Multi-modal data fusion distributed software service system anomaly detection method

Abstract

The invention relates to a distributed software service system anomaly detection method based on multi-modal data fusion. Compared with the prior art, the defect that anomaly of a distributed software service system is difficult to detect through single-modal monitoring data is overcome. The method comprises the following steps: acquiring monitoring data of a distributed software service system; constructing an anomaly detection model; training an anomaly detection model; monitoring the distributed software service system to be detected, and obtaining multi-modal monitoring data; and carrying out anomaly detection on the distributed software service system. According to the method, a self-supervised comparative learning method is utilized to explicitly model a dependency relationship among multi-modal data, data characterization of different modals is aggregated through a self-adaptive modal fusion mechanism, and service abnormity is discovered in advance by predicting monitoring data in a next period of time at the current moment, so that online monitoring, operation and maintenance of a service system are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed service system, in particular to a multi-modal data fusion distributed software service system anomaly detection method. BACKGROUND

[0002] Distributed software system improves the scalability and flexibility of software application development by decoupling applications into many small, loosely coupled services, thereby adapting to the rapid growth of service system scale. In order to ensure the normal operation of the service system, multiple modal monitoring data need to be introduced during the service operation, including system runtime logs, system monitoring indicators and service call chains, etc. Through real-time monitoring of system operation state, the normal operation of the service system is ensured by identifying in time when the monitoring data deviates from the normal mode.

[0003] Existing anomaly detection methods mostly start from single modal monitoring data. When the anomaly is reflected on the corresponding modal data, it can be effectively detected. However, with the expansion of application scale and the growth of service types, the types and quantities of anomalies are also increasing. Different types of anomalies often have different performance modes. The anomaly detection method relying on single modal data will have a high false negative rate when facing the above anomalies, because if the anomaly does not significantly deviate from the normal mode in the corresponding data type, the detection method will be difficult to accurately detect it. In addition, there is a complex dependency relationship between different modal monitoring data, and the existing method does not consider the mutual influence between each modal data.

[0004] Therefore, in the distributed software service system, it is necessary to start from the perspective of multi-modal monitoring data, and further study the targeted anomaly detection method, which helps to improve the stability and reliability of the service system, discover potential faults in time, and reduce operation and maintenance cost. SUMMARY

[0005] The purpose of the present application is to solve the defect that single modal monitoring data in the prior art cannot detect the anomaly of the distributed software service system, and to provide a multi-modal data fusion distributed software service system anomaly detection method to solve the above problems.

[0006] In order to achieve the above purpose, the technical scheme of the present application is as follows:

[0007] A multi-modal data fusion distributed software service system anomaly detection method, comprising the following steps:

[0008] Obtaining distributed software service system monitoring data;

[0009] Building an anomaly detection model;

[0010] Training of anomaly detection model;

[0011] monitoring a distributed software service system to be detected, and obtaining multi-modal monitoring data;

[0012] Abnormality detection of the distributed software service system: inputting the multi-modal monitoring data into the trained abnormality detection model, and performing abnormality detection of the distributed software service system according to an alarm threshold.

[0013] The obtaining of the monitoring data of the distributed software service system comprises the following steps:

[0014] obtaining monitoring data of a historical distributed software service system, assuming that the obtained monitoring data is monitoring data in a time window of size at a detection time

[0015] indicator data , representing monitoring indicators in the form of time series in the current time window, wherein is the indicator dimension, indicating that the system has collected pieces of service-related indicator data, and R is a real number set;

[0016] log data , representing log sequences generated in the current time window, sorted by timestamp, representing the number of log entries in the window, representing a single log message;

[0017] call chain data , representing call chain data generated in the current time window, representing the number of call chains in the window, representing a single call chain data.

[0018] The construction of the abnormality detection model comprises the following steps:

[0019] The abnormality detection model comprises a modal separate encoding module, a multi-modal contrast learning module, an adaptive modal fusion module, and an abnormality score calculation module;

[0020] The modal separate encoding module is set;

[0021] The multi-modal contrast learning module is set;

[0022] The adaptive modal fusion module is set;

[0023] The abnormality score calculation module is set.

[0024] The training of the abnormality detection model comprises the following steps:

[0025] The overall error function of the abnormality detection model is set​ defined as the prediction error , the contrastive learning error and the weight entropy error

[0026]

[0027] wherein is a weight factor,

[0028] the prediction error is defined as the difference between the L2 norm of the predicted value and the actual value:

[0029]

[0030] wherein are the indicator, log and call chain data at the th time step, respectively, and are the predicted data of the corresponding modal, respectively;

[0031] all parameters in the neural network are updated end-to-end by the gradient descent method;

[0032] The indicator data, log data and call chain data are input into a modal separate encoding module to extract the features of each modal;

[0033] The modal features are input into a multi-modal contrastive learning module to output the aligned modal features;

[0034] The aligned modal features are input into an adaptive modal fusion module to obtain the predicted value of the multi-modal data;

[0035] The predicted value of the multi-modal data is input into an anomaly score calculation module to calculate the anomaly score and dynamically update the alarm threshold.

[0036] The setting modal separate encoding module comprises the following steps:

[0037] For the indicator data in the form of time series , the missing values are filled by linear interpolation, and the values of the time series are aggregated into fixed time intervals; subsequently, outliers are removed based on the 3-sigma principle to reduce the interference of noise on the training process, and principal component analysis is used to remove indicators with low information content, and Min-max normalization is used to map the absolute value of the indicator to 0 to 1, and the processed indicator data is denoted as

[0038] wherein represents the screened indicator, ​​​​​R represents the size of the aggregated time window, where R is the set of real numbers;

[0039] The Transformer encoder is used to capture global-scale dependencies between time series and generate a global representation. :

[0040] ,

[0041] in, Indicates Transformer encoder;

[0042] Subsequently, the GRU model is used to recursively update adjacent steps to learn local short-range dependencies and generate index representations. :

[0043] ;

[0044] For semi-structured log data First, use Drain to extract the log template, then use the extracted log template to... The original log entries are mapped to corresponding templates to construct a normalized log trigger graph. ,

[0045] in, Representation diagram The nodes in For the number of nodes, The nodes in the graph represent a log template. Represents the weighted adjacency matrix between nodes, for any node Its weight for Chinese log template The normalized probability is calculated using the following formula:

[0046] ,

[0047] in, sequence Chinese log template Number of times, Represents a sequence Chinese log template Number of times, Representing the characteristics of each node, Use the normalized frequency of log template occurrences in each time interval as the node feature;

[0048] Use a graph attention network with edge weights to capture dependencies present in log sequences:

[0049] ,

[0050] ,

[0051] ,

[0052] ,

[0053]

[0054] ,

[0055] ,

[0056] represents the spliced log dependency feature, the time sequence feature in is extracted using the GRU encoder to obtain the log representation ; wherein is the feature of node i, that is, the normalized frequency of the occurrence of log template i in each time interval, is a matrix for linear transformation of the original feature, is the original feature after linear transformation, is the initial feature, is a trainable linear transformation matrix, is the number of network layers, is the attention score of node i to node j, is an attention parameter vector, is an activation function, is the node The normalized attention weight of the neighbor in the first layer, is the neighbor node of node , is the output feature dimension, is a splicing operation, ;

[0057] For tree-shaped call chain data , each call chain data in is split into a more fine-grained call span according to the combination of <calling service, called service>, denoted as ;

[0058] Each span data includes the following fields: timestamp, calling / called service, call chain ID, Span ID, parent Span ID, and call data field. Spans belonging to the same call share a call chain ID and are associated through the parent Span ID, forming a tree structure.

[0059] For all spans within the time window, statistics of features belonging to the same <caller, callee> combination, resulting in feature representation of the call chain ,

[0060] where, denotes the number of <caller, callee> combinations, denotes the feature dimensions obtained from the call chain data, is a real number set;

[0061] Using SENet to adaptively weigh the weights between each dimension:

[0062] ,

[0063] ,

[0064] ,

[0065] ,

[0066] where denotes the weight of each dimension, denotes the features of the same <caller, callee> combination c, is the pooling weight of combination c, denotes the global average pooling, is the i-th feature component of combination c, is the pooling weight of all combinations, is the adaptive activation operation, is the weight vector of p combinations, and are fully connected weight matrices, and are activation functions;

[0067] Features of call chain data is the weighted sum of the original features:

[0068] ,

[0069] where, is the weight of channel c.

[0070] The setting multi-modal contrast learning module comprises the following steps:

[0071] For any two combinations in the three modalities of indicators, logs, and call chains, i.e. , define its contrast learning error :

[0072] ,

[0073] ,

[0074] wherein denotes the temperature coefficient, denotes the data batch, one batch including multimodal data samples, and respectively denote the modal feature of the th data, denotes the cosine similarity, denotes the matching error of modal with respect to modal denotes the matching error of modal for modal ;

[0075] the overall contrastive learning error is:

[0076] .

[0077] The adaptive modal fusion module comprises the following steps:

[0078] The features of the three modalities after alignment are spliced using a multimodal self-attention mechanism, and a self-attention fusion is applied:

[0079] ,

[0080] ,

[0081] ,

[0082] is the fused multimodal unified representation, is the splicing of the aligned features, respectively are query, key, and value matrices, respectively are corresponding linear transformation weight matrices, is the dimension of Q, is a function for row-by-row normalization, is an index representation, is a log representation, is a feature of the call chain data;

[0083] An expert hybrid model is introduced to extract diversified feature representations, and important modal features are activated through an adaptive weight mechanism,

[0084] The expert mixture model comprises K expert models each consisting of a fully connected layer Each expert model is trained by a multi-modal unified representation to predict the time step of three modal data :

[0085] ,

[0086] wherein denotes the indicator data at the time step, denotes the frequency of each log sequence appearing at the time step, denotes the q-dimensional statistical features of p spans at the time step;

[0087] The threshold network is used to adaptively calculate the weight of each expert :

[0088] ,

[0089] wherein is a random Gaussian noise matrix, the operation represents that only the subsequent softmax normalization operation is performed on the top K largest elements in the vector, and the rest of the elements are set to 0, and are linear change matrices, and R is a set of real numbers, is an activation function;

[0090] The final multi-modal data prediction value is the weighted sum of the prediction values of each expert network:

[0091] , is the component of the i-th expert in the weight , , and are the predicted data of the indicators, logs and call chains respectively;

[0092] The weight entropy error is introduced as a regularization term:

[0093] ,

[0094] wherein is used to prevent the base from being 0;

[0095] By maximizing the weight entropy, the model is encouraged to pay attention to the prediction ability of each expert during the training process.​

[0096] The setting abnormal score calculation module comprises the following steps:

[0097] Abnormal score at time t The difference between the predicted value and the actual value of the multi-modal data is:

[0098] ,

[0099] When detecting data stream arrives, using SPOT method to dynamically update detection threshold , , And are the predicted data of the corresponding modal, are the indicators, logs and call chain data at the time step;

[0100] Use the P98 quantile of the first m abnormal scores as the initial threshold u, and then calculate the abnormal score set that exceeds u :

[0101] ,

[0102] is the abnormal score value that exceeds u, is the abnormal score of sample i,

[0103] Use to fit the generalized Paretian distribution , and calculate the detection threshold at this time :

[0104] ,

[0105] Where p is a hyperparameter representing the preset expected abnormal proportion, and represents the preset expected abnormal proportion and are the initial shape parameter and scale parameter of the generalized Paretian distribution ,

[0106] At time t, compare the threshold value at time t-1 with the abnormal score at time t ;

[0107] If , it is considered that the system is in an abnormal state at this time;

[0108] If , the difference between it and u is added to to obtain , and re-fitting the generalized PATE distribution at this time and updating the threshold :

[0109] ,

[0110] where is the number of anomaly scores that have been computed at time t, is the set of anomaly scores at time t, and are the shape and scale parameters of the generalized PATE distribution fitted at time t, respectively. If

[0111] , then no operation is performed. A computer readable storage medium, the storage medium has a computer program stored thereon, when the computer program is executed by a processor, a multi-modal data fusion distributed software service system anomaly detection method can be realized.

[0112] A computer device, characterized in that, include memory, processor and storage on the memory and can run on the processor computer program, when the processor executes, a multi-modal data fusion distributed software service system anomaly detection method can be realized.

[0113] Advantages

[0114] The multi-modal data fusion distributed software service system anomaly detection method of the application, compared with the prior art, uses a self-supervised contrast learning method to explicitly model the dependency relationship between multi-modal data, aggregates data representations of different modalities through an adaptive modal fusion mechanism, predicts monitoring data in the next period of time at the current time, discovers service anomalies in advance, and realizes online monitoring and operation of the service system.

[0115] In order to extract unique features of each modality, the application designs a modal-specific encoding network from the characteristics of each modality; subsequently, the application uses a self-supervised contrast learning method to explicitly model the dependency relationship between multi-modal data. In order to improve the prediction ability of the model, the application aggregates data representations of different modalities through an adaptive modal fusion mechanism, and uses a threshold network to determine the importance of each expert network. Finally, the application predicts monitoring data in the next period of time at the current time, calculates anomaly scores to discover service anomalies, and iteratively updates alarm thresholds, realizes online monitoring and real-time operation of the service system.

[0116] BRIEF DESCRIPTION OF DRAWINGS

[0117] Figure 1 is the method sequence diagram of the application.​

[0118] Figure 2 A method framework of the present application. DETAILED DESCRIPTION

[0119] In order to make the structural features and the effects achieved by the present application more further understood and recognized, the following detailed description is made in conjunction with the preferred embodiments and the accompanying drawings, as follows:

[0120] As shown in the drawings, the abnormality detection method of the multi-modal data fusion distributed software service system of the present application comprises the following steps: Figure 1

[0121] Firstly, the monitoring data of the distributed software service system is acquired.

[0122] In the distributed software service system, the system running state is monitored through various ways, including the service related indicators collected by using Prometheus, the service calling / called situation collected by using Jaeger at a fixed sampling rate, and the distributed logs collected by using the Elasticsearch + Fluentd + Kibana (EFK) suite. The goal is to predict the values of various modal data in the future service running process through the historical monitoring data, and to alarm for the cases exceeding the threshold value. The first step to solve this problem is to abstract the actual application problem into a mathematical problem, and the input of the problem is the monitoring data in the time window of before the detection time (not including ) with a size of .

[0123] The monitoring data of the historical distributed software service system is acquired, and it is assumed that the acquired monitoring data is in the time window of before the detection time with a size of , which includes the following:

[0124] Indicator data , indicating the monitoring indicators in the form of time series in the current time window, wherein is the indicator dimension, indicating that the system has collected pieces of service related indicator data, and R is a real number set;

[0125] Log data , indicating the log sequence generated in the current time window, sorted by timestamp, indicating the number of log entries in the window, indicating a single log message;

[0126] Call chain data , indicating the call chain data generated in the current time window, ​representing the number of call chains in the window, representing single call chain data.

[0127] Secondly, an anomaly detection model is constructed.

[0128] The object of the present application is to establish a proper model to predict the runtime state of the system at the moment , wherein 0 represents a normal state and 1 represents an abnormal state. The present application designs an anomaly detection model as shown in Figure 2 , which mainly includes four stages of modal individual encoding, multi-modal contrast learning, adaptive modal fusion and abnormal score calculation, as shown in Figure 2 .

[0129] (1) The anomaly detection model is set to include a modal individual encoding module, a multi-modal contrast learning module, an adaptive modal fusion module and an abnormal score calculation module.

[0130] (2) The modal individual encoding module is set. The main task of the modal individual encoding stage is to extract unique modal features according to the characteristics of each modal data for further anomaly detection tasks.

[0131] A1) For index data in the form of time series , missing values are filled by linear interpolation, and the values of the time series are aggregated into fixed time intervals (e.g. 1 minute); then, based on the 3-sigma principle, outliers are removed to reduce the interference of noise on the training process, and principal component analysis is used to remove indicators with low information content. In order to eliminate the negative impact of different dimensions and distributions of indicators on model training, Min-max normalization is used to map the absolute value of the indicator to 0 to 1, and the processed indicator data is denoted as ,

[0132] wherein represents the filtered indicators, represents the aggregated time window size, and R is a set of real numbers;

[0133] The Transformer encoder is used to capture the dependency relationship in the global scale of the time series, and to generate a global representation :

[0134] ,

[0135] wherein represents the Transformer encoder;

[0136] Then, the GRU model is used to recursively update the adjacent steps to learn the local short-range dependencies, and the index representation is generated :

[0137] .

[0138] A2) For semi-structured log data , first use Drain to extract log templates to prevent a large number of irrelevant fields in the log from introducing noise information and affecting the judgment ability of the model. Use the extracted log template to map the original log entries in to the corresponding template, in order to effectively utilize the potential sequence features and frequency features in the log data, construct a normalized log trigger graph ,

[0139] wherein, represents a node in the graph , is the number of nodes, is the node in the graph,

[0140] Each node represents a log template. represents the weighted adjacency matrix between nodes, for any node , the weight is the normalized probability of the log template in , the specific calculation formula is:

[0141] ,

[0142] wherein, is the number of times of the log template in the sequence , is the number of times of the log template in the sequence , represents the feature of each node, uses the normalized frequency of the log template appearing in each time interval as the node feature;

[0143] Use the graph attention network with edge weights to capture the dependencies existing in the log sequence:

[0144] ,

[0145] ,

[0146] ,

[0147] ,

[0148]

[0149] ,

[0150] ,

[0151] denotes the stitched log dependency feature, the time sequence feature in is extracted using a GRU encoder to obtain the log representation ; wherein is the feature of node i, i.e., the normalized frequency of occurrence of log template i in each time interval, is a matrix for linear transformation of the original feature, is the original feature after linear transformation, is the initial feature, is a trainable linear transformation matrix, is the number of network layers, is the attention score of node i to node j, is an attention parameter vector, is an activation function, is node The normalized attention weight of the neighbor in the first layer, is the neighbor node of node , is the output feature dimension, is a concatenation operation.

[0152] A3) For tree-shaped call chain data , each call chain data in is split into a more fine-grained call span according to the combination of <calling service, called service>, denoted as ;

[0153] Each span data includes the following fields: timestamp, calling / called service, call chain ID, Span ID, parent Span ID, and call data field. Spans belonging to the same call share a call chain ID and are associated through the parent Span ID, forming a tree structure.

[0154] For all spans within a time window, the features belonging to the same <calling service, called service> combination (such as the average response time of the call, the response success rate, the number of calls, the number of status response codes, etc.) are counted to obtain the feature representation of the call chain ,

[0155] wherein,​ the number of combinations of <caller service, callee service>, representing the feature dimensions statistically obtained from the call chain data, is a real number set;

[0156] using the adaptive learning of SENet to learn the weight of each <caller service, callee service> combination:

[0157] ,

[0158] ,

[0159] ,

[0160] ,

[0161] wherein represents the weight of each dimension, represents the feature of the same <caller service, callee service> combination, is the pooling weight of the combination c, represents the global average pooling, is the i-th feature component of the combination c, is the pooling weight of all combinations, is the adaptive activation operation, is the weight vector of p combinations, and is the fully connected weight matrix, and is the activation function;

[0162] Features of call chain data is the weighted sum of the original features:

[0163] ,

[0164] wherein, is the weight of channel c.

[0165] (3) Set a multi-modal contrast learning module.

[0166] The alignment task of the three modalities is designed as three sets of binary alignment tasks to learn the dependency relationship between modalities and map it to a unified semantic space. Specifically,

[0167] For any binary combination in the three modalities of indicators, logs, and call chains, i.e. , define its contrast learning error :

[0168] ,

[0169] ,

[0170] wherein denotes the temperature coefficient, denotes a data batch, one batch comprising multimodal data samples, and denote the m-th data in the n-th batch, respectively, denote the m-th data in the n-th batch, denotes the cosine similarity, denotes the matching error of the m-th modality with respect to the m-th modality , denotes the matching error of the m-th modality with respect to the m-th modality ;

[0171] the overall contrastive learning error is:

[0172] .

[0173] (4) Set an adaptive modality fusion module.

[0174] B1) In order to learn the correlation between different modalities, a multimodal self-attention mechanism is used to splice the aligned features of the three modalities, and self-attention fusion is applied:

[0175] ,

[0176] ,

[0177] ,

[0178] is the fused multimodal unified representation, is the splicing of the aligned features, are query, key, and value matrices, respectively, are the corresponding linear transformation weight matrices, respectively, is the dimension of Q, the function is used for row-by-row normalization;

[0179] B2) Introduce an expert mixed model to extract diversified feature representations, and activate important modality features through an adaptive weight mechanism,

[0180] the expert mixed model comprises expert models composed of full connection layers , each expert model is activated by the multimodal unified representation Predicted time step Three-modal data :

[0181] ,

[0182] wherein, denotes the indicator data at the th time step, denotes the frequency of each log sequence appearing at the th time step, denotes the q-dimensional statistical features of p spans at the th time step;

[0183] B3) using a threshold network adaptively calculates the weight of each expert :

[0184] ,

[0185] wherein is a random Gaussian noise matrix, operation represents that only the subsequent softmax normalization operation is performed on the top K largest elements in the vector, and the rest of the elements are set to 0, and are linear change matrices, and R is a set of real numbers, is an activation function;

[0186] The final multi-modal data prediction value is the weighted sum of the prediction values of each expert network:

[0187] , is the component of the i th expert in the weight , , and ;

[0188] In order to balance the attention degree of each expert model in the training process and prevent the model from relying too much on a single expert model, the model is encouraged to pay attention to the prediction ability of each expert during the training process by maximizing the weight entropy. Introduce the weight entropy error as a regularization term:

[0189] ,

[0190] wherein is used to prevent the base from being 0.

[0191] (5) Set an abnormal score calculation module.

[0192] C1) abnormal score at the moment The difference between the predicted value and the actual value of the multi-modal data is:

[0193] ,

[0194] When detecting data stream arrival, dynamically update the detection threshold using the SPOT method (C2 step) , , and are the predicted data of indicators, logs and call chains respectively, are the indicator, log and call chain data at the th time step;

[0195] C2) Use the P98 quantile of the first m anomaly scores as the initial threshold u, and then calculate the set of anomaly scores that exceed u :

[0196] ,

[0197] is the anomaly score value that exceeds u, is the anomaly score of sample i,

[0198] Use to fit the generalized Pareto distribution , and calculate the detection threshold at this time :

[0199] ,

[0200] where p is a hyperparameter representing the preset expected anomaly proportion (preset expected anomaly proportion), and are the initial shape parameter and scale parameter of the generalized Pareto distribution ,

[0201] At time t, compare the threshold value at time t-1 with the anomaly score at time t ;

[0202] If , it is considered that the system is in an abnormal state at this time;

[0203] If , the difference between it and u is added to to obtain , and the generalized Pareto distribution at this time is refitted using , and the threshold value is updated :

[0204] ​ ,

[0205] wherein denotes the number of abnormal scores that have been calculated at time t, is the set of abnormal scores at time t, and are the shape parameter and scale parameter of the generalized Pareto distribution fitted at time t, respectively;

[0206] If , no operation is performed.

[0207] Third step, training of the anomaly detection model.

[0208] (1) Set the overall error function of the anomaly detection model defined as the sum of the prediction error , the contrastive learning error and the weight entropy error :

[0209] ,

[0210] wherein is a weight factor,

[0211] The prediction error is defined as the difference between the predicted value and the actual value in terms of L2 norm:

[0212] ,

[0213] wherein, are the indicator, log and call chain data at the th time step, respectively, , and are the predicted data of the corresponding modalities;

[0214] All parameters in the neural network are updated end-to-end by the gradient descent method.

[0215] (2) The indicator data, log data and call chain data are input into the modality separate coding module to extract the features of each modality;

[0216] The features of each modality are input into the multi-modal contrastive learning module to output the aligned modality features;

[0217] The aligned modality features are input into the adaptive modality fusion module to obtain the predicted value of the multi-modal data;

[0218] The predicted value of the multi-modal data is input into the abnormal score calculation module to calculate the abnormal score and dynamically update the alarm threshold. ​

[0219] Fourthly, the distributed software service system to be detected is monitored, and multi-modal monitoring data is obtained.

[0220] Fifthly, abnormality detection of the distributed software service system: the multi-modal monitoring data is input into the trained abnormality detection model, and abnormality monitoring of the distributed software service system is performed according to an alarm threshold.

[0221] The basic principles, main features and advantages of the present application are shown and described above. It should be understood by those skilled in the art that the present application is not limited by the above examples, and the above examples and descriptions in the specification are only the principles of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the claimed present application. The scope of protection required by the present application is defined by the appended claims and their equivalents.

Claims

1. A method for anomaly detection in a distributed software service system using multimodal data fusion, characterized in that, Includes the following steps: 11) Obtain monitoring data from the distributed software service system; 12) Construct an anomaly detection model; 13) Training the anomaly detection model; 14) Monitor the distributed software service system under test and acquire multimodal monitoring data; 15) Anomaly detection in distributed software service systems: Input multimodal monitoring data into the trained anomaly detection model, and perform anomaly monitoring of distributed software service systems based on alarm thresholds.

2. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 1, characterized in that, The process of obtaining monitoring data for the distributed software service system includes the following steps: Obtain historical monitoring data of the distributed software service system, assuming the data obtained is from the detection time. The previous size was The monitoring data within the time window includes the following: Indicator data , represents the monitoring indicators in time series form within the current time window, where As an indicator dimension, it represents the data collected by the system. The service-related metrics data, where R is the set of real numbers; Log data This indicates the log sequence generated within the current time window, sorted by timestamp. This indicates the number of log entries in the window. This represents a single log message; Call chain data This represents the call chain data generated within the current time window. This indicates the number of call chains in the window. This represents a single call chain data.

3. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 1, characterized in that, The construction of the anomaly detection model includes the following steps: 31) The anomaly detection model is defined as including a modality-specific encoding module, a multimodal contrastive learning module, an adaptive modality fusion module, and an anomaly score calculation module; 32) Set up a separate encoding module for each modality; 33) Set up a multimodal contrastive learning module; 34) Configure the adaptive modal fusion module; 35) Set up the abnormal score calculation module.

4. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 1, characterized in that, The training of the anomaly detection model includes the following steps: 41) Define the overall error function of the anomaly detection model. Defined as prediction error Comparative learning error and weighted entropy error The sum of: ， in As a weighting factor, Prediction error Defined as the difference in L2 norm between the predicted and actual values: ， in, The first Metrics, logs, and call chain data at each time step , and These are the prediction data for the corresponding modes; Update all parameters in the neural network end-to-end using gradient descent. 42) Input indicator data, log data, and call chain data into the modality-specific encoding module to extract features for each modality; Each modal feature is input into the multimodal contrast learning module, which outputs aligned modal features. The aligned modal features are input into the adaptive modal fusion module to obtain the predicted values ​​of the multimodal data; The predicted values ​​of the multimodal data are input into the anomaly score calculation module to calculate the anomaly score and dynamically update the alarm threshold.

5. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 3, characterized in that, The setting modality separate encoding module includes the following steps: 51) For indicator data in time series format The missing values ​​are filled using linear interpolation, and the time series values ​​are aggregated into fixed time intervals. Then, outliers are removed based on the 3-sigma principle to reduce noise interference during training. Principal component analysis is used to remove indicators with insufficient information content, and Min-max normalization is used to map the absolute values ​​of the indicators to between 0 and 1. The processed indicator data is denoted as follows: , in, This indicates the selected indicators. R represents the size of the aggregated time window, where R is the set of real numbers; The Transformer encoder is used to capture global-scale dependencies between time series and generate a global representation. : ， in, Indicates Transformer encoder; Subsequently, the GRU model is used to recursively update adjacent steps to learn local short-range dependencies and generate index representations. : ； 52) For semi-structured log data First, use Drain to extract the log template, then use the extracted log template to... The original log entries are mapped to corresponding templates to construct a normalized log trigger graph. , in, Representation diagram The nodes in For the number of nodes, The nodes in the graph represent a log template. Represents the weighted adjacency matrix between nodes, for any node Its weight for Chinese log template The normalized probability is calculated using the following formula: ， in, sequence Chinese log template Number of times, Represents a sequence Chinese log template Number of times, Representing the characteristics of each node, Use the normalized frequency of log template occurrences in each time interval as the node feature; Use a graph attention network with edge weights to capture dependencies present in log sequences: ， ， ， ， ， ， This represents the concatenated log dependency features, extracted using a GRU encoder. The temporal characteristics in the log are used to obtain log representations. ;in The characteristic of node i is the normalized frequency of log template i in each time interval. The matrix is ​​used to perform a linear transformation on the original features. These are the original features after linear transformation. As initial features, Let be a trainable linear transformation matrix. For the number of network layers, Let be the attention score of node i to node j. For attention parameter vectors, For activation function, For nodes In the Floor to Neighbor Normalized attention weights For nodes The neighboring nodes, To output feature dimensions, For splicing operations, ; 53) For tree-like call chain data Based on the combination of <calling service, called service>, Each call chain data in Break it down into finer-grained calls to span, denoted as ; Each span data includes the following fields: timestamp, calling / called service, call chain ID, span ID, parent span ID, and call data field. Spans belonging to the same call share a call chain ID and are associated through the parent span ID to form a tree structure. For all spans within the time window, we statistically analyze the features belonging to the same <calling service, called service> combination to obtain the feature representation of the call chain. , in, This represents the number of combinations of <calling service, called service>. This represents the feature dimensions obtained from the call chain data. It is the set of real numbers; Using SENet to adaptively balance the weights across the various dimensions: ， ， ， ， in This represents the weight of each dimension. This describes the characteristics of the same <calling service, called service> combination c. The pooling weights for combination c, Indicates global average pooling. Let i be the i-th feature component of combination c. Concatenate the pooling weights for all combinations. For adaptive activation operation, Let p be the weight vector of the combinations. and The weight matrix is ​​the fully connected component. and For activation functions; Features of call chain data Weighted summation of the original features: ， in, Let be the weight of channel c.

6. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 3, characterized in that, The setup of the multimodal contrastive learning module includes the following steps: For any binary combination of the three modalities of metrics, logs, and call chains, i.e. Define its contrastive learning error : ， ， in Indicates the temperature coefficient. This indicates a data batch, where a batch includes... A multimodal data sample, and They represent the first Modality in the data feature, Represents cosine similarity. Representing modes Relative to mode Matching error, Representing modes For mode Matching error; Overall contrastive learning error for: 。 7. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 3, characterized in that, The setting of the adaptive modality fusion module includes the following steps: 71) Using a multimodal self-attention mechanism, the aligned features from the three modalities are concatenated, and self-attention fusion is applied: ， ， ， To achieve a unified representation of the fused multimodal structures, For the splicing of alignment features, These are query, key, and value matrices, respectively. These are the corresponding linear transformation weight matrices. For the dimension of Q, The function is used for row-by-row normalization. As an indicator, For log characterization, Features of the call chain data; 72) Introduce an expert hybrid model to extract diverse feature representations, and activate important modal features through an adaptive weighting mechanism. Expert hybrid models include An expert model consisting of fully connected layers Each expert model is represented by a multimodal unified representation. Predicting time steps Trimodal data : ， in, Indicates the first Indicator data at each time step Indicates the first The frequency of each log sequence at each time step Indicates the first q-dimensional statistical features of p spans at each time step; 73) Using threshold networks Adaptive calculation of each expert's weight : ， in The noise matrix is ​​random Gaussian. The operation means that only the first K largest elements of the vector are subjected to subsequent softmax normalization, and the remaining elements are set to 0. and Let R be a linear transformation matrix, and R be the set of real numbers. For activation functions; The final multimodal data prediction is a weighted sum of the predictions from each expert network: , For weight The weight of the i-th expert in the middle, , and These are prediction data for metrics, logs, and call chains, respectively. Introducing weighted entropy error As a regularization term: ， in Used to prevent the base from being 0; By maximizing weight entropy, the model is encouraged to consider the predictive capabilities of various experts simultaneously during training.

8. The anomaly detection method for a distributed software service system based on multimodal data fusion according to claim 3, characterized in that, The abnormal score calculation module includes the following steps: 81) outlier score at time The difference between the predicted and actual values ​​of multimodal data: ， When the detection data stream arrives, the SPOT method is used to dynamically update the detection threshold. , , and These are the prediction data for the corresponding modes. The first Metrics, logs, and call chain data at each time step; 82) Use the P98 quantile of the first m outlier scores as the initial threshold u, and then calculate the set of outlier scores that exceed u. : ， For abnormal scores exceeding u, The outlier score for sample i. use Fitting the generalized Patore distribution And calculate the detection threshold at this time. : ， Where p is a hyperparameter representing the preset expected anomaly ratio, and represents the preset expected anomaly ratio. and They are the generalized Patore distributions. Initial shape parameters and scale parameters, At time t, compare the threshold at time t-1. outlier score at time t ; if If so, the system is considered to be in an abnormal state. if Then add the difference between it and u. From ,use Refit the generalized Patore distribution at this point and update the threshold : ， in This represents the number of abnormal scores calculated at time t. Let be the set of outlier scores at time t. and The generalized Patorai distribution fitted at time t is shown below. Shape parameters and scale parameters; if If so, no operation will be performed.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, enables the anomaly detection method for a distributed software service system based on multimodal data fusion as described in any one of claims 1-8.

10. A computer device, characterized in that, The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it can implement the anomaly detection method for a distributed software service system based on multimodal data fusion as described in any one of claims 1-8.

Images