Time sequence anomaly prediction method and device based on graph neural network, equipment and medium

Abstract

The invention relates to a time sequence anomaly prediction method and device based on a graph neural network, equipment and a medium. The method comprises the following steps: collecting multivariable time sequence monitoring data of a plurality of service entities in a cloud platform; extracting an interaction relationship of different variables in the multivariable time sequence monitoring data, and identifying a coupling variable group through statistical causal analysis according to the interaction relationship; by analyzing a collaborative change mode of the coupling variable group, extracting abnormal propagation characteristics from corresponding data, and screening out candidate abnormal events according to the abnormal propagation characteristics; constructing an abnormal propagation atlas by taking variables in the coupling variable group as nodes and the abnormal propagation characteristics as edges; based on the candidate abnormal events, a preset graph neural network model is adopted to execute root cause reasoning in a graph to determine an abnormal root source list; and simulating an abnormal propagation process, comparing a simulation result with the candidate event, and generating an abnormal cause analysis result. By adopting the method, the accuracy of time sequence anomaly prediction and the efficiency of root cause analysis in the cloud platform can be improved.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing monitoring and artificial intelligence, and in particular relates to a method, device, equipment and medium for predicting time series anomalies based on graph neural networks. Background Technology

[0002] With the rapid development of cloud computing monitoring and artificial intelligence technologies, the scale of service entities in cloud platforms is constantly expanding, and monitoring data is exhibiting characteristics such as multivariability, high dimensionality, and time series, thus giving rise to time series anomaly prediction technologies based on machine learning. These technologies can automatically analyze massive amounts of monitoring data and identify potential anomaly patterns. Traditional technologies typically employ simple univariate time series analysis or multivariate detection methods based on correlation coefficients, using fixed thresholds or sliding windows to capture outliers. For example, outlier detection is first performed on individual indicators such as CPU utilization and memory usage for each service entity, and then the results are integrated through human experience to identify abnormal events.

[0003] However, current rule-based or traditional statistical methods have many problems: due to the complex dependencies between service entities in cloud platforms, traditional methods are unable to effectively capture the interactions and causal propagation paths between multiple variables, resulting in low accuracy in anomaly detection and a high risk of false positives or false negatives; traditional methods usually rely on prior knowledge or static thresholds and cannot adapt to dynamically changing load environments, making root cause analysis inefficient and often requiring manual intervention and time-consuming post-incident investigations; these methods lack modeling of anomaly propagation mechanisms and cannot simulate the diffusion process of anomalies within the system, thus limiting prediction and prevention capabilities. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, device, and medium for predicting time series anomalies based on graph neural networks that can solve the above problems.

[0005] In a first aspect, this application provides a method for predicting time-series anomalies based on graph neural networks, including:

[0006] Collect multivariable time-series monitoring data from multiple service entities in the cloud platform;

[0007] Extract the interaction relationships between different variables in multivariate time series monitoring data, and identify the coupled variable groups based on the interaction relationships through statistical causal analysis;

[0008] By analyzing the collaborative change patterns of the coupled variable group, anomaly propagation features are extracted from the multivariate time series monitoring data corresponding to the coupled variable group, and candidate anomaly events are screened from the multivariate time series monitoring data based on the anomaly propagation features.

[0009] Using the variables in the coupled variable group as nodes, and constructing edges between nodes based on anomaly propagation characteristics, an anomaly propagation graph is formed.

[0010] Based on candidate abnormal events, a pre-defined graph neural network model is used to perform root cause reasoning in the abnormal propagation graph to determine the list of abnormal root causes.

[0011] Based on the list of anomaly root causes, and according to the characteristics of anomaly propagation, the propagation of anomalies in the anomaly propagation map is simulated to obtain the simulated anomaly propagation results;

[0012] The simulated anomaly propagation results are compared with candidate anomaly events to obtain anomaly comparison results, and anomaly cause analysis results are generated based on the anomaly comparison results.

[0013] In one embodiment, the interaction relationships between different variables in multivariate time-series monitoring data are extracted, and based on these interaction relationships, a set of coupled variables is identified through statistical causal analysis, including:

[0014] Calculate the statistical correlation of variable pairs in multivariate time series monitoring data, where a variable pair consists of any two variables;

[0015] Filter out variable pairs whose statistical correlation values ​​are greater than a preset correlation threshold;

[0016] Perform statistical causal analysis on the selected variable pairs to obtain the causal analysis results;

[0017] Based on the causal analysis results, determine the type of causal dependency for each variable pair. The types of causal dependency include bidirectional causal dependency and unidirectional causal dependency.

[0018] Based on the determination of the causal dependency type, all variable pairs that are determined to be of the same causal dependency type are grouped together, and all groups of variable pairs are integrated to form a coupled variable group.

[0019] In one embodiment, by analyzing the collaborative change patterns of the coupled variable group, anomaly propagation features are extracted from the multivariate time-series monitoring data corresponding to the coupled variable group, including:

[0020] Multivariate time-series monitoring data is divided into time-series segments based on a time-series window of preset length;

[0021] Based on time series fragments, calculate the time series synergy index between any two variables in a set of coupled variables;

[0022] Based on all temporal coherence indices, determine the coherent change patterns of the corresponding coupled variable groups within each temporal sequence segment;

[0023] The difference between the collaborative change mode of each coupled variable group and the preset normal time-series collaborative change mode is calculated to obtain the collaborative mode difference value.

[0024] The difference value of the cooperative mode is compared with a preset difference threshold. When the difference value of the cooperative mode exceeds the preset difference threshold, the time sequence segment corresponding to the cooperative mode is marked as an abnormal segment.

[0025] Extract the anomaly propagation characteristics of the coupled variable groups within each anomaly segment. The anomaly propagation characteristics include the anomaly initiation variable identifier, the anomaly propagation direction, the anomaly propagation speed, the number of anomaly-affecting variables, and the anomaly time.

[0026] In one embodiment, candidate abnormal events are selected from multivariate time-series monitoring data based on abnormal propagation characteristics, including:

[0027] Mark the timing window corresponding to each abnormal segment as an abnormal window;

[0028] Based on the preset clustering rules, association clustering is performed on each abnormal window to obtain an abnormal window cluster;

[0029] Within the abnormal window cluster, the abnormal propagation features of the coupled variable groups within each abnormal segment are integrated to obtain the window abnormal propagation feature set.

[0030] The abnormal propagation features in the window abnormal propagation feature set are associated and bound with the corresponding abnormal segments, and the dataset formed after association and binding is marked as a candidate abnormal event.

[0031] In one embodiment, based on candidate anomalous events, a pre-defined graph neural network model is used to perform root cause reasoning in the anomalous propagation graph to determine a list of anomalous root causes, including:

[0032] By learning node embedding representations of the anomaly propagation graph through a pre-defined graph neural network model, the spatiotemporal feature vectors of each node are obtained.

[0033] Based on spatiotemporal feature vectors, calculate the abnormal propagation influence score of the node corresponding to each abnormal initiation variable identifier in the window abnormal propagation feature set in the abnormal event;

[0034] Based on the abnormal propagation influence score, a set of candidate root source nodes is identified in the abnormal propagation graph;

[0035] Extract the coupling variable groups corresponding to the nodes in the candidate root source node set and the abnormal time of the abnormal propagation features corresponding to the extracted coupling variable groups;

[0036] The extracted sets of coupled variables and abnormal times are integrated to form a list of candidate anomaly root causes;

[0037] The graph clustering layer in the pre-defined graph neural network model is used to perform deduplication clustering analysis on the candidate anomaly root source list to form an anomaly root source list. The anomaly root source list contains one or more subsets of anomaly root source lists with similar propagation patterns.

[0038] In one embodiment, based on the list of anomaly root causes, the propagation of anomalies in the anomaly propagation map is simulated according to the anomaly propagation characteristics to obtain simulated anomaly propagation results, including:

[0039] Based on a subset of the anomaly root cause list, determine the anomaly simulation parameters, which include the anomaly starting node, the anomaly propagation direction, and the anomaly propagation speed.

[0040] Based on the anomaly simulation parameters, in the anomaly propagation graph, starting from the anomaly initiation node, a directed graph traversal is performed according to the anomaly propagation direction to obtain the simulated anomaly propagation path.

[0041] Based on the simulated anomaly propagation path, the timing of the simulated anomaly reaching each node is determined according to the anomaly propagation speed, thus obtaining the anomaly node timing sequence.

[0042] By integrating all simulated anomaly propagation paths and corresponding anomaly node timing sequences, the simulated anomaly propagation results are obtained.

[0043] In one embodiment, multivariate time-series monitoring data of multiple service entities in the cloud platform are collected, including:

[0044] Obtain service entity type information and dynamic load information of the service entity;

[0045] Based on the preset monitoring targets, the data collection parameters are determined according to the service entity type information and dynamic load information;

[0046] Based on data acquisition parameters, raw time-series stream data of multiple service entities in the cloud platform are collected;

[0047] All raw time-series stream data are integrated to form multivariate time-series monitoring data.

[0048] Secondly, this application also provides a time series anomaly prediction device based on graph neural networks, comprising:

[0049] The time-series data acquisition module is used to collect multivariate time-series monitoring data from multiple service entities in the cloud platform;

[0050] The coupling variable identification module is used to extract the interaction relationships between different variables in multivariate time series monitoring data, and to identify the coupling variable group based on the interaction relationships through statistical causal analysis.

[0051] The abnormal event filtering module is used to extract abnormal propagation features from the multivariate time series monitoring data corresponding to the coupled variable group by analyzing the collaborative change pattern of the coupled variable group, and to filter out candidate abnormal events from the multivariate time series monitoring data based on the abnormal propagation features.

[0052] The anomaly graph construction module is used to construct edges between nodes using variables in the coupled variable group as nodes and anomaly propagation characteristics to form an anomaly propagation graph.

[0053] The anomaly root cause reasoning module is used to perform root cause reasoning in the anomaly propagation graph based on candidate anomaly events and to determine the list of anomaly root causes by using a preset graph neural network model.

[0054] The anomaly simulation analysis module is used to simulate the propagation of anomalies in the anomaly propagation map based on the anomaly root source list and the anomaly propagation characteristics, and obtain the simulated anomaly propagation results.

[0055] The anomaly cause analysis module is used to compare the simulated anomaly propagation results with candidate anomaly events to obtain anomaly comparison results, and generate anomaly cause analysis results based on the anomaly comparison results.

[0056] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described graph neural network-based time series anomaly prediction method.

[0057] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described graph neural network-based time series anomaly prediction method.

[0058] The aforementioned method, apparatus, equipment, and medium for predicting time-series anomalies based on graph neural networks provide a comprehensive foundation for analysis by collecting multivariate time-series monitoring data from multiple service entities in a cloud platform. It extracts the interaction relationships between different variables in the data and uses statistical causal analysis to identify coupled variable groups, capturing complex dependencies and causal propagation paths among multiple variables. By analyzing the collaborative change patterns of coupled variable groups, it extracts anomaly propagation features from the data and uses these features to screen candidate anomaly events, achieving accurate identification of anomaly patterns. An anomaly propagation graph is constructed using coupled variable group variables as nodes and anomaly propagation features as edges, concretizing abstract relationships and providing structured support for root cause reasoning. Based on candidate events, a pre-defined graph neural network model is used to perform root cause reasoning within the graph, determining a list of anomaly root causes. The spatiotemporal feature learning capability of graph neural networks is used to automatically locate root cause nodes, significantly improving the efficiency of root cause analysis and overcoming the inefficiencies of traditional methods that rely on static thresholds and manual intervention. The anomaly propagation process is simulated and compared with candidate events to generate causal analysis results, enhancing adaptability to dynamic environments and predictive and preventative capabilities. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a flowchart of the time series anomaly prediction method based on graph neural networks of the present invention;

[0061] Figure 2 This is a structural diagram of the time series anomaly prediction device based on graph neural network of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0063] In one embodiment, such as Figure 1 As shown, a method for predicting temporal anomalies based on graph neural networks is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, and can also be applied to a system including a terminal and a server, and can be implemented through the interaction between the terminal and the server.

[0064] In the implementation environment, the hardware includes monitoring terminals corresponding to multiple service entities, data acquisition servers, graph neural network processing servers, and distributed storage devices. The monitoring terminals are embedded in the cloud platform service entities, responsible for real-time collection of multi-variable time-series monitoring data, such as CPU utilization and memory usage. The data acquisition servers receive raw time-series stream data uploaded by the terminals, perform variable interaction relationship extraction and statistical causal analysis to identify coupled variable groups. The graph neural network server uses a preset model to construct anomaly propagation graphs and perform root cause inference. The storage devices are used to cache historical data and support time-series analysis. In the application scenario, when the cloud platform experiences dynamic load fluctuations or service anomalies, the monitoring terminals and servers interact via the network: the terminals continuously collect and transmit data to the servers; the servers process the data, filter candidate anomaly events, simulate the anomaly propagation process, and feed back the anomaly cause analysis results to the terminals, achieving collaborative anomaly prediction and root cause analysis, improving the accuracy and efficiency of cloud platform monitoring. In this embodiment, the method includes the following steps:

[0065] S01 collects multivariate time-series monitoring data of multiple service entities in the cloud platform.

[0066] The cloud platform refers to a distributed environment that provides cloud computing services. Service entities refer to independently running computing entities within the cloud platform, such as virtual machines or containers. Multivariate time-series monitoring data consists of a time-series dataset composed of multiple monitoring metrics (such as CPU utilization, memory usage, and network traffic). In implementation, by acquiring the type information (such as instance specifications) and dynamic load information (such as real-time resource requirements) of service entities, and adaptively determining data collection parameters (including sampling frequency and metric range) based on preset monitoring objectives (such as anomaly detection accuracy), raw time-series stream data is collected from the cloud platform. Through data integration techniques (such as time alignment and redundancy filtering), unified multivariate time-series monitoring data is formed, providing a comprehensive and high-quality input foundation for subsequent identification of coupled variable groups and anomaly propagation analysis.

[0067] S02, extract the interaction relationships between different variables in multivariate time series monitoring data, and identify the coupled variable groups based on the interaction relationships through statistical causal analysis.

[0068] Here, the interaction relationship refers to the statistical dependence between variables over time; statistical causal analysis is a technique that uses causal discovery algorithms (such as Granger causality tests or transit entropy analysis) to infer the causal direction between variables; and the coupled variable set is a set of variables that characterizes a strong causal dependency. In practice, this can be achieved by calculating the statistical correlation between any two variable pairs (such as the Pearson correlation coefficient or mutual information; when using the Pearson correlation coefficient, the formula is as follows:) , Let x be the value of the variable x at the i-th time series data point. Let y be the value of the variable y at the i-th time series data point. and Let x and y be the time-series means of variables x and y, respectively, and n be the total number of time-series data points. Filter out variable pairs whose correlation values ​​exceed a preset threshold (set according to the calculation method and historical data: the threshold is 0.8 when using Pearson correlation coefficient by default. This threshold is based on 1000 sets of historical normal monitoring data of the cloud platform, covering two types of service entities: virtual machines and containers. The verification results are: false correlation rate ≤ 5%, and missed correlation rate ≤ 3%). Perform statistical causal analysis on the filtered variable pairs to determine their causal dependency type (including bidirectional or unidirectional causal dependency). Based on the type determination results, variable pairs of the same causal dependency type are grouped and integrated to form coupled variable groups, providing a structured variable relationship basis for subsequent abnormal propagation feature extraction.

[0069] S03. By analyzing the collaborative change patterns of the coupled variable group, anomaly propagation features are extracted from the multivariate time series monitoring data corresponding to the coupled variable group, and candidate anomaly events are selected from the multivariate time series monitoring data based on the anomaly propagation features.

[0070] Among them, the coordinated change pattern refers to the linkage change pattern of multiple variables in the coupled variable group in the time series. The anomaly propagation feature characterizes the dynamic attributes of the anomaly propagation among variables, including the anomaly initiation variable identifier, propagation direction, propagation speed, number of influencing variables, and anomaly time. Candidate anomaly events refer to the set of potential anomaly data obtained through feature screening. In implementation, data can be divided into time series segments by a time series window of preset length. The time series coordination index (such as dynamic time regularization distance or cross correlation coefficient) between variables in the coupled variable group is calculated based on the segment. The coordinated change pattern of each segment is determined accordingly. The difference between the pattern and the preset normal pattern is calculated (using Euclidean distance or KL divergence). When the difference value exceeds the preset threshold, it is marked as an anomaly segment. The anomaly propagation feature of the coupled variable group in the segment is extracted. By clustering and integrating the anomaly window and binding it with the feature, a set of candidate anomaly events is formed, which provides structured input for the subsequent construction of anomaly propagation map.

[0071] S04 uses the variables in the coupled variable group as nodes and constructs the edges between the nodes based on the anomaly propagation characteristics to form an anomaly propagation graph.

[0072] In this model, a node is a single monitored variable entity in the coupled variable group, and edges are defined by anomaly propagation features (including attributes such as anomaly propagation direction and speed) to characterize the causal relationship of anomaly propagation between variables. An anomaly propagation graph is a directed graph data structure used to visualize the propagation topology of anomalies in the variable network. In implementation, each variable in the coupled variable group can be mapped to a node in the graph, and directed edges can be added between relevant nodes according to anomaly propagation features (such as the initial variable identifier and propagation direction) to construct a graph model that reflects the dynamic propagation path of anomalies, providing a structured input basis for subsequent graph neural network root cause inference.

[0073] S05. Based on candidate abnormal events, a pre-set graph neural network model is used to perform root cause reasoning in the abnormal propagation graph to determine the list of abnormal root causes.

[0074] The preset graph neural network model is a pre-configured neural network architecture for graph structure learning (it can use GAT or GCN; when using GAT, the number of attention heads is 4, the hidden layer dimension is 64, and the output layer dimension is 32; when using GCN, the number of layers is 3, the hidden layer dimension is 64, and the activation function is ReLU). Root cause reasoning is the process of using graph neural networks to trace causes and locate anomaly sources. The anomaly root cause list is a structured output containing one or more subsets of anomaly root causes. In implementation, the preset graph neural network model can be used to learn node embedding representations of the anomaly propagation graph, extract the spatiotemporal feature vectors of each node, and based on the... The eigenvectors calculate the anomalous propagation influence score of the node corresponding to the anomalous initiation variable in the candidate anomalous events (calculated through self-attention mechanism when using GAT, and through betweenness centrality measure when using GCN; betweenness centrality calculation is based on the shortest path of the anomalous propagation graph). Based on the scores, a set of candidate root source nodes is identified, and the coupling variable groups and their anomalous time information corresponding to the nodes in the set are extracted and integrated to form a candidate anomalous root source list. The graph clustering layer in the graph neural network (such as community detection or hierarchical clustering) is used to perform deduplication and pattern clustering analysis on the list to generate an anomalous root source list containing similar propagation patterns, thereby realizing the automated and accurate location of anomalous root sources on the cloud platform.

[0075] S06. Based on the list of anomaly root causes, and according to the characteristics of anomaly propagation, simulate the propagation of anomalies in the anomaly propagation map to obtain the simulated anomaly propagation results.

[0076] The simulated anomaly propagation refers to the computational simulation of reproducing the anomaly diffusion process in the graph based on anomaly parameters. In implementation, anomaly simulation parameters (including the anomaly starting node, propagation direction, and propagation speed) can be parsed from a subset of the anomaly root source list. Starting from the anomaly starting node in the anomaly propagation graph, a directed graph traversal algorithm is executed according to the anomaly propagation direction (either breadth-first search or path exploration based on propagation constraints can be selected, such as breadth-first search or path exploration based on propagation constraints where the propagation constraint is anomaly propagation speed ≤ 5 nodes / minute). Based on the anomaly propagation speed parameters, the time-series information of the anomaly reaching each node along each path is calculated: if the speed is fixed, time-series = number of path nodes / propagation speed (unit: minutes); if the speed fluctuates, a linear interpolation method is used to complete the time-series of intermediate nodes). Simulated anomaly propagation paths are generated, and the time-series information of the anomaly reaching each node along each path is calculated based on the anomaly propagation speed parameters. All simulated propagation paths and their corresponding anomaly node time-series data are integrated to form a structured simulated anomaly propagation result, providing benchmark data for subsequent comparative analysis with candidate anomaly events.

[0077] S07. The simulated anomaly propagation results are compared with the candidate anomaly events to obtain the anomaly comparison results, and the anomaly cause analysis results are generated based on the anomaly comparison results.

[0078] Specifically, spatiotemporal sequence matching algorithms (such as dynamic time warping or similarity calculation based on graph edit distance) can be used to compare the simulated anomaly propagation path with the anomaly propagation paths recorded in candidate anomaly events point by point, generating anomaly comparison results that include path consistency, temporal deviation values, and differences in the scope of influence. Deviation analysis (including temporal offset, path divergence points, and differences in propagation intensity) is then performed on the comparison results. Combined with the anomaly events, the root causes of the differences between simulation and reality are analyzed, generating causal analysis results that include root cause verification, propagation path reliability assessment, and anomaly impact analysis, thus achieving a verification-based diagnosis and explanation of the entire anomaly event.

[0079] The aforementioned graph neural network-based time-series anomaly prediction method effectively captures the complex dependencies and causal propagation paths among service entities in the cloud platform by collecting multivariate time-series monitoring data and extracting variable interactions, and using statistical causal analysis to identify coupled variable groups. It extracts anomaly propagation features and filters candidate events by analyzing the collaborative change patterns of coupled variable groups, achieving accurate identification of anomaly patterns. An anomaly propagation graph is constructed using variables as nodes and anomaly features as edges, providing structured support for root cause reasoning. A graph neural network model is used to perform root cause reasoning to determine the list of anomaly root causes, and its spatiotemporal feature learning capabilities are used to automatically locate root cause nodes, significantly improving the efficiency of root cause analysis and overcoming the inefficiencies of traditional methods that rely on static thresholds and manual intervention. By simulating the anomaly propagation process and comparing it with candidate events to generate causal analysis results, it enhances adaptability to dynamic environments and predictive and preventative capabilities, comprehensively improving the accuracy and efficiency of time-series anomaly prediction in the cloud platform.

[0080] In one embodiment, the interaction relationships between different variables in multivariate time-series monitoring data are extracted, and based on these interaction relationships, a set of coupled variables is identified through statistical causal analysis, including:

[0081] S11, calculate the statistical correlation of variable pairs in multivariate time series monitoring data, where a variable pair consists of any two variables;

[0082] S12, filter out variable pairs whose statistical correlation values ​​are greater than the preset correlation threshold;

[0083] S13, Perform statistical causal analysis on the selected variable pairs to obtain the causal analysis results;

[0084] S14. Based on the causal analysis results, determine the type of causal dependency for each variable pair. The types of causal dependency include bidirectional causal dependency and unidirectional causal dependency.

[0085] S15. Based on the determination result of the causal dependency type, all variable pairs that are determined to be of the same causal dependency type are grouped together, and all groups of variable pairs are integrated to form a coupled variable group.

[0086] Specifically, the statistical correlation between any two variables in multivariate time-series monitoring data can be calculated, such as using Pearson correlation coefficient or mutual information to quantify the linear or nonlinear dependence between variables; variable pairs with statistical correlation values ​​greater than a preset correlation threshold are selected, which is adaptively set based on historical data or calculation methods; statistical causal analysis is performed on the selected variable pairs, using causal discovery algorithms such as Granger causality test or transit entropy analysis to obtain causal analysis results, thereby inferring the causal direction between variables; based on the causal analysis results, the type of causal dependence of each variable pair is determined, including bidirectional causal dependence (i.e., variables influence each other) or unidirectional causal dependence (i.e., one variable influences another unidirectionally); based on the determination results, all variable pairs of the same causal dependence type are grouped together, and by integrating all groups of variable pairs to form coupled variable groups, the strong causal dependence between variables is structurally represented, providing a basis for subsequent extraction of anomaly propagation features.

[0087] In one embodiment, by analyzing the collaborative change patterns of the coupled variable group, anomaly propagation features are extracted from the multivariate time-series monitoring data corresponding to the coupled variable group, including:

[0088] S21, Divide the multivariate time-series monitoring data into time-series segments according to the time-series window of preset length;

[0089] S22, based on time series fragments, calculate the temporal synergy index between any two variables in the coupled variable group;

[0090] S23, Based on all temporal synergy indicators, determine the synergistic change pattern of the corresponding coupled variable groups within each temporal sequence segment;

[0091] S24, calculate the difference between the collaborative change mode of each coupled variable group and the preset normal time-series collaborative change mode to obtain the collaborative mode difference value;

[0092] S25, compare the difference value of the cooperative mode with the preset difference threshold. When the difference value of the cooperative mode exceeds the preset difference threshold, mark the time sequence segment corresponding to the cooperative mode as an abnormal segment.

[0093] S26, extract the anomaly propagation characteristics of the coupled variable groups within each anomaly segment. The anomaly propagation characteristics include the anomaly initiation variable identifier, the anomaly propagation direction, the anomaly propagation speed, the number of anomaly-affecting variables, and the anomaly time.

[0094] For example, specifically, multivariate time-series monitoring data can be divided into continuous time-series segments based on a preset time-series window (the window size is adaptively set based on historical data or application scenarios, such as a window length of 5 minutes, determined by the principle that the minimum duration of historical abnormal events on the cloud platform is ≥5 minutes). Based on the time-series segment, the time-series synergy index between any two variables in the coupled variable group is calculated, such as using dynamic time warping distance to capture shape similarity or cross-correlation coefficients to quantify phase relationships and quantify the degree of linkage between variables. Based on the comprehensive analysis of all time-series synergy indices, the synergistic change pattern of the corresponding coupled variable group within each time-series segment is determined. This pattern characterizes the overall behavioral pattern of the variable group in a specific time period. The synergistic change pattern of each coupled variable group is compared with the preset normal time-series synergistic change pattern (using K-means analysis on historical normal data). Clustering training was conducted (K=3 clusters, training samples were monitoring data from the past 30 days without anomalies, sample size ≥5000). Dissimilarity was calculated using methods such as Euclidean distance or KL divergence to obtain the collaborative pattern difference value, thus quantifying the deviation. When the collaborative pattern difference value exceeded a preset difference threshold (dynamically adjusted according to false alarm rate or accuracy requirements), the corresponding time-series segment was marked as an anomalous segment, indicating a potential anomaly. Anomaly propagation characteristics of coupled variable groups within each anomalous segment were extracted. This included identifying the initial variable identifier of the anomaly (e.g., the first variable deviating from the normal range) through time-series analysis, inferring the direction of anomaly propagation based on causal direction, calculating the anomaly propagation speed using timestamps, counting the number of affected variables as the number of anomaly-affecting variables, and recording the anomaly occurrence time as the anomaly time, forming a structured feature set to provide input for subsequent anomaly event screening and root cause analysis.

[0095] In one embodiment, candidate abnormal events are selected from multivariate time-series monitoring data based on abnormal propagation characteristics, including:

[0096] S31, mark the timing window corresponding to each abnormal segment as an abnormal window;

[0097] S32, perform association clustering on each abnormal window according to the preset clustering rules to obtain an abnormal window cluster;

[0098] S33, within the abnormal window cluster, integrate the abnormal propagation features of the coupled variable groups within each abnormal segment to obtain the window abnormal propagation feature set;

[0099] S34, associate and bind the abnormal propagation features in the window abnormal propagation feature set with the corresponding abnormal segments, and mark the dataset formed after association and binding as candidate abnormal events.

[0100] For example, the time series windows corresponding to each anomalous segment can be marked as anomalous windows. Anomalous windows are divided based on time series windows of a preset length and identified by the difference value of the co-occurrence pattern exceeding a threshold. According to preset clustering rules (such as clustering algorithms based on time series similarity or Euclidean distance), association clustering is performed on each anomalous window to form an anomalous window cluster, so as to aggregate anomalous windows with spatiotemporal correlation. Within the anomalous window cluster, the anomalous propagation features of the coupled variable groups within each anomalous segment (including the anomalous initiation variable identifier, propagation direction, propagation speed, number of influencing variables, and anomalous time) are integrated, and a window anomalous propagation feature set is generated through data aggregation technology. The anomalous propagation features in the window anomalous propagation feature set are associated and bound with the corresponding anomalous segments. The binding is implemented using a key-value pair or timestamp indexed data structure, and the structured dataset formed after binding is marked as a candidate anomalous event, providing accurate and integrated anomalous event input for subsequent root cause inference.

[0101] In one embodiment, based on candidate anomalous events, a pre-defined graph neural network model is used to perform root cause reasoning in the anomalous propagation graph to determine a list of anomalous root causes, including:

[0102] S41, learn the node embedding representation of the anomaly propagation graph through a preset graph neural network model to obtain the spatiotemporal feature vector of each node;

[0103] S42, based on spatiotemporal feature vectors, calculate the abnormal propagation influence score of the node corresponding to each abnormal initiation variable identifier in the window abnormal propagation feature set in the abnormal event;

[0104] S43, Based on the abnormal propagation influence score, identify the set of candidate root source nodes in the abnormal propagation graph;

[0105] S44, extract the coupling variable group corresponding to the node in the candidate root node set and the abnormal time of the abnormal propagation feature corresponding to the extracted coupling variable group;

[0106] S45, integrate the extracted coupled variable groups and abnormal times to form a list of candidate abnormal root causes;

[0107] S46, The graph clustering layer in the preset graph neural network model is used to perform deduplication clustering analysis on the candidate anomaly root source list to form an anomaly root source list. The anomaly root source list contains one or more subsets of anomaly root source lists with similar propagation patterns.

[0108] For example, a pre-defined graph neural network model (such as GAT or GCN architecture) can be used to learn node embedding representations in the anomaly propagation graph. The spatiotemporal feature extraction capability of the graph neural network is used to generate spatiotemporal feature vectors for each node, capturing the temporal and spatial dependencies between nodes. Based on these spatiotemporal feature vectors, the anomaly propagation influence score of the node corresponding to each anomaly initiation variable in the window anomaly propagation feature set is calculated. For example, an attention mechanism or centrality measure can be used to quantify the potential influence of each node as an anomaly source. Based on the anomaly propagation influence score, a set of candidate root source nodes is identified in the anomaly propagation graph, and nodes with scores exceeding a pre-defined threshold are selected as potential root sources. Node pairs are then extracted from the candidate root source node set. The system identifies the corresponding coupled variable groups (i.e., the previously identified set of variables with strong causal dependencies) and the anomalous times (such as timestamps obtained from the feature set) corresponding to the anomalous propagation characteristics of these coupled variable groups. It integrates all extracted coupled variable groups and anomalous time information to form a structured candidate anomaly root cause list, initially summarizing potential root causes. A graph clustering layer (such as a community detection algorithm or hierarchical clustering) in a pre-defined graph neural network model is used to perform deduplication clustering analysis on the candidate anomaly root cause list, eliminating redundant entries and dividing the list into one or more subsets of the anomaly root cause list based on the similarity of propagation patterns. Through node embedding, score calculation, node identification, data extraction, list integration, and clustering analysis, a refined anomaly root cause list is output, achieving automated root cause localization.

[0109] In one embodiment, based on the list of anomaly root causes, the propagation of anomalies in the anomaly propagation map is simulated according to the anomaly propagation characteristics to obtain simulated anomaly propagation results, including:

[0110] S51, Determine the anomaly simulation parameters based on the subset of the anomaly root source list. The anomaly simulation parameters include the anomaly starting node, the anomaly propagation direction, and the anomaly propagation speed.

[0111] S52, Based on the anomaly simulation parameters, in the anomaly propagation graph, starting from the anomaly initiation node, traverse the directed graph according to the anomaly propagation direction to obtain the simulated anomaly propagation path;

[0112] S53, based on the simulated anomaly propagation path, the timing of the simulated anomaly reaching each node is determined according to the anomaly propagation speed, thus obtaining the anomaly node timing.

[0113] S54 integrates all simulated anomaly propagation paths and corresponding anomaly node timings to obtain the simulated anomaly propagation results.

[0114] Specifically, anomaly simulation parameters can be parsed and determined based on a subset of the anomaly root cause list. These parameters include the anomaly initiation node (the node identifier extracted from the subset as the simulation starting point), the anomaly propagation direction (causal direction information obtained from the anomaly propagation features), and the anomaly propagation speed (the propagation rate calculated based on the time difference in the features). Based on the anomaly simulation parameters, in the anomaly propagation graph (a directed graph constructed with variables as nodes and anomaly propagation features as edges), starting from the anomaly initiation node, a directed graph traversal algorithm is executed according to the anomaly propagation direction, such as breadth-first search or path exploration based on propagation constraints, to generate simulated anomaly propagation paths and reproduce the topological structure of anomaly diffusion. Based on the simulated anomaly propagation paths, the time-series information of the anomaly reaching each node along each path is calculated according to the anomaly propagation speed parameters, such as by dividing by the speed value or applying time-series interpolation methods, to obtain the accurate anomaly node time series (i.e., the time point when each node is affected by the anomaly). All simulated anomaly propagation paths and their corresponding anomaly node time-series data are integrated to form a structured simulated anomaly propagation result. This result is usually output in the form of a graph sequence or a timestamp array, providing benchmark data for subsequent comparison with candidate anomaly events.

[0115] In one embodiment, multivariate time-series monitoring data of multiple service entities in the cloud platform are collected, including:

[0116] S61, Obtain the service entity type information and dynamic load information of the service entity;

[0117] S62, based on preset monitoring targets, determines data collection parameters according to service entity type information and dynamic load information;

[0118] S63, based on data acquisition parameters, collects raw time-series stream data from multiple service entities in the cloud platform;

[0119] S64 integrates all raw time-series stream data to form multivariate time-series monitoring data.

[0120] For example, service entity type information (such as virtual machine specifications or container configuration) and dynamic load information (such as real-time resource utilization or request traffic) of the service entity can be obtained to comprehensively understand the entity's operating status. Based on preset monitoring targets (accuracy requirements or resource limitations for anomaly detection, such as anomaly response time requirements in the cloud platform service level agreement SLA; if the response time is ≤10s, the target is high real-time detection), data collection parameters are adaptively determined according to the service entity type information and dynamic load information, including the sampling frequency (the collection interval is dynamically adjusted according to load fluctuations, and the sampling frequency is set according to the service entity type, such as the sampling frequency for virtual machine service entities). The sampling frequency is 1 time / 30s for containerized service entities and 1 time / 10s for monitoring metrics (such as selecting key metrics like CPU utilization and memory usage). Based on the data acquisition parameters, raw time-series stream data from multiple service entities in the cloud platform are collected through monitoring terminals (such as agents or sensors) deployed on the service entities to ensure the real-time performance and integrity of the data. All raw time-series stream data are integrated, and time alignment techniques (such as timestamp-based synchronization) and redundancy filtering methods (such as removing duplicate or invalid data points) are used to form unified, structured multivariate time-series monitoring data, providing a high-quality data foundation for subsequent variable interaction analysis and anomaly detection.

[0121] The aforementioned graph neural network-based temporal anomaly prediction method collects multivariate temporal monitoring data from multiple service entities in a cloud platform, extracts the interaction relationships between different variables, and uses statistical causal analysis to identify coupled variable groups. This effectively captures the complex dependencies and causal propagation paths between service entities, overcoming the false positives and false negatives caused by the difficulty of modeling multivariate interactions in traditional methods. By dividing the data into sequence segments through a preset temporal window, the method calculates the temporal synergy index of variables in the coupled variable group. After determining the synergistic change pattern, it calculates the difference between the pattern and the normal pattern. When the difference exceeds a threshold, the abnormal segment is marked, and anomaly propagation features are extracted. Then, by associative clustering, the anomaly window and feature binding are integrated to filter candidate anomaly events, achieving accurate identification and structured processing of anomaly patterns. An anomaly propagation graph is constructed using the coupled variable group variables as nodes and the anomaly propagation features as edges, concretizing the abstract relationships into a directed graph structure, providing visual support for root cause reasoning. Based on candidate events, a pre-defined graph neural network model is used to perform root cause reasoning in the graph. Spatiotemporal feature vectors are extracted through node embedding representation learning, and the propagation influence score of the anomaly initiation node is calculated using an attention mechanism. This identifies a set of candidate root source nodes, extracts corresponding coupling variable groups and anomaly times to form a candidate list, and generates a subset of the anomaly root source list through graph clustering to remove duplicates. This automatically locates the root source node, significantly improving the efficiency of root cause analysis and avoiding the inefficiencies of traditional methods that rely on static thresholds and manual intervention. Based on the subset of the anomaly root source list, anomaly simulation parameters are analyzed, and a directed graph traversal is performed in the graph to generate simulated propagation paths. The node time sequence is determined based on the propagation speed, and the simulated anomaly propagation results are integrated. These results are then compared with candidate events in a spatiotemporal sequence to generate anomaly cause analysis results including path fit and deviation analysis. Verification-based diagnosis enhances the system's adaptability and predictive prevention capabilities in dynamic load environments. By integrating multivariate data acquisition, statistical causal analysis, collaborative pattern detection, graph neural network reasoning, and propagation simulation comparison, this approach effectively solves the core problems of traditional techniques, such as difficulty in capturing interactive dependencies, inefficiency in root cause analysis, and lack of propagation modeling.

[0122] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0123] Based on the same inventive concept, this application also provides a graph neural network-based temporal anomaly prediction device for implementing the graph neural network-based temporal anomaly prediction method described above. The solution provided by this device is similar to the implementation scheme described in the above method. Therefore, the specific limitations of one or more graph neural network-based temporal anomaly prediction device embodiments provided below can be found in the limitations of the graph neural network-based temporal anomaly prediction method described above, and will not be repeated here.

[0124] In one exemplary embodiment, such as Figure 2 As shown, a time series anomaly prediction device based on graph neural networks is provided, comprising:

[0125] The time-series data acquisition module 101 is used to collect multivariate time-series monitoring data of multiple service entities in the cloud platform;

[0126] The coupling variable identification module 102 is used to extract the interaction relationship between different variables in multivariate time series monitoring data, and to identify the coupling variable group based on the interaction relationship through statistical causal analysis.

[0127] The abnormal event screening module 103 is used to extract abnormal propagation features from the multivariate time series monitoring data corresponding to the coupled variable group by analyzing the collaborative change pattern of the coupled variable group, and to screen out candidate abnormal events from the multivariate time series monitoring data based on the abnormal propagation features.

[0128] Anomaly graph construction module 104 is used to construct anomaly propagation graph by using variables in the coupled variable group as nodes and constructing edges between nodes based on anomaly propagation characteristics.

[0129] The anomaly root cause reasoning module 105 is used to perform root cause reasoning in the anomaly propagation graph based on candidate anomaly events and a preset graph neural network model to determine the list of anomaly root causes.

[0130] The anomaly simulation analysis module 106 is used to simulate the propagation of anomalies in the anomaly propagation map based on the anomaly root source list and the anomaly propagation characteristics, and to obtain the simulated anomaly propagation results.

[0131] The anomaly cause analysis module 107 is used to compare the simulated anomaly propagation results with the candidate anomaly events to obtain anomaly comparison results, and generate anomaly cause analysis results based on the anomaly comparison results.

[0132] In one embodiment, the coupling variable identification module 102 is further configured to:

[0133] Calculate the statistical correlation of variable pairs in multivariate time series monitoring data, where a variable pair consists of any two variables;

[0134] Filter out variable pairs whose statistical correlation values ​​are greater than a preset correlation threshold;

[0135] Perform statistical causal analysis on the selected variable pairs to obtain the causal analysis results;

[0136] Based on the causal analysis results, determine the type of causal dependency for each variable pair. The types of causal dependency include bidirectional causal dependency and unidirectional causal dependency.

[0137] Based on the determination of the causal dependency type, all variable pairs that are determined to be of the same causal dependency type are grouped together, and all groups of variable pairs are integrated to form a coupled variable group.

[0138] In one embodiment, the abnormal event filtering module 103 is further configured to:

[0139] Multivariate time-series monitoring data is divided into time-series segments based on a time-series window of preset length;

[0140] Based on time series fragments, calculate the time series synergy index between any two variables in a set of coupled variables;

[0141] Based on all temporal coherence indices, determine the coherent change patterns of the corresponding coupled variable groups within each temporal sequence segment;

[0142] The difference between the collaborative change mode of each coupled variable group and the preset normal time-series collaborative change mode is calculated to obtain the collaborative mode difference value.

[0143] The difference value of the cooperative mode is compared with a preset difference threshold. When the difference value of the cooperative mode exceeds the preset difference threshold, the time sequence segment corresponding to the cooperative mode is marked as an abnormal segment.

[0144] Extract the anomaly propagation characteristics of the coupled variable groups within each anomaly segment. The anomaly propagation characteristics include the anomaly initiation variable identifier, the anomaly propagation direction, the anomaly propagation speed, the number of anomaly-affecting variables, and the anomaly time.

[0145] In one embodiment, the abnormal event filtering module 103 is further configured to:

[0146] Mark the timing window corresponding to each abnormal segment as an abnormal window;

[0147] Based on the preset clustering rules, association clustering is performed on each abnormal window to obtain an abnormal window cluster;

[0148] Within the abnormal window cluster, the abnormal propagation features of the coupled variable groups within each abnormal segment are integrated to obtain the window abnormal propagation feature set.

[0149] The abnormal propagation features in the window abnormal propagation feature set are associated and bound with the corresponding abnormal segments, and the dataset formed after association and binding is marked as a candidate abnormal event.

[0150] In one embodiment, the anomaly root cause reasoning module 105 is further configured to:

[0151] By learning node embedding representations of the anomaly propagation graph through a pre-defined graph neural network model, the spatiotemporal feature vectors of each node are obtained.

[0152] Based on spatiotemporal feature vectors, calculate the abnormal propagation influence score of the node corresponding to each abnormal initiation variable identifier in the window abnormal propagation feature set in the abnormal event;

[0153] Based on the abnormal propagation influence score, a set of candidate root source nodes is identified in the abnormal propagation graph;

[0154] Extract the coupling variable groups corresponding to the nodes in the candidate root source node set and the abnormal time of the abnormal propagation features corresponding to the extracted coupling variable groups;

[0155] The extracted sets of coupled variables and abnormal times are integrated to form a list of candidate anomaly root causes;

[0156] The graph clustering layer in the pre-defined graph neural network model is used to perform deduplication clustering analysis on the candidate anomaly root source list to form an anomaly root source list. The anomaly root source list contains one or more subsets of anomaly root source lists with similar propagation patterns.

[0157] In one embodiment, the anomaly simulation analysis module 106 is further configured to:

[0158] Based on a subset of the anomaly root cause list, determine the anomaly simulation parameters, which include the anomaly starting node, the anomaly propagation direction, and the anomaly propagation speed.

[0159] Based on the anomaly simulation parameters, in the anomaly propagation graph, starting from the anomaly initiation node, a directed graph traversal is performed according to the anomaly propagation direction to obtain the simulated anomaly propagation path.

[0160] Based on the simulated anomaly propagation path, the timing of the simulated anomaly reaching each node is determined according to the anomaly propagation speed, thus obtaining the anomaly node timing sequence.

[0161] By integrating all simulated anomaly propagation paths and corresponding anomaly node timing sequences, the simulated anomaly propagation results are obtained.

[0162] In one embodiment, the time-series data acquisition module 101 is further configured to:

[0163] Obtain service entity type information and dynamic load information of the service entity;

[0164] Based on the preset monitoring targets, the data collection parameters are determined according to the service entity type information and dynamic load information;

[0165] Based on data acquisition parameters, raw time-series stream data of multiple service entities in the cloud platform are collected;

[0166] All raw time-series stream data are integrated to form multivariate time-series monitoring data.

[0167] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the graph neural network-based time series anomaly prediction method as described above.

[0168] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0169] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0170] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A method for predicting temporal anomalies based on graph neural networks, characterized in that, The method includes: Collect multivariate time-series monitoring data from multiple service entities in the cloud platform; Extract the interaction relationships between different variables in the multivariate time-series monitoring data, and identify the coupled variable groups based on the interaction relationships through statistical causal analysis; By analyzing the collaborative change patterns of the coupled variable group, anomaly propagation features are extracted from the multivariate time-series monitoring data corresponding to the coupled variable group, and candidate anomaly events are selected from the multivariate time-series monitoring data based on the anomaly propagation features. Using the variables in the coupled variable group as nodes, and constructing edges between nodes based on the anomaly propagation features, an anomaly propagation graph is formed. Based on the candidate abnormal events, a preset graph neural network model is used to perform root cause reasoning in the abnormal propagation graph to determine the list of abnormal root causes. Based on the list of anomaly root causes, and according to the anomaly propagation characteristics, the propagation of the anomaly in the anomaly propagation map is simulated to obtain the simulated anomaly propagation results; The simulated anomaly propagation results are compared with the candidate anomaly events to obtain anomaly comparison results, and anomaly cause analysis results are generated based on the anomaly comparison results.

2. The method according to claim 1, characterized in that, The step involves extracting the interaction relationships between different variables in the multivariate time-series monitoring data, and based on these interaction relationships, identifying the coupled variable group through statistical causal analysis, including: Calculate the statistical correlation degree of variable pairs in the multivariate time series monitoring data, wherein the variable pair consists of any two variables; Filter out variable pairs whose statistical correlation values ​​are greater than a preset correlation threshold; Perform statistical causal analysis on the selected variable pairs to obtain the causal analysis results; Based on the causal analysis results, the causal dependency type of each variable pair is determined, including bidirectional causal dependency and unidirectional causal dependency. Based on the determination of the causal dependency type, all variable pairs that are determined to be of the same causal dependency type are grouped together, and all groups of variable pairs are integrated to form the coupled variable group.

3. The method according to claim 1, characterized in that, The step of extracting anomaly propagation features from the multivariate time-series monitoring data corresponding to the coupled variable group by analyzing the collaborative change patterns of the coupled variable group includes: The multivariate time-series monitoring data is divided into time-series sequence segments according to a time-series window of preset length; Based on the time series segment, calculate the time series synergy index between any two variables in the coupled variable group; Based on all the aforementioned temporal synergy indices, determine the synergistic change pattern of the corresponding coupled variable groups within each of the aforementioned temporal sequence segments; The difference between the collaborative change mode of each coupled variable group and the preset normal time-series collaborative change mode is calculated to obtain the collaborative mode difference value. The difference value of the cooperative mode is compared with a preset difference threshold. When the difference value of the cooperative mode exceeds the preset difference threshold, the time sequence segment corresponding to the cooperative mode is marked as an abnormal segment. Extract the anomaly propagation features of the coupled variable groups within each anomaly segment. The anomaly propagation features include the anomaly initiation variable identifier, the anomaly propagation direction, the anomaly propagation speed, the number of anomaly-affecting variables, and the anomaly time.

4. The method according to claim 3, characterized in that, The step of filtering candidate abnormal events from the multivariate time-series monitoring data based on the abnormal propagation characteristics includes: Mark the timing window corresponding to each of the aforementioned abnormal segments as an abnormal window; According to the preset clustering rules, association clustering is performed on each of the abnormal windows to obtain an abnormal window cluster; Within the abnormal window cluster, the abnormal propagation features of the coupled variable groups within each abnormal segment are integrated to obtain the window abnormal propagation feature set. The abnormal propagation features in the window abnormal propagation feature set are associated and bound with the corresponding abnormal segments, and the dataset formed after the association and binding is marked as the candidate abnormal event.

5. The method according to claim 4, characterized in that, Based on the candidate abnormal events, a preset graph neural network model is used to perform root cause reasoning in the abnormality propagation graph to determine the list of abnormality root causes, including: The spatiotemporal feature vectors of each node are obtained by learning node embedding representations through the preset graph neural network model. Based on the spatiotemporal feature vector, calculate the abnormal propagation influence score of the node corresponding to each abnormal initiation variable identifier in the window abnormal propagation feature set in the abnormal event. Based on the abnormal propagation influence score, a set of candidate root source nodes is identified in the abnormal propagation graph; Extract the coupling variable group corresponding to the node in the candidate root source node set and the abnormal time of the abnormal propagation feature corresponding to the extracted coupling variable group; The extracted sets of coupled variables and the abnormal times are integrated to form a list of candidate abnormal root causes; The candidate anomaly root cause list is subjected to deduplication clustering analysis using the graph clustering layer in the preset graph neural network model to form the anomaly root cause list, which contains one or more subsets of anomaly root cause lists with similar propagation patterns.

6. The method according to claim 5, characterized in that, The step of simulating the propagation of an anomaly in the anomaly propagation map based on the anomaly root source list and the anomaly propagation characteristics to obtain the simulated anomaly propagation result includes: Based on the subset of the anomaly root cause list, anomaly simulation parameters are determined, including the anomaly starting node, anomaly propagation direction, and anomaly propagation speed. Based on the anomaly simulation parameters, in the anomaly propagation graph, starting from the anomaly initiation node and according to the anomaly propagation direction, a directed graph traversal is performed to obtain the simulated anomaly propagation path. Based on the simulated anomaly propagation path, the timing of the simulated anomaly reaching each node is determined according to the anomaly propagation speed, thus obtaining the anomaly node timing sequence. By integrating all the simulated anomaly propagation paths and the corresponding anomaly node timings, the simulated anomaly propagation result is obtained.

7. The method according to claim 1, characterized in that, The multivariate time-series monitoring data of multiple service entities in the data collection cloud platform includes: Obtain the service entity type information and dynamic load information of the service entity; Based on the preset monitoring targets, the data collection parameters are determined according to the service entity type information and dynamic load information; Based on the data acquisition parameters, raw time-series stream data of multiple service entities in the cloud platform are collected; All the original time-series stream data are integrated to form the multivariate time-series monitoring data.

8. A time series anomaly prediction device based on graph neural networks, characterized in that, The device includes: The time-series data acquisition module is used to collect multivariate time-series monitoring data from multiple service entities in the cloud platform; The coupling variable identification module is used to extract the interaction relationship between different variables in the multivariate time series monitoring data, and to identify the coupling variable group based on the interaction relationship through statistical causal analysis. An abnormal event filtering module is used to extract abnormal propagation features from the multivariate time-series monitoring data corresponding to the coupled variable group by analyzing the collaborative change pattern of the coupled variable group, and to filter candidate abnormal events from the multivariate time-series monitoring data based on the abnormal propagation features. An anomaly graph construction module is used to construct edges between nodes using the variables in the coupled variable group as nodes and the anomaly propagation features to form an anomaly propagation graph. An anomaly root cause reasoning module is used to perform root cause reasoning in the anomaly propagation graph based on the candidate anomaly events, using a preset graph neural network model to determine the list of anomaly root causes. An anomaly simulation analysis module is used to simulate the propagation of an anomaly in the anomaly propagation map based on the anomaly root source list and the anomaly propagation characteristics, and obtain the simulated anomaly propagation results. The anomaly cause analysis module is used to compare the simulated anomaly propagation results with the candidate anomaly events to obtain anomaly comparison results, and generate anomaly cause analysis results based on the anomaly comparison results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images