Microservice anomaly detection method and device

Abstract

The invention relates to a micro-service anomaly detection method and device. The micro-service anomaly detection method comprises the following steps: acquiring multi-source index data of a micro-service system, and preprocessing the multi-source index data to obtain preprocessed multi-source index data; performing spatial dimension feature extraction on the preprocessed multi-source index data through a convolutional neural network model to obtain a spatial feature vector; performing time sequence feature extraction on the spatial feature vector through a bidirectional long short-term memory network model to obtain a hidden state of each time step; obtaining the weight coefficient of the hidden state of each time step through an attention mechanism, and carrying out the weighted summation of the hidden states of all time steps based on the weight coefficients, and obtaining an attention fusion feature; and according to the attention fusion features, abnormal indexes of the micro-service are detected and predicted.

Description

Technical Field

[0001] This application relates to the field of microservice technology, and in particular to a method and apparatus for detecting microservice anomalies. Background Technology

[0002] With the rapid development of information technology, the scale and complexity of enterprise applications are constantly increasing. To better cope with this change and meet the needs of business flexibility, scalability, and rapid iteration, microservice architecture has permeated many industries, such as e-commerce, fintech, internet services, and the Internet of Things. However, with the widespread application of microservice systems, the complexity of their management and operation is also becoming increasingly prominent. Due to the large number and interrelationship of microservices, an anomaly in any microservice can trigger a chain reaction, affecting the performance and availability of related dependent services and even the entire microservice system, leading to problems such as degraded user experience and business losses. Therefore, timely detection of microservice anomalies to ensure the stable operation of microservices has become an urgent technical problem to be solved. Summary of the Invention

[0003] Therefore, it is necessary to provide a microservice anomaly detection method, device, computer equipment, computer-readable storage medium, and computer program product to address the above-mentioned technical problems, which can detect and predict anomaly indicators of microservices and achieve comprehensive monitoring of microservices.

[0004] Firstly, this application provides a microservice anomaly detection method, which includes:

[0005] Obtain multi-source indicator data from the microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data.

[0006] Spatial dimension features are extracted from the preprocessed multi-source index data using a convolutional neural network model to obtain spatial feature vectors.

[0007] Using a bidirectional long short-term memory network model, time-series features are extracted from the spatial feature vector to obtain the hidden state at each time step;

[0008] By using an attention mechanism, the weight coefficients of the hidden state at each time step are obtained, and the hidden states at all time steps are weighted and summed based on the weight coefficients to obtain the attention fusion feature.

[0009] Based on the attention fusion features, abnormal indicators of microservices are detected and predicted.

[0010] In one embodiment, the step of extracting spatial dimension features from the preprocessed multi-source indicator data using a convolutional neural network model to obtain a spatial feature vector includes:

[0011] The convolutional layers in the convolutional neural network model are used to perform convolution operations on the preprocessed multi-source index data to obtain feature maps.

[0012] The feature map is processed by modifying the linear unit activation function to obtain the feature map after activation function processing;

[0013] Max pooling is performed on the feature map processed by the activation function through the pooling layer in the convolutional neural network model to obtain the pooled feature map.

[0014] The pooled feature maps are integrated by a fully connected layer to obtain the spatial feature vector.

[0015] In one embodiment, the step of performing a convolution operation on the preprocessed multi-source index data through the convolutional layer in the convolutional neural network model to obtain a feature map includes:

[0016] The preprocessed multi-source index data is converted into different formats according to different types to obtain format-converted multi-source index data.

[0017] The feature map is obtained by performing convolution operations on the multi-source index data after format conversion through the convolutional layers in the convolutional neural network model.

[0018] In one embodiment, the feature map obtained by the convolution operation... for:

[0019]

[0020] in, For convolution kernel, This is the multi-source indicator data after format conversion.

[0021] In one embodiment, the feature map after activation function processing... for:

[0022]

[0023] in, This is the feature map obtained from the convolution operation.

[0024] In one embodiment, the pooled feature map for:

[0025]

[0026] in, The feature map after activation function processing. For the number of rows in the pooled window, This represents the number of columns in the pooled window.

[0027] In one embodiment, spatial feature vectors for:

[0028]

[0029] in, This is the weight matrix of the fully connected layer. This is the bias vector.

[0030] In one embodiment, the hidden state at each time step for:

[0031]

[0032]

[0033] in, This represents the hidden state output by the feedforward long short-term memory network layer at time step t. For backward long short-term memory network layers at time steps The hidden state of the output. Let be the spatial eigenvectors at time step t. For Sigmoid activation function, The hyperbolic tangent activation function is used. Here is the weight matrix for the forget gate. Let be the weight matrix of the input gate, and Wo be the weight matrix of the output gate. This is the weight matrix used to calculate the candidate cell states. Let be the bias vector of the forget gate. Let bo be the bias vector of the input gate, and bo be the bias vector of the output gate. This is the bias vector used to calculate the state of the candidate cell.

[0034] In one embodiment, the step of obtaining the weight coefficients of the hidden state at each time step through an attention mechanism, and then performing a weighted summation of the hidden states at all time steps based on the weight coefficients to obtain the attention fusion feature, includes:

[0035] Determine the correlation score between the hidden state and the anomaly indicator at each time step to obtain a correlation score vector;

[0036] The correlation score vector is normalized by a normalized exponential function to obtain the weight coefficient of the hidden state at each time step, wherein the sum of the weight coefficients at all time steps is 1.

[0037] In one embodiment, the correlation score vector for:

[0038]

[0039] Weight coefficients of the hidden state at each time step for:

[0040]

[0041] in, The weight matrix is ​​a learnable matrix. The hidden state at each time step, Here, T is the bias vector, and T is the total number of time steps.

[0042] In one embodiment, the step of detecting and predicting abnormal indicators of microservices based on the attention fusion features includes:

[0043] Determine the attention fusion characteristics within a preset historical time period;

[0044] Determine the mean of the attention fusion features within the preset historical time period, and determine the standard deviation of the attention fusion features within the preset historical time period;

[0045] Based on the mean and the standard deviation, the outlier intervals are determined;

[0046] If the attention fusion feature of the current time step exceeds the abnormal range, then the corresponding microservice metric is determined to be abnormal.

[0047] In one embodiment, the step of detecting and predicting abnormal indicators of microservices based on the attention fusion features includes:

[0048] Based on the attention fusion characteristics, regression analysis is used to predict abnormal indicators for a preset future time period of the microservice.

[0049] In one embodiment, the preprocessing of the multi-source indicator data to obtain preprocessed multi-source indicator data includes:

[0050] The streaming logs are processed based on the OpenTelemetry call chain and aggregated into a log group with call dependencies for the same business scenario.

[0051] An SVM classifier based on trace call chain and Jaccard text similarity is used to cluster and denoise the log group to obtain a denoised clustered log group.

[0052] The clustered log groups and corresponding call chains are merged according to business scenarios, and clustering features are extracted. These clustering features are used as input to the convolutional neural network model.

[0053] In one embodiment, the microservice anomaly detection method further includes:

[0054] Construct the convolutional neural network model and initialize the weights and biases of the convolutional neural network model using a random initialization method;

[0055] A bidirectional long short-term memory network model is constructed, and the weights and biases of the bidirectional long short-term memory network model are initialized using a random initialization method;

[0056] An attention mechanism is constructed, and the dimensions of the attention weight matrix and the attention bias vector are determined based on the feature dimensions output by the bidirectional long short-term memory network model.

[0057] Secondly, this application also provides a microservice anomaly detection device, the microservice anomaly detection device comprising:

[0058] The data acquisition module is used to acquire multi-source indicator data of the microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data.

[0059] The spatial feature module is used to extract spatial dimension features from the preprocessed multi-source index data using a convolutional neural network model to obtain a spatial feature vector.

[0060] The time feature module is used to extract time series features from the spatial feature vector using a bidirectional long short-term memory network model to obtain the hidden state at each time step.

[0061] The attention mechanism module is used to obtain the weight coefficients of the hidden state at each time step through the attention mechanism, and to perform a weighted summation of the hidden states at all time steps based on the weight coefficients to obtain the attention fusion feature.

[0062] An anomaly detection module is used to detect and predict anomaly indicators of microservices based on the attention fusion features.

[0063] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0064] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0065] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0066] The aforementioned microservice anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire multi-source indicator data of a microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data; extract spatial dimension features from the preprocessed multi-source indicator data using a convolutional neural network model to obtain spatial feature vectors; extract time-series features from the spatial feature vectors using a bidirectional long short-term memory network model to obtain the hidden state at each time step; obtain the weight coefficients of the hidden states at each time step using an attention mechanism, and perform a weighted summation of the hidden states at all time steps based on the weight coefficients to obtain attention fusion features; and detect and predict anomaly indicators of the microservice based on the attention fusion features; thereby, based on the CNN-BiLSTM-Attention model, the microservice anomaly indicators are detected and predicted. The comprehensive processing of multi-source data in the service, through an attention mechanism, enables the model to focus more on key information related to anomaly indicators, improving the accuracy of anomaly detection and prediction. Furthermore, the comprehensive processing of multi-source data can fully explore the potential relationships and complementary information between different data sources, providing more comprehensive information support for the monitoring and prediction of anomaly indicators. The solution in this application addresses technical problems in related technologies such as incomplete feature extraction, insufficient utilization of time-series information, lack of attention to key information, and poor multi-source data fusion effects. The solution in this application can more accurately detect anomaly indicators in distributed microservice systems in real time and accurately predict future anomalies, improving the stability and reliability of microservice systems, reducing system maintenance costs and failure risks. Moreover, the method of this invention has strong generalization ability and can be applied to different types of microservice systems and application scenarios. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1This is a flowchart illustrating a microservice anomaly detection method in one embodiment;

[0069] Figure 2 This is a schematic diagram of the model architecture involved in a microservice anomaly detection method in one embodiment;

[0070] Figure 3 This is a flowchart illustrating step S102 in one embodiment;

[0071] Figure 4 This is a flowchart illustrating step S104 in one embodiment;

[0072] Figure 5 This is a structural block diagram of a microservice anomaly detection device in one embodiment. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0074] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0075] Through research, the inventors of this application have discovered that, in related technologies, the methods for monitoring and predicting microservice anomaly indicators to ensure the normal operation of distributed microservice systems mainly include the following:

[0076] Rule-based and threshold-based methods. Operations personnel, based on experience and a preliminary understanding of the system, issue alerts when the monitoring system detects that a metric value violates predefined rules or exceeds a threshold. This method, relying on fixed rules and thresholds, cannot adapt to the dynamic changes in metrics under different business scenarios and load conditions within the microservice system. Furthermore, simply comparing metric values ​​with thresholds requires manual consideration of the interrelationships between different metrics and their complex changes over time, demonstrating weak ability to handle complex relationships.

[0077] Methods based on traditional machine learning models. Some research and practice have adopted traditional machine learning models, such as decision trees, support vector machines (SVM), or Naive Bayes, to monitor and predict anomaly indicators in microservices. Taking decision trees as an example, microservice data is used as input, and the decision tree model is trained to learn patterns in the data, thereby determining whether anomalies have occurred. While traditional machine learning models can process data and detect anomalies to a certain extent, they also have some shortcomings. First, they are highly dependent on feature engineering: a large amount of manual feature engineering is required, such as selecting appropriate features and encoding features. This is not only time-consuming and labor-intensive, but also requires a high level of professional knowledge from the operators. If the feature selection is inappropriate, it may seriously affect the model's performance. Second, they have limited processing capabilities for time-series data: for the large amount of time-series data in microservice systems, such as service performance monitoring data over continuous time periods, traditional machine learning models are relatively weak in processing. They struggle to effectively capture long-term dependencies and temporal change patterns in the data, thus performing poorly in predicting future anomaly indicator changes in microservices.

[0078] Methods based on a single neural network model. With the development of deep learning, related technologies have attempted to use a single neural network model to solve the problem of monitoring and predicting microservice anomalies. However, single neural network models also have significant limitations. Single-dimensional processing limitations: They only focus on processing the characteristics of a single dimension of the data; however, microservice data actually has rich spatiotemporal characteristics. For example, service logs not only contain text content, but their recording time order is also important. A single model cannot fully account for these characteristics, resulting in limited accuracy in monitoring and predicting microservice anomalies. Insufficient fusion of multi-source data: Microservice systems generate multiple data sources, such as request call chains, service logs, and various performance and resource metrics. When processing this multi-source data, a single neural network model often simply treats them as input without fully exploring the potential relationships and complementary information between different data sources. For example, when predicting microservice anomalies, it may not be able to effectively combine error information in service logs with system resource metric data from the same period, thus affecting the accuracy of the prediction.

[0079] In distributed microservice anomaly monitoring and prediction technologies, the inability to effectively extract features from different data sources when processing multi-source data leads to information loss and affects the accuracy of anomaly monitoring and prediction. For example, methods in related technologies struggle to extract deep semantic features from textual information in log data; simple statistical methods fail to capture the dynamic changes in system resource metrics. While single neural network models can capture some temporal information when processing time-series data, they lack depth in understanding long-term dependencies, especially in microservice systems where the complexity and dynamism of business operations make accurate utilization of temporal information crucial. For instance, models in related technologies may fail to accurately predict performance fluctuations over long periods when predicting microservice performance changes. Furthermore, there is a lack of focus on critical information: methods in related technologies often treat all data equally, neglecting key information. In microservice systems, certain data points are crucial for anomaly detection, but methods in related technologies fail to highlight the importance of this key information, leading to misjudgments or omissions. Furthermore, the multi-source data fusion effect is poor: the multi-source data fusion methods in related technologies are simple and cannot give full play to the synergistic effect between different data sources, resulting in low quality of fused data and affecting the effectiveness of abnormal indicator monitoring and prediction.

[0080] In view of this, the microservice anomaly detection method provided in this application embodiment can at least solve the problem of difficulty in detecting and predicting multi-source data when performing microservice anomaly diagnosis in related technologies.

[0081] The technical solutions in this application are applicable to both single-node microservices and distributed microservices. Distributed microservices are a software architecture that decomposes a large, complex application into multiple small, independently deployed and running microservices. These microservices collaborate in a distributed computing environment, communicating over a network to complete the overall application's functionality. Each microservice focuses on completing a specific business function, possessing its own independent database (which can be shared or independent depending on the situation), runtime environment, and deployment mechanism. They can be developed using different programming languages ​​and technical frameworks and can be independently extended, upgraded, and maintained, improving the application's flexibility, scalability, and maintainability.

[0082] The microservice anomaly detection method provided in this application embodiment can be executed, for example but not limited to, by independently deployed monitoring or detection components, and can be executed by a centralized monitoring platform, etc.

[0083] In some exemplary embodiments, combined with Figure 1 and Figure 2A microservice anomaly detection method is provided, which may include the following steps S101~S105.

[0084] S101: Obtain multi-source indicator data from the microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data.

[0085] Step S101 is used for data acquisition and data preprocessing.

[0086] Multi-source metric data can be collected from microservice systems. Multi-source metric data includes, but is not limited to, request call chain data, log data, service performance monitoring data, middleware monitoring metric data, and system resource metric data.

[0087] The request call chain data includes OTel (OpenTelemetry, an open-source observability framework) call chain data. Specifically, the request call chain data includes, but is not limited to: distributed tracing data collected in accordance with the OTel specification, and call chain data generated by tracing tools such as SkyWalking, Zipkin, and Jaeger (the core of which includes call chain topology, call time of each service / component, request ID, parameter context, call result status, etc.).

[0088] Log data includes business logs and system logs printed by application services. Specifically, log data includes, but is not limited to: business log data printed by application services (including microservices) (such as user operation records, business process results, and exception error details), underlying system log data (such as operating system, runtime environment, and container / cluster orchestration system logs), and microservice tracing log data (such as cross-service call full-link records and time consumption logs for each stage).

[0089] In addition to the log data mentioned above, as an example, the following log data may also be included: 1) Middleware log data: such as database slow query logs, MQ (Message Queue) message delivery failure logs, and Redis operation logs (which are the middleware's own runtime logs, falling between business logs and system logs, and are also an important source of multi-source metric data). 2) Gateway log data: such as API (Application Programming Interface) gateway request forwarding logs, rate limiting interception logs, and cross-domain access logs (critical logs at the microservice entry point, used to monitor entry layer anomalies).

[0090] Service performance monitoring data includes commonly used business metrics such as concurrent requests per second (QPS), system response time, and business error rate. Specifically, service performance monitoring data includes, but is not limited to, requests per second (QPS), concurrent requests, system / interface response time (including average response time and P95 / P99 quantiles), and business error rate (including system error rate and business logic error rate).

[0091] Middleware monitoring metrics include database performance metrics, message queue metrics for message middleware, and permission monitoring metrics for security middleware. Specifically, middleware monitoring metrics include, but are not limited to: database performance and status metrics (such as query time, connection pool utilization, and number of slow queries), message middleware queue and flow metrics (such as message backlog, production / consumption rate, and delivery success rate), security middleware permission and access control metrics (such as permission verification pass rate, number of illegal access interceptions, and token expiration frequency), and caching middleware read / write and hit metrics (such as cache hit rate, read / write time, and number of expired keys).

[0092] System resource metrics include CPU (Central Processing Unit) load and utilization, memory utilization, bandwidth utilization, disk utilization, disk read / write speed and I / O (Input / Output) latency, network I / O, network bandwidth utilization, and network latency. Specifically, system resource metrics include, but are not limited to: CPU load (1 / 5 / 15-minute load values), CPU utilization; memory utilization, used / remaining memory capacity; disk utilization, disk read / write IOPS, disk read / write throughput (speed), disk I / O latency; network transmit / receive bandwidth utilization, network I / O throughput, network latency (round-trip time, RTT), and network packet loss rate.

[0093] In addition to the system resource metrics data mentioned above, as an example, the following system resource metrics data may also be included:

[0094] Process-level resource metrics: CPU utilization and memory usage of a single microservice process (distinct from overall node resources, accurately pinpointing resource overload in a specific service). Cloud-native specific metrics: Pod resource request / limit utilization (e.g., CPU request utilization, memory limit utilization) and container PID (Process Identifier) ​​limit utilization on Kubernetes nodes. Hardware health metrics: Server CPU temperature and power status (commonly used in physical machine deployments to prevent hardware failures from causing resource anomalies).

[0095] In other words, in step S101, data collection tools can be used to collect request call chain data, log data, service performance monitoring data, middleware monitoring metrics data, and system resource metrics data from various nodes of the microservice system. For call chain data: Based on the OpenTelemetry protocol, the call chain entry points of each microservice in the system are improved, and collected through probe deployment or actively reported to the system by the SDK (Software Development Kit). For log data: Key information, such as error logs and warning logs, is extracted from the log files of each service node using internal log collection probes or open-source log collectors. For system resource metrics data: Relevant metrics (such as CPU utilization, memory utilization, network I / O, bandwidth utilization, etc.) are collected through internal system monitoring or by using the open-source Prometheus.

[0096] In step S101, data preprocessing may include: cleaning the collected data, removing duplicate data, abnormal data and noisy data, normalization, pre-association and other preprocessing operations to improve the quality and usability of the data.

[0097] Outliers in system resource metrics can be identified and removed through statistical analysis. For example, for CPU utilization data, if the utilization rate at a certain point in time is significantly higher than the normal range (obtained through historical data statistics, not data from system failure points), then that data point is considered an outlier and removed.

[0098] For garbled characters and incomplete information in the log data, repair and supplementation are performed. For log and call chain data, streaming log data clustering and noise reduction methods can be used to pre-associate and fuse logs and call chains according to business scenarios, and the characteristic data of the business scenarios can be re-added to the multi-source data.

[0099] Then, the cleaned data is normalized to map it to the [0, 1] interval for model training and prediction. For example, for CPU utilization data, the actual value is divided by the server's maximum CPU utilization to obtain a normalized value in the [0, 1] interval.

[0100] Optionally, the multi-source indicator data is preprocessed to obtain preprocessed multi-source indicator data, including: processing streaming logs based on OpenTelemetry call chains to aggregate them into log groups with call dependencies for the same business scenario; performing clustering and noise reduction on the log groups based on an SVM classifier using trace call chains and Jaccard text similarity to obtain denoised clustered log groups; and fusing the clustered log groups with the corresponding call chains according to business scenarios to extract clustering features, which are then used as input to a convolutional neural network model.

[0101] Specifically: 1) Conventional data preprocessing operations include denoising (using the 3σ criterion) and normalization (mapping to the [0, 1] interval); 2) Data pre-association operations are performed on the streaming log data and call chain data of the microservice system. The steps are as follows: a) The streaming log data is coarsely processed based on the OpenTelemetry call chain. The coarse processing includes format standardization (unifying field naming rules) and redundant field removal. Logs with call dependencies in the same business scenario are associated and aggregated into log groups; b) The streaming logs are clustered and denoised using an SVM classifier based on trace call chain and Jaccard text similarity. The Jaccard text similarity threshold is set to 0.7. The SVM classifier uses the radial basis function (RBF). The clustering objective is to group logs with semantic similarity ≥ 0.7 into one class and remove noise from unrelated isolated logs; c) The clustered log groups and the corresponding call chain data are merged according to the business scenario. Clustering features (including log frequency, call chain depth, and number of occurrences of abnormal keywords) are extracted. The clustering features are used as the input data for the next convolutional neural network convolutional layer.

[0102] In other words, in addition to conventional data preprocessing, this invention adds a data pre-association operation. A streaming log data clustering and denoising method is used to pre-associate logs and call chains: First, the streaming log data from the business system is coarsely processed using OpenTelemetry call chains, aggregating business scenario logs with call dependencies. Then, an SVM classifier based on trace call chains and Jaccard text similarity is used to cluster and denoise the streaming logs. This method allows log and call chain data in a single format to be merged together in a business format, and clustering features are extracted as input to the convolutional layers of the convolutional neural network in the next step.

[0103] In the above embodiments, streaming logs are first processed into business scenario log groups with dependencies using OpenTelemetry call chains, integrating business association information of microservices. Then, log clustering and noise reduction are achieved by combining trace call chains with an SVM classifier based on Jaccard similarity, effectively filtering out redundant and interfering data while retaining core business features. Finally, the clustered log groups and call chains are fused according to business scenarios to extract features, which not only strengthens the business association of multi-source data but also provides a high-quality input foundation that fits the microservice business logic for subsequent spatial feature extraction by convolutional neural networks. This preprocessing process solves the problems of messy and noisy multi-source log data and allows subsequent feature extraction to focus more on the actual business operation rules of microservices. Combined with the preceding spatiotemporal feature extraction and anomaly detection logic, it improves the accuracy and business adaptability of anomaly detection, making it particularly suitable for business-level anomaly monitoring needs in complex distributed microservice scenarios.

[0104] S102 uses a convolutional neural network model to extract spatial dimension features from the preprocessed multi-source index data, resulting in spatial feature vectors.

[0105] A CNN (Convolutional Neural Network) is a type of feedforward neural network whose artificial neurons can respond to surrounding units within a certain coverage area. It has unique advantages in processing spatially structured data (such as images or text) and can extract local features of the data. In this embodiment, a CNN is used to extract the spatial dimensional features of microservice-related data.

[0106] CNNs focus on spatial features. CNN models excel at extracting spatial features from data. For data with spatial structure in microservices, such as request call chains (which can be viewed as a structured network graph) and service log text (which can be transformed into an image-like structure for processing), they can extract feature information.

[0107] In step S102, a CNN is used to extract features from the preprocessed multi-source data to obtain the spatial features of the data. That is, the preprocessed multi-source monitoring data enters the feature extraction stage, and the spatial features of the data are extracted by a convolutional neural network (CNN).

[0108] S103 uses a bidirectional long short-term memory network model to extract time-series features from spatial feature vectors, obtaining the hidden state at each time step.

[0109] Bidirectional Long Short-Term Memory (BiLSTM) is an improved recurrent neural network with memory capabilities, enabling it to process time-series data. It consists of LSTM layers in both forward and backward directions, allowing it to consider both past and future information simultaneously, thus better capturing the temporal characteristics of the data. In this embodiment, BiLSTM is used to model and analyze the time-series data of microservices.

[0110] LSTM focuses on the time series dimension. For example, LSTM models are primarily used to process time series data, and their unique memory unit structure allows them to capture long-term dependencies in the data to a certain extent. In microservice scenarios, they can be used to analyze time-series data such as service performance monitoring data over consecutive time periods to predict whether future anomalies will occur.

[0111] In step S103, the features extracted by the CNN are input into the BiLSTM for temporal modeling to capture the time-series features of the data. That is, the spatial feature vectors are arranged in chronological order to form a temporal feature sequence, which is then input into the Bidirectional Long Short-Term Memory (BiLSTM) network model for time-series feature extraction, and the hidden state at each time step is output (the hidden state is the high-order time-series feature learned by the BiLSTM).

[0112] S104. Through the attention mechanism, the weight coefficients of the hidden state at each time step are obtained, and the hidden states at all time steps are weighted and summed based on the weight coefficients to obtain the attention fusion feature.

[0113] Attention is a mechanism that simulates human concentration, assigning different weights to data based on its importance, thus enhancing the model's focus on key information. In this embodiment, the attention mechanism is combined with BiLSTM, enabling the model to pay more attention to parts closely related to microservice anomaly indicators, thereby improving the accuracy of anomaly detection and prediction.

[0114] In step S104, an attention mechanism is introduced into the output layer of the BiLSTM to weight the model's output and highlight information closely related to anomalies. Specifically, the attention mechanism calculates the weight coefficients of the hidden states at each time step (the weight coefficients are adaptively learned by the model based on feature importance), and the hidden states at all time steps are weighted and summed based on the weight coefficients to obtain the attention fusion features.

[0115] S105 detects and predicts abnormal indicators of microservices based on attention fusion characteristics.

[0116] In step S105, based on the results processed by the attention mechanism, abnormal indicators of the microservice are detected and predicted in real time. Optionally, the attention fusion features are input into a preset detection model to detect and predict the trends of abnormal indicators of the microservice in real time.

[0117] The technical solution of this application, by acquiring and preprocessing multi-source indicator data, can integrate operational information from various dimensions of a microservice system, filter out noise interference, and lay a high-quality data foundation for subsequent feature extraction. Secondly, it utilizes a convolutional neural network model to extract spatial dimension features, effectively capturing the correlation and dependency relationships between multi-source indicators. Then, it mines time-series features through a bidirectional long short-term memory network model, completely preserving the temporal evolution patterns of the indicator data, achieving comprehensive coverage of spatiotemporal dimension features. Furthermore, it introduces an attention mechanism to assign weight coefficients to the hidden states at each time step and performs a weighted summation, adaptively focusing on key temporal features more valuable for anomaly detection, strengthening the representation ability of effective information, and reducing interference from irrelevant features. Finally, it performs anomaly detection and prediction based on attention fusion features, combining the comprehensiveness of multi-source data, the correlation of spatiotemporal features, and the targeting of key features, improving the accuracy and timeliness of anomaly detection. This enables rapid identification of potential anomalies in the microservice system and early warning, effectively reducing service interruptions or performance degradation caused by anomaly expansion, providing reliable assurance for the stable operation of the microservice system, and is particularly suitable for high-precision anomaly monitoring needs under complex distributed microservice architectures.

[0118] In some exemplary embodiments, reference is made to Figure 3 Step S102 involves using a convolutional neural network model to extract spatial dimension features from the preprocessed multi-source index data to obtain spatial feature vectors, which may include the following steps S301~S304.

[0119] S301 uses the convolutional layers in the convolutional neural network model to perform convolution operations on the preprocessed multi-source index data to obtain feature maps.

[0120] Optionally, step S301 may include the following steps: converting the preprocessed multi-source index data into different formats according to their different types to obtain format-converted multi-source index data; and performing convolution operations on the format-converted multi-source index data through the convolutional layers in the convolutional neural network model to obtain feature maps.

[0121] By adding a classification format conversion step for multi-source indicator data before the convolutional operation of the convolutional neural network, the preprocessed multi-source indicator data is first converted according to data type. This ensures that different types of data (such as performance indicators, business indicators, resource consumption indicators, etc.) can adapt to the input requirements of the convolutional layer, avoiding feature extraction distortion or model malfunction caused by data format differences. This lays a standardized data foundation for subsequent convolutional operations. When the formatted multi-source indicator data is processed by the convolutional layer, it can more accurately capture the internal correlation of similar indicators and the cross-dimensional dependencies of different types of indicators, further enhancing the representation quality of spatial dimension features. Combined with the temporal feature extraction of the bidirectional long short-term memory network and the key information focusing of the attention mechanism, the final attention fusion features are more targeted and effective, thereby improving the accuracy of anomaly detection and prediction.

[0122] This process involves appropriately formatting different types of data according to their characteristics. For example, call chains and log data are converted into two-dimensional feature vectors; time-series index data is compressed and mapped to a low-dimensional vector space (assuming a k-dimensional vector space) using an autoencoder, resulting in an embedding vector for each time point. For the converted data, appropriate convolutional kernel sizes and numbers are set, and convolutional operations are used to extract local features. Different convolutional kernels can capture different feature patterns in different local regions, and parallel operation of multiple convolutional kernels can extract various spatial features.

[0123] Optionally, the feature map obtained from the convolution operation for:

[0124]

[0125] in, For convolution kernel, This is the multi-source indicator data after format conversion.

[0126] This formula visualizes the convolution operation process. By performing an element-wise weighted summation of the convolution kernel K and the format-transformed multi-source indicator data X, it ensures sufficient interaction between data at different locations and the convolution kernel, stably capturing local correlations and global dependencies among multi-source indicators. It also provides clear mathematical logic support for the spatial feature extraction process, avoiding ambiguity in feature extraction. This quantifiable calculation method is compatible with standardized input data after format transformation and provides a well-structured spatial feature foundation for subsequent temporal feature extraction using bidirectional long short-term memory networks. Combined with the attention mechanism to focus on key features, it further improves the accuracy and interpretability of anomaly detection and prediction.

[0127] S302, the feature map is processed by modifying the linear unit activation function to obtain the feature map after activation function processing.

[0128] The modified linear unit activation function is the ReLU activation function. After convolution in the convolutional layer, the ReLU activation function is applied to introduce non-linearity and enhance the model's expressive power. This is used for the intermediate feature maps obtained after the convolution operation. The output is obtained by processing the data using the ReLU activation function. This enables the model to learn more complex functional relationships.

[0129] Optionally, the feature map after activation function processing. for:

[0130]

[0131] in, This is the feature map obtained from the convolution operation.

[0132] This design employs the max(0, Y) calculation method, which preserves the effective spatial features extracted by the convolution operation while suppressing negative numerical interference in the feature map, avoiding the gradient vanishing problem and making the subsequent temporal feature extraction process of the bidirectional long short-term memory network more stable. Simultaneously, the nonlinear transformation of the activation function enhances the representational ability of the features, making the spatial features more closely match the nonlinear correlation characteristics of microservice indicator data. Combined with the preceding convolution calculation logic, this further improves the quality of spatial dimension features.

[0133] S303 uses the pooling layer in the convolutional neural network model to perform max pooling on the feature map after activation function processing, and obtains the pooled feature map.

[0134] To further reduce the dimensionality of the data while retaining important feature information, a pooling layer is added after the convolutional layer. Max pooling is performed on the data to highlight the most salient features in local regions, while reducing the amount of data and facilitating subsequent processing.

[0135] Optional, pooled feature map for:

[0136]

[0137] in, The feature map after activation function processing. For the number of rows in the pooled window, This represents the number of columns in the pooled window.

[0138] By using a pooling window to aggregate the maximum values ​​of the activated feature maps, key spatial information is preserved while feature dimensionality is compressed, reducing subsequent computational overhead and meeting the real-time requirements of microservice anomaly detection. Simultaneously, pooling enhances feature robustness, reducing interference from fluctuations in microservice metrics data. Combined with the preceding activation function processing, this further improves the quality and stability of spatial features.

[0139] S304 integrates the pooled feature maps through a fully connected layer to obtain spatial feature vectors.

[0140] After the preceding convolution, activation function, and pooling operations, the extracted scattered features are finally integrated through a fully connected layer, outputting the final feature vector. That is, to obtain the feature vector containing spatial feature information. This feature vector will be used as the input for the next step of the BiLSTM model.

[0141] Optional, spatial feature vectors for:

[0142]

[0143] in, This is the weight matrix of the fully connected layer. This is the bias vector.

[0144] By leveraging the linear transformation between the weight matrix and the bias vector, the refined spatial features after pooling are integrated into a spatial feature vector with uniform dimensionality. This achieves both feature reduction and standardization, while also enhancing the representational power of key features through the weight matrix, thus adapting to the temporal feature extraction input requirements of subsequent bidirectional long short-term memory networks. This structured fully connected layer transformation inherits the feature refinement effect of pooling operations and upgrades spatial features from "local representations" to "globally correlated vector forms." Combined with the preceding convolution, activation, and pooling processes, this results in more complete and efficient feature extraction in the spatial dimension.

[0145] In some exemplary embodiments, BiLSTM consists of forward LSTM layers and backward LSTM layers, with its basic unit being a Long Short-Term Memory (LSTM) cell. For a single time step t, the internal structure of the LSTM cell involves multiple gating mechanisms to control the flow and updating of information, mainly including the Input Gate, Forget Gate, and Output Gate. The CNN output feature vector obtained in step S304 serves as the input feature vector sequence of BiLSTM. ,in This represents the total duration of the time series (i.e., the total number of time steps). Indicates the time step The input feature vector at time step Time BiLSTM basic unit structure output It can be represented as:

[0146]

[0147] Assume the feedforward LSTM layer has a time step of The output hidden state is The backward LSTM layer at the time step The hidden state of the output is So for the entire BiLSTM, at the time step... The final output is hidden. This can be obtained by concatenating the hidden states of the forward and backward views, i.e., the hidden state at each time step. for:

[0148]

[0149] in, This represents the hidden state output by the feedforward long short-term memory network layer at time step t. For backward long short-term memory network layers at time steps The hidden state of the output. Let be the spatial eigenvectors at time step t. It is the sigmoid activation function. The hyperbolic tangent activation function is used. Here is the weight matrix for the forget gate. Let be the weight matrix of the input gate, and Wo be the weight matrix of the output gate. This is the weight matrix used to calculate the candidate cell states. Let be the bias vector of the forget gate. Let bo be the bias vector of the input gate, and bo be the bias vector of the output gate. This is the bias vector used to calculate the state of the candidate cell.

[0150] By combining the hidden states of forward and backward LSTMs, the method captures the bidirectional temporal correlation of microservice metrics data (including both historical evolution patterns and subsequent trend influences), compensating for the information gaps in unidirectional temporal models. Simultaneously, through fine-grained control of the forget gate, input gate, and output gate, it adaptively filters effective content from the temporal information (such as retaining key anomaly features and filtering redundant fluctuations). Combined with the nonlinear transformation of the Sigmoid and tanh activation functions, it enhances the representational power of temporal features. This structured hidden state computation not only inherits the high-quality spatial feature vectors from the previous output but also provides a richer and more accurate temporal feature foundation for the subsequent attention mechanism. Ultimately, this helps the attention fusion features better align with the temporal evolution patterns of microservice anomalies, improving the accuracy and timeliness of anomaly detection and prediction, and making the method both robust and accurate in the dynamic operation scenarios of complex microservice systems.

[0151] Steps S301 to S304 described above first capture the spatial correlation features of multi-source indicators through convolutional layers, then suppress ineffective negative features and enhance nonlinear representation capabilities through modified linear unit activation functions, followed by refining key features and reducing computational overhead using max pooling layers, and finally integrating them into a standardized spatial feature vector through fully connected layers. This achieves an ordered transformation of multi-source indicator data from raw input to high-quality spatial features. This processing chain ensures both the comprehensiveness (covering multi-indicator correlations) and accuracy (focusing on key information) of spatial dimension features, and provides a highly adaptable input foundation for subsequent temporal feature extraction by bidirectional long short-term memory networks. Combined with Bi-LSTM and attention mechanisms, the entire method can simultaneously consider the spatiotemporal dimension features of microservice indicators, improving the accuracy and robustness of anomaly detection, effectively adapting to the multi-source indicator monitoring scenarios of complex microservice systems, and providing reliable feature support for the accurate identification and prediction of microservice anomalies.

[0152] In some exemplary embodiments, reference is made to Figure 4 Step S104 involves obtaining the weight coefficients of the hidden state at each time step through an attention mechanism, and then performing a weighted summation of the hidden states at all time steps based on the weight coefficients to obtain the attention fusion feature. This may include the following steps S401 to S402.

[0153] S401, determine the correlation score between the hidden state and the anomaly indicator at each time step to obtain the correlation score vector.

[0154] Specifically, the output for each time step is calculated. The correlation score between the value and the anomaly indicator is used to determine the attention weights. This is achieved through a learnable weight matrix. and bias vector After performing a linear transformation and then passing through The activation function yields a relevance score vector.

[0155] Optional, correlation score vector for:

[0156]

[0157] in, The weight matrix is ​​a learnable matrix. The hidden state at each time step, This is the bias vector.

[0158] S402, normalize the correlation score vector by using a normalized exponential function to obtain the weight coefficient of the hidden state at each time step, where the sum of the weight coefficients of all time steps is 1.

[0159] The normalization exponential function is the softmax function. This is achieved by analyzing the correlation score vector. Perform a softmax operation to transform it into an attention weight vector. This ensures that the sum of the attention weights for all time steps is 1, thus obtaining the attention weights for each time step. This indicates the correlation between the BiLSTM output at that time step and the anomaly indicator.

[0160] Optional, the weight coefficients of the hidden state at each time step. for:

[0161]

[0162] Where T is the total number of time steps.

[0163] First, a learnable weight matrix and bias vector are used, combined with a tanh activation function, to calculate the relevance score of the hidden state at each time step, achieving a non-linear correlation measure of temporal features. Then, a softmax function is used to convert the score into weight coefficients, adaptively allocating the importance ratio of the hidden state at different time steps. This process not only inherits the bidirectional temporal hidden state output of Bi-LSTM, but also focuses on the temporal features more critical to anomaly detection (such as time steps of sudden index changes and fluctuations), avoiding the dilution of effective information caused by equalization. At the same time, the learnable parameter design allows the attention mechanism to adapt to the dynamic index characteristics of microservice systems. Combined with the spatiotemporal feature extraction link, the attention fusion features can more accurately characterize the key representations of microservice anomalies, improving the accuracy of anomaly detection and prediction, and making the method both flexible and targeted in complex microservice scenarios.

[0164] Optionally, a weighted summation can be used to obtain the attention output. This is based on the calculated attention weights. We perform a weighted summation of the outputs at all time steps of the BiLSTM to obtain the output after attention mechanism processing. This is the attention fusion feature.

[0165]

[0166] In the above embodiments, convolutional layers are first used to capture the spatial correlation features of multi-source indicators. Then, a modified linear unit activation function is used to suppress ineffective negative features and enhance nonlinear representation capabilities. Next, a max pooling layer is used to refine key features and reduce computational overhead. Finally, a fully connected layer is used to integrate them into a standardized spatial feature vector, realizing the orderly transformation of multi-source indicator data from raw input to high-quality spatial features. This processing link ensures both the comprehensiveness (covering multi-indicator correlation) and accuracy (focusing on key information) of spatial dimension features, and provides a highly adaptable input foundation for subsequent temporal feature extraction by bidirectional long short-term memory networks. With Bi-LSTM and attention mechanisms, the entire method can simultaneously take into account the spatiotemporal dimension features of microservice indicators, improving the accuracy and robustness of anomaly detection and effectively adapting to the multi-source indicator monitoring scenarios of complex microservice systems.

[0167] In some exemplary embodiments, abnormal indicators of microservices are detected and predicted based on attention fusion characteristics, including: determining attention fusion characteristics within a preset historical period; determining the mean of attention fusion characteristics within the preset historical period and determining the standard deviation of attention fusion characteristics within the preset historical period; determining an abnormal interval based on the mean and standard deviation; and determining that the corresponding microservice indicator is abnormal if the attention fusion characteristics at the current time step exceed the abnormal interval.

[0168] Statistical analysis methods can be used to determine whether any abnormalities have occurred.

[0169] As an example, one can... Historical data (i.e., data from the past period) Perform statistical analysis on the values ​​and calculate their mean. and standard deviation Then, based on business needs, a reasonable exception range is set as follows: ,in It is a constant determined based on business needs and data characteristics (usually taken as...). ).when When the current value exceeds this abnormal range, it is considered an abnormal situation. This can be expressed by the formula:

[0170]

[0171] In actual operation, new microservice-related data is continuously acquired and processed according to the aforementioned data collection, preprocessing, and feature extraction steps. For example, data is collected every minute, and after preprocessing and feature extraction, a comprehensive feature vector containing spatial and temporal features is obtained, which is then input into the trained CNN-BiLSTM-Attention model. Based on the model's output, statistical analysis methods are used to determine if any anomalies have occurred. For example, for a microservice's system response time metric, the mean and standard deviation of its output values ​​over the past 10 minutes are calculated, with the anomaly range defined as [mean - 3 × standard deviation, mean + 3 × standard deviation]. If the current system response time value exceeds this range, the metric is considered anomaly. Simultaneously, the output of the attention mechanism is used to analyze information closely related to the anomaly metric. For example, if the attention mechanism highlights a high correlation between the log data of a certain service node and the anomaly metric, further details in the log data are examined, such as whether error or warning messages exist.

[0172] In the above embodiments, the mean and standard deviation of attention fusion features from preset historical time periods are first calculated to construct an anomaly range that closely matches the normal operation of microservices. This leverages the focusing advantage of attention fusion features on key spatiotemporal information while adapting the anomaly judgment benchmark to the actual operating characteristics of the system. When the current attention fusion feature exceeds this range, the indicator is judged as abnormal, achieving objectivity and dynamic adaptability in anomaly detection. This avoids the limitations of fixed thresholds being out of touch with actual operating conditions and accurately captures abnormal fluctuations in microservice indicators that deviate from normal patterns. This logic builds upon the high-quality feature output of the aforementioned spatiotemporal feature extraction and attention fusion, moving anomaly detection from "feature representation" to "precise judgment," improving the accuracy and adaptability of anomaly identification, and effectively meeting the dynamic and personalized anomaly monitoring needs of complex microservice systems.

[0173] In some exemplary embodiments, the detection and prediction of abnormal indicators of microservices based on attention fusion characteristics includes: using regression analysis to predict abnormal indicators of microservices for a preset future time period based on attention fusion characteristics.

[0174] Among them, based on the analysis of historical data and the characteristics of current data, regression analysis is used to predict abnormal indicators in the future.

[0175] First, define some explanatory variables related to abnormal indicators (such as historical system resource indicators, service performance indicators, etc.), denoted as . And the corresponding result after attention mechanism processing (as the explained variable) is .

[0176] This is described by establishing a linear regression equation. and The relationship between them can be expressed by the regression equation as follows:

[0177]

[0178] in, It is the regression coefficient. This is the error term.

[0179] The regression coefficients are estimated using methods such as least squares to obtain the estimated regression equation. Then, the current values ​​of the explanatory variables (i.e., current system resource indicators, service performance indicators, etc.) are substituted into the estimated regression equation to predict abnormal indicators in the future. Let the predicted future time step be... ( The result is The calculation formula is as follows:

[0180] =

[0181] in, , , , ..., These are the estimated regression coefficients. It is the current time step. The explanatory variable values.

[0182] In actual operation, new relevant data about microservices is continuously acquired. Substituting current system resource and service performance metrics into the regression equation, abnormal metric values ​​are predicted for the next 10 minutes. By continuously updating the input data, future abnormal metric conditions can be predicted in real time, allowing for early system anomaly alerts. In summary, microservice anomaly detection and metric prediction can be performed based on the CNN-BiLSTM-Attention model.

[0183] In the above embodiments, by relying on the precise representation of key spatiotemporal information of microservices through attention fusion features and utilizing regression analysis to uncover the correlation patterns between features and indicator changes, it is possible to proactively predict abnormal indicators for a predetermined future time period. This approach not only inherits the high-quality attention fusion features output from the aforementioned process but also expands the functional boundaries of the method, extending from "post-event anomaly identification" to "pre-event risk warning," enabling microservice systems to perceive potential anomaly trends in advance, allowing maintenance personnel time to handle the situation, and preventing service interruptions caused by the escalation of anomalies. Simultaneously, the combination of the adaptability of regression analysis and the accuracy of attention fusion features improves the reliability of the prediction results, effectively adapting to the dynamic operating scenarios of complex microservice systems, and further strengthening the method's ability to guarantee the stability of microservices.

[0184] In some exemplary embodiments, the microservice anomaly detection method further includes: constructing a convolutional neural network model and initializing the weights and biases of the convolutional neural network model using a random initialization method.

[0185] As an example, a CNN model is constructed. The network structure parameters are determined, including the number of convolutional layers, the size and number of convolutional kernels, and the type and parameters of pooling layers. For cases containing multiple types of data (such as call chain data, log data, and system resource indicator data), three convolutional layers are set. The first convolutional layer has a 3×3 kernel size and 16 kernels to initially extract common features from different types of data; the second convolutional layer has a 5×5 kernel size and 32 kernels to further extract more complex local features; the third convolutional layer has a 3×3 kernel size and 64 kernels to enhance the extraction of key local features. Max pooling is used in the pooling layers, with a pooling window size of 2×2. Model parameters are initialized: the weights and biases of the CNN model are initialized using a random initialization method. For example, for the weight matrix of the convolutional layers, its elements are initialized to random values ​​in the range [-0.1, 0.1], and the bias vector is initialized to 0. Set training parameters: Select a suitable optimization algorithm, such as the Adam optimization algorithm, and set the learning rate to 0.001 and the batch size to 32. Also, determine the number of training epochs to be 100, meaning 100 iterations of training on the entire dataset.

[0186] In some exemplary embodiments, the microservice anomaly detection method further includes: constructing a bidirectional long short-term memory network model and initializing the weights and biases of the bidirectional long short-term memory network model using a random initialization method.

[0187] As an example, a BiLSTM model is constructed. The number of units and layers is determined: based on the length and complexity of the time series data, the number of units and layers in the forward and backward LSTM layers of the BiLSTM model are determined. For time series with long lengths and certain periodicity and trends, the number of units in both the forward and backward LSTM layers is set to 64, and the number of layers is 2. This better captures long-term dependencies and temporal variation patterns in the data. Model parameters are initialized: the weights and biases of the BiLSTM model are initialized using a random initialization method. For the weight matrices of the input gate, forget gate, and output gate of the LSTM unit, their elements are initialized to random values ​​in the interval [-0.1, 0.1], and the bias vector is initialized to 0.

[0188] In some exemplary embodiments, the microservice anomaly detection method further includes: constructing an attention mechanism and determining the dimensions of the attention weight matrix and the attention bias vector based on the feature dimensions output by the bidirectional long short-term memory network model.

[0189] As an example, we introduce an attention mechanism. Determine the dimensions of the attention weight matrix and bias vector: Based on the 128-dimensional feature dimension of the BiLSTM output, determine the dimensions of the attention weight matrix and bias vector to be 128×1. Initialize the attention parameters: Initialize the elements of the attention weight matrix to random values ​​in the interval [-0.1, 0.1], and initialize the bias vector to 0.

[0190] In the above embodiments, a convolutional neural network and a bidirectional long short-term memory network are first constructed, and the weights and biases of the two models are initialized using a random initialization method. This provides a foundation of initial parameters without prior bias for model training, avoiding the slow convergence or local optima problems caused by fixed initial values. Then, the dimensions of the attention weight matrix and bias vector are matched according to the output feature dimension of the bidirectional long short-term memory network, ensuring accurate adaptation between the attention mechanism and the feature output of the preceding model. This model construction and parameter adaptation process not only ensures the independence and rationality of each deep learning model, but also achieves efficient collaboration between models through dimension matching. This makes the subsequent feature extraction and anomaly detection processes more stable and converge faster, while improving the engineering feasibility and adaptability of the entire method, effectively supporting accurate anomaly detection and prediction in complex microservice multi-source indicator scenarios.

[0191] The technical effects of this application's embodiments include the ability to detect and predict anomalies in microservices using multiple indicator data sources, and to detect system anomalies from multi-dimensional information such as application service layer (call chain data source, application logs, business scenario indicator data) and system resource layer (CPU, memory, network bandwidth, etc.).

[0192] The main inventive point of this application is the comprehensive processing of multi-source data for microservices based on the CNN-BiLSTM-Attention model. Through the attention mechanism, the model can focus more on key information related to anomaly indicators, improving the accuracy of anomaly detection and prediction. Furthermore, the comprehensive processing of multi-source data can fully explore the potential relationships and complementary information between different data sources, providing more comprehensive information support for the monitoring and prediction of anomaly indicators.

[0193] This application addresses the technical problems in existing technologies, such as incomplete feature extraction, insufficient utilization of temporal information, lack of attention to key information, and poor multi-source data fusion. Therefore, it enables more accurate real-time detection of abnormal indicators in distributed microservice systems and accurate prediction of future anomalies. This improves the stability and reliability of microservice systems and reduces system maintenance costs and failure risks. Furthermore, the method of this application has strong generalization capabilities and can be applied to different types of microservice systems and application scenarios.

[0194] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0195] Based on the same inventive concept, this application also provides a microservice anomaly detection device for implementing the microservice anomaly detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more microservice anomaly detection device embodiments provided below can be found in the limitations of the microservice anomaly detection method described above, and will not be repeated here.

[0196] In one exemplary embodiment, such as Figure 5 As shown, a microservice anomaly detection device is provided, comprising:

[0197] The data acquisition module 510 is used to acquire multi-source indicator data from the microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data.

[0198] The spatial feature module 520 is used to extract spatial dimension features from the preprocessed multi-source index data using a convolutional neural network model to obtain spatial feature vectors.

[0199] The time feature module 530 is used to extract time series features from the spatial feature vector through a bidirectional long short-term memory network model to obtain the hidden state at each time step.

[0200] Attention mechanism module 540 is used to obtain the weight coefficients of the hidden state at each time step through the attention mechanism, and to perform a weighted summation of the hidden states at all time steps based on the weight coefficients to obtain the attention fusion feature.

[0201] The anomaly detection module 550 is used to detect and predict anomaly indicators of microservices based on attention fusion characteristics.

[0202] In an exemplary embodiment, the spatial feature module 520 is used to perform convolution operations on the preprocessed multi-source index data through the convolutional layer in the convolutional neural network model to obtain a feature map; process the feature map through a modified linear unit activation function to obtain a feature map after activation function processing; perform max pooling operation on the feature map after activation function processing through the pooling layer in the convolutional neural network model to obtain a pooled feature map; and integrate the pooled feature map through a fully connected layer to obtain a spatial feature vector.

[0203] In an exemplary embodiment, the spatial feature module 520 is used to convert the preprocessed multi-source index data into different formats according to different types to obtain format-converted multi-source index data; and to perform convolution operation on the format-converted multi-source index data through the convolutional layer in the convolutional neural network model to obtain feature maps.

[0204] In an exemplary embodiment, the attention mechanism module 540 is used to determine the correlation score between the hidden state and the anomaly index at each time step to obtain a correlation score vector; and to normalize the correlation score vector by a normalized exponential function to obtain the weight coefficient of the hidden state at each time step, wherein the sum of the weight coefficients of all time steps is 1.

[0205] In an exemplary embodiment, the anomaly detection module 550 is used to determine the attention fusion characteristics within a preset historical time period; determine the mean of the attention fusion characteristics within the preset historical time period, and determine the standard deviation of the attention fusion characteristics within the preset historical time period; determine the anomaly interval based on the mean and standard deviation; and determine the corresponding microservice metric anomaly if the attention fusion characteristics at the current time step exceed the anomaly interval.

[0206] In one exemplary embodiment, the anomaly detection module 550 is used to predict anomaly indicators of a microservice for a preset future time period based on attention fusion characteristics and regression analysis methods.

[0207] In an exemplary embodiment, the data acquisition module 510 is used to process streaming logs based on OpenTelemetry call chains and aggregate them into log groups with call dependencies for the same business scenario; to perform clustering and noise reduction on the log groups based on an SVM classifier using trace call chains and Jaccard text similarity to obtain denoised clustered log groups; to fuse the clustered log groups with the corresponding call chains according to business scenarios and extract clustering features, which are then used as input to a convolutional neural network model.

[0208] In an exemplary embodiment, the apparatus further includes a model building module for building a convolutional neural network model and initializing the weights and biases of the convolutional neural network model using a random initialization method; building a bidirectional long short-term memory network model and initializing the weights and biases of the bidirectional long short-term memory network model using a random initialization method; building an attention mechanism and determining the dimensions of the attention weight matrix and the attention bias vector based on the feature dimensions output by the bidirectional long short-term memory network model.

[0209] Each module in the aforementioned microservice anomaly detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0210] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0211] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0212] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0213] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0214] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0215] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A microservice anomaly detection method, characterized in that, The microservice anomaly detection method includes: Obtain multi-source indicator data from the microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data. Spatial dimension features are extracted from the preprocessed multi-source index data using a convolutional neural network model to obtain spatial feature vectors. Using a bidirectional long short-term memory network model, time-series features are extracted from the spatial feature vector to obtain the hidden state at each time step; By using an attention mechanism, the weight coefficients of the hidden state at each time step are obtained, and the hidden states at all time steps are weighted and summed based on the weight coefficients to obtain the attention fusion feature. Based on the attention fusion features, abnormal indicators of microservices are detected and predicted.

2. The microservice anomaly detection method according to claim 1, characterized in that, The process involves using a convolutional neural network model to extract spatial dimension features from the preprocessed multi-source indicator data, resulting in a spatial feature vector, including: The convolutional layers in the convolutional neural network model are used to perform convolution operations on the preprocessed multi-source index data to obtain feature maps. The feature map is processed by modifying the linear unit activation function to obtain the feature map after activation function processing; Max pooling is performed on the feature map processed by the activation function through the pooling layer in the convolutional neural network model to obtain the pooled feature map. The pooled feature maps are integrated by a fully connected layer to obtain the spatial feature vector.

3. The microservice anomaly detection method according to claim 2, characterized in that, The step of performing a convolution operation on the preprocessed multi-source index data through the convolutional layers in the convolutional neural network model to obtain a feature map includes: The preprocessed multi-source index data is converted into different formats according to different types to obtain format-converted multi-source index data. The feature map is obtained by performing convolution operations on the multi-source index data after format conversion through the convolutional layers in the convolutional neural network model.

4. The microservice anomaly detection method according to claim 2, characterized in that, Feature maps obtained from convolution operations for: in, For convolution kernel, This is the multi-source indicator data after format conversion.

5. The microservice anomaly detection method according to claim 2, characterized in that, Feature maps after activation function processing for: in, This is the feature map obtained from the convolution operation.

6. The microservice anomaly detection method according to claim 2, characterized in that, Feature map after pooling for: in, The feature map after activation function processing. For the number of rows in the pooled window, This represents the number of columns in the pooled window.

7. The microservice anomaly detection method according to claim 2, characterized in that, Spatial feature vectors for: in, This is the weight matrix of the fully connected layer. This is the bias vector.

8. The microservice anomaly detection method according to claim 1, characterized in that, Hidden state at each time step for: in, This represents the hidden state output by the feedforward long short-term memory network layer at time step t. For backward long short-term memory network layers at time steps The hidden state of the output. Let be the spatial eigenvectors at time step t. For Sigmoid activation function, The hyperbolic tangent activation function is used. Here is the weight matrix for the forget gate. Let be the weight matrix of the input gate, and Wo be the weight matrix of the output gate. This is the weight matrix used to calculate the candidate cell states. Let be the bias vector of the forget gate. Let bo be the bias vector of the input gate, and bo be the bias vector of the output gate. This is the bias vector used to calculate the state of the candidate cell.

9. The microservice anomaly detection method according to claim 1, characterized in that, The process involves obtaining the weight coefficients of the hidden state at each time step through an attention mechanism, and then performing a weighted summation of the hidden states across all time steps based on these weight coefficients to obtain the attention fusion feature, including: Determine the correlation score between the hidden state and the anomaly indicator at each time step to obtain a correlation score vector; The correlation score vector is normalized by a normalized exponential function to obtain the weight coefficient of the hidden state at each time step, wherein the sum of the weight coefficients at all time steps is 1.

10. The microservice anomaly detection method according to claim 9, characterized in that, Correlation score vector for: Weight coefficients of the hidden state at each time step for: in, The weight matrix is ​​a learnable matrix. The hidden state at each time step, Here, T is the bias vector, and T is the total number of time steps.

11. The microservice anomaly detection method according to claim 1, characterized in that, The step of detecting and predicting abnormal indicators of microservices based on the attention fusion features includes: Determine the attention fusion characteristics within a preset historical time period; Determine the mean of the attention fusion features within the preset historical time period, and determine the standard deviation of the attention fusion features within the preset historical time period; Based on the mean and the standard deviation, the outlier intervals are determined; If the attention fusion feature of the current time step exceeds the abnormal range, then the corresponding microservice metric is determined to be abnormal.

12. The microservice anomaly detection method according to claim 1, characterized in that, The step of detecting and predicting abnormal indicators of microservices based on the attention fusion features includes: Based on the attention fusion characteristics, regression analysis is used to predict abnormal indicators for a preset future time period of the microservice.

13. The microservice anomaly detection method according to claim 1, characterized in that, The preprocessing of the multi-source indicator data to obtain preprocessed multi-source indicator data includes: The streaming logs are processed based on the OpenTelemetry call chain and aggregated into a log group with call dependencies for the same business scenario. An SVM classifier based on trace call chain and Jaccard text similarity is used to cluster and denoise the log group to obtain a denoised clustered log group. The clustered log groups and corresponding call chains are merged according to business scenarios, and clustering features are extracted. These clustering features are used as input to the convolutional neural network model.

14. The microservice anomaly detection method according to claim 1, characterized in that, The microservice anomaly detection method further includes: Construct the convolutional neural network model and initialize the weights and biases of the convolutional neural network model using a random initialization method; A bidirectional long short-term memory network model is constructed, and the weights and biases of the bidirectional long short-term memory network model are initialized using a random initialization method; An attention mechanism is constructed, and the dimensions of the attention weight matrix and the attention bias vector are determined based on the feature dimensions output by the bidirectional long short-term memory network model.

15. A microservice anomaly detection device, characterized in that, The microservice anomaly detection device includes: The data acquisition module is used to acquire multi-source indicator data of the microservice system and preprocess the multi-source indicator data to obtain preprocessed multi-source indicator data. The spatial feature module is used to extract spatial dimension features from the preprocessed multi-source index data using a convolutional neural network model to obtain a spatial feature vector. The time feature module is used to extract time series features from the spatial feature vector using a bidirectional long short-term memory network model to obtain the hidden state at each time step. The attention mechanism module is used to obtain the weight coefficients of the hidden state at each time step through the attention mechanism, and to perform a weighted summation of the hidden states at all time steps based on the weight coefficients to obtain the attention fusion feature. An anomaly detection module is used to detect and predict anomaly indicators of microservices based on the attention fusion features.

Images