A micro-service multi-modal anomaly detection method based on dynamic graph learning

Abstract

The application provides a micro-service multi-modal anomaly detection method based on dynamic graph learning, comprising: collecting multi-modal observable data; pre-processing the multi-modal observable data for alignment and windowing processing to obtain data features of the multi-modal observable data, performing entity binding processing on the data features according to the association between the data features and physical instances carrying the data to obtain a node data table and an edge data table; constructing a plurality of graph snapshots arranged in time sequence to form a graph snapshot sequence with a time window as an index, and creating a time edge between adjacent graph snapshots to obtain a dynamic graph; when an interaction event occurs in the dynamic graph, generating a final node representation of an interaction event occurrence node participating in each interaction event; obtaining an anomaly prediction probability of the node according to the final node representation to determine whether the node is abnormal. The method can improve the detection accuracy and accurately identify anomalies caused by mode drift or slow performance degradation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of microservice anomaly detection, and particularly relates to a microservice multi-modal anomaly detection method based on dynamic graph learning. BACKGROUND

[0002] Microservice architecture, as the core mode of building large-scale distributed applications in the cloud native era, has been widely used. Microservices significantly improve the agility of development and the scalability of systems by decoupling complex monolithic applications into a group of independent and autonomous services. However, this architecture also brings unprecedented operational challenges, especially in anomaly detection.

[0003] In the prior art, the dynamically evolving microservice system is generally simplified as a series of discrete and independent static graph snapshots for analysis. This "slicing" processing method, which fixes the service call relationship occurring within a time period as a static adjacency matrix or graph structure and attaches the indicators within the time period as node features, can analyze the spatial topology relationship within a certain time window, but fundamentally breaks the continuity of time and cannot observe the smooth evolution of system state and topology structure from one instant to the next. The dynamics of the microservice system (such as instance start-stop and call changes) are forcibly fixed within the window, losing its dynamic nature. When the anomaly is a continuous evolution process rather than an instantaneous event, these models based on static snapshots cannot effectively detect because they lack complete modeling of the process.

[0004] In the prior art, when multiple modal data are fused, a shallow fusion strategy of feature splicing before model input is generally adopted. This method fails to learn and model the deep interaction between different modal data, resulting in the neglect of complex anomaly patterns caused by the joint action of multiple sources and weak signals, causing loss of key information and inaccurate representation of system state.

[0005] In the microservice system, many key system failures are not instantaneous and dramatic events, but the result of long-term and slow evolution. The judgment standard for this type of anomaly is whether the current behavior pattern deviates from its long-term normal baseline. However, the memory capacity maintained by each service instance in the prior art is usually limited to the current analysis window length, and the long-term history behavior of the service is "amnesia". This makes it impossible for the model to establish a stable historical behavior baseline. Its understanding of the normal pattern of the service is local and short-term, and it cannot distinguish between normal periodic fluctuations (such as daytime traffic peaks) and true anomalies caused by pattern drift, making it difficult to accurately identify anomalies that need to be compared with long-term historical context for judgment, ultimately leading to false positives or false negatives.

[0006] Therefore, it is necessary to provide a new microservice anomaly detection method to solve the above problems. SUMMARY

[0007] The application aims to provide a multi-modal anomaly detection method based on dynamic graph learning, which can continuously track the state evolution of service instances and capture the complete propagation process of faults on the service call chain to improve the accuracy of detection and reduce the false negative rate.

[0008] The multi-modal anomaly detection method for microservices based on dynamic graph learning provided by the application comprises the following steps: collecting multi-modal observable data from a microservice system, wherein the multi-modal observable data comprises index data, call chain data and log data; pre-processing the multi-modal observable data, including performing alignment and windowing processing to obtain data features of the index data, the call chain data and the log data, performing entity binding processing on the data features according to the association between the data features and physical instances carrying the data to obtain a node data table recording the state of the physical instances in each time window and an edge data table recording the interaction between the physical instances; filtering the node data and the edge data in the same time window to construct a plurality of graph snapshots arranged in time sequence to form a graph snapshot sequence, creating a time edge between the same physical instance nodes in adjacent graph snapshots to obtain a dynamic graph of the behavior of the microservice system; creating a memory state vector for each node in the dynamic graph, updating the memory state vector of each interaction event occurrence node when an interaction event occurs in the dynamic graph, combining the updated memory state vector of each interaction event occurrence node and the current fusion feature vector to generate a final node representation; performing nonlinear transformation on the final node representation of each node in each time window to obtain an anomaly prediction probability, and determining that the physical instance corresponding to the node is abnormal in the corresponding time window when the anomaly prediction probability is greater than a preset decision threshold.

[0009] The multi-modal anomaly detection method for microservices based on dynamic graph learning provided by the application has the following beneficial effects: the state evolution of each service instance is continuously tracked through the design of an event-driven and memory updating mechanism, and the complete propagation process of faults on the service call chain is captured. For slow heat type faults or complex cascading faults that need to accumulate evidence to determine, the accuracy of detection can be significantly improved, and the false negative rate can be reduced. Through a complex interaction network, the deep relationship between indexes, logs and call chains is actively mined and learned, so that a feature representation that can better reflect the real state of the system is generated. At the same time, a long-term evolving historical state vector is maintained for each service instance, and a stable behavior baseline can be established. This makes the application not only capable of detecting instantaneous anomalies, but also capable of accurately identifying anomalies caused by pattern drift or slow performance degradation that are difficult to be found by traditional methods.

[0010] In a possible embodiment, the data features obtained by performing the alignment and windowing processing include: defining a common time window; grouping the index data, the call chain data and the log data according to the time length of the common time window respectively; applying a plurality of aggregation functions to the grouped index data to obtain a plurality of dimension statistical features to obtain an index feature vector; performing a structured processing on the grouped log set to extract a log template, and performing vectorization on the log set according to a pre-constructed global ordered dictionary to obtain a log template count vector; and performing a statistics on the grouped call chain data to generate feature values describing node features and edge features.

[0011] In another possible embodiment, when the index data and the log data are collected, metadata tags of physical instances carrying corresponding data are attached to the data, and the log data carries a tracking identifier generated by the microservice system for an external request; the entity binding processing of the data features includes: according to the association between the metadata tags of the physical instances and the index data and the log data, and the association between the tracking identifier carried in the log data and the call chain data, aggregating the data features related to the same physical instance in each time window; constructing a node data table according to the state of each physical instance in each time window, and constructing an edge data table according to the interaction between the physical instances in each time window.

[0012] In other possible embodiments, the graph snapshot sequence construction includes: filtering the node data table and the edge data table to obtain node data and edge data in a same time window, creating nodes in a graph snapshot according to the filtered node data, and constructing directed edges of the graph snapshot according to the filtered edge data to obtain a graph snapshot corresponding to the time window; indexing the time windows, performing data filtering and creating graph snapshots for each time window to generate a sequence composed of a plurality of graph snapshots arranged in time sequence.

[0013] Updating the memory state vector of each interaction event occurrence node participating in the interaction event includes: collecting the memory state vectors of all neighbor nodes of the interaction event occurrence node in the last time window and the fusion feature vector of the current time window, aggregating the collected neighbor node information to obtain aggregated information; and sending the aggregated information into a gated recurrent unit to update the memory state vector of the interaction event occurrence node.

[0014] The generation of the aggregated information includes: fusing an absolute time difference, a relative time interval and a local time jitter between the interaction events to obtain a time code; and generating the aggregated information by weighting and aggregating the collected neighbor node information and the time code through a graph attention mechanism, and the generation of the aggregated information satisfies the following formula: wherein, represents the time window is the node to which the information is aggregated, represents a graph attention function, representing neighbor nodes in the previous time window memory state vector, representing neighbor nodes in the current time window fusion feature vector, representing the node and time encoding of the interaction between the node representing all neighbor nodes of the node .

[0015] The data set is divided into a training set in chronological order, and the training set is labeled with an abnormal label. The data set includes node data tables and edge data tables corresponding to all time windows. In the training set, a feature subset is selected according to the mutual information score between the data features and the abnormal label. When calculating the fusion feature vector of the node, the category feature dense vector representation of the node is generated according to the feature subset. The dense vector representation of the node and the numerical feature are interacted through an explicit and implicit interaction network, and the outputs of the two interaction networks are spliced to generate a fusion feature vector.

[0016] An encoder-decoder structure is set. Category features in preprocessed multi-modal observable data are extracted, and the extracted category features are mapped to an initial feature vector. An encoder is applied to nonlinearly compress the initial feature vector to generate a dense vector representation reflecting category attributes. A decoder is applied to restore the dense vector representation generated by the encoder to the original category feature information. The encoder-decoder structure is optimized and trained by minimizing the reconstruction error between the initial feature vector and the reconstructed category feature information in a self-supervised learning mode. When calculating the fusion feature vector of the node, the optimized and trained encoder is used to generate the dense vector representation of the category feature of the node.

[0017] The explicit interaction between the dense vector representation of the node and the numerical feature includes performing a vector product operation on the dense vector representation of the node and the numerical feature bit by bit to generate an explicit interaction vector. The implicit interaction between the dense vector representation of the node and the numerical feature includes concatenating the dense vector representation of the node and the numerical feature and inputting them into a multilayer perceptron to generate an implicit feature vector.

[0018] Candidate threshold values are selected in fixed steps within the output probability interval. The abnormal prediction result is obtained by comparing different candidate threshold values with the abnormal prediction probability on the validation set. The prediction results under different candidate threshold values are compared with the real labels. The change curve of the key performance indicators is calculated and analyzed to select the optimal threshold value that can maximize the detection performance as the decision threshold value. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 A flowchart of a microservice multi-modal anomaly detection method based on dynamic graph learning provided for an embodiment of the present application is shown in FIG. 1.

[0020] Figure 2 A flowchart of generating a final node representation based on a dynamic graph provided for an embodiment of the present application is shown in FIG. 3.

[0021] Figure 3 An electronic device structure diagram provided for an embodiment of the present application is shown in FIG. 4. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the usual meanings understood by those of ordinary skill in the art to which the present application belongs. The words such as “comprise” and the like used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0023] The present embodiment provides a microservice multi-modal anomaly detection method based on dynamic graph learning. Referring to the drawings accompanying the description Figure 1 , the method comprises:

[0024] S101: Collecting multi-modal observable data from a microservice system, the multi-modal observable data comprising index data, call chain data and log data.

[0025] In a possible embodiment, the multi-modal observable data original data stream acquisition depends on mature open source tools and technology stacks in the industry.

[0026] In a specific embodiment, the indicator data is collected through the Prometheus monitoring system, and plugins such as Node-Exporter are deployed to obtain system-level indicators of the host node, or Metric-Server is used to obtain container-level indicators on the Kubernetes platform. The call chain data is captured through the integration of open source distributed tracking systems such as Jaeger or Apache SkyWalking, or by using their agents for non-intrusive tracking to capture complete call chain data. The collection of log data is usually achieved by deploying log collection agents (such as the widely used Fluentd or Logstash) on each node of the Kubernetes cluster, and the collection agent is responsible for automatically discovering and collecting logs generated by all containers on the node, and forwarding them to a unified storage backend.

[0027] In a possible embodiment, in an environment using a service mesh such as Istio, the telemetry function of the service mesh can be directly used to non-intrusively capture indicators and call relationships of inter-service communication, simplifying the deployment and maintenance cost of data collection.

[0028] S102: The multi-modal observable data is preprocessed, including alignment and windowing to obtain data features of the indicator data, the call chain data and the log data, entity binding processing of the data features according to the association between the data features and the physical instances carrying the data, to obtain a node data table recording the state of the physical instances in each time window and an edge data table recording the interaction between the physical instances.

[0029] After collecting the original, heterogeneous multi-modal observable data stream, in order to unify the data of different sources and formats for processing, the multi-modal observable data is preprocessed to prepare for subsequent dynamic graph construction. The preprocessing of the multi-modal observable data includes two steps of alignment and windowing and entity binding.

[0030] In a possible embodiment, the alignment and windowing processing to obtain data features includes: defining a common time window; grouping the indicator data, the call chain data and the log data according to the time length of the common time window; applying a plurality of aggregation functions to the grouped indicator data to obtain multi-dimensional statistical features to obtain an indicator feature vector; structuring the grouped log set to extract a log template, and vectorizing the log set according to a pre-constructed global ordered dictionary to obtain a log template count vector; and counting the grouped call chain data to generate feature values describing node features and edge features.

[0031] In a possible embodiment, metadata tags of physical instances carrying corresponding data are attached to the data when collecting the index data and the log data, and the log data carries a tracking identifier generated by the microservice system for an external request. The entity binding processing of the data features includes: according to the association between the metadata tags of the physical instances and the index data and the log data, and the association between the tracking identifier carried in the log data and the call chain data, aggregating the data features related to the same physical instance in each time window; constructing a node data table according to the state of each physical instance in each time window, and constructing an edge data table according to the interaction between the physical instances in each time window.

[0032] The purpose of alignment and windowing is to convert and synchronize the collected heterogeneous data streams with different timestamps to a unified time window sequence. In a specific embodiment, the specific process of alignment and windowing processing includes: first, defining a fixed length, non-overlapping common time window as the minimum unit of data alignment. The size of the common time window is an important hyperparameter, which determines the granularity and sensitivity of anomaly detection. Then, based on the time length of the common time window, the index data, the call chain data and the log data are windowed respectively.

[0033] Specifically, the metric data is a high-frequency numerical time series (e.g., Prometheus collects every 15 seconds). In order to align it with the public time window, all original data points falling into the same time window need to be aggregated to generate statistical features that can represent the state of the time window. The specific process of windowing the metric data is to filter out all original metric data points whose timestamps are located in the same time window to group the metric data. A variety of aggregation functions are applied to the grouped data points to perform aggregation calculations to characterize the performance of the metric data in the time window from different dimensions. After aggregation calculation, each metric in the time window is not a series of original values but is converted into a feature vector containing multiple statistical features. The statistical features obtained after aggregation calculation include mean (reflecting the average level of the metric), standard deviation (measuring the volatility or stability of the metric), maximum / minimum (capturing peak and valley, which is crucial for detecting peak or sudden drop anomalies), and percentile (especially important for delay and other performance metrics, used to reflect the performance of long-tail requests). For example, after applying a variety of aggregation functions to the CPU utilization metric, the converted feature vector is: {cpu_util_mean, cpu_util_stddev, cpu_util_max, cpu_util_p99}, where cpu_util_mean represents the mean of CPU utilization, cpu_util_stddev represents the standard deviation of CPU utilization, cpu_util_max represents the maximum value of CPU utilization, and cpu_util_p99 represents the percentile of CPU utilization.

[0034] Log data is discrete, unstructured text events. Windowing it is vectorizing it, i.e., converting multiple log information generated in a time window into a fixed-dimensional numerical vector. The specific process of windowing the log data is to collect all original logs falling into the same time window to group the log data. Use a log parsing algorithm to structure each original log, extract the log template (static text part) and log parameter (dynamic changing part). A global ordered dictionary containing all known log templates based on cosine is used to vectorize the log set composed of original logs falling into the same window, so that a log template count vector strictly corresponding to the order of the global ordered dictionary can be formed. The dimension of the log template count vector is equal to the size of the global ordered dictionary, and the value of each dimension is the number of occurrences of the corresponding log template in the log set. For example, if the order of the interval ordered dictionary is [template_A, template_B, template_error_C], and template A appears 5 times and template C appears 2 times in the log set, then the corresponding log vector formed by conversion is [5, 0, 2].

[0035] In one possible embodiment, the log template count vector is usually highly sparse (i.e. most values are 0) because only a small number of log templates will appear in a time window. For efficient storage and readability, the present application adopts a sparse representation format of key-value pairs in the node data table, only recording the templates with non-zero occurrence times, such as {"error-A": 5, "info-B": 100}.

[0036] The call chain data is essentially structured data describing the interactions between services. The goal of windowing is to aggregate all interactions occurring within a single time period to summarize the topological interaction characteristics of the system within that period. The specific process of windowing the call chain data is as follows: filter out all call chain data whose start timestamp is located within the same time window. Perform statistics on the grouped call chain data to generate numerical values that can describe the characteristics of nodes (service instances) and edges (call relationships) within the time window, where node characteristic aggregation includes statistics on each node (service instance) within the time window, including request inflow / outflow (total number of requests received and sent by the service instance) and average processing time (average time spent by the service instance in processing requests, i.e. average duration of span); edge characteristic aggregation includes statistics on each edge within the time window, including call frequency, error frequency, and delay statistics, such as when the edge represents a call from service A to service B, the total number of A calls to B within the time window is the call frequency, the number of call failures is the error frequency, and the average delay and p99 delay of the call are the delay statistics.

[0037] Through the above alignment and windowing operations on the indicator data, log data, and call chain data, the originally heterogeneous and asynchronous three data sources can be successfully converted and synchronized to a unified time window sequence, laying the foundation for subsequent analysis modeling.

[0038] In a dynamic cloud-native environment, the IP address, hostname, and other identifiers of a service instance (such as a Kubernetes Pod) are dynamically changing, and the instances have transience and identity variability. The identifiers of different data sources in multi-modal observable data are also heterogeneous: service instances can be frequently destroyed and rebuilt, and each new instance will obtain a unique, usually randomly generated name and dynamically allocated IP address; different observability data sources use different identifiers. For example, monitoring systems such as Prometheus may use IP addresses to capture indicators; log messages may record hostnames or Pod names; while spans in distributed tracing systems are usually associated with logical service names. The characteristics of service instances and identifiers in a dynamic cloud-native environment make it difficult to accurately associate service instances with multi-modal observable data related to them.

[0039] The application designs a mechanism for assigning a globally unique tracking identifier to a request entering a microservice system and injecting metadata tags into each service instance using a distributed tracking system. Through the combination of these mechanisms, a unique and standardized instance identifier is constructed for the service instance, and the metrics, logs, and call chain information belonging to the instance are accurately associated, thereby solving the problem of physical instance identification.

[0040] In one specific embodiment, the entity binding processing of the data features includes:

[0041] When an external request first enters the microservice system, a globally unique tracking identifier is generated for the request by the distributed tracking system. The tracking identifier is injected as context information into the header of the request and is passed between services. When configuring the log framework, the tracking identifier can be automatically read from the context of the current request and printed as metadata to each related log message. Thus, the tracking identifier generated for the external request is carried in the log data collected from the microservice system. In this way, the log data can be accurately associated with the call chain through the tracking identifier it carries. For example, a log with the content "database connection failed" can be accurately associated with the complete call chain of a specific user request that caused the failure through the tracking identifier it carries.

[0042] The metadata tags of each physical instance are designed to be attached. When the metrics are grabbed from the physical instance, the metadata tags of the physical instance are attached to the collected metrics. When the logs are collected, the metadata of the physical instance that generates the logs is attached to the collected log data. In this way, the metadata tags of the physical instance can be uniformly attached to the metrics data, log data, and call chain data, so as to realize the binding of the multi-modal observable data and the physical instance and the logical service to which the physical instance belongs. Exemplarily, in the Kubernetes environment, the process of injecting the metadata tags and associating the information between the physical instance and the multi-modal observable data is as follows: the Kubernetes platform automatically attaches a set of rich metadata tags, such as pod_name, service_name, namespace, and the like, to each physical instance (Pod) managed by it, and the monitoring system (such as Prometheus) dynamically queries the Kubernetes API to obtain the Pod list and IP address that meet the specific tags by using the service discovery (ServiceDiscovery) mechanism of the Kubernetes platform instead of relying on the static IP address list. When the Prometheus grabs the metrics from a Pod, all the metadata tags of the Pod are automatically attached to the collected metrics. The log collection agent deployed on the node can also interact with the Kubernetes API, so as to attach the metadata tags of the Pod that generates the log to the collected log when the log is collected. The metadata tags attached to the multi-modal observable data are in the form of {service="auth", pod="auth-deployment-5f7b8c9d6-xyz123"}.

[0043] The entity binding finally constructs a globally unique and normalized instance ID for each physical instance. In the present application, the instance ID usually adopts the format of service-name@pod-name. The instance ID will serve as the primary key for subsequent construction of data tables, so as to ensure that all related multi-modal observable data of a physical instance are correctly aggregated together in a time window.

[0044] After the alignment and windowing processing and the entity binding processing, the collected original multi-modal observable data can be converted into two core structured data tables as direct inputs for constructing a dynamic graph. The constructed structured data tables are a node data table and an edge data table. The node data table records the state of each physical instance in each time window, and the structure thereof is shown in Table 1:

[0045] Table 1 Node data table

[0046]

[0047] Edge data table records the interactions (i.e. service calls) between physical instances within each time window, and an example of its structure is shown in Table 2:

[0048] Table 2 Edge data table

[0049]

[0050] S103: Filter the node data and edge data in the same time window to construct a plurality of graph snapshots arranged in time sequence to form a graph snapshot sequence, and create a time edge between the same physical instance nodes between adjacent graph snapshots to obtain a dynamic graph of the microservice system behavior.

[0051] In a possible embodiment, the graph snapshot sequence construction includes: filtering the node data table and the edge data table to obtain node data and edge data in a same time window, creating nodes in a graph snapshot according to the filtered node data, and constructing directed edges of the graph snapshot according to the filtered edge data to obtain a graph snapshot corresponding to the time window; and indexing the time window, performing data filtering and creating a graph snapshot for each time window to generate a sequence of a plurality of graph snapshots arranged in time sequence.

[0052] The behavior of the microservice system in a period of time is defined as a dynamic graph, which is a sequence composed of a series of graph snapshots arranged in time: wherein each graph snapshot represents the complete state of the microservice system in the time window , and contains a node set and an edge set of the time window. The construction of the graph snapshot is a process of translating the preprocessed table data into graph structured data. For each unique time window , the corresponding graph snapshot is constructed using the node data table and the edge data table. In a series of independent graph snapshots, if there are nodes representing the same physical instance between two adjacent graph snapshots, a directed time edge is created between the nodes in the adjacent graph snapshots. The dynamic graph of the above structure contains two types of relationships, and the structure of the dynamic graph can completely retain the spatiotemporal dynamic information of the microservice system, and can reflect the real-time interaction between physical instances (spatial dimension) and the evolution of the state of each physical instance over time (temporal dimension), thereby providing a structured basis for subsequent spatiotemporal feature learning.

[0053] In a specific embodiment, the specific process of dynamic graph construction includes: indexing the time window , filtering the node data table and the edge data table to obtain a node data table and an edge data table containing the time window Two subsets of data from all records are selected, and the resulting subsets contain the data needed to construct the corresponding graph snapshot. All the necessary information.

[0054] Create nodes based on the filtered subset of node data: Iterate through the filtered subset of node data, where each piece of information in the subset corresponds to a snapshot of the graph. A node is a record in a system where its unique identifier comes from the `node_id` field in the corresponding record information. The node's characteristics (i.e., the state of the physical instance within that time window) are composed of other data fields recorded in the information. For example, the value of the `cpu_util_mean` field and the key-value pair of the `log_template_counts` field (such as `{"error-A":5,"info-B":100}`) are appended to the newly created node as part of its initial feature vector.

[0055] After the nodes are created, spatial edges are created based on the filtered subset of edge data: traversing the filtered subset of edge data, each piece of information in the subset corresponds to a graph snapshot. A directed edge in the context represents a service call. The starting node of the edge is specified by the src_node_id field recorded in the information, the target node of the edge is specified by the dst_node_id field recorded in the information, and the characteristics of the edge (i.e., the attributes of this call) are composed of other data fields recorded in the information, such as protocol, method, and call_count.

[0056] Once the nodes and edges are created, all call and interaction relationships between the nodes are added to the graph snapshot. In the middle, a complete process was completed, including a specific time window. A snapshot of the graph of all physical instances and their interactions. The construction of graph snapshots. This graph snapshot construction process is repeated for each time window in the node dataset and edge dataset, thereby generating a series of graph snapshots. }

[0057] After obtaining a series of independent graph snapshots, the time series is traversed, and for any two adjacent graph snapshots... and Iterate through each node in the graph snapshot. If nodes represent the same physical instance, that is, the graph snapshot... Nodes in and exists in the next snapshot The middle is recorded as If the nodes have the same node_id, a directed time edge is created between the two nodes. , ).

[0058] S104: create a memory state vector for each node in the dynamic graph, update the memory state vector of each interaction event occurrence node participating in the interaction event when the interaction event occurs in the dynamic graph, and combine the updated memory state vector of each interaction event occurrence node and the current fusion feature vector to generate a final node representation.

[0059] After obtaining the dynamic graph that can completely retain the spatio-temporal dynamic information of the micro-service system, a high-quality initial feature vector is created for the nodes in the dynamic graph, and the spatio-temporal evolution pattern of the nodes on the dynamic graph is learned to generate a final node representation containing spatio-temporal context information.

[0060] Specifically, referring to the accompanying drawings Figure 2 , a high-quality initial feature vector is first created for each node in the dynamic graph, and this feature vector needs to effectively fuse the data features extracted from the indicator data, log data and call chain data. The initial feature vector formed is the fusion feature vector of the node. Then the spatio-temporal evolution pattern of the nodes on the dynamic graph is learned: a memory state vector is maintained for each node in the dynamic graph, and the memory state vector summarizes the historical information of the node. When an interaction event occurs in the dynamic graph, a final node representation containing spatio-temporal context information is generated according to the memory state vector and the fusion feature vector.

[0061] In a possible embodiment, the data set is divided in chronological order to obtain a training set, and an abnormal label is labeled on the training set, wherein the data set includes node data tables and edge data tables corresponding to all time windows; on the training set, a feature subset is screened according to mutual information scores between data features and abnormal labels; when calculating the fusion feature vector of the node, the dense vector representation of the categorical feature of the node is generated according to the feature subset, and the dense vector representation of the node and the numerical feature are interacted through an explicit and implicit interaction network, and the outputs of the two interaction networks are spliced to generate the fusion feature vector .

[0062] An encoder-decoder structure is set; a categorical feature in the preprocessed multi-modal observable data is extracted, and the extracted categorical feature is mapped to an initial feature vector; the encoder is applied to nonlinearly compress the initial feature vector to generate a dense vector representation reflecting the category attribute, the decoder is applied to restore the dense vector representation generated by the encoder to the original categorical feature information, and the encoder-decoder structure is optimized and trained by minimizing the reconstruction error between the initial feature vector and the reconstructed categorical feature information in a self-supervised learning mode; when calculating the fusion feature vector of the node, the optimized and trained encoder is used to generate the dense vector representation of the categorical feature of the node.

[0063] The explicit interaction between the dense vector representation of the node and the numerical feature includes: performing a bit-by-bit vector product operation on the dense vector representation of the node and the numerical feature to generate an explicit interaction vector; and the implicit interaction between the dense vector representation of the node and the numerical feature includes: concatenating the dense vector representation of the node and the numerical feature and inputting the same into a multi-layer perception to generate an implicit feature vector.

[0064] In a possible embodiment, updating the memory state vector of each interaction event occurrence node participating in an interaction event includes: collecting memory state vectors of all neighbor nodes of the interaction event occurrence node in a previous time window and fusion feature vectors of the neighbor nodes in a current time window, and aggregating the collected neighbor node information to obtain aggregated information; and sending the aggregated information to a gated recurrent unit for updating the memory state vector of the interaction event occurrence node.

[0065] The generation of the aggregated information includes: fusing an absolute time difference, a relative time interval and a local time jitter between interaction events to obtain time encoding; and performing weighted aggregation on the collected neighbor node information and the time encoding through a graph attention mechanism to generate the aggregated information, and the generation of the aggregated information satisfies the following formula: wherein, denotes a time window of the node to which information is aggregated, denotes a graph attention function, denotes a neighbor node in a previous time window of the node , denotes a fusion feature vector of a neighbor node in a current time window of the node , denotes time encoding of interaction between the node and all neighbor nodes of the node .

[0066] In a specific embodiment, the entire set of data is first divided into a training set, a validation set and a test set. The entire set of data refers to data obtained through data preprocessing, and specifically includes a node data table and an edge data table corresponding to all time windows; the division of the training set, the validation set and the test set is performed in chronological order. Exemplarily, the data in the first 70% of time windows can be divided into the training set, the data in the middle 15% of time windows can be divided into the validation set, and the data in the last 15% of time windows can be divided into the test set.

[0067] Then the data features of the nodes are fused to generate the fusion feature vector on the training set. In order to reduce noise and improve efficiency, feature selection is performed first, and then feature fusion is performed on each node according to the selected feature type. The specific process of generating the fusion feature vector is as follows:

[0068] The features extracted from the original multi-modal observable data after data preprocessing are taken as candidate features, including multi-dimensional statistical features such as mean, standard deviation, maximum value, and percentile of the index data after aggregation; log template count vector after structured parsing and vectorization processing of the log data; node features of the call chain data, including request inflow / outflow, average processing time, etc. statistical values, and edge features, including call frequency, error frequency, delay statistics, etc. interactive feature values. Traverse all candidate features, and use the data of the training set to calculate the mutual information score between each candidate feature and the abnormal label. The source of the abnormal label information is the fault record manually labeled according to the historical data, the alarm record of the monitoring system, or the fault information artificially injected in the controlled experiment environment. The formal definition of mutual information is as follows: Where, represents the mutual information between the random variable (original feature) and (abnormal label), which is used to measure the nonlinear statistical dependence between the two; represents the mathematical expectation; represents the joint probability when the random variable takes the value and takes the value ; represents the marginal probability of the random variable taking the value ; represents the marginal probability of the random variable taking the value the edge probability. Specifically, the above formal definition formula is a general form of the theoretical definition of mutual information. In order to improve the accuracy of the calculation, the feature types are distinguished for calculation: for category type features, such as log templates, the above formal definition formula is converted into an empirical mutual information formula based on frequency statistics, that is, the weighted sum of all possible value combinations; for continuous features, such as CPU usage indicators, etc., since the value is continuous, frequency statistics cannot be directly performed, and the KSG estimator is used to directly calculate the mutual information score through non-parametric K-nearest neighbor distance estimation to avoid information loss caused by continuous data discretization. After calculating the mutual information scores of all candidate features, the mutual information scores are ranked in descending order, and then the top K features are selected according to the pre-set hyperparameter K to form a feature subset. It should be noted that the feature subset is fixed after being selected, and the selected feature subset will be used for model training, validation and testing, and will not be reselected or adjusted on the validation set or test set.

[0069] For the feature subset, a three-stage deep fusion process is adopted to mine the complex interactions between the numerical features (from indicators) and categorical features (from logs, call chains) of the nodes. The deep fusion of features is as follows: an encoder-decoder structure is set up, a dense vector representation of the categorical features is learned through the encoder-decoder structure, then the dense vector representation and the original numerical features are deeply interacted through parallel explicit and implicit interaction networks to fully mine the non-linear correlations therein, and finally the outputs of the interaction networks are spliced and input into a multilayer perceptron to generate a fusion feature vector. The encoder-decoder structure needs to be optimized and trained first, and the dense vector representation of the categorical features is generated by using the optimized encoder. The optimization training process of the encoder-decoder structure is as follows: 1. Input information extraction. The categorical features of each physical instance in the current time window are extracted directly according to the structured data generated after data preprocessing, such as log template ID, service call type, etc. 2. Embedding mapping. The discrete category ID is mapped to a low-dimensional continuous vector space through an embedding layer, and the non-numerical category information is converted into a calculable initial feature vector. 3. Encoding compression. The encoder compresses the initial feature vector through a multilayer neural network to extract its core semantic features and generate a dense vector representation reflecting the category attribute. 4. Reconstruction and decoding. The decoder attempts to restore the dense vector in the hidden space to the original category feature information to verify the effectiveness of feature extraction. 5. Objective function optimization. The entire encoder-decoder network is trained by minimizing the reconstruction error between the original input and the reconstructed output in a self-supervised learning mode. Explicit interaction refers to simulating the correlation between features through explicit mathematical operations (such as vector multiplication or feature cross), and the calculation formula directly defines how the features are combined two by two, with a clear structure and easy to capture low-order feature cross relationships. The explicit interaction method usually adopts a structure similar to Cross Network to perform vector product operation on the numerical features and the dense vector representation. Implicit interaction refers to automatically learning the complex correlation between features through a deep neural network, and the interaction process is hidden in the weighted calculation of neurons. The implicit interaction method directly splices the numerical features and the dense vector representation and inputs them into a multilayer perceptron. Implicit interaction can "implicitly" mine high-order non-linear correlations that are difficult to understand intuitively through non-linear activation functions, and capture complex patterns caused by the joint action of multiple weak signals. The explicit interaction network produces a feature vector, and the implicit interaction network produces another feature vector. The two output vectors are spliced and input into a multilayer perceptron for dimension reduction or transformation to obtain the final fusion feature vector, which contains the instantaneous state of the numerical indicators, the condensed information of the log semantics, and the implicit state after deep interaction between the two (such as certain correlation between the frequency of a specific log and CPU fluctuations).

[0070] In a specific embodiment, after obtaining the fusion feature vector of each node, a temporal graph network (TGN) is used to learn the spatio-temporal evolution pattern of the nodes on the dynamic graph. The generation process of the final node representation containing spatio-temporal context information includes: maintaining a memory state vector for each node in the dynamic graph Before starting to process the time series data (i.e. ), the memory state vectors of all nodes appearing in the graph are set to zero. The memory state vectors are updated when an interaction event occurs in the dynamic graph.

[0071] In order to capture the time dynamics between events more finely, an enhanced time encoding mechanism is designed, which considers the absolute time difference between events, calculates the normalized relative time interval and local time jitter, and then concatenates the absolute time difference, relative time interval and local time jitter of the event into a comprehensive feature vector, and fuses the comprehensive feature vector through a multi-layer perception to obtain the time encoding. The absolute time difference between events is calculated according to the original timestamp of the interaction event in the microservice system, which is mainly derived from the call chain data collected by the distributed tracking system, which records the precise time of each span (Span) in detail. The absolute time difference between events specifically refers to the absolute difference between the timestamp of the current event and the timestamp of the event in the interaction sequence. Although the system as a whole uses a time window for data regularization in the preprocessing stage, each interaction within the window is restored to a discrete time sequence event for processing after entering the TGN dynamic representation to learn the spatio-temporal evolution pattern of the nodes. The absolute time difference captures the distribution characteristics (such as frequency and timing jitter) of the event stream in the time dimension, and through the calculation of local time jitter and other indicators, the model can identify time-sensitive faults such as abnormal fluctuations in request frequency. The calculation of the normalized relative time interval satisfies the following formula: The normalized local time jitter satisfies the following formula: ; wherein denotes the normalized relative time interval of the event; denotes the local time jitter of the event; denotes the absolute time difference of the event; denotes the absolute time difference of the previous (the event); and ​​These represent the maximum and minimum time differences of all events within a dataset or a window, respectively. It is a very small positive number, used to prevent the denominator from being zero. The comprehensive feature vector of the events is: The final result was the first The time code for each event is: .

[0072] TGN uses an event-driven approach to update node states. When an interaction event occurs, all nodes involved in that event need to update their state. The edge data table generated during the preprocessing phase identifies all node pairs that interacted within the current time window. These physical instances that participated in the service call are the relevant nodes that require state updates.

[0073] For a node that needs to update its state It will come from its neighboring nodes. Information is collected and weighted through a graph attention mechanism to generate aggregated information. : ,in, Indicates within the time window For nodes Aggregated information; Representation graph attention mechanism weighted aggregation algorithm; Representing neighboring nodes In the previous time window The memory state vector; Representing neighboring nodes In the current time window fused feature vectors; Represents a node and Time encoding of interactions between them; Indicates traversing nodes All neighboring nodes Time window The determination is based on the image snapshot sequence number after alignment and windowing processing, that is, any [image snapshot number] in the [image snapshot sequence number]. The timing position of interactive events occurring within a time window during processing is: .

[0074] Aggregated information The data is fed into a Gated Recurrent Unit (GRU) to update the node's own memory state vector. The GRU selectively retains past information and incorporates new event data, effectively capturing temporal evolution. The memory state vector update satisfies the following formula: ,in, Represents a node In the time window Updated memory state vector; Represents a node In the previous time window The memory state vector.

[0075] Update the memory state vector of the nodes (Representing its long-term history) and the current fused feature vector (Representing its immediate state) are combined and a final node representation is generated through a multilayer perceptron. : , Represents a node In the time window The final node representation.

[0076] The generated final node representation contains spatiotemporal context information, which serves as input for subsequent anomaly detection and classification.

[0077] S105: Perform a nonlinear transformation on the final node representation of each node in each time window to obtain the anomaly prediction probability. When the anomaly prediction probability is greater than the preset decision threshold, the physical instance corresponding to the node is judged as an anomaly in the corresponding time window.

[0078] This invention uses a standard multilayer perceptron network model to process the final node representation to obtain the anomaly prediction probability. The input of this multilayer perceptron network model is each node. In each time window The generated final node representation The multilayer perceptron (MLP) linearly projects the input vector using the weight matrix and bias terms in its hidden layers, and performs layer-by-layer transformations using nonlinear activation functions (such as ReLU) to learn a nonlinear decision boundary in the feature space that distinguishes normal behavior from complex abnormal patterns. The output layer of the MLP uses a sigmoid activation function, which compresses the network's output value to the (0,1) interval. This output value can be directly interpreted as the predicted probability that the node is abnormal at that moment, denoted as . An output value close to 1 indicates that the model determines the instance to be highly likely to be abnormal, while an output value close to 0 indicates that the model determines the instance to be highly likely to be normal.

[0079] The multilayer perceptron network model is trained and can then be used for online or offline anomaly detection. The direct output of the model is an anomaly prediction probability between 0 and 1. To get a clear binary classification result (i.e. "normal" or "abnormal"), the abnormal prediction probability needs to be compared with a pre-set decision threshold θ, if the prediction probability > θ, the instance is determined as abnormal at this moment ( ); otherwise, it is determined as normal ( ).

[0080] In one possible embodiment, the selection of the decision threshold includes: selecting candidate thresholds in the output probability interval at fixed steps; testing the abnormal prediction results obtained by comparing different candidate thresholds with the abnormal prediction probability on the validation set, comparing the prediction results under different candidate thresholds with the real labels; calculating and analyzing the change curve of the key performance indicators to select the optimal threshold that can maximize the detection performance as the decision threshold.

[0081] In one specific embodiment, the present application divides the entire data set to obtain the training set, the validation set and the test set, the training set is used to train the multi-layer perceptron network model, the validation set is used to determine the decision threshold experiment, and the decision threshold determined by the validation set is fixed to determine the test set.

[0082] Specifically, the determination process of the decision threshold is: selecting values in the (0, 1) probability interval output by the model as candidate thresholds at fixed steps, testing a series of different thresholds on the validation set, comparing the prediction results under different thresholds with the real labels, calculating and analyzing the change curve of the key performance indicators (such as F1-score), and selecting the threshold that can make the key performance indicators optimal as the decision threshold.

[0083] In one specific embodiment, since in the real data, the number of normal samples is much larger than that of abnormal samples. If the standard loss function is used for training, the model will tend to predict all samples as the majority class (normal), thereby ignoring the minority abnormal samples, resulting in the failure of the detection model. In order to solve this problem, the present application designs a weighted cross-entropy loss function combining FocalLoss and L2 regularization to train the multi-layer perceptron network model. The formal definition of the loss function satisfies the following formula: , wherein, represents the final loss function that needs to be minimized for the entire model, and the process of model training is to adjust the parameters to make the value of this function as small as possible. The Focal Loss term is the main part of the loss function, which adds a modulation factor The role of the modulation factor is to greatly reduce the contribution of the total loss for those samples that the model can easily and accurately classify (for example, a normal sample with a prediction probability close to 0), and to relatively increase the contribution for those few abnormal samples that the model is difficult to classify. This forces the model to pay more attention to learning how to identify these difficult abnormal samples during the training process. Among them, the outer loop represents the traversal of all time windows (from 1 to T), and the inner loop represents the traversal of all micro-service instance nodes in the current time window , is a parameter for balancing the weights of positive and negative samples, is a focusing parameter for adjusting the weights of difficult and easy samples, , indicates the true label, if the node is indeed abnormal at time , , if it is normal, . is an L2 regularization term, which prevents the model weights from being too large by penalizing the sum of squares of all weight parameters Θ of the model, thereby avoiding overfitting of the model on the training data and enhancing its generalization ability on unknown data.

[0084] The micro-service multi-modal anomaly detection method based on dynamic graph learning provided by the application discards the traditional paradigm of regarding the system as a discrete static snapshot, but regards it as a continuous evolving event stream. The TGN is applied to capture the whole process of the spatio-temporal propagation of anomalies. The TGN maintains a memory state vector that is constantly updated over time for each node in the dynamic graph, enabling it to capture long-term historical behavior patterns, and uses this continuously updated node-level memory to accurately detect slowly changing or behavior drifting anomalies that require long-term historical context for judgment. An enhanced time encoding mechanism combining absolute interval, relative interval and local jitter is designed, which not only uses the absolute time difference between events, but also introduces relative and jitter dimensions to more finely depict the dynamics of the event stream. This multi-dimensional time encoding method provides the TGN model with richer temporal context information to improve the detection ability of time-sensitive anomalies.

[0085] Through encoding-reconstruction and parallel explicit / implicit interaction networks, the nonlinear interaction relationship between numerical features (from indicators) and categorical features (from logs, call chains) is deeply mined. This unique feature fusion architecture solves the problem of information loss in feature splicing in the prior art.

[0086] The microservice multi-modal anomaly detection method based on dynamic graph learning of the application does not consider each time window in isolation, but coherently tracks the state evolution of each service instance through the design of the event-driven and memory update mechanism of the TGN, and captures the complete propagation process of the fault on the service call chain. Therefore, for slow heat type faults or complex cascading faults that need to accumulate evidence to judge, the accuracy of detection can be significantly improved, and the false negative rate can be reduced. Through a complex interaction network, the deep relationship between indicators, logs and call chains is actively mined and learned, so as to generate a feature representation that can better reflect the real state of the system. At the same time, the memory module of the TGN maintains a long-term evolving historical state vector for each service instance, which can establish a stable behavior baseline. This makes the application not only able to detect transient anomalies, but also able to accurately identify anomalies caused by mode shift or slow performance degradation that are difficult to be found by traditional methods.

[0087] In some embodiments of the application, the electronic device 300 can include one or more processors 301, a memory 302, a display 303, one or more application programs (not shown), and one or more computer programs 304, which can be connected through one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors, and the one or more computer programs 304 include instructions that can be used to perform various steps in the method embodiments of the application and corresponding embodiments. Figure 3 Figure 1

[0088] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above functional modules is taken as an example for illustration, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0089] The functional units in each embodiment of the application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0090] ​​The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: flash memory, mobile hard disk, read-only memory, random access memory, magnetic disk or optical disk, and various media that can store program codes.

[0091] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A microservice multimodal anomaly detection method based on dynamic graph learning, characterized in that, include: Multimodal observable data is collected from the microservice system. The multimodal observable data includes metric data, call chain data, and log data. When collecting metric data and log data, the metadata tags of the physical instances carrying the corresponding data are attached to the data, and the log data carries the trace identifiers generated by the microservice system for external requests. The multimodal observable data is preprocessed, including alignment and windowing to obtain data features of metric data, call chain data, and log data. Based on the association between these data features and the physical instances carrying the data, entity binding is performed on the data features to obtain a node data table recording the state of physical instances within each time window and an edge data table recording the interactions between physical instances. Specifically, entity binding of data features includes: aggregating data features related to the same physical instance within each time window based on the association between the metadata tags of physical instances and the metric and log data, and the association between the tracking identifiers carried in the log data and the call chain data; constructing a node data table based on the state of each physical instance within each time window, and constructing an edge data table based on the interactions between physical instances within each time window. By using time windows as an index to filter node and edge data within the same time window, multiple graph snapshots arranged in chronological order are constructed to form a graph snapshot sequence. Time edges are created based on the same physical instance nodes between adjacent graph snapshots to obtain a dynamic graph of microservice system behavior. A memory state vector is created for each node in the dynamic graph. When an interaction event occurs in the dynamic graph, the memory state vector of each node participating in the interaction event is updated. The updated memory state vector of each node participating in the interaction event is combined with the current fusion feature vector to generate the final node representation. Updating the memory state vector of each node participating in the interaction event includes: collecting the memory state vectors of all neighboring nodes of the node participating in the interaction event in the previous time window and the fusion feature vector of the current time window, aggregating the collected neighboring node information to obtain aggregated information; and sending the aggregated information to the entry control loop unit to update the memory state vector of the node participating in the interaction event. For each node, a nonlinear transformation is performed on the final node representation in each time window to obtain the anomaly prediction probability. When the anomaly prediction probability is greater than the preset decision threshold, the physical instance corresponding to the node is judged as an anomaly in the corresponding time window.

2. The method according to claim 1, characterized in that, Data features obtained through alignment and windowing include: Define a common time window; The indicator data, call chain data, and log data are grouped according to the length of the common time window. Multiple aggregation functions are applied to the grouped indicator data to obtain multi-dimensional statistical features, thereby generating indicator feature vectors. The log sets obtained by grouping are structured to extract log templates, and the log sets are vectorized according to a pre-built global ordered dictionary to obtain log template counting vectors; The grouped call chain data is statistically analyzed to generate feature values ​​that describe node and edge characteristics.

3. The method according to claim 1, characterized in that, The construction of the image snapshot sequence includes: The node data table and edge data table are filtered to obtain node data and edge data within the same time window. The nodes in the graph snapshot are created based on the filtered node data, and the directed edges of the graph snapshot are constructed based on the filtered edge data, thus obtaining the graph snapshot of the corresponding time window. Using time windows as indexes, data filtering is performed for each time window, and a sequence of multiple time-ordered graph snapshots is generated.

4. The method according to claim 1, characterized in that, The generation of aggregated information includes: Time coding is obtained by integrating the absolute time difference, relative time interval, and local time jitter between interactive events; The collected neighbor node information and time codes are weighted and aggregated using a graph attention mechanism to generate aggregate information. The generation of aggregate information satisfies the following formula: ,in, Indicates within the time window For nodes The aggregated information This represents the graph attention function. Representing neighboring nodes In the previous time window The memory state vector, Representing neighboring nodes In the current time window The fused feature vector, Represents a node and Time encoding of interactions between them Indicates traversing nodes All neighboring nodes .

5. The method according to claim 1, characterized in that, The entire dataset is divided into training sets according to time order, and anomaly labels are marked on the training sets. The entire dataset includes node data tables and edge data tables corresponding to all time windows. On the training set, a subset of features is selected based on the mutual information score between data features and anomaly labels; When calculating the fused feature vector of a node, a dense vector representation of the node's categorical features is generated based on the feature subset. The dense vector representation of the node and the numerical features are then interacted through explicit and implicit interaction networks, and the outputs of the two interaction networks are concatenated to generate the fused feature vector.

6. The method according to claim 5, characterized in that, Set up the encoder-decoder structure; Extract categorical features from the preprocessed multimodal observable data and map the extracted categorical features to an initial feature vector; An encoder is used to perform nonlinear compression on the initial feature vector to generate a dense vector representation that reflects the category attribute. A decoder is used to restore the dense vector representation generated by the encoder to the original category feature information. A self-supervised learning mode is used to optimize the encoder-decoder structure by minimizing the reconstruction error between the initial feature vector and the reconstructed category feature information. When calculating the fused feature vector of a node, a dense vector representation of the node's categorical features is generated using the optimized and trained encoder.

7. The method according to claim 5, characterized in that, The explicit interaction between the dense vector representation of a node and its numerical features includes: performing a bitwise vector product operation on the dense vector representation of the node and its numerical features to generate an explicit interaction vector; The implicit interaction between the dense vector representation of a node and its numerical features includes: concatenating the dense vector representation of a node and its numerical features and then inputting the concatenation into a multilayer perceptron to generate an implicit feature vector.

8. The method according to claim 1, characterized in that, The selection of the decision threshold includes: selecting candidate thresholds within the probability interval of the output by a fixed step size; On the validation set, the abnormal prediction results are obtained by comparing different candidate thresholds with the abnormal prediction probability, and the prediction results under different candidate thresholds are compared with the true labels. Calculate and analyze the change curves of key performance indicators to select the optimal threshold that maximizes detection efficiency as the decision threshold.

Images