Micro-service multi-mode anomaly detection method based on dynamic graph learning

Abstract

The invention provides a micro-service multi-mode anomaly detection method based on dynamic graph learning. The micro-service multi-mode anomaly detection method comprises the steps of collecting multi-mode observable data; preprocessing the multi-modal observable data, performing alignment and windowing processing to obtain data features of the multi-modal observable data, and performing entity binding processing on the data features according to association between the data features and physical examples bearing the data to obtain a node data table and an edge data table; constructing a plurality of graph snapshots arranged according to a time sequence by taking the time window as an index to form a graph snapshot sequence, and creating a time edge between adjacent graph snapshots to obtain a dynamic graph; when an interaction event occurs in the dynamic graph, generating a final node representation of each interaction event occurrence node participating in the interaction event; and obtaining an abnormal prediction probability of the node according to the final node representation so as to judge whether the node is abnormal or not. By applying the method, the detection accuracy can be improved, and abnormities caused by mode drift or slow performance degradation can be accurately identified.

Description

Technical Field

[0001] This invention relates to the field of microservice anomaly detection technology, and in particular to a microservice multimodal anomaly detection method based on dynamic graph learning. Background Technology

[0002] Microservice architecture, as a core pattern for building large-scale distributed applications in the cloud-native era, has been widely adopted. By decoupling complex monolithic applications into a set of independent, autonomous services, microservices significantly improve development agility and system scalability. However, this architecture also brings unprecedented operational challenges, especially in anomaly detection.

[0003] Current technologies commonly simplify dynamically evolving microservice systems into a series of discrete, independent static graph snapshots for analysis. This "slicing" approach, which solidifies service call relationships within a time window into a static adjacency matrix or graph structure and adds metrics for that time window as node characteristics, while capable of analyzing spatial topological relationships within a specific time window, fundamentally severs the continuity of time. It fails to observe the smooth evolution of system state and topology from one moment to the next. The dynamics of microservice systems (such as instance startup and shutdown, and changes in calls) are forcibly fixed within the window, losing their dynamic nature. When an anomaly is a continuously evolving process rather than a transient event, these static snapshot-based models cannot effectively detect it due to the lack of comprehensive process modeling.

[0004] Existing technologies for fusing multimodal data generally employ a shallow fusion strategy that performs feature concatenation before model input. This approach fails to learn and model the deep interaction relationships between different modalities, resulting in the neglect of complex anomaly patterns caused by the combined effects of multiple sources and weak signals, leading to the loss of key information and inaccurate system state representation.

[0005] Furthermore, in microservice systems, many critical system failures are not instantaneous, drastic events, but rather the result of long-term, slow evolution. The criterion for judging such anomalies is whether the current behavior pattern deviates from its long-term normal baseline. However, in existing technologies, the memory maintained by each service instance is usually limited by the length of the current analysis window, resulting in "amnesia" regarding the service's long-term historical behavior. This makes it impossible for the model to establish a stable historical behavior baseline; its understanding of the service's normal patterns is local and short-term, unable to distinguish between normal periodic fluctuations (such as daytime traffic peaks) and true anomalies caused by pattern drift. Consequently, it is difficult to accurately identify anomalies that require comparison with long-term historical context, ultimately leading to false positives or false negatives.

[0006] Therefore, it is necessary to provide a novel microservice anomaly detection method to solve the above problems. Summary of the Invention

[0007] The purpose of this invention is to provide a multimodal anomaly detection method based on dynamic graph learning, which constructs an anomaly detection method that can coherently track the state evolution of service instances and capture the complete propagation process of faults in the service call chain, so as to improve the accuracy of detection and reduce the false negative rate.

[0008] The microservice multimodal anomaly detection method based on dynamic graph learning provided by this invention includes: collecting multimodal observable data from the microservice system, including indicator data, call chain data, and log data; preprocessing the multimodal observable data, including alignment and windowing to obtain data features of indicator data, call chain data, and log data; performing entity binding processing on the data features according to the association between the data features and the physical instances carrying the data to obtain a node data table recording the state of physical instances and an edge data table recording the interactions between physical instances within each time window; and constructing multiple time-based nodes and edge data tables by filtering node data and edge data within the same time window using the time window as an index. A sequence of graph snapshots arranged in a specific order is formed. Time edges are created based on the same physical instance nodes between adjacent graph snapshots to obtain a dynamic graph of the microservice system behavior. A memory state vector is created for each node in the dynamic graph. When an interaction event occurs in the dynamic graph, the memory state vector of each node that participated in the interaction event is updated. The updated memory state vector of each node that participated in the interaction event is combined with the current fused feature vector to generate the final node representation. A nonlinear transformation is performed on the final node representation of each node in each time window to obtain the anomaly prediction probability. When the anomaly prediction probability is greater than a preset decision threshold, the physical instance corresponding to the node is judged as an anomaly in the corresponding time window.

[0009] The beneficial effects of the microservice multimodal anomaly detection method based on dynamic graph learning provided by this invention are as follows: By designing an event-driven and memory-update mechanism, it coherently tracks the state evolution of each service instance and captures the complete propagation process of faults along the service call chain. For slow-burning faults or complex cascading faults that require accumulated evidence for judgment, it can significantly improve detection accuracy and reduce false negative rate. Through a complex interactive network, it actively mines and learns the deep relationships between metrics, logs, and call chains, thereby generating feature representations that better reflect the true state of the system. At the same time, by maintaining a long-term evolving historical state vector for each service instance, a stable behavioral baseline can be established. This enables this invention not only to detect transient anomalies but also to accurately identify anomalies caused by pattern drift or slow performance degradation that are difficult to detect by traditional methods.

[0010] In one possible embodiment, the data features obtained through alignment and windowing processing include: defining a common time window; grouping the indicator data, call chain data, and log data according to the duration of the common time window; applying multiple aggregation functions to the grouped indicator data to obtain multi-dimensional statistical features and thus indicator feature vectors; performing structured processing on the grouped log sets to extract log templates, and vectorizing the log sets according to a pre-built globally ordered dictionary to obtain log template count vectors; and performing statistics on the grouped call chain data to generate feature values ​​describing node and edge features.

[0011] In another possible embodiment, when collecting metric data and log data, the metadata tags of the physical instances carrying the corresponding data are attached to the data, and the log data carries the tracing identifiers generated by the microservice system for external requests; the entity binding processing of data features includes: aggregating data features related to the same physical instance within each time window based on the association between the metadata tags of the physical instance and the metric data and log data, and the association between the tracing identifiers carried in the log data and the call chain data; constructing a node data table based on the status of each physical instance within each time window, and constructing an edge data table based on the interactions between physical instances within each time window.

[0012] In other possible embodiments, the construction of the graph snapshot sequence includes: filtering the node data table and the edge data table to obtain node data and edge data within the same time window; creating nodes in the graph snapshot based on the filtered node data; constructing directed edges of the graph snapshot based on the filtered edge data; and obtaining the graph snapshot for the corresponding time window; using the time window as an index, performing data filtering and creating graph snapshots for each time window to generate a sequence of multiple graph snapshots arranged in chronological order.

[0013] Updating the memory state vector of each interactive event node involves: collecting the memory state vectors of all neighboring nodes of the interactive event node in the previous time window and the fusion feature vector of the current time window; aggregating the collected neighboring node information to obtain aggregated information; and sending the aggregated information to the gate control loop unit to update the memory state vector of the interactive event node.

[0014] The generation of aggregated information includes: fusing the absolute time difference, relative time interval, and local time jitter between interaction events to obtain time codes; and using a graph attention mechanism to weighted aggregate the collected neighbor node information and time codes to generate aggregated information. The generation of aggregated information satisfies the following formula: ,in, Indicates within the time window For nodes The aggregated information This represents the graph attention function. Representing neighboring nodes In the previous time window The memory state vector, Representing neighboring nodes In the current time window The fused feature vector, Represents a node and Time encoding of interactions between them Indicates traversing nodes All neighboring nodes .

[0015] The entire dataset is divided into training sets according to time sequence, and anomaly labels are added to the training sets. The entire dataset includes node data tables and edge data tables corresponding to all time windows. On the training set, feature subsets are selected based on the mutual information scores between data features and anomaly labels. When calculating the fused feature vector of a node, a dense vector representation of the node's categorical features is generated based on the feature subsets. The dense vector representation of the node and the numerical features are interacted through explicit and implicit interaction networks, and the outputs of the two interaction networks are concatenated to generate the fused feature vector.

[0016] An encoder-decoder structure is set up; categorical features are extracted from the preprocessed multimodal observable data, and the extracted categorical features are mapped to initial feature vectors; the encoder is applied to perform nonlinear compression on the initial feature vectors to generate dense vector representations reflecting categorical attributes; the decoder is applied to restore the original categorical feature information from the dense vector representations generated by the encoder; a self-supervised learning mode is used to optimize and train the encoder-decoder structure by minimizing the reconstruction error between the initial feature vectors and the reconstructed categorical feature information; when calculating the fused feature vector of a node, the optimized encoder is used to generate a dense vector representation of the node's categorical features.

[0017] The explicit interaction between the dense vector representation of a node and its numerical features includes: performing a bitwise vector product operation on the dense vector representation of the node and its numerical features to generate an explicit interaction vector; the implicit interaction between the dense vector representation of a node and its numerical features includes: concatenating the dense vector representation of the node and its numerical features and inputting the concatenation into a multilayer perceptron to generate an implicit feature vector.

[0018] Candidate thresholds are selected with a fixed step size within the output probability interval; the anomaly prediction results are obtained by comparing different candidate thresholds with the anomaly prediction probability on the validation set, and the prediction results under different candidate thresholds are compared with the true labels; the change curves of key performance indicators are calculated and analyzed to select the optimal threshold that maximizes detection efficiency as the decision threshold. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating a microservice multimodal anomaly detection method based on dynamic graph learning, provided in an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the process for generating the final node representation based on a dynamic graph, provided in an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0023] This embodiment provides a microservice multimodal anomaly detection method based on dynamic graph learning. See the appendix of the specification. Figure 1 The method includes:

[0024] S101: Collect multimodal observable data from the microservice system. Multimodal observable data includes metric data, call chain data, and log data.

[0025] In one possible implementation, the acquisition of the raw data stream of multimodal observables relies on mature open-source tools and technology stacks in the industry.

[0026] In one specific implementation, metric data is collected through the Prometheus monitoring system, and system-level metrics for host nodes are obtained by deploying plugins such as Node-Exporter, or container-level metrics on the Kubernetes platform are obtained through Metric-Server. Call chain data is captured by integrating open-source distributed tracing systems such as Jaeger or Apache SkyWalking, performing code-level instrumentation on microservice applications, or using their proxies for non-intrusive tracing to capture complete call chain data. Log data collection is typically achieved by deploying a log collection agent (such as the widely used Fluentd or Logstash) on each node of the Kubernetes cluster. The collection agent is responsible for automatically discovering and collecting logs generated by all containers on the node and forwarding them to a unified storage backend.

[0027] In one possible embodiment, in an environment using a service mesh such as Istio, the telemetry capabilities of the service mesh can be directly utilized to capture metrics and call relationships of inter-service communication in a non-intrusive manner, simplifying the deployment and maintenance costs of data collection.

[0028] S102: Multimodal observable data is preprocessed, including alignment and windowing to obtain data features of indicator data, call chain data and log data. Based on the association between data features and the physical instances carrying the data, entity binding processing is performed on the data features to obtain a node data table that records the status of physical instances within each time window and an edge data table that records the interactions between physical instances.

[0029] After acquiring the raw, heterogeneous multimodal observable data stream, preprocessing is performed to ensure that data from diverse sources and formats can be processed uniformly, preparing for subsequent dynamic graph construction. The preprocessing of multimodal observable data includes two steps: alignment and windowing, and entity binding.

[0030] In one possible embodiment, the data features obtained through alignment and windowing processing include: defining a common time window; grouping the indicator data, call chain data, and log data according to the duration of the common time window; applying multiple aggregation functions to the grouped indicator data to obtain multi-dimensional statistical features and thus indicator feature vectors; performing structured processing on the grouped log sets to extract log templates, and vectorizing the log sets according to a pre-built globally ordered dictionary to obtain log template count vectors; and performing statistics on the grouped call chain data to generate feature values ​​describing node and edge features.

[0031] In one possible embodiment, when collecting metric data and log data, metadata tags of the physical instances carrying the corresponding data are attached to the data, and the log data carries trace identifiers generated by the microservice system for external requests. Entity binding processing of data features includes: aggregating data features related to the same physical instance within each time window based on the association between the metadata tags of the physical instance and the metric data and log data, and the association between the trace identifiers carried in the log data and the call chain data; constructing a node data table based on the state of each physical instance within each time window, and constructing an edge data table based on the interactions between physical instances within each time window.

[0032] The purpose of alignment and windowing is to transform and synchronize heterogeneous data streams with different timestamps onto a unified time window sequence. In a specific embodiment, the alignment and windowing process includes: first, defining a fixed-length, non-overlapping common time window as the smallest unit for data alignment. The size of the common time window is an important hyperparameter, determining the granularity and sensitivity of anomaly detection. Then, based on the length of the common time window, windowing is performed on the indicator data, call chain data, and log data respectively.

[0033] Specifically, the metric data is a high-frequency numerical time series (e.g., Prometheus collects data every 15 seconds). To align it with a common time window, all raw data points falling within the same time window need to be aggregated to generate statistical features that represent the state of that time window. The specific process for windowing the metric data is as follows: Raw metric data points with timestamps within the same time window are filtered out to group the metric data. Various aggregation functions are applied to the grouped data points to perform aggregation calculations, characterizing the metric data's performance within the time window from different dimensions. After aggregation calculations, each metric is transformed from a series of raw values ​​within the time window into a feature vector containing multiple statistical features. The statistical features obtained after aggregation calculations include the mean (reflecting the average level of the metric), standard deviation (measuring the metric's fluctuation or stability), maximum / minimum value (capturing peaks and troughs, crucial for detecting spikes or sudden drops), and percentiles (especially important for performance metrics such as latency, used to reflect the performance of long-tail requests). For example, after applying various aggregation functions to the CPU utilization metric, the resulting feature vector is: {cpu_util_mean, cpu_util_stddev, cpu_util_max, cpu_util_p99}, where cpu_util_mean represents the mean CPU utilization, cpu_util_stddev represents the standard deviation of CPU utilization, cpu_util_max represents the maximum CPU utilization, and cpu_util_p99 represents the percentile of CPU utilization.

[0034] Log data consists of discrete, unstructured text events. Windowing this data involves vectorizing it, converting multiple log entries generated within a time window into a fixed-dimensional numerical vector. The specific process for windowing log data is as follows: Collect all raw logs falling within the same time window to group the log data. Use log parsing algorithms to structure each raw log entry, extracting the log template (static text) and log parameters (dynamically changing parts). Vectorize the log set containing all known log templates, built based on cosine similarity. This results in a log template counting vector that strictly corresponds to the order of the global ordered dictionary. The dimension of this log template counting vector is equal to the size of the global ordered dictionary, and the value of each dimension represents the number of times the corresponding log template appears in the log set. For example, if the order of the interval ordered dictionary is [template_A, template_B, template_error_C], and template A appears 5 times and template C appears 2 times in the log set, then the corresponding log vector would be [5, 0, 2].

[0035] In one possible embodiment, the log template count vector is typically highly sparse (i.e., most values ​​are 0) because only a few log templates appear within a time window. For efficient storage and readability, this invention employs a sparse key-value pair representation format in the node data table, recording only templates that appear more than zero times, such as {"error-A":5,"info-B":100}.

[0036] Call chain data is essentially structured data describing interactions between services. Windowing aims to aggregate all interactions occurring within a single time period to summarize the topological interaction characteristics of the system during that period. The specific process for windowing call chain data is as follows: First, filter out all call chain data whose start timestamps fall within the same time window. Then, perform statistical analysis on the grouped call chain data to generate numerical values ​​that describe the characteristics of nodes (service instances) and edges (call relationships) within the time window. Node feature aggregation includes calculating the request inflow / outflow (total number of requests received and sent by the service instance) and average processing time (the average time the service instance itself spends processing requests, i.e., the average duration of the span) for each node (service instance) within the time window. Edge feature aggregation includes calculating the number of calls, errors, and latency for each edge within the time window. For example, if an edge represents a call from service A to service B, the total number of calls from A to B within the time window is the call count, the number of failed calls is the error count, and the average latency and p99 latency are the latency statistics.

[0037] By performing the alignment and windowing operations on the indicator data, log data, and call chain data described above, the three originally heterogeneous and asynchronous data sources can be successfully converted and synchronized onto a unified time window sequence, laying the foundation for subsequent analysis and modeling.

[0038] In dynamic cloud-native environments, the IP address, hostname, and other identifiers of a service instance (such as a Kubernetes Pod) change dynamically, and instances are transient and their identities are volatile. Identifiers from different data sources in multimodal observables are also heterogeneous: service instances may be frequently destroyed and recreated, and each new instance will acquire a unique, usually randomly generated name and a dynamically assigned IP address; different observable data sources use different identifiers. For example, monitoring systems like Prometheus may use IP addresses to capture metrics; log messages may record hostnames or Pod names; and spans in distributed tracing systems are usually associated with logical service names. These characteristics of service instances and identifiers in dynamic cloud-native environments make it difficult to accurately correlate service instances with their associated multimodal observables.

[0039] This invention designs a mechanism that uses a distributed tracing system to assign a globally unique tracing identifier to requests entering a microservice system and to inject metadata tags into each service instance. By combining these mechanisms, a unique and standardized instance identifier is constructed for each service instance, and the metrics, logs, and call chain information belonging to that instance are accurately associated, thereby solving the problem of physical instance identification.

[0040] In one specific embodiment, entity binding processing of data features includes:

[0041] When an external request first enters the microservice system, a globally unique tracing identifier is generated for that request through a distributed tracing system. This tracing identifier is injected as context information into the request header and passed between services. When the logging framework is configured, it can automatically read the tracing identifier from the context of the current request and print it as metadata to every relevant log message. Thus, this invention carries the tracing identifier generated for external requests in the log data collected from the microservice system. In this way, log data can be accurately associated with the call chain through its carried tracing identifier. For example, a log entry with the content "database connection failed" can be accurately associated with the complete call chain of the specific user request that caused this failure through its carried tracing identifier.

[0042] The design involves attaching a set of metadata tags to each physical instance. When metrics are scraped from a physical instance, the physical instance's metadata tags are appended to the collected metrics. When collecting logs, the metadata of the physical instance that generated the log is appended to the collected log data. In this way, metric data, log data, and call chain data can all be uniformly tagged with the physical instance's metadata tags, enabling the binding of multimodal observable data with the physical instances hosting them and their respective logical services. For example, the process of injecting metadata tags and associating information between physical instances and multimodal observable data in a Kubernetes environment is as follows: The Kubernetes platform automatically appends a rich set of metadata tags to each physical instance (Pod) it manages, such as pod_name, service_name, namespace, etc. The monitoring system (such as Prometheus) uses Kubernetes' Service Discovery mechanism, rather than relying on a static list of IP addresses, to dynamically query the Kubernetes API to obtain a list of Pods matching specific tags and their IP addresses. When Prometheus scrapes metrics from a Pod, it automatically appends all the metadata tags of that Pod to the collected metrics. Log collection agents deployed on nodes can also interact with the Kubernetes API, attaching metadata tags of the pod that generated the log to the collected logs. Metadata tags for multimodal observables can be formatted as {service="auth", pod="auth-deployment-5f7b8c9d6-xyz123"}.

[0043] Entity binding ultimately constructs a globally unique, normalized instance ID for each physical instance. In this invention, the instance ID typically adopts the format service-name@pod-name. The instance ID will serve as the primary key for subsequent data table construction, ensuring that all relevant multimodal observables of a physical instance are correctly aggregated within a given time window.

[0044] After the alignment, windowing, and entity binding processes described above, the collected raw multimodal observable data can be transformed into two core structured data tables as direct inputs for constructing the dynamic graph. The constructed structured data tables are a node data table and an edge data table. The node data table records the state of each physical instance within each time window, and its structure is shown in Table 1.

[0045] Table 1 Node Data Table

[0046]

[0047] The edge data table records the interactions (i.e., service calls) between physical instances within each time window, and its structure is shown in Table 2:

[0048] Table 2 Edge Data Table

[0049]

[0050] S103: Using time windows as an index, filter node and edge data within the same time window to construct multiple graph snapshots arranged in chronological order to form a graph snapshot sequence. Create time edges based on the same physical instance nodes between adjacent graph snapshots to obtain a dynamic graph of microservice system behavior.

[0051] In one possible embodiment, the construction of the graph snapshot sequence includes: filtering the node data table and the edge data table to obtain node data and edge data within the same time window; creating nodes in the graph snapshot based on the filtered node data; constructing directed edges of the graph snapshot based on the filtered edge data; and obtaining the graph snapshot for the corresponding time window; using the time window as an index, performing data filtering and creating graph snapshots for each time window to generate a sequence of multiple graph snapshots arranged in chronological order.

[0052] The behavior of a microservice system over a period of time can be defined as a dynamic graph, which is a sequence of graph snapshots arranged in time: , where each image snapshot Representing the microservice system within a time window The complete state, containing the set of nodes for that time window. Sum of edges The construction of a graph snapshot is a process of translating preprocessed tabular data into graph-structured data. For each unique time window... Construct corresponding graph snapshots using node data tables and edge data tables. In a series of independent graph snapshots, if two adjacent graph snapshots contain nodes representing the same physical instance, a directed temporal edge is created between the adjacent graph snapshots based on the nodes. The dynamic graph structure described above contains two types of relationships. The structure of the dynamic graph can completely preserve the spatiotemporal dynamic information of the microservice system, and can simultaneously reflect the real-time interaction between physical instances (spatial dimension) and the evolution of the state of each physical instance over time (temporal dimension), providing a structured foundation for subsequent spatiotemporal feature learning.

[0053] In one specific embodiment, the specific process of constructing a dynamic graph includes: using a time window As an index, the node data table and edge data table are filtered to obtain the data containing time windows. Two subsets of data from all records are selected, and the resulting subsets contain the data needed to construct the corresponding graph snapshot. All the necessary information.

[0054] Create nodes based on the filtered subset of node data: Iterate through the filtered subset of node data, where each piece of information in the subset corresponds to a snapshot of the graph. A node is a record in a system where its unique identifier comes from the `node_id` field in the corresponding record information. The node's characteristics (i.e., the state of the physical instance within that time window) are composed of other data fields recorded in the information. For example, the value of the `cpu_util_mean` field and the key-value pair of the `log_template_counts` field (such as `{"error-A":5,"info-B":100}`) are appended to the newly created node as part of its initial feature vector.

[0055] After the nodes are created, spatial edges are created based on the filtered subset of edge data: traversing the filtered subset of edge data, each piece of information in the subset corresponds to a graph snapshot. A directed edge in the context represents a service call. The starting node of the edge is specified by the src_node_id field recorded in the information, the target node of the edge is specified by the dst_node_id field recorded in the information, and the characteristics of the edge (i.e., the attributes of this call) are composed of other data fields recorded in the information, such as protocol, method, and call_count.

[0056] Once the nodes and edges are created, all call and interaction relationships between the nodes are added to the graph snapshot. In the middle, a complete process was completed, including a specific time window. A snapshot of the graph of all physical instances and their interactions. The construction of graph snapshots. This graph snapshot construction process is repeated for each time window in the node dataset and edge dataset, thereby generating a series of graph snapshots. }

[0057] After obtaining a series of independent graph snapshots, the time series is traversed, and for any two adjacent graph snapshots... and Iterate through each node in the graph snapshot. If nodes represent the same physical instance, that is, the graph snapshot... Nodes in and exists in the next snapshot The middle is recorded as If the nodes have the same node_id, a directed time edge is created between the two nodes. , ).

[0058] S104: Create a memory state vector for each node in the dynamic graph. When an interaction event occurs in the dynamic graph, update the memory state vector of each node that participated in the interaction event. Combine the updated memory state vector of each node with the current fused feature vector to generate the final node representation.

[0059] After obtaining a dynamic graph that can completely preserve the spatiotemporal dynamic information of the microservice system, high-quality initial feature vectors are created for the nodes in the dynamic graph. The spatiotemporal evolution patterns of the nodes on the dynamic graph are learned to generate the final node representation containing spatiotemporal context information.

[0060] For details, please refer to the instruction manual appendix. Figure 2 First, a high-quality initial feature vector is created for each node in the dynamic graph. This feature vector needs to effectively fuse data features extracted from metric data, log data, and call chain data. The resulting initial feature vector is the node's fused feature vector. Then, the spatiotemporal evolution pattern of nodes in the dynamic graph is learned: a memory state vector is maintained for each node in the dynamic graph. The memory state vector summarizes the node's historical information. When an interaction event occurs in the dynamic graph, the final node representation containing spatiotemporal context information is generated based on the memory state vector and the fused feature vector.

[0061] In one possible embodiment, the entire dataset is partitioned chronologically to obtain a training set, and anomaly labels are added to the training set. The entire dataset includes node and edge data tables corresponding to all time windows. On the training set, a feature subset is selected based on the mutual information score between data features and anomaly labels. When calculating the fused feature vector of a node, a dense vector representation of the node's categorical features is generated based on the feature subset. This dense vector representation and the numerical features are then interacted with through explicit and implicit interaction networks, and the outputs of the two interaction networks are concatenated to generate the fused feature vector. .

[0062] An encoder-decoder structure is set up; categorical features are extracted from the preprocessed multimodal observable data, and the extracted categorical features are mapped to initial feature vectors; the encoder is applied to perform nonlinear compression on the initial feature vectors to generate dense vector representations reflecting categorical attributes; the decoder is applied to restore the original categorical feature information from the dense vector representations generated by the encoder; a self-supervised learning mode is used to optimize and train the encoder-decoder structure by minimizing the reconstruction error between the initial feature vectors and the reconstructed categorical feature information; when calculating the fused feature vector of a node, the optimized encoder is used to generate a dense vector representation of the node's categorical features.

[0063] The explicit interaction between the dense vector representation of a node and its numerical features includes: performing a bitwise vector product operation on the dense vector representation of the node and its numerical features to generate an explicit interaction vector; the implicit interaction between the dense vector representation of a node and its numerical features includes: concatenating the dense vector representation of the node and its numerical features and inputting the concatenation into a multilayer perceptron to generate an implicit feature vector.

[0064] In one possible embodiment, updating the memory state vector of each interactive event occurrence node involved in the interactive event includes: collecting the memory state vectors of all neighboring nodes of the interactive event occurrence node in the previous time window and the fused feature vector of the current time window, aggregating the collected neighboring node information to obtain aggregated information; and sending the aggregated information to the gate control loop unit to update the memory state vector of the interactive event occurrence node.

[0065] The generation of aggregated information includes: fusing the absolute time difference, relative time interval, and local time jitter between interaction events to obtain time codes; and using a graph attention mechanism to weighted aggregate the collected neighbor node information and time codes to generate aggregated information. The generation of aggregated information satisfies the following formula: ,in, Indicates within the time window For nodes The aggregated information This represents the graph attention function. Representing neighboring nodes In the previous time window The memory state vector, Representing neighboring nodes In the current time window The fused feature vector, Represents a node and Time encoding of interactions between them Indicates traversing nodes All neighboring nodes .

[0066] In one specific embodiment, the entire dataset is first divided into a training set, a validation set, and a test set. The entire dataset refers to the data obtained after data preprocessing, specifically including the node data tables and edge data tables corresponding to all time windows; the division of the training set, validation set, and test set is based on chronological order. For example, the data from the first 70% of the time window can be divided into the training set, the data from the middle 15% of the time window into the validation set, and the data from the last 15% of the time window into the test set.

[0067] Then, the data features of the nodes are fused on the training set to generate a fused feature vector. To reduce noise and improve efficiency, feature selection is performed first, and then feature fusion is performed on each node according to the selected feature types. The specific process for generating the fused feature vector is as follows:

[0068] The features extracted from the original multimodal observable data after data preprocessing are used as candidate features. These include multi-dimensional statistical features of aggregated indicator data, such as feature vectors for mean, standard deviation, maximum value, and percentiles; log template count vectors of log data after structured parsing and vectorization; node features of the call chain data, including statistical values ​​such as request inflow / outflow and average processing time; and edge features, including interaction feature values ​​such as call count, error count, and latency statistics. All candidate features are traversed, and the mutual information score between each candidate feature and the anomaly label is calculated using the training set data. The anomaly label information comes from manually annotated fault records based on historical data, alarm records from monitoring systems, or fault information manually injected in a controlled experimental environment. The formal definition of mutual information is: ,in, Represents random variables (Original characteristics) and Mutual information between (abnormal labels) is used to measure the non-linear statistical dependency between them; Represents the mathematical expectation; Represents random variables Values and Values The joint probability at time; Represents random variables Values The marginal probability; Represents random variables Values The marginal probability. Specifically, the above formal definition formula is the general theoretical definition of mutual information. To improve accuracy during calculation, the calculation is performed differently depending on the feature type: for categorical features, such as log templates, the formal definition formula is transformed into an empirical mutual information formula based on frequency statistics, i.e., a weighted summation of all possible value combinations; for continuous features, such as CPU utilization metrics, since the values ​​are continuous, frequency statistics cannot be directly performed. In this case, a KSG estimator is used to directly calculate the mutual information score through non-parametric K-nearest neighbor distance estimation, avoiding information loss caused by the discretization of continuous data. After calculating the mutual information scores of all candidate features, they are sorted in descending order according to the mutual information scores, and then the K highest-ranking features are selected to form a feature subset according to the pre-set hyperparameter K. It should be noted that once the feature subset is selected, it is fixed and will be used for model training, validation, and testing; it will not be reselected or adjusted on the validation or test sets.

[0069] For the feature subset, a three-stage deep fusion process is employed to mine the complex interactions between numerical features (from metrics) and categorical features (from logs and call chains) of nodes. The deep feature fusion process involves: setting up an encoder-decoder structure; learning dense vector representations of categorical features through the encoder-decoder structure; then, deeply interacting the dense vector representations with the original numerical features through parallel explicit and implicit interaction networks to fully exploit the nonlinear correlations; finally, concatenating the outputs of the interaction networks and generating a fused feature vector through a multilayer perceptron. The encoder-decoder structure requires prior optimization training, using the optimized encoder to generate dense vector representations of categorical features. The optimization training process of the encoder-decoder structure is as follows: 1. Input information extraction: Directly extracting categorical features of each physical instance within the current time window from the structured data generated after data preprocessing, such as log template ID and service call type. 2. Embedding mapping: Mapping discrete category IDs to a low-dimensional continuous vector space through an embedding layer, transforming non-numerical category information into computable initial feature vectors. 3. Encoding and compression. The encoder uses a multi-layer neural network to non-linearly compress the initial feature vector, extracting its core semantic features and generating a dense vector representation reflecting the category attribute. 4. Reconstruction and Decoding. The decoder attempts to recover the original category feature information from the dense vector in the latent space to verify the effectiveness of feature extraction. 5. Objective Function Optimization. A self-supervised learning model is adopted, training the entire encoder-decoder network by minimizing the reconstruction error between the original input and the reconstructed output. Explicit interaction refers to simulating the relationship between features through explicit mathematical operations (such as vector multiplication or feature crossing). Its calculation formula directly defines how features are combined pairwise, with a clear structure and easy capture of low-order feature crossing relationships. Explicit interaction methods typically use a structure similar to a Cross Network, performing bitwise vector product operations on numerical features and dense vectors. Implicit interaction refers to automatically learning complex relationships between features through deep neural networks, with the interaction process hidden in the weighted calculation of neurons. Implicit interaction methods directly concatenate numerical features and dense vector representations and input them into a multi-layer perceptron. Implicit interactions, through nonlinear activation functions, can implicitly uncover high-order nonlinear correlations that are difficult to understand intuitively, capturing complex patterns caused by the combined effects of multiple weak signals. An explicit interaction network generates one feature vector, and an implicit interaction network generates another. These two output vectors are concatenated and then fed into a multilayer perceptron for dimensionality reduction or transformation to obtain the final fused feature vector. This fused feature vector contains the instantaneous state of numerical indicators, condensed log semantics, and the implicit state resulting from the deep interaction between the two (e.g., a correlation between the frequency of specific log occurrences and CPU fluctuations).

[0070] In one specific embodiment, after obtaining the fused feature vector of each node, a Temporal Graph Network (TGN) is used to learn the spatiotemporal evolution pattern of the nodes on the dynamic graph. The generation process of the final node representation containing spatiotemporal context information includes: for each node in the dynamic graph... They all maintain a memory state vector Before starting to process time series data (i.e.) (Time), refers to all nodes appearing in the graph. Its memory state vector All are set to zero. The memory state vector is updated when an interactive event occurs in the dynamic graph.

[0071] To capture the temporal dynamics between events more precisely, an enhanced time coding mechanism is designed. This mechanism considers the absolute time difference between events, calculates the normalized relative time interval and local time jitter, and then concatenates the absolute time difference, relative time interval, and local time jitter into a comprehensive feature vector. This comprehensive feature vector is then fused using a multilayer perceptron to obtain the time code. The absolute time difference between events... Calculated based on the raw timestamps of interaction events in the microservice system, primarily derived from call chain data collected by the distributed tracing system. This data meticulously records the precise moment each span occurs. The absolute time difference between events specifically refers to the current span in the interaction sequence. The timestamp of the first event and the first The absolute difference between the timestamps of each event. Although the system as a whole uses time windows for data normalization during the preprocessing stage, after entering the spatiotemporal evolution mode of the TGN dynamic representation learning node, each interaction within the window is restored as a discrete time-series event for processing. The absolute time difference captures the distribution characteristics of the event stream in the time dimension (such as frequency and timing jitter). By calculating indicators such as local time jitter, the model can identify time-sensitive faults such as abnormal fluctuations in request frequency. The calculation of the normalized relative time interval satisfies the following formula: The normalized local time jitter calculation satisfies the following formula: ;in, Indicates the first Normalized relative time intervals for each event; Indicates the first Local time jitter of an event; Indicates the first The absolute time difference between the events; Indicates the previous (the first) The absolute time difference of each event; and These represent the maximum and minimum time differences of all events within a dataset or a window, respectively. It is a very small positive number, used to prevent the denominator from being zero. The comprehensive feature vector of the events is: The final result was the first The time code for each event is: .

[0072] TGN uses an event-driven approach to update node states. When an interaction event occurs, all nodes involved in that event need to update their state. The edge data table generated during the preprocessing phase identifies all node pairs that interacted within the current time window. These physical instances that participated in the service call are the relevant nodes that require state updates.

[0073] For a node that needs to update its state It will come from its neighboring nodes. Information is collected and weighted through a graph attention mechanism to generate aggregated information. : ,in, Indicates within the time window For nodes Aggregated information; Representation graph attention mechanism weighted aggregation algorithm; Representing neighboring nodes In the previous time window The memory state vector; Representing neighboring nodes In the current time window fused feature vectors; Represents a node and Time encoding of interactions between them; Indicates traversing nodes All neighboring nodes Time window The determination is based on the image snapshot sequence number after alignment and windowing processing, that is, any [image snapshot number] in the [image snapshot sequence number]. The timing position of interactive events occurring within a time window during processing is: .

[0074] Aggregated information The data is fed into a Gated Recurrent Unit (GRU) to update the node's own memory state vector. The GRU selectively retains past information and incorporates new event data, effectively capturing temporal evolution. The memory state vector update satisfies the following formula: ,in, Represents a node In the time window Updated memory state vector; Represents a node In the previous time window The memory state vector.

[0075] Update the memory state vector of the nodes (Representing its long-term history) and the current fused feature vector (Representing its immediate state) are combined and a final node representation is generated through a multilayer perceptron. : , Represents a node In the time window The final node representation.

[0076] The generated final node representation contains spatiotemporal context information, which serves as input for subsequent anomaly detection and classification.

[0077] S105: Perform a nonlinear transformation on the final node representation of each node in each time window to obtain the anomaly prediction probability. When the anomaly prediction probability is greater than the preset decision threshold, the physical instance corresponding to the node is judged as an anomaly in the corresponding time window.

[0078] This invention employs a standard multilayer perceptron network model to process the final node representations to obtain anomaly prediction probabilities. The input to this multilayer perceptron network model is each node. In each time window The generated final node representation The multilayer perceptron (MLP) linearly projects the input vector using the weight matrix and bias terms in its hidden layers, and performs layer-by-layer transformations using nonlinear activation functions (such as ReLU) to learn a nonlinear decision boundary in the feature space that distinguishes normal behavior from complex abnormal patterns. The output layer of the MLP uses a sigmoid activation function, which compresses the network's output value to the (0,1) interval. This output value can be directly interpreted as the predicted probability that the node is abnormal at that moment, denoted as . An output value close to 1 indicates that the model determines the instance to be highly likely to be abnormal, while an output value close to 0 indicates that the model determines the instance to be highly likely to be normal.

[0079] The multilayer perceptron network model is trained and can then be used for online or offline anomaly detection. The direct output of the model is an anomaly prediction probability between 0 and 1. To obtain a clear binary classification result (i.e., "normal" or "abnormal"), the anomaly prediction probability needs to be compared with a pre-set decision threshold θ. If the prediction probability... If the value is greater than θ, then the instance is considered abnormal at that moment. Otherwise, it is judged as normal. ).

[0080] In one possible embodiment, the selection of the decision threshold includes: selecting candidate thresholds within the output probability interval with a fixed step size; testing on the validation set by comparing different candidate thresholds with the anomaly prediction probability to obtain anomaly prediction results, comparing the prediction results under different candidate thresholds with the true label; calculating and analyzing the change curves of key performance indicators to select the optimal threshold that maximizes detection efficiency as the decision threshold.

[0081] In one specific embodiment, the present invention divides the entire data set into a training set, a validation set, and a test set. The training set is used to train the multilayer perceptron network model, the validation set is used to conduct experiments to determine the decision threshold, and the decision threshold determined by the validation set is fixed for use in judging the test set.

[0082] Specifically, the process of determining the decision threshold is as follows: within the (0,1) probability interval of the model output, select values ​​as candidate thresholds with a fixed step size, test a series of different thresholds on the validation set, compare the prediction results under different thresholds with the true labels, calculate and analyze the change curves of key performance indicators (such as F1-score), and select the threshold that enables the key performance indicators to reach the optimal level as the decision threshold.

[0083] In one specific embodiment, since the number of normal samples far exceeds the number of abnormal samples in real data, if a standard loss function is used for training, the model will tend to predict all samples as the majority class (normal), thus ignoring the few abnormal samples and causing the detection model to fail. To solve this problem, this invention designs a weighted cross-entropy loss function that combines FocalLoss and L2 regularization. We will then train a multilayer perceptron network model. The formal definition of the loss function satisfies the following formula: ,in, This represents the final loss function that the entire model needs to minimize. The model training process involves adjusting the parameters to make this function as small as possible. The Focal Loss term is the main part of the loss function; it adds a modulation factor to each term in addition to the standard cross-entropy loss. The modulation factor's role is to significantly reduce its contribution to the total loss for samples that the model can easily and accurately classify (e.g., a normal sample with a predicted probability close to 0). Conversely, its contribution is relatively increased for the few outlier samples that the model struggles to classify. This forces the model to focus more on learning how to identify these difficult outlier samples during training. The outer layer... This represents iterating through all time windows (from 1 to T), inner layer Represents the current time window Iterate through all microservice instance nodes within the scope. It is a parameter used to balance the weights of positive and negative samples. It is a focusing parameter that adjusts the weights of easy and difficult samples. This is represented as the real label, if the node In time If it is indeed abnormal, then If it is normal, then . It is an L2 regularization term that penalizes the sum of squares of all weight parameters Θ of the model to prevent the model weights from becoming too large, thereby avoiding overfitting on the training data and enhancing its generalization ability on unknown data.

[0084] This invention provides a microservice multimodal anomaly detection method based on dynamic graph learning, which abandons the traditional paradigm of treating the system as a discrete static snapshot and instead views it as a continuously evolving event stream. It applies Time Graph Learning (TGN) to capture the entire spatiotemporal propagation process of anomalies. TGN maintains a continuously updated memory state vector for each node in the dynamic graph, enabling it to capture long-term historical behavioral patterns. This continuously updated node-level memory is used to accurately detect slowly changing or behaviorally drifting anomalies that require long-term historical context for judgment. An enhanced time coding mechanism combining absolute intervals, relative intervals, and local jitter is designed. It not only uses the absolute time difference between events but also introduces the dimensions of relativity and jitter to more finely characterize the dynamics of the event stream. This multi-dimensional time coding method provides the TGN model with richer temporal context information, thereby improving the detection capability of time-sensitive anomalies.

[0085] By using encoding-reconstruction and parallel explicit / implicit interaction networks, the non-linear interaction relationship between numerical features (from metrics) and categorical features (from logs and call chains) is deeply explored. This unique feature fusion architecture solves the problem of information loss that easily occurs when feature splicing in existing technologies.

[0086] The microservice multimodal anomaly detection method based on dynamic graph learning (TGN) of this invention does not view each time window in isolation. Instead, it coherently tracks the state evolution of each service instance through the event-driven and memory update mechanism of TGN, capturing the complete propagation process of faults along the service call chain. Therefore, it can significantly improve the detection accuracy and reduce the false negative rate for slow-burning faults or complex cascading faults that require accumulated evidence for judgment. Through a complex interactive network, it actively mines and learns the deep relationships between metrics, logs, and call chains, thereby generating feature representations that better reflect the true state of the system. At the same time, the memory module of TGN maintains a long-term evolving historical state vector for each service instance, which can establish a stable behavioral baseline. This enables this invention not only to detect transient anomalies but also to accurately identify anomalies caused by pattern drift or slow performance degradation that are difficult to detect by traditional methods.

[0087] In other embodiments of this application, an electronic device is disclosed, such as... Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the steps in the corresponding embodiments.

[0088] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0089] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0090] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0091] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A microservice multimodal anomaly detection method based on dynamic graph learning, characterized in that, include: Multimodal observable data is collected from the microservice system, including metric data, call chain data, and log data. The multimodal observable data is preprocessed, including alignment and windowing to obtain data features of indicator data, call chain data and log data. Based on the association between the data features and the physical instances carrying the data, entity binding processing is performed on the data features to obtain a node data table that records the state of physical instances and an edge data table that records the interactions between physical instances within each time window. By using time windows as an index to filter node and edge data within the same time window, multiple graph snapshots arranged in chronological order are constructed to form a graph snapshot sequence. Time edges are created based on the same physical instance nodes between adjacent graph snapshots to obtain a dynamic graph of microservice system behavior. A memory state vector is created for each node in the dynamic graph. When an interaction event occurs in the dynamic graph, the memory state vector of each node that participated in the interaction event is updated. The updated memory state vector of each node that participated in the interaction event is combined with the current fusion feature vector to generate the final node representation. For each node, a nonlinear transformation is performed on the final node representation in each time window to obtain the anomaly prediction probability. When the anomaly prediction probability is greater than the preset decision threshold, the physical instance corresponding to the node is judged as an anomaly in the corresponding time window.

2. The method according to claim 1, characterized in that, Data features obtained through alignment and windowing include: Define a common time window; The indicator data, call chain data, and log data are grouped according to the length of the common time window. By applying various aggregation functions to the grouped indicator data, multi-dimensional statistical features are obtained, resulting in indicator feature vectors. The log sets obtained by grouping are structured to extract log templates, and the log sets are vectorized according to a pre-built global ordered dictionary to obtain log template counting vectors; The grouped call chain data is statistically analyzed to generate feature values ​​that describe node and edge characteristics.

3. The method according to claim 1, characterized in that, When collecting metric data and log data, the metadata tags of the physical instances carrying the corresponding data are attached to the data, and the log data carries the trace identifiers generated by the microservice system for external requests; Entity binding processing of data features includes: aggregating data features related to the same physical instance within each time window based on the correlation between the metadata tags of physical instances and indicator data and log data, and the correlation between the tracking identifiers carried in the log data and the call chain data; A node data table is constructed based on the state of each physical instance within each time window, and an edge data table is constructed based on the interactions between physical instances within each time window.

4. The method according to claim 1, characterized in that, The construction of the image snapshot sequence includes: The node data table and edge data table are filtered to obtain node data and edge data within the same time window. The nodes in the graph snapshot are created based on the filtered node data, and the directed edges of the graph snapshot are constructed based on the filtered edge data, thus obtaining the graph snapshot of the corresponding time window. Using time windows as indexes, data filtering is performed for each time window, and a sequence of multiple time-ordered graph snapshots is generated.

5. The method according to claim 1, characterized in that, Updating the memory state vector of each interaction event occurrence node involved in the interaction event includes: Collect the memory state vectors of all neighboring nodes of the node where the interaction event occurred in the previous time window and the fused feature vectors of the current time window, and aggregate the collected neighboring node information to obtain aggregated information; The aggregated information is sent to the entry control loop unit to update the memory state vector of the interactive event occurrence node.

6. The method according to claim 5, characterized in that, The generation of aggregated information includes: Time coding is obtained by integrating the absolute time difference, relative time interval, and local time jitter between interactive events; The collected neighbor node information and time encoding are weighted and aggregated using a graph attention mechanism to generate aggregate information. The generation of aggregate information satisfies the following formula: ,in, Indicates within the time window For nodes The aggregated information This represents the graph attention function. Representing neighboring nodes In the previous time window The memory state vector, Representing neighboring nodes In the current time window The fused feature vector, Represents a node and Time encoding of interactions between them Indicates traversing nodes All neighboring nodes .

7. The method according to claim 1, characterized in that, The entire dataset is divided into training sets according to time order, and anomaly labels are marked on the training sets. The entire dataset includes node data tables and edge data tables corresponding to all time windows. On the training set, a subset of features is selected based on the mutual information score between data features and anomaly labels; When calculating the fused feature vector of a node, a dense vector representation of the node's categorical features is generated based on the feature subset. The dense vector representation of the node and the numerical features are then interacted through explicit and implicit interaction networks, and the outputs of the two interaction networks are concatenated to generate the fused feature vector.

8. The method according to claim 7, characterized in that, Set up the encoder-decoder structure; Extract categorical features from the preprocessed multimodal observable data and map the extracted categorical features to an initial feature vector; An encoder is used to perform nonlinear compression on the initial feature vector to generate a dense vector representation that reflects the category attribute. A decoder is used to restore the dense vector representation generated by the encoder to the original category feature information. A self-supervised learning mode is used to optimize the encoder-decoder structure by minimizing the reconstruction error between the initial feature vector and the reconstructed category feature information. When calculating the fused feature vector of a node, a dense vector representation of the node's categorical features is generated using the optimized and trained encoder.

9. The method according to claim 7, characterized in that, The explicit interaction between the dense vector representation of a node and its numerical features includes: performing a bitwise vector product operation on the dense vector representation of the node and its numerical features to generate an explicit interaction vector; The implicit interaction between the dense vector representation of a node and its numerical features includes: concatenating the dense vector representation of a node and its numerical features and then inputting the concatenation into a multilayer perceptron to generate an implicit feature vector.

10. The method according to claim 1, characterized in that, The selection of decision thresholds includes: selecting candidate thresholds within the probability interval of the output by a fixed step size; On the validation set, the abnormal prediction results are obtained by comparing different candidate thresholds with the abnormal prediction probability, and the prediction results under different candidate thresholds are compared with the true labels. Calculate and analyze the change curves of key performance indicators to select the optimal threshold that maximizes detection efficiency as the decision threshold.

Images