Micro-service anomaly detection method, system and equipment
By employing a two-round detection process using neural networks and machine learning algorithms, combined with LSTM, GAT, and K-Means algorithms, the problems of false alarms and misreports in microservice anomaly detection are solved, thereby improving the accuracy of detection.
Patent Information
- Application Number
- CN202511723598.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-21
- Publication Date
- 2026-03-03
AI Technical Summary
Existing microservice anomaly detection methods are prone to false alarms and misreporting, resulting in low accuracy.
An anomaly detection agent based on a neural network is used for initial detection. Combining real-time monitoring data and service call chain data, features are extracted using a Long Short-Term Memory (LSTM) module and a Graph Attention Network (GAT). Feature fusion and anomaly score prediction are then performed. In the second round, the log data is analyzed in depth using the K-Means clustering algorithm to confirm anomalies.
By employing a two-round anomaly identification process, the false alarm rate and positive alarm rate of microservice anomaly detection were significantly reduced, and the accuracy of detection was improved.
Smart Images
Figure CN121598256A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of microservice anomaly detection, and specifically relates to a microservice anomaly detection method, system and device. Background Technology
[0002] As the functionality and code size of business software systems in monolithic architectures continue to increase, the readability, maintainability, and scalability of the system gradually decline, while the required performance and resources become increasingly demanding. Traditional monolithic architectures can no longer meet the increasingly complex business needs. To address these issues, distributed architectures have emerged. By splitting applications into multiple independent service modules, they achieve load balancing, improve the system's concurrent processing capabilities, and promote code reuse and business flexibility. Microservice architecture, as an implementation of distributed architecture, divides a single business application into multiple small modules according to its functions. Each microservice is an independent application with its own data storage and technology stack, and can be deployed independently. Each service in a microservice architecture typically runs in an independent container. Containerized deployment provides greater flexibility and portability, but it also introduces the complexity of container orchestration.
[0003] Currently, most microservice anomaly detection relies on operations and maintenance personnel constantly monitoring online operational data, which is particularly prone to human error. Furthermore, some intelligent anomaly detection methods primarily use neural network models, which are susceptible to false positives and misreporting.
[0004] Therefore, improving the accuracy of microservice anomaly detection is an urgent problem to be solved in this field, given that existing microservice anomaly detection methods are prone to false alarms and misreports. Summary of the Invention
[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a microservice anomaly detection method, system, and device. This invention provides a microservice anomaly detection method that acquires observable data of the microservice, including real-time monitoring data and service call chain data. The observable data is input into a preliminary anomaly detection module to obtain preliminary anomaly detection data. This preliminary anomaly detection module is a neural network-based anomaly detection agent. Based on the preliminary anomaly detection data, the latest log data is retrieved and input into a clustering model to obtain clustering results. Based on the clustering results, microservice anomaly data is determined. The microservice anomaly data is then output to a Kafka message queue. This invention's microservice anomaly detection method introduces efficient neural networks and machine learning algorithms, employing a two-round anomaly determination process to solve the problems of false positives, misreporting, and low accuracy in existing microservice anomaly detection methods.
[0006] To achieve the above objectives, the present invention adopts the following technical solution:
[0007] This invention proposes a microservice anomaly detection method, characterized by the following steps:
[0008] S1. Obtain observable data for the microservice, including real-time monitoring data and service call chain data;
[0009] S2. Input the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly detection data; the preliminary anomaly detection module is an anomaly detection agent based on a neural network;
[0010] S3. Based on the preliminary anomaly detection data, call the latest log data and input the log data into the clustering model to obtain the clustering result;
[0011] S4. Based on the clustering results, identify abnormal data in the microservices;
[0012] S5. Output the microservice exception data to the Kafka message queue.
[0013] Further, in step S2, the observable data of the microservice is input into the preliminary anomaly detection module to obtain preliminary anomaly data, specifically including:
[0014] S21. Input the real-time monitoring data from the observable data into the Long Short-Term Memory (LSTM) layer to extract time-series features;
[0015] S22. Input the service call chain data in the observable data into the graph attention network GAT layer to extract the topological features of the call chain.
[0016] S23. Input the temporal features and the call chain topology features into the self-attention layer, assign weights to the temporal features and the call chain topology features through the self-attention layer, and perform feature fusion based on the feature fusion layer to obtain fused features;
[0017] S24. Input the fused features into the anomaly score prediction layer to obtain the anomaly score;
[0018] S25. Compare the abnormal score with the threshold to determine whether it is abnormal, and obtain preliminary abnormal detection data.
[0019] Furthermore, in the Long Short-Term Memory (LSTM) layer, a coupling gate is introduced to couple the forget gate and the input gate, thereby preventing the state from growing indefinitely and associating the forgetting of old information with the input of new information. Specifically:
[0020] The forget gate determines which information will be forgotten; it contains a sigmoid neural network layer that takes input X at time t. t and the LSTM output signal h at time t-1 t-1 , where W f and b f These are the parameters of the neural network; their specific calculation formula is as follows:
[0021] f t =σ(W f ·[h t-1 ,X t ]+b f )
[0022] The input gate determines which information from a new input will be retained. The input gate consists of two parts: a sigmoid neural network layer with parameter W. i and b i One is a tanh neural network layer with parameter W. c and b c ; The sigmoid neural network layer accepts h t-1 and X t As input, then output an i between 0 and 1. t This determines which information needs to be updated; the specific calculation formula is as follows:
[0023] i t =σ(W i ·[h t-1 ,X t ]+b i )
[0024] The coupling gate is used to correlate the forget gate and the input gate. The specific calculation formula is as follows:
[0025] g t =σ(W g ·[h t-1 ,X t ]+b g )
[0026] f t =f t *g t
[0027] i t =i t *(1-g t ).
[0028] Furthermore, in the GAT layer, a multi-head attention mechanism is introduced to fully compute the hidden state through N independent attention mechanisms, and then the average of the data features is used to obtain the call chain topology features.
[0029] Furthermore, the feature is that, in step S3, the log data is input into a clustering model to obtain clustering results, wherein the clustering model adopts the K-Means algorithm.
[0030] The present invention also proposes a microservice anomaly detection system, characterized in that the microservice anomaly detection system executes the aforementioned microservice anomaly detection method, including: a microservice data acquisition module, a preliminary detection module, a log clustering module, an anomaly determination module, and an anomaly data output module;
[0031] The microservice data acquisition module acquires observable data for the microservice, including real-time monitoring data and service call chain data.
[0032] The preliminary detection module inputs the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly detection data; the preliminary anomaly detection module is an anomaly detection agent based on a neural network.
[0033] The log clustering module, based on the preliminary anomaly detection data, calls the latest log data and inputs the log data into the clustering model to obtain the clustering results;
[0034] The anomaly determination module determines abnormal data for microservices based on the clustering results.
[0035] The abnormal data output module outputs the abnormal data of the microservice to the Kafka message queue.
[0036] The present invention also proposes a computer device, the device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.
[0037] Compared with existing technologies, it has the following beneficial effects:
[0038] This invention discloses a microservice anomaly detection method. The method acquires observable data for the microservice, including real-time monitoring data and service call chain data. The observable data is input into a preliminary anomaly detection module to obtain preliminary anomaly detection data. This module is a neural network-based anomaly detection agent. Based on the preliminary anomaly detection data, the latest log data is retrieved and input into a clustering model to obtain clustering results. Based on the clustering results, microservice anomaly data is determined. Finally, the microservice anomaly data is output to a Kafka message queue. This invention's microservice anomaly detection method introduces efficient neural networks and machine learning algorithms. Through a two-round anomaly determination process, the first round uses an efficient neural network algorithm for preliminary anomaly detection to address false positives in microservice anomaly detection. The second round focuses on in-depth analysis of the log data, using secondary verification through clustering algorithms to determine microservice anomaly data, thereby reducing false positives and incorrect alarms. In other words, this invention's microservice anomaly detection method reduces the false positive rate and improves the accuracy of anomaly detection. Attached Figure Description
[0039] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0040] Figure 1 This is a schematic diagram of a microservice anomaly detection method provided in an embodiment of the present invention.
[0041] Figure 2 This is a structural diagram of a long short-term memory module provided in an embodiment of the present invention.
[0042] Figure 3 This is a diagram of the GAT layer structure provided in an embodiment of the present invention.
[0043] Figure 4 The flowchart of the clustering algorithm provided in the embodiment of the present invention is shown.
[0044] Figure 5 This is a schematic diagram of a microservice anomaly detection system provided in an embodiment of the present invention. Detailed Implementation
[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0046] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0047] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, but this is not intended to limit the scope of the invention.
[0048] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0049] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0050] This invention proposes a method for detecting anomalies in microservices. For example... Figure 1 As shown, a microservice anomaly detection method includes the following steps S1 to S5.
[0051] S1. Obtain observable data for the microservice, including real-time monitoring data and service call chain data.
[0052] Specifically, observable data, including real-time monitoring data and service call chain data, is acquired and used as input for the preliminary anomaly detection module.
[0053] S2. Input the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly detection data; the preliminary anomaly detection module is an anomaly detection agent based on a neural network.
[0054] Step S2: Input the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly data, specifically including:
[0055] S21. Input the real-time monitoring data from the observable data into the Long Short-Term Memory (LSTM) layer to extract time-series features;
[0056] S22. Input the service call chain data in the observable data into the graph attention network GAT layer to extract the topological features of the call chain.
[0057] S23. Input the temporal features and the call chain topology features into the self-attention layer, assign weights to the temporal features and the call chain topology features through the self-attention layer, and perform feature fusion based on the feature fusion layer to obtain fused features;
[0058] S24. Input the fused features into the anomaly score prediction layer to obtain the anomaly score;
[0059] S25. Compare the abnormal score with the threshold to determine whether it is abnormal, and obtain preliminary abnormal detection data.
[0060] Specifically, the implementation of the anomaly detection agent mainly ensures the correct detection of anomalies by fusing multiple excellent neural network models. To ensure the accuracy of the neural network, we propose a multimodal neural network model. For time-series data, this invention introduces an improved LSTM to extract time-series features; for service call chain data, a GAT layer is used to extract call chain topological features, and finally, a self-attention algorithm is used to assign weights to the time-series features and call chain features, followed by feature fusion.
[0061] However, compared to RNNs, LSTMs add three gate structures: the "forget gate," the "input gate," and the "output gate." These gate structures allow LSTMs to systematically influence the state at each time step of the neural network. The structure diagram of the Long Short-Term Memory module is shown below. Figure 2 As shown. Unlike traditional LSTM, we propose LSTM-s, which introduces a "coupling gate" to couple the "forget gate" and the "input gate", thereby avoiding infinite state growth and associating the forgetting of old information with the input of new information.
[0062] In step S21, at the Long Short-Term Memory (LSTM) layer, a coupling gate is introduced to couple the forget gate and the input gate, thereby preventing the state from growing indefinitely and associating the forgetting of old information with the input of new information. Specifically:
[0063] The forget gate determines which information will be forgotten; it contains a sigmoid neural network layer that takes input X at time t. t and the LSTM output signal h at time t-1 t-1 , where W f and b fThese are the parameters of the neural network; their specific calculation formula is as follows:
[0064] f t =σ(W f ·[h t-1 ,X t ]+b f )
[0065] The input gate determines which information from a new input will be retained. The input gate consists of two parts: a sigmoid neural network layer with parameter W. i and b i One is a tanh neural network layer with parameter W. c and b c ; The sigmoid neural network layer accepts h t-1 and X t As input, then output an i between 0 and 1. t This determines which information needs to be updated; the specific calculation formula is as follows:
[0066] i t =σ(W i ·[h t-1 ,X t ]+b i )
[0067] The coupling gate is used to correlate the forget gate and the input gate. The specific calculation formula is as follows:
[0068] g t =σ(W g ·[h t-1 ,X t ]+b g )
[0069] f t =f t *g t
[0070] i t =i t *(1-g t ).
[0071] The specific pseudocode is as follows:
[0072]
[0073]
[0074] In a specific embodiment, the LSTM-s model with added coupling gates outperforms the ordinary LSTM in terms of convergence iterations, average accuracy, real-time response latency (ms), and F1 score.
[0075] In the GAT layer, a multi-head attention mechanism is introduced. The hidden state is fully computed through N independent attention mechanisms, and then the average of the data features is used to obtain the call chain topology features.
[0076] Specifically, the GAT (Graph Attention Network) layer, as a key step in processing data from the service call chain, can accurately capture relevant feature information. The GAT layer structure diagram is shown below. Figure 3 As shown. Unlike traditional graph attention algorithms, we introduce a multi-head attention mechanism to stabilize the learning process. By applying N independent attention mechanisms to fully compute the hidden states, we then average the data features to obtain the better-performing call chain topology features. The specific calculation formula is as follows:
[0077]
[0078] Compared to the traditional GAT model, our model's node-neighbor pairs are parallelizable, resulting in higher computational efficiency, and we can assign appropriate weights based on the different levels of nodes.
[0079] S3. Based on the preliminary anomaly detection data, call the latest log data and input the log data into the clustering model to obtain the clustering result.
[0080] To ensure that normal network and traffic fluctuations do not lead to abnormal false alarms or misreports, this invention proposes a two-round anomaly determination. The second round focuses on in-depth analysis of log data, using clustering algorithms to further determine whether an anomaly is genuine, thereby reducing the false alarm and misreport rates. For the clustering algorithm, this invention uses the K-Means algorithm, which divides the logs into K clusters by iteratively calculating the distance between the centroids of data points. The clustering algorithm flowchart is shown below. Figure 4 As shown. The specific algorithm steps are as follows:
[0081] (1) Randomly initialize K centroids μ1, μ2...μ K ;
[0082] (2) Calculate x for each data point i Euclidean distance to the center of mass The data point is then assigned to the nearest cluster C. j ;
[0083] (3) Recalculate the centroid of the cluster.
[0084] (4) Repeat steps 2 and 3 until the centroid no longer changes.
[0085] In a specific embodiment, a comparison was made between the microservice anomaly detection results using clustering algorithms for secondary verification and those without secondary verification. The false positive rate and misreport rate of the microservice anomaly detection method using clustering algorithms for secondary verification were both lower than those without secondary verification.
[0086] S4. Based on the clustering results, identify abnormal data in microservices.
[0087] S5. Output the microservice exception data to the Kafka message queue.
[0088] Specifically, message queues ensure the system responds quickly to abnormal situations.
[0089] The microservice anomaly detection method proposed in this invention introduces efficient neural networks and machine learning algorithms. Through a two-round anomaly determination process, the first round uses an efficient neural network model to perform preliminary anomaly detection to solve the problem of false alarms in microservice anomaly detection. The second round focuses on in-depth analysis of log data and uses a clustering algorithm for secondary verification to determine microservice anomaly data, thereby reducing the occurrence of false alarms and helping operation and maintenance personnel to discover online anomalies in a timely manner. It can be used for intelligent operation and maintenance of distributed nodes.
[0090] Figure 5 This is a microservice anomaly detection system provided in an embodiment of the present invention. For example... Figure 5 As shown, this microservice anomaly detection system includes: a microservice data acquisition module, a preliminary detection module, a log clustering module, an anomaly determination module, and an anomaly data output module.
[0091] The microservice data acquisition module acquires observable data for the microservice, including real-time monitoring data and service call chain data.
[0092] The preliminary detection module inputs the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly detection data; the preliminary anomaly detection module is an anomaly detection agent based on a neural network.
[0093] The log clustering module, based on the preliminary anomaly detection data, calls the latest log data and inputs the log data into the clustering model to obtain the clustering results;
[0094] The anomaly determination module determines abnormal data for microservices based on the clustering results.
[0095] The abnormal data output module outputs the abnormal data of the microservice to the Kafka message queue.
[0096] The aforementioned microservice anomaly detection system can be implemented as a computer program that can run on a computer device.
[0097] Computer devices include processors, memory, and network interfaces connected via a system bus, wherein the memory may include non-volatile storage media and internal memory.
[0098] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions that, when executed, cause the processor to perform a microservice anomaly detection method.
[0099] This processor provides computing and control capabilities to support the operation of the entire computer device.
[0100] This internal memory provides an environment for the execution of computer programs in non-volatile storage media, which, when executed by the processor, enable the processor to perform a microservice anomaly detection method.
[0101] This network interface is used for network communication with other devices. Those skilled in the art will understand that the above-described computer device structure is only a partial structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.
[0102] The processor is used to run a computer program stored in the memory, which implements the microservice anomaly detection method described in Embodiment 1.
[0103] It should be understood that, in the embodiments of this application, the processor may be a Central Processing Unit (CPU), but it may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.
[0104] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.
[0105] The present invention also provides a storage medium. This storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when executed by a processor, the computer program causes the processor to perform the microservice anomaly detection method described in Embodiment 1.
[0106] The storage medium can be any computer-readable storage medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.
[0107] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0108] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
[0109] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0110] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.
[0111] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.
Claims
1. A microservice anomaly detection method, characterized in that, Including the following steps: S1. Obtain observable data for the microservice, including real-time monitoring data and service call chain data; S2. Input the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly detection data; The preliminary anomaly detection module is an anomaly detection agent based on a neural network; S3. Based on the preliminary anomaly detection data, call the latest log data and input the log data into the clustering model to obtain the clustering result; S4. Based on the clustering results, identify abnormal data in the microservices; S5. Output the microservice exception data to the Kafka message queue.
2. The method according to claim 1, characterized in that, Step S2: Input the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly data, specifically including: S21. Input the real-time monitoring data from the observable data into the Long Short-Term Memory (LSTM) layer to extract time-series features; S22. Input the service call chain data in the observable data into the graph attention network GAT layer to extract the topological features of the call chain. S23. Input the temporal features and the call chain topology features into the self-attention layer, assign weights to the temporal features and the call chain topology features through the self-attention layer, and perform feature fusion based on the feature fusion layer to obtain fused features; S24. Input the fused features into the anomaly score prediction layer to obtain the anomaly score; S25. Compare the abnormal score with the threshold to determine whether it is abnormal, and obtain preliminary abnormal detection data.
3. The method according to claim 2, characterized in that, In the Long Short-Term Memory (LSTM) layer, a coupling gate is introduced to couple the forget gate and the input gate, thereby preventing the state from growing indefinitely and associating the forgetting of old information with the input of new information. Specifically: The forget gate determines which information will be forgotten; it contains a sigmoid neural network layer that takes input X at time t. t and the LSTM output signal h at time t-1 t-1 , where W f and b f These are the parameters of the neural network; their specific calculation formula is as follows: f t =σ(W f ·[h t-1 ,X t ]+ b f) The input gate determines which information from a new input will be retained. The input gate consists of two parts: a sigmoid neural network layer with parameter W. i and b i One is a tanh neural network layer with parameter W. c and b c ; The sigmoid neural network layer accepts h t-1 and X t As input, then output an i between 0 and 1. t This determines which information needs to be updated; the specific calculation formula is as follows: i t =σ(W i ·[h t-1 ,X t ]+b i ) The coupling gate is used to correlate the forget gate and the input gate. The specific calculation formula is as follows: g t =σ(W g ·[h t-1 ,X t ]+b g ) f t =f t *g t i t =i t *(1-g t )。 4. The method according to claim 2, characterized in that, In the GAT layer, a multi-head attention mechanism is introduced. The hidden state is fully computed through N independent attention mechanisms, and then the average of the data features is used to obtain the call chain topology features.
5. The method according to claim 1, characterized in that, In step S3, the log data is input into the clustering model to obtain the clustering result, wherein the clustering model adopts the K-Means algorithm.
6. A microservice anomaly detection system, characterized in that, The microservice anomaly detection system executes a microservice anomaly detection method as described in claim 1, comprising: a microservice data acquisition module, a preliminary detection module, a log clustering module, an anomaly determination module, and an anomaly data output module; The microservice data acquisition module acquires observable data for the microservice, including real-time monitoring data and service call chain data. The preliminary detection module inputs the observable data of the microservice into the preliminary anomaly detection module to obtain preliminary anomaly detection data; the preliminary anomaly detection module is an anomaly detection agent based on a neural network. The log clustering module, based on the preliminary anomaly detection data, calls the latest log data and inputs the log data into the clustering model to obtain the clustering results; The anomaly determination module determines abnormal data for microservices based on the clustering results. The abnormal data output module outputs the abnormal data of the microservice to the Kafka message queue.
7. A computer device, characterized in that, The device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method as described in any one of claims 1 to 5.