Microservice system anomaly identification method and architecture based on multi-modal fusion

Abstract

The invention relates to the technical field of micro-service system multi-modal data anomaly identification, in particular to a micro-service system anomaly identification method and architecture based on multi-modal fusion. The method comprises the following steps: firstly, respectively carrying out modal specific noise filtering on tracking, log and index data; then, a dynamic graph is constructed using Pearson's correlation coefficients to quantify inter-modal correlation. Then, designing a mixed graph neural network of a fusion graph Transform network and a dynamic graph attention network to extract cross-modal spatial-temporal features; and finally, calculating an anomaly score based on the extracted features, and dynamically adjusting a threshold value by adopting an extreme value theory to realize robust anomaly judgment. The technical problem that fault diagnosis is delayed or misjudged due to the fact that original data noise is limited and cross-modal correlation is difficult to effectively capture is effectively solved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of micro-service system multi-modal data anomaly identification, and particularly relates to a micro-service system anomaly identification method and architecture based on multi-modal fusion. BACKGROUND

[0002] With the rapid development of cloud computing and distributed architecture, micro-service systems have been widely applied in Internet, finance, government affairs and other key fields due to their advantages such as modular deployment, elastic expansion, independent iteration, etc. The micro-service system realizes the decoupling of business logic by splitting complex business into multiple independent service components, but at the same time brings problems such as dynamic changes of system topology structure and complex interaction relationship between services, which makes the causes of abnormal failure more hidden and the propagation path more complex. Therefore, based on the multi-source data generated during the system running process, anomaly identification has become a core technical requirement to ensure the stable and reliable operation of the micro-service system, among which trace data, log data and index data as the three types of core multi-modal data of the micro-service system can reflect the system running characteristics from different dimensions such as call link, running state record and resource monitoring, and are the key basis for anomaly diagnosis.

[0003] Current micro-service system anomaly identification technologies mainly include single-modal identification methods and multi-modal fusion identification methods.

[0004] In the single-modal identification method: the method based on log data mainly screens abnormal information through template extraction, keyword matching and other methods, such as DeepTraLog method [1] extracts log events from original logs, converts trace data into span events, and converts span and log events into matrix representation, then constructs a trace event graph for each trace, trains a model based on GGNN, and finally determines system anomalies through abnormal score. The method based on index data focuses on time series feature analysis, and detects anomalies through threshold judgment, time series prediction and other methods; Chen, Hongyang and Che [2] proposed a fault detection method based on dynamic threshold selection, in which the coordinator activates the data collector regularly to collect system indicators, and then the statistical aggregator retrieves and aggregates these indicators; then the communication topology is constructed and stored to facilitate data organization, and the STCell model is used to capture the relationship between input data and system components, and the abnormal score is calculated from the latest observation value; finally, the dynamic threshold selection strategy determines the fault threshold, thereby realizing effective fault detection. The method based on trace data relies on complete call chain analysis to predict and detect anomalies; for example, the TraceSieve method [3]The tracking data is converted into a matrix representation, and a generative adversarial network is used for noise filtering. The model is trained by combining a variational graph autoencoder and elastic weight consolidation techniques. Finally, anomaly scores are calculated using negative log-likelihood to achieve fault prediction. Although these methods have made progress, they are mainly limited to the single-modal analysis of log data, indicator data, and tracking data, and fail to fully utilize the correlation between logs, indicators, and tracking data, resulting in a low overall anomaly detection accuracy.

[0005] To overcome the limitations of single-modal identification methods, multimodal fusion identification methods have emerged. Their core idea is to integrate complementary information from three types of data to improve the comprehensiveness of anomaly detection. However, existing multimodal fusion technologies still have significant shortcomings: Firstly, they lack dedicated filtering schemes for noise specific to different modalities, often employing uniform noise reduction methods that fail to effectively address differentiated noise issues such as fragmented tracking data paths, redundant log entries, missing indicator data, and outliers. Secondly, they lack precision in capturing intermodal relationships, mostly relying on simple concatenation and static weighted fusion to process data, failing to adapt to the dynamic operating characteristics of microservice systems and struggling to capture the temporal evolution patterns of cross-modal relationships in real time.

[0006] It is evident that, due to the inherent defects of single-modal methods and the inadequacies of existing multimodal fusion technologies, the anomaly identification process is prone to delays in fault diagnosis and high false positive rates, failing to meet the real-time and accuracy requirements of microservice systems for anomaly identification. Therefore, this issue urgently needs to be addressed.

[0007] [1] Chenxi Zhang, Xin Peng, Chaofeng Sha, Ke Zhang, Zhenqing Fu, XiyaWu, Qingwei Lin, and Dongmei Zhang. Deeptralog: Trace-log combined microservice anomaly detection through graph-based deep learning. In Proceedings of the 44 th International Conference on Software Engineering, pages 623–634, 2022. [2]]Hongyang Chen, Pengfei Chen, Benran Wang, Xian Yu, Xiaofan Chen,Dandan Ma, and Zibin Zheng. Graph neural network based robust anomalydetection at service level in sdn driven microservice system. ComputerNetworks, 239:110135, 2024. [3] Shenglin Zhang, Zhongjie Pan, Heng Liu, Pengxiang Jin, Yongqian Sun, Qianyu Ouyang, Jiaju Wang, Xueying Jia, Yuzhi Zhang, Hui Yang, et al. Efficient and robust trace anomaly detection for large-scale microservice systems. In 2023 IEEE 34 th International Symposium on Software ReliabilityEngineering (ISSRE), pages 69–79. IEEE, 2023. Summary of the Invention

[0008] To address the technical problems of delayed or misjudged fault diagnosis caused by noise in the raw data and the difficulty in effectively capturing cross-modal correlations, this invention provides a method for anomaly identification in microservice systems based on multimodal fusion. Based on this identification method, this invention also provides an architecture for anomaly identification in microservice systems based on multimodal fusion.

[0009] To achieve the above objectives, the present invention provides the following technical solution: A method for anomaly identification in microservice systems based on multimodal fusion, comprising: Acquire multimodal data from the microservice system, including tracing data, log data, and metric data, and perform modality-specific noise filtering on the multimodal data; Based on the denoised multimodal data, the Pearson correlation coefficient between different modal data is calculated. A dynamic graph representing the correlation between modalities is constructed with modalities as nodes and Pearson correlation coefficients as edge weights. The dynamic graph is input into a pre-trained hybrid graph neural network model to extract cross-modal spatiotemporal features that represent the system state; Based on the features extracted by the hybrid graph neural network model, the anomaly score of the system state is calculated, and the anomaly judgment threshold is dynamically adjusted in combination with the extreme value theory, so as to identify system anomalies based on the comparison result of the anomaly score and the anomaly judgment threshold.

[0010] As a further improvement to the above scheme, the steps for modality-specific noise filtering of the tracking data are as follows: Inputting noisy or incomplete raw tracking data x into the generator of the adversarial autoencoder model a And repair the original tracking data; Initiating the dual-discriminator collaborative verification process: First discriminator The generator output data undergoes call chain spatiotemporal continuity verification, and a second discriminator is used. Perform metadata consistency verification on the data output by the generator; The generator is trained and optimized using a pre-defined loss function, which is: L G =E x~pdata [log(1-D1(G(x a )))+log(1-D2(G(x a )))]+λE x~pdata ||G(x a )-x a || 2 In the formula, L G E represents the total loss function of the generator; x~pdata This indicates that x represents the original tracking data distribution pdata. a "Calculate the expected value; log represents the natural logarithm; G(x) a ) indicates that the generator is applied to x a The output generated data; λ represents the weight coefficient of the reconstruction loss; ||·|| 2 Represents the L2 norm; The generator outputs the repaired tracking data, completing the repair and metadata correction of the original tracking data.

[0011] As a further improvement to the above scheme, the loss functions of the two discriminators are expressed as follows:

[0012]

[0013] In the formula, Indicates the first discriminator The loss function; Let D2 represent the loss function of the second discriminator.

[0014] As a further improvement to the above scheme, the steps for modality-specific noise filtering of log data are as follows: The Drain3 algorithm is used to convert the original unstructured log collection into a structured template library T. parse ; With T parse Given a unique input, for T parse For each log template t, combining TF-IDF term saliency with a predefined set of domain keywords κ, a composite semantic score S(t) is calculated for each log template t. Log templates with S(t) greater than or equal to a semantic threshold are retained, resulting in a semantically filtered template library T. sem ;

[0015] In the formula, w represents a single term contained in log template t; TF-IDF(w) represents the TF-IDF value of term w; β represents the weight amplification coefficient of domain keywords; I (w∈κ) represents the indicator function; Calculate T sem The normalized frequency f(t) of each template t is used to eliminate templates with f(t) < θ using a double threshold strategy. low Or f(t)>θ high The template outputs a refined log template library T. final Complete the noise reduction of log data; Where, θ low θ high These represent the 5th and 95th percentiles of the historical frequency distribution, respectively.

[0016] As a further improvement to the above scheme, the steps for modality-specific noise filtering of the index data are as follows: By integrating time window statistics and spatial grouping statistics, the original indicator data is standardized.

[0017] In the formula, x b This represents the original indicator data. Standardized indicator data; μ t , These represent the mean and variance of the time window, respectively; μ s , α and β are the mean and variance of the spatial grouping, respectively; α and β are the corresponding weighting coefficients, respectively. Using standardized indicator data as input, and addressing missing values ​​that occurred during data collection, this method calculates the distance from the missing point to the previous valid point x, based on the principle of temporal locality.m-τ distance d prev , to the next valid point x m+τ distance d next According to the weighted formula Calculate interpolation values Complete the missing data to obtain a complete time-series index dataset; Using a complete time-series index dataset as input, a local outlier algorithm is used to detect global outliers. When the local outlier factor is greater than 2.0, outlier data that deviate from the normal distribution are marked and filtered. Z-Score normalization is performed on the filtered data for 50 sample windows, and the final output is the denoised index data.

[0018] As a further improvement to the above scheme, the steps for constructing the dynamic graph are as follows: Obtain the denoised multimodal data, calculate the Pearson correlation coefficient between every two modalities in the three modalities of the multimodal data, and quantify the linear dependence between logs and metrics, logs and tracking, and metrics and tracking using the Pearson correlation coefficient; Using logs, metrics, and tracking as nodes in the graph, and the calculated Pearson correlation coefficients between pairs of modes as the weights of the connecting edges between corresponding nodes, an adjacency graph representing the static association between modes is constructed. The static adjacency graph is time-series aggregated according to the preset time slices to form a dynamic graph flow consisting of a series of static graphs that dynamically evolve with the system's operating state. The static graph corresponding to each time slice recalculates the Pearson correlation coefficient based on the modal data within the corresponding time slice to update the edge weights, so that the entire graph structure can reflect the temporal changes in the correlation between modalities in real time. Finally, the dynamic graph flow is output for subsequent feature learning.

[0019] As a further improvement to the above scheme, the steps for extracting spatiotemporal features are as follows: The dynamic graph stream is input into a pre-trained hybrid graph neural network model; By using the graph Transformer network layer in a hybrid graph neural network model, global dependencies between nodes in a dynamic graph flow are learned. By using a dynamic graph attention network layer in a hybrid graph neural network model, importance weights between nodes in the dynamic graph flow are dynamically assigned to capture local critical dependencies. By using gated recurrent units in a hybrid graph neural network model, the evolution of dynamic graph flow in the time dimension is modeled. Integrate global dependencies, local critical dependencies, and evolutionary patterns to output corresponding cross-modal spatiotemporal features.

[0020] As a further improvement to the above scheme: based on the abnormal score sequence corresponding to historical normal data, a generalized Pareto distribution is fitted, and a dynamic anomaly judgment threshold is calculated according to the generalized Pareto distribution and the preset significance level.

[0021] As a further improvement to the above scheme, the anomaly detection threshold is expressed as follows:

[0022] In the formula, ζ t Indicates the anomaly detection threshold; u represents the initial high quantile threshold; ξ represents the shape parameter; δ represents the scale parameter; N represents the total number of samples; n u This indicates the number of times u is exceeded in the statistical history, and ε represents the specified significance level. This invention also provides an anomaly detection architecture for microservice systems based on multimodal fusion, comprising: The data preprocessing and modality-specific noise reduction module is used in the modality-specific noise filtering step of a microservice system anomaly identification method based on multimodal fusion to obtain denoised multimodal data. The dynamic graph construction module is used to execute the dynamic graph construction step in the microservice system anomaly identification method based on multimodal fusion, so as to obtain a dynamic graph; The feature extraction module is used in the cross-modal spatiotemporal feature acquisition step of the microservice system anomaly identification method based on multimodal fusion, so as to obtain cross-modal spatiotemporal features; The anomaly detection module is used in the system anomaly detection step of the microservice system anomaly detection method based on multimodal fusion to identify system anomalies.

[0023] Compared with the prior art, the beneficial effects of the present invention are: First, the heterogeneous noise of tracking, log, and indicator data is filtered to effectively remove interference such as path fragments, redundant entries, and outliers, ensuring data quality from the source and avoiding the impact of noise on subsequent analysis. Next, the linear dependencies between modes are quantified using the Pearson correlation coefficient, and the temporal evolution of these relationships is represented in real time by a dynamic graph. Furthermore, a hybrid graph neural network is used to deeply integrate global dependencies, local key associations, and temporal evolution features, achieving accurate capture and deep fusion of cross-modal associations. Finally, the anomaly detection threshold is dynamically adjusted using extreme value theory, significantly improving the real-time performance and accuracy of anomaly identification. Therefore, this invention effectively solves the technical problems of delayed or misjudged fault diagnosis caused by limitations in raw data noise and the difficulty in effectively capturing cross-modal associations through the optimization of the entire process of "modality-specific noise filtering - dynamic graph construction - cross-modal spatiotemporal feature extraction - dynamic threshold determination." Attached Figure Description

[0024] Figure 1This is a flowchart of the identification method in this invention.

[0025] Figure 2 This is a structural diagram of the autoencoder model in this invention.

[0026] Figure 3 This is a schematic diagram illustrating the principle of multimodal data preprocessing in this invention.

[0027] Figure 4 This is a schematic diagram illustrating the principle of cross-modal correlation analysis in this invention.

[0028] Figure 5 This is a schematic diagram illustrating the principle of hybrid GTN-GAN graph learning in this invention.

[0029] Figure 6 This is a schematic diagram of the adaptive anomaly detection principle based on EVT in this invention.

[0030] Figure 7 This is a performance comparison chart of the GAIA and AIOps2021 systems under different window sizes in this invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Please see Figures 1-6 This invention discloses a method for anomaly identification in microservice systems based on multimodal fusion. The core of this method revolves around the entire process of anomaly identification design, utilizing the microservice system's tracing data, log data, and indicator data. Figure 2 and Figure 3 First, specific filtering is implemented for the three types of data based on their specific noise characteristics. Tracking data undergoes path fragmentation and metadata errors repaired using an adversarial autoencoder with a generator-dual discriminator architecture. Log data is structured using the Drain3 algorithm, filtered by semantic scores, and redundancy is removed through dual-threshold frequency filtering. Metric data is processed for missing values ​​and fluctuation noise through spatiotemporal normalization, bidirectional interpolation completion, local outlier detection, and sliding window Z-Score normalization. Figure 4 and Figure 5 Then, based on the denoised data, the Pearson correlation coefficient between each pair of modes is calculated. A static adjacency graph is constructed with modes as nodes and correlation coefficients as edge weights. Through time-slicing and time-series aggregation, a dynamic graph flow reflecting the dynamic evolution of modal associations is formed; such as Figure 6The dynamic graph stream is then input into a pre-trained hybrid graph neural network model. The model learns global dependencies through graph Transformer layers, captures key local correlations through dynamic graph attention layers, and models temporal evolution patterns through gated recurrent units, integrating and outputting cross-modal spatiotemporal features. Finally, a generalized Pareto distribution is fitted based on the anomaly score sequence of historical normal data, and the anomaly judgment threshold is dynamically adjusted using extreme value theory. Accurate anomaly identification is achieved by comparing the anomaly score with the threshold. The corresponding system comprises four modules: data preprocessing and noise reduction, dynamic graph construction, feature extraction, and anomaly judgment, corresponding to the steps described above, forming a complete technical system from data cleaning to anomaly identification, effectively improving the real-time performance and accuracy of anomaly identification in microservice systems.

[0033] I. Multimodal Data

[0034] 1. Log data

[0035] As a text record of service operation, logs directly reflect the internal state of the service through error codes (such as database connection failures) and exception stack traces (such as API authentication errors).

[0036] 2. Indicator Data

[0037] The health status of the system is quantified by continuously collecting time-series measurements (such as CPU utilization and request latency percentiles) and combining them with statistical analysis (mean, quartile distribution).

[0038] 3. Tracking data

[0039] By leveraging the call chains generated by the distributed tracing framework, a request-level service call topology can be constructed, revealing the dependencies between services (such as the call frequency and latency between services A and B).

[0040] II. Noise Treatment

[0041] Noise is a key factor affecting the accuracy of fault detection in microservice monitoring data. Specifically, log data often contains redundant debugging entries and irrelevant events, metric data may contain outliers due to momentary fluctuations or collection errors, and trace data may be incomplete due to low sampling rates or missing links.

[0042] The anomaly detection framework proposed in this invention employs a four-stage pipeline to achieve multimodal fault detection in microservice systems. In the data preprocessing stage, heterogeneous monitoring data (including metrics such as CPU utilization, logs such as semantic event records, and traces such as service call chains) undergo modality-specific noise filtering and feature extraction to generate a structured time-series representation while preserving key temporal and contextual patterns. Subsequently, in the correlation analysis stage, statistical techniques such as the Pearson correlation coefficient are used to quantify cross-modal dependencies, revealing the implicit associations between metrics, log events, and tracing paths. These dependencies are dynamically encoded into a graph structure that evolves with the system state.

[0043] In the graph learning phase, a hybrid architecture combining a graph Transformer network and a dynamic graph attention network is used to process the dynamic graph flow. This approach can simultaneously learn spatial dependencies (via GTN) and temporal dynamic characteristics (via GATv2Conv), capturing both immediate and long-term system behavior. Finally, in the anomaly detection phase, the trained model calculates anomaly scores through gated recurrent units (GRUs) and dynamically adjusts the detection threshold using extremum theory to ensure robust performance under fluctuating operating environments. The GRU's gating mechanism effectively captures long-term dependencies in time-series data, enabling more accurate identification of system anomaly patterns compared to traditional methods.

[0044] 1. Perform modality-specific noise filtering on the tracking data.

[0045] like Figure 2 As shown, to address the issues of path fragmentation and inaccurate metadata in trajectory data caused by low sampling rates, this invention employs an autoencoder model based on adversarial training. It utilizes a generator-dual discriminator architecture for unsupervised noise suppression: the generator (G) synthesizes realistic trajectory data to deceive the discriminators (D1 and D2) to the greatest extent possible, while the two discriminators analyze the reconstructed trajectory features and participate in the adversarial learning process to dynamically distinguish between real and synthetic data. This method not only reduces noise but also enhances trajectory continuity and data fidelity. The specific steps are as follows: First, input noisy or incomplete raw tracking data x into the generator of the adversarial autoencoder model. a And repair the original tracking data.

[0046] Next, the dual-discriminator collaborative verification process is initiated: First discriminator The generator output data undergoes call chain spatiotemporal continuity verification, and a second discriminator is used. Metadata consistency verification is performed on the data output by the generator; the loss functions of the two discriminators are expressed as follows:

[0047]

[0048] In the formula, Indicates the first discriminator The loss function; Let D2 represent the loss function of the second discriminator.

[0049] Then, the generator is trained and optimized using a preset loss function, which is: L G =E x~pdata [log(1-D1(G(x a )))+log(1-D2(G(x a )))]+λE x~pdata ||G(x a )-x a || 2 In the formula, L G E represents the total loss function of the generator; x~pdata This indicates that x represents the original tracking data distribution pdata. a "Calculate the expected value; log represents the natural logarithm; G(x) a ) indicates that the generator is applied to x a The output generated data; λ represents the weight coefficients of the reconstruction loss, ensuring the similarity between the generated data and the original data in the feature space, thereby preserving effective information and suppressing noise; ||·|| 2 This represents the L2 norm.

[0050] The discriminator distinguishes between real and generated data distributions by maximizing these losses. D1 focuses on spatiotemporal continuity (e.g., repairing broken links), while D2 verifies metadata consistency (e.g., timestamps, attributes). The model is trained adversarially between the generator and discriminator in an unsupervised manner. The generator learns to synthesize repaired trajectories that can simultaneously fool both discriminators while maintaining consistency with the original data; the discriminators, on the other hand, perform multi-dimensional feature analysis (e.g., D1 ensures physical plausibility, D2 verifies it). By jointly optimizing the adversarial and reconstruction objectives, the generator achieves interpolation and correction of missing links and metadata errors in low-sampling-rate trajectory data.

[0051] Finally, the generator outputs the repaired tracking data, completing the repair and metadata correction of the original tracking data.

[0052] This section introduces an adversarial training framework for an adversarial autoencoder based on a generator-dual discriminator architecture, and constructs a modality-specific noise filtering mechanism: To address the incompleteness issues of tracking data, such as path fragmentation and metadata errors, a generator is used to repair the original noisy tracking data. Then, a first discriminator verifies the spatiotemporal continuity of the call chain, and a second discriminator verifies the consistency of metadata. An optimization model, incorporating adversarial and reconstruction losses, is used to achieve accurate repair of the tracking data. For redundant entries in the log data, such as debug logs, the Drain3 algorithm is used to convert unstructured logs into structured templates. Then, semantic scores are calculated using TF-IDF term saliency and domain keywords, and low-value redundant templates are removed using dual-threshold frequency filtering. For noise in the indicator data, such as jitter and outliers, spatiotemporal normalization is used to eliminate scale differences. After bidirectional interpolation to fill in missing values, local outlier detection and sliding window Z-Score normalization are used to filter out instantaneous fluctuations and global outliers. This adversarial training-driven multi-dimensional data cleaning mechanism systematically removes modality-specific noise from the source, ensuring that the data input to the subsequent dynamic graph construction and feature extraction stages has high accuracy, completeness, and consistency. This lays a reliable data foundation for the entire anomaly identification process, thereby significantly improving the model's robustness against complex noise interference and its generalization ability to adapt to the dynamic operation scenarios of microservice systems.

[0053] 2. Perform modality-specific noise filtering on log data.

[0054] The log data processing workflow employs dynamic template extraction and hierarchical filtering, using the drain3 algorithm with adaptive granularity control. First, a service-specific template library is built. Subsequent semantic filtering combines TF-IDF domain knowledge to retain operationally important logs, while frequency-based filtering removes transient debugging entries and low-value warnings. The specific steps are as follows: First, the Drain3 algorithm is used to convert the original unstructured log collection L into a structured template library T. parse ;T parse =Drain3(L;α,d max ,τ sim The granularity control parameter α balances template generalization (lower values ​​produce coarse-grained templates containing more wildcards; higher values ​​preserve fine-grained details). Maximum tree depth d max Constrain memory consumption and prevent overfitting. The similarity threshold τ... sim Log line merging labels are determined based on normalized edit distance.

[0055] Next, with T parse Given a unique input, for T parseFor each log template t, combining TF-IDF term saliency with a predefined set of domain keywords κ, a composite semantic score S(t) is calculated for each log template t. Log templates with S(t) greater than or equal to a semantic threshold (obtained through empirical calibration) are retained to obtain the semantically filtered template library T. sem .

[0056]

[0057] In the formula, w represents a single term contained in log template t; TF-IDF(w) represents the TF-IDF value of term w; β represents the weight amplification coefficient of domain keywords; and I(w∈κ) represents the indicator function.

[0058] Finally, calculate T. sem The normalized frequency f(t) of each template t is used to eliminate templates with f(t) < θ using a double threshold strategy. low Or f(t)>θ high The template outputs a refined log template library T. final To perform noise reduction on log data; where θ low θ high These represent the 5th and 95th percentiles of the historical frequency distribution, respectively.

[0059] 3. Perform modality-specific noise filtering on the indicator data.

[0060] The indicator data undergoes spatiotemporal normalization to address sampling inconsistency. An adaptive time window alignment method enables cross-service measurement synchronization, while bidirectional interpolation handles missing values. To suppress noise, several robust statistical methods are integrated, including local outlier detection and Z-score normalization. The specific steps are as follows: First, to address the sampling inconsistency issue in distributed monitoring systems, a method is adopted to standardize the raw indicator data by fusing time window statistics and spatial grouping statistics:

[0061] In the formula, x b This represents the original indicator data. Standardized indicator data; μ t , These represent the mean and variance of the time window, respectively; μ s , α and β represent the mean and variance of the spatial grouping, respectively; α and β are the corresponding weighting coefficients, with values ​​of 0.7 and 0.5, respectively. This approach prioritizes temporal patterns while balancing spatial influences, thereby generating normalized values ​​for cross-service comparisons. .

[0062] Adaptive Time Window Wk Synchronizing heterogeneous data streams through dynamic interval adjustment: W k =[t k -1.5Δt,t k [-1.5Δt], where Δt represents the average data arrival interval across services. 1.5 serves as a scaling factor to ensure robust alignment under burst traffic, while t... k Then mark the synchronization anchor point.

[0063] Using standardized indicator data as input, and addressing missing values ​​that occurred during data collection, this method calculates the distance from the missing point to the previous valid point x, based on the principle of temporal locality. m-τ distance d prev , to the next valid point x m+τ distance d next According to the weighted formula Calculate interpolation values Complete the missing data to obtain a complete time-series index dataset; Using a complete time-series index dataset as input, the local outlier algorithm is used to detect global outliers. When the local outlier LOF > 2.0, outlier data that deviate from the normal distribution are marked and filtered. Z-Score normalization is performed on the filtered data for 50 sample windows, and the final output is the denoised index data.

[0064] II. Animated Graphs

[0065] Based on the denoised multimodal data, the Pearson correlation coefficients between different modalities are calculated. A dynamic graph representing the intermodal relationships is constructed, using modalities as nodes and the Pearson correlation coefficients as edge weights. The specific steps are as follows: First, the denoised multimodal data is obtained, and the Pearson correlation coefficient between each pair of modes in the three types of multimodal data is calculated. The linear dependencies between logs and metrics, logs and tracking, and metrics and tracking are quantified by the Pearson correlation coefficient.

[0066] Next, using logs, metrics, and tracking modalities as nodes in the graph, and the calculated Pearson correlation coefficients between each pair of modalities as the weights of the edges connecting corresponding nodes, an adjacency graph representing the static associations between modalities is constructed. The adjacency matrix of the adjacency graph is represented as follows:

[0067] Where, ρ TL ρ TM ρ LMThis represents the Pearson correlation coefficients between tracking and logs, tracking and metrics, and logs and metrics. Diagonal elements represent autocorrelation (fixed at 1), while off-diagonal elements capture cross-modal dependencies. The adjacency graph visualizes interactive patterns and provides prior knowledge for downstream tasks such as anomaly localization and root cause inference.

[0068] The static adjacency graph is time-series aggregated according to the preset time slices to form a dynamic graph flow consisting of a series of static graphs that dynamically evolve with the system's operating state. The static graph corresponding to each time slice recalculates the Pearson correlation coefficient based on the modal data within the corresponding time slice to update the edge weights, so that the entire graph structure can reflect the temporal changes in the correlation between modalities in real time. Finally, the dynamic graph flow G is output for subsequent feature learning.

[0069] III. Extracting Cross-Modal Spatiotemporal Features

[0070] The dynamic graph stream is processed using a hybrid architecture of an integrated graph transform network (GTN) and a dynamic graph attention network (GATv2Conv), with its temporal evolution captured by gated recurrent units (GRUs). The dynamic graph is input into a pre-trained hybrid graph neural network model to extract cross-modal spatiotemporal features representing the system state. The specific steps are as follows: First, a dynamic graph stream (the static graph of each time slice dynamically updates the edge weights through the Pearson correlation coefficient to reflect the temporal changes in the correlation between modes in real time) constructed from logs, metrics, and tracking data is input into a pre-trained hybrid graph neural network model.

[0071] Next, spatiotemporal feature encoding is performed through the Graph Transformer Network (GTN) layer in the model. Based on the normalized adjacency matrix with self-loop (obtained by thresholding the time-varying Pearson correlation matrix), neighborhood information is aggregated through multi-layer graph convolution iteration. The system learns the global dependencies between nodes in the dynamic graph flow, ensuring comprehensive coverage of cross-modal associations.

[0072] Then, through the dynamic graph attention network layer (GATv2Conv), the dynamic dependencies between nodes are adaptively learned by relying on the multi-head attention mechanism. First, the node features are linearly transformed and concatenated. Then, the attention score is calculated by the LeakyReLU activation function and normalized by softmax. The importance weights between nodes are dynamically allocated, accurately focusing on the local dependencies that are key to anomaly identification and filtering out invalid association interference.

[0073] Next, the model uses a gated recurrent unit (GRU) to adjust the ratio of retaining historical hidden states to updating current features by using update gates and reset gates. This decodes historical states and generates future graph topology, effectively modeling the evolution of dynamic graph flow over time. During model training, end-to-end optimization is performed using a composite loss function that includes topology reconstruction loss, node feature loss, and edge weight loss. Learnable coefficients balance the loss terms to ensure modeling accuracy.

[0074] Ultimately, by deeply integrating global dependencies, local key dependencies, and temporal evolution patterns, we can output cross-modal spatiotemporal features with stronger representation capabilities, providing solid support for subsequent anomaly identification.

[0075] This section proposes a hybrid graph neural network architecture that integrates Graph Transformer Network (GTN) and Dynamic Graph Attention Network (GATv2Conv), and introduces a Gated Recurrent Unit (GRU) to construct a full-dimensional feature extraction framework, achieving synergistic integration and in-depth mining of global dependencies, key local associations, and temporal evolution patterns. The core advantage of this hybrid architecture lies in accurately leveraging the complementary capabilities of each network module: the Graph Transformer network layer, as the core of global feature modeling, iteratively aggregates neighborhood information for log, metric, and tracking modal nodes in the dynamic graph flow, systematically learning the global dependencies between nodes to ensure comprehensive coverage of cross-modal associations; the Dynamic Graph Attention Network layer, relying on the dynamic attention mechanism, dynamically allocates node weights according to the strength of inter-modal associations, accurately focusing on key local dependencies for anomaly identification and filtering out invalid association interference; the Gated Recurrent Unit specifically models the temporal evolution patterns of the dynamic graph flow, flexibly adjusting the ratio of historical feature retention to current feature updates through a gating mechanism to capture the temporal change trend of the system's operating state. The three elements work together to deeply integrate cross-modal correlations at the global level, key dependencies at the local level, and dynamic evolutionary features at the temporal level, ultimately outputting cross-modal spatiotemporal features with stronger representation capabilities. This provides solid support for subsequent anomaly score calculation and accurate identification, effectively making up for the shortcomings of a single network in global coverage, local focus, or temporal modeling, highlighting the innovation and practicality of the hybrid architecture.

[0076] IV. Anomaly Detection

[0077] Based on the features extracted by the hybrid graph neural network model, anomaly scores of the system states are calculated. Anomaly detection thresholds are then dynamically adjusted using extreme value theory to identify system anomalies by comparing the anomaly scores with the thresholds. The specific steps are as follows: First, using the cross-modal high-dimensional features extracted by the hybrid graph neural network model, the anomaly score of the current system operating state is calculated. This anomaly score is used to quantify the degree of deviation between the current system state and the historical normal mode.

[0078] Next, the abnormal score sequence is modeled using extreme value theory, and the initial high quantile threshold is determined by analyzing the distribution characteristics of historical abnormal scores.

[0079] Furthermore, based on the shape and scale parameters obtained from the maximum likelihood estimation, a generalized Pareto distribution model is constructed to dynamically adjust the anomaly detection threshold. This increases the anomaly detection threshold during stable system operation to reduce false alarms and decreases it during periods of frequent anomalies to improve sensitivity.

[0080] The anomaly detection threshold is expressed as follows:

[0081] In the formula, ζ t Indicates the anomaly detection threshold; u represents the initial high quantile threshold; ξ represents the shape parameter; δ represents the scale parameter; N represents the total number of samples; n u This indicates the number of times u is exceeded in the statistical history, and ε indicates the specified significance level.

[0082] Finally, the calculated current system anomaly score is compared with the dynamically adjusted anomaly detection threshold. If the anomaly score exceeds the threshold, the system is determined to be abnormal, and the fault detection result is output.

[0083] V. Identification Frame (MFND)

[0084] The recognition framework includes a data preprocessing and modality-specific noise reduction module, a dynamic graph construction module, a feature extraction module, and an anomaly detection module, which are described in detail below: 1. Data preprocessing and modality-specific noise reduction module The data preprocessing and modality-specific noise reduction module is used to receive tracking data, log data and indicator data from the microservice system, and perform modality-specific noise filtering on each type of data to output denoised multimodal feature data.

[0085] The data preprocessing and modality-specific noise reduction module includes: The tracing processing subunit employs an adversarial autoencoder model based on a generator-discriminator architecture to repair incomplete tracing paths and correct metadata errors.

[0086] The log processing subunit employs a dynamic template extraction combined with a hierarchical filtering strategy based on semantics and frequency to generate a refined log template library.

[0087] The indicator processing subunit employs spatiotemporal normalization, adaptive window alignment, and robust statistical denoising methods to output clean and continuous indicator time series.

[0088] 2. Dynamic Graph Construction Module

[0089] The dynamic graph construction module is connected to the data preprocessing and modality-specific denoising module. Based on the denoised multimodal feature data, it calculates the Pearson correlation coefficient between different modalities and constructs a dynamic graph structure that evolves with the system state, using modalities as nodes and correlation coefficients as edge weights. Specifically, it is used for: The time frame is divided into continuous sliding windows, and the Pearson correlation coefficients between each pair of tracking, logs, and metrics are calculated within each window. The three modalities are used as fixed graph nodes, and the calculated correlation coefficient matrix is ​​used as a weighted adjacency matrix. The graphs at each time point are aggregated in chronological order to form a dynamic graph flow.

[0090] 3. Feature Extraction Module

[0091] The feature extraction module is connected to the dynamic graph construction module and includes a pre-trained hybrid graph neural network. This hybrid graph neural network integrates graph Transformer network layers, dynamic graph attention network layers, and a time-series modeling unit to extract cross-modal spatiotemporal features from the dynamic graph structure. The hybrid graph neural network operates in the following manner: First, information is propagated among multi-hop neighbors through a graph Transformer network layer to capture global dependency patterns. Then, a dynamic graph attention network layer dynamically calculates attention weights between nodes based on a learnable nonlinear function to focus on key local interactions. Finally, a temporal modeling unit encodes the temporal evolution features of the dynamic graph flow.

[0092] 4. Exception Decision Module

[0093] The anomaly detection module is connected to the feature extraction module. It calculates the system's anomaly score based on cross-modal spatiotemporal features, dynamically adjusts the anomaly detection threshold using extreme value theory, and outputs an anomaly identification signal based on the comparison between the anomaly score and the threshold. Specifically, it is used for: First, a generalized Pareto distribution is fitted based on the abnormal score sequence corresponding to historical normal data; then, the dynamically changing anomaly judgment threshold ζ_t is calculated in real time according to the distribution model and the preset significance level; finally, the real-time calculated abnormal score is compared with the dynamic threshold, and the final anomaly judgment signal is output.

[0094] VI. Experimental Verification

[0095] 1. Dataset

[0096] To verify the effectiveness of the proposed multimodal fault and normality detection framework, experiments were conducted on two heterogeneous open-source datasets that differ in system architecture, fault characteristics, and data size, as shown in Table I.

[0097] Table I Experimental Dataset

[0098] Dataset 1 corresponds to the General AIOpsAtlas (GAIA) dataset provided by Cloudwise. The GAIA dataset provides a comprehensive multimodal telemetry data warehouse, collected from a production-grade distributed system, covering runtime data from 10 interconnected instances over 14 consecutive days. This deployment simulates a real microservice architecture with cross-service dependencies using containerized workloads (Kubernetes Pods). Data collection was performed using industry-standard observability tools at a 5-second granularity: Prometheus v2.35 for system metrics (CPU / memory / disk I / O), Fluentd v1.14 for log aggregation, and Jaeger v1.35 for distributed tracing. The dataset contains 728,459 system metrics (covering 42 different metric types), 87.2 million structured log entries (JSON format, containing 18 predefined severity levels), and 28.4 million tracing spans with complete causal relationships.

[0099] Dataset 2 originates from the mission-critical management infrastructure of a Tier 1 commercial bank, encompassing 18 heterogeneous components, including microservice clusters, physical server arrays, distributed database nodes, and containerized workloads. The dataset was rigorously annotated by two senior infrastructure engineers with over ten years of experience in financial systems. These experts performed independent annotation processes on six months of operational records (January-June 2021), employing a double-blind cross-validation protocol to ensure annotation consistency. Fault types are systematically categorized into six critical infrastructure layers: memory anomalies, CPU overload, network congestion patterns, disk failures, JVM memory leaks, and JVM CPU contention scenarios. Each fault instance underwent trimodal validation through waveform analysis (95th percentile threshold), regular expression log pattern matching, and causal relationship reconstruction. As the official evaluation benchmark 2 for the 3rd International AIOps Challenge (2021), Dataset 2 boasts IEEE TNSM-certified data quality, millisecond-precision timestamps, and a full-stack anomaly propagation path. All monitoring data underwent PCIDSS-compliant anonymization, preserving operational semantics while removing commercially sensitive information.

[0100] 2. Hardware processing

[0101] The identification framework was developed based on PyTorch 1.12.1 and deployed on a Linux computing platform equipped with dual Intel Xeon Gold 5218 processors (16 cores / 32 threads @ 2.30GHz), dual NVIDIA Tesla V100 SGPUs (32GB HBM2 VRAM), and 192GB DDR4 memory. To extract time-series patterns, the multimodal data serialization process employed a configurable sliding window mechanism, with a window length of 60 and a step size of 1. Following standard operational analysis practices, the experiment was set up to divide the monitoring sequence for each service instance into time sequences.

[0102] 3. Comparison of recognition results

[0103] The comparative analysis of this invention includes four representative baseline frameworks: JumpStart [4] AnoFusion [5] SCWarn [6] and DiagFusion [7] These methods collectively cover a technical spectrum from single-source analysis to cross-modal collaboration. To ensure experimental rigor, a unified hyperparameter space was established for all models, and a grid search strategy with five-fold cross-validation was used to jointly optimize architectural parameters (such as hidden layer dimensions) and training parameters (such as learning rate scheduling). Model selection employed an early stopping mechanism based on validation set F1 scores, terminating training when no improvement was observed for 15 consecutive epochs. All baseline implementations underwent 10 randomized initialization trials on identical hardware configurations to reduce random bias, and the final performance metrics were reported as the median of three independent experimental runs to ensure statistical reliability.

[0104] The evaluation employs three key metrics: precision, measuring prediction reliability; recall, quantifying the completeness of fault coverage; and the harmonic mean of the two, the F1 score. Precision = TP / (TP+FP), Recall = TP / (TP+FN), where TP (true positives) represents the correctly detected fault window, FP (false positives) represents the normal period of time where faults were mistakenly identified, and FN (false negatives) represents the validated faults missed by the model. This combination of metrics rigorously evaluates the mitigation capabilities for Type I (FP) and Type II (FN) errors.

[0105] Table II shows the performance comparison on the GAIA and AIOps2021 datasets.

[0106] As shown in Table II, the identification framework of this invention achieves comprehensive performance advantages in two heterogeneous operation scenarios: GAIA (microservice-intensive environment) and AIOps2021 (bank core system). In GAIA, MFND achieves a precision of 0.906 and a recall of 0.929, with an F1 score of 0.912; this represents a 5.5% improvement compared to the state-of-the-art DiagFusion (F1=0.857). Notably, its precision exceeds AnoFusion by 11.3% (0.795 vs 0.906), while maintaining a recall comparable to the single-modal JumpStarter (0.929 vs 0.785), validating the advantages of multimodal fusion in improving precision. The AIOps2021 scenario further highlights MFND's capabilities, achieving a precision of 0.872 and a recall of 0.823 (F1=0.855), exceeding DiagFusion by 9.3% (0.762 vs 0.855) in F1 score. This demonstrates its superior ability to detect potential faults in high-reliability environments.

[0107] Comparative analysis reveals key limitations of baseline methods. SCWarn suffers a significant drop in precision due to its rigid modality weighting strategy (GAIA: 0.547, 35.9% lower than MFND; AIOps2021: 0.500), exposing the vulnerability to interference inherent in traditional multimodal strategies. JumpStarter exhibits an extreme precision-recall imbalance in AIOps2021 (precision 0.181 vs. recall 0.500), demonstrating the decision vulnerability of unimodal analysis. Meanwhile, DiagFusion's dynamic modality selection fails in banking systems, with recall dropping to 0.812, indicating its insufficient adaptability to complex infrastructure.

[0108] MFND's superiority stems from its differentiated multimodal attention mechanism, achieving precise cross-modal alignment through three collaborative operations: 1) dynamic tracking of causal relationship modeling (44.86M tracking points in GAIA); 2) temporal correlation analysis of metrics (12.87M metrics in AIOps2021); and 3) entropy-controlled log filtering (achieving 83.2% noise reduction across 66.65M logs). Engineering implementations have validated its operational effectiveness: a 38.7% reduction in false positives (FP) in GAIA (142 → 87 cases compared to DiagFusion) and a 64.3% reduction in false negatives (FN) in AIOps2021 (56 → 20 cases compared to JumpStarter). By optimally balancing precision and recall, MFND establishes a new performance benchmark for industrial-grade fault detection, advancing cross-domain intelligent operations and maintenance through robust multimodal fusion.

[0109] 4. Component Contribution

[0110] Experimental results on the GAIA and AIOps2021 datasets (Tables III and IV) demonstrate that the synergistic integration of the noise filtering, graph construction, and model replacement modules significantly enhances the fault detection capability of the MFND framework. On the GAIA dataset, the noise-filtered full model achieves precision, recall, and F1 score of 0.906, 0.929, and 0.912, respectively, outperforming the unfiltered baseline (0.844 / 0.880 / 0.862). Regarding graph construction, Pearson correlation achieves the best performance with an F1 score of 0.912, surpassing Spearman correlation (F1=0.890) and distance correlation (F1=0.885). The model replacement module further validates the superiority of GATv2Conv: compared to GAT, its F1 score improves from 0.891 to 0.912, with precision and recall increasing by 2.4, respectively.

[0111] Table III shows the performance comparison on the GAIA dataset.

[0112] Performance comparison of Table IV on the AIOps2021 dataset

[0113] In the AIOps2021 dataset, the complete noise filtering model improved the F1 score from 0.818 to 0.855, while Pearson correlation maintained the best performance with an F1 score of 0.855. Notably, the MIC method in graph construction showed an unusually low F1 score of 0.944, requiring further validation. By integrating all three modules (noise filtering + Pearson + GATv2Conv), MFND demonstrated cross-scene robustness: a 5.8 improvement in the F1 score on GAIA.

[0114] Finally, by combining the results of noise filtering and graph construction modules, the efficiency of the MFND method becomes apparent. By employing state-of-the-art techniques in noise filtering and graph construction, the MFND method demonstrates superior performance, significantly improving F1 scores on both the GAIA and AIOps2021 datasets, thus validating its effectiveness.

[0115] The above analysis clearly demonstrates the necessity and superiority of each core component in the MFND framework. Regarding noise filtering, enabling the full modality-specific denoising module significantly improved the F1 score from 0.862 to 0.912 compared to the baseline without any filtering (WithoutFilter), confirming its crucial role in improving data quality and model robustness. In graph construction methods, a horizontal comparison of various association metrics showed that the Pearson correlation coefficient achieved the best performance with an F1 score of 0.912, maintaining high precision (0.906) while achieving the highest recall (0.929), proving it to be the optimal and balanced choice for modeling linear dependencies between modalities, outperforming other methods such as mutual information and Spearman correlation. At the network architecture level, replacing the traditional graph attention network (GAT) with a dynamic graph attention network (GATv2Conv) improved the F1 score from 0.891 to 0.912, verifying that its dynamic attention mechanism can more effectively capture evolving dependencies in complex microservice environments. In summary, the experimental data fully demonstrate that the specific combination of technologies integrated into the MFND framework—namely, adversarial training-based modal denoising, Pearson correlation-based dynamic graph construction, and hybrid neural network integrating GTN and GATv2Conv—constitutes a complete solution with optimal performance and synergistic effects, none of which can be omitted.

[0116] 5. Hyperparameter sensitivity analysis

[0117] like Figure 7 As shown, this study highlights the critical impact of window parameters on fault detection performance by systematically adjusting the time window size (ranging from 15 to 120). For the two heterogeneous datasets GAIA and AIOps2021, the F1 score peaks when the window size is set to 30. This phenomenon can be attributed to the dual effect of window size: windows that are too small (<30) cannot capture the complete fault propagation chain (e.g., microservice calls typically require 25-35 sampling points to achieve full path coverage), while windows that are too large (>60) introduce irrelevant temporal noise (such as interference from periodic maintenance tasks), thus diluting key features.

[0118] More specifically, a window size of 30 perfectly matches the average depth of microservice call chains in the GAIA scenario (3.2 hops, 9-11 sampling points per hop). In the AIOps2021 scenario, this corresponds to the transaction group batch processing cycle (28-32 seconds) of a bank transaction pipeline. When the window size is expanded to 60, the GAIA F1 score decreases, mainly due to the interference of cross-instance redundancy metrics with causal modeling of core services. Experimental results confirm that the optimal window size is strongly influenced by the temporal characteristics of the business scenario. The general choice of a window size of 30 strikes a balance between cross-modal alignment requirements and noise suppression capabilities, providing a key parameter for practical deployment.

[0119] VII. Conclusion

[0120] This invention proposes MFND, an innovative multimodal fault detection framework designed to address the key challenges of monitoring and diagnosing faults in dynamic microservice architectures. By integrating logs, metrics, and tracing data, MFND establishes a robust and efficient fault detection method, overcoming the limitations of traditional unimodal methods.

[0121] MFND's core innovation lies in its dynamic graph construction method, which effectively models linear dependencies between heterogeneous data sources using the Pearson correlation coefficient. Compared to traditional interoperability technologies, this method demonstrates superior performance in capturing service call patterns and resource contention scenarios while maintaining computational efficiency.

[0122] Notably, this model architecture innovatively replaces the traditional Graph Attention Network (GAT) with GATv2Conv. Its dynamic attention mechanism, implemented through a learnable nonlinear transformation function, adaptively adjusts the distribution of attention weights among different nodes. This enhancement significantly improves the modeling accuracy of anomaly propagation paths in complex topologies, such as dynamic dependencies between microservices.

[0123] To address noise issues in raw monitoring data, MFND introduced a filtering mechanism based on an adversarial autoencoder. This innovation effectively eliminates irrelevant debug logs, transient metric fluctuations, and incomplete tracking data while preserving key fault characteristics. This preprocessing step significantly enhances the robustness of subsequent analysis.

[0124] MFND, combining a hybrid architecture of graph transformation networks and dynamic graph attention networks, dynamically adapts to evolving system topologies, achieving state-of-the-art performance: an F1 score of 0.912, precision of 0.906, and recall of 0.929. The framework further validates its effectiveness by determining optimal configurations for real-world deployments, such as identifying a 30-step window size that balances fault propagation coverage and noise suppression. Furthermore, the superior performance of Pearson correlation in modeling microservice dependencies provides practitioners with practical insights for designing monitoring systems.

[0125] VIII. Reference Documents [4] Minghua Ma, Shenglin Zhang, Junjie Chen, Jim Xu, Haozhe Li, Yongliang Lin, Xiaohui Nie, Bo Zhou, Yong Wang, and Dan Pei. {Jump-Starting} multivariate time series anomaly detection for online service systems. In 2021 USENIX Annual Technical Conference (USENIXATC21), pages 413–426, 2021. [5] Chenyu Zhao, Minghua Ma, Zhenyu Zhong, Shenglin Zhang, Zhiyuan Tan, Xiao Xiong, LuLu Yu, Jiayi Feng, Yongqian Sun, Yuzhi Zhang, et al. Robust multimodal failure detection for microservice systems. In Proceedings of the 29 th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 5639–5649, 2023. [6] Nengwen Zhao, Junjie Chen, Zhaoyang Yu, Honglin Wang, Jiesong Li, Bin Qiu, Hongyu Xu, Wenchi Zhang, Kaixin Sui, and Dan Pei. Identifying bad software changes via multimodal anomaly detection for online service systems. In Proceedings of the 29 thACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 527–539, 2021. [7]Shenglin Zhang, Pengxiang Jin, Zihan Lin, Yongqian Sun, BichengZhang, Sibo Xia, Zhengdan Li, Zhenyu Zhong, Minghua Ma, WaJin, et al. Robust failure diagnosis of microservice system through multimodal data. IEEE Transactions on Services Computing, 16(6):3851–3864, 2023.

[0126] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for anomaly identification in a microservice system based on multimodal fusion, characterized in that, include: Acquire multimodal data from the microservice system, including tracing data, log data, and metric data, and perform modality-specific noise filtering on the multimodal data; Based on the denoised multimodal data, the Pearson correlation coefficient between different modal data is calculated. A dynamic graph representing the correlation between modalities is constructed with modalities as nodes and Pearson correlation coefficients as edge weights. The dynamic graph is input into a pre-trained hybrid graph neural network model to extract cross-modal spatiotemporal features that represent the system state; Based on the features extracted by the hybrid graph neural network model, the anomaly score of the system state is calculated, and the anomaly judgment threshold is dynamically adjusted in combination with the extreme value theory, so as to identify system anomalies based on the comparison result of the anomaly score and the anomaly judgment threshold.

2. The anomaly identification method for microservice systems based on multimodal fusion according to claim 1, characterized in that, The steps for modality-specific noise filtering of tracking data are as follows: Inputting noisy or incomplete raw tracking data x into the generator of the adversarial autoencoder model a And repair the original tracking data; Initiating the dual-discriminator collaborative verification process: First discriminator The generator output data undergoes call chain spatiotemporal continuity verification, and a second discriminator is used. Perform metadata consistency verification on the data output by the generator; The generator is trained and optimized using a pre-defined loss function, which is: L G =E x~pdata [log(1-D1(G(x a )))+log(1-D2(G(x a )))]+λE x~pdata ||G(x a )-x a || 2 In the formula, L G E represents the total loss function of the generator; x~pdata This indicates that x represents the original tracking data distribution pdata. a "Calculate the expected value; log represents the natural logarithm; G(x) a ) indicates that the generator is applied to x a The output generated data; λ represents the weight coefficient of the reconstruction loss; ||·|| 2 Represents the L2 norm; The generator outputs the repaired tracking data, completing the repair and metadata correction of the original tracking data.

3. The anomaly identification method for a microservice system based on multimodal fusion according to claim 2, characterized in that, The loss functions of the two discriminators are expressed as follows: In the formula, Indicates the first discriminator The loss function; Let D2 represent the loss function of the second discriminator.

4. A method for anomaly identification in a microservice system based on multimodal fusion according to claim 1 or 2, characterized in that, The steps for modality-specific noise filtering of log data are as follows: The Drain3 algorithm is used to convert the original unstructured log collection into a structured template library T. parse ; With T parse Given a unique input, for T parse For each log template t, combining TF-IDF term saliency with a predefined set of domain keywords κ, a composite semantic score S(t) is calculated for each log template t. Log templates with S(t) greater than or equal to a semantic threshold are retained, resulting in a semantically filtered template library T. sem ; In the formula, w represents a single term contained in log template t; TF-IDF(w) represents the TF-IDF value of term w; β represents the weight amplification coefficient of domain keywords; I (w∈κ) represents the indicator function; Calculate T sem The normalized frequency f(t) of each template t is used to eliminate templates with f(t) < θ using a double threshold strategy. low Or f(t)>θ high The template outputs a refined log template library T. final Complete the noise reduction of log data; Where, θ low θ high These represent the 5th and 95th percentiles of the historical frequency distribution, respectively.

5. A method for anomaly identification in a microservice system based on multimodal fusion according to claim 1 or 2, characterized in that, The steps for filtering modality-specific noise from the indicator data are as follows: By integrating time window statistics and spatial grouping statistics, the original indicator data is standardized. In the formula, x b This represents the original indicator data. Standardized indicator data; μ t , These represent the mean and variance of the time window, respectively; μ s , α and β are the mean and variance of the spatial grouping, respectively; α and β are the corresponding weighting coefficients, respectively. Using standardized indicator data as input, and addressing missing values ​​that occurred during data collection, this method calculates the distance from the missing point to the previous valid point x, based on the principle of temporal locality. m-τ distance d prev , to the next valid point x m+τ distance d next According to the weighted formula Calculate interpolation values Complete the missing data to obtain a complete time-series index dataset; Using a complete time-series index dataset as input, a local outlier algorithm is used to detect global outliers. When the local outlier factor is greater than 2.0, outlier data that deviate from the normal distribution are marked and filtered. Z-Score normalization is performed on the filtered data for 50 sample windows, and the final output is the denoised index data.

6. The anomaly identification method for a microservice system based on multimodal fusion according to claim 1, characterized in that, The steps for constructing a dynamic graph are as follows: Obtain the denoised multimodal data, calculate the Pearson correlation coefficient between every two modalities in the three modalities of the multimodal data, and quantify the linear dependence between logs and metrics, logs and tracking, and metrics and tracking using the Pearson correlation coefficient; Using logs, metrics, and tracking as nodes in the graph, and the calculated Pearson correlation coefficients between pairs of modes as the weights of the connecting edges between corresponding nodes, an adjacency graph representing the static association between modes is constructed. The static adjacency graph is time-series aggregated according to the preset time slices to form a dynamic graph flow consisting of a series of static graphs that dynamically evolve with the system's operating state. The static graph corresponding to each time slice recalculates the Pearson correlation coefficient based on the modal data within the corresponding time slice to update the edge weights, so that the entire graph structure can reflect the temporal changes in the correlation between modalities in real time. Finally, the dynamic graph flow is output for subsequent feature learning.

7. The anomaly identification method for a microservice system based on multimodal fusion according to claim 6, characterized in that, The steps for extracting spatiotemporal features are as follows: The dynamic graph stream is input into a pre-trained hybrid graph neural network model; By using the graph Transformer network layer in a hybrid graph neural network model, global dependencies between nodes in a dynamic graph flow are learned. By using a dynamic graph attention network layer in a hybrid graph neural network model, importance weights between nodes in the dynamic graph flow are dynamically assigned to capture local critical dependencies. By using gated recurrent units in a hybrid graph neural network model, the evolution of dynamic graph flow in the time dimension is modeled. Integrate global dependencies, local critical dependencies, and evolutionary patterns to output corresponding cross-modal spatiotemporal features.

8. The anomaly identification method for a microservice system based on multimodal fusion according to claim 7, characterized in that, Based on the abnormal score sequence corresponding to historical normal data, a generalized Pareto distribution is fitted, and a dynamic anomaly detection threshold is calculated according to the generalized Pareto distribution and the preset significance level.

9. The anomaly identification method for a microservice system based on multimodal fusion according to claim 8, characterized in that, The anomaly detection threshold is expressed as follows: In the formula, ζ t Indicates the threshold for anomaly detection; u represents the initial high quantile threshold; ξ represents the shape parameter; δ represents the scale parameter; N represents the total number of samples; n u This indicates the number of times u is exceeded in the statistical history, and ε indicates the specified significance level.

10. A microservice system anomaly identification architecture based on multimodal fusion, characterized in that, include: The data preprocessing and modality-specific noise reduction module is used to perform the modality-specific noise filtering step in the microservice system anomaly identification method based on multimodal fusion as described in any one of claims 1-5, so as to obtain denoised multimodal data; A dynamic graph construction module is used to execute the dynamic graph construction step in the microservice system anomaly identification method based on multimodal fusion as described in claim 6, so as to obtain a dynamic graph; The feature extraction module is used to perform the cross-modal spatiotemporal feature acquisition step in the microservice system anomaly identification method based on multimodal fusion as described in claim 7, so as to obtain cross-modal spatiotemporal features; The anomaly determination module is used to perform the system anomaly identification step in the microservice system anomaly identification method based on multimodal fusion as described in claim 8 or 9, in order to identify system anomalies.

Images