Internet basic service anomaly identification method and model

Abstract

The invention discloses an abnormity identification method and model of internet basic service, and relates to the technical field of internet. The method comprises the steps of collecting multi-source original data, and performing preprocessing to obtain multi-source basic data; obtaining a global feature vector through a cross-modal attention mechanism; obtaining an abnormal score of each node through a variational auto-encoder and a discrimination network based on the global feature vector; adding the abnormal score into the knowledge graph, and calculating the contribution degree of each node in combination with the conduction coefficient and the trust label of the edge in the knowledge graph; and by taking the abnormal node as a starting point, generating and outputting a candidate root cause path set based on the contribution degree in a back propagation mode. Multi-source basic data are converted into global feature vectors through a cross-modal attention mechanism, the comprehensiveness and accuracy of anomaly recognition are improved, the risk of missing report is reduced, meanwhile, candidate root cause paths are generated through back propagation on the basis of a knowledge graph constructed based on multi-source original data, and accurate positioning of complex abnormal root causes is achieved.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to an anomaly identification method and model for Internet infrastructure services. Background Technology

[0002] Internet infrastructure services are the core carriers supporting the operation of various network applications and digital businesses. They encompass multiple components such as hosts, containers, network devices, and application services, undertaking key functions such as data transmission, business support, and resource scheduling. Their stable operation is directly related to the continuity and security of digital economic activities. Internet infrastructure services are inherently characterized by a dynamic and ever-changing network environment, widespread and cross-domain service distribution, diverse service forms, and complex and heterogeneous data content. Furthermore, against the backdrop of rapid digital economic development, network attacks on internet infrastructure services are becoming increasingly diversified, covert, and large-scale, posing a serious threat to the stability and security of these services.

[0003] In current technology, a common method for identifying anomalies in basic internet services is to conduct analysis based on single-dimensional data. Typically, only limited types of data such as network traffic, system logs, or single performance indicators are collected. After simple cleaning, feature matching and anomaly determination are performed using preset rules and traditional statistical models. Furthermore, in the context of root cause localization, the system relies on pre-built static topology mapping relationships and combines human experience to make preliminary inferences about the components associated with the anomalies.

[0004] Therefore, it can be seen that the current methods of identifying anomalies in Internet infrastructure services rely only on single-dimensional data and have poor ability to integrate multi-source heterogeneous data, resulting in poor accuracy and high false negative rate in anomaly identification. Furthermore, root cause localization relies on static topology and human experience, making it difficult to locate the root cause of complex anomalies that cross nodes and sources, resulting in low root cause localization accuracy. Summary of the Invention

[0005] To address the aforementioned issues, this application provides an anomaly identification method and model for basic internet services. By collecting multi-source raw data and transforming it into a unified global feature vector using a cross-modal attention mechanism, the comprehensiveness and accuracy of anomaly identification are improved, and the risk of missed detections is reduced. Simultaneously, a knowledge graph containing node trust labels and edge propagation coefficients is constructed and trained based on multi-source data. The node contribution is calculated by combining anomaly scores and candidate root cause paths are generated through backpropagation. This eliminates the reliance on static topology and human experience, achieving accurate localization of complex anomaly root causes. Furthermore, it enhances the interpretability and operability of root cause localization, significantly reducing operation and maintenance troubleshooting costs and response time.

[0006] The embodiments of this application disclose the following technical solutions: In a first aspect, embodiments of this application provide an anomaly detection method for internet infrastructure services, applied to a pre-trained anomaly detection model, the method comprising: Collect multi-source raw data corresponding to each node, and preprocess the multi-source raw data to obtain multi-source basic data; Based on the multi-source basic data corresponding to each node, a global feature vector corresponding to each node is obtained through a cross-modal attention mechanism; Based on the global feature vector corresponding to each node, an anomaly score for each node is obtained through a pre-trained variational autoencoder and a pre-trained discriminant network; wherein, the anomaly score measures the degree of deviation between the global feature vector and the global feature vector under normal Internet infrastructure service conditions. The anomaly score of each node is added to the knowledge graph, and the contribution of each node is calculated based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node. The knowledge graph is constructed based on the multi-source raw data corresponding to each node and trained based on the multi-source historical data corresponding to each node. The knowledge graph includes each node and the edges between each node, with each node carrying a trust label and each edge carrying a propagation coefficient. Starting with an abnormal node, and based on the contribution of each node in the knowledge graph, a set of candidate root cause paths is generated through backpropagation, and the candidate root cause paths in the set are output; wherein, the abnormal node is a node whose abnormal score is higher than a preset threshold.

[0007] In one possible implementation, the step of obtaining the global feature vector corresponding to each node based on the multi-source basic data corresponding to each node through a cross-modal attention mechanism includes: For a single node, based on the multi-source basic data, multiple initial feature vectors are encoded to obtain the corresponding features. The weight coefficients corresponding to each of the initial feature vectors are calculated using a cross-modal attention mechanism. Based on the weight coefficients corresponding to each initial feature vector, the multiple initial feature vectors are weighted to obtain the corresponding global feature vectors, thereby obtaining the global feature vectors corresponding to each node.

[0008] In one possible implementation, obtaining the anomaly score for each node based on the global feature vector corresponding to each node through a pre-trained variational autoencoder includes: For a single node, the global feature vector corresponding to the node is input into a pre-trained variational autoencoder so that the variational autoencoder outputs a reconstructed feature vector corresponding to the global feature vector. The global feature vector corresponding to the node is input into a pre-trained discriminant network so that the discriminant network outputs a discrimination score corresponding to the global feature vector; Based on the reconstruction error between the global feature vector and the reconstructed feature vector and the discrimination score, the anomaly score of the node is obtained, so as to obtain the anomaly score of each node.

[0009] In one possible implementation, the knowledge graph is obtained as follows: Based on the multi-source raw data corresponding to each node, each node and the edges between each node are constructed in the knowledge graph to obtain the knowledge graph framework; wherein, the node type includes at least one of the following: service instance, host, switch port, configuration item, user session and external IP, and the edge relationship definition includes at least one of the following: call, dependency, routing and configuration; Based on the confirmed events in the multi-source historical data corresponding to each node, the transmission coefficients of the edges between each node in the knowledge graph framework are trained to obtain the knowledge graph.

[0010] In one possible implementation, calculating the contribution of each node based on the transmission coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node includes: For a given node, the contribution of the node is calculated using a preset causal graph neural network aggregation function based on the transmission coefficient of the edge between the node and the downstream nodes connected to the node, the node's anomaly score, and the node's trust label.

[0011] In one possible implementation, starting with an anomaly node and based on the contribution of each node in the knowledge graph, a set of candidate root cause paths is generated through backpropagation, including: Starting from the abnormal node, greedily select the upstream node to extend the path according to the order of contribution from high to low, and obtain one or more predicted root cause paths; Verify the temporal consistency and causal rationality of the one or more predicted root cause paths to obtain one or more candidate root cause paths, thus obtaining a set of candidate root cause paths.

[0012] In one possible implementation, after outputting the candidate root cause paths in the candidate root cause path set, the method further includes: Based on the candidate root cause paths, corresponding risk warning information is generated to indicate the anomalies in the Internet infrastructure services.

[0013] In one possible implementation, the method further includes: Collect the repair results, actual business impact, and false positive / false negative statistics of the candidate root cause paths, and construct anomaly confidence verification parameters based on the collected repair results, actual business impact, and false positive / false negative statistics of the candidate root cause paths; Using the multi-source raw data corresponding to each node as the raw sample, based on the raw sample, the corresponding perturbation sample is generated through controlled random perturbation, and the corresponding adversarial sample is generated through gradient guidance. Based on the original samples, the task loss of the anomaly detection model is obtained, and based on the original samples, the jitter samples, and the adversarial samples, the robust regularization term of the anomaly detection model is obtained. Based on the anomaly confidence verification parameters, the task loss and the robust regularization term are weighted to obtain the total loss of the anomaly identification model, and the anomaly identification model is optimized based on the total loss.

[0014] In one possible implementation, the robust regularization term of the anomaly detection model is obtained based on the difference between the discrimination score corresponding to the original sample and the discrimination score corresponding to the jitter sample, and the difference between the discrimination score corresponding to the original sample and the discrimination score corresponding to the adversarial sample.

[0015] Secondly, embodiments of this application provide an anomaly identification model for basic Internet services, including: a collection and access layer, a representation and detection layer, and a location and tracking layer; The acquisition and access layer is used to acquire multi-source raw data corresponding to each node, and to preprocess the multi-source raw data to obtain multi-source basic data. The representation and detection layer is used to obtain the global feature vector corresponding to each node based on the multi-source basic data corresponding to each node through a cross-modal attention mechanism. The representation and detection layer is further used to obtain an anomaly score for each node based on the global feature vector corresponding to each node, through a pre-trained variational autoencoder and a pre-trained discriminant network; wherein, the anomaly score measures the degree of deviation between the global feature vector and the global feature vector under normal Internet infrastructure service conditions; The localization and tracking layer is used to add the anomaly score of each node to the knowledge graph, and calculate the contribution of each node based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node; wherein, the knowledge graph is constructed based on the multi-source original data corresponding to each node, and trained based on the multi-source historical data corresponding to each node; the knowledge graph includes each node and the edges between each node, and each node carries a trust label, and each edge carries a propagation coefficient; The location and tracking layer is further configured to generate a set of candidate root cause paths by backpropagation, starting from an abnormal node and based on the contribution of each node in the knowledge graph; and output the candidate root cause paths in the set of candidate root cause paths; wherein the abnormal node is a node whose abnormal score is higher than a preset threshold.

[0016] Compared with existing technologies, this application has the following advantages: by collecting multi-source raw data and transforming it into a unified global feature vector through a cross-modal attention mechanism, the comprehensiveness and accuracy of anomaly identification are improved, and the risk of false negatives is reduced. At the same time, a knowledge graph containing node trust labels and edge propagation coefficients is constructed and trained based on multi-source data. The node contribution is calculated by combining anomaly scores and candidate root cause paths are generated through backpropagation. This eliminates the dependence on static topology and human experience, achieves accurate localization of complex anomaly root causes, and enhances the interpretability and operability of root cause localization, significantly reducing operation and maintenance troubleshooting costs and response time. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating an anomaly identification method for an Internet infrastructure service provided in this application embodiment; Figure 2 A flowchart illustrating the generation method of the global feature vector provided in the embodiments of this application; Figure 3 A schematic flowchart illustrating the knowledge graph generation method provided in this application embodiment; Figure 4 A flowchart illustrating the optimization method of the anomaly recognition model provided in the embodiments of this application; Figure 5This is a schematic diagram of the structure of an anomaly identification model for an Internet infrastructure service provided in an embodiment of this application. Detailed Implementation

[0019] As described earlier, the purpose of anomaly detection is to analyze data during the operation of basic internet services to promptly identify abnormal behavior and pinpoint the root causes of problems. Risk factors (such as abnormal CPU utilization, login failures, and sudden changes in network traffic) are crucial for threat detection, but their influence (weight) varies significantly across different key targets (such as core business systems and data storage services). Furthermore, risk factors themselves exhibit dynamic and volatile characteristics, leading to frequent fluctuations in their influence on key targets. Simultaneously, the types and attributes of risk factors associated with different key targets are numerous and complex, with intricate relationships between these factors. Coupled with the wide geographical distribution, diverse survival states, uncertain outbreak times and severity, and significant differences in warning thresholds of anomalies (threats), anomaly detection in basic internet services faces extremely high technical challenges.

[0020] In current technologies, common methods for identifying anomalies in basic internet services are as follows: analysis is conducted based on single-dimensional data, feature matching and anomaly determination are performed through preset rules and traditional statistical models, and in the context of root cause localization, preliminary inferences about the components associated with anomalies are made by relying on pre-built static topological mapping relationships and combining human experience.

[0021] Therefore, current methods for anomaly detection in internet infrastructure services focus on analyzing single-dimensional data, such as network traffic data or system log data. This lack of effective integration of multi-source heterogeneous data makes it impossible to fully capture the complex characteristics of anomalies, resulting in a high false negative rate and poor accuracy. Furthermore, root cause analysis relies on pre-built static topology mappings and human experience, lacking precise modeling of dynamic dependencies and causal propagation paths between components. This makes it difficult to pinpoint the root causes of complex anomalies that cross nodes and sources, leading to low accuracy in root cause analysis.

[0022] Furthermore, root cause localization relies on pre-built static topology mapping and human experience judgment, which cannot provide automated remediation suggestions. Moreover, the low accuracy of root cause localization leads to high troubleshooting costs and low response efficiency for operations and maintenance personnel, and a high risk of misjudgment.

[0023] This application provides an anomaly identification method for Internet infrastructure services, comprising: collecting multi-source raw data corresponding to each node, and preprocessing the multi-source raw data to obtain multi-source basic data; based on the multi-source basic data corresponding to each node, obtaining a global feature vector corresponding to each node through a cross-modal attention mechanism; based on the global feature vector corresponding to each node, obtaining an anomaly score for each node through a pre-trained variational autoencoder; adding the anomaly score of each node to a knowledge graph, and calculating the contribution of each node based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node; starting from the anomaly node, generating a candidate root cause path set through backpropagation based on the contribution of each node in the knowledge graph, and outputting the candidate root cause paths in the candidate root cause path set. This application improves the comprehensiveness and accuracy of anomaly identification and reduces the risk of false negatives by collecting multi-source raw data and transforming it into a unified global feature vector using a cross-modal attention mechanism. At the same time, it constructs and trains a knowledge graph containing node trust labels and edge propagation coefficients based on multi-source data, calculates node contribution by combining anomaly scores, and generates candidate root cause paths through backpropagation. This eliminates the reliance on static topology and human experience, achieves accurate localization of complex anomaly root causes, and enhances the interpretability and operability of root cause localization, significantly reducing operation and maintenance troubleshooting costs and response time.

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0025] Example 1: The following is combined Figures 1-4 This application provides a detailed description of an anomaly identification method for basic Internet services, which is applied to a pre-trained anomaly identification model.

[0026] like Figure 1 As shown in the embodiments of this application, an anomaly identification method for an Internet infrastructure service includes the following steps: S101. Collect the multi-source raw data corresponding to each node, and preprocess the multi-source raw data to obtain multi-source basic data.

[0027] Multi-source raw data refers to the collection of raw monitoring and business data acquired from different collection dimensions and data sources at various nodes during the operation of basic internet services, without undergoing in-depth processing such as feature extraction and fusion. Multi-source raw data reflects the operational status, relationships, network interaction behavior, external environmental risks, and spatiotemporal distribution characteristics of basic internet services. It forms the core data foundation for subsequent anomaly identification, risk assessment, and root cause localization. The completeness of its covered dimensions and the authenticity of the data affect the comprehensiveness and accuracy of anomaly detection.

[0028] Specifically, each node in the internet infrastructure services is treated as an independent data collection unit, covering core components such as hosts, containers, network devices, and application services. This captures the operational and interactive data of each node, and provides unified access to multi-source raw data for each node. For example, a unified data access channel enables centralized aggregation of multi-source raw data from various nodes, and supports adaptable access for different types of data, ensuring that all types of raw data from multiple sources are collected.

[0029] Specifically, the multi-source raw data includes: time-series metric data, runtime log data, and dependency relationship data.

[0030] Among them, time-series metrics refer to the event-sequence-type operational status data continuously output by core components such as hosts, containers, applications, and network devices during the operation of internet infrastructure services. Time-series metric data includes: CPU utilization, memory usage, request latency, QPS (Queries Per Second) / throughput, packet loss rate, etc. CPU utilization refers to the percentage of time that the central processing unit of a component in an internet infrastructure service actually spends processing tasks per unit of time, out of the total available time; memory usage refers to the amount of physical or virtual memory currently used by a component in an internet infrastructure service during operation (or the percentage of total memory capacity); request latency refers to the total time elapsed from when a user or downstream component initiates a service request until the corresponding result is received; QPS / throughput refers to the number of legitimate requests (such as API calls, data queries, business accesses, etc.) that an internet infrastructure service can process per second, while throughput refers to the total amount of data or requests successfully processed by the internet infrastructure service per unit of time; packet loss rate refers to the percentage of data packets sent from the source node that fail to reach the destination node due to network congestion, link failure, equipment malfunction, or malicious interference during network transmission, out of the total number of data packets sent.

[0031] Runtime log data, also known as host, container, and application runtime log data, refers to a collection of semi-structured text data generated by components such as hosts, containers, and applications during the runtime cycle of internet infrastructure services. Runtime log data includes: system runtime logs, container lifecycle logs, application error stack information, and user operation audit events. System runtime logs refer to log data automatically generated by the operating system (such as server operating system and network device system) and core system components of internet infrastructure services during operation, reflecting the underlying operational status of the system. Container lifecycle logs refer to log data recording key events and operational status of containers throughout their entire lifecycle from creation to destruction in containerized deployment scenarios. Application error stack information (or error stack logs) refers to log data automatically generated when an application encounters an exception (such as a crash, functional error, or logical exception) during operation, containing a detailed error tracing chain. User operation audit events refer to audit log data recording critical operations performed by users on internet infrastructure services, applications, or system resources.

[0032] Dependency data, also known as configuration, asset information, and topology dependency data, refers to a static or semi-static data set describing the relationships between asset information, configuration parameters, and components in internet infrastructure services, forming the relational framework for service operation. Dependency data includes: an asset list (such as details of core assets like servers, network devices, and application instances), a service registry (configurations related to service registration and discovery), a network topology (network connection relationships between components), and configuration item snapshots (static records of core parameters). While the data updates infrequently, it is highly stable. Dependency data can construct and maintain service dependency graphs and configuration mapping tables, accurately mapping runtime-detected anomalies to the affected component set. This is crucial for cross-node correlation analysis and anomaly propagation path inference. Simultaneously, this type of data provides a structured basis for locating the root cause of threats, estimating the scope of anomaly impact, and developing targeted remediation strategies, forming the foundation for cross-component and cross-level root cause tracing.

[0033] In one possible implementation, the multi-source raw data also includes: network traffic and session metadata, external intelligence data, and geographic-temporal semantic data.

[0034] Network traffic and session metadata refer to the raw data set generated during network interactions of basic Internet services, used to describe network transmission status and communication session characteristics. Network traffic and session metadata include: traffic statistics, five-tuple session information (source IP, destination IP, source port, destination port, protocol), connection duration, session rate, protocol distribution, etc., which fully record the details of network-level interaction behavior.

[0035] External intelligence data refers to a collection of reference-based raw data related to cyber threats from third-party data sources such as external security organizations and open-source security communities. External intelligence data includes key information such as known malicious domain names / IP addresses, C2 (command and control) server signatures, and publicly available vulnerability intelligence, focusing on verified or widely recognized security risk elements.

[0036] Geographic temporal semantic data refers to the raw data set describing the spatial distribution characteristics and temporal context of interactions in basic internet services. Geographic temporal semantics includes: spatial dimension information about the geographical origin of traffic or requests (such as the region to which the access node belongs) and temporal semantic information, such as peak business hours, system maintenance windows, and holiday contexts.

[0037] In one possible implementation, for a single node, the multi-source raw data corresponding to that node is processed by time synchronization, time zone standardization, field semantic mapping, preliminary cleaning and formatting, etc., to obtain multi-source basic data.

[0038] Time synchronization refers to aligning the timestamps of multiple source raw data to eliminate time inconsistencies caused by clock deviations and ensure the temporal correlation of the data.

[0039] Time zone standardization refers to converting the time zones of multi-source raw data collected from different regions into a preset standard time zone to avoid data analysis bias caused by time zone differences.

[0040] Among them, field semantic mapping refers to performing field semantic mapping operations to clarify the correspondence and unified semantics of fields from different sources of data, eliminate field ambiguity, and achieve consistency at the field level, based on the differences in field definitions of various types of raw data.

[0041] The initial cleaning process includes noise reduction and deduplication. Noise reduction refers to filtering out abnormal and interfering data from multiple sources (such as invalid values ​​caused by equipment failure, garbled characters in logs, etc.) and retaining true and valid data records. Deduplication refers to identifying and removing duplicate data (such as duplicate logs and duplicate indicator data caused by overlapping collection frequencies) to reduce data redundancy.

[0042] Formatting refers to converting the multi-source raw data after the above processing into a unified data format (such as structured data tables, standardized vector formats, etc.) to ensure that the data meets the input requirements for subsequent feature encoding and fusion.

[0043] For example, for time-series indicator data, missing value imputation, sampling alignment, and scale normalization are performed to ensure data validity and consistency; for runtime log data, timestamp standardization, key field extraction, and text vectorization are performed to transform semi-structured text into unified structured numerical data; for dependency data, service dependency graphs and configuration mappings are constructed and maintained to transform static / semi-static information snapshots into structured dependency data; for network traffic and session metadata, key features are extracted using feature engineering methods such as session aggregation, sliding window statistics, endpoint clustering, and protocol behavior profiling to highlight communication patterns and trends; for external intelligence data, known threat information is standardized and cross-referenced with internal observation data to establish risk correlations; for geospatial semantic data, geographic source and temporal context information are standardized (e.g., unified time zones, and annotation of business peaks / maintenance windows).

[0044] Furthermore, during the acquisition and preprocessing of raw multi-source data, buffer playback, breakpoint resume, and packet loss detection functions are embedded. Buffer playback refers to supporting the backtracking and reprocessing of historical data streams through data buffer storage, further ensuring data integrity and availability; breakpoint resume refers to resuming data transmission from the breakpoint for interrupted data streams, avoiding data loss; packet loss detection refers to real-time monitoring of the data transmission process to promptly identify data loss.

[0045] In this embodiment of the application, the preprocessing of multi-source raw data is to transform the scattered, heterogeneous, and non-standard multi-source raw data of nodes into unified, clean, reliable, and directly usable multi-source basic data for subsequent feature extraction.

[0046] S102. Based on the multi-source basic data corresponding to each node, the global feature vector corresponding to each node is obtained through a cross-modal attention mechanism.

[0047] Among them, the cross-modal attention mechanism is a feature fusion technology for different modal data (i.e., multi-source basic data). In the multimodal feature space, by adaptively calculating the attention weight of each modal feature, it highlights the modal features that are more relevant to node anomaly identification, suppresses the interference of redundant or irrelevant modal features, and finally fuses the feature vectors from different data modalities into a global feature vector with a unified dimension and rich in key information, so as to achieve efficient collaboration and value maximization of heterogeneous data.

[0048] To make it easier to understand, the following will be combined with... Figure 2 Let me explain in detail how to obtain the global feature vector corresponding to a given node.

[0049] S201. Based on multi-source basic data, encode the corresponding multiple initial feature vectors respectively.

[0050] Specifically, based on multi-source basic data, targeted encoding processing is used to convert them into their respective initial feature vectors, so as to obtain multiple initial feature vectors corresponding to the multi-source basic data.

[0051] For example, for time-series index data, residual convolution and a bidirectional LSTM encoder are used to generate time-series feature vectors that capture short-term mutations and long-term trends; for runtime log data, a text embedding module is used to generate log semantic feature vectors containing semantic information; and for dependency data, a graph attention network (GAT) encoding is used to generate topological structure feature vectors that characterize the key relationships between components (nodes). It should be noted that the aforementioned time-series feature vectors, topological structure feature vectors, and log semantic feature vectors are "multiple initial feature vectors".

[0052] S202. Calculate the weight coefficients corresponding to each initial feature vector through a cross-modal attention mechanism.

[0053] The weight coefficients corresponding to each initial feature vector can be understood as the global attention weights of each initial feature vector for anomaly identification in internet infrastructure services. That is, through a cross-modal attention mechanism adaptively generating anomaly identification as the core task, the information value of each initial feature vector can be accurately quantified. A higher weight coefficient indicates that the initial feature vector is more important and has a stronger correlation with anomaly identification; conversely, a lower weight coefficient indicates that the initial feature vector is less important and has a weaker correlation with anomaly identification.

[0054] Specifically, the weight coefficients corresponding to each initial feature vector are obtained by first performing independent linear mapping on each initial feature vector to generate the corresponding query vector (Q), key vector (K), and value vector (V). Then, the query vector corresponding to any initial feature vector is selected as the benchmark and obtained by performing correlation calculation and scaling normalization with the key vectors corresponding to all initial feature vectors. This takes into account both the information strength of the individual initial feature vector and the association logic between different initial feature vectors.

[0055] To make it easier to understand, the following examples, using formulas (1) and (2), illustrate the weight coefficients corresponding to each initial feature vector.

[0056] (1)

[0057] in, score ( Q i , K j ) is the first i The query vector corresponding to the initial feature vector and the first initial feature vector jThe similarity score between the key vectors corresponding to the initial feature vector, i.e. the first initial feature vector. j Similarity scores corresponding to each initial feature vector; Q i For the first i The query vector corresponding to each initial feature vector; K j For the first j The key vectors corresponding to the initial feature vectors K j T For the first j Transpose of the key vectors corresponding to the initial feature vectors; This is a scaling factor used to normalize the dot product results, preventing excessively large values ​​and gradient vanishing due to high dimensionality.

[0058] The similarity score corresponding to each initial feature vector is obtained through formula (1). Then, the similarity score corresponding to each initial feature vector is normalized to obtain the weight coefficient corresponding to each initial feature vector. As shown in formula (2): (2) in, a i，j For the first j The weight coefficients corresponding to the initial feature vector are essentially the weights of the first initial feature vector. i The query vector corresponding to the initial feature vector and the first initial feature vector j The ratio between the similarity scores between the key vectors corresponding to the initial feature vectors and the sum of all similarity scores; Sotf The max function is a normalized exponential activation function used to convert an input of any set of real numbers into an output of values ​​between 0 and 1, where the sum of all values ​​is 1.

[0059] S203. Based on the weight coefficients corresponding to each initial feature vector, the multiple initial feature vectors are weighted to obtain the corresponding global feature vector.

[0060] Specifically, based on the weight coefficients output by the cross-modal attention mechanism, the value vectors corresponding to multiple initial feature vectors are adaptively weighted and fused to aggregate the scattered initial feature vectors into a global feature vector of a unified dimension.

[0061] For example, suppose multiple initial feature vectors include F1, F2, and F3, where F1 is the initial feature vector corresponding to time-series metric data (referred to as the time-series metric feature vector), F2 is the initial feature vector corresponding to runtime log data (referred to as the runtime log feature vector), and F3 is the initial feature vector corresponding to dependency relationship data; the value vector corresponding to the initial feature vector F1 is... V1. The value vector corresponding to F2 is V 2. The value vector corresponding to F3 is V 3; The weight coefficients corresponding to each initial feature vector are respectively: a 1. a 2 and a 3, of which a 1, a 2, a 3 represents the weight coefficients corresponding to F1, F2, and F3, respectively. Therefore, the global feature vector = .

[0062] In this embodiment, multiple initial feature vectors are generated by targeted encoding of multi-source basic data, realizing the structured representation of different types of data such as time-series index data, operation log data, and dependency relationship data. Adaptive weight coefficients are generated based on the cross-modal attention mechanism, and the multiple initial feature vectors are weighted based on the weight coefficients to obtain a global feature vector. This not only realizes the unified dimensional aggregation of multi-source features, but also weakens the interference of low-value redundant information through adaptive weight coefficient allocation, retains features that have a great impact on node anomalies, and provides more accurate and targeted feature inputs for subsequent node anomaly score calculation and root cause localization, greatly improving the accuracy and adaptability of single-node anomaly identification.

[0063] The above combination Figure 2 This application details how the global feature vector is obtained in its embodiments. The following section continues with further examples. Figure 1 This application introduces an anomaly identification method for basic Internet services provided by its embodiments.

[0064] S103. Based on the global feature vector corresponding to each node, the anomaly score of each node is obtained through a pre-trained variational autoencoder and a pre-trained discriminant network.

[0065] The anomaly score measures the degree of deviation between the global feature vector and the global feature vector under normal internet infrastructure service conditions. A higher anomaly score indicates a greater deviation between the global feature vector and the global feature vector under normal internet infrastructure service conditions; conversely, a lower anomaly score indicates a smaller deviation between the global feature vector and the global feature vector under normal internet infrastructure service conditions.

[0066] Variational Autoencoders (VAEs) are generative probabilistic models based on deep learning. They learn the latent probability distribution of input data and generate new samples similar to the original data based on this distribution. VAEs build upon the traditional encoder-decoder architecture by introducing probabilistic modeling constraints, enabling the model not only to reconstruct data but also to capture the underlying statistical patterns, resulting in stronger generalization capabilities and a greater ability to perceive changes in data distribution.

[0067] Specifically, the pre-trained variational autoencoder is trained using a large number of global feature vectors of nodes under normal conditions, enabling the variational autoencoder to fully learn the latent probability distribution of global feature vectors under normal conditions.

[0068] Among them, the pre-trained discriminant network is a discriminative model based on deep learning, which is used to output a discriminant score to represent the probability that the input global feature vector deviates from the normal distribution, that is, the probability that the input global feature vector is abnormal.

[0069] Specifically, the pre-trained discriminant network is trained by using the latent representations output by a pre-trained variational autoencoder from the global feature vectors of nodes under normal conditions. This allows the discriminant network to fully learn the feature patterns and distribution rules of the latent representations under normal conditions, thereby establishing a discriminant benchmark of "normal features".

[0070] In one possible implementation, for a given node, the global feature vector corresponding to the node is input into a pre-trained variational autoencoder so that the pre-trained variational autoencoder outputs a reconstructed feature vector corresponding to the global feature vector; simultaneously, the global feature vector corresponding to the node is input into a pre-trained discriminant network so that the pre-trained discriminant network outputs a discrimination score corresponding to the global feature vector; subsequently, based on the reconstruction error between the global feature vector and the reconstructed feature vector and the discrimination score, the anomaly score of the node is obtained, thus obtaining the anomaly score for each node.

[0071] Specifically, the input of the pre-trained variational autoencoder is the global feature vector of the node, and the output of the pre-trained variational autoencoder is the reconstructed feature vector corresponding to the global feature vector. It is an "ideal normal vector" generated by the variational autoencoder based on the learned normal distribution, which has the same structure as the input global feature vector and conforms to the normal pattern. It is called the reconstructed feature vector.

[0072] Specifically, the input to the pre-trained discriminant network is the global feature vector of the node, and the output of the pre-trained discriminant network is the discriminant score, which is an evaluation of whether the global feature vector output by the discriminant network deviates from the normal distribution. The larger the discriminant score, the more the global feature vector deviates from the normal distribution, and the smaller the discriminant score, the closer the global feature vector is to the normal distribution.

[0073] Specifically, the reconstruction error and discrimination score between the global feature vector and the reconstructed feature vector are weighted to obtain the anomaly score of the node.

[0074] The reconstruction error is used to quantify the structural difference between the actual operating state and the normal operating state of a node. In this embodiment, the reconstruction error is calculated using the Euclidean distance (L2 norm) between the global feature vector and the reconstructed feature vector, as shown in formula (3): (3) Among them, S rec The reconstruction error is between the global feature vector and the reconstructed feature vector. x For global feature vectors, To reconstruct the feature vector.

[0075] For ease of understanding, the abnormal scores provided in the embodiments of this application are illustrated below with examples based on formula (4).

[0076] S=αS rec +(1-α)S disc (4)

[0077] Where S is the anomaly score; α is the preset reconstruction error weight; (1-α) is the preset discrimination score weight; and the sum of the preset reconstruction error weight and the preset discrimination score weight is 1; S rec S represents the reconstruction error between the global feature vector and the reconstructed feature vector. disc The discrimination score is the output of the pre-trained discrimination network.

[0078] As shown in formula (2), the larger the reconstruction error, the greater the difference between the node's global feature vector and the reconstructed feature vector, indicating a greater difference between the node's actual operating state and its ideal normal operating state, thus indicating a higher risk of anomaly for the node. The larger the discrimination score, the more the node's global feature vector deviates from the normal distribution, thus indicating a higher risk of anomaly for the node. Therefore, the anomaly score is the weighted result of the reconstruction error and the discrimination score. The larger the anomaly score, the higher the risk of anomaly for the node, which may involve malicious attacks, performance degradation, configuration anomalies, or cross-node propagation.

[0079] For example, suppose the global feature vector x=[0.6,0.5,0.3,0.7,0.4], the reconstructed feature vector output by the VAE based on the global feature vector. =[0.48,0.29,0.41,0.58,0.21], the discrimination score S output by the discrimination network. disc =0.5, the preset reconstruction error weight α=0.4. Therefore, the reconstruction error is: S rec = =0.35, then the abnormal score S = 0.4 × 0.35 + 0.6 × 0.5 = 0.44.

[0080] In one possible implementation, after obtaining the anomaly score of each node through a pre-trained variational autoencoder based on the global feature vector corresponding to each node, the list of key triggering factors corresponding to each node is determined through the Shaplectic interpretation algorithm or the integral gradient algorithm based on the global feature vector corresponding to each node.

[0081] The list of key triggering factors includes one or more key triggering factors, which are feature types that lead to node anomalies. Specifically, key triggering factors refer to feature types selected from multiple initial feature vectors that significantly affect node anomaly scores. In essence, the list of key triggering factors clearly identifies the key causes of node anomalies and their feature vectors, providing interpretability support for anomaly identification and other related tasks.

[0082] The Shapley Additive Explanations (SHAP) algorithm, based on Shapley values ​​in game theory, assigns a feature contribution value to each output of the model (referred to as the "abnormal score of a node" in this embodiment), quantifying the degree and direction of each feature's influence on that abnormal score. Its core logic is to treat each feature type as a game participant and calculate its average marginal contribution across all possible subsets of feature types to obtain its importance score to the final result, ensuring the fairness and consistency of contribution value calculation.

[0083] The Integrated Gradient algorithm is a gradient-based model interpretation algorithm. It calculates the gradient integral of the model output (anomaly score) as the model input gradually transitions from a baseline value (typically the value of a default feature vector without anomalies, such as normal CPU utilization or no error logs) to the actual value (the values ​​of each dimension of the global feature vector of a node). This quantifies the cumulative contribution of each feature type's dimension to the anomaly score. The gradient reflects the local influence of the feature type on the output, while the integral accumulates this local influence into a global contribution. A higher final score indicates a stronger driving effect of that feature type on anomalies (i.e., the anomaly score).

[0084] S104. Add the anomaly score corresponding to each node to the knowledge graph, and calculate the contribution of each node based on the transmission coefficient of the edge between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node.

[0085] A knowledge graph consists of each node and the edges between them, with each node carrying a trust label and each edge carrying a transmission coefficient. A knowledge graph is a structured semantic network for basic internet services, that is, constructing relationships between nodes and attaching key attributes to support causal inference and root cause localization.

[0086] Specifically, the knowledge graph is obtained as follows: a knowledge graph framework is constructed based on the multi-source raw data corresponding to each node, and the key attributes of the knowledge graph are trained based on the multi-source historical data corresponding to each node, thus obtaining the knowledge graph.

[0087] Multi-source historical data refers to a collection of historical observation data accumulated during the operation of internet infrastructure services, covering multiple dimensions. It is the core data source for training the transmission coefficients of edges in a knowledge graph. For example, multi-source historical data, which corresponds one-to-one with the original data types, includes: historical time-series indicator data, historical operation log data, and historical dependency relationship data.

[0088] Trust labels refer to the trust metrics assigned to each node in the knowledge graph, used to measure the reliability of node data, the stability of historical behavior, and the impact of its abnormal state on other nodes.

[0089] For example, the value range of the trust label is usually [0,1] (0 represents completely untrusted, and 1 represents completely trusted). For example, the trust label of the node of the core business service instance (with no anomalies in multi-source historical data and stable data collection) is close to 1 (e.g., 0.9), while the trust label of the external IP that has been the source of attacks and the container node that has frequently reported errors in the past is close to 0 (e.g., 0.1).

[0090] The transmission coefficient refers to the quantitative index of the causal influence intensity of each edge (relationship between nodes) in the knowledge graph, which is used to reflect the probability and degree of influence of the abnormal state of the upstream node propagating to the downstream node.

[0091] For example, the transmission coefficient typically ranges from [-1, +1]. When the transmission coefficient is positive, it indicates that the anomaly of the upstream node has a positive promoting effect on the downstream node, meaning that the more severe the anomaly of the upstream node, the higher the risk of anomaly in the downstream node. When the transmission coefficient is negative, it indicates that the anomaly of the upstream node has a negative inhibiting effect on the downstream node, meaning that the more severe the anomaly of the upstream node, the lower the risk of anomaly in the downstream node.

[0092] To make it easier to understand, the following will be combined with... Figure 3 This paper provides an example of how the knowledge graph is obtained in an embodiment of this application.

[0093] S301. Based on the multi-source raw data corresponding to each node, construct each node and the edges between each node in the knowledge graph to obtain the knowledge graph framework.

[0094] Specifically, based on the multi-source raw data corresponding to each node, key components (i.e., nodes) and the relationships between components in the Internet infrastructure services are extracted, and a basic topology framework containing only trust labels of nodes without dynamic transmission coefficients is constructed to obtain the knowledge graph framework.

[0095] The types of nodes include at least one of the following: service instance, host, switch port, configuration item, user session, and external IP; the relationship definition of the edge includes at least one of the following: call, dependency, route, and configuration.

[0096] Regarding node types: Service instance refers to the actual running business service unit (such as the deployment instance of payment service or user authentication service), which is the carrier of business logic; Host refers to the physical server, virtual machine, or container that hosts the service or application, providing basic resources such as computing and storage; Switch port refers to the physical or logical port of a network switch, which is the network node for data transmission and is responsible for connecting different network devices; Configuration item refers to the key configuration parameters of the system, service, or device (such as database connection address, port number, running threshold, etc.), which determine the running rules; User session refers to the interactive session record formed after a user logs into the system (such as administrator login session, ordinary user operation session), which is associated with user behavior; External IP refers to the external network address from the Internet (including normal external IP, malicious IP, etc.), which is the entry node for external access.

[0097] In terms of the definition of edge relationships: calling refers to a node actively initiating a request to call the function or service of another node (such as service instance A calling service instance B to complete data verification); dependency refers to the fact that the normal operation of one node is premised on the existence or normal operation of another node (such as a service instance relying on configuration items to obtain running parameters); routing refers to the network path association of data transmission from one node to another (such as a host routing to an external IP through a switch port); configuration refers to configuration nodes providing configuration parameters to other nodes, or loading parameters of other configuration nodes (such as a container loading port configuration items).

[0098] For example, suppose we obtain multi-source raw data corresponding to four nodes, and the four nodes correspond to four services, A, B, C, and D. The key components extracted from the internet infrastructure services are designated as nodes SA, SB, SC, and SD in the knowledge graph framework. The node type is service instance, and all nodes have a trust tag of 0.9. Based on the multi-source raw data corresponding to the four nodes, we extract that service A depends on B and C, service B depends on C and D, and service C depends on D. The edges in the knowledge graph framework are shown in Table 1. Table 1

[0099] S302. Based on the confirmed events in the multi-source historical data corresponding to each node, train the transmission coefficients of the edges between each node in the knowledge graph framework to obtain the knowledge graph.

[0100] Specifically, based on the confirmed events in the multi-source historical data corresponding to each node as supervision signals, the propagation coefficients of each edge in the knowledge graph framework are trained through a causal graph neural network to obtain a complete knowledge graph.

[0101] Multi-source historical data refers to the multi-source historical data accumulated during the operation of internet infrastructure services, which is the data source for confirmed events. Confirmed events refer to abnormal events that have been verified manually or by automated tools, including: root cause node (i.e., the origin of the anomaly), chain of affected nodes (anomaly propagation path, such as H-01->SB->SA), propagation sequence (the time order in which each node's anomaly is triggered, such as SB becoming abnormal 2 minutes after H-01, and SA becoming abnormal 5 minutes later), and degree of impact.

[0102] The training process of a knowledge graph can be as follows: the knowledge graph framework and confirmed events contained in multi-source historical data are input into a causal graph neural network, so that the causal graph neural network can load the knowledge graph framework and assign initial values ​​to the propagation coefficients of each edge. Then, the message passing mechanism of the causal graph neural network is used to simulate the propagation of anomalies. The prediction results of the causal graph neural network are compared with the actual propagation of confirmed events. The propagation coefficients of the edges are adjusted by backpropagation so that the prediction results approximate the real scene, thereby obtaining the propagation coefficients of each edge and obtaining a complete knowledge graph.

[0103] The above combination Figure 3 This paper details how the knowledge graph was obtained in the embodiments of this application. The following section will continue to discuss this in conjunction with... Figure 1 This application provides a detailed description of an anomaly identification method for basic Internet services.

[0104] In one possible implementation, for a node, the contribution of each node is calculated using a pre-defined causal graph neural network aggregation function, based on the edge propagation coefficient between the node and its downstream connected nodes, the node's anomaly score, and the node's trust label.

[0105] The contribution of a node is used to quantify the causal attribution value of a single node in causing anomalies to its connected downstream nodes. This is used for root cause localization, i.e., determining the degree of influence and responsibility weight of the node in triggering anomalies in downstream nodes within the anomaly propagation chain. In this embodiment, the contribution value that can quantify the causal attribution value is obtained by fusing the node's own anomaly score and trust label, as well as the transmission coefficient between the node and its connected downstream nodes.

[0106] Among them, the causal graph neural network aggregation function is a non-linear fusion function that captures the non-linear relationship between the strength of causal associations between nodes (edge ​​propagation coefficient) and the node's own state (node's anomaly score and node's trust label) to achieve accurate quantification of the influence of root cause nodes.

[0107] To facilitate understanding, the contribution rate will be explained in detail below with reference to formula (5).

[0108] C uv = f ( a uv , S u , T u (5)

[0109] in, C uv The contribution of node u. a uv For nodes u and its connected downstream nodes v The conductivity, S u For nodes u Abnormal scores, T u For nodes u Trust labels f This is the aggregation function for causal graph neural networks.

[0110] To make it easier to understand, the following example, using formula (6), illustrates a contribution level.

[0111] (6)

[0112] in, C uv For nodesu Contribution a uv For nodes u and its connected downstream nodes v The conductivity, S u For nodes u Abnormal scores, T u For nodes u Trust tags, take the transmission coefficient a uv The absolute value, Sigmoid is the activation function. As shown in formula (6), only the causal influence strength is retained; S u × T u The abnormal score and trust label of the merge node are used to determine the abnormality level and trustworthiness of the merge node.

[0113] For example, assume the conduction coefficient of the edge a uv =0.65, node u abnormal scores S u =0.6, node u Trust tags T u =0.85. Therefore, the contribution level... C uv = Sigmoid (0.65×0.6×0.85)≈0.58.

[0114] It should be noted that for nodes that do not have a direct connection to downstream nodes, their contribution is 0.

[0115] S105. Starting from the abnormal node, based on the contribution of each node in the knowledge graph, generate a set of candidate root cause paths through backpropagation, and output the candidate root cause paths in the set of candidate root cause paths.

[0116] In this context, an abnormal node is a node whose abnormal score exceeds a preset threshold and serves as the starting point for root cause tracing. Specifically, in this embodiment, the abnormal node is the endpoint of the abnormal propagation chain, and its upstream root node, which triggered the abnormality, needs to be traced back through reverse propagation.

[0117] Among them, the reverse propagation method refers to starting from the abnormal node and tracing back the upstream nodes along the relationship between nodes in the knowledge graph (the edges between nodes) to discover the path expansion method of the abnormal propagation source, thereby restoring the root cause path of "root cause node -> intermediate node -> abnormal node".

[0118] The candidate root cause path set includes one or more candidate root cause paths. A candidate root cause path refers to a complete anomaly propagation link obtained through backpropagation, which is "root cause node -> intermediate node -> anomaly node". It intuitively presents the propagation process of an anomaly from its source to its destination.

[0119] In one possible implementation, starting from the anomalous node, the upstream node extension path is greedily selected in descending order of contribution to obtain one or more predicted root cause links; the time consistency of one or more predicted root cause paths is verified to obtain one or more candidate root cause paths, thus obtaining a set of candidate root cause paths.

[0120] Greedy selection is a local optimum-oriented strategy for backward expansion of root cause paths. Its core is to quickly generate high-priority predicted root cause paths by prioritizing the capture of local optimum solutions at each step, without pursuing the global optimum solution in order to balance efficiency and core target identification.

[0121] Specifically, a greedy selection strategy, following the order of contribution from highest to lowest, expands the root cause path backward from the anomalous node. Each time, based on a preset node threshold, upstream nodes with contributions higher than the threshold are selected and traversed, resulting in one or more unverified predicted root cause paths. If no upstream node with a contribution higher than the threshold exists, the path expansion immediately stops. During path expansion, the path contribution of the current path is calculated synchronously as the root cause path expands, and it is determined whether the path contribution is less than the preset path threshold. If the path contribution is lower than the preset threshold, the path expansion will immediately stop, even if an upstream node with a contribution higher than the threshold exists.

[0122] To facilitate understanding, the path contribution is illustrated below with an example based on formula (7). For a multi-hop path, P = u —> v 1—>...—> v k Take the k-hop path as an example.

[0123] Cp = Cuv 1× Cv 1 v 2×...× Cv k-1 v k × λ k (7)

[0124] in, Cp Contribution to the path Cuv 1 is a node u Contribution (node) u For nodesv (Contribution of 1) Cv 1 v 2 is a node v Contribution of 1 (node) v 1 pair of nodes v 2 (contribution) Cv k-1 v k For nodes v k-1 Contribution (node) v k-1 For nodes v k λ is the attenuation coefficient (0 < λ < 1). k For the number of jumps, λ k This is the attenuation term.

[0125] For example, starting from the anomalous node SA, the upstream nodes connected to SA include S-B1, S-B2, and S-B3. S-B1's contribution is 0.9, which is greater than the preset node threshold of 0.4; S-B2's contribution is 0.7, which is greater than 0.4; and S-B3's contribution is 0.3, which is less than the node threshold. Therefore, S-B3 is excluded. For the remaining upstream nodes, S-B1 is selected first, in descending order of contribution. Then, based on node S-B1, its connected upstream nodes are selected. S-B1's connected upstream nodes include S-C1 and S-C2. S-C1's contribution is 0.8, which is greater than 0.4; and S-C2's contribution is 0.5, which is greater than 0.4. S-C1 is selected first, in descending order of contribution. Simultaneously, the path contribution of this predicted root cause path is calculated as 0.9 × 0.8 × 0.9. 2 =0.5832 (λ=0.9), while the preset path threshold is 0.7. If the path contribution is greater than the preset path threshold, the expansion of the path will stop, and the corresponding predicted root cause path will be S-C1—>S-B1—>SA.

[0126] Specifically, verifying the temporal consistency of the predicted root cause path means that the anomaly occurrence time of all nodes in the root cause path must satisfy the condition that "the anomaly time of the upstream node ≤ the anomaly time of the downstream node," meaning that the root cause node becomes abnormal first, and the anomaly gradually propagates to the abnormal nodes. For example, the anomaly trigger timestamp of each node in the predicted root cause path is extracted, and the time series is checked for continuity in a forward order from the root cause node, intermediate nodes to the abnormal node, thereby achieving temporal consistency verification.

[0127] In one possible implementation, the confidence of each candidate causal link is calculated based on the data carried on the knowledge graph (anomaly score of nodes, trust label of nodes, transmission coefficient of edges between nodes, etc.), thereby ranking and outputting the candidate causal links.

[0128] In this embodiment of the application, a visualized candidate causal chain is output in the form of a topology graph, and a list of affected assets, confidence assessment and remediation priority can also be output.

[0129] In one possible implementation, after outputting the candidate root cause paths in the candidate root cause path set, corresponding risk warning information is generated based on the candidate root cause paths to indicate the anomalies in the Internet infrastructure services.

[0130] For example, risk warning information includes: a visual description of the candidate root cause chain, a list of affected assets, supplementary explanations of the risk causes, remediation suggestions and priorities, etc.

[0131] In one possible implementation, risk warning information can be sent to the corresponding operations and maintenance personnel via email, application pop-ups, or push notifications from the operations and maintenance platform interface.

[0132] Furthermore, existing anomaly detection models are typically trained based on static data distributions, resulting in insufficient robustness to dynamic disturbances such as factor value drift, data noise, and domain variation. This leads to significant performance degradation after model deployment due to dynamic changes in the operating environment (such as configuration changes, business fluctuations, and metric biases). In this embodiment, by collecting feedback results on the repair of candidate root cause paths (including repair effectiveness, actual business impact, false positive / false negative statistics, etc.) and combining this with service anomaly factor value domain space jitter processing (including local Gaussian noise injection, domain jump simulation, and gradient-guided adversarial perturbation), the pre-trained anomaly detection model is dynamically adjusted and its parameters iterated. This effectively enhances the model's adaptability to factor value drift, noise, and domain variation, significantly improving the robustness of the anomaly detection model and its performance stability after actual deployment.

[0133] To make it easier to understand, the following will be combined with... Figure 4 This paper details the optimization of the anomaly recognition model in the embodiments of this application.

[0134] S401. Collect the repair results, actual business impact, and false positive / false negative statistics of candidate root cause paths, and construct anomaly confidence verification parameters based on the collected repair results, actual business impact, and false positive / false negative statistics of candidate root cause paths.

[0135] Among them, the anomaly confidence verification parameter is used to adjust the task loss and robust regularization term of the anomaly identification model during the training phase, thereby guiding the perturbation intensity and distribution range of the service anomaly factor value space jitter training.

[0136] The remediation results for candidate root cause paths include: the effectiveness of the remediation operations (such as successful root cause node blocking, or successful remediation scenarios such as configuration restoration and anomaly elimination, or remediation failure scenarios such as continued anomalies after remediation or ineffective remediation due to root cause location errors); actual business impact includes: quantitative indicators (such as the duration of business interruption caused by the anomaly, the scale of affected users, the amount of failed transactions, and the duration of core link unavailability) and qualitative feedback (such as whether it affects core businesses such as login and payment, and whether it triggers user complaints); false positive and false negative statistics are automatically labeled by the system or manually confirmed by operations and maintenance personnel, for example: false positive records where the model judges an anomaly but there is no actual threat, false negative records where the model does not detect anomalies but there are actual anomalies, and correct identification records where the model accurately identifies the anomaly and the root cause is correctly located.

[0137] In one possible implementation, sample weights are also constructed based on the collected remediation results of candidate root cause paths, actual business impact, and false positive / false negative statistics.

[0138] The sample weights are differentiated numerical weights assigned to the training samples of the anomaly detection model based on the repair results of candidate root cause paths, actual business impact, and false positive / false negative statistics. These weights quantify the business importance and model learning priority of different samples during the optimization process, rather than applying a uniform weight to all samples. Specifically, multi-source raw data with high sample weights are considered high-value multi-source raw data.

[0139] S402. Using the original data from multiple sources corresponding to each node as the original samples, generate corresponding perturbation samples through controlled random perturbation based on the original samples, and generate corresponding adversarial samples through gradient guidance.

[0140] In one possible implementation, based on sample weights, high-value multi-source raw data is selected from the multi-source raw data corresponding to each node, and the high-value multi-source raw data is used as the original sample. Based on the original sample, corresponding perturbation samples are generated through controlled random perturbation, and corresponding adversarial samples are generated through gradient guidance.

[0141] Specifically, multi-source raw data with sample weights greater than a preset sample weight threshold are considered high-value multi-source raw data. Therefore, based on sample weights, multi-source raw data with weights greater than the preset sample weight threshold are selected as high-value multi-source raw data, and these high-value multi-source raw data are used as the original samples. In this embodiment, high-value multi-source raw data is selected by sample weights, avoiding wasting computing power on original multi-source data (samples) with "low impact and ineffective repair" in anomaly identification. This allows training resources to be prioritized for multi-source raw data in "core business nodes and historical missed detection scenarios," which can significantly improve the convergence speed of the anomaly identification model.

[0142] Among them, perturbation samples refer to samples generated from the original samples through controlled random perturbation.

[0143] Specifically, for numerical risk factors in the original sample, factor domain modeling is first performed, and local Gaussian noise perturbation is applied to the numerical risk factors in the original sample based on factor domain modeling. For categorical risk factors in the original sample, categorical factor domains are first divided by clustering, such as by clustering based on business semantic similarity. Perturbation is applied to the categorical risk factors in the original sample through domain transition (i.e., domain transition perturbation is applied to the categorical risk factors in the original sample), thereby obtaining the perturbed sample corresponding to the original sample.

[0144] Factor domain modeling refers to the process of statistically modeling the distribution characteristics or value range of each numerical risk factor (such as CPU utilization, database query failure rate, login event type) in multi-source raw data. The purpose is to clarify the normal boundary and attribute characteristics of each risk factor and provide a basis for subsequent perturbation processing.

[0145] Specifically, for numerical risk factors in the original sample, based on factor domain modeling, Gaussian noise perturbation that conforms to their historical distribution characteristics is applied to the numerical risk factors to simulate small fluctuations in factor values ​​in the real environment (such as measurement error, sampling bias, and instantaneous load fluctuations). For example, for the numerical risk factor, the standard deviation of the Gaussian noise is determined based on its historical variance, generating a noise term that follows a normal distribution. This noise term is then superimposed onto the original numerical risk factor to obtain the perturbed numerical risk factor.

[0146] Domain jump perturbation refers to a perturbation method that involves controllably replacing the values ​​of categorical risk factors in the original sample within the same semantic domain formed by clustering. The core is to simulate reasonable distributional variation scenarios such as business mode switching, configuration parameter adjustment, or fault type evolution in a real environment, and to strictly limit the jump to the same domain to avoid semantic distortion.

[0147] Adversarial examples refer to samples generated from the original samples through gradient guidance. That is, small, directional gradient guidance perturbations are applied to the original samples to simulate boundary sample scenarios (samples close to the model's decision boundary that are easily misjudged), thereby enhancing the model's ability to identify critical anomalies.

[0148] S403. Based on the original samples, obtain the task loss of the anomaly recognition model, and based on the original samples, jitter samples and adversarial samples, obtain the robust regularization term of the anomaly recognition model.

[0149] The task loss is derived from the reconstruction error and classification error of the original sample.

[0150] To facilitate understanding, the following example illustrates task loss using formula (8): L task = γS rec ( x 0) + ( 1 - γ ) L cls ( x 0) (8) in, L task The task loss of the anomaly detection model, S rec ( x 0) represents the original sample. x The reconstruction error corresponding to 0, L cls ( x 0) represents the original sample. x The classification error corresponding to 0 is γ The preset weighting coefficient for reconstruction error in task loss is (1- γ ) is the preset weighting coefficient for classification error in task loss.

[0151] Specifically, the reconstruction error corresponding to the original sample is obtained as follows: the original sample is input into the anomaly detection model, the anomaly detection model generates the corresponding global feature vector based on the original sample, and determines the corresponding reconstruction feature vector through a pre-trained variational autoencoder. The Euclidean distance between the global feature vector corresponding to the original sample and the corresponding reconstruction feature vector is calculated to obtain the reconstruction error corresponding to the original sample.

[0152] The classification loss corresponding to the original samples only applies to labeled original samples. For labeled original samples, the cross-entropy loss function is used to calculate the difference between the probability distribution predicted by the anomaly detection model and the true label distribution.

[0153] The robust regularization term is derived from the differences between the discrimination scores of the original samples and the jitter samples, as well as the differences between the discrimination scores of the original samples and the interference samples.

[0154] To facilitate understanding, the robust regularization term is illustrated below with examples from formula (9): (9) in, L robust For robust regularization terms in anomaly detection models, S disc ( x 0) represents the original sample.x The discriminant score corresponding to 0 S disc ( x 1) For jitter samples x The discriminant score corresponding to 1 S disc ( x 2) For adversarial examples x The corresponding discriminant score for 2, λ The preset weighting coefficients for the difference in discrimination scores between the original sample and the jittering sample in the robust regularization term, (1- λ ) is the preset weighting coefficient for the difference in discrimination scores between the original sample and the interference sample in the robust regularization term.

[0155] For example: the discrimination score for the original sample is 0.5, the discrimination score for the jittered sample is 0.55, and the discrimination score for the adversarial sample is 0.62. λ If the value is 0.7, then the robust regularization term of the anomaly detection model = =0.071.

[0156] Specifically, the discrimination scores for each sample are obtained as follows: the original sample, jitter sample, and adversarial sample are input into the anomaly detection model, the anomaly detection model generates corresponding global feature vectors based on the original sample, jitter sample, and adversarial sample, and obtains the discrimination scores corresponding to the original sample, jitter sample, and adversarial sample through a pre-trained discriminant network.

[0157] S404. Based on the anomaly confidence verification parameters, the task loss and robust regularization term are weighted to obtain the total loss of the anomaly recognition model, and the anomaly recognition model is optimized based on the total loss.

[0158] Specifically, based on the anomaly confidence verification parameters, the weight coefficient β corresponding to the robust regularization term is derived; while the weight coefficient corresponding to the task loss is 1 by default.

[0159] To facilitate understanding, the total loss of the anomaly detection model is illustrated below with an example based on formula (10): L = L task + β × L robust (10) in, L The total loss of the anomaly detection model is... L task The task loss of the anomaly detection model, L robust For robust regularization terms in anomaly detection models, βThese are the weight coefficients corresponding to the robust regularization term obtained based on the anomaly confidence verification parameters.

[0160] Specifically, the task loss and robust regularization term are weighted to obtain the total loss of the anomaly detection model. The model is then optimized to minimize this total loss. In this embodiment, the anomaly detection model is optimized using its task loss, ensuring that the model's output closely matches the actual business operation, reducing false positives and false negatives caused by deviations between the model's predictions and reality. By generating corresponding jitter samples and adversarial samples to simulate real-world interference such as factor value drift, data noise, domain mutation, and boundary samples, combined with robust regularization constraints, the anomaly detection model adapts to various dynamic interferences in advance during optimization. This significantly improves the model's anti-interference capability, solving the problem of performance degradation due to environmental changes after deployment, which is often caused by static data training in existing technologies. This ensures stable operation of the model in complex and dynamic internet infrastructure service environments.

[0161] Furthermore, the anomaly identification method for internet infrastructure services provided in this application is a closed-loop process of "identification-location-response-feedback," which eliminates the need for frequent manual intervention. It achieves automatic iterative updates of model parameters through continuously collected business feedback data and dynamically generated multi-source perturbation samples (jitter samples and adversarial samples). As businesses expand, configurations change, and attack patterns evolve, the model can continuously optimize its identification capabilities, maintaining stable and reliable detection performance over the long term, and adapting to the dynamic evolution needs of internet infrastructure services.

[0162] This application provides an anomaly identification method for Internet infrastructure services, comprising: collecting multi-source raw data corresponding to each node, and preprocessing the multi-source raw data to obtain multi-source basic data; based on the multi-source basic data corresponding to each node, obtaining a global feature vector corresponding to each node through a cross-modal attention mechanism; based on the global feature vector corresponding to each node, obtaining an anomaly score for each node through a pre-trained variational autoencoder and a pre-trained discriminant network; adding the anomaly score of each node to a knowledge graph, and calculating the contribution of each node based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node; starting from the anomaly node, generating a candidate root cause path set through backpropagation based on the contribution of each node in the knowledge graph, and outputting the candidate root cause paths in the candidate root cause path set. This application's embodiments improve the comprehensiveness and accuracy of anomaly identification and reduce the risk of false negatives by collecting multi-source raw data and transforming it into a unified global feature vector using a cross-modal attention mechanism. Simultaneously, it constructs and trains a knowledge graph containing node trust labels and edge propagation coefficients based on multi-source data, calculates node contribution by combining anomaly scores, and generates candidate root cause paths through backpropagation. This eliminates the reliance on static topology and human experience, achieves accurate localization of complex anomaly root causes, and enhances the interpretability and operability of root cause localization, significantly reducing operation and maintenance troubleshooting costs and response time.

[0163] Furthermore, by weighting the initial feature vectors from multiple sources through a cross-modal attention mechanism, key features are highlighted and redundant information is suppressed, making the global feature vectors more accurately reflect the true state of the nodes. This lays a high-quality feature foundation for subsequent anomaly score calculation and root cause analysis, thereby improving the overall accuracy of anomaly identification.

[0164] Furthermore, anomaly scores are calculated by combining the reconstruction error of the variational autoencoder with the discrimination score of the discriminant network. At the same time, the deviation of the global feature vector from the normal distribution and the discrimination results of the abnormal pattern are considered, making anomaly quantification more comprehensive and in line with the actual scenario. This effectively reduces the risk of misjudgment caused by a single judgment standard and improves the reliability of anomaly judgment.

[0165] Furthermore, a knowledge graph tailored to actual business needs is constructed based on multi-source raw data. By training the transmission coefficients of edges using historically confirmed events, the knowledge graph accurately characterizes node relationships and the strength of causal influence, providing a reliable structured foundation for subsequent contribution calculations and root cause localization. Through a causal graph neural network aggregation function, the contribution of each node is calculated by integrating transmission coefficients, anomaly scores, and trust labels, accurately quantifying the impact weight of each node on anomalies. This provides accurate evidence for reverse tracing of root cause paths and improves the accuracy of root cause localization.

[0166] Furthermore, invalid prediction paths are filtered out by verifying time consistency and causal rationality, reducing redundant candidate paths, ensuring the effectiveness and relevance of the candidate root cause path set, reducing the troubleshooting costs for operations and maintenance personnel, and improving the efficiency of root cause localization.

[0167] Furthermore, anomaly confidence verification parameters, constructed based on the repair results of candidate root cause paths, actual business impact, and false positive / false negative statistics, make the weighting of task loss and robust regularization terms more aligned with the needs of real business scenarios, achieving dynamic adaptation of model optimization directions. Moreover, by generating perturbation samples through controlled random perturbation and adversarial samples through gradient guidance, and constructing robust regularization terms by combining the difference in discrimination scores between the original samples and the two types of samples, the model's resistance to interference from conventional factor drift, sudden perturbations, and malicious adversarial attacks is effectively strengthened, avoiding the generalization shortcomings caused by training with a single sample. Finally, by weighted fusion of task loss and robust regularization terms to obtain the total loss and optimize the model, while ensuring the accuracy of threat identification, the false positive and false negative rates in dynamic business environments are significantly reduced. This allows the model to accurately capture real anomalies and stably adapt to complex and ever-changing service operation scenarios, significantly improving the timeliness and reliability of threat discovery.

[0168] Example 2: The following is combined Figure 5 This application provides a detailed description of an anomaly identification model for basic Internet services.

[0169] like Figure 5 As shown in the embodiment of this application, an anomaly identification model for Internet basic services includes: a collection and access layer 501, a characterization and detection layer 502, and a location and tracking layer 503.

[0170] The acquisition and access layer 501 is used to acquire the multi-source raw data corresponding to each node, and to preprocess the multi-source raw data to obtain multi-source basic data. The representation and detection layer 502 is used to obtain the global feature vector corresponding to each node based on the multi-source basic data corresponding to each node through a cross-modal attention mechanism; The representation and detection layer 502 is also used to obtain the anomaly score of each node based on the global feature vector corresponding to each node through a pre-trained variational autoencoder and a pre-trained discriminant network; where the anomaly score measures the degree of deviation between the global feature vector and the global feature vector under normal Internet infrastructure service conditions. The localization and tracking layer 503 is used to add the anomaly score of each node to the knowledge graph, and calculate the contribution of each node based on the transmission coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node. The knowledge graph is constructed based on the multi-source original data corresponding to each node and trained based on the multi-source historical data corresponding to each node. The knowledge graph includes each node and the edges between each node, and each node carries a trust label and each edge carries a transmission coefficient. The localization and tracking layer 503 is also used to generate a set of candidate root cause paths by backpropagation, starting from an abnormal node and based on the contribution of each node in the knowledge graph; and output the candidate root cause paths in the set of candidate root cause paths; wherein, an abnormal node is a node whose abnormal score is higher than a preset threshold.

[0171] In one possible implementation, the representation and detection layer 502 is specifically used to encode multiple initial feature vectors based on multi-source basic data for a single node; calculate the weight coefficients corresponding to each initial feature vector through a cross-modal attention mechanism; and perform weighted processing on the multiple initial feature vectors based on the weight coefficients corresponding to each initial feature vector to obtain the corresponding global feature vector, so as to obtain the global feature vector corresponding to each node.

[0172] In one possible implementation, the representation and detection layer 502, specifically for a single node, inputs the global feature vector corresponding to the node into a pre-trained variational autoencoder so that the variational autoencoder outputs a reconstructed feature vector corresponding to the global feature vector; inputs the global feature vector corresponding to the node into a pre-trained discriminant network so that the discriminant network outputs a discrimination score corresponding to the global feature vector; and obtains the anomaly score of the node based on the reconstruction error between the global feature vector and the reconstructed feature vector and the discrimination score, thus obtaining the anomaly score for each node.

[0173] In one possible implementation, the localization and tracking layer 503 is specifically used to calculate the contribution of a node based on the transmission coefficient of the edge between the node and the downstream nodes connected to the node, the node's anomaly score, and the node's trust label, through a preset causal graph neural network aggregation function, so as to obtain the contribution of each node.

[0174] In one possible implementation, the location and tracking layer 503 is specifically used to start from the abnormal node, greedily select the upstream node extension path in descending order of contribution, and obtain one or more predicted root cause paths; verify the temporal consistency and causal rationality of one or more predicted root cause paths, and obtain one or more candidate root cause paths to obtain a set of candidate root cause paths.

[0175] In one possible implementation, the anomaly detection model also includes a decision and response layer; the decision and response layer is used to generate corresponding risk warning information based on candidate root cause paths to indicate anomalies in Internet infrastructure services.

[0176] In one possible implementation, the anomaly detection model further includes a feedback and learning layer. This layer is used to: collect the repair results, actual business impact, and false positive / false negative statistics of candidate root cause paths; and construct anomaly confidence verification parameters based on these collected data. Using the multi-source raw data corresponding to each node as raw samples, corresponding perturbation samples are generated through controlled random perturbation, and corresponding adversarial samples are generated through gradient guidance. Based on the raw samples, the task loss of the anomaly detection model is obtained, and based on the raw samples, perturbation samples, and adversarial samples, a robust regularization term for the anomaly detection model is obtained. Based on the anomaly confidence verification parameters, the task loss and robust regularization term are weighted to obtain the total loss of the anomaly detection model, and the anomaly detection model is optimized based on the total loss.

[0177] This application provides an anomaly detection model for internet infrastructure services, comprising: a data acquisition and access layer 501, used to acquire multi-source raw data corresponding to each node and preprocess the multi-source raw data to obtain multi-source basic data; a representation and detection layer 502, used to obtain a global feature vector corresponding to each node based on the multi-source basic data corresponding to each node through a cross-modal attention mechanism; the representation and detection layer 502 is also used to obtain an anomaly score for each node based on the global feature vector corresponding to each node through a pre-trained variational autoencoder and a pre-trained discriminant network; a localization and tracking layer 503, used to add the anomaly score of each node to a knowledge graph and calculate the contribution of each node based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node; the localization and tracking layer 503 is also used to generate a candidate root cause path set starting from the anomaly node, based on the contribution of each node in the knowledge graph, through backpropagation, and output the candidate root cause paths in the candidate root cause path set; wherein, the anomaly node is a node whose anomaly score is higher than a preset threshold. This application's embodiments improve the comprehensiveness and accuracy of anomaly identification and reduce the risk of false negatives by collecting multi-source raw data and transforming it into a unified global feature vector using a cross-modal attention mechanism. Simultaneously, it constructs and trains a knowledge graph containing node trust labels and edge propagation coefficients based on multi-source data, calculates node contribution by combining anomaly scores, and generates candidate root cause paths through backpropagation. This eliminates the reliance on static topology and human experience, achieves accurate localization of complex anomaly root causes, and enhances the interpretability and operability of root cause localization, significantly reducing operation and maintenance troubleshooting costs and response time.

[0178] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the model embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The model embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separate. The components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment solution according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0179] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for anomaly identification in basic internet services, characterized in that, The method, applied to a pre-trained anomaly detection model, includes: Collect multi-source raw data corresponding to each node, and preprocess the multi-source raw data to obtain multi-source basic data; Based on the multi-source basic data corresponding to each node, a global feature vector corresponding to each node is obtained through a cross-modal attention mechanism; Based on the global feature vector corresponding to each node, an anomaly score for each node is obtained through a pre-trained variational autoencoder and a pre-trained discriminant network; wherein, the anomaly score measures the degree of deviation between the global feature vector and the global feature vector under normal Internet infrastructure service conditions. The anomaly score of each node is added to the knowledge graph, and the contribution of each node is calculated based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node. The knowledge graph is constructed based on the multi-source raw data corresponding to each node and trained based on the multi-source historical data corresponding to each node. The knowledge graph includes each node and the edges between each node, with each node carrying a trust label and each edge carrying a propagation coefficient. Starting with an abnormal node, and based on the contribution of each node in the knowledge graph, a set of candidate root cause paths is generated through backpropagation, and the candidate root cause paths in the set are output; wherein, the abnormal node is a node whose abnormal score is higher than a preset threshold.

2. The method according to claim 1, characterized in that, The process of obtaining the global feature vector corresponding to each node based on the multi-source basic data corresponding to each node through a cross-modal attention mechanism includes: For a single node, based on the multi-source basic data, multiple initial feature vectors are encoded to obtain the corresponding features. The weight coefficients corresponding to each of the initial feature vectors are calculated using a cross-modal attention mechanism. Based on the weight coefficients corresponding to each initial feature vector, the multiple initial feature vectors are weighted to obtain the corresponding global feature vectors, thereby obtaining the global feature vectors corresponding to each node.

3. The method according to claim 1, characterized in that, The anomaly score for each node is obtained by using a pre-trained variational autoencoder based on the global feature vector corresponding to each node, including: For a single node, the global feature vector corresponding to the node is input into a pre-trained variational autoencoder so that the variational autoencoder outputs a reconstructed feature vector corresponding to the global feature vector. The global feature vector corresponding to the node is input into a pre-trained discriminant network so that the discriminant network outputs a discrimination score corresponding to the global feature vector; Based on the reconstruction error between the global feature vector and the reconstructed feature vector and the discrimination score, the anomaly score of the node is obtained, so as to obtain the anomaly score of each node.

4. The method according to claim 1, characterized in that, The knowledge graph was obtained in the following way: Based on the multi-source raw data corresponding to each node, each node and the edges between each node in the knowledge graph are constructed to obtain the knowledge graph framework; wherein, the node type includes at least one of the following: service instance, host, switch port, configuration item, user session and external IP, and the edge relationship definition includes at least one of the following: call, dependency, routing and configuration; Based on the confirmed events in the multi-source historical data corresponding to each node, the transmission coefficients of the edges between each node in the knowledge graph framework are trained to obtain the knowledge graph.

5. The method according to claim 1, characterized in that, The calculation of each node's contribution based on the transmission coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node includes: For a given node, the contribution of the node is calculated using a preset causal graph neural network aggregation function based on the transmission coefficient of the edge between the node and the downstream nodes connected to the node, the node's anomaly score, and the node's trust label.

6. The method according to claim 1, characterized in that, Starting with an anomaly node, and based on the contribution of each node in the knowledge graph, a set of candidate root cause paths is generated through backpropagation, including: Starting from the abnormal node, greedily select the upstream node to extend the path according to the order of contribution from high to low, and obtain one or more predicted root cause paths; Verify the temporal consistency of the one or more predicted root cause paths to obtain one or more candidate root cause paths, thus obtaining a set of candidate root cause paths.

7. The method according to claim 1, characterized in that, After outputting the candidate root cause paths in the candidate root cause path set, the method further includes: Based on the candidate root cause paths, corresponding risk warning information is generated to indicate the anomalies in the Internet infrastructure services.

8. The method according to claim 7, characterized in that, The method further includes: Collect the repair results, actual business impact, and false positive / false negative statistics of the candidate root cause paths, and construct anomaly confidence verification parameters based on the collected repair results, actual business impact, and false positive / false negative statistics of the candidate root cause paths; Using the multi-source raw data corresponding to each node as the raw sample, based on the raw sample, corresponding perturbation samples are generated through controlled random perturbation, and corresponding adversarial samples are generated through gradient guidance. Based on the original samples, the task loss of the anomaly detection model is obtained, and based on the original samples, the jitter samples, and the adversarial samples, the robust regularization term of the anomaly detection model is obtained. Based on the anomaly confidence verification parameters, the task loss and the robust regularization term are weighted to obtain the total loss of the anomaly identification model, and the anomaly identification model is optimized based on the total loss.

9. The method according to claim 8, characterized in that, The robust regularization term of the anomaly detection model is obtained based on the difference between the discrimination score corresponding to the original sample and the discrimination score corresponding to the jitter sample, and the difference between the discrimination score corresponding to the original sample and the discrimination score corresponding to the adversarial sample.

10. An anomaly detection model for basic internet services, characterized in that, include: The data acquisition and access layer, the characterization and detection layer, and the localization and tracking layer; The acquisition and access layer is used to acquire multi-source raw data corresponding to each node, and to preprocess the multi-source raw data to obtain multi-source basic data. The representation and detection layer is used to obtain the global feature vector corresponding to each node based on the multi-source basic data corresponding to each node through a cross-modal attention mechanism. The representation and detection layer is further used to obtain an anomaly score for each node based on the global feature vector corresponding to each node through a pre-trained variational autoencoder; wherein, the anomaly score measures the degree of deviation between the global feature vector and the global feature vector under normal Internet infrastructure service conditions; The localization and tracking layer is used to add the anomaly score of each node to the knowledge graph, and calculate the contribution of each node based on the propagation coefficient of the edges between each node in the knowledge graph, the anomaly score of each node, and the trust label of each node; wherein, the knowledge graph is constructed based on the multi-source original data corresponding to each node, and trained based on the multi-source historical data corresponding to each node; the knowledge graph includes each node and the edges between each node, and each node carries a trust label, and each edge carries a propagation coefficient; The location and tracking layer is also used to generate a set of candidate root cause paths by backpropagation, starting from an abnormal node and based on the contribution of each node in the knowledge graph; and output the candidate root cause paths in the set of candidate root cause paths; wherein, the abnormal node is a node whose abnormal score is higher than a preset threshold.

Images