Dynamic spatio-temporal graph learning microservice anomaly detection method for multi-modal data

Abstract

The application discloses a kind of dynamic spatio-temporal graph learning microservice exception detection methods for multi-modal data, which comprises: collecting data information from the microservice system to be detected and inputting into computer system and carrying out data preprocessing, obtaining multi-modal data;The multi-modal data is processed based on the sliding window mechanism, and a dynamic dependency graph sequence is constructed;Based on dynamic dependency graph sequence, spatial relationship modeling and time series dynamic evolution modeling are performed, a representation integrating time series information is generated, and a graph-level representation vector containing complete spatio-temporal context is generated;The graph-level representation vector is input into a deep vector data description anomaly detection model based on contrast learning, and the detection result is output.The microservice exception detection based on multi-modal dynamic spatio-temporal graph learning and contrast enhancement SVDD of the application explicitly captures the dynamic evolution characteristics of microservice topology structure, and realizes the deep fusion of spatio-temporal coupling characteristics, while suppressing the decision boundary ambiguity problem in unsupervised detection.

Description

Dynamic Spatiotemporal Graph Learning Microservice Anomaly Detection Method for Multimodal Data Technical Field

[0001] This invention relates to the field of microservice anomaly detection, and in particular, to a dynamic spatiotemporal graph learning method for microservice anomaly detection based on multimodal data. Background Technology

[0002] Microservice systems, as a core form of distributed architecture, support the efficient deployment, elastic scaling, and agile iteration of various complex business processes. With the widespread adoption of microservice systems, system scale and complexity are increasing daily, and the calling relationships between service instances exhibit highly dynamic and intertwined dependencies, posing numerous challenges to anomaly detection.

[0003] First, the dependency graph of microservice calls is highly dynamic, with its edge weights and topology constantly evolving over time. Existing static graph methods often struggle to capture these temporal changes, making it difficult to effectively distinguish between normal dynamic adjustments and anomaly propagation, and also failing to perceive real-time changes in dependency strength.

[0004] Secondly, the abnormal patterns of microservice systems are usually formed by both spatial structure dependencies and temporal evolution dependencies. However, existing research focuses on single-dimensional modeling and lacks the ability to jointly learn spatiotemporal fusion features, making it difficult to achieve the fusion of complex spatiotemporal features within a unified framework.

[0005] Finally, in weakly supervised or unsupervised scenarios, the boundary between difficult samples and true anomalous samples is often blurred, and the feature space is easily dragged by noisy samples. Existing reconstruction-based methods struggle to effectively distinguish between the two, resulting in insufficient boundary discrimination capabilities.

[0006] In summary, to address the limitations of existing technologies that do not simultaneously address dynamic topology awareness, spatiotemporal feature fusion, and ambiguous decision boundaries, a dynamic spatiotemporal graph learning microservice anomaly detection method for multimodal data is proposed. Summary of the Invention

[0007] The main objective of this invention is to provide a dynamic spatiotemporal graph learning microservice anomaly detection method for multimodal data, in order to overcome the limitations of existing technologies such as static topology failing to capture real-time dependency changes, lack of effective modeling of dynamic spatiotemporal dependencies of service nodes, and often blurred boundaries between difficult samples and real abnormal samples.

[0008] Based on the first main aspect of the present invention, a method for anomaly detection in a dynamic spatiotemporal graph learning microservice for multimodal data is provided, comprising the following steps performed by a computer system:

[0009] Data information is collected from the microservice system to be tested, input into the computer system, and preprocessed to obtain multimodal data; the data information includes log data, performance indicators, and raw tracking data.

[0010] The multimodal data is segmented based on a sliding window mechanism to generate detection windows. Each detection window is further divided into multiple data steps to construct a dynamic dependency graph sequence.

[0011] Based on dynamic dependency graph sequences, spatial relationship modeling and temporal dynamic evolution modeling are performed through graph attention networks and gated graph neural networks to generate representations that integrate temporal information;

[0012] Based on the fused temporal information representation, average pooling is performed on all time steps to generate a graph-level representation vector containing the complete spatiotemporal context;

[0013] The graph-level representation vector is input into a deep vector data description anomaly detection model based on contrastive learning. The Euclidean distance from the graph-level representation vector to the center of the low-dimensional hypersphere space is calculated, and the detection result is output based on the Euclidean distance.

[0014] As a further preferred embodiment, in the aforementioned method, the data preprocessing includes parsing log data, preprocessing performance metrics, and parsing raw tracking data;

[0015] The execution steps for parsing the log data are as follows:

[0016] The Drain parser is used to extract templates from the log data and convert them into structured log data. Unidentified templates are classified into a unified category, and timestamps and service instance identifiers are retained. At the same time, the data is aggregated by service node and sliding time window.

[0017] The temporal dependencies of events in structured log data are modeled based on the Hawkes self-excited point process. The baseline intensity vector of each service node within each sliding time window is determined by maximum likelihood, and a temporal log feature sequence representation is generated.

[0018] The execution steps for the performance index preprocessing are as follows:

[0019] The performance index sequence at all timestamps is truncated using IQR to suppress extreme values; then, it is standardized by median absolute deviation to obtain the index sequence.

[0020] The execution steps for parsing the raw tracking data are as follows:

[0021] Extract the service instance identifier, start timestamp, and response latency for each span from the original tracking data;

[0022] After aggregating the span according to the time dimension, calculate the latency statistics of each service node within the corresponding time window to generate a time-series tracking feature sequence;

[0023] The multimodal data includes time-series log feature sequence representation, indicator sequence, and time-series tracking feature sequence.

[0024] As a further preferred embodiment, in the aforementioned method, the execution steps for constructing the dynamic dependency graph sequence are as follows:

[0025] Based on the multimodal data, the time axis is divided using a sliding window mechanism with a preset window length and step size to generate multiple detection windows;

[0026] For each detection window, a dynamic dependency graph sequence is constructed by further dividing it into multiple time steps;

[0027] Specifically, the dynamic dependency graph sequence includes multiple dynamic graph snapshots, and each dynamic graph snapshot includes a set of nodes corresponding to service instances in the system, node features, a set of directed edges, and an edge weight matrix.

[0028] As a further preferred embodiment, in the aforementioned method, the steps for performing spatial relationship modeling are as follows:

[0029] Based on graph attention network, modality-adaptive encoding is performed on node features, which are composed of time-series log feature sequence representation, index sequence and time-series tracking feature sequence concatenated.

[0030] Specifically, the time-series log feature sequence representation is encoded using an embedding layer combined with a fully connected layer, while the index sequence and time-series tracking feature sequence are encoded using a one-dimensional convolutional neural network.

[0031] The three types of feature encoding results are mapped to a unified embedding space for normalization to obtain fused features;

[0032] Based on the fusion features, a multi-layer graph attention network is used to update the node features of all nodes in the current layer;

[0033] In each layer of the graph attention network, for each service node, the attention weights between it and all its neighboring nodes are calculated through a multi-head self-attention mechanism.

[0034] The attention weights are used to perform a weighted summation of the node features of the neighboring nodes, and then the representation of the node features is calculated using an activation function.

[0035] After multiple iterations, each service node obtains a spatial representation that integrates multi-hop domain and multimodal information;

[0036] The attention weight is determined by the similarity of the node features of the service node and the neighboring nodes after linear transformation.

[0037] As a further preferred embodiment, in the aforementioned method, the execution steps of the temporal dynamic evolution modeling are as follows:

[0038] Using a gated graph neural network, for the current time step of the dynamic graph snapshot in the dynamic dependency graph sequence, firstly, the neighbor states of each service node are weighted and summed according to the call intensity in the edge weight matrix to obtain the weighted message;

[0039] The weighted message and the historical state of the service node in the previous time step are input into the gated loop unit for fusion to update the hidden state of the service node in the current time step.

[0040] Iterate in the order of time steps until all nodes of the dynamic dependency graph sequence have been processed, and the hidden states of nodes at all time steps are obtained.

[0041] A multi-head self-attention mechanism is used to perform weighted fusion of the hidden states of nodes at all time steps to generate a representation of the fused time-series message.

[0042] As a further preferred embodiment, in the aforementioned method, the deep vector data description anomaly detection model based on contrastive learning includes a nonlinear projection layer that maps the graph-level representation vector to a low-dimensional hypersphere space.

[0043] Specifically:

[0044]

[0045] Among them, among them, among them Represents the projection matrix. Represents the dimension of a low-dimensional hypersphere. This represents the bias vector. This indicates that the sequence elements are real numbers. Represents the dimension of node features. Represents the hypersphere embedding vector. The hyperbolic tangent activation function ensures that the embedding vector is constrained within a bounded space. This represents a graph-level vector representation.

[0046] As a further preferred embodiment, in the aforementioned method, the training process of the deep vector data description anomaly detection model based on contrastive learning includes:

[0047] During the training phase, the center of the low-dimensional hypersphere space is initialized using pure normal samples, and a contrastive learning mechanism is introduced to construct a joint loss function.

[0048] The joint loss function includes a first loss term, a contrastive loss term, and a regularization term;

[0049] Specifically, the joint loss function is shown in the following equation:

[0050]

[0051] in, The first loss term is the SVVD loss for normal samples. Indicates comparative loss, Indicates the weight of the comparative loss. This represents all trainable parameters in the model. Represents the regularization coefficient;

[0052] A deep vector data description anomaly detection model based on contrastive learning is trained by optimizing the joint loss function.

[0053] As a further preferred embodiment, in the aforementioned method, the execution steps for outputting the detection result based on the Euclidean distance are as follows:

[0054] The calculated Euclidean distance is defined as the anomaly score for the current detection window;

[0055] The abnormal score is compared with a preset threshold; if the abnormal score is greater than the preset threshold, it is determined to be abnormal.

[0056] If the abnormal score exceeds the preset threshold, it is judged as normal.

[0057] According to a second key aspect of the present invention, an electronic device is provided, comprising: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0058] The memory stores a computer program that, when executed by the processor, causes the processor to perform the aforementioned dynamic spatiotemporal graph learning microservice anomaly detection method for multimodal data.

[0059] Based on a third key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed, implements the aforementioned dynamic spatiotemporal graph learning microservice anomaly detection method for multimodal data.

[0060] Compared with existing technologies, this invention provides a microservice anomaly detection method that learns from the dynamic spatiotemporal graph of multimodal data. First, this invention uses a temporal dependency graph sequence for construction, and performs timely segmentation of multimodal data based on a sliding window. It generates an independent weighted directed adjacency matrix for each time window, and explicitly maps the real-time service call intensity to dynamic edge weights, providing a dynamic view for the microservice system. This solves the problem that traditional static graph construction methods ignore the "topology drift" phenomenon and cannot distinguish between normal dynamic adjustments and anomaly propagation, thus improving the ability to capture real-time changes in service dependencies.

[0061] Secondly, this invention constructs a hierarchical spatiotemporal joint graph representation learning network, adopting a two-layer architecture of space and time. It captures the spatial topological dependence of multimodal data at a single time step by modeling spatial relationships, and aggregates the dynamic evolution trajectory of nodes across time steps by using temporal dynamic evolution modeling. This solves the difficulty of existing technologies in effectively modeling the dynamic spatiotemporal dependence of service nodes, realizes the deep integration of spatiotemporal coupling features, and improves the model's ability to represent structural anomalies in complex dynamic environments.

[0062] Finally, this invention designs a contrast-enhanced deep SVDD joint optimization framework, which compacts the normal sample space by constraining the center of the hypersphere, and introduces contrast loss to explicitly infer potential abnormal samples using a small number of negative examples, thereby maximizing the separation degree between normal and abnormal patterns in the feature space. This solves the problem of ambiguous decision boundaries and low recognition rate of difficult samples at the distribution edge in the prior art, and achieves high-precision and robust discrimination of microservice anomalies. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0064] Figure 1 shows the execution flowchart of a microservice anomaly detection method based on dynamic spatiotemporal graph learning from multimodal data in one embodiment of the present invention;

[0065] Figure 2 shows an architecture diagram of dynamic dependency graph construction for a microservice anomaly detection method based on dynamic spatiotemporal graph learning from multimodal data in one embodiment of the present invention;

[0066] Figure 3 illustrates the architecture of a graph neural network for spatial and temporal modeling of a microservice anomaly detection method that learns from dynamic spatiotemporal graphs of multimodal data, according to an embodiment of the present invention.

[0067] Figure 4 shows an architecture diagram of an anomaly detection method for learning microservice anomaly detection from dynamic spatiotemporal graphs of multimodal data in one embodiment of the present invention.

[0068] Figure 5 shows a parameter sensitivity analysis diagram of a microservice anomaly detection method based on dynamic spatiotemporal graph learning from multimodal data in one embodiment of the present invention on an experimental dataset. Detailed Implementation

[0069] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0070] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0071] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0072] The following is a description of the specific meanings of technical terms, English abbreviations, and formula parameters that may be used in this invention:

[0073] Drain Parser: A high-efficiency online log parsing algorithm whose core objective is to solve the problem of converting unstructured logs into their structure.

[0074] Hawkes self-excited point process: a dynamic time-series point process model that describes the self-excited phenomenon in which the occurrence of an event increases the probability of subsequent similar / related events.

[0075] IQR truncation: A method for handling outliers based on interquartile ranges, used to clean up extreme values ​​in data.

[0076] Graph Attention Network (CAT): A graph neural network (GNN) based on an attention mechanism. Its core is to adaptively aggregate the features of neighboring nodes by learning the attention weights between nodes.

[0077] GATv2: An improved version of Graph Attention Network (GAT), its core is to perform weighted aggregation of node domains through dynamically learned attention weights, while also improving the calculation method of attention scores, thus solving the problem of limited expressive power of the original GAT. It is the core module of spatial aggregation features in this invention.

[0078] Gated Graph Neural Network (GGNN): A type of graph neural network that introduces a gating mechanism. It combines graph structure information with the temporal modeling capability of gated recurrent units, and adapts the information transmission and forgetting of hidden states of nodes by updating and resetting gates.

[0079] Low-dimensional hypersphere space: a low-dimensional feature space commonly used in machine learning single classification and anomaly detection tasks. The core is to transform high-dimensional original features into a low-dimensional space through a learnable mapping function, and use the hypersphere as the core modeling carrier to achieve a compact characterization of the distribution of target samples.

[0080] A hypersphere is a set of all points in an n-dimensional feature space whose distance to a fixed center is less than or equal to a certain threshold.

[0081] Sliding window mechanism: a basic data segmentation strategy for processing continuous time-series or streaming data. Its core is to cut unbounded continuous data into multiple sub-data modules with contextual relationships by setting the window length and sliding step size, which facilitates subsequent analysis, modeling or anomaly detection.

[0082] Unseen category: This refers to the category that was not included in the training data during the model training phase.

[0083] Self-attention mechanism: an adaptive weighted fusion mechanism used to capture dependencies between elements within a sequence.

[0084] SVDD: Support Vector Data Description, is a single-class machine learning algorithm that uses only normal samples to perform anomaly detection.

[0085] Deep SVDD: Deep Single-Class Support Vector Data Description is an algorithm that combines the feature extraction capabilities of deep learning with the traditional SVDD single-class classification idea. It is one of the core technologies for solving anomaly detection tasks in complex high-dimensional data.

[0086] Contrastive learning: a self-supervised learning paradigm. Its core is to build similar-dissimilar sample pairs so that the model learns the essential feature representation of the data, thereby improving the model's ability to discriminate the data.

[0087] As shown in Figure 1, in one embodiment, a microservice anomaly detection method based on learning dynamic spatiotemporal graphs of multimodal data according to the present invention includes the following steps S1-S5 executed by a computer system:

[0088] S1, collect data information from the microservice system to be tested, input it into the computer system, and perform data preprocessing to obtain multimodal data; the data information includes log data, performance indicators, and raw tracking data;

[0089] S2, the multimodal data is segmented based on the sliding window mechanism to generate a detection window, and each detection window is further divided into multiple data steps to construct a dynamic dependency graph sequence;

[0090] S3, based on dynamic dependency graph sequences, performs spatial relationship modeling and temporal dynamic evolution modeling through graph attention networks and gated graph neural networks to generate representations that integrate temporal information;

[0091] S4, Based on the representation of the fused temporal information, average pooling is performed on all time steps to generate a graph-level representation vector containing the complete spatiotemporal context;

[0092] S5, input the graph-level representation vector into the deep vector data description anomaly detection model based on contrastive learning, calculate the Euclidean distance from the graph-level representation vector to the center of the low-dimensional hypersphere space, and output the detection result based on the Euclidean distance.

[0093] To address the challenges of topology drift and ambiguous decision boundaries in anomaly detection for microservice systems in dynamic environments, this invention proposes a microservice anomaly detection method (TGSphere) based on multimodal dynamic spatiotemporal graph learning and contrast-enhanced SVDD.

[0094] Specifically, as shown in Figures 2 to 4, a systematic anomaly detection framework is proposed for multimodal monitoring data consisting of logs, metrics, and traces. This framework mainly includes three stages.

[0095] In the first stage, a weighted directed dynamic dependency graph sequence is constructed based on a sliding window.

[0096] Next, a spatiotemporal graph encoder is designed to generate a fused graph-level representation by jointly modeling the dependencies between services and the temporal evolution patterns within the window through spatial attention and gated graph neural networks.

[0097] Finally, contrast-enhanced SVDD was used for optimization. While compacting the feature space of normal samples, contrastive learning was used to increase the distance with abnormal samples, thereby achieving accurate anomaly detection based on hypersphere distance.

[0098] In one feasible implementation, step S1 is described in detail:

[0099] (1) Logs analysis

[0100] Logs are semi-structured text data that record system status and significant events at key points in time. TGSphere employs a combined structured and time-series modeling approach for log data in microservice systems.

[0101] This invention uses the Drain parser, which is widely used in other research centers, to extract templates from raw unstructured logs, thereby achieving a structured representation of the logs.

[0102] Each log entry is mapped to a corresponding event template number, and unseen templates are categorized as "Unseen".

[0103] Based on this, timestamps and service instance identifiers are retained, and log events are aggregated by service node and sliding time window.

[0104] To address the temporal dependencies of log events, the Hawkes self-starting point process is introduced to model the occurrence intensity of each type of event, capturing the self-starting and mutual influence relationships between events.

[0105] For nodes The For a class of events, the conditional strength function is defined as:

[0106]

[0107] in, Represents a node The first Baseline strength of class events, Indicates a time step. Indicates time step With historical time Time difference, This indicates that the kernel function is triggered, using exponential form. This indicates the index of the log event type.

[0108] Specifically, triggering the kernel function:

[0109]

[0110] in Indicates the intensity attenuation coefficient. Indicates hyperparameters, Represents an exponential function. Indicates a time step. Indicates the log event type index. This indicates that the kernel function is triggered.

[0111] Finally, the baseline intensity vector of each service node within each time window is obtained through maximum likelihood estimation, resulting in the time-series log feature sequence:

[0112]

[0113] in, Indicates the sequence length. Indicates the characteristic sequence of time-series logs In the middle, the first The log feature matrix at each time step, where For the number of service nodes, Total number of log templates (including the "Unseen" category). Indicates a time step.

[0114] (2) Metrics preprocessing

[0115] Each service instance is typically accompanied by multiple performance metrics (KPIs), such as network traffic, CPU utilization, and memory usage.

[0116] The original indicator data sequence is denoted as:

[0117]

[0118] in, Indicates the sequence length. Indicates the original indicator data sequence In the middle, the first Each time step service nodes Dimension the original index observation value, Indicates a time step. This indicates the performance metric dimension.

[0119] To suppress the interference of extreme values ​​on subsequent standardization and feature learning, the nodes... performance indicators Sequences at all time steps: Perform IQR truncation. Indicates a time step.

[0120] The specific IQR truncation is shown below:

[0121]

[0122]

[0123]

[0124] in, Indicates the lower quartile, To represent the upper quartile, Indicates interquartile range, [ , ] indicates the truncated interval.

[0125] Finally, again Standardize the median absolute deviation (MAD):

[0126]

[0127] in, This represents the median calculation function. This represents the Gaussian calibration factor.

[0128] Obtain the indicator sequence:

[0129]

[0130] in, Indicates the sequence length. Indicator sequence In the middle, the first The indicator feature matrix at each time step Indicates the number of service nodes. Indicates performance metric dimensions, Indicates a time step.

[0131] (3) traces analysis

[0132] In a microservice system, distributed tracing records the complete execution path of a user request across various service instances. Each tracing consists of several spans, which contain key information such as tracing ID, span ID, parent span ID, service instance ID, start time, and duration.

[0133] This invention systematically analyzes the raw trace data. First, it traverses all traces and spans, extracting the service instance ID and start timestamp for each span. and response delay .

[0134] Subsequently, the spans are aggregated by timestamps to construct a time series mapping relationship between timestamps and service delay sets.

[0135] For each time window, calculate the latency statistics of each service node within the window to form a time-series tracking feature sequence:

[0136]

[0137] in, Indicates the sequence length. Indicates the time-series tracking feature sequence In the middle, the first The temporal tracking feature matrix at each time step, To indicate the number of service nodes, This indicates the dimension of the statistical feature.

[0138] In one feasible implementation, step S2 is described in detail:

[0139] After obtaining , and Next, a service dependency graph is built to integrate the three modalities and represent the state and invocation relationship of service instances in the microservice system.

[0140] To capture the temporal evolution pattern of the system, this invention employs a sliding window strategy to generate detection samples.

[0141] Use window length Step length Divide the time axis to generate a detection window:

[0142]

[0143] in, Indicates the start marker of the time window. Indicates the end marker of the time window. Indicates the index of the time window. Indicates a time step.

[0144] For each detection window Further divided into At each time step, construct the sequence of dynamic dependency graphs:

[0145]

[0146] in, Indicates the first A snapshot of the dynamic dependency graph sequence at each time step.

[0147] Specifically, for any time step A snapshot of a dynamic graph sequence is defined as: This represents a snapshot of a dynamic dependency graph sequence. This indicates that the set of nodes corresponds to the service instances in the system.

[0148] Specifically, the corresponding node features are defined as follows:

[0149] in, , This indicates the concatenation of feature dimensions. Indicates a time step. Indicates the characteristic sequence of time-series logs In the middle, the first Log feature matrix at each time step Indicator sequence In the middle, the first The indicator feature matrix at each time step Indicates the time-series tracking feature sequence In the middle, the first The temporal tracking feature matrix at each time step, The total dimension representing the node features. This represents the total number of log templates. Indicates performance metric dimensions, Represents the statistical feature dimension. Indicates the number of service nodes. Represents a set of directed edges; The edge weight matrix is ​​obtained by aggregating call counts within a time window and normalizing by row, showing the non-zero positions of the edge weights. Represents a node Call another node The weight values ​​reflect the intensity of the calls after normalization.

[0150] In one feasible implementation, step S3 is described in detail:

[0151] TGSphere is built on a hierarchical graph neural network architecture and aims to achieve microservice anomaly detection through dynamic structure learning.

[0152] This invention designs a joint architecture of a Spatial Feature Module (SFM) and a Temporal Evolution Module (TEM).

[0153] During the encoding phase, the model receives a sequence of dynamic graphs. As input.

[0154] To achieve effective fusion of multimodal information, the raw data first undergoes an input embedding operation, mapping it to a unified initial node representation. .

[0155] To model the complex heterogeneous dependencies between microservices, a GAT-based SFM module is proposed. As input, it aggregates neighborhood topology information and generates spatial aggregation features. .

[0156] Furthermore, to capture the temporal dependencies of node states within the sliding window, this invention designs a TEM module based on GGNN, utilizing... With dynamic edge weight state updates, a hidden state sequence is finally generated. .

[0157] In one embodiment, spatial relationship modeling is first performed:

[0158] The Spatial Feature Module (SFM) aims to aggregate multimodal features of neighboring nodes by learning the dependency strength between service instances.

[0159] Unlike traditional graph attention networks, the call relationships in microservice systems have different directions and strengths. Therefore, graph attention networks (GAT) are used to model this heterogeneous dependency.

[0160] For each snapshot in the graph sequence Its node characteristics It is composed of preprocessed features from three modalities. This indicates that the set of nodes corresponds to the service instances in the system. Represents a set of directed edges; Represents the edge weight matrix. Indicates the characteristic sequence of time-series logs In the middle, the first Log feature matrix at each time step Indicator sequence In the middle, the first Indicator feature matrix at each time step Indicates the time-series tracking feature sequence In the middle, the first The temporal tracking feature matrix at each time step, Indicates a time step.

[0161] To fully extract the semantic information of each modality, this invention first maps the original features to a unified embedding space using independent encoders:

[0162]

[0163] in, Indicates the first The initial node representation of a time-step graph sequence snapshot. To indicate the number of service nodes, This indicates that the sequence elements are real numbers. This represents the dimension of the node features in the input layer. Encoders for logs, metrics, and tracking, respectively. This indicates a normalization operation. Indicates the characteristic sequence of time-series logs In the middle, the first Log feature matrix at each time step Indicator sequence In the middle, the first Indicator feature matrix at each time step Indicates the time-series tracking feature sequence In the middle, the first The temporal tracking feature matrix at each time step, Indicates a time step.

[0164] Specifically, the logs use an embedding layer + fully connected layer, while the metrics and tracking use a 1D-CNN.

[0165] After obtaining the fusion features, this invention employs a multi-layer graph attention network to capture the dependencies between services. The node features of the layer are updated as follows:

[0166]

[0167] in, Indicates the first The representation matrix of all nodes in the layer is the spatial aggregation feature. Indicates the first Layer node feature dimensions This indicates the operation of a multi-head attention mechanism. Indicates the first The representation matrix of all nodes in the layer. This represents the layer index of GAT. This represents a snapshot of a dynamic dependency graph sequence. Indicates a time step.

[0168] Specifically, each attention head is represented by a node calculated through neighborhood aggregation:

[0169]

[0170] in, This represents the activation function. Represents neighboring nodes. Indicates a service node. Indicates service node The set of neighboring nodes, Indicates service node and neighboring nodes Attention weights between them Indicates the first Layer edge weight constraint parameters, Indicates the first Layer Neighborhood Nodes Historical hidden feature vectors This represents the layer index of the GAT.

[0171] Specifically, attention weights Through service nodes With neighboring nodes Feature similarity learning:

[0172]

[0173] in, It is a linear transformation matrix; This is the attention parameter vector; This represents an exponential function used to convert feature similarity into non-negative weights; Indicates the transpose of the attention parameter; Indicates leakage Activation functions introduce non-linearity into feature computation, thus avoiding the gradient vanishing problem. Representing neighboring nodes eigenvectors; Indicates service node eigenvectors, Indicates the range of neighbors.

[0174] Although GATv2 itself does not directly accept numerical input of edge weights, the edge weight matrix The model behavior has already been affected during the graph construction phase: only when the invocation intensity... At that time, service node Directed edges to neighboring nodes Newly joined This constrains the neighbor range. .

[0175] This design retains the flexibility of data-driven approaches while leveraging the prior structure of the invoked topology. Notably, the edge weight matrix... It will be explicitly used by GGNN for weighted message passing in the subsequent time series modeling stage.

[0176] go through After layer GAT, each node achieves fusion. Spatial representation of skip neighborhood multimodal information This provides a rich feature base for subsequent time series modeling.

[0177] In one embodiment, temporal state evolution modeling is performed:

[0178] After capturing the spatial dependencies of a single graph snapshot, this invention further models the graph sequence using a gated graph neural network (GGNN). The temporal evolution pattern, in which, Indicates the first A snapshot of the dynamic dependency graph sequence at each time step. This indicates the total number of time steps.

[0179] Unlike the Spatial Feature Module (SFM), the Temporal Evolution Module (TEM) aims to explicitly maintain historical state information and capture the dynamic transition patterns of service states by fusing current observations with past memories through a gating mechanism.

[0180] For the t-th time step in the graph sequence ( ), Representing the total number of time steps, the gated graph neural network (GGNN) first processes each service node... Aggregate weighted messages from neighbors:

[0181]

[0182] in, Representing neighboring nodes Spatial representation after GAT processing, Represents the edge weight matrix The elements in (normalized call strength). This represents the learnable message transformation matrix. Indicates the range of neighbors.

[0183] Unlike the spatial module, the temporal module directly uses edge weights during message passing. Weight the neighbor states.

[0184] This reflects the difference in the strength of call relationships: services called more frequently have a greater impact on the state of their neighbors. A message function is designed to implement edge-weighted aggregation, ensuring that message delivery conforms to the actual call pattern.

[0185] Subsequently, the gated graph neural network (GGNN) uses a gated recurrent unit (GRU) to fuse historical states with current messages and update the hidden state of nodes:

[0186]

[0187] in, For service nodes In the hidden state (initial state) of the previous time step Represented by space (obtained by projection) Indicates a gating unit. Indicates the first At this time step, the service node The current input features, Indicates a time step.

[0188] The gating mechanism of the Gated Cyclic Unit (GRU) includes a reset gate. With the update gate :

[0189]

[0190]

[0191]

[0192]

[0193] in, It is the sigmoid activation function. For element-wise multiplication, Indicates an update to the door. This indicates that the door is being reset. This represents the learnable weight matrix of the updated gate. This represents the learnable weight matrix of the reset gate. This represents the hyperbolic tangent activation function. The learnable weight matrix representing the candidate states. Indicates service node The candidate hidden state, Indicates service node In the The final hidden state of a time step, representing the time step.

[0194] Update Gate Control the extent to which historical information is retained, reset the door The gating mechanism determines the intensity of forgetting historical states. This gating mechanism enables GGNN to adaptively balance short-term fluctuations with long-term trends.

[0195] After the graph sequence is propagated step by step, the hidden states of the nodes at all time steps are obtained:

[0196]

[0197] To capture the differences in the contribution of different time steps to anomaly detection, this invention employs a multi-head self-attention mechanism to fuse temporal information:

[0198]

[0199] in, This is the global representation of all nodes at all time steps after graph-level pooling. This represents the hidden state of nodes at all time steps. Represents the dimension of node features. This indicates the operation of the self-attention mechanism. This indicates that the sequence elements are real numbers. This indicates the total number of time steps.

[0200] Attention weight This reflects the importance of the time step in the final anomaly detection, enabling the model to focus on critical moments.

[0201] In one feasible implementation, step S4 is described in detail:

[0202] The representation of the fused temporal information is obtained. Subsequently, the present invention further performs average pooling on all time steps to obtain a global temporal representation:

[0203]

[0204] in: For the first time after attention weighting The representation of a time step, Represents the dimension of node features. This indicates the total number of time steps.

[0205] To map multimodal spatiotemporal features to a compact anomaly detection space, this invention employs a support vector data description (SVDD) framework.

[0206] Through a nonlinear projection layer Mapped to a low-dimensional hypersphere:

[0207]

[0208] in, For the projection matrix, The hyperbolic tangent activation function ensures that the embedding vector is constrained within a bounded space. Represents the dimension of node features. This represents the bias vector. Represents the global timing representation. Represents the dimension of a low-dimensional hypersphere. This represents the embedding vector in the hypersphere space.

[0209] In one feasible implementation, step S5 is described in detail:

[0210] During the training phase, this invention first initializes the SVDD hypersphere centers on pure normal samples:

[0211]

[0212] in, To determine the number of normal samples in the training set, Represents the hypersphere embedding vector. This represents the fused temporal information in a normal sample. Indicates the number of service nodes The first in A normal node.

[0213] In standard SVDD training, the optimization objective is to minimize the average distance of all samples to the center, thereby learning a compact hypersphere decision boundary:

[0214]

[0215] in, Indicates the number of service nodes. Indicates the first Global time-series representation of a normal node Represents the hypersphere embedding vector. The hypersphere center represents the depth SVVD. Represents the regularization coefficient. This represents all trainable parameters in the model. Indicates the number of service nodes The first in A normal node.

[0216] The outlier score of a sample is defined as its Euclidean distance from the center: ,

[0217] in, Represents the hypersphere embedding vector. Represents the global timing representation. The hypersphere center represents the depth SVVD. Indicates abnormal scores.

[0218] Samples whose distance exceeds a preset threshold are judged as abnormal.

[0219] In one embodiment, the training process of a deep SVDD anomaly detection model based on contrastive learning is further explained:

[0220] Standard SVDD relies solely on training with normal samples and lacks the ability to explicitly model anomalous patterns, which can lead to excessive shrinkage or relaxation of the hypersphere boundary.

[0221] To enhance the model's ability to distinguish between normal and abnormal samples, this invention introduces a contrastive learning mechanism, explicitly utilizing a small number of known abnormal samples during training. Therefore, this invention employs SVDD loss and contrastive loss to construct the loss function:

[0222]

[0223] in, The first loss term is the SVVD loss for normal samples. Indicates comparative loss, Indicates the weight of the comparative loss. This represents all trainable parameters in the model. This represents the regularization coefficient.

[0224] Specifically, the SVDD loss for normal samples:

[0225]

[0226] in, This represents the total number of normal samples. Indicates the number of service nodes. Represents the hypersphere embedding vector. Indicates the th after time-series attention weighting The representation of a time step, The hypersphere center represents the depth SVVD.

[0227] Inherited from the standard SVDD, ensuring normal sample aggregation.

[0228] Comparative loss:

[0229]

[0230] in,

[0231]

[0232]

[0233] Specifically, Indicates the number of service nodes. This represents the total number of abnormal samples. This represents the total number of normal samples. For the abnormal sample index set, For the interval hyperparameter, The hypersphere center represents the depth SVVD. Indicates an abnormal time step. Indicates the th after time-series attention weighting The representation of a time step, This indicates that the outlier sample, after being weighted by temporal attention, is the [number]th [item]. Representation of an abnormal time step This represents the squared average distance from the normal sample to the center of the hypersphere. This represents the squared average distance from the outlier sample to the center of the hypersphere. This represents the embedding vector in the hypersphere space.

[0234] In one feasible implementation, experimental evaluations were conducted in the following embodiments to verify the performance of the present invention.

[0235] In this embodiment, experiments are conducted using two microservice benchmark systems: TrainTicket (TT), a train ticket booking system deployed with a microservice architecture, and SocialNetwork (SN), a social networking site dataset.

[0236] TrainTicket (TT) is collected from the microservice benchmark system TrainTicket, where users can check, book, and pay for train tickets. It consists of 41 microservice instances that interact with each other, and the dataset collects multimodal data from 27 of these business-related microservices.

[0237] SocialNetwork (SN) is collected from the microservice benchmark system SocialNetwork, where users can create, read, favorite, and forward posts. There are 21 microservice instances interacting with each other, and this dataset collects multimodal data from 12 of the business-related microservices.

[0238] Tracing data for TT was collected over a 7-hour period without anomalies, and tracing data for SN was collected over a 1.2-hour period. Anomalies were injected into a microservice for 10 minutes at 2-minute intervals; for TT, the injection interval was 2 minutes, and for SN, the injection interval was 30 seconds. The data was divided into normal and abnormal segments. The TGSphere model was trained using 70% of the normal (i.e., no anomaly) data, while the remaining 30% of the normal data and all the abnormal data (during the anomaly injection period) were used as test data.

[0239] To rigorously evaluate the effectiveness of the TGSphere method proposed in this invention, a comprehensive comparison with eight state-of-the-art baseline methods is performed in this embodiment.

[0240] These comparisons cover different data sources, including unimodal data (tracking, logs, or metrics only) and heterogeneous multimodal data.

[0241] Specifically, the eight baseline methods include:

[0242] TraceAnomaly constructs Trace vectors to represent the structure and timing characteristics of microservice calls, and uses deep Bayesian networks to learn the posterior distribution of normal Trace patterns.

[0243] LogAnomaly treats log streams as natural language sequences and uses the Template2Vec mechanism to extract semantic information from log templates, thereby enabling it to detect both order anomalies and quantity anomalies simultaneously.

[0244] JumpStarter performs anomaly detection for multivariate time series metrics. It uses compressed sensing to recover "clean" signals from noisy monitoring data and identifies anomalies by reconstructing errors, making it particularly effective in solving cold start problems.

[0245] DeepTraLog combines graph anomaly detection using trace and log. It captures execution structure and embedded log events by constructing a unified graph representation and trains a GGNN-based SVDD model to detect anomalies that deviate from normal service behavior.

[0246] SCWarn is a semi-supervised multimodal detection method that integrates metrics and logarithms. It uses a multimodal LSTM to encode the temporal dependencies of heterogeneous data sources and fuses features through a concatenation operation to identify service instability caused by poor software changes.

[0247] Eadro is an unsupervised end-to-end anomaly diagnostic framework that utilizes trace, log, and metric. It constructs a dependency graph to model the system topology and employs a graph attention network (GAT) to learn representations of normal system states for anomaly detection.

[0248] AnoFusion uses graph Transformer networks to model complex multimodal correlations and combines GAT and GRU to capture dynamic changes in system state.

[0249] MSTGAD seamlessly integrates three modalities of data through a microservice system twin (MST) graph and employs an attention-based multimodal learning mechanism to capture intramodal and intermodal interactions, thereby achieving robust detection.

[0250] All experiments were conducted on a Linux server equipped with an Intel Core i7-12700K CPU and an NVIDIA GeForce RTX 3090 Ti GPU.

[0251] The software environment is based on Python 3.8 and PyTorch 1.12, and the graph neural network component is implemented using Deep GraphLibrary (DGL) 0.9.

[0252] Although TGSphere is trained using a one-class paradigm, which aims to detect anomalous samples by learning the hypersphere boundary of normal data, anomaly detection is essentially a binary classification decision process during the inference phase.

[0253] Therefore, this invention uses a common binary classification metric to measure model performance: , , ,in, (True positive) indicates the number of abnormal samples that were correctly detected, while (False negative) and (False positives) represent the number of samples that were missed and the number of samples that were falsely reported, respectively.

[0254] Furthermore, to evaluate the model's robustness without relying on specific thresholds, the Area Under the Feature Curve (ROC-AUC) and Average Precision (AP) are used. ROC-AUC measures the model's overall diagnostic ability across all possible classification thresholds, while AP summarizes the performance of the precision-recall curve, providing a more reliable evaluation for the typically imbalanced datasets in microservice anomaly detection. Higher values ​​for all these metrics indicate better model performance.

[0255] Experiments show that the overall performance of the TGSphere method of this invention is significantly better than that of existing mainstream methods. TGSphere significantly outperforms existing state-of-the-art methods in F1 (0.987), recall (0.9993), and precision (0.981), effectively reducing false negatives and false positives.

[0256] Secondly, TGSphere breaks through the blind spots of a single perspective by deeply integrating metrics, logs, and tracing data, ensuring that it can capture complex anomalies reflected by any modality or its correlation.

[0257] Finally, TGSphere constructs a sequence of dynamic dependency graphs, utilizes GAT to capture the spatial spillover effects between services, and combines a temporal attention mechanism to focus on structural changes at key time steps. This fine-grained spatiotemporal dependency modeling effectively filters out noise and significantly enhances the model's ability to represent dynamic structural anomalies.

[0258] To comprehensively evaluate the effectiveness of different modules and data modalities in TGSphere, this invention conducts ablation studies on experimental datasets.

[0259] Studies have shown that ablation experiments have confirmed the effectiveness of each modality. Removing trace data resulted in the most severe performance degradation (F1 score dropped to 0.667), confirming the fundamental role of call chains in building dynamic topologies and connecting heterogeneous data. Without traces, the graph model degenerates into isolated node processing, losing its ability to capture anomaly propagation paths. Furthermore, TGSphere-Metric (0.895) is slightly inferior to TGSphere-Log (0.910), indicating that continuous metric fluctuations are more direct in reflecting resource-related anomalies than discrete logs, but the two remain complementary in semantics and state.

[0260] Component analysis reveals that temporal evolution modeling is crucial. Removing the GGNN module responsible for state recursive evolution leads to a significant performance drop (F1 score drops to 0.715), far exceeding the impact of the SelfAttn module, which only handles time-step weighting (0.916). This demonstrates that capturing the continuous evolution of service states within a sliding window (implemented by GGNN / GRU) is more critical than simply allocating time-step attention.

[0261] Ultimately, the superiority of the complete model (0.987) validates the necessity of integrating spatial interaction and temporal evolution mechanisms within a unified framework.

[0262] The TGSphere method proposed in this invention includes several key hyperparameters that determine the model's representation capacity and learning stability, primarily including the sliding window size. Representation Dimensions ( , ), architectural complexity (number of attention heads and number of hidden layers in the graph neural network), and regularization terms ( Dropout).

[0263] To evaluate the sensitivity of these parameters, this invention conducted comprehensive experiments on a dataset.

[0264] As shown in Figure 5, the experiment demonstrates that, in terms of representation dimensions, (8), (16) The performance reaches its peak. Excessive dimensionality can easily lead to feature sparsity or diminishing returns.

[0265] In terms of architectural complexity, a single or moderate number of heads produces robust results, while an excessive number of heads does not significantly enhance the modeling of dependency structures in the scenario of this invention. Furthermore, in the regularization strategy, when... Optimal performance is achieved when the value is set to 0.001 and Dropout is around 0.2-0.4. Aggressive regularization will disrupt the continuity of temporal dependencies.

[0266] Furthermore, the model performs best when the time window is 100. Smaller time windows will result in lower and unstable performance due to insufficient time context.

[0267] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0268] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for anomaly detection in a dynamic spatiotemporal graph learning microservice for multimodal data, characterized in that, The process includes the following steps performed by the computer system: collecting data information from the microservice system to be tested, inputting it into the computer system, and performing data preprocessing to obtain multimodal data; the data information includes log data, performance indicators, and raw tracking data; segmenting the multimodal data based on a sliding window mechanism to generate a detection window, further dividing each detection window into multiple data steps, and constructing a dynamic dependency graph sequence; Based on dynamic dependency graph sequences, spatial relationship modeling and temporal dynamic evolution modeling are performed through graph attention networks and gated graph neural networks to generate representations that integrate temporal information; Based on the fused temporal information representation, average pooling is performed on all time steps to generate a graph-level representation vector containing the complete spatiotemporal context; the graph-level representation vector is input into a deep vector data description anomaly detection model based on contrastive learning, the Euclidean distance from the graph-level representation vector to the center of the low-dimensional hypersphere space is calculated, and the detection result is output based on the Euclidean distance; the dynamic dependency graph sequence includes multiple dynamic graph snapshots, each dynamic graph snapshot including the service instances corresponding to the node set in the system, node features, directed edge set, and edge weight matrix; the execution steps of the temporal dynamic evolution modeling are as follows: a gated graph neural network is used, For the current time step snapshot of the dynamic dependency graph sequence, firstly, the neighbor states of each service node are weighted and summed according to the call intensity in the edge weight matrix to obtain a weighted message; the weighted message and the historical state of the service node in the previous time step are input into the gated loop unit for fusion to update the hidden state of the service node in the current time step; the iteration is performed according to the time step order until all nodes in the entire dynamic dependency graph sequence are processed to obtain the hidden state of the nodes in all time steps; the hidden states of the nodes in all time steps are weighted and fused using a multi-head self-attention mechanism to generate a representation of the fused time-series message; The training process of the deep vector data description anomaly detection model based on contrastive learning includes: during the training phase, the center of the low-dimensional hypersphere space is initialized using pure normal samples, and a contrastive learning mechanism is introduced to construct a joint loss function; the joint loss function includes a first loss term, a contrastive loss term, and a regularization term; specifically, the joint loss function is shown in the following equation: in, The first loss term is the SVVD loss for normal samples. Indicates comparative loss, Indicates the weight of the comparative loss. This represents all trainable parameters in the model. The regularization coefficient is represented by the joint loss function; a deep vector data description anomaly detection model based on contrastive learning is trained by optimizing the joint loss function.

2. The anomaly detection method for dynamic spatiotemporal graph learning microservices for multimodal data according to claim 1, characterized in that, The data preprocessing includes parsing log data, preprocessing performance metrics, and parsing raw tracking data. The execution steps of log data parsing are as follows: the Drain parser is used to extract templates from the log data and convert them into structured log data. Unidentified templates are classified into a unified category, and timestamps and service instance identifiers are retained. At the same time, aggregation is performed by service node and sliding time window. The temporal dependency of events in the structured log data is modeled based on the Hawkes self-starting point process. The baseline strength vector of each service node in each sliding time window is determined by maximum likelihood, and a temporal log feature sequence representation is generated. The performance metric preprocessing steps are as follows: IQR truncation is performed on the performance metric sequence across all timestamps to suppress extreme values; then, median absolute deviation is standardized to obtain the metric sequence. The raw tracking data parsing steps are as follows: Service instance identifier, start timestamp, and response latency are extracted from each span in the raw tracking data; after aggregating the spans according to the time dimension, the latency statistical characteristics of each service node within the corresponding time window are calculated to generate a time-series tracking feature sequence. The multimodal data includes time-series log feature sequence representation, metric sequence, and time-series tracking feature sequence.

3. The anomaly detection method for dynamic spatiotemporal graph learning microservices for multimodal data according to claim 1, characterized in that, The execution steps for constructing the dynamic dependency graph sequence are as follows: Based on the multimodal data, the time axis is divided into multiple detection windows by using a sliding window mechanism with a preset window length and step size; each detection window is further divided into multiple time steps to construct the dynamic dependency graph sequence.

4. The anomaly detection method for dynamic spatiotemporal graph learning microservices for multimodal data according to claim 1, characterized in that, The execution steps of the spatial relationship modeling are as follows: Based on a graph attention network, modality-adaptive encoding is performed on node features, which are composed of time-series log feature sequence representation, index sequence, and time-series tracking feature sequence concatenated. Specifically, the time-series log feature sequence representation is encoded using an embedding layer combined with a fully connected layer, while the index sequence and time-series tracking feature sequence are encoded using a one-dimensional convolutional neural network. The encoding results of the three types of features are mapped to a unified embedding space for normalization processing to obtain fused features. Based on the fusion features, a multi-layer graph attention network is used to update the node features of all nodes in the current layer; In each layer of the graph attention network, for each service node, the attention weights between it and all its neighboring nodes are calculated through a multi-head self-attention mechanism. The attention weights are used to perform a weighted summation of the node features of neighboring nodes, and then the node feature representation is calculated using an activation function. After multiple iterations, each service node obtains a spatial representation that integrates multi-hop domain and multimodal information. The attention weight is determined by the similarity of the node features of the service node and the neighboring nodes after linear transformation.

5. The anomaly detection method for dynamic spatiotemporal graph learning microservices for multimodal data according to claim 1, characterized in that, The deep vector data description anomaly detection model based on contrastive learning includes a nonlinear projection layer that maps the graph-level representation vectors to a low-dimensional hypersphere space; specifically: in, Represents the projection matrix. Represents the dimension of a low-dimensional hypersphere. This represents the bias vector. This indicates that the sequence elements are real numbers. Represents the dimension of node features. Represents the hypersphere embedding vector. The hyperbolic tangent activation function ensures that the embedding vector is constrained within a bounded space. This represents a graph-level vector representation.

6. The anomaly detection method for dynamic spatiotemporal graph learning microservices for multimodal data according to claim 1, characterized in that, The execution steps for outputting the detection result based on the Euclidean distance are as follows: the calculated Euclidean distance is defined as the anomaly score of the current detection window; the anomaly score is compared with a preset threshold; if the anomaly score is greater than the preset threshold, it is determined to be abnormal; if the anomaly score exceeds the preset threshold, it is determined to be normal.

7. An electronic device, comprising: The system includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, communication interface, and memory communicate with each other via the communication bus; the memory stores a computer program, which, when executed by the processor, causes the processor to execute the dynamic spatiotemporal graph learning microservice anomaly detection method for multimodal data as described in any one of claims 1-6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed, the program implements the dynamic spatiotemporal graph learning microservice anomaly detection method for multimodal data as described in any one of claims 1 to 6.

Images