Micro-service fault root cause positioning method, system and device based on multi-scale periodic time sequence knowledge graph and medium

Abstract

The invention relates to the technical field of artificial intelligence and intelligent operation and maintenance, in particular to a micro-service fault root cause positioning method, system and device based on a multi-scale periodic time sequence knowledge graph and a medium. The method comprises the following steps: firstly, constructing a micro-service evolution event chain according to heterogeneous data, secondly, designing a time-aware embedding generation method based on frequency domain transformation and a gating mechanism, extracting a periodic vector by utilizing learnable frequency domain coding, and fusing the periodic vector into event embedding through adaptive semantic gating so as to suppress periodic noise; thirdly, constructing a multi-scale context tensor through convolution downsampling operation capable of learning step length, and stacking the reference sequence and subsequences of different receptive fields in a channel dimension; and finally, extracting unified fault representation by using a hybrid reasoning network, and outputting a root cause list by combining a mask time prediction auxiliary task. The tidal effect and the timed task feature can be effectively identified, and the accuracy and generalization ability of root cause positioning are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence and intelligent operation and maintenance, in particular, to a microservice fault root cause positioning method, system, device and medium based on a multi-scale periodic time series knowledge graph. BACKGROUND

[0002] With the wide application of microservice architecture and cloud native technology, the topology structure of modern distributed systems (such as large-scale e-commerce platforms and online payment systems) is becoming increasingly complex, and the operation and maintenance data generated is showing the characteristics of massiveness, multi-modality and high dynamics. In order to ensure the high availability of services, it is necessary to quickly locate the fault root cause (Root Cause Analysis, RCA) from the mass data, which has become a key technology in the field of intelligent operation and maintenance.

[0003] At present, the fault reasoning method based on time series knowledge graph (Temporal Knowledge Graph, TKG) has gradually become the mainstream. This kind of method models the entities (service nodes), relationships (calling dependencies) and events (alarm logs) in the system as four-tuples with timestamps , and excavates the evolution law of events through a deep learning model.

[0004] However, the existing fault diagnosis methods still have the following difficult-to-overcome technical bottlenecks when facing complex real operation and maintenance scenarios: 1. Limitations of applicability of traditional time series analysis methods Although traditional time series analysis methods (such as ARIMA, RNN or methods based on frequency domain analysis) have been relatively mature in dealing with continuous numerical data (such as time domain and frequency domain features of CPU utilization and memory water level), the core data in the intelligent operation and maintenance scenario - system logs and calling chain events - are essentially discrete event sequences. These data are sparsely distributed on the time axis and contain complex graph structure semantics, making it difficult for traditional continuous time series analysis methods to be directly applied and unable to effectively capture the deep associations between discrete fault events and continuous performance indicators.

[0005] 2. Existing TKG reasoning models lack perception of complex periodic patterns Existing TKG reasoning models usually treat timestamps Numerical or static position encoding simplified as linear flow ignores the significant multi-periodic characteristics in the operation and maintenance data. For example, the regular resource fluctuations caused by user behavior affected diurnal pattern or cron jobs. Existing models cannot effectively distinguish between "normal periodic fluctuations" and "abnormal sudden failures" in the embedding space. This leads to the model easily misjudging the periodic high load as an anomaly, resulting in a large number of false positives.

[0006] 3. Existing multi-scale modeling methods have large calculation overhead and poor universality Although there have been a few attempts in the field of time series knowledge graphs to model multi-scale or multi-periodic (such as hierarchical graph neural networks or complex decoupled embedding-based solutions), these methods often have the following shortcomings: Model bloated, huge overhead: In order to capture features of different time spans, existing methods often design extremely complex network structures, resulting in a huge increase in the number of parameters, high inference delay, and difficulty in meeting the stringent real-time requirements of online operation.

[0007] High coupling, difficult to migrate: Existing multi-scale modules are usually deeply bound to specific model architectures, lacking universality.

[0008] Lack of lightweight paradigm: There is currently a lack of a lightweight, pluggable multi-scale modeling paradigm that cannot be flexibly migrated to existing inference models to enhance their ability to capture long and short time dependencies.

[0009] 4. Lack of self-supervised time regularity learning mechanism In the field of operation and maintenance, labeled fault samples (Labels) with exact root causes are extremely scarce. Existing inference methods mainly rely on supervised or semi-supervised link prediction tasks, failing to fully utilize the natural timestamp information in the vast amount of logs. Lack of a mechanism to force the model to focus on the time distribution regularity, resulting in insufficient generalization ability of the model in the few-sample scenario. SUMMARY

[0010] The present application aims at the problem that the existing time sequence knowledge graph reasoning model cannot effectively distinguish periodic regularity and sudden failure when processing intelligent operation and maintenance data, resulting in high false alarm rate, and the problem that a single time scale is difficult to capture instantaneous error and chronic performance degradation at the same time, and proposes a microservice fault root cause positioning method, system, equipment and medium based on a multi-scale periodic time sequence knowledge graph; first, a microservice evolution event chain is constructed according to heterogeneous data, second, a time-aware embedding generation method based on frequency domain transformation and gating mechanism is designed, a learnable frequency domain coding is used to extract a periodic vector, and the periodic vector is fused into an event embedding through an adaptive semantic gating to suppress periodic noise, third, a multi-scale context tensor is constructed through a convolution downsampling operation with a learnable step, and a reference sequence and a subsequence with different receptive fields are stacked in the channel dimension, and finally, a hybrid reasoning network is used to extract a unified fault representation, and a root cause list is output in combination with a mask time prediction auxiliary task; the tide effect and timing task characteristics can be effectively identified, and the accuracy and generalization ability of root cause positioning are significantly improved.

[0011] The present application specifically realizes the following contents: A microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph, specifically comprising the following steps: Step S1: constructing a microservice evolution event chain according to collected heterogeneous operation and maintenance data; Step S2: mapping the microservice evolution event chain into an initial vector sequence, introducing a learnable frequency domain mapping mechanism, injecting a periodic vector into the initial vector sequence, and generating a time-aware event embedding; Step S3: time sequence aggregation time-aware event embedding to construct a reference feature sequence, according to a set of different convolution step parameters, aligning and splicing the reference feature sequence and each subsequence feature in the channel dimension to construct a multi-scale input tensor; Step S4: inputting the multi-scale input tensor into the constructed hybrid reasoning network, alternately performing pattern matching in the feature channel dimension and causal extraction in the time sequence dimension, generating fault evolution representation, and calculating the ranking probability of the candidate fault node according to the fault evolution representation, correcting the ranking result in combination with the mask time prediction auxiliary task, and outputting a microservice fault root cause list.

[0012] In order to better realize the present application, further, the step S1 specifically comprises the following steps: Step S11: obtaining multi-modal data from a microservice system; Step S12: extracting the calling topology between service entities and the state log inside the service from the multi-modal data, and uniformly mapping into time sequence quadruples containing timestamps; Step S13: calling a sliding window mechanism to intercept all related quadruples of the node to be diagnosed within a preset time window, forming a microservice evolution event chain.

[0013] To better implement the present application, further, the step S12 specifically comprises the following steps: Step S121: Extracting the calling topology data between service entities and the state log data inside the service from the multi-modal data; Step S122: According to the calling topology data between service entities, parsing the trace_id and span_id fields in the micro-service calling chain data, establishing the directed calling edges between service nodes as the relationship data of the graph; Step S123: According to the state log data inside the service, parsing the abnormal keywords in the business log data, establishing the state edges inside the service nodes as the attribute data of the graph; Step S124: Uniformly formatting the directed calling edges and the state edges into a four-tuple containing a timestamp.

[0014] To better implement the present application, further, the step S2 specifically comprises the following steps: Step S21: Establishing a time dictionary to map the timestamps in the micro-service evolution event chain four-tuple into relative time indexes ID; Step S22: Introducing a learnable frequency domain mapping mechanism to construct a trigonometric function layer containing multiple groups of trainable frequency parameters and phase parameters, inputting the relative time indexes ID into the sine function and the cosine function in parallel, and splicing the output frequency domain features; Step S23: Projecting the spliced frequency domain features through a linear transformation layer to the same dimension space as the event embedding to obtain a periodic feature vector; Step S24: Splicing the semantic vector of the current event with the periodic feature vector, calculating the scalar gating coefficient through an activation function, and weighting the periodic feature vector according to the scalar gating coefficient, to generate a time-aware event embedding by only modifying the time embedding part in the initial vector sequence in a residual addition manner.

[0015] To better implement the present application, further, the step S3 specifically comprises the following steps: Step S31: Time-series aggregation of time-aware event embedding to construct a reference feature sequence; Step S32: According to a plurality of different convolution stride parameters set, performing a learnable down-sampling convolution operation on the reference feature sequence to generate sub-sequence features reflecting different time span evolution laws; Step S33: Restoring each sub-sequence to the same time length as the reference sequence by linear interpolation, and splicing in the feature channel dimension to form a multi-scale input tensor containing micro details and macro trends.

[0016] In order to better realize the present application, further, the specific operation of the step S31 is: grouping the events in the evolution event chain according to a set time window, using an average pooling operation to aggregate the micro events in the same window into a macro feature vector, and forming a reference sequence.

[0017] In order to better realize the present application, further, the specific operation of the step S32 is: initializing a one-dimensional convolution kernel corresponding to a step length according to a set incremental sampling step length parameter, performing convolution operation on the reference sequence, and obtaining a plurality of sub-sequences with reduced sequence length.

[0018] Based on the above-mentioned microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph, in order to better realize the present application, further, a microservice fault root cause positioning system based on a multi-scale periodic time sequence knowledge graph is proposed, which is used to execute the above-mentioned microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph; comprising a preprocessing unit, a time-aware embedding unit, a tensor construction unit, and a fault root cause positioning unit; The preprocessing unit is used to construct a microservice evolution event chain according to the collected heterogeneous operation and maintenance data. The time-aware embedding unit is used to map the microservice evolution event chain into an initial vector sequence, introduce a learnable frequency domain mapping mechanism, inject a periodic vector into the initial vector sequence, and generate a time-aware event embedding. The tensor construction unit is used to time-aggregate the time-aware event embedding to construct a reference feature sequence, align and splice the reference feature sequence and each sub-sequence feature in the channel dimension according to a set of different convolution step length parameters, and construct a multi-scale input tensor. The fault root cause positioning unit is used to input the multi-scale input tensor into the constructed hybrid reasoning network, alternately perform mode matching in the feature channel dimension and causal extraction in the time sequence dimension, generate a fault evolution representation, calculate the ranking probability of a candidate fault node according to the fault evolution representation, correct the ranking result in combination with a mask time prediction auxiliary task, and output a microservice fault root cause list.

[0019] Based on the above-mentioned microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph, in order to better realize the present application, further, an electronic device is proposed, characterized by comprising a memory and a processor; the memory has a computer program stored thereon; when the computer program is executed on the processor, the above-mentioned microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph is realized.

[0020] In order to better realize the present application, further, a computer readable storage medium is provided, characterized in that the computer readable storage medium has computer instructions stored thereon; when the computer instructions are executed on the electronic device, the microservice fault root cause positioning method based on the multi-scale periodic time sequence knowledge graph is realized.

[0021] The present application has the following advantages: (1) The present application innovatively introduces a periodic feature mapping based on a learnable frequency domain transformation and an adaptive semantic gating mechanism. Unlike the prior art, which only considers time as linear position encoding, the present application can capture multi-frequency periodicity in the frequency domain space and adaptively adjust the injection weight of periodic features according to the semantic context of the current event, thereby effectively suppressing the interference caused by normal periodic fluctuations while preserving abnormal sensitivity.

[0022] (2) The present application performs convolution downsampling on the reference sequence with different strides and constructs a tensor using channel stacking, so that the model can simultaneously consider micro and macro features without building a complex hierarchical graph network; it can not only sensitively capture millisecond-level Trace disconnection or log errors, but also effectively identify performance degradation trends that last for several hours or even several days, with low computational overhead.

[0023] (3) The present application introduces a dual-task driving mechanism during inference training, especially a masked time prediction auxiliary task; by forcing the model to use timestamp information in a large amount of unsupervised logs for self-supervised learning, the model can better understand the time distribution rules of system normal operation, thereby maintaining a high root cause positioning accuracy rate even with only a small amount of labeled samples.

[0024] (4) The present application directly constructs an evolving event chain based on microservice call chains and business logs, and the inference result can be directly mapped to specific service component entities and RPC call relationships. Operation and maintenance personnel can not only obtain a recommended list of root cause entities, but also trace the time path of fault evolution through multi-scale features, providing an intuitive decision basis for subsequent fault repair. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 A microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph provided by the present application is shown in the whole flowchart; Figure 2 A microservice fault root cause positioning method based on a multi-scale periodic time sequence knowledge graph provided by the present application is shown in the logic architecture diagram; Figure 3A flowchart of an evolution event chain construction process based on heterogeneous operation and maintenance data provided by the present application is shown in the figure. Figure 4 A schematic diagram of a periodic feature learning and gating mechanism principle provided by the present application is shown in the figure. Figure 5 A schematic diagram of a multi-scale context tensor construction principle provided by the present application is shown in the figure. Figure 6 An electronic device hardware structure schematic diagram provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the described embodiments are only a part of the embodiments of the present application, not all the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present application.

[0027] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the terms "set", "connected", "connected" should be understood broadly, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be connected inside two elements. For those of ordinary skill in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0028] Embodiment 1 The present embodiment proposes a microservice fault root cause positioning method based on multi-scale periodic time sequence knowledge graph, which specifically includes the following steps: Step S1: Constructing a microservice evolution event chain according to the collected heterogeneous operation and maintenance data; The step S1 specifically includes the following steps: Step S11: Obtaining multi-modal data from the microservice system; Step S12: Extracting the calling topology between service entities and the state logs inside the service from the multi-modal data, and uniformly mapping them into time sequence quadruples containing timestamps; The step S12 specifically includes the following steps: Step S121: Extracting the calling topology data between service entities and the state log data inside the service from the multi-modal data; Step S122: According to the calling topology data between service entities, the trace_id and span_id fields in the microservice calling chain data are parsed, the directed calling edges between service nodes are established, and the relationship data of the graph is obtained; Step S123: According to the state log data inside the service, the abnormal keywords in the business log data are parsed, the state edges inside the service nodes are established, and the attribute data of the graph is obtained; Step S124: The directed calling edges and the state edges are uniformly formatted into a four-tuple containing a timestamp.

[0029] Step S13: A sliding window mechanism is called to intercept all related four-tuples of the to-be-diagnosed node within a preset time window, and a microservice evolution event chain is formed.

[0030] Step S2: The microservice evolution event chain is mapped to an initial vector sequence, a learnable frequency domain mapping mechanism is introduced, a periodic vector is injected into the initial vector sequence, and a time-aware event embedding is generated; The step S2 specifically includes the following steps: Step S21: A time dictionary is established, and the timestamps in the microservice evolution event chain four-tuple are mapped to relative time indexes ID; Step S22: A learnable frequency domain mapping mechanism is introduced, a trigonometric function layer containing multiple groups of trainable frequency parameters and phase parameters is constructed, the relative time indexes ID are input into the sine function and the cosine function in parallel, and the frequency domain features output are spliced; Step S23: The spliced frequency domain features are projected to the same dimension space as the event embedding through a linear transformation layer, and a periodic feature vector is obtained; Step S24: The semantic vector of the current event and the periodic feature vector are spliced, a scalar gating coefficient is calculated through an activation function, the periodic feature vector is weighted according to the scalar gating coefficient, and a time-aware event embedding is generated by modifying only the time embedding part in the initial vector sequence in a residual addition manner.

[0031] Step S3: Time sequence aggregation of the time-aware event embedding constructs a reference feature sequence, and according to a set of different convolution step parameters, the reference feature sequence and each subsequence feature are aligned and spliced in the channel dimension to construct a multi-scale input tensor; The step S3 specifically includes the following steps: Step S31: Time sequence aggregation of the time-aware event embedding constructs a reference feature sequence; The specific operation of the step S31 is: the events in the evolution event chain are grouped according to a set time window, the micro events in the same window are aggregated into a macro feature vector by using an average pooling operation, and a reference sequence is formed.

[0032] Step S32: Perform a learnable down-sampling convolution operation on the reference feature sequence according to a plurality of different convolution step parameters set, to generate sub-sequence features reflecting evolution rules of different time spans; The specific operation of the step S32 is: according to the set incremental sampling step parameters, initialize one-dimensional convolution kernels corresponding to the step lengths respectively, and perform convolution operation on the reference sequence to obtain a plurality of sub-sequences with reduced sequence length.

[0033] Step S33: Restore each sub-sequence to the same time length as the reference sequence by linear interpolation, and splice in the feature channel dimension to form a multi-scale input tensor containing micro details and macro trends.

[0034] Step S4: Input the multi-scale input tensor into the constructed hybrid inference network, alternately perform pattern matching in the feature channel dimension and causal extraction in the time sequence dimension, generate fault evolution representation, and calculate the ranking probability of the candidate fault nodes according to the fault evolution representation, correct the ranking result combined with the mask time prediction auxiliary task, and output the microservice fault root cause list.

[0035] Working principle: The embodiment first constructs a microservice evolution event chain according to heterogeneous data, then designs a time-aware embedding generation method based on frequency domain transformation and gating mechanism, uses a learnable frequency domain coding to extract a periodic vector, and fuses it into the event embedding through an adaptive semantic gating to suppress periodic noise; thirdly, a multi-scale context tensor is constructed by a learnable step convolution down-sampling operation, and the reference sequence and the sub-sequences of different receptive fields are stacked in the channel dimension; finally, a hybrid inference network is used to extract a unified fault representation, and a mask time prediction auxiliary task is used to output a root cause list; it can effectively identify the characteristics of tidal effect and timing task, and significantly improve the accuracy and generalization ability of root cause positioning.

[0036] Embodiment 2: The embodiment is based on the above-mentioned embodiment 1, as shown in Figure 1 The specific steps include the following steps.

[0037] Step S1: Evolution event chain construction based on heterogeneous operation and maintenance data: collect multi-modal data of the microservice system, extract the calling topology between service entities and the state log inside the service, and unify them into time sequence four-tuple sequences containing timestamps; for the target service node to be diagnosed, the history interaction neighbor subgraph is extracted with the current time as the reference, and the microservice evolution event chain is generated in chronological order; In the step S1, the specific process of constructing the microservice evolution event chain includes: The trace_id and span_id fields in the trace data of microservice call chain are parsed to establish a directed call edge between service nodes as the relationship data of the graph; The abnormal keywords in the business log (Log) data are parsed to establish a state edge within the service node as the attribute data of the graph; The directed call edge and the state edge are uniformly formatted into a quadruple, wherein is limited to a microservice component entity, is limited to an RPC call relationship or a Log state type, is a timestamp of the event occurrence; All related quadruples of the to-be-diagnosed node within a preset time window are intercepted using a sliding window mechanism to form an evolution event chain.

[0038] Step S2: Time-aware embedding generation based on frequency domain transformation and gating mechanism: mapping the evolution event chain into an initial vector sequence; introducing a learnable frequency domain mapping mechanism to convert discrete timestamp indexes into continuous periodic vectors containing frequency and phase information, and through adaptive semantic gating calculation to fuse coefficients, injecting the periodic vectors into the time dimension of the initial vector sequence to generate time-aware event embeddings that suppress periodic noise; In the step S2, the specific process of generating time-aware embedding based on frequency domain transformation and gating mechanism includes: Time discretization mapping: establishing a time dictionary to map the absolute timestamp in the input quadruple into a relative time index ID; Learnable frequency domain coding: constructing a trigonometric function layer containing multiple groups of trainable frequency parameters and phase parameters, inputting the relative time index ID into the sine function and cosine function in parallel, and concatenating the output results to capture the multi-band periodicity of the data; Dimension alignment mapping: projecting the concatenated frequency domain features through a linear transformation layer to the same dimension space as the event embedding to obtain a periodic feature vector; Semantic adaptive fusion: concatenating the semantic vector of the current event with the periodic feature vector and calculating the scalar gating coefficient through the activation function, weighting the periodic feature vector using the coefficient, and only modifying the time embedding part of the corresponding relative time index ID in a residual addition manner.

[0039] Step S3: Multi-scale context tensor construction step based on learnable step size: temporal aggregation is performed on the time-aware event embedding to construct a baseline feature sequence; a plurality of different convolution step size parameters are configured, and a learnable down-sampling convolution operation is performed on the baseline feature sequence to generate subsequence features reflecting the evolution law of different time spans; the baseline feature sequence and each subsequence feature are aligned and spliced in the channel dimension to construct a multi-scale input tensor; In the step S3, the specific process of the multi-scale context tensor construction based on the learnable step size is as follows: Day-level window aggregation: group the events in the evolution event chain according to a 24-hour time window, aggregate the micro events in the same window into a macro feature vector using an average pooling operation, and form a baseline sequence; Step length convolution sampling: set a group of increasing sampling step size parameters, initialize a one-dimensional convolution kernel corresponding to each step size, and perform convolution operation on the baseline sequence to obtain a plurality of subsequences with reduced sequence length but expanded feature receptive field; Multi-scale tensor stacking: restore each subsequence to the same time length as the baseline sequence by linear interpolation, and splice (Concat) in the feature channel dimension to form a multi-scale input tensor containing micro details and macro trends.

[0040] Step S4: Hybrid interaction reasoning and root cause output step driven by double tasks: input the multi-scale input tensor into a hybrid reasoning network, alternately perform pattern matching in the feature channel dimension and causal extraction in the time sequence dimension, generate fault evolution representation; calculate the ranking probability of the candidate fault nodes based on the representation, and correct the ranking result combined with the mask time prediction auxiliary task, output the microservice fault root cause list.

[0041] Working principle: the embodiment first constructs a microservice evolution event chain based on Trace, Log and Metric heterogeneous operation and maintenance data; secondly, designs a time-aware embedding generation method based on frequency domain transformation and gating mechanism, uses a learnable frequency domain coding to extract a periodic vector, and fuses it into the event embedding through an adaptive semantic gating to suppress periodic noise; thirdly, a multi-scale context tensor is constructed by a learnable step size convolution down-sampling operation, and the baseline sequence and the subsequences with different receptive fields are stacked in the channel dimension; finally, a hybrid reasoning network is used to extract a unified fault representation, and a mask time prediction auxiliary task is used to output a root cause list. The application can effectively identify the tide effect and the characteristics of the timing task, and significantly improve the accuracy and generalization ability of root cause positioning.

[0042] The other parts of the embodiment are the same as those of the above-mentioned embodiment 1, and will not be described here.

[0043] Embodiment 3: The embodiment is based on any of the above embodiments 1-embodiment 2, as Figure 1 、 Figure 2 、 Figure 3 、 Figure 4 、 Figure 5 indicated, taking a typical distributed microservice business system as an example, which contains Web front-end, Redis cache, MySQL database and other service components, and continuously collects multi-modal operation and maintenance data.

[0044] As shown in Figure 1 , a microservice fault root cause positioning method based on multi-scale periodic time series knowledge graph, specifically comprising the following steps: Step S1: Evolution event chain construction based on heterogeneous operation and maintenance data; This step aims to convert multi-modal heterogeneous data of microservice system into structured evolution event chain that can be processed by the model.

[0045] (1) Topological mapping based on call chain (Trace) The system parses the call chain sampling data. Following OpenTracing or similar industry standards, a complete business request is identified by trace_id, and the calling level between services is determined by span_id and parent_id.

[0046] Entity mapping: extract the service name field (service_name) in the call record as the microservice component entity in the graph.

[0047] Relationship construction: if the parent_id in the record of service A is equal to the span_id of service B, then a directed call edge is established.

[0048] Attribute extraction: extract the status code (status_code, such as 200 or 500) as a dynamic attribute on the edge.

[0049] (2) State discretization based on logs (Log) and metrics (Metric) Log analysis: analyze business and system logs. Extract key exception keywords (such as Memory_Overflow, Timeout) in log content through log template matching to construct internal state event quadruples of services, for example .

[0050] Metric discretization: read performance metric time series data (such as CPU usage, memory usage). For continuous numerical values, set dynamic threshold (such as 3-sigma anomaly detection algorithm) to discretize them into attribute events to supplement the dynamic features of the graph.

[0051] (3) Microservice evolution event chain construction All the four tuples extracted above are sorted by timestamp . For the target node to be diagnosed, all first-order and second-order neighbor interaction events within a preset historical time window are extracted using a sliding window, arranged in chronological order to form an evolution event chain, which serves as the input sequence of the model.

[0052] Step S2: Time-aware embedding generation step based on frequency domain transformation and gating mechanism This step aims to distinguish normal periodic fluctuations from sudden failures in the feature space through a learnable frequency domain mapping.

[0053] (1) Initial vector sequence mapping Each four tuple in the evolution event chain is input into the embedding layer. The subject, relationship, object, and timestamp index are mapped to low-dimensional dense vectors, denoted as subject vector , relationship vector , object vector , and initial time embedding . A semantic vector is also constructed.

[0054] (2) Learnable frequency domain encoding To capture multi-frequency periodic patterns (such as daily tides and weekly trends commonly seen in business systems), this embodiment introduces a trigonometric function layer containing a set of learnable parameters (frequency terms) and (phase terms) to map the timestamp index to the frequency domain space. The mapped result is denoted as , as shown in equation (1): ;

[0055] Subsequently, through dimension alignment mapping, a periodic feature vector consistent with the initial time embedding dimension is obtained, where is the general representation of the frequency term, and is the general representation of the phase term, as shown in equation (2): ;

[0056] (3) Adaptive semantic gating fusion The gating coefficient is calculated using a single-layer perceptron, which is determined by the semantic vector and the periodic feature vector ​(value range 0~1), the final expression is shown in equation (3): ;

[0057] Utilizing weighting, and stacked to the initial time embedding in residual connection manner, to generate time-aware embedding . Finally, the spliced vector is input into the Transformer encoder to obtain the benchmark feature sequence .

[0058] Step S3: multi-scale context tensor construction step based on learnable step size; This step aims to build multi-scale features reflecting the evolution law of different time spans to adapt to the scenario of coexistence of instantaneous failure and chronic degradation.

[0059] (1) Benchmark feature sequence (Scale-0) The complete sequence of the encoder output is retained as the benchmark scale containing microscopic details (such as Trace chain breakage) .

[0060] (2) Learnable down-sampling based on step convolution A set of periodic step size parameters is configured . For each parameter , a one-dimensional convolution layer with step size (Strided 1D Convolution) is used to process the benchmark sequence. The convolution kernel parameters are automatically updated in training, thereby adaptively extracting key features under this period , see equation (4): ; This operation generates a set of sub-sequence feature sets with compressed sequence length but expanded receptive field .

[0061] (3) Multi-scale tensor stacking Each sub-sequence feature is restored and aligned to the benchmark sequence length through interpolation or broadcasting mechanism, and is spliced (Concat) in the feature channel dimension to form a multi-scale input tensor .

[0062] Step S4: hybrid interactive reasoning and root cause output step driven by double tasks; (1) Hybrid interactive reasoning ​The multi-scale input tensor is sent into a hybrid inference network. The network alternately performs channel mixing and sequence mixing, promotes the interaction of micro and macro features in the feature dimension, and extracts causal dependencies in the time dimension, and finally outputs a unified fault evolution representation.

[0063] (2) Dual-task joint inference Root cause ranking (main task): Based on the fault evolution representation, calculate the probability scores of all candidate service entities in the knowledge graph, and generate a root cause recommendation list.

[0064] Masked time prediction (auxiliary task): In the training stage, randomly mask the timestamps in the input and require the model to make predictions. This task forces the model to learn the time distribution of system logs and helps correct the main task.

[0065] The final joint loss optimization calculation is shown in formula (5), where Lmain represents the loss of the root cause ranking task, Laux represents the loss of the masked time prediction task: ; 3. Hardware operating environment As shown in Figure 6 , the embodiment of the application also provides an electronic device, including a processor, a memory and a computer program stored on the memory and executable on the processor. The processor, when executing the computer program, implements the above steps S1 to S4. The memory is used to store the call chain, log, index and other original operation and maintenance data, as well as the evolution event chain and multi-scale feature tensor generated in the inference process.

[0066] The other parts of this embodiment are the same as any one of the above embodiments 1-2, and will not be repeated here.

[0067] Embodiment 4: On the basis of any one of the above embodiments 1-3, the embodiment proposes a microservice fault root cause positioning system based on a multi-scale periodic time series knowledge graph, which is used to execute the above-mentioned microservice fault root cause positioning method based on a multi-scale periodic time series knowledge graph; including a preprocessing unit, a time-aware embedding unit, a tensor construction unit, and a fault root cause positioning unit; The preprocessing unit is used to construct a microservice evolution event chain according to the collected heterogeneous operation and maintenance data; The time-aware embedding unit is used to map the microservice evolution event chain into an initial vector sequence, introduce a learnable frequency domain mapping mechanism, inject a periodic vector into the initial vector sequence, and generate a time-aware event embedding. The tensor construction unit is configured to construct a benchmark feature sequence based on time-series aggregated time-aware event embedding, align and splice the benchmark feature sequence and each subsequence feature in a channel dimension according to a plurality of different convolution step parameters set, and construct a multi-scale input tensor; The fault root cause positioning unit is configured to input the multi-scale input tensor into the constructed hybrid inference network, alternately perform pattern matching in a feature channel dimension and causal extraction in a time series dimension, generate fault evolution representation, calculate ranking probability of a candidate fault node according to the fault evolution representation, correct the ranking result in combination with a mask time prediction auxiliary task, and output a microservice fault root cause list.

[0068] The embodiment further provides an electronic device including a memory and a processor, and the memory has a computer program stored thereon; when the computer program is executed on the processor, the method for positioning a microservice fault root cause based on a multi-scale periodic time-series knowledge graph is implemented.

[0069] The embodiment further provides a computer readable storage medium, and the computer readable storage medium has computer instructions stored thereon; when the computer instructions are executed on the electronic device, the method for positioning a microservice fault root cause based on a multi-scale periodic time-series knowledge graph is implemented.

[0070] The other parts of the embodiment are the same as any one of the above-mentioned embodiments 1-3, and thus will not be described again.

[0071] The above is only a preferred embodiment of the present application, and does not limit the present application in any form. Any simple modification or equivalent change based on the technical essence of the present application to the above embodiment falls within the protection scope of the present application.

Claims

1. A microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph, characterized in that, Specifically, the following steps are included: Step S1: Construct a microservice evolution event chain based on the collected heterogeneous operation and maintenance data; Step S2: Map the microservice evolution event chain to an initial vector sequence, introduce a learnable frequency domain mapping mechanism, inject periodic vectors into the initial vector sequence, and generate time-aware event embeddings; Step S3: Temporal aggregation and time-aware event embedding to construct a baseline feature sequence. Based on multiple sets of different convolution stride parameters, the baseline feature sequence and the features of each sub-sequence are aligned and concatenated in the channel dimension to construct a multi-scale input tensor. Step S4: Input the multi-scale input tensor into the constructed hybrid inference network, alternately perform pattern matching in the feature channel dimension and causal extraction in the time series dimension to generate a fault evolution representation, calculate the ranking probability of candidate fault nodes based on the fault evolution representation, and correct the ranking result by combining the mask time prediction auxiliary task to output a microservice fault root cause list.

2. The microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph according to claim 1, characterized in that, Step S1 specifically includes the following steps: Step S11: Obtain multimodal data from the microservice system; Step S12: Extract the call topology between service entities and the status logs within the service from the multimodal data, and map them uniformly into time-series quadruples containing timestamps; Step S13: Use the sliding window mechanism to capture all relevant quadruplets of the node to be diagnosed within the preset time window to form a microservice evolution event chain.

3. The microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph according to claim 2, characterized in that, Step S12 specifically includes the following steps: Step S121: Extract call topology data between service entities and status log data within the service from the multimodal data; Step S122: Based on the call topology data between service entities, parse the trace_id and span_id fields in the microservice call chain data, and establish directed call edges between service nodes as graph relation data; Step S123: Based on the internal status log data of the service, parse the abnormal keywords in the business log data, and establish the internal status edges of the service node as attribute data of the graph; Step S124: Format the directed call edge and the state edge into a quadruple containing a timestamp.

4. The microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph according to claim 1, characterized in that, Step S2 specifically includes the following steps: Step S21: Establish a time dictionary and map the timestamps in the microservice evolution event chain quadruple to relative time index IDs; Step S22: Introduce a learnable frequency domain mapping mechanism, construct a trigonometric function layer containing multiple sets of trainable frequency parameters and phase parameters, input the relative time index ID in parallel into the sine function and cosine function, and splice the output frequency domain features; Step S23: Project the spliced ​​frequency domain features through a linear transformation layer to the same dimensional space as the event embedding to obtain a periodic feature vector; Step S24: After concatenating the semantic vector of the current event with the periodic feature vector, calculate the scalar gating coefficient through the activation function, and weight the periodic feature vector according to the scalar gating coefficient. Generate the time-aware event embedding by only correcting the time embedding part in the initial vector sequence in the way of residual addition.

5. The microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph according to claim 1, characterized in that, Step S3 specifically includes the following steps: Step S31: Construct a baseline feature sequence by embedding time-series aggregated time-aware events; Step S32: Based on multiple sets of different convolution stride parameters, perform learnable downsampling convolution operations on the baseline feature sequence to generate subsequence features that reflect the evolution patterns over different time spans; Step S33: Restore each subsequence to the same time length as the baseline sequence through linear interpolation, and splice them in the feature channel dimension to form a multi-scale input tensor containing micro-details and macro-trends.

6. The microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph according to claim 5, characterized in that, The specific operation of step S31 is as follows: group the events in the evolution event chain according to a set time window, call the average pooling operation to aggregate the micro events in the same window into a macro feature vector, and form a benchmark sequence.

7. The microservice fault root cause localization method based on multi-scale periodic temporal knowledge graph according to claim 5, characterized in that, The specific operation of step S32 is as follows: according to the set incremental sampling step size parameter, initialize the one-dimensional convolution kernel with the corresponding step size respectively, perform convolution operation on the reference sequence, and obtain multiple subsequences with reduced sequence length.

8. A microservice fault root cause localization system based on a multi-scale periodic temporal knowledge graph, used to execute the microservice fault root cause localization method based on a multi-scale periodic temporal knowledge graph as described in claim 1; characterized in that, It includes a preprocessing unit, a time-aware embedding unit, a tensor construction unit, and a fault root cause localization unit; The preprocessing unit is used to construct a microservice evolution event chain based on the collected heterogeneous operation and maintenance data; The time-aware embedding unit is used to map the microservice evolution event chain into an initial vector sequence, introduce a learnable frequency domain mapping mechanism, inject periodic vectors into the initial vector sequence, and generate time-aware event embeddings. The tensor construction unit is used to construct a baseline feature sequence by embedding time-aware events in a time-series aggregation. Based on multiple sets of different convolution stride parameters, the baseline feature sequence and the features of each sub-sequence are aligned and concatenated in the channel dimension to construct a multi-scale input tensor. The fault root cause localization unit is used to input multi-scale input tensors into the constructed hybrid inference network, alternately perform pattern matching in the feature channel dimension and causal extraction in the time series dimension to generate fault evolution representations, calculate the ranking probability of candidate fault nodes based on the fault evolution representations, and correct the ranking results by combining the mask time prediction auxiliary task to output a microservice fault root cause list.

9. An electronic device, characterized in that, It includes a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements the microservice fault root cause localization method based on a multi-scale periodic temporal knowledge graph as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 9, they implement the microservice fault root cause localization method based on a multi-scale periodic temporal knowledge graph as described in any one of claims 1-7.

Images