Time-frequency feature comparison enhanced micro-service system anomaly detection method, device and equipment and storage medium

Abstract

The application discloses a micro-service system anomaly detection method and device based on time-frequency feature contrast enhancement, equipment and a storage medium, the method comprises the following steps: inputting original data of a micro-service system into a pre-trained target anomaly detection model for processing, and outputting an anomaly detection result; since the frequency feature enhancement module is used for extracting frequency domain features in the application, the dependence between channels is enhanced, the utilization capability of the model for frequency information is improved, multi-level positive samples and negative samples are generated based on the frequency domain features, and then multi-level feature coding is performed, so that the abnormal conditions of real data are effectively simulated, model degradation is prevented, the recognition capability of the model for fluctuations is enhanced, and thus the abnormal fluctuations in the micro-service system can be accurately detected; reconstruction and contrast learning are combined, the recognition capability of the model for abnormal signals is enhanced, the robustness and accuracy of anomaly detection are improved, and the abnormal fluctuations in the micro-service system can be accurately detected.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of microservice system anomaly detection, and in particular to a microservice system anomaly detection method and device based on time-frequency feature comparison enhancement, equipment and storage medium. BACKGROUND

[0002] With the acceleration of digital transformation, microservice architecture has become the mainstream choice for large distributed systems (such as e-commerce, finance, cloud services, etc. scenarios). Its core is to split a monolithic application into dozens or even hundreds of independent services that work together through network calls. This architecture brings flexibility and scalability advantages, but also leads to exponential growth in system complexity.

[0003] For microservice system data field anomaly detection, time series anomaly detection technology is mainly used. However, existing time series anomaly detection technology has defects, and these defects are further exacerbated in the dynamic, heterogeneous, and strongly correlated scenarios of microservice systems:

[0004] First, the missing frequency domain information and the amplification of dynamic boundary error: existing time series anomaly detection mainly focuses on long and short term dependencies in the time domain, while ignoring pattern information in the frequency domain. Existing frequency information extraction methods are mostly based on Fourier transform. However, Fourier transform has the Gibbs phenomenon, i.e. when the values on both sides of the sequence differ greatly, there will be oscillation approximation, introducing high-frequency noise, increasing the error value of the boundary information, and thus affecting the detection result. In microservice systems, this defect is amplified due to architectural characteristics. This is because microservices are strongly dynamic, with service instances scaling up and down with traffic, frequent version iterations, and frequent and complex changes in time series "boundaries" (such as service startup cold start and version switching time).

[0005] Second, the risk of insufficient negative sample generation in unsupervised scenarios is exacerbated: microservice anomalies are multi-source and low-probability, with fault scenarios including service-to-service call timeouts, dependent service outages, network partitions, and extreme traffic shocks, and most anomalies are low-frequency "black swan" events (for example, a payment service experiencing a cascade timeout due to a third-party interface failure). Real anomaly label data is difficult to cover comprehensively, leading to an increased risk of insufficient negative sample generation in unsupervised scenarios.

[0006] Third, time series reconstruction is difficult to adapt to the heterogeneous scenario of microservice systems: microservice time series are heterogeneous: the index modes of different technology stack services differ significantly (for example, GC latency of Java services, number of coroutines of Go services, and command response time of Redis), and there are also inter-instance differences in time series of different instances of the same service (such as user services deployed in multiple replicas). Existing time series anomaly detection methods rely on time series reconstruction, and traditional reconstruction methods require accurate reconstruction of normal data, but such methods face challenges when dealing with complex microservice system time series. If the model is too complex, it may degenerate into an identity transformation and cannot effectively distinguish between normal and abnormal data; if the model is too simple, it cannot capture the complex dependencies of time series. SUMMARY

[0007] The main purpose of the present application is to provide a microservice system anomaly detection method, device, equipment and storage medium based on time-frequency feature comparison enhancement, aiming to solve the technical problem that the time series anomaly detection technology in the prior art is further intensified in the dynamic, heterogeneous and strong correlation scenario of the microservice system, resulting in the inability to accurately detect abnormal fluctuations in the microservice system.

[0008] To achieve the above purpose, the present application provides a microservice system anomaly detection method based on time-frequency feature comparison enhancement, which is applied to a microservice system, and the method comprises the following steps:

[0009] The original data of the microservice system is input into a pre-trained target anomaly detection model for processing, and an anomaly detection result is output;

[0010] The processing process of the target anomaly detection model comprises:

[0011] The original data of the microservice system is normalized to obtain normalized original data;

[0012] The frequency domain feature enhancement module extracts frequency domain features from the normalized original data to obtain an input feature sequence;

[0013] The input feature sequence is sliced and divided to generate a plurality of different levels of positive sample sequences;

[0014] The positive sample sequences are respectively input into a positive sample encoding structure and a negative sample encoding structure for feature encoding to obtain positive sample features and negative sample features;

[0015] The decoder respectively decodes the positive sample features and the negative sample features to output positive sample output results and negative sample output results, and the positive sample output results are de-normalized to obtain a reconstructed sequence;

[0016] A contrast anomaly score is generated based on the positive sample output and the negative sample output, and a reconstruction anomaly score is generated based on the reconstructed sequence and the normalized original data.

[0017] Based on the comparison anomaly score and the reconstructed anomaly score, a target anomaly score is determined. It is then determined whether the target anomaly score is higher than a preset anomaly score threshold, and the determination result is output as an anomaly detection result.

[0018] Optionally, the frequency domain feature extraction process of the frequency domain feature enhancement module includes:

[0019] Discrete cosine transform is performed on the time series of each channel of the normalized original data to obtain frequency domain features:

[0020]

[0021] in, This represents DCT transformed data. Indicates frequency index, This represents the original data after normalization. Represents the first in a time series Values ​​at each point in time. Indicates a time index. Indicates the sequence length;

[0022] The frequency domain features are normalized to obtain the normalized frequency domain features:

[0023]

[0024] in, This represents the normalized frequency domain characteristics. This represents the instance normalization function. Representing feature dimension, Indicates batch size. Indicates the number of channels. Indicates the first The first sample The mean frequency domain characteristics of each channel, Indicates the first The first sample The frequency domain characteristic variance of each channel, Represents a constant;

[0025] The normalized frequency domain features are weighted by a fully connected layer to obtain the frequency domain feature weights.

[0026]

[0027] in, Represents the frequency domain feature weights. represents a convolutional layer, represents an activation function, represents a Sigmoid function;

[0028] apply the frequency domain feature weight to the normalized original data to obtain a weighted time domain feature, and perform residual connection on the weighted time domain feature and the normalized original data to obtain an input feature sequence:

[0029]

[0030]

[0031] wherein, represents a weighted time domain feature, represents an element-wise multiplication, represents an input feature sequence.

[0032] Optionally, the positive sample structure comprises a multi-level encoder, and the negative sample structure comprises a noise pollution module and a multi-level encoder.

[0033] The noise pollution module is configured to perform noise pollution processing on a positive sample sequence input into the negative sample encoding structure to generate a negative sample sequence, and output the negative sample sequence to the multi-level encoder.

[0034] The feature encoding process of the multi-level encoder comprises:

[0035] value embedding encoding and position embedding encoding are performed on the input sequence to obtain value encoding features and position encoding features, the input sequence being a positive sample sequence or a negative sample sequence;

[0036] The value encoding features and the position encoding features are fused, and the fused features are regularized to obtain candidate features;

[0037] The candidate features are input into a plurality of multi-head attention mechanism layers for calculation to obtain multi-head attention mechanism calculation results;

[0038] The multi-head attention mechanism calculation results are subjected to residual connection and normalization processing to obtain intermediate features, and the intermediate features are input into a feedforward network for processing to obtain output features, the output features being positive sample features or negative sample features.

[0039] Optionally, the noise pollution processing process of the noise pollution module comprises:

[0040] The positive sample sequence input into the negative sample encoding structure is divided into a first half portion of data and a second half portion of data;

[0041] Noise masks and Gaussian noise are generated based on a probability threshold for contamination.

[0042] The second half of the data is noise-contaminated based on the noise mask and the Gaussian noise, and then the noise-contaminated second half of the data is combined with the first half of the data to generate a negative sample sequence.

[0043] Optionally, the inverse normalization processing of the positive sample output results includes:

[0044]

[0045] in, For the sequences in the output results of positive samples, Represents the inverse normalization function. For offset parameters, For scaling parameters, Represents a sequence The mean, Represents a sequence variance The reconstructed sequence output after inverse normalization. Represents a constant.

[0046] Optionally, before inputting the raw data of the microservice system into the pre-trained target anomaly detection model for processing and outputting the anomaly detection result, the method further includes:

[0047] A raw anomaly detection model is constructed, and the raw dataset of the microservice system is input into the raw anomaly detection model for processing in order to train the raw anomaly detection model;

[0048] The training process of the original anomaly detection model includes:

[0049] The original dataset is normalized to obtain a normalized original dataset, and the normalized original dataset is divided into a training dataset and a test dataset according to a preset ratio.

[0050] The training dataset is subjected to frequency domain feature extraction using a frequency domain feature enhancement module to obtain the input feature sequence;

[0051] The input feature sequence is sliced ​​to generate multiple positive sample sequences at different levels;

[0052] The positive sample sequence is input into the positive sample encoding structure and the negative sample encoding structure respectively for feature encoding to obtain positive sample features and negative sample features;

[0053] The positive sample feature and the negative sample feature are respectively decoded by a decoder to obtain a positive sample output result and a negative sample output result, and the positive sample output is de-normalized to obtain a reconstruction sequence;

[0054] A contrast loss function is generated based on the positive sample output result and the negative sample output result, and a reconstruction loss function is generated based on the reconstruction sequence and the training data set;

[0055] A joint loss function is constructed based on the contrast loss function and the reconstruction loss function, and the original anomaly detection model is trained based on the joint loss function;

[0056] The test data set is input into the trained original anomaly detection model for processing to obtain a test result;

[0057] In response to the test result meeting a preset condition, the trained original anomaly detection model is output as a target anomaly detection model.

[0058] Optionally, the contrast loss function is generated based on the positive sample output result and the negative sample output result, including:

[0059] The positive sample output result and the negative sample output result are spliced to obtain a spliced sample:

[0060]

[0061] wherein, represents the spliced sample, , and represent the positive sample output results of different scales respectively, represents the negative sample output result;

[0062] The spliced sample is normalized to obtain a normalized sample:

[0063]

[0064] wherein, represents the normalized sample, represents a value of a channel at a time point in an i-th sample;

[0065] The normalized sample is transposed to obtain a transposed sample:

[0066]

[0067] wherein, ​​​denotes a transpose sample, denotes a transpose, denotes a dimension of the transpose sample;

[0068] a cosine similarity matrix is calculated based on the transpose sample:

[0069]

[0070] wherein, denotes a cosine similarity matrix, denotes a dimension of the cosine similarity matrix;

[0071] elements in the upper half and the lower half of the diagonal of the similarity matrix are extracted and spliced to obtain a spliced matrix:

[0072]

[0073] wherein, denotes a spliced matrix, denotes a time point sample cosine similarity with other samples, denotes a cosine similarity between a vector and a vector at a position ;

[0074] the spliced matrix is normalized to obtain a normalized matrix:

[0075]

[0076] wherein, denotes a normalized matrix, denotes a Softmax function, denotes a dimension of the normalized matrix;

[0077] a probability distribution calculation is performed based on the normalized matrix to obtain a first similarity probability sum and a second similarity probability sum:

[0078]

[0079]

[0080] wherein, denotes a first similarity probability sum, the first similarity probability sum being used to measure the similarity of a sample to a sample , a sample , denotes a second similarity probability sum, the second similarity probability sum being used to measure the similarity of a sample to a sample , samples of similarity, denotes a sample index, denotes a time point index;

[0081] generate a contrast loss function based on the first similarity probability sum and the second similarity probability sum, the contrast loss function comprising:

[0082]

[0083]

[0084]

[0085] wherein, denotes a first contrast loss term, denotes a second contrast loss term, denotes a total contrast loss;

[0086] the reconstruction loss function comprises:

[0087]

[0088]

[0089]

[0090]

[0091] wherein, denotes the average value of the reconstruction loss, , and denote reconstruction sequences of three different scales respectively, denotes an input training data set, , and denote three reconstruction losses calculated based on the reconstruction sequences of different scales respectively, denotes a mean square error function.

[0092] In addition, in order to achieve the above purpose, the application further provides a microservice system anomaly detection device based on time-frequency feature contrast enhancement, which is applied to a microservice system, and is used to realize the microservice system anomaly detection method based on time-frequency feature contrast enhancement as described above.

[0093] In addition, to achieve the above object, the present application also provides a microservice system anomaly detection device based on time-frequency feature comparison enhancement, comprising a memory, a processor and a microservice system anomaly detection program based on time-frequency feature comparison enhancement stored in the memory, wherein the processor is configured to run the microservice system anomaly detection program based on time-frequency feature comparison enhancement, and the computer program is configured to implement the steps of the microservice system anomaly detection method based on time-frequency feature comparison enhancement as described above.

[0094] In addition, to achieve the above object, the present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the microservice system anomaly detection method based on time-frequency feature comparison enhancement as described above.

[0095] The present application inputs the original data of the microservice system into a pre-trained target anomaly detection model for processing, and outputs an anomaly detection result; the processing process of the target anomaly detection model comprises: normalizing the original data of the microservice system to obtain normalized original data, extracting frequency domain features from the normalized original data through a frequency domain feature enhancement module to obtain an input feature sequence, slicing and dividing the input feature sequence to generate a plurality of different levels of positive sample sequences, inputting the positive sample sequences into a positive sample coding structure and a negative sample coding structure respectively for feature coding to obtain positive sample features and negative sample features, decoding the positive sample features and the negative sample features through a decoder respectively to obtain positive sample output results and negative sample output results, and performing inverse normalization on the positive sample output results to obtain a reconstruction sequence, generating a comparison anomaly score based on the positive sample output results and the negative sample output results, generating a reconstruction anomaly score based on the reconstruction sequence and the normalized original data, determining a target anomaly score based on the comparison anomaly score and the reconstruction anomaly score, judging whether the target anomaly score is higher than a preset anomaly score threshold, and outputting the judgment result as an anomaly detection result; since the frequency domain features are extracted through the frequency feature enhancement module, the dependence between channels is enhanced, the utilization ability of the model for frequency information is improved, a plurality of levels of positive samples and negative samples are generated based on the frequency domain features, then multi-level feature coding is performed respectively, the abnormal situation of the real data is effectively simulated, the model degradation is prevented, the recognition ability of the model for fluctuations is enhanced, and thus the abnormal fluctuations in the microservice system are accurately detected, the reconstruction and comparison learning are combined, the recognition ability of the model for abnormal signals is enhanced, the robustness and accuracy of the anomaly detection are improved, and the abnormal fluctuations in the microservice system are accurately detected. BRIEF DESCRIPTION OF DRAWINGS

[0096] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, the other drawings can also be obtained based on these drawings without any creative effort.

[0097] Figure 1 is the structure schematic diagram of the micro-service system anomaly detection equipment based on time-frequency feature comparison and enhancement of the hardware running environment related to the embodiment scheme of the present application.

[0098] Figure 2 is the flowchart of the first embodiment of the micro-service system anomaly detection method based on time-frequency feature comparison and enhancement of the present application.

[0099] Figure 3 is the processing flowchart of the frequency domain feature enhancement module in the embodiment of the micro-service system anomaly detection method based on time-frequency feature comparison and enhancement of the present application.

[0100] Figure 4 is the flowchart of the second embodiment of the micro-service system anomaly detection method based on time-frequency feature comparison and enhancement of the present application.

[0101] Figure 5 is the anomaly detection flowchart of the micro-service system in the second embodiment of the micro-service system anomaly detection method based on time-frequency feature comparison and enhancement of the present application.

[0102] The implementation of the object of the present application, functional features and advantages will be further described with reference to the accompanying drawings in combination with the embodiments. DETAILED DESCRIPTION

[0103] It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0104] Referring to Figure 1 , Figure 1 is the structure schematic diagram of the micro-service system anomaly detection equipment based on time-frequency feature comparison and enhancement of the hardware running environment related to the embodiment scheme of the present application.

[0105] As Figure 1As shown in the figure, the microservice system anomaly detection device based on time-frequency feature comparison enhancement can include a processor 1001, for example, a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between the components. The user interface 1003 can include a display screen, an input unit such as a keyboard, and can also include a standard wired interface and a wireless interface. The network interface 1004 can optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 can be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM) such as a disk memory. The memory 1005 can also be a storage device independent of the aforementioned processor 1001.

[0106] Those skilled in the art can understand that Figure 1 The structure shown in the figure does not constitute a limitation on the microservice system anomaly detection device based on time-frequency feature comparison enhancement, and can include more or fewer components than the figure, or combine certain components, or different component arrangements.

[0107] As Figure 1 As shown in the figure, the memory 1005 as a computer readable storage medium can include an operating system, a network communication module, a user interface module, and a microservice system anomaly detection program based on time-frequency feature comparison enhancement.

[0108] In Figure 1 In the microservice system anomaly detection device based on time-frequency feature comparison enhancement, the network interface 1004 is mainly used for data communication with a network server; the user interface 1003 is mainly used for data interaction with a user; the processor 1001 and the memory 1005 in the microservice system anomaly detection device based on time-frequency feature comparison enhancement can be arranged in the microservice system anomaly detection device based on time-frequency feature comparison enhancement. The microservice system anomaly detection device based on time-frequency feature comparison enhancement calls the microservice system anomaly detection program based on time-frequency feature comparison enhancement stored in the memory 1005 through the processor 1001, and executes the microservice system anomaly detection method based on time-frequency feature comparison enhancement provided by the embodiment of the present application.

[0109] The embodiment of the present application provides a microservice system anomaly detection method based on time-frequency feature comparison enhancement, which is described with reference to Figure 2 ,Figure 2 FIG. 1 is a flowchart of a first embodiment of the microservice system anomaly detection method based on time-frequency feature comparison enhancement according to the present application.

[0110] In this embodiment, the microservice system anomaly detection method based on time-frequency feature comparison enhancement comprises the following steps:

[0111] Step S10: input the original data of the microservice system into the pre-trained target anomaly detection model for processing, and output the anomaly detection result.

[0112] It should be noted that the present embodiment is applied to anomaly detection of time series data of a microservice system in a real production environment (for example, anomaly detection of index time series data of a microservice system), so as to detect abnormal fluctuations in the microservice system. The time series data of the microservice system mainly includes two types of performance indicators and business indicators, which contain performance indicator data (CPU utilization, memory utilization, network traffic, etc.) of operating systems, databases, middleware, and containers, as well as business indicator data (response time, success rate, throughput, etc.) during user experience. The data is unfolded in time, and each data records different indicator data at the same time point. There is a strong context-dependent feature in the data, and in the microservice elasticity expansion and contraction scene, the normal fluctuation range of resource indicators (such as container CPU, memory, and network traffic) will change dynamically with the load, and there is often no absolute anomaly detection standard for internal data.

[0113] It should be understood that the execution subject of the present embodiment can be a computing service device with data processing, network communication, and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or a terminal electronic device capable of realizing the above functions. In the following, the microservice system anomaly detection device based on time-frequency feature comparison enhancement (referred to as detection device) is taken as an example to illustrate the present embodiment and each of the following embodiments.

[0114] It should be noted that the original data of the microservice system can be KPI data collected by the detection device during the running process of the microservice system. KPI data is key indicator data for measuring the running state of the microservice system, and KPI data can include performance indicator data (such as CPU utilization, memory utilization, disk I / O utilization, etc.), resource management indicator data (such as resource utilization, load balancing, etc.), and service quality indicator data (such as response time, throughput, etc.). These indicator data can comprehensively reflect the performance and resource utilization efficiency of the microservice system, and through analysis of them, potential problems can be found in time and optimized, so as to ensure stable and efficient operation of the microservice system.

[0115] The processing process of the target anomaly detection model comprises:

[0116] Step S1: normalizing the original data of the micro-service system to obtain normalized original data.

[0117] It should be noted that the calculation process of normalization is as follows:

[0118]

[0119]

[0120] wherein the final represents the normalized time series data, represents the original time series data, is a shift parameter, is a scaling parameter, represents the mean of the time series represents the variance of the time series .

[0121] Step S2: performing frequency domain feature extraction on the normalized original data through a frequency domain feature enhancement module to obtain an input feature sequence.

[0122] It should be noted that the frequency domain feature enhancement module (DCTFE) performs frequency domain feature extraction on the normalized data and uses residual connection to enhance the input feature representation.

[0123] Further, in order to accurately extract frequency domain feature information, with reference to Figure 3 , Figure 3 is a processing flowchart of the frequency domain feature enhancement module in an embodiment, and the frequency domain feature extraction process of the frequency domain feature enhancement module in the above step S2 can include:

[0124] Step S21: performing discrete cosine transform on the time series of each channel of the normalized original data to obtain frequency domain features.

[0125] It should be noted that the input sequence shape is wherein is the batch size, is the sequence length, and is the number of channels. The DCT conversion is performed on the time series of each channel, with reference to the following mathematical expression:

[0126]

[0127] wherein represents the DCT conversion data, represents the frequency index, represents the normalized original data, ​denotes the value of the time series at the time point denotes the time index, denotes the sequence length.

[0128] It should be noted that the DCT transform can be a Discrete Cosine Transform (DCT) for converting a signal from the time domain to the frequency domain. The DCT transform extracts the frequency information in the signal by decomposing it into a weighted sum of cosine functions of different frequencies. The DCT is suitable for processing signals with periodic characteristics, as it can effectively concentrate the energy of the signal in a few frequency components.

[0129] It can be understood that the specific process of the DCT transform is as follows:

[0130] 1. Input sequence becomes a two-dimensional tensor with shape , where is the size of the last dimension, is the product of the other dimensions except the last dimension.

[0131] 2. Construct auxiliary sequence :

[0132]

[0133] Take the even column data and the odd column data of respectively, where the odd column data is flipped and then spliced to form a new sequence .

[0134] 3. Calculate the real fast Fourier transform , the specific calculation formula is as follows:

[0135]

[0136] where is the real fast Fourier transform, which returns a complex number, and here has a shape of (M, N / 2 + 1, 2), and the last dimension represents the real and imaginary parts of the complex number.

[0137] 4. Construct the rotation factor:

[0138]

[0139] where, , denotes the real part of the rotation factor, ​denotes the amplitude coefficient of the imaginary part of the rotation factor.

[0140] 5. Calculate DCT:

[0141]

[0142] wherein, denotes the real part of denotes the imaginary part of

[0143] 6. Stack all channels and restore the initial shape:

[0144]

[0145] wherein, denotes the restoration of the initial input shape.

[0146] Step S22: Normalize the frequency domain features to obtain normalized frequency domain features.

[0147] It can be understood that the data after DCT conversion is normalized, and the weight learning is performed through the fully connected layer:

[0148]

[0149]

[0150]

[0151] wherein, denotes the normalized frequency domain features, denotes the instance normalization function, denotes the feature dimension, denotes the batch size, denotes the number of channels, denotes the frequency domain feature mean of the th channel of the th sample, denotes the frequency domain feature variance of the th channel of the th sample, denotes a constant, and there is no offset and scaling here.

[0152] Step S23: Weight learning on the normalized frequency domain features through the fully connected layer to obtain frequency domain feature weights:

[0153]

[0154] wherein, denotes the frequency domain feature weights, ​​denotes a convolution layer, denotes an activation function, denotes a Sigmoid function, which maps weights to the interval (0, 1).

[0155] Step S24: applying the frequency domain feature weight to the normalized original data to obtain a weighted time domain feature, and performing residual connection between the weighted time domain feature and the normalized original data to obtain an input feature sequence.

[0156] It should be understood that the learned weight is applied to the original input, and residual connection is performed to obtain the final output of the module:

[0157]

[0158]

[0159] wherein, denotes a weighted time domain feature, denotes element-wise multiplication, denotes an input feature sequence.

[0160] Step S3: slicing and dividing the input feature sequence to generate a plurality of positive sample sequences at different levels.

[0161] It can be understood that by slicing and dividing the input sequence according to a specific size, the calculation process is as follows:

[0162] to the input feature sequence wherein, b is a batch size, l is a sequence length, c is a number of channels.

[0163]

[0164] wherein, is a number of blocks, is a size of each block, is a sliced sequence, denotes a tensor dimension rearrangement operation function, which is used to efficiently reconstruct the data dimension and solve the problem of different space-time scales of multi-medium data.

[0165] Step S4: inputting the positive sample sequence into a positive sample encoding structure and a negative sample encoding structure respectively for feature encoding to obtain a positive sample feature and a negative sample feature.

[0166] It can be understood that the positive sample coding structure is used for multi-level feature coding of the positive sample sequence; and the negative sample coding structure is used for noise pollution processing of the positive sample sequence, generating a negative sample sequence, and then multi-level feature coding of the negative sample sequence.

[0167] Further, in order to accurately capture short-term fluctuations and long-term trends in the sequence, in an embodiment, the above-mentioned positive sample structure includes a multi-level encoder, and the negative sample structure includes a noise pollution module and a multi-level encoder.

[0168] The noise pollution module is configured to perform noise pollution processing on the positive sample sequence input into the negative sample coding structure, generate a negative sample sequence, and output the negative sample sequence to the multi-level encoder.

[0169] The feature coding process of the multi-level encoder includes:

[0170] Value embedding coding and position embedding coding are performed on the input sequence to obtain value coding features and position coding features, the input sequence being a positive sample sequence or a negative sample sequence.

[0171] The value coding features and the position coding features are fused, and the fused features are regularized to obtain candidate features.

[0172] The candidate features are input into a multi-head attention mechanism layer pair for calculation to obtain multi-head attention mechanism calculation results.

[0173] The multi-head attention mechanism calculation results are subjected to residual connection and normalization processing to obtain intermediate features, and the intermediate features are input into a feedforward network for processing to obtain output features, the output features being positive sample features or negative sample features.

[0174] It can be understood that the positive sample coding structure branch can be provided with three different sizes , and finally obtain three kinds of positive sample sequences. The multi-level encoder Poly-level Encoder obtains short-term fluctuations and long-term trends of the sequence and richer feature representations by coding sequences of different slice sizes, and the calculation process is as follows:

[0175] Step 411: Value embedding coding and position embedding coding are performed on the input sequence. The value embedding coding is performed by mapping the input features to the target dimension through a one-dimensional convolution layer; and the position embedding coding generates fixed position encodings for each position, adds these encodings to the input features, and sums them up to obtain the final output through a layer, and the input sequence is denoted as , and the calculation process is as follows.

[0176]

[0177]

[0178]

[0179]

[0180] wherein, is a dimension, is a dimension index, , is a dropout rate of the layer.

[0181] Step 412: The multi-head attention mechanism layer calculates:

[0182]

[0183] wherein, (Query), (Key), (Value) are three matrices generated by linear transformation of the input sequence, representing query, key and value respectively, is a dimension of the key vector, used to scale the dot product result to prevent gradient disappearance, the function normalizes the dot product score to a probability distribution, representing the correlation weight between different positions.

[0184] The above multi-head attention mechanism layer calculation includes:

[0185] (1) Linear transformation generates query matrix, key matrix and value matrix:

[0186] The sequence after value embedding and position embedding is mapped by three independent linear layers to obtain:

[0187]

[0188]

[0189]

[0190] wherein, , and represent query matrix, key matrix and value matrix respectively, , , are projection weight matrices of query, key and value, , , Query, key and value projection bias vectors.

[0191] (2) Compute attention score:

[0192] The similarity between elements in the sequence is measured by the dot product of and .

[0193]

[0194] where is the dimension of the key vector.

[0195] (3) Normalization:

[0196] The attention weight matrix is obtained by normalizing , and the final weight matrix is obtained by adding a layer to prevent overfitting.

[0197]

[0198] (4) Value projection:

[0199] The final output feature is obtained by multiplying the normalized matrix with the value matrix .

[0200]

[0201] Step 413: Multi-level encoder calculation:

[0202] The attention mechanism calculation result is connected with the residual and normalized, and input into the feedforward network to obtain the final output.

[0203]

[0204]

[0205] where denotes the normalized output, denotes the attention output, denotes the regularization operation, denotes the layer normalization function, denotes the feedforward neural network, denotes the final output.

[0206] Further, in order to simulate the abnormal situation of real data, prevent model degradation, and enhance the recognition ability of the model to fluctuations, in an embodiment, the noise pollution processing process of the noise pollution module in the above negative sample encoding structure can include:

[0207] The positive sample sequence input into the negative sample encoding structure is divided into front half data and back half data;

[0208] Generate noise mask and Gaussian noise based on the probability threshold of pollution;

[0209] Noise pollution is performed on the back half data based on the noise mask and the Gaussian noise, and the back half data after noise pollution is combined with the front half data to generate a negative sample sequence.

[0210] It should be understood that the negative sample encoding structure branch, such as the positive sample encoding structure branch described above, Three positive sample sequences are noise-polluted to obtain three negative sample sequences Meanwhile, after the positive sample is input into the multi-level encoder, the negative sample is input into the multi-level encoder in parallel to obtain respective feature representations. The negative sample generation method calculation process is as follows:

[0211] The sliced positive sample sequence is noise-polluted. First, the sliced positive sample data is divided into two parts, the front half and the back half. The back half data is noise-polluted, and the polluted data is combined with the front half data to form a negative sample sequence. The calculation process is as follows:

[0212]

[0213]

[0214]

[0215] Wherein, is the front half data, is the back half data, is the pollution probability threshold, is the back half data after pollution, is the recombined negative sample sequence with pollution.

[0216] Wherein, the noise pollution processing ( ) calculation process is as follows.

[0217] Suppose the input sequence is of the shape (b1, b2,... bn), where bn is the size of the last dimension. In its last dimension, with a probability Add Gaussian noise with a standard deviation of .

[0218] First, generate a noise mask:

[0219]

[0220] where is a random number uniformly distributed in the interval [0, 1).

[0221] Second, generate Gaussian noise:

[0222]

[0223] where, denotes a Gaussian distribution with mean 0 and variance .

[0224] Third, perform noise pollution:

[0225]

[0226] where, is the element in the last dimension of the tensor .

[0227] Step S5: output the positive sample feature and the negative sample feature respectively by the decoder to obtain a positive sample output result and a negative sample output result, and perform inverse normalization processing on the positive sample output result to obtain a reconstruction sequence.

[0228] It can be understood that the feature sequence output by the encoder is input into the decoder to obtain the positive sample output and the negative sample output. At the same time, the positive sample output is inversely normalized to obtain the reconstruction output.

[0229] In a specific implementation, first, the feature sequence output by the encoder is input into the decoder to obtain the positive sample output and the negative sample output. At the same time, the positive sample output is inversely normalized to obtain the reconstruction output.

[0230] The decoder itself is a linear layer, and the specific calculation process is as follows:

[0231]

[0232]

[0233] where, is the feature sequence input into the decoder, is a weight matrix, is a bias vector, is the output of the decoder.

[0234] Here, the positive sample output is represented as​ , the negative sample output is represented as .

[0235] Further, in order to enhance the model's ability to identify abnormal signals and improve the robustness and accuracy of anomaly detection, in an embodiment, the positive sample output result is subjected to inverse normalization processing, which can include:

[0236]

[0237]

[0238]

[0239]

[0240] wherein, is a sequence in the positive sample output result, represents an inverse normalization function, is an offset parameter, is a scaling parameter, represents the mean of the sequence , and represents the variance of the sequence , and is a reconstructed sequence after inverse normalization, represents a constant.

[0241] Here, represents three reconstructed sequences after inverse normalization.

[0242] Step S6: generating a contrast anomaly score based on the positive sample output result and the negative sample output result, and generating a reconstructed anomaly score based on the reconstructed sequence and the normalized original data.

[0243] It should be understood that the reconstructed anomaly score needs to be averaged along the last dimension to obtain three loss values, and the sum of the three loss values is the reconstructed anomaly score .

[0244]

[0245]

[0246]

[0247]

[0248] wherein, represents the mean of the first reconstructed loss, represents the mean of the second reconstructed loss, a mean value of the third reconstruction loss, a mean function, a raw data input, and represent reconstruction sequences of three different scales, respectively.

[0249] Here, the contrast loss anomaly score is obtained by calculating the Euclidean distance between the three positive sample outputs along the last dimension, and the three Euclidean distance values are summed to obtain the contrast anomaly score .

[0250]

[0251]

[0252]

[0253]

[0254] wherein, represents the Euclidean distance between sample and sample , used to measure the difference between the two in the feature space, represents the feature dimension index, represents the Euclidean distance between sample and sample , represents the Euclidean distance between sample and sample ;

[0255] The final anomaly score is obtained by summing the two anomaly scores above.

[0256]

[0257] Step S7: determining a target anomaly score based on the contrast anomaly score and the reconstruction anomaly score, judging whether the target anomaly score is higher than a preset anomaly score threshold, and outputting the judgment result as an anomaly detection result.

[0258] It should be noted that if the anomaly score is higher than the pre-set anomaly score threshold, it is marked as abnormal (1), otherwise it is normal (0), so as to output the anomaly detection result.

[0259] ​​The embodiment inputs original data of a micro-service system into a pre-trained target anomaly detection model for processing, and outputs an anomaly detection result. The processing process of the target anomaly detection model includes: performing normalization processing on the original data of the micro-service system to obtain normalized original data, performing frequency domain feature extraction on the normalized original data through a frequency domain feature enhancement module to obtain an input feature sequence, performing slice division on the input feature sequence to generate a plurality of different levels of positive sample sequences, inputting the positive sample sequences into a positive sample coding structure and a negative sample coding structure respectively for feature coding to obtain positive sample features and negative sample features, decoding and outputting the positive sample features and the negative sample features through a decoder to obtain positive sample output results and negative sample output results, performing inverse normalization processing on the positive sample output results to obtain a reconstruction sequence, generating a comparison anomaly score based on the positive sample output results and the negative sample output results, generating a reconstruction anomaly score based on the reconstruction sequence and the normalized original data, determining a target anomaly score based on the comparison anomaly score and the reconstruction anomaly score, judging whether the target anomaly score is higher than a preset anomaly score threshold, and outputting the judgment result as the anomaly detection result. Since the frequency domain features are extracted through the frequency feature enhancement module in the embodiment, the dependence between channels is enhanced, the utilization capability of the model for frequency information is improved, the multi-level positive samples and negative samples are generated based on the frequency domain features, and then multi-level feature coding is performed, the anomaly conditions of real data are effectively simulated, the model degradation is prevented, the recognition capability of the model for fluctuations is enhanced, and thus the anomaly fluctuations in the micro-service system are accurately detected. The reconstruction and comparison learning are combined, the recognition capability of the model for abnormal signals is enhanced, the robustness and accuracy of anomaly detection are improved, and the anomaly fluctuations in the micro-service system are accurately detected.

[0260] Reference Figure 4 , Figure 4 FIG. 2 is a flowchart of a second embodiment of the micro-service system anomaly detection method based on time-frequency feature comparison enhancement according to the present application.

[0261] Based on the first embodiment, before the step S10, the embodiment further includes:

[0262] Step S100: constructing an original anomaly detection model, and inputting an original data set of a micro-service system into the original anomaly detection model for processing to train the original anomaly detection model;

[0263] The training process of the original anomaly detection model includes:

[0264] Step S101: performing normalization processing on the original data set to obtain a normalized original data set, and dividing the normalized original data set into a training data set and a test data set according to a preset ratio.

[0265] Step S102: performing frequency domain feature extraction on the training data set through a frequency domain feature enhancement module to obtain an input feature sequence;

[0266] Step S103: slicing and dividing the input feature sequence to generate a plurality of positive sample sequences at different levels;

[0267] Step S104: inputting the positive sample sequences into a positive sample encoding structure and a negative sample encoding structure respectively for feature encoding to obtain positive sample features and negative sample features;

[0268] Step S105: decoding and outputting the positive sample features and the negative sample features respectively through a decoder to obtain positive sample output results and negative sample output results, and performing inverse normalization processing on the positive sample output to obtain a reconstruction sequence;

[0269] Step S106: generating a contrast loss function based on the positive sample output results and the negative sample output results, and generating a reconstruction loss function based on the reconstruction sequence and the training data set;

[0270] Step S107: constructing a joint loss function based on the contrast loss function and the reconstruction loss function, and training the original anomaly detection model based on the joint loss function;

[0271] Step S108: inputting the test data set into the trained original anomaly detection model for processing to obtain a test result;

[0272] Step S109: in response to the test result satisfying a preset condition, outputting the trained original anomaly detection model as a target anomaly detection model.

[0273] It can be understood that, since the conventional time series anomaly detection method has inherent defects, when it is applied to a microservice system, the defects of the conventional time series anomaly detection method in the dynamic, heterogeneous and strongly correlated scenarios of the microservice system are further exacerbated, resulting in the inability to accurately and effectively detect abnormal fluctuations in the microservice system. The inherent defects of the conventional time series anomaly detection method include:

[0274] 1. The existing time series anomaly detection method mainly focuses on the long short-term dependence relationship in the time domain, and ignores the pattern information in the frequency domain. The existing frequency information extraction method is mostly based on Fourier transform. However, Fourier transform has Gibbs phenomenon, that is, when the values on both sides of the sequence are significantly different, oscillation approximation occurs, high-frequency noise is introduced, the error value of the boundary information increases, and thus the result of the model is affected.

[0275] 2. In unsupervised learning, due to the lack of labeled data of anomalies, the generation of negative samples is crucial for model training. Without negative samples, the model may degenerate into a trivial solution and fail to learn meaningful information.

[0276] 3. Current anomaly detection methods are mainly based on time series reconstruction, which requires high-quality reconstruction. Traditional reconstruction methods require accurate reconstruction of normal data, but this method may face challenges when dealing with complex time series. If the model is too complex, it may degenerate into an identity transformation and fail to effectively distinguish between normal and abnormal data; if the model is too simple, it cannot capture the complex dependencies of time series.

[0277] To solve the above problems, the embodiment proposes a microservice system anomaly detection method based on time-frequency feature contrast enhancement. Referring to Figure 5 , Figure 5 is a schematic diagram of the anomaly detection process of the microservice system in this embodiment. First, the data is preprocessed, and each time series data is processed by the frequency domain feature enhancement module (DCTFE), which extracts feature information of different frequencies and inputs it into the subsequent module.

[0278] Then, take the slicing operation to cut out blocks of different sizes to generate feature sequences of different levels, i.e. positive sample sequences; at the same time, design a double-branch structure of positive and negative samples for the feature sequence. Among them, the positive sample structure inputs the positive sample sequence into the multi-level encoder (Poly-level Encoder); the negative sample structure first generates negative samples, and then generates negative sample sequences by adding noise to the positive sample sequence, and then inputs them into the multi-level encoder (Poly-level Encoder). The multi-level encoder captures short-term fluctuations and long-term trends in the sequence to enhance the representation ability of the model.

[0279] Finally, input into the decoder to decode, compare the output of the positive sample structure with the output of the negative sample structure; and take the positive sample structure as an independent branch, and perform sequence reconstruction on the output of the positive sample structure by inverse normalization, and compare it with the original sequence. Joint reconstruction and contrast learning get the anomaly score, and the error exceeds the set threshold to determine the anomaly. The embodiment uses a contrast learning framework, uses frequency domain feature information, divides slice sequences, extracts multi-level features, and further improves the modeling ability of the model, which is suitable for time series anomaly detection in the running process of microservice systems.

[0280] Further, to improve the accuracy of model anomaly detection, the above step S106 can include:

[0281] Step S1061: Splice the positive sample output result and the negative sample output result to obtain a spliced sample.

[0282] It should be noted that the three positive sample output features are assumed to be , and the negative sample output feature is , all of which have the shape (b, l, c). Wherein, b is the batch size, l is the sequence length, and c is the number of channels. All samples are spliced as follows:

[0283]

[0284] Wherein, represents the spliced sample, , and represent the output results of positive samples of different scales, and the output result of the negative sample.

[0285] Step S1062: normalizing the spliced sample to obtain a normalized sample.

[0286] It can be understood that the normalization processing can be to calculate norm and normalize:

[0287]

[0288] Wherein, represents the normalized sample, represents the value of the i-th channel at the i-th time point in the i-th sample, and is a very small constant. Step S1063: data transposition is performed on the normalized sample to obtain a transposed sample.

[0289] It should be noted that the data transposition can be to transpose the data of the first dimension and the second dimension:

[0290]

[0291]

[0292] Wherein, represents the transposed sample, represents the transposition, and represents the dimension of the transposed sample.

[0293] Step S1064: calculating a cosine similarity matrix based on the transposed sample.

[0294] It should be noted that calculating the similarity matrix can include:

[0295] ​​

[0296] wherein, denotes a cosine similarity matrix, denotes the dimension of the cosine similarity matrix.

[0297] Step S1065: Extracting the upper half elements and the lower half elements of the diagonal line of the similarity matrix, and splicing them to obtain a spliced matrix.

[0298] It can be understood that by removing the diagonal elements of the matrix, the upper half elements and the lower half elements of the diagonal line of the matrix are extracted respectively, and then the upper half elements are spliced with the lower half elements:

[0299]

[0300] wherein, denotes a spliced matrix, denotes a time point sample cosine similarity between the sample and other samples, denotes the cosine similarity between the vector and the vector at the i-th position.

[0301] Step S1066: Normalizing the spliced matrix to obtain a normalized matrix.

[0302] It can be understood that the normalization processing can be a normalization operation on the spliced matrix :

[0303]

[0304] wherein, denotes a normalized matrix, denotes a Softmax function, denotes the dimension of the normalized matrix.

[0305] Step S1067: Calculating the probability distribution based on the normalized matrix to obtain a first similarity probability sum and a second similarity probability sum.

[0306] It should be noted that the index, index [0, b-1], index [b, 2b-1], index [2b, 3b-1], index [3b, 4b-1].

[0307]

[0308] ​​

[0309]

[0310] wherein, denotes a first similarity probability sum for measuring the similarity of the sample to the sample , the sample , denotes a second similarity probability sum for measuring the similarity of the sample to the sample , the sample , denotes a sample index, denotes a time point index.

[0311] is a similarity probability sum of the corresponding vector ( ) to ( ) and ( ), is a similarity probability sum of the corresponding vector ( ) to ( ) and ( ).

[0312] Step S1068: generating a contrastive loss function based on the first similarity probability sum and the second similarity probability sum, the contrastive loss function comprising:

[0313]

[0314]

[0315]

[0316] wherein, denotes a first contrastive loss term, denotes a second contrastive loss term, denotes a total contrastive loss;

[0317] It should be noted that the present embodiment jointly trains the model by using the reconstruction loss and the contrastive loss, the reconstruction loss adopts the mean square error function, and the contrastive loss adopts the similarity contrastive loss function. The reconstruction loss function comprises:

[0318]

[0319]

[0320]

[0321]

[0322] wherein, represents the average value of the reconstruction loss, , and represent reconstruction sequences of three different scales respectively, represents the input training data set, , and represent three reconstruction losses calculated based on the reconstruction sequences of different scales respectively, represents the mean square error function.

[0323] The technical effects of the embodiment are as follows:

[0324] 1. A frequency domain feature enhancement module based on discrete cosine transform (DCT) is introduced. The module utilizes the symmetry and periodicity of DCT to avoid the Gibbs phenomenon, and has more advantages in suppressing high-frequency noise than the traditional Fourier transform. DCT can efficiently compress energy, and the calculation result is a real number, without the need for inverse transformation, thereby reducing the computational complexity. In addition, the module enhances the dependence between channels through frequency information, improving the model's ability to utilize frequency information.

[0325] 2. A negative sample generation method is cited, which generates diversified negative samples through noise pollution method, can effectively simulate the abnormal situation of real data, prevent model degradation, enhance the recognition ability of the model to fluctuations, and improve the robustness and accuracy of the model.

[0326] 3. A new joint learning framework is cited, which combines reconstruction and contrastive learning, enhances the recognition ability of the model to abnormal signals through shared feature representation and joint optimization of loss function, and improves the robustness and accuracy of anomaly detection.

[0327] In addition, the embodiment of the application also proposes a computer readable storage medium, the computer readable storage medium stores a microservice system anomaly detection program based on time-frequency feature contrast enhancement, and the microservice system anomaly detection program based on time-frequency feature contrast enhancement is executed by a processor to realize the steps of the microservice system anomaly detection method based on time-frequency feature contrast enhancement as described above.

[0328] The computer readable storage medium provided in the application may be, for example, a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electrical connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electrical wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination of the above.

[0329] The computer readable storage medium described above may be contained in the microservice system anomaly detection device based on time-frequency feature comparison enhancement, or may exist separately and not be assembled into the microservice system anomaly detection device based on time-frequency feature comparison enhancement.

[0330] In addition, the embodiment of the application also provides a computer program product, including a microservice system anomaly detection program based on time-frequency feature comparison enhancement, and the microservice system anomaly detection program based on time-frequency feature comparison enhancement realizes the steps of the microservice system anomaly detection method based on time-frequency feature comparison enhancement when executed by a processor.

[0331] The computer program product embodiment of the application is basically the same as the above-mentioned microservice system anomaly detection method based on time-frequency feature comparison enhancement, and will not be repeated here.

[0332] In addition, the embodiment of the application also provides a microservice system anomaly detection device based on time-frequency feature comparison enhancement, which is applied to a microservice system, and is used to realize the microservice system anomaly detection method based on time-frequency feature comparison enhancement as described above.

[0333] The microservice system anomaly detection device based on time-frequency feature comparison enhancement provided in the application adopts the microservice system anomaly detection method based on time-frequency feature comparison enhancement in the above embodiment, and can solve the technical problem of microservice system anomaly detection based on time-frequency feature comparison enhancement. Compared with the prior art, the beneficial effects of the microservice system anomaly detection device based on time-frequency feature comparison enhancement provided in the application are the same as those of the microservice system anomaly detection method based on time-frequency feature comparison enhancement provided in the above embodiment, and other technical features in the microservice system anomaly detection device based on time-frequency feature comparison enhancement are the same as those disclosed in the above embodiment method, which will not be repeated here.

[0334] It should be understood that the above is only an example, and does not constitute any limitation on the technical solutions of the application. In specific applications, those skilled in the art can set it up according to the needs, and the application does not limit it.

[0335] It should be noted that the above-described workflow is only illustrative and does not limit the scope of protection of the application. In actual application, those skilled in the art can select part or all of them to achieve the purpose of the embodiment scheme according to actual needs, which is not limited here.

[0336] In addition, technical details not described in detail in the embodiment can be referred to the microservice system anomaly detection method based on time-frequency feature comparison enhancement provided in any embodiment of the application, which will not be repeated here.

[0337] It should be noted that in this document, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or system including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or system. Without more limitations, the element defined by the statement "includes a" does not exclude the presence of another identical element in the process, method, article or system including the element.

[0338] The above embodiment number of the application is only for description, not representing the advantages and disadvantages of the embodiments.

[0339] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0340] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for anomaly detection in a microservice system based on time-frequency feature comparison enhancement, characterized in that, The method is applied to a microservice system, and the method includes: The raw data from the microservice system is input into a pre-trained target anomaly detection model for processing, and the anomaly detection results are output. The processing steps of the target anomaly detection model include: Normalize the raw data of the microservice system to obtain normalized raw data; The frequency domain feature enhancement module extracts frequency domain features from the normalized raw data to obtain the input feature sequence. The input feature sequence is sliced ​​to generate multiple positive sample sequences at different levels; The positive sample sequence is input into the positive sample encoding structure and the negative sample encoding structure respectively for feature encoding to obtain positive sample features and negative sample features; The positive sample features and the negative sample features are decoded and output by the decoder to obtain positive sample output results and negative sample output results. The positive sample output results are then denormalized to obtain the reconstructed sequence. A contrast anomaly score is generated based on the positive sample output and the negative sample output, and a reconstruction anomaly score is generated based on the reconstructed sequence and the normalized original data. Based on the comparison anomaly score and the reconstructed anomaly score, a target anomaly score is determined, and it is determined whether the target anomaly score is higher than a preset anomaly score threshold. The determination result is then output as an anomaly detection result. The frequency domain feature extraction process of the frequency domain feature enhancement module includes: Discrete cosine transform is performed on the time series of each channel of the normalized original data to obtain frequency domain features: in, This represents DCT transformed data. Indicates frequency index, This represents the original data after normalization. Represents the first in a time series Values ​​at each point in time. Indicates a time index. Indicates the sequence length; The frequency domain features are normalized to obtain the normalized frequency domain features: in, This represents the normalized frequency domain characteristics. This represents the instance normalization function. Representing feature dimension, Indicates batch size. Indicates the number of channels. Indicates the first The first sample The mean frequency domain characteristics of each channel, Indicates the first The first sample The frequency domain characteristic variance of each channel, Represents a constant; The normalized frequency domain features are weighted by a fully connected layer to obtain the frequency domain feature weights. in, Represents the frequency domain feature weights. Indicates a convolutional layer. This represents the activation function. Represents the Sigmoid function; The frequency domain feature weights are applied to the normalized original data to obtain weighted time domain features. The weighted time domain features are then residual-conjoined with the normalized original data to obtain the input feature sequence. in, This represents the weighted time-domain characteristics. This represents element-wise multiplication. Indicates the input feature sequence; The positive sample structure includes a multi-level encoder, and the negative sample structure includes a noise contamination module and a multi-level encoder. The noise contamination module is used to perform noise contamination processing on the positive sample sequence input into the negative sample encoding structure, generate a negative sample sequence, and output the negative sample sequence to the multi-level encoder. The feature encoding process of the multi-level encoder includes: The input sequence is subjected to value embedding encoding and position embedding encoding to obtain value encoding features and position encoding features, wherein the input sequence is a positive sample sequence or a negative sample sequence; The value encoding feature and the position encoding feature are fused, and the fused feature is regularized to obtain candidate features; The candidate features are input into the multi-head attention mechanism layer for calculation to obtain the multi-head attention mechanism calculation result; The calculation results of the multi-head attention mechanism are subjected to residual connection and normalization to obtain intermediate features. The intermediate features are then input into the feedforward network for processing to obtain output features, which are either positive or negative sample features.

2. The microservice system anomaly detection method based on time-frequency feature comparison enhancement as described in claim 1, characterized in that, The noise pollution treatment process of the noise pollution module includes: The positive sample sequence input into the negative sample encoding structure is divided into a first half of data and a second half of data; Noise masks and Gaussian noise are generated based on a probability threshold for contamination. The second half of the data is noise-contaminated based on the noise mask and the Gaussian noise, and then the noise-contaminated second half of the data is combined with the first half of the data to generate a negative sample sequence.

3. The anomaly detection method for microservice systems based on time-frequency feature comparison enhancement as described in claim 1, characterized in that, The inverse normalization process for the positive sample output includes: in, For the sequences in the output results of positive samples, Represents the inverse normalization function. For offset parameters, For scaling parameters, Represents a sequence The mean, Represents a sequence variance The reconstructed sequence output after inverse normalization. Represents a constant.

4. The microservice system anomaly detection method based on time-frequency feature comparison enhancement as described in any one of claims 1 to 3, characterized in that, Before inputting the raw data of the microservice system into the pre-trained target anomaly detection model for processing and outputting the anomaly detection result, the process also includes: A raw anomaly detection model is constructed, and the raw dataset of the microservice system is input into the raw anomaly detection model for processing in order to train the raw anomaly detection model; The training process of the original anomaly detection model includes: The original dataset is normalized to obtain a normalized original dataset, and the normalized original dataset is divided into a training dataset and a test dataset according to a preset ratio. The training dataset is subjected to frequency domain feature extraction using a frequency domain feature enhancement module to obtain the input feature sequence; The input feature sequence is sliced ​​to generate multiple positive sample sequences at different levels; The positive sample sequence is input into the positive sample encoding structure and the negative sample encoding structure respectively for feature encoding to obtain positive sample features and negative sample features; The positive sample features and the negative sample features are decoded and output by the decoder to obtain positive sample output results and negative sample output results. The positive sample output is then denormalized to obtain the reconstructed sequence. A contrastive loss function is generated based on the positive sample output and the negative sample output, and a reconstruction loss function is generated based on the reconstructed sequence and the training dataset; A joint loss function is constructed based on the contrast loss function and the reconstruction loss function, and the original anomaly detection model is trained based on the joint loss function. The test dataset is input into the trained original anomaly detection model for processing to obtain the test results. In response to the test results meeting preset conditions, the trained original anomaly detection model is output as the target anomaly detection model.

5. The microservice system anomaly detection method based on time-frequency feature comparison enhancement as described in claim 4, characterized in that, The generation of the contrastive loss function based on the positive sample output and the negative sample output includes: The positive sample output and the negative sample output are concatenated to obtain the concatenated sample: in, Indicates splicing samples, , and These represent the output results of positive samples at different scales. This indicates the output result for negative samples; The spliced ​​samples are normalized to obtain normalized samples: in, Represents a normalized sample. Indicates the first In the nth sample The first time point The value of each channel; The normalized samples are transposed to obtain the transposed samples: in, Indicates a transposed sample. Indicates transpose. Indicates the dimension of the transposed sample; Calculate the cosine similarity matrix based on the transposed sample: in, Represents the cosine similarity matrix. The dimension of the cosine similarity matrix is ​​represented by . Extract the upper and lower diagonal elements from the similarity matrix and concatenate them to obtain the concatenated matrix: in, This represents a concatenated matrix. Indicates a point in time sample Cosine similarity with other samples Indicates the first Vectors at each position sum vector Cosine similarity; The concatenated matrix is ​​normalized to obtain the normalized matrix: in, Represents a normalized matrix. This represents the Softmax function. Indicates the dimension of the normalized matrix; Based on the normalized matrix, probability distribution calculations are performed to obtain the first similarity probability sum and the second similarity probability sum: in, This represents the sum of first similarity probabilities, which is used to measure the similarity of samples. With sample ,sample Similarity, This represents the second similarity probability sum, which is used to measure the similarity of samples. With sample ,sample Similarity, Indicates the sample index. Indicates a point-in-time index; A contrast loss function is generated based on the first similarity probability sum and the second similarity probability sum, the contrast loss function including: in, Indicates the first comparative loss term. This represents the second comparative loss term. Indicates the total comparison loss; The reconstruction loss function includes: in, This represents the average value of the reconstruction loss. , and These represent reconstructed sequences at three different scales. This represents the input training dataset. , and These represent three reconstruction losses calculated using the mean squared error of the reconstructed sequences at different scales. This represents the mean square error function.

6. A microservice system anomaly detection device based on time-frequency feature comparison enhancement, characterized in that, The device is applied to a microservice system and is used to implement the microservice system anomaly detection method based on time-frequency feature comparison enhancement as described in any one of claims 1 to 5.

7. A microservice system anomaly detection device based on time-frequency feature comparison enhancement, characterized in that, The microservice system anomaly detection device based on time-frequency feature comparison enhancement includes: a memory, a processor, and a microservice system anomaly detection program based on time-frequency feature comparison enhancement stored in the memory. The processor is used to run the microservice system anomaly detection program based on time-frequency feature comparison enhancement, and the microservice system anomaly detection program based on time-frequency feature comparison enhancement is configured to implement the microservice system anomaly detection method based on time-frequency feature comparison enhancement as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a microservice system anomaly detection program based on time-frequency feature comparison enhancement, which, when executed by a processor, implements the microservice system anomaly detection method based on time-frequency feature comparison enhancement as described in any one of claims 1 to 5.

Images