Root cause service sorting method and system based on graph neural network and SLA weight

Abstract

The invention belongs to the technical field of distributed system monitoring and fault positioning, and discloses a root cause service sorting method and system based on a graph neural network and an SLA weight, and the method comprises the steps: constructing a dynamic service dependency graph based on service topology data and real-time index data, the dynamic service dependency graph being a weighted directed graph structure; when it is detected that a service node index is abnormal or calling edge fluctuation exceeds a threshold value, abnormal propagation path reasoning is triggered, and candidate abnormal propagation paths are generated by using a multi-modal graph neural network model; calculating a root cause influence score based on the candidate abnormal propagation path in combination with the index deviation of each service node, a preset SLA weight and a propagation hop count; and sorting the service nodes according to the root cause influence scores, and determining the priority of the root cause service. According to the method, the abnormal propagation path can be automatically reasoned, and intelligent root cause service sorting is realized in combination with the SLA weight.

Description

Technical Field

[0001] This invention relates to the field of distributed system monitoring and fault location technology, and in particular to a root cause service ranking method and system based on graph neural networks and SLA weights. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] In microservice architecture information systems, the dependencies between services are complex and dynamically changing, making it difficult for traditional monitoring systems to accurately identify the propagation paths of anomalies and the root cause service. Existing solutions mainly rely on static thresholds, rule engines, or distributed tracing tools for problem localization, but they have the following shortcomings: While distributed tracing tools can provide dynamic topology maps and distributed tracing, they lack the ability to intelligently reason about anomaly propagation paths and cannot automatically identify complex propagation patterns across services; while metric monitoring tools can monitor JVM, host, and database metrics, they cannot correlate metric anomalies with dependencies, making it difficult to determine the priority of the root cause service; existing methods do not consider the SLA weight of services, resulting in a disconnect between root cause localization results and actual business needs, affecting fault response efficiency. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a root cause service ranking method and system based on graph neural networks and SLA weights, which can automatically infer anomaly propagation paths and achieve intelligent ranking of root cause services by combining SLA weights.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a root cause service ranking method based on graph neural networks and SLA weights, comprising the following steps: Based on service topology data and real-time metric data, a dynamic service dependency graph is constructed, which is a weighted directed graph structure. When an abnormal service node metric is detected or the fluctuation of the call edge exceeds the threshold, an anomaly propagation path inference is triggered, and a candidate anomaly propagation path is generated using a multimodal graph neural network model. Based on the candidate anomaly propagation path, the root cause impact score is calculated by combining the indicator deviation of each service node, the preset SLA weight, and the number of propagation hops. Service nodes are sorted according to their root cause impact scores to determine the priority of root cause services.

[0006] As an alternative implementation, the steps of anomaly propagation path reasoning include: A graph neural network model employing a hybrid architecture of MGNN and DyGNN is used to fuse multi-dimensional edge attribute features through a modal gating mechanism. A causal attention mechanism is introduced in the GAT / GCN layer, and a counterfactual sample generator is used to filter propagation edges with high causal confidence. Anomaly propagation paths are predicted based on message passing mechanisms, and the path features are normalized.

[0007] As an alternative implementation, the root cause impact score is calculated by incorporating index bias, SLA weight, and propagation hop count, and dynamically weighted using adjustable parameters.

[0008] As an alternative implementation method, the SLA weight is calculated by combining the business preset value and real-time service performance data using the entropy method.

[0009] As an alternative implementation, it also includes performing joint probability calculations on multiple high-scoring services based on Bayesian inference to determine the final root cause service.

[0010] As an alternative implementation, the steps for constructing a dynamic service dependency graph include: The call relationships between services are analyzed using a distributed tracing tool to construct an initial service dependency graph; Add corresponding metric attributes and SLA weights to the nodes and edges in the graph; Real-time monitoring of service topology changes and dynamic updates to the graph structure to reflect the latest service dependency status.

[0011] Secondly, the present invention provides a root cause service ranking system based on graph neural networks and SLA weights, comprising: The graph construction module is configured to: construct a dynamic service dependency graph based on service topology data and real-time indicator data, wherein the dynamic service dependency graph is a weighted directed graph structure; The anomaly detection module is configured to: trigger anomaly propagation path reasoning when anomalies in service node metrics or fluctuations in call edges exceed a threshold, and generate candidate anomaly propagation paths using a multimodal graph neural network model; The impact score calculation module is configured to: calculate the root cause impact score based on the candidate anomaly propagation path, combined with the indicator deviation of each service node, the preset SLA weight and the number of propagation hops; The root cause ranking module is configured to sort service nodes based on root cause impact scores to determine the priority of root cause services.

[0012] Thirdly, the present invention provides an electronic device including a memory and a processor, and computer instructions stored in the memory and running on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the first aspect.

[0013] Fourthly, the present invention provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, perform the method described in the first aspect.

[0014] Fifthly, the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention proposes a root cause service ranking method based on graph neural networks and SLA weights, demonstrating significant comprehensive advantages in the field of fault localization for microservice architecture information systems. This method constructs a dynamically evolving service dependency graph by integrating link tracing topology and real-time monitoring indicators, laying a solid foundation for subsequent accurate analysis. Its core innovation lies in employing a multimodal graph neural network model. This model can not only intelligently learn complex dependency and invocation patterns between services, but also effectively identify high-confidence anomaly propagation paths from massive amounts of data by introducing causal attention mechanisms and counterfactual reasoning techniques, thereby greatly improving the accuracy and reliability of root cause inference. In the root cause determination stage, this invention breaks through the limitations of traditional methods that only focus on technical indicators, creatively incorporating Service Level Agreement (SLA) weights into the quantitative evaluation system. By designing a dynamically weighted root cause impact score formula and supplementing it with online parameter optimization through reinforcement learning, the ranking results can truly reflect the degree of impact of anomalies on core business, ensuring that operational resources are prioritized for the most critical services. Furthermore, this method possesses excellent real-time response and adaptive capabilities, enabling it to continuously track the dynamic changes of microservice architecture information systems, automatically adapt to sensitive scenarios such as business peaks, significantly shorten the mean time to recovery (MTTR), reduce the manual troubleshooting costs for the operations and maintenance team, and ultimately provide strong intelligent support for ensuring the high availability and business continuity of distributed systems.

[0016] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0017] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0018] Figure 1 This is a schematic diagram illustrating the overall architecture and module interaction relationships of the root cause service ranking system based on graph neural networks and SLA weights of the present invention. Figure 2 This is a flowchart of the root cause service ranking method based on graph neural networks and SLA weights of the present invention; Figure 3 This is a schematic diagram of graph data input and initialization in anomaly propagation path reasoning. Figure 4 This is a schematic diagram of multi-dimensional feature fusion in anomaly propagation path reasoning; Figure 5 This is a schematic diagram of dynamic embedding updates in anomaly propagation path reasoning; Figure 6 A schematic diagram of the causal attention mechanism in anomaly propagation path reasoning; Figure 7 A graph illustrating the propagation edge selection method for high causal confidence in anomaly propagation path reasoning; Figure 8 A schematic diagram illustrating the risk compensation mechanism in the calculation of indicator differences in root cause service ranking. Figure 9 Schematic diagram of the entropy method in SLA calculation for root cause service sequencing; Figure 10 A schematic diagram illustrating the changes in DSW data during SLA calculation in root cause service ranking; Figure 11 A schematic diagram of Bayesian inference of root causes in root cause service ranking. Detailed Implementation

[0019] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0020] It should be noted that the following detailed description is exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0021] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form as well. Furthermore, it should be understood that the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but includes other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0023] Example 1 like Figures 1 to 11As shown, this embodiment provides a root cause service ranking method based on graph neural networks and SLA weights, including the following steps: Based on service topology data and real-time metric data, a dynamic service dependency graph is constructed, which is a weighted directed graph structure. When an abnormal service node metric is detected or the fluctuation of the call edge exceeds the threshold, an anomaly propagation path inference is triggered, and a candidate anomaly propagation path is generated using a multimodal graph neural network model. Based on the candidate anomaly propagation path, the root cause impact score is calculated by combining the indicator deviation of each service node, the preset SLA weight, and the number of propagation hops. Service nodes are sorted according to their root cause impact scores to determine the priority of root cause services.

[0024] The specific solution of the present invention is as follows: Step 1: Build the service dependency graph: The dynamic topology graph of microservices is obtained using a link tracing tool. The call relationships between services are parsed, and a directed graph G=(V, E) is constructed, where V is the set of service nodes (containing microservice nodes and their dependent services), and E is the set of call edges. Combined with the metric data from the metric monitoring tool, attribute metric thresholds and SLA weights are added to each node v∈V and edge e∈E.

[0025] Step 1 specifically includes the following steps: Step 11: Collect microservice topology data using a tracing tool; Step 12: Obtain the topology data and parse the call relationships between multiple services; Step 13: Merge the inter-service call relationships. Construct a directed weighted graph based on the directed graph formula G=(V, E), including the set of nodes and edges.

[0026] Step 14: Dynamically update the weighted graph mechanism. When the link tracing tool detects a change in service topology, it uses the update formula... (in, This indicates the updated service topology. This indicates the previous service topology. The SLA weights on the nodes of the graph structure are updated in real time (representing the detected topology changes since the last update), and the data is shown in Table 1. Table 1 shows the SLA weight updates on the nodes of the graph structure;

[0027] Step 15: Indicator Correlation Analysis. Using time series data from indicator monitoring tools, the indicator correlation formula is applied. Where R represents the overall correlation strength between node metrics and the calling edge; Pearson correlation coefficient quantifies the linear correlation between node metrics x (such as CPU utilization) and edge attributes y (such as response latency); To capture the causal driving relationship between changes in node indicators and fluctuations in calling edges in the time series, the Granger causality test results are used. D(t) represents the Dynamic Time Warping (DTW) distance, which solves the problem of matching time series with non-equal lengths or phase shifts. α, β, and γ are adaptive weights, which dynamically adjust the contribution of each indicator according to the data distribution (such as enhancing the causal weight when there are abnormal fluctuations) to identify the relationship between node indicators and calling edges. The relationship between the indicators on each node and the edges is mapped to a dataset, as shown in Table 2. Table 2 maps the indicators on each node to the relationships on the edges into a dataset;

[0028] Step 2: Anomaly Propagation Path Reasoning: Real-time monitoring tools and link tracing tools track edge fluctuations. When anomalies or significant edge fluctuations are detected in node v, anomaly propagation inference is triggered. A multimodal graph neural network model is constructed, employing a hybrid architecture of MGNN and DyGNN. A modal gating mechanism integrates multi-dimensional edge attribute features such as call frequency, response latency, and time series, and a dynamic update strategy is used to adjust node embeddings in real time to capture the temporal evolution of inter-service dependencies. Subsequently, this model is used to train graph G. A causal attention mechanism is introduced at the GAT / GCN layer. A counterfactual sample generator is constructed using Do-calculus to simulate node isolation and traffic scheduling intervention scenarios. The probability increase ratio of the affected node after intervention is calculated (P(Y=y|do(X=x)) - P(Y=y|do(X=x'))) and high-causal confidence propagation edges are selected. Simultaneously, Pearson correlation coefficient and Granger causality test are combined to quantify the causal strength of nodes in the candidate path. Finally, the initial state of the anomalous node v is input, and the model predicts the anomaly propagation path P={v1, v2,..., v} through a message passing mechanism. n}, generate candidate propagation chains, and use the algorithm SDR-NORM(N( )= The service call frequency, response latency, and time series are normalized to [0,1] for standardized service weights. The path length of the propagation chain is normalized, and the links that exceed the threshold are marked as priority roots for analysis.

[0029] Step 2 specifically includes the following steps: Step 21: Construction of the MGNN and DyGNN Hybrid Architecture Model - Part 1: Graph Data Input and Initialization. Input the directed weighted graph G (containing node topology and initialized weights) generated in Step 1 into the MGNN and DyGNN hybrid architecture model. Convert the graph data to the input format of the MGNN-DyGNN hybrid architecture, initialize the node embedding representation, and output the neural network representation of the basic graph structure, preserving the original dependencies, such as... Figure 3 As shown; Step 22: Construction of the Hybrid Architecture Model of MGNN and DyGNN (Part 2): Multi-dimensional Feature Fusion. Input call frequency, response latency, and time-series multi-dimensional edge attribute data. Integrate multi-dimensional features through a modal gate control mechanism to generate a joint representation. Output node embedding data after fusing multi-dimensional features, such as... Figure 4 As shown; Step 23: Building the Hybrid Architecture Model of MGNN and DyGNN (Part 3): Dynamic Embedding Update. Input real-time monitored node metric streams and edge attribute change information. Apply a dynamic update strategy (using Python's bqplot component to bind slider / button controls to link chart data attributes (e.g., line.y = new_embedding), combined with hold_sync() for batch updates, to achieve interactive node embedding visualization, monitor service metric time-series data streams, dynamically refresh embedding coordinates and redraw connections, capturing the time-series evolution of service dependencies). Adjust node embeddings in real-time to capture the time-series evolution of inter-service dependencies, outputting time-series-aware dynamic node embedding data, such as... Figure 5 As shown; Step 24: Based on the indicator edge set data in Step 15, collect indicator and edge data using indicator detection tools and link tracing tools and detect whether abnormal propagation reasoning is triggered; Step 25: After the anomaly propagation inference is triggered, the anomaly indicators, edge data set, and graph G data are aggregated using the Contact method and then input into the MGNN and DyGNN hybrid architecture model built based on steps 21, 22, and 23 for model training. The aggregated data is shown in the table below. Table 3 shows the aggregated data;

[0030] Step 26: During training, the GAT / GCN layer uses a causal attention mechanism to identify nodes and edge information highly relevant to anomaly propagation, such as... Figure 6 As shown; Step 27: Simultaneously, using a counterfactual sample generator constructed with Do-calculus, intervention scenarios such as node isolation and traffic scheduling are simulated. The probability increase ratio of the affected nodes after intervention is calculated using the formula P(Y=y|do(X=x)) - P(Y=y|do(X=x')), thereby filtering out propagation edges with high causal confidence, such as... Figure 7 As shown; Step 28: Based on the high-confidence propagation edge after the intervention in Step 27, train by combining Pearson correlation coefficient and Granger causality test, quantify the causal strength of nodes in the candidate path, and finally input the initial state of the abnormal node v, as shown in Table 4. Table 4. High-confidence propagation edge analysis;

[0031] Step 29: Use the SDR-NORM algorithm (N) )= Where median(X) is the median of dataset X, and IQR(X) is the quartile range of dataset X, that is, the difference between the upper quartile (Q3) and the lower quartile (Q1): IQR(X) = Q3 - Q1. It is a very small positive number, used to prevent the numerator from being zero when the denominator is zero. Centered based on the median, then divided by The result is scaled, multiplied by 1 / 2 and then added to map to the interval [0,1]. The service call frequency, response latency and time series aggregated in step 25 are normalized and the result is standardized to the interval [0,1]. At the same time, the path length of the propagation chain is normalized, and the links that exceed the threshold are marked as links that are given priority for root cause analysis, as shown in Table 5.

[0032] Table 5 shows links that exceed the threshold and are marked as links that are prioritized for root cause analysis (assuming a path length threshold of 0.7).

[0033] Step 3: Root Cause Service Ranking For each service in the anomaly propagation path P The root cause affects the score The calculation formula is: The parameters α, β, γ, σ, and E are adjusted in real time by an online gradient descent algorithm (Adam optimizer), dynamically updating weights based on the contribution rate of each service in historical anomaly data to avoid static parameter bias. A DQN reinforcement learning model is also introduced, optimizing parameter allocation strategies based on root cause localization accuracy feedback. When the performance index difference exceeds a threshold, a risk compensation mechanism is triggered, automatically increasing weights to prioritize the identification of critical service anomalies. SLA weights are based on a pre-set business benchmark, combined with real-time service performance (response time, error rate) and user satisfaction data, calculating a comprehensive weight using the entropy method to ensure high-value services receive priority during anomalies. For complex SLA scenarios, a dependency sensitivity weighted method (DSW) is used. This approach addresses the issue of traditional product-based methods over-penalizing low SLA components by quantifying the impact of dependency. For propagation hop count, a graph neural network (GAT) is used to fuse temporal features (abnormal propagation speed, duration) and topological features (node ​​betweenness centrality). After extracting feature vectors, the hop count impact is weighted and calculated. Finally, based on S... i The scores are ranked and combined with business context constraints: if a high-scoring service belongs to the core business chain, it is directly marked as the root cause; if there are multiple high-scoring services, the joint probability is calculated through Bayesian inference to determine the final root cause, thereby achieving accurate positioning and dynamic priority decision-making.

[0034] Step 3 specifically includes the following steps: Step 31: Obtain each service v i Real-time monitored metrics (such as call frequency and response latency) are temporarily stored in a designated storage area for subsequent processing steps, as shown in Table 6. Table 6 shows the real-time monitoring metrics for each service;

[0035] Step 32: Set the SLA service preset baseline and obtain the real-time service node v i Performance data (such as response latency) Error rate Collect user satisfaction data (such as customer satisfaction index and user retention rate), and temporarily store the data in a designated storage area for subsequent processing steps, as shown in Table 7; Table 7 Performance data of real-time service nodes;

[0036] Step 33: Based on the graph structure node / edge data, anomaly propagation path P, and indicator differences of each service node Vi obtained in Step 2, temporarily store the data in the designated storage area for subsequent processing steps, as shown in Table 8. Table 8 shows the characteristic data of node / edge data, anomaly propagation path P, and the difference in indicators of each service node Vi;

[0037] Step 34: Based on the time series and topological feature data (anomaly propagation speed, duration, and node betweenness centrality) obtained in Step 2, temporarily store the data in the specified storage area for subsequent processing steps, as shown in Table 9; Table 9. Temporal and topological feature data;

[0038] Step 35: Compare the indicator difference with the threshold, triggering a risk compensation mechanism to dynamically increase the weight (e.g., if the v2 node response time exceeds the standard (150ms > 100ms) and the error rate exceeds the standard (1.2% > 0.5%), then dynamically increase the v2 weight to 1.3 (initial weight = 1.0)). Figure 8 As shown; Step 36: Calculate the average comprehensive weight of the SLA weights using the weight matrix entropy method and historical weight analysis, DSW method ( Addressing the impact of combined SLA dependencies, such as Figure 9 , Figure 10 As shown; Step 37: The propagation hop count is calculated by weighting the temporal and topological features using GAT (the specific method is as follows:) (1) Calculate the weighted feature representation from node V2 to node V1 using the attention coefficient and the feature vector of node V2; (2) Propagate the weighted representation to V1 and update the feature representation of V1; (3) Use the attention coefficient again to calculate the weighted feature representation from V1 to API; (4) Calculate the propagation influence score of V2 by combining the feature representations of V2->V1, the feature representations of V1 to API, and considering the abnormal duration SLA of V2.

[0039] Step 38: Root Cause Score i Synthesized according to the formula, with Adam adjusting parameters in real time and DQN optimization strategies, while simultaneously integrating each service v i The root cause of the influence score S i Sort by score and mark priority.

[0040] The specific method is as follows: (1) Based on the feature representation data stored in steps 31, 32, 33 and 34, calculate the index difference, SLA weight and propagation hops of the current service node in steps 35, 36 and 37 respectively, and then calculate the initial score of the node according to the root cause score formula (e.g., Si=0.85). (2) Use the Adam optimizer to adjust the parameters α, β, γ, σ, and E in the root cause calculation formula. For example, set the learning rate to 0.001, α=0.1, β=0.1, γ=0.1, σ=0.1, and E=0.1. When there are no major events in the environmental sensitivity service, the maximum amplification is 10%, i.e., 0.1. After iterative training, update to the new Si score (e.g., Si=0.85 becomes Si=0.88). (3) Use the DQN optimization strategy to first isolate the traffic of a certain node and observe the change in its error rate (if the error rate increases, adjust the α coefficient to 0.2). (4) Incorporate the adjusted parameters into the root cause formula, and include each service node v i Recalculate the scores and sort them from highest to lowest, marking their priority; Step 39: Obtain the root cause service ranking list generated in Step 38. At the same time, combine the feature information of the upper and lower nodes of the current service node to determine whether there are high scores. High scores are marked as root cause candidates. If there are multiple high scores, the Bayesian inference method is called directly. Step 310: Calculate candidate service v using Bayesian inference i The joint probability is calculated by comprehensively considering dependencies and weights, and finally the root cause determination result is obtained, such as... Figure 11 As shown.

[0041] In this embodiment, the method overcomes the shortcomings of traditional static analysis in adapting to the dynamic changes of microservices by using dynamic graph modeling and real-time indicator fusion; the introduction of SLA weights makes the ranking results more in line with business priorities, and the exceptions of high SLA services are handled first.

[0042] Example 2 This embodiment provides a root cause service ranking system based on graph neural networks and SLA weights, including: The graph construction module is configured to: construct a dynamic service dependency graph based on service topology data and real-time indicator data, wherein the dynamic service dependency graph is a weighted directed graph structure; The anomaly detection module is configured to: trigger anomaly propagation path reasoning when anomalies in service node metrics or fluctuations in call edges exceed a threshold, and generate candidate anomaly propagation paths using a multimodal graph neural network model; The impact score calculation module is configured to: calculate the root cause impact score based on the candidate anomaly propagation path, combined with the indicator deviation of each service node, the preset SLA weight and the number of propagation hops; The root cause ranking module is configured to sort service nodes based on root cause impact scores to determine the priority of root cause services.

[0043] It should be noted that the above modules correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the above modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules can be executed in a computer system as part of the system.

[0044] In further embodiments, the following is also provided: An electronic device includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method described in Embodiment 1. For brevity, further details are omitted here.

[0045] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0046] A computer-readable storage medium for storing computer instructions that, when executed by a processor, perform the method of Embodiment 1.

[0047] The method in Example 1 can be directly executed by a hardware processor, or it can be executed by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0048] A computer program product includes a computer program that, when executed by a processor, implements the method in Embodiment 1.

[0049] The present invention also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, which execute in a device on a target real or virtual processor to perform the processes / methods described above. Typically, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., that perform specific tasks or implement specific abstract data types. In various embodiments, the functionality of program modules can be combined or divided among program modules as needed. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside in both local and remote storage media.

[0050] The computer program code used to implement the methods of the present invention may be written in one or more programming languages. This computer program code may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the computer or other programmable data processing device, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a stand-alone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0051] In the context of this invention, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, and the like. Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0052] Those skilled in the art will recognize that the units and algorithm steps described in conjunction with the embodiments herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0053] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A root cause service ranking method based on graph neural networks and SLA weights, characterized in that, Includes the following steps: Based on service topology data and real-time metric data, a dynamic service dependency graph is constructed, which is a weighted directed graph structure. When an abnormal service node metric is detected or the fluctuation of the call edge exceeds the threshold, an anomaly propagation path inference is triggered, and a candidate anomaly propagation path is generated using a multimodal graph neural network model. Based on the candidate anomaly propagation path, the root cause impact score is calculated by combining the indicator deviation of each service node, the preset SLA weight, and the number of propagation hops. Service nodes are sorted according to their root cause impact scores to determine the priority of root cause services.

2. The root cause service ranking method based on graph neural networks and SLA weights as described in claim 1, characterized in that, The steps involved in anomaly propagation path reasoning include: A graph neural network model employing a hybrid architecture of MGNN and DyGNN is used to fuse multi-dimensional edge attribute features through a modal gating mechanism. A causal attention mechanism is introduced in the GAT / GCN layer, and a counterfactual sample generator is used to filter propagation edges with high causal confidence. Anomaly propagation paths are predicted based on message passing mechanisms, and the path features are normalized.

3. The root cause service ranking method based on graph neural networks and SLA weights as described in claim 1, characterized in that, The root cause impact score is calculated by integrating index bias, SLA weight, and propagation hop count, and dynamically weighted using adjustable parameters.

4. The root cause service ranking method based on graph neural networks and SLA weights as described in claim 3, characterized in that, SLA weights are calculated using the entropy method, based on predefined business values ​​and real-time service performance data.

5. The root cause service ranking method based on graph neural networks and SLA weights as described in claim 1, characterized in that, It also includes joint probability calculation of multiple high-scoring services based on Bayesian inference to determine the final root cause service.

6. The root cause service ranking method based on graph neural networks and SLA weights as described in claim 1, characterized in that, The steps to construct a dynamic service dependency graph include: The call relationships between services are analyzed using a distributed tracing tool to construct an initial service dependency graph; Add corresponding metric attributes and SLA weights to the nodes and edges in the graph; Real-time monitoring of service topology changes and dynamic updates to the graph structure to reflect the latest service dependency status.

7. A root cause service ranking system based on graph neural networks and SLA weights, characterized in that, include: The graph construction module is configured to: construct a dynamic service dependency graph based on service topology data and real-time indicator data, wherein the dynamic service dependency graph is a weighted directed graph structure; The anomaly detection module is configured to: trigger anomaly propagation path reasoning when anomalies in service node metrics or fluctuations in call edges exceed a threshold, and generate candidate anomaly propagation paths using a multimodal graph neural network model; The impact score calculation module is configured to: calculate the root cause impact score based on the candidate anomaly propagation path, combined with the indicator deviation of each service node, the preset SLA weight and the number of propagation hops; The root cause ranking module is configured to sort service nodes based on root cause impact scores to determine the priority of root cause services.

8. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the method described in any one of claims 1-6.

Images