Micro-service fault diagnosis method and system based on multi-modal data space-time dependency perception

Abstract

The invention discloses a micro-service fault diagnosis method and system based on multi-modal data spatio-temporal dependency perception, and the method comprises the steps: fusing various modal data, such as logs, indexes and calls, through a gating index linear unit; and extracting time dependence and space dependence characteristics among multi-modal data through a UGFormer algorithm fusing a Transform attention mechanism and GNN graph structure perception capability, and realizing nonlinear transformation mapping from a characteristic vector to target output by using MLP so as to complete complex fault detection and root cause positioning tasks. Experimental evaluation results prove that in a representative micro-service fault data set, the accuracy rate of the method based on the multi-mode space-time dependency perception in a fault detection task reaches 98.9%, and the accuracy rate of the method based on the multi-mode space-time dependency perception in a root cause positioning task HRat1 (Top-1 hit rate) reaches 82.6%.

Description

Technical Field

[0001] This invention belongs to the field of microservice fault diagnosis technology, specifically relating to a microservice fault diagnosis method and system based on multimodal data spatiotemporal dependency awareness. Background Technology

[0002] With the rise of mobile internet and the continuous development of the software industry, the surge in user numbers and rapid changes in demand have rendered traditional monolithic applications ineffective in handling large-scale concurrency, difficult version iteration, and poor scalability. Microservice architecture decomposes complex applications into a set of small, independent services, and has gained widespread adoption due to its higher flexibility, faster iteration speed, better maintainability and scalability, and stronger fault tolerance. However, as the number of services increases, communication between services becomes more complex, service dependencies become difficult to track, leading to chaotic dependency relationships and making deployment, monitoring, and maintenance more complicated. Currently, microservice fault detection and localization, as a key technology to ensure the stable operation of microservice systems, still cannot provide sufficient accuracy and complete interpretability. Existing research and practices are often limited by the limited information provided by single-modal operation and maintenance data, making it difficult to provide a comprehensive perspective to understand and detect more comprehensive and complex fault modes, thus limiting the accuracy and applicability of fault detection and localization.

[0003] Microservice fault diagnosis methods based on multimodal data fusion can be divided into three main categories: result fusion, model fusion, and feature fusion.

[0004] As an early multimodal fusion method, the limitation of result fusion lies mainly in its limited improvement over single-modal techniques. These methods typically perform anomaly detection and other processing on each single-modal data separately, and then fuse the results based on intermodal correlations or voting mechanisms. However, inconsistencies in diagnostic conclusions may arise due to differences in modeling different modal data, increasing the difficulty of the final decision. Furthermore, maintaining multiple single-modal models incurs high storage and maintenance costs, and the overall performance is not significantly superior to single-modal techniques, making it difficult to overcome the inherent limitations of single-modal data.

[0005] Model fusion solutions are often constrained by the heterogeneity of multimodal data. Such methods require the design of complex models that can handle multiple features (such as causal graphs and knowledge graphs). Although integrating more observable data improves the comprehensiveness of diagnosis, the differences in heterogeneous data (such as the unstructured nature of logs and the temporal nature of indicators) increase the difficulty of model design. In addition, graph-based model construction relies on topological or relational information. If the data association is inaccurate, noise may be introduced, affecting the accuracy of diagnosis.

[0006] The core challenge of feature fusion schemes lies in how to effectively handle the unified representation of heterogeneous data and the problem of information loss. These methods require preprocessing of multimodal data to generate a unified feature matrix or event sequence, but the preprocessing process may lose some unique information of some modalities. At the same time, balancing the importance of features of different modalities and ensuring the interpretability of fused features is also quite difficult. If the feature weights are not allocated reasonably, some key information may be underestimated, affecting the accuracy of root cause localization. Summary of the Invention

[0007] To address the shortcomings and challenges mentioned in the feature fusion schemes in the above technical background, this invention proposes a microservice fault diagnosis method and system based on the spatiotemporal dependency awareness of multimodal data. This method fully mines the temporal and spatial dependency features between multimodal data through artificial intelligence algorithms, reduces information loss caused by modality fusion, and can effectively improve the accuracy of fault detection and root cause localization.

[0008] The technical solution adopted in this invention is as follows:

[0009] A microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness includes the following steps:

[0010] S1. Data collection: Collect log data, indicator data, and call data;

[0011] S2. Data processing: Cleaning and processing the three types of heterogeneous data—log data, indicator data, and call data—to obtain log data vectors, indicator data vectors, and call data vectors.

[0012] S3. In the modal fusion stage, the log data vector, indicator data vector, and call data vector are concatenated to obtain an input tensor. Then, the concatenated vector is processed by a gated exponential linear unit (GELU). The multi-source features in the concatenated vector are dynamically filtered and nonlinearly integrated to obtain a comprehensive feature vector.

[0013] S4. In the dependency-aware learning stage, each service in the microservice system is abstracted into several graph nodes, and the call relationship between services is abstracted into edges to construct a complete graph structure data representation. Based on the graph structure and node features, the UGformer network is used to perform end-to-end joint representation learning, thereby effectively capturing the relationship between the service topology and feature information to obtain graph embedding vectors.

[0014] S5. In the fault diagnosis stage, the fault detection task and root cause localization task are mapped to classification tasks. The graph embedding vector is mapped to the specific classification task through MLP, thereby realizing the detection of faults and the localization of root causes.

[0015] Furthermore, in S1, during the process of collecting log data, metric data, and calling data:

[0016] Logstash is used to collect log data, Prometheus is used to collect metric data, and Jaeger is used to collect call data.

[0017] The metrics include: CPU utilization, memory utilization, bytes received per second, and bytes sent per second.

[0018] Furthermore, in S2, during the cleaning and processing:

[0019] For log data, first use Drain to standardize the log data, and then use an implicit Markov model to convert the standardized log data into a hidden state probability vector, i.e., a log data vector.

[0020] For indicator data and call data, linear interpolation is used to complete the missing data in the indicator data to restore the continuity of the indicator data; the call data is pre-processed to obtain the average latency of each service being called at each time step; then, the Z-Score normalization method is used to standardize the processed indicator data and call data, and the formats of the standardized indicator data and call data are integrated and organized into tensors of the same dimension. Then, gated causal convolution (GCC) is used to model the long-distance dependencies in the time series data to obtain indicator data vectors and call data vectors.

[0021] Furthermore, in S2, the GCC models long-distance dependencies in time-series data, and the process of obtaining the indicator data vector and the call data vector is as follows:

[0022] The time-series data includes index data and call data organized into tensors of the same dimension;

[0023] Given an input sequence x 1:t With time step t, the output y of GCC t The calculation is as follows:

[0024]

[0025] Among them, W g and W f These are the gated convolution kernel and the feature convolution kernel, respectively. * indicates a convolution operation, σ is the sigmoid function with an output range of [0,1], controlling the information flow, and tanh is the hyperbolic tangent function, generating candidate activation values. This represents element-wise multiplication; when the input sequence is index data, the output y is... t The indicator data vector, wherein the input sequence is the call data, and the output is y. tTo call the data vector.

[0026] Furthermore, in S4, based on graph structure and node features, the UGformer network is used for end-to-end joint representation learning, thereby effectively capturing the correlation between service topology and feature information, in the process of obtaining graph embedding vectors:

[0027] In each UGformer layer, the features of all nodes are first interacted globally through the Transformer self-attention network, and then the graph topology is explicitly modeled through the GNN layer, ultimately learning a better graph structure data representation.

[0028] Furthermore, in S4, the Transformer self-attention layer performs global interaction on the features of all nodes, capturing long-distance dependencies between nodes; its input is the feature matrix H(k)∈R of all nodes. n×d n is the number of nodes, d is the feature dimension, and the output is the intermediate representation H′(k);

[0029] The GNN layer uses the adjacency matrix Adj of the graph, abbreviated as A, to explicitly model the local structural information between nodes; then A and H′(k) are input into the GNN layer and the features of all output nodes are aggregated, where k represents the number of attention heads, and the aggregated result is the graph embedding vector δ.

[0030] Furthermore, in the self-attention layer, the input node vector The query vector is linearly transformed into a query vector, a key vector, and a value vector. The attention weights of the self-attention layer are obtained by calculating the dot product of the query vector and the key vector, normalizing it using the softmax function, and then multiplying it by the value vector.

[0031] The final attention output ATT is:

[0032]

[0033] Where, N v Let v represent the set of neighboring nodes of node v. The formula indicates that the new representation of node u is the weighted sum of its neighboring nodes u′. These are attention weights, representing the degree of attention node u pays to node u′, where d is the dimension of the vector, and V... (k) It is a value vector;

[0034] The intermediate representation of the formula H′(k) is:

[0035] H ′ (k)=ATT V (H(k)Q (k) ,H(k)K (k) ,H(k)V (k) )

[0036] In the formula, Q (k) For the query vector, K (k) This is the key vector.

[0037] Furthermore, the intermediate representation H′(k) is input into the GNN layer, and the node features are updated in conjunction with the adjacency matrix A of the graph.

[0038] H (k+1) =GNN(A,H′) (k) )

[0039] Among them, H (k+1) It is the updated node feature matrix;

[0040] The aggregation method uses max pooling to obtain the graph embedding vector δ:

[0041]

[0042] Where N(v) is the set of neighboring nodes of node v. It is the neighbor node v i Its characteristics.

[0043] Furthermore, in S5, during the process of mapping the fault detection task and root cause localization task to a classification task after inputting the graph embedding vector into the multilayer perceptron (MLP):

[0044] The fault detection task involves inputting a graph embedding vector into a binary classifier. The classifier's task is to determine whether the system has a fault. Specifically, the last layer of the MLP is a neuron with a sigmoid activation function, which outputs a probability value between 0 and 1.

[0045] The root cause localization task aims to determine the specific cause of the failure. Assuming there are N possible root causes in the microservice system, the graph embedding vector is input into an MLP with N output neurons. Each neuron corresponds to a possible root cause, and the activation function of the output layer is also chosen as softmax to output the probability distribution of each root cause. By selecting the category with the highest probability, the specific root cause of the failure is determined.

[0046] A microservice fault diagnosis system based on multimodal data spatiotemporal dependency awareness, the system comprising:

[0047] One or more processors;

[0048] Memory, used to store one or more programs;

[0049] When the one or more programs are executed by the one or more processors, the one or more processors implement any one of the microservice fault diagnosis methods based on multimodal data spatiotemporal dependency awareness.

[0050] Beneficial effects:

[0051] 1. Spatiotemporal Dependency Fusion of Multimodal Data: This invention innovatively proposes a multimodal data fusion method based on gated exponential linear units (GELU), which can effectively integrate three types of heterogeneous data: logs, metrics, and call chains. It also enhances the ability to capture key information through dynamic filtering and nonlinear integration mechanisms, significantly reducing the information loss problem in traditional feature fusion schemes.

[0052] 2. UGFormer algorithm for spatiotemporal dependency modeling: This invention is based on the UGFormer algorithm, combined with the self-attention mechanism of Transformer and the topology awareness capability of graph neural networks (GNN), to model the temporal dependencies (such as time-series anomaly patterns) and spatial dependencies (such as service call relationships) in microservice systems, breaking through the limitations of traditional methods that rely on only a single data perspective.

[0053] 3. High-precision fault diagnosis and interpretability: By inputting the graph embedding vector extracted by UGFormer into a multilayer perceptron (MLP), this invention achieves high performance in fault detection (accuracy of 98.9%) and root cause localization (HR@1 up to 82.6%), and provides interpretability analysis based on attention weights, which is significantly better than the diagnostic effect of existing single-modal or simple fusion methods.

[0054] Through the aforementioned innovations, this patent solves the problems of difficult multimodal data fusion and insufficient dependency modeling in microservice architecture. It achieves industry-leading levels in fault detection accuracy and root cause location efficiency, providing reliable technical support for ensuring the stability of large-scale microservice systems. Attached Figure Description

[0055] Figure 1 This is a flowchart of a microservice fault diagnosis method based on multimodal data fusion according to an embodiment of the present invention;

[0056] Figure 2 This is a network structure diagram of UGFormer according to an embodiment of the present invention. Detailed Implementation

[0057] The present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments. The purpose and effects of the present invention will become clearer. It should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0058] See Figure 1 This method comprises five stages: data acquisition, data processing, modality fusion, dependency-aware learning, and fault diagnosis. It integrates three modal data types: logs, metrics, and call data, enabling fault detection and root cause classification tasks for microservice systems.

[0059] 1. Data Acquisition Phase

[0060] During the data acquisition phase, Logstash was used to collect log data, Prometheus was used to collect metric data, and Jaeger was used to collect call data. Metric data includes, but is not limited to, CPU utilization, memory utilization, bytes received per second, and bytes sent per second.

[0061] During data collection, exceptions can be manually injected to simulate abnormal situations in a real microservice system. The collected raw data will be stored in a CSV file for subsequent processing.

[0062] 2. Data Processing Stage

[0063] The data processing phase will involve different processes to clean and process the three types of heterogeneous data: logs, metrics, and calls.

[0064] For log data, we first use Drain to standardize the raw data, and then use a hidden Markov model to convert the log sequence into a hidden state probability vector.

[0065] Drain is a high-efficiency online log parsing tool that can automatically convert unstructured raw logs into structured log templates. It uses a heuristic algorithm based on a fixed-depth tree to quickly identify constant and variable parts (such as numbers, IP addresses, etc.) in the logs and represents the variables in wildcard form, thereby achieving log standardization and clustering.

[0066] The process by which a Hidden Markov Model (HMM) obtains the hidden state probability vector from the input observation sequence O = (o1, o2, ..., oT) is achieved through iterative calculations using a forward algorithm: Initially, the initial state probability π is used... i =P(s) i The emission probability b of the first observation (t=1) i (o1)=P(o1∣s i ), thus obtaining the initial hidden state probability distribution α1(i)=π i ·b i (o1); For subsequent time t (2≤t≤T), combine the state probability α of the previous time. t-1 (j) State transition probability a ji =P(s) i |s j ) and the currently observed emission probability bi (o t ), through α t (i)=(∑ j α t-1 (j)·a ji )·b i (o t Iterative updates are performed to obtain the hidden state probability vector (α) at ​​each time step. t (1),α t t(2),…,α t t(N)), where N is the total number of hidden states, and the vector elements represent the probability of being in the corresponding hidden state at time t.

[0067] The processing flow for metrics and data retrieval is similar.

[0068] For indicator data, considering the possible numerical fluctuations during the collection process and the breakpoints and gaps in the original data, linear interpolation is first used to fill in the missing data in order to restore the continuity of the indicator data as much as possible.

[0069] For the data to be invoked, the raw data is first processed to calculate the average latency of each service being invoked at each moment.

[0070] Based on this, to eliminate the differences in data fluctuation caused by the difference in the units of measurement of different indicators, the Z-Score standardization method is further used to standardize the processed dataset, thereby eliminating the influence of the units of measurement and ensuring the fairness and accuracy of subsequent analysis.

[0071]

[0072] Where x represents a specific value in the processed dataset; μ represents the mean of the dataset; σ represents the standard deviation of the dataset; and z is the Z-Score standardized value with a mean of 0 and a standard deviation of 1.

[0073] Next, the formats of the indicator data and the call data are integrated and organized into tensors of the same dimension. Then, gated causal convolution (GCC) is used to model the long-distance dependencies in the time series data (indicator data and call data).

[0074] Gated Causal Convolution (GCC) is a temporal modeling technique that combines gating mechanisms and causal convolution. Its core function is to enhance the expressive power of temporal features by dynamically controlling the information flow while strictly adhering to causal constraints (relying only on historical information). It generates a content stream (activated by tanh) and a gated stream (activated by sigmoid) through parallel convolution operations. The multiplication of these two streams selectively preserves and suppresses features, effectively mitigating the vanishing gradient problem and capturing complex temporal dependencies. Compared to ordinary causal convolution, GCC can adaptively focus on key patterns in the temporal sequence, making it particularly suitable for scenarios requiring fine-grained temporal control, such as long sequence modeling, anomaly detection, and speech synthesis.

[0075] Given an input sequence x 1:t With time step t, the output y of GCC t The calculation is as follows:

[0076]

[0077] Among them, W g and W f These are the gated convolution kernel and the feature convolution kernel, respectively. * indicates a convolution operation, σ is the sigmoid function with an output range of [0,1], controlling the information flow, and tanh is the hyperbolic tangent function, generating candidate activation values. This represents element-wise multiplication; the input sequence is index data or call data.

[0078] 3. Modal fusion stage

[0079] In the modality fusion stage, the log data vector, indicator data vector, and call data vector obtained in the data processing stage are concatenated to obtain the input tensor. Then, the concatenated vector is processed through the gated exponential linear unit (GELU), with the focus on dynamic filtering and nonlinear integration of multi-source features to enhance the capture of key information.

[0080] The Gated Exponential Linear Unit (GELU) is a variant of the Gated Linear Unit (GLU). By combining the gating mechanism with the Exponential Linear Unit (ELU), it enhances the nonlinear expressive power of the model. Its core function is to divide the input features into two parts: one part is activated by the ELU to generate a gating signal, and the other part is multiplied element-wise with the gating signal, achieving dynamic filtering and weighting of information. In multimodal fusion scenarios, GELU can more effectively integrate temporal and non-temporal features, and is particularly suitable for enhancing the modeling ability of long sequence dependencies.

[0081] GELU(x) = proj a (x)⊙ELU(proj b(x)+1)

[0082] Where x is the input tensor, proj a (x) and proj b (x) splits x into two parts through linear projection (usually a fully connected layer); ⊙ represents element-wise multiplication, and ELU is the exponential linear unit activation function.

[0083] 4. Dependency-aware learning stage

[0084] In the dependency-aware learning phase, each service in the microservice system is abstracted as a graph node, such as... Figure 2 The numbers 1, 2, 3, 4, and 5 in the graph represent the call relationships between services, which are abstracted as edges to construct a complete graph structure data representation. In the preliminary stage, a comprehensive feature vector GELU(x) has been generated for each graph node (service) by fusing log data, indicator data, and call data. Based on this graph structure and node features, graph neural networks can be used for end-to-end joint representation learning, thereby effectively capturing the correlation between service topology and feature information.

[0085] UGformer aims to overcome the limitations of using only self-attention mechanisms while ignoring graph structure by combining Transformer self-attention mechanisms and Graph Neural Networks (GNNs) to process small to medium-sized graph data. The core idea of ​​this structure is: in each layer of UGformer, the features of all nodes are first globally interacted through the Transformer self-attention network, and then the graph topology is explicitly modeled through the GNN layer, ultimately learning a better representation of the graph structure data.

[0086] like Figure 2 As shown, each layer of UGformer contains two key components:

[0087] Transformer self-attention layer: Performs global interaction on the features of all nodes, capturing long-distance dependencies between nodes. Its input is the feature matrix H(k)∈R of all nodes. n×d (n is the number of nodes, d is the feature dimension), the output is the intermediate representation H′(k).

[0088] The GNN layer explicitly models the local structural information between nodes using the graph's adjacency matrix Adj, hereinafter referred to as A. Then, A and H′(k) are input into the GNN layer, where k represents the number of attention heads, and the output is the graph embedding vector δ.

[0089] In the self-attention layer, the input node vector It is linearly transformed into three distinct vectors: the query vector (Query, Q), the key vector (Key, K), and the value vector (Value, V). These vectors are calculated as follows:

[0090]

[0091] in, These are learnable weight matrices used to convert the input vector into a query vector, a key vector, and a value vector, respectively.

[0092] The output of the self-attention layer is obtained by multiplying the query vector and key vector by the value vector after normalization using the softmax function. The specific formula is as follows:

[0093]

[0094] in, d is the attention weight, representing the degree of attention node u pays to node u′, and d is the dimension of the vector.

[0095] The final attention output (ATT) is calculated as follows:

[0096]

[0097] Where, N v Let v represent the set of neighboring nodes of node v. This formula indicates that the new representation of node u is the weighted sum of its neighboring nodes u′.

[0098] H′(k)=ATT V (H(k)Q (k) ,H(k)K (k) ,H(k)V (k) )

[0099] Then, the node feature matrix H′(k) output by the Transformer is input into the GNN layer, and the node features are updated in combination with the adjacency matrix A of the graph.

[0100] H (k+1) =GNN(A,H′) (k) )

[0101] Among them, H (k+1) It is the updated node feature matrix.

[0102] To obtain the embedding vector for the entire graph, we need to aggregate the features of all nodes. Common aggregation methods include summation, averaging, or max pooling. Here, we use max pooling to obtain the graph embedding vector δ.

[0103]

[0104] Where N(v) is the set of neighboring nodes of node v. It is the neighbor node v i Its characteristics.

[0105] Thus, UGFormer has effectively learned the global embedding vector representation of the graph. By combining the global modeling capabilities of the Transformer with the local structure awareness capabilities of the GNN, UGFormer is able to learn more powerful and expressive graph representations. This is particularly important for microservice fault diagnosis.

[0106] 5. Fault Diagnosis Phase

[0107] A multilayer perceptron (MLP) is a classic feedforward artificial neural network consisting of at least one input layer, one or more hidden layers (each containing multiple neurons / nodes), and an output layer. Its core is the transmission of data through a fully connected structure: weighted connections are established between each neuron in adjacent layers. After the signal enters through the input layer, the hidden layers extract nonlinear features step by step (relying on activation functions such as ReLU and Sigmoid to introduce nonlinear transformations), and finally, the output layer generates the prediction result.

[0108] For an MLP with L layers, where the weight matrix of the l-th layer (l = 1, 2, ..., L) is W (l) The bias vector is b (l) The activation function is σ. (l) Its input vector h (0) =δ, and its final output is:

[0109] y = σ (l) (W (L) h (L-1) +b (L) )

[0110] After inputting the graph embedding vector δ output from the dependency-aware learning stage into a multilayer perceptron (MLP), the fault detection and root cause localization tasks can be further mapped to classification tasks. Specifically:

[0111] Fault detection task: Input the graph embedding vector into a binary classifier whose task is to determine whether a fault exists in the system. Specifically, the last layer of an MLP is typically a neuron with a sigmoid activation function, which outputs a probability value between 0 and 1.

[0112] Root cause localization task: The goal of the root cause localization task is to determine the specific cause of a failure. Assuming there are N possible root causes in the system, a graph embedding vector δ can be input into an MLP with N output neurons. Each neuron corresponds to a possible root cause, and the activation function of the output layer is also chosen as softmax to output the probability distribution of each root cause. By selecting the category with the highest probability, the specific root cause of the failure can be determined.

[0113] In this way, MLP can effectively map graph embedding vectors to specific classification tasks, thereby enabling fault detection and root cause localization. This method not only utilizes the rich information of the graph structure but also improves task accuracy through the powerful expressive capabilities of MLP.

[0114] Example:

[0115] This embodiment provides a deployment and fault injection process for a benchmark microservice system, the railway ticketing service. The railway ticketing service is a typical microservice architecture, containing 41 microservice instances, 27 of which are business-related. These microservices communicate over a network to provide services for querying, booking, and paying for train tickets. To collect multi-source data, the railway ticketing service system is deployed in a Docker container to simulate valid user requests and test its performance.

[0116] In deploying the unified railway ticketing service system, we used open-source monitoring tools to collect data. To simulate fault conditions in the system, we injected three typical fault types using the Chaosblade tool:

[0117] 1. CPU exhaustion: Simulates the situation of CPU resource exhaustion by having a high-load program consume a large amount of CPU resources.

[0118] 2. Network Congestion: Simulate the performance degradation caused by network congestion by delaying the network data packets of a microservice instance.

[0119] 3. Network packet loss: Randomly discard network data packets to simulate an unstable network environment.

[0120] These fault injections simulated real-world anomalies. We generated 0.2 to 0.5 requests per second for the unified railway ticketing service system for 7 hours to collect normal data. Normal data under fault-free conditions was collected before injecting faults. During the fault injection process, the duration of each fault was set to 10 minutes, with a 2-minute interval between two fault injections. Each fault injection operation was performed on a single microservice. In total, we performed 162 fault injection operations on the unified railway ticketing service system.

[0121] These fault data were collected from multiple sources, including traces, KPIs, and logs. After analysis, they can be used for fault detection and root cause analysis. The collected data was divided into training data (60%) and test data (40%), maintaining a balance between abnormal and normal states.

[0122] According to the method described in this invention, the following processes are performed in sequence in this embodiment:

[0123] 1. Data Preprocessing

[0124] Log data is structured and parsed using the Drain tool to extract log templates, and the log sequence is transformed into a hidden state probability vector using a Hidden Markov Model (HMM). Metric data is filled with missing values ​​using linear interpolation and standardized using the Z-Score method. Call chain data is used to calculate the average call latency of each service at each time step and is also standardized using the Z-Score method. Gated causal convolution (GCC) is used to perform temporal modeling on metrics and call data to extract long-distance dependency features.

[0125] 2. Modal fusion

[0126] Log vectors, indicator vectors, and call vectors are concatenated to form a multimodal input tensor; gated exponential linear units (GELUs) are used to dynamically filter and nonlinearly integrate multi-source features, enhancing the ability to express key anomaly information.

[0127] 3. Dependency-aware learning

[0128] Each microservice is abstracted as a graph node, and the call relationship between services is abstracted as directed edges to construct a service call graph. Based on the UGFormer algorithm, the features of all nodes are first globally interacted through the Transformer self-attention layer to capture the potential temporal and logical relationships between services. Then, the service topology structure is explicitly modeled through the GNN layer to extract local structural information. Finally, the features of each node are aggregated through max pooling to obtain the global graph embedding vector (graph representation).

[0129] 4. Fault Diagnosis

[0130] The graph embedding vector is input into a multilayer perceptron (MLP) for fault detection. The MLP uses a binary classifier (with a sigmoid activation function) to output the probability of whether a system fault has occurred. In experiments, this method accurately detects anomalies at the moment of fault occurrence, achieving an accuracy of 98.9%. For root cause localization, the MLP uses an N-classifier, and the output layer uses a softmax activation function to give the probability that each microservice is the root cause of the fault. Experimental results show that the root cause localization hit rate (HR@1) reaches 82.6%, verifying the interpretability and localization capability of the method in complex scenarios.

Claims

1. A microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness, characterized in that, Includes the following steps: S1. Data collection: Collect log data, indicator data, and call data; S2. Data processing: Cleaning and processing the three types of heterogeneous data—log data, indicator data, and call data—to obtain log data vectors, indicator data vectors, and call data vectors. S3. In the modal fusion stage, the log data vector, indicator data vector, and call data vector are concatenated to obtain an input tensor. Then, the concatenated vector is processed by a gated exponential linear unit (GELU). The multi-source features in the concatenated vector are dynamically filtered and nonlinearly integrated to obtain a comprehensive feature vector. S4. In the dependency-aware learning stage, each service in the microservice system is abstracted into several graph nodes, and the call relationship between services is abstracted into edges to construct a complete graph structure data representation. Based on the graph structure and node features, UGformer is used to perform end-to-end joint representation learning, thereby effectively capturing the relationship between the service topology and feature information to obtain graph embedding vectors. S5. In the fault diagnosis stage, the fault detection task and root cause localization task are mapped to classification tasks. The graph embedding vector is mapped to the specific classification task through MLP, thereby realizing the detection of faults and the localization of root causes.

2. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 1, characterized in that, In S1, during the process of collecting log data, metric data, and calling data: Logstash is used to collect log data, Prometheus is used to collect metric data, and Jaeger is used to collect call data. The metrics include: CPU utilization, memory utilization, bytes received per second, and bytes sent per second.

3. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 1, characterized in that, In S2, during the cleaning and processing process: For log data, first use Drain to standardize the log data, and then use an implicit Markov model to convert the standardized log data into a hidden state probability vector, i.e., a log data vector. For indicator data and call data, linear interpolation is used to fill in the missing data in the indicator data to restore the continuity of the indicator data; preliminary processing of the call data is performed to obtain the average latency of each service being called at each time. Then, the Z-Score normalization method is used to normalize the processed indicator data and call data. The formats of the normalized indicator data and call data are integrated and organized into tensors of the same dimension. Then, gated causal convolution (GCC) is used to model the long-distance dependencies in the time series data to obtain indicator data vectors and call data vectors.

4. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 3, characterized in that, In S2, the GCC models long-distance dependencies in time-series data, and the process of obtaining the indicator data vector and the call data vector is as follows: The time-series data includes index data and call data organized into tensors of the same dimension; Given an input sequence x 1:t With time step t, the output y of GCC t The calculation is as follows: Among them, W g and W f These are the gated convolution kernel and the feature convolution kernel, respectively. * indicates a convolution operation, σ is the sigmoid function with an output range of [0,1], controlling the information flow, and tanh is the hyperbolic tangent function, generating candidate activation values. This represents element-wise multiplication; when the input sequence is index data, the output y is... t The indicator data vector, wherein the input sequence is the call data, and the output is y. t To call the data vector.

5. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 1, characterized in that, In S4, based on graph structure and node features, UGformer is used for end-to-end joint representation learning to effectively capture the correlation between service topology and feature information, thus obtaining the graph embedding vector: In each UGformer layer, the features of all nodes are first globally interacted through the Transformer self-attention network, and then the graph topology is explicitly modeled through the GNN layer, ultimately learning a better graph structure data representation.

6. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 5, characterized in that, In S4, the Transformer self-attention layer performs global interaction on the features of all nodes, capturing long-distance dependencies between nodes; Its input is the feature matrix H(k)∈R of all nodes. n×d n is the number of nodes, d is the feature dimension, and the output is the intermediate representation H′(k); The GNN layer uses the adjacency matrix Adj of the graph, abbreviated as A, to explicitly model the local structural information between nodes; then A and H′(k) are input into the GNN layer and the features of all output nodes are aggregated, where k represents the number of attention heads, and the aggregated result is the graph embedding vector δ.

7. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 6, characterized in that, In the self-attention layer, the input node vector The query vector is linearly transformed into a query vector, a key vector, and a value vector. The attention weights of the self-attention layer are obtained by calculating the dot product of the query vector and the key vector, normalizing it using the softmax function, and then multiplying it by the value vector. The final attention output ATT is: Where, N v Let v represent the set of neighboring nodes of node v. The formula indicates that the new representation of node u is the weighted sum of its neighboring nodes u′. These are attention weights, representing the degree of attention node u pays to node u′, where d is the dimension of the vector, and V... (k) It is a value vector; The intermediate representation of the formula H′(k) is: H′(k)=AT V (H(k)Q (k) ,H(k)K (k) ,H(k)V (k) ) In the formula, Q (k) For the query vector, K (k) This is the key vector.

8. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 6, characterized in that, The intermediate representation H′(k) is input into the GNN layer, and the node features are updated in combination with the adjacency matrix A of the graph. H (k+1) =GNN(A,H′ (k) ) Among them, H (k+1) It is the updated node feature matrix; The aggregation method uses max pooling to obtain the graph embedding vector δ: Where N(v) is the set of neighboring nodes of node v. It is the neighbor node v i Its characteristics.

9. The microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness according to claim 1, characterized in that, In S5, during the process of inputting the graph embedding vector into the multilayer perceptron (MLP) and mapping the fault detection task and root cause localization task to the classification task: The fault detection task involves inputting a graph embedding vector into a binary classifier. The classifier's task is to determine whether the system has a fault. Specifically, the last layer of the MLP is a neuron with a sigmoid activation function, which outputs a probability value between 0 and 1. The root cause localization task aims to determine the specific cause of the failure. Assuming there are N possible root causes in the microservice system, the graph embedding vector is input into an MLP with N output neurons. Each neuron corresponds to a possible root cause, and the activation function of the output layer is also chosen as softmax to output the probability distribution of each root cause. By selecting the category with the highest probability, the specific root cause of the failure is determined.

10. A microservice fault diagnosis system based on multimodal data spatiotemporal dependency awareness, characterized in that, The system includes: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a microservice fault diagnosis method based on multimodal data spatiotemporal dependency awareness as described in any one of claims 1-9.

Images