Microservice fault early warning method based on time sequence feature fusion

Abstract

The invention relates to the technical field of intelligent power grid micro-service architecture and fault early warning, in particular to a micro-service fault early warning method based on time sequence feature fusion, which comprises the following steps of: firstly, acquiring three types of heterogeneous operation data of a performance index, a log text and a service arrangement link of a micro-service cluster in an intelligent power grid arrangement system; the method comprises the following steps: firstly, constructing a time sequence feature matrix with fault relevance, secondly, carrying out dynamic weight fusion on heterogeneous features by adopting an improved space-time attention mechanism, dynamically updating a feature library by combining an incremental learning mechanism with memory playback, optimizing fault feature representation and extracting a time sequence relevance abnormal mode, and finally, carrying out feature extraction. Accurate early warning of fault severity is realized through a three-level hierarchical early warning model; the problems of insufficient multi-dimensional feature fusion, poor dynamic adaptability, weak cascade fault identification capability and single early warning dimension in the prior art are solved.

Description

Technical Field

[0001] This invention relates to the field of smart grid microservice architecture and fault early warning technology, specifically a microservice fault early warning method based on time-series feature fusion. Background Technology

[0002] With the popularization of cloud computing and microservice architecture, microservice clusters have become the core architectural pattern supporting large and complex business systems. In smart grid orchestration systems, microservice clusters cover multiple core modules such as power dispatching, data acquisition, and user services. The inter-service call relationships are complex, and the operating status is affected by multiple factors such as hardware resources, network environment, and business load. Faults are characterized by suddenness, correlation, and cascading propagation. Traditional fault early warning methods based on static thresholds are no longer sufficient to meet the requirements.

[0003] Currently, existing microservice fault warning methods have the following limitations:

[0004] 1. Traditional methods often focus on single-dimensional data, failing to fully explore the correlation between multiple dimensions of data such as performance, logs, links, and environment. This results in a one-sided characterization of fault features and makes it difficult to identify faults caused by the coupling of multiple factors.

[0005] 2. Most early warning systems use static feature libraries and fixed thresholds. When the microservice cluster topology changes, business load fluctuates, or the operating environment changes, the model needs to be manually retrained, resulting in a delayed response and inability to adapt to the dynamically changing microservice environment.

[0006] 3. Existing technologies focus more on fault detection of individual microservices, lacking the ability to predict fault propagation paths and impact ranges. This makes it difficult to identify cascading faults across service links in advance, resulting in early warnings being triggered only after the fault has spread, thus missing the opportunity to deal with the situation.

[0007] 4. It only outputs whether a fault has occurred or a simple severity classification, without including the scope of the fault's impact, its evolution trend, and response suggestions. This fails to provide comprehensive decision support for operations and maintenance personnel and prolongs the fault handling time.

[0008] Therefore, there is an urgent need for a microservice cluster fault early warning method that can integrate multi-dimensional temporal characteristics, adapt to dynamic environments, predict fault propagation, and output multi-dimensional early warning information to improve the timeliness, accuracy, and decision support capabilities of early warning. Summary of the Invention

[0009] This invention aims to provide a microservice fault early warning method based on time-series feature fusion, which solves the problems of insufficient multi-dimensional feature fusion, poor dynamic adaptability, weak cascading fault identification capability, and single early warning dimension in the existing technology.

[0010] This invention solves the above-mentioned technical problems through the following technical solution: a microservice fault early warning method based on time-series feature fusion, comprising the following steps:

[0011] S1. Multi-source data acquisition: Collect multi-dimensional heterogeneous operation index data of microservice clusters in the smart grid orchestration system, including numerical performance indicators (server CPU utilization, memory usage, network throughput, disk I / O latency, and service response time), text logs (orchestration instruction execution failure logs, data synchronization timeout logs, service abnormal termination records, and API call failure information), and topological service orchestration link data (cross-microservice call latency, orchestration success rate, microservice dependency topology, and request traffic fluctuations). Through data standardization and structuring, construct a time-series feature matrix.

[0012] S2. Heterogeneous Feature Fusion: An improved spatiotemporal attention mechanism is used to dynamically weight and fuse the temporal feature matrix to obtain a fused feature matrix. During the process of obtaining the fused feature matrix, different dimensions are distinguished by attention weights, including spatial attention weights. And time attention weight By combining an incremental learning mechanism with memory playback (abnormal sample detection step, feature library weight optimization step, and historical feature retention step), new abnormal samples are detected and the feature library is updated to obtain the updated feature library.

[0013] S3. Hierarchical Intelligent Early Warning: The feature library is input into a three-level hierarchical early warning model, which sequentially performs lightweight anomaly detection, deep fault classification, and graded decision-making to output the fault severity warning result.

[0014] The positive and progressive effects of this invention are as follows:

[0015] 1. For the first time, it integrates three types of heterogeneous data: performance, logs, and links, significantly improving fault feature coverage. The incremental learning mechanism with memory playback can avoid "catastrophic forgetting." The feature library update response time is fast, and the dynamic adaptation efficiency is improved many times compared to traditional static methods.

[0016] 2. The improved spatiotemporal attention mechanism highlights the characteristics of the power grid topology. The three-level early warning rules combine probability and performance degradation, shorten the early warning time, increase the cascade fault identification rate, and reduce the false alarm rate. Moreover, the three-level early warning clearly defines the priority of handling "low / medium / high risk", which significantly improves operation and maintenance efficiency. Attached Figure Description

[0017] Figure 1 The flowchart illustrates the solution for the microservice cluster fault early warning method based on time-series feature fusion provided by this invention.

[0018] Figure 2This is a schematic diagram of the calculation and convergence process of the spatiotemporal decomposition attention mechanism provided by the present invention.

[0019] Figure 3 The flowchart for updating the incremental learning feature library provided by this invention.

[0020] Figure 4 The following is a three-level architecture diagram of the hierarchical early warning model provided by this invention. Detailed Implementation

[0021] The present invention will be further illustrated by way of embodiments below, but the present invention is not limited to the scope of the embodiments.

[0022] See Figures 1 to 4 A microservice fault early warning method based on temporal feature fusion includes the following steps:

[0023] S1. Multi-source data acquisition: Collect multi-dimensional heterogeneous operational indicator data of microservice clusters in the smart grid orchestration system, including numerical performance indicators, text-based log text, and topology-based service orchestration link data, and construct a time-series feature matrix. ;

[0024] The multi-dimensional operational metrics data are divided into three categories: The first category is performance metrics, i.e., numerical data, which focuses on the hardware and response data supporting the core microservices of the power grid, including server CPU utilization, memory usage, network throughput, disk I / O latency, and service response time; the second category is log text, i.e., text data, which contains exception records unique to the power grid microservices, mainly including orchestration instruction execution failure logs, data synchronization timeout logs, service abnormal termination records, and API call failure information; the third category is service orchestration link data, i.e., topology data, which focuses on the hierarchical dependencies of the power grid microservices, covering cross-microservice call latency, orchestration success rate, dependency topology between microservices, and request traffic fluctuations, and is transformed into an s×s adjacency matrix, where s is the number of microservice nodes;

[0025] Let the data collection period be... The unit is seconds, and the collection duration is... Then the timestamp sequence is ,in , The sampling interval is denoted as ; the performance index is expressed as . ,in Representing server CPU utilization, memory usage, network throughput, disk I / O latency, and service response time, this provides a direct and intuitive quantification of microservice hardware resource consumption and operational efficiency; log text is transformed into vectors through NLP preprocessing. ,in Vectors are embedded in log keywords to facilitate the discovery of hidden fault clues in the text; service orchestration link data is transformed into an adjacency matrix. This provides a structural basis for analyzing fault propagation paths, among which For the number of microservice nodes, Indicates service Call service , This indicates no calling relationship; based on the above time series and three types of heterogeneous features, the heterogeneous features at different time points are associated and integrated to form a time series feature matrix, providing a data foundation for extracting time series correlation anomaly patterns.

[0026] The time-series feature matrix The construction method is as follows: set the collection period. Sampling interval timestamp sequence Define the performance metric matrix Z, the log vector matrix L, and the link adjacency matrix A, and concatenate the three types of matrices according to the time dimension, as follows:

[0027] .

[0028] S2. Heterogeneous Feature Fusion: An improved spatiotemporal attention mechanism is used to fuse the temporal feature matrix. Dynamic weighted fusion is performed to obtain the fusion feature matrix. By combining an incremental learning mechanism with memory playback, new abnormal samples are detected and the feature library is updated to obtain the updated feature library. ;

[0029] The obtained fusion feature matrix During the process, different dimensions are distinguished by attention weights, including spatial attention weights. And time attention weight Spatial attention weights The formula used to highlight features that have a significant impact on the fault is:

[0030] ;

[0031] in, For querying the matrix, The key matrix, and All are composed of characteristic matrices Generated through linear transformation. The feature dimension is used to analyze... and The inner product result is scale-normalized. As a bias term, the attention weight calculation results are adjusted by offset. The function normalizes the attention weights; ensuring The values ​​of each element in the middle range from Furthermore, the sum is 1, which makes the weights probabilistically interpretable and facilitates the differentiation of the significance of different feature dimensions on the fault.

[0032] Temporal attention weights for temporal correlation The temporal attention weight is used to capture dependencies of features at different time points and to mine temporal correlation patterns in the fault evolution process. The calculation formula is:

[0033] ;

[0034] in, and These are the query matrix and the key matrix, used to extract feature queries and association information along the time dimension, providing support for calculating the time attention weights. Position encoding is used to enhance the time series sequence information. For the time step dimension, and The inner product result is scale-normalized to avoid numerical problems caused by differences in time series length and feature dimension, thus ensuring the stability of temporal attention computation. This is a bias term used to adjust the calculation results of the temporal attention weights, thereby improving the model's accuracy in fitting temporal dependencies. The function is also used to normalize the temporal attention weights, resulting in a fused feature matrix. ;

[0035] The incremental learning mechanism with memory playback includes an anomaly detection step: using the Isolation Forest algorithm to calculate samples abnormal probability The specific formula is as follows:

[0036] ;

[0037] in, For the sample Average path length, The average path length of all samples within the current detection time interval, and the average path length of all samples in the isolated forest, serve as a reference benchmark for anomaly detection; when samples When it is an outlier, Significantly smaller than normal samples ,therefore Approaching 1, or vice versa Approaching 0; when When a new abnormal pattern sample is identified, the incremental update process of the feature library is triggered. The anomaly detection threshold, in the smart grid scenario, has a value range of [value range missing]. ;

[0038] Next, to adapt the feature library to the dynamic feature distribution of smart grid microservices, an online gradient descent algorithm is used to optimize the feature library weights. Based on this, the incremental learning mechanism with memory playback also includes a feature library weight optimization step: using an online gradient descent algorithm, a composite loss function is defined.

[0039] ;

[0040] in, Cross-entropy loss is used to measure the difference between the predicted fault type and the actual fault type. for Divergence is used to constrain the consistency between the distribution of new features and the distribution of historical features. For balance coefficient, The model predicts the probability distribution of fault types for current abnormal pattern samples based on the existing feature library. The encoded vector for manually labeled fault type tags. The distribution of multidimensional features of newly added abnormal pattern samples after probabilistic processing. For historical feature database and Characteristic probability distribution of similar fault types;

[0041] Iteratively update the feature library weights using gradient descent. The specific formula is as follows:

[0042] ;

[0043] in, and These are the feature library weight parameters before and after the update. For learning rate, The loss function with respect to the weights The gradient points in the direction in which the loss function increases;

[0044] The incremental learning mechanism with memory playback also includes a historical feature retention step: selecting a key sample set from the historical feature database that meets the criteria of covering typical fault types of smart grids and has the highest feature identification rate. And through the formula Calculate the historical feature matrix, where For historical feature matrix, For the sample set size, For the first key sample set One sample, This is the historical feature weight vector;

[0045] The newly added abnormal pattern features are weighted and fused with historically retained features. The feature library update formula is as follows:

[0046] ;

[0047] in, To update the factors, dynamic adjustments are made based on the stability of the smart grid's operating state. When the system is stable... When the system fluctuates .

[0048] S3. Hierarchical Intelligent Early Warning: The feature library... Input a three-level hierarchical early warning model, and output the early warning result of the fault severity through lightweight anomaly detection, deep fault classification and hierarchical decision-making in sequence;

[0049] The hierarchical early warning model takes temporally correlated anomaly patterns and optimized fault feature representations as inputs, and implements fault severity-based early warning through a three-level architecture. The three-level hierarchical early warning model includes:

[0050] Lightweight anomaly detection: Utilizes the local outlier factor algorithm to calculate outlier scores for samples. Set threshold ,when When identified as a potential anomaly, This is the first-level threshold;

[0051] Deep Fault Classification: Employing temporal convolutional networks for potential anomalous samples. Fine-grained classification is performed by capturing the temporal dependencies of fault evolution through multiple causal convolutional layers, and the probability distribution of fault types is output. , among them The total number of fault types in smart grid microservices;

[0052] The rule for hierarchical decision-making is as follows:

[0053] Level 1 Warning (Low Risk): When And the decline in single-service performance indicators Triggered at time;

[0054] Level 2 Warning (Medium Risk): When It is triggered when the performance index of the cross-service link drops by 10%-30%;

[0055] Level 3 Warning (High Risk): When Furthermore, the performance indicators of multiple service links decreased significantly. Triggered at time;

[0056] in, Fault type probability distribution The maximum probability value in.

[0057] This invention is not limited to the embodiments described above. Any changes in shape or structure shall fall within the protection scope of this invention. The protection scope of this invention is defined by the appended claims. Those skilled in the art may make various changes or modifications to these embodiments without departing from the principles and essence of this invention, but all such changes and modifications shall fall within the protection scope of this invention.

Claims

1. A microservice fault early warning method based on temporal feature fusion, characterized in that, Includes the following steps: S1. Multi-source data acquisition: Collect multi-dimensional heterogeneous operation index data of microservice clusters in the smart grid orchestration system, including numerical performance indicators, text log text and topology service orchestration link data, and construct a time-series feature matrix. S2. Heterogeneous feature fusion: The temporal feature matrix is ​​dynamically weighted and fused using an improved spatiotemporal attention mechanism to obtain a fused feature matrix. Combined with an incremental learning mechanism with memory playback, new abnormal samples are detected and the feature library is updated to obtain an updated feature library. S3. Hierarchical Intelligent Early Warning: The feature library is input into a three-level hierarchical early warning model, which sequentially performs lightweight anomaly detection, deep fault classification, and graded decision-making to output the fault severity warning result.

2. The microservice fault early warning method based on time-series feature fusion as described in claim 1, characterized in that: In S1: Performance metrics include server CPU utilization, memory usage, network throughput, disk I / O latency, and service response time; Log text includes orchestration instruction execution failure logs, data synchronization timeout logs, service abnormal termination records, and API call failure information, which are preprocessed using NLP; Service orchestration link data, including cross-microservice call latency, orchestration success rate, microservice dependency topology, and request traffic fluctuations, is transformed into an s×s adjacency matrix, where s is the number of microservice nodes.

3. The microservice fault early warning method based on time-series feature fusion as described in claim 2, characterized in that, The time-series feature matrix in S1 The construction method is as follows: set the collection period. Sampling interval timestamp sequence Define the performance metric matrix Z, the log vector matrix L, and the link adjacency matrix A, and concatenate the three types of matrices according to the time dimension, as follows: ； Where m represents the number of performance metrics, n represents the number of preprocessed vectors, and s represents the number of microservice nodes.

4. The microservice fault early warning method based on time-series feature fusion as described in claim 1, characterized in that: The obtained fusion feature matrix During the process, different dimensions are distinguished by attention weights, including spatial attention weights. And time attention weight Spatial attention weights The formula used to highlight features that have a significant impact on the fault is: ； in, For querying the matrix, The key matrix, and All are composed of characteristic matrices Generated through linear transformation. The feature dimension is used to analyze... and The inner product result is scale-normalized. For bias terms, The function normalizes the attention weights.

5. The microservice fault early warning method based on time-series feature fusion as described in claim 4, characterized in that: The time attention weight The calculation formula is: ； in, and These are the query matrix and the key matrix, respectively. For position encoding, For the time step dimension, and The inner product result is scale-normalized. For bias terms, The function is also used to normalize the temporal attention weights, resulting in a fused feature matrix. .

6. The microservice fault early warning method based on time-series feature fusion as described in claim 1, characterized in that, The incremental learning mechanism with memory replay in S2 includes an anomaly detection step: calculating samples using the isolated forest algorithm. abnormal probability The specific formula is as follows: ； in, For the sample Average path length, This represents the average path length of all samples within the current detection time interval.

7. A microservice fault early warning method based on time-series feature fusion as described in claim 6, characterized in that, The incremental learning mechanism with memory playback in S2 also includes a feature library weight optimization step: using an online gradient descent algorithm, a composite loss function is defined. ； in, For cross-entropy loss, for divergence, For balance coefficient, The model predicts the probability distribution of fault types for current abnormal pattern samples based on the existing feature library. The encoded vector for manually labeled fault type tags. The distribution of multidimensional features of newly added abnormal pattern samples after probabilistic processing. For historical feature database and Characteristic probability distribution of similar fault types; Iteratively update the feature library weights using gradient descent. The specific formula is as follows: ； in, and These are the feature library weight parameters before and after the update. For learning rate, The loss function with respect to the weights The gradient points in the direction in which the loss function increases.

8. A microservice fault early warning method based on time-series feature fusion as described in claim 6, characterized in that, The incremental learning mechanism with memory playback in S2 also includes a historical feature retention step: selecting a key sample set from the historical feature database that meets the criteria of covering typical fault types of smart grids and has the highest feature identification rate. And through the formula Calculate the historical feature matrix, where For historical feature matrix, For the sample set size, For the first key sample set One sample, This is the historical feature weight vector; The newly added abnormal pattern features are weighted and fused with historically retained features. The feature library update formula is as follows: ； in, To update the factors, dynamic adjustments are made based on the stability of the smart grid's operating state. When the system is stable... When the system fluctuates .

9. A microservice fault early warning method based on time-series feature fusion as described in claim 1, characterized in that, The three-level hierarchical early warning model in S3 includes: Lightweight anomaly detection: Utilizes the local outlier factor algorithm to calculate outlier scores for samples. Set threshold ,when It was identified as a potential anomaly at that time; Deep Fault Classification: Employing temporal convolutional networks for potential anomalous samples. Fine-grained classification is performed by capturing the temporal dependencies of fault evolution through multiple causal convolutional layers, and the probability distribution of fault types is output. , among them This represents the total number of fault types in smart grid microservices.

10. A microservice fault early warning method based on time-series feature fusion as described in claim 9, characterized in that, The rules for hierarchical decision-making in S3 are as follows: Level 1 Warning (Low Risk): When And the decline in single-service performance indicators Triggered at 10%; Level 2 Warning (Medium Risk): When It is triggered when the performance index of the cross-service link drops by 10%-30%; Level 3 Warning (High Risk): When Furthermore, the performance indicators of multiple service links decreased significantly. Triggered at time; in, Fault type probability distribution The maximum probability value in.

Images