, and finally, the accuracy of detection and positioning can be improved through abnormal index detection and positioning. BRIEF DESCRIPTION OF DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, brief descriptions will be given to the drawings needed in the embodiments or prior art descriptions. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0068] Figure 1 A flowchart of a cloud-native multi-dimensional index anomaly detection and positioning method provided by an embodiment of the present application;

[0069] Figure 2 A structural schematic diagram of a cloud-native multi-dimensional index anomaly detection and positioning device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. The cloud-native multi-dimensional index abnormality detection and positioning device provided by the present application is used in the technical field of intelligent operation and maintenance. The above is only an example and does not limit the application field of the method and device provided by the present application.

[0071] In recent years, with the continuous development of cloud-native technology, the containerization rate of applications continues to increase, and the business volume has also migrated from traditional cloud virtual machines to containers on the cloud. Through intelligent operation and maintenance, automatic detection and positioning of abnormal monitoring indicators of containers can greatly reduce the burden of manual operation and maintenance and significantly improve the efficiency of operation and maintenance.

[0072] In the prior art, the traditional model does not explicitly model the periodic characteristics of the business peak period (such as daily traffic peak), which leads to misjudgment of normal fluctuations as abnormal; the traditional model analyzes the single-dimensional indicators such as container CPU and thread pool in isolation, ignoring the cross-latitude dynamic correlation (such as database response delay causing blocking); the existing scheme cannot quantify the contribution of each indicator to the abnormality, and the operation and maintenance personnel are difficult to quickly locate the fault source. The operation and maintenance personnel still need to spend a lot of time checking various indicators and logs, and judging whether the indicators are abnormal and the corresponding abnormal reasons according to their own operation and maintenance experience. The process is complex and requires high technical level of personnel.

[0073] The inventors propose the technical solutions of the present application through research. First, multi-dimensional time sequence indexes of containers in a cloud native cluster and middleware logs of the containers in the cluster are collected. Then, the multi-dimensional time sequence indexes are grouped according to business attributes to obtain grouped multi-dimensional time sequence indexes, and the middleware logs are encoded to obtain text sequence representations. Next, time information in the grouped multi-dimensional time sequence indexes is encoded by Time2Vec to obtain index spatiotemporal features. The index spatiotemporal features are encoded by using a multi-head attention mechanism to obtain index hidden state representations of each group. Then, each group's intra-group spatiotemporal representation is generated by using a time convolution network (TCN) and the index hidden state representations of each group. Based on a cross-attention mechanism, the relevance of the intra-group spatiotemporal representations of each group is calculated to obtain index global feature representations. Based on the cross-attention mechanism, the index global feature representations and the text sequence representations are cross-modal fused to obtain cross-modal fusion feature representations. According to the cross-modal fusion feature representations, the multi-dimensional time sequence indexes of the containers in the cloud native cluster are predicted to obtain index prediction values. Finally, according to the index prediction values, abnormal index detection and positioning are performed. In this way, by comprehensively collecting the multi-dimensional time sequence indexes of the containers in the cloud native cluster and the middleware logs, comprehensive monitoring of the running state of the containers is realized. According to the business attributes, the time sequence indexes are grouped, and the index spatiotemporal features and the index hidden state representations are effectively extracted by combining Time2Vec encoding and the multi-head attention mechanism. The intra-group spatiotemporal representations are further generated by using the time convolution network (TCN), which enhances the expression ability of the time sequence features. The relevance of the intra-group spatiotemporal representations is calculated by the cross-attention mechanism to obtain the index global feature representations, which are cross-modal fused with the text sequence representations to effectively integrate the multi-dimensional data. Based on the cross-modal fusion feature representations, the index prediction is performed, which improves the accuracy of the prediction. Finally, through abnormal index detection and positioning, the accuracy of detection and positioning can be improved.

[0074] To make persons in the technical field better understand the present application, the present application is further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons of ordinary skill in the art without creative labor fall within the scope of protection of the present application. It should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings. The embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0075] Reference is made to Figure 1 , Figure 1 A flowchart of a cloud native multi-dimensional index abnormal detection and positioning method provided by an embodiment of the present application includes:

[0076] S101: Collect multi-dimensional time series indicators of containers in a cloud-native cluster and middleware logs of containers in the cluster.

[0077] First, the following terms need to be explained:

[0078] Cloud-native refers to a method of building and running applications that aims to fully leverage the advantages of cloud computing environments. The core concept is containerization, which encapsulates applications and their dependencies in lightweight containers within a Kubernetes cluster. A pod is the scheduling unit in a cloud-native Kubernetes cluster and is an encapsulation of one or more containers.

[0079] Prometheus refers to an open-source service monitoring system and time database that provides a general data model and fast data collection, storage, and query interface. By writing PromQL data query statements, you can query and aggregate monitoring indicator data.

[0080] Elastic Search is an open-source high-extensible distributed full-text search engine that provides API interfaces for fast full-text search. By connecting Kubernetes cluster logs to Elastic Search, you can help operations personnel call API interfaces for fast log searching and analysis.

[0081] Collect multi-dimensional time series indicators of containers in a cloud-native cluster using the Prometheus tool; collect middleware logs of containers in the cluster using the Elastic Search engine.

[0082] S102: Group multi-dimensional time series indicators according to business attributes to obtain grouped multi-dimensional time series indicators.

[0083] Group multi-dimensional time series indicators according to business attributes, with groups including resource groups, thread groups, and database groups, i.e., group multi-dimensional time series indicators into resource group multi-dimensional time series indicators, thread group multi-dimensional time series indicators, and database group multi-dimensional time series indicators. The multi-dimensional time series indicators of each group are represented as .

[0084] Among them, the resource group (G1) contains CPU usage, memory usage, and JVM heap memory usage, the thread group (G2) contains thread pool usage, active thread count, and blocked thread count, and the database group (G3) contains data source active connection count and 5-minute database response time. Among them, d1=3, d2=3, d3=2 are the dimensions within the group, and T is the time step.

[0085] S103: Encode the middleware logs to obtain a text sequence representation.

[0086] The pre-trained language model BERT is used to encode the middleware log text sequence s at each time to obtain a text sequence represents, represents the feature representation containing the entire text sequence information, and the formula is as follows:

[0087] ;

[0088] wherein the text sequence s, the expression is: {s=w1,w2,…,w N} represents the log statement that needs to be analyzed, and the log contains N words, i.e. w1,w2,…,w N , the subscript N is the sequence length of the log statement, and w represents a word. The pre-trained language model BERT refers to a deep language model BERT pre-trained using a large unsupervised corpus.

[0089] S104: Time2Vec encoding is performed on the time information in the grouped multi-dimensional time sequence index to obtain the index space-time features of each group.

[0090] Time2Vec encoding is a vector representation method for time series data, which aims to convert the dynamic feature of time into a static vector form that can be processed by the model. The time information in each group of time sequence index data is Time2Vec encoded to generate multi-scale time features of each group. Then, the multi-scale time features of each group and the multi-dimensional time sequence index of each group are spliced and normalized to obtain the index space-time features of each group , the formula is as follows:

[0091] ;

[0092] wherein, is the time embedding vector, is a learnable mapping matrix, which matches the time embedding dimension with the features within the group, wherein, The calculation method of is as follows:

[0093] ;

[0094] wherein, the period parameter C=[3600,7200,86400] corresponds to the hour level, half-day level, and day level period respectively.

[0095] S105: The multi-head attention mechanism is used to encode the index space-time features of each group to obtain the index hidden state representation of each group.

[0096] The multi-head attention mechanism is used to encode the index space-time features of each group to obtain the index hidden state representation of each group , the formula is as follows:

[0097] ;

[0098] wherein, , , are the projection matrix of Query, Key, Value of the g-th group of indicators respectively.

[0099] S106: Generate the intra-group spatio-temporal representation of each group by using the time convolution network TCN and the indicator hidden state representation of each group.

[0100] Use the time convolution network TCN to process the indicator hidden state representation of each group to prevent future information leakage, and fuse the indicator hidden state representation and the time series enhanced representation through residual connection. , obtain the intra-group spatio-temporal representation of each group , the formula is as follows:

[0101] ;

[0102] ;

[0103] wherein, l is the number of layers of the time convolution network.

[0104] S107: Calculate the relevance of the intra-group spatio-temporal representation of each group based on the cross-attention mechanism to obtain the indicator global feature representation.

[0105] Use the cross-attention mechanism to calculate the relevance of the intra-group spatio-temporal representation of each group, take the resource group feature as the query, fuse the thread group and database group features, and obtain the indicator global feature representation , the formula is as follows:

[0106] ;

[0107] ;

[0108] .

[0109] S108: Perform cross-modal fusion on the indicator global feature representation and the text sequence representation based on the cross-attention mechanism to obtain the cross-modal fusion feature representation.

[0110] Use the cross-attention mechanism to perform cross-modal fusion on the indicator global feature representation and the text sequence representation to obtain the cross-modal fusion feature representation , the formula is as follows:

[0111] .

[0112] S109: predicting the multi-dimensional time series indicators of the containers in the cloud-native cluster according to the cross-modal fusion feature representation, to obtain indicator prediction values.

[0113] The GRU gate recurrent unit network and the TCN time convolution network are used as the decoder to predict the indicators of the next three time steps, and the formula is as follows:

[0114] .

[0115] S110: performing abnormal indicator detection and positioning according to the indicator prediction values.

[0116] The threshold is set according to the indicator prediction values, and the threshold is compared with the actual indicator values, to complete the cloud-native multi-dimensional indicator abnormal detection and positioning based on the time perception and the multi-layer attention mechanism.

[0117] In the embodiment of the application, the multi-dimensional time series indicators of the containers in the cloud-native cluster and the middleware logs of the containers in the cluster are first collected, then the multi-dimensional time series indicators are grouped according to the business attributes to obtain the grouped multi-dimensional time series indicators, and the middleware logs are encoded to obtain the text sequence representation. Then, the time information in the grouped multi-dimensional time series indicators is encoded by Time2Vec to obtain the indicator spatio-temporal features, the multi-head attention mechanism is used to encode the indicator spatio-temporal features to obtain the indicator hidden state representation of each group, the time convolution network TCN and the indicator hidden state representation of each group are used to generate the intra-group spatio-temporal representation of each group, and then the relevance of the intra-group spatio-temporal representation of each group is calculated based on the cross-attention mechanism to obtain the indicator global feature representation. The cross-modal fusion is performed on the indicator global feature representation and the text sequence representation based on the cross-attention mechanism to obtain the cross-modal fusion feature representation. The multi-dimensional time series indicators of the containers in the cloud-native cluster are predicted according to the cross-modal fusion feature representation, to obtain the indicator prediction values. Finally, the abnormal indicator detection and positioning are performed according to the indicator prediction values. In this way, by comprehensively collecting the multi-dimensional time series indicators of the containers in the cloud-native cluster and the middleware logs, the overall monitoring of the running state of the containers is realized. The time series indicators are grouped according to the business attributes, and the Time2Vec encoding and the multi-head attention mechanism are combined to effectively extract the indicator spatio-temporal features and the indicator hidden state representation. The intra-group spatio-temporal representation is further generated by using the time convolution network TCN, to enhance the expression ability of the time series features. The relevance of the intra-group spatio-temporal representation is calculated by the cross-attention mechanism to obtain the indicator global feature representation, and the cross-modal fusion is performed on the indicator global feature representation and the text sequence representation, to effectively integrate the multi-dimensional data. The indicator prediction is performed based on the cross-modal fusion feature representation, to improve the accuracy of the prediction. Finally, the accuracy of the detection and positioning can be improved by the abnormal indicator detection and positioning.

[0118] Some specific implementation manners of the cloud-native multi-dimensional index anomaly detection and positioning method provided by the embodiments of the present application are provided above, based on which, the present application further provides a corresponding device. The device provided by the embodiments of the present application will be introduced from the perspective of functional modularization below.

[0119] Referring to Figure 2 , Figure 2 A structural schematic diagram of a cloud-native multi-dimensional index anomaly detection and positioning device provided by the embodiments of the present application is shown in FIG. 2. The cloud-native multi-dimensional index anomaly detection and positioning device 200 comprises:

[0120] The acquisition module 201 is configured to acquire multi-dimensional time series indexes of containers in a cloud-native cluster and middleware logs of the containers in the cluster.

[0121] The grouping module 202 is configured to group the multi-dimensional time series indexes according to business attributes to obtain grouped multi-dimensional time series indexes.

[0122] The first encoding module 203 is configured to encode the middleware logs to obtain text sequence representations.

[0123] The second encoding module 204 is configured to perform Time2Vec encoding on time information in the grouped multi-dimensional time series indexes to obtain index space-time features of each group.

[0124] The third encoding module 205 is configured to encode the index space-time features of each group by using a multi-head attention mechanism to obtain index hidden state representations of each group.

[0125] The generation module 206 is configured to generate intra-group space-time representations of each group by using a time convolution network (TCN) and the index hidden state representations of each group.

[0126] The calculation module 207 is configured to calculate the relevance of the intra-group space-time representations of each group based on a cross-attention mechanism to obtain index global feature representations.

[0127] The cross-modal fusion module 208 is configured to perform cross-modal fusion on the index global feature representations and the text sequence representations based on a cross-attention mechanism to obtain cross-modal fusion feature representations.

[0128] The prediction module 209 is configured to predict the multi-dimensional time series indexes of the containers in the cloud-native cluster according to the cross-modal fusion feature representations to obtain index prediction values.

[0129] The abnormal index detection and positioning module 210 is configured to perform abnormal index detection and positioning according to the index prediction values.

[0130] Optionally, the acquisition module 201 comprises:

[0131] The first collection unit is configured to collect multi-dimensional time series indexes of containers in the cloud-native cluster by using a Prometheus tool.

[0132] The second collection unit is configured to collect middleware logs of the containers in the cluster by using an Elastic Search engine.

[0133] Optionally, the grouping module 202 comprises:

[0134] The first encoding unit is configured to perform Time2Vec encoding on time information in the grouped multi-dimensional time series indexes to generate multi-scale time features of each group.

[0135] The processing unit is configured to perform splicing and normalization processing on the grouped multi-dimensional time series indexes and the multi-scale time features of each group to obtain index space-time features of each group.

[0136] The grouping unit is configured to group the multi-dimensional time series indexes into resource group multi-dimensional time series indexes, thread group multi-dimensional time series indexes and database group multi-dimensional time series indexes according to the business attributes.

[0137] Optionally, the first encoding module 203 comprises:

[0138] The second encoding unit is configured to encode the middleware logs by using a pre-trained language model BERT to obtain the text sequence representation.

[0139] Optionally, the second encoding module 204 comprises:

[0140] Optionally, the generation module 206 comprises:

[0141] The generation unit is configured to perform time series feature enhancement on the index hidden state representation of each group by using a time convolution network TCN, and fuse the index hidden state representation and the time series enhanced representation through a residual connection to obtain an intra-group space-time representation of each group.

[0142] Optionally, the calculation module 207 comprises:

[0143] The calculation unit is configured to take the multi-dimensional time series indexes of the resource group as a query based on a cross-attention mechanism, fuse the multi-dimensional time series indexes of the thread group or the multi-dimensional time series indexes of the database group, and calculate the relevance of the intra-group space-time representations of each group to obtain an index global feature representation.

[0144] Optionally, the prediction module 209 comprises:

[0145] The prediction unit predicts a multi-dimensional time sequence index of the container in the cloud-native cluster by using the cross-modal fusion feature representation and a GRU gate recurrent unit network and a TCN time convolution network as a decoder, to obtain the index prediction value.

[0146] Optionally, the abnormal index detection and positioning module 210 comprises:

[0147] The setting unit sets a threshold value according to the index prediction value.

[0148] The comparison unit compares the actual index value with the threshold value to realize abnormal index detection and positioning.

[0149] Embodiments of the present application also provide a corresponding device and a computer storage medium for implementing the scheme provided by the embodiments of the present application.

[0150] The device comprises a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes to enable the device to execute the method described in any embodiment of the present application.

[0151] The computer storage medium stores codes, and when the codes are executed, the device executing the codes implements the method described in any embodiment of the present application.

[0152] From the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by means of software plus a general hardware platform. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as a read-only memory (English: read-only memory, ROM) / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the method described in each embodiment or some parts of the embodiments of the present application.

[0153] It should be noted that, in the specification, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0154] It should also be noted that each of the embodiments described in the specification illustrate aspects of the application and are not meant to be an exhaustive list of all possible embodiments. Furthermore, the description should not be interpreted as an exhaustive list of all possible aspects of the application. Embodiments of the application can include all possible combinations of the described aspects. The above-described apparatus embodiment is merely illustrative, and units described as separate units can or can not be physically separate, and units described as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0155] The above describes only one specific implementation of the present application, but the protection scope of the present application is not limited to this. Any skilled person in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A cloud-native multi-dimensional indicator anomaly detection and location method, characterized in that: include: Collect multi-dimensional time series metrics of containers in cloud native clusters and middleware logs of containers in clusters; Grouping the multidimensional time series indicators according to business attributes to obtain grouped multidimensional time series indicators; Encoding the middleware log to obtain a text sequence representation; Performing Time2Vec encoding on the time information in the grouped multidimensional time series indicators to obtain the spatiotemporal characteristics of the indicators of each group; A multi-head attention mechanism is used to encode the spatiotemporal features of the indicators of each group to obtain the latent state representation of the indicators of each group; Using the temporal convolutional network (TCN) and the hidden state representation of the indicators of each group, generating the intra-group spatiotemporal representation of each group; Based on the cross-attention mechanism, the correlation of the intra-group spatiotemporal representation of each group is calculated to obtain the global feature representation of the indicator; Based on the cross-attention mechanism, the global feature representation of the indicator and the text sequence representation are cross-modally fused to obtain a cross-modal fusion feature representation; Based on the cross-modal fusion feature representation, multi-dimensional time series indicators of containers in the cloud native cluster are predicted to obtain indicator prediction values; Abnormal indicator detection and positioning are performed based on the predicted values ​​of the indicators.

2. The method according to claim 1, characterized in that The collection of multi-dimensional time series indicators of containers in the cloud native cluster and middleware logs of containers in the cluster includes: Use the Prometheus tool to collect multi-dimensional time series indicators of containers in the cloud native cluster; The Elastic Search engine is used to collect the middleware logs of containers in the cluster.

3. The method according to claim 1, characterized in that The step of grouping the multi-dimensional time series indicators according to the service attributes to obtain the grouped multi-dimensional time series indicators includes: The multi-dimensional timing indicators are divided into multi-dimensional timing indicators of resource groups, multi-dimensional timing indicators of thread groups and multi-dimensional timing indicators of database groups according to the business attributes.

4. The method according to claim 1, wherein The encoding of the middleware log to obtain a text sequence representation includes: The middleware log is encoded using a pre-trained language model BERT to obtain the text sequence representation.

5. The method according to claim 1, wherein The time information in the grouped multi-dimensional time series indicators is encoded using Time2Vec to obtain the spatiotemporal characteristics of the indicators of each group, including: Performing Time2Vec encoding on the time information in the grouped multidimensional time series indicators to generate multi-scale time features for each group; The grouped multi-dimensional time series indicators and the multi-scale time features of each group are spliced ​​and normalized to obtain the spatiotemporal features of the indicators of each group.

6. The method according to claim 1, characterized in that The method of using a temporal convolutional network (TCN) and the hidden state representation of the indicators of each group to generate a spatiotemporal representation of each group includes: The temporal convolutional network (TCN) is used to enhance the temporal features of the latent state representation of the indicators of each group, and the latent state representation of the indicators and the temporal enhancement representation are fused through residual connections to obtain the intra-group spatiotemporal representation of each group.

7. The method according to claim 3, characterized in that The cross-attention mechanism is used to calculate the correlation of the spatiotemporal representations within each group to obtain a global feature representation of the indicator, including: Based on the cross-attention mechanism, the multidimensional timing indicators of the resource group are used as queries, the multidimensional timing indicators of the thread group or the multidimensional timing indicators of the database group are fused, and the correlation of the intra-group spatiotemporal representations of the groups is calculated to obtain the global feature representation of the indicators.

8. The method according to claim 1, characterized in that The method of predicting the multi-dimensional time series indicators of the containers in the cloud native cluster based on the cross-modal fusion feature representation to obtain indicator prediction values ​​includes: A GRU gated recurrent unit network and a TCN temporal convolutional network are used as decoders, and the cross-modal fusion feature representation is utilized to predict the multi-dimensional time series indicators of the containers in the cloud native cluster to obtain the predicted values ​​of the indicators.

9. The method according to claim 1, characterized in that The detecting and locating of abnormal indicators according to the predicted indicator values ​​includes: Setting a threshold value based on the predicted value of the indicator; The actual indicator value is compared with the threshold value to detect and locate abnormal indicators.

10. A cloud-native multi-dimensional indicator anomaly detection and positioning device, characterized in that: include: The collection module is used to collect multi-dimensional time series indicators of containers in the cloud native cluster and the middleware logs of containers in the cluster; A grouping module, configured to group the multidimensional time series indicators according to business attributes to obtain grouped multidimensional time series indicators; A first encoding module, configured to encode the middleware log to obtain a text sequence representation; A second encoding module is used to perform Time2Vec encoding on the time information in the grouped multi-dimensional time series indicators to obtain the spatiotemporal characteristics of the indicators of each group; A third encoding module is used to encode the spatiotemporal features of the indicators of each group using a multi-head attention mechanism to obtain a latent state representation of the indicators of each group; A generation module, configured to generate a spatiotemporal representation of each group using a temporal convolutional network (TCN) and the latent state representation of the indicators of each group; A calculation module, configured to calculate the correlation of the spatiotemporal representations within each group based on a cross-attention mechanism to obtain a global feature representation of the indicator; A cross-modal fusion module, configured to perform cross-modal fusion on the indicator global feature representation and the text sequence representation based on a cross-attention mechanism to obtain a cross-modal fusion feature representation; A prediction module, configured to predict multi-dimensional time series indicators of containers in a cloud native cluster based on the cross-modal fusion feature representation to obtain indicator prediction values; The abnormal indicator detection and positioning module is used to detect and locate abnormal indicators based on the predicted values ​​of the indicators.

Images