Classification method and device of microservice logs of information system, and electronic equipment

Abstract

The application discloses a kind of information system microservice log classification method and its device, electronic equipment, it is related to artificial intelligence field, wherein the classification method includes: collecting the microservice log information of target information system, and obtaining the context information associated with microservice log information, processing context information and microservice log information, generates input sequence, determines the system type of target information system, and using the preset classification model corresponding to system type processes input sequence, obtains classification result.The application solves the technical problem that the accuracy of classifying microservice log of information system in related technology is low.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, and more specifically, to a method, apparatus, and electronic device for classifying microservice logs of an information system. Background Technology

[0002] With the increasing complexity and service-oriented nature of information systems (such as microservices, API (Application Programming Interface) gateways, and distributed middleware), unstructured error logs generated during system operation have become a critical source of information for fault diagnosis and early warning. However, these logs are typically generated by different technology stacks (such as Dubbo (a distributed service governance framework), Spring Cloud (a microservice ecosystem suite), RESTEasy (a service implementation framework), etc.), resulting in diverse textual expressions and loosely structured syntax.

[0003] In related technologies, error log classification mainly adopts the following methods: (1) rule matching based on keywords or regular expressions, such as judging whether it is a timeout by detecting strings such as "timeout", "timed out", and "elapsed >". However, this method has poor generalization ability and is prone to failure when faced with log format changes, multilingual mixing, abbreviations or encoding escaping (such as "Read timedout" and "Client response timeout"); (2) using a general NLP (Natural Language Processing) model for error log classification. However, the general model has serious biases in understanding the semantics of information systems, resulting in low classification accuracy.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, and electronic device for classifying microservice logs of an information system, in order to at least solve the technical problem of low accuracy in classifying microservice logs of information systems in related technologies.

[0006] According to one aspect of the present invention, a method for classifying microservice logs of an information system is provided, comprising: collecting microservice log information of a target information system and obtaining context information associated with the microservice log information; processing the context information and the microservice log information to generate an input sequence; determining the system type of the target information system and processing the input sequence using a preset classification model corresponding to the system type to obtain a classification result, wherein the preset classification model includes at least an encoder structure and a classification structure, the encoder structure being used to encode the input sequence and the classification structure being used to classify the received encoded vector.

[0007] Furthermore, the steps for obtaining context information associated with microservice log information include: determining the tracing identifier of the microservice log information; obtaining the call chain based on the tracing identifier, and obtaining the service topology based on the call chain; determining the timestamp for collecting the microservice log information; and representing the call chain, service topology, and timestamp as context information.

[0008] Furthermore, the context information includes at least: service topology, call chain, and timestamp. The steps of processing the context information and microservice log information to generate the input sequence include: cleaning the microservice log information to obtain cleaned microservice log information; transforming the service topology to generate a call path string; extracting features from the call chain to obtain link features; and using the call path string, link features, and timestamp as prefixes and concatenating them to the cleaned microservice log information to obtain the input sequence.

[0009] Furthermore, before processing the input sequence using a preset classification model corresponding to the system type to obtain the classification result, the process further includes: constructing an encoder structure, wherein the encoder structure includes: multiple encoding layers, each encoding layer including: an attention network and a neural network; constructing a classification structure, wherein the classification structure includes: a fully connected layer; and constructing an initial classification model based on the encoder structure and the classification structure.

[0010] Furthermore, after constructing the initial classification model based on the encoder structure and classification structure, the process also includes: for each system type, collecting multiple historical microservice logs corresponding to the system type and the historical context information associated with each historical microservice log; determining the set of fault types corresponding to the system type; labeling all historical microservice logs based on the fault type set to obtain the actual fault types corresponding to the historical microservice logs; concatenating the historical microservice logs and historical context information to obtain multiple concatenated data; and training the initial classification model using all concatenated data until the loss value is less than a preset loss threshold to obtain the preset classification model. The loss value is determined by a loss function based on the actual fault type and the predicted fault type output by the initial classification model.

[0011] Further, the steps of processing the input sequence using a preset classification model corresponding to the system type to obtain the classification result include: encoding the input sequence to obtain an initial vector; processing the initial vector using the first encoding layer in the encoder structure to obtain an output vector, and processing the output vector using the next encoding layer in the encoder structure until the last encoding layer to obtain a semantic vector; linearly transforming the semantic vector using a fully connected layer in the classification structure to obtain a target vector; processing the target vector using an activation function to obtain the probability value of each fault type corresponding to the system type; and determining the fault type corresponding to the maximum probability value as the target fault type when the maximum probability value is greater than or equal to a preset probability threshold, thus obtaining the classification result.

[0012] Furthermore, the processing steps of the encoding layer include: using the attention network in the encoding layer to perform attention calculation on the received vector to obtain a weighted vector; and using the neural network in the encoding layer to perform a linear transformation on the weighted vector to obtain an output vector.

[0013] According to another aspect of the present invention, a classification apparatus for microservice logs of an information system is also provided, comprising: an acquisition unit for acquiring microservice log information of a target information system and acquiring context information associated with the microservice log information; a first processing unit for processing the context information and the microservice log information to generate an input sequence; and a second processing unit for determining the system type of the target information system and processing the input sequence using a preset classification model corresponding to the system type to obtain a classification result, wherein the preset classification model includes at least an encoder structure and a classification structure, the encoder structure being used to encode the input sequence and the classification structure being used to classify the received encoded vector.

[0014] Furthermore, the acquisition unit includes: a first determining module, used to determine the tracing identifier of the microservice log information; a first acquisition module, used to acquire the call chain based on the tracing identifier, and acquire the service topology based on the call chain; a second determining module, used to determine the timestamp of the collected microservice log information; and a first characterization module, used to characterize the call chain, service topology, and timestamp as context information.

[0015] Furthermore, the context information includes at least: service topology, call chain, and timestamp. The concatenation unit includes: a first cleaning module for cleaning the microservice log information to obtain cleaned microservice log information; a first transformation module for transforming the service topology to generate a call path string; a first extraction module for extracting features from the call chain to obtain link features; and a first concatenation module for using the call path string, link features, and timestamp as prefixes and concatenating them to the cleaned microservice log information to obtain an input sequence.

[0016] Furthermore, the classification device also includes: a first construction module, used to construct an encoder structure before processing the input sequence using a preset classification model corresponding to the system type to obtain a classification result, wherein the encoder structure includes: multiple encoding layers, each encoding layer including: an attention network and a neural network; a second construction module, used to construct a classification structure, wherein the classification structure includes: a fully connected layer; and a third construction module, used to construct an initial classification model based on the encoder structure and the classification structure.

[0017] Furthermore, the classification device also includes: a first acquisition module, used to acquire multiple historical microservice logs corresponding to each system type and historical context information associated with each historical microservice log after constructing an initial classification model based on the encoder structure and classification structure; a third determination module, used to determine the set of fault types corresponding to the system type; and to label all historical microservice logs based on the set of fault types to obtain the actual fault types corresponding to the historical microservice logs; a second splicing module, used to splice the historical microservice logs and historical context information to obtain multiple spliced ​​data; and a first training module, used to train the initial classification model using all spliced ​​data until the loss value is less than a preset loss threshold to obtain a preset classification model, wherein the loss value is determined by a loss function based on the actual fault type and the predicted fault type output by the initial classification model.

[0018] Further, the second processing unit includes: a first encoding module for encoding the input sequence to obtain an initial vector; a first processing module for processing the initial vector using the first encoding layer in the encoder structure to obtain an output vector, and then processing the output vector using the next encoding layer in the encoder structure until the last encoding layer to obtain a semantic vector; a first linear transformation module for performing a linear transformation on the semantic vector using a fully connected layer in the classification structure to obtain a target vector; a second processing module for processing the target vector using an activation function to obtain a probability value for each fault type corresponding to the system type; and a fourth determination module for determining the fault type corresponding to the maximum probability value as the target fault type when the maximum probability value is greater than or equal to a preset probability threshold, thereby obtaining a classification result.

[0019] Furthermore, the first processing module includes: a first calculation submodule, used to perform attention calculation on the received vector using an attention network in the coding layer to obtain a weighted vector; and a first linear transformation submodule, used to perform a linear transformation on the weighted vector using a neural network in the coding layer to obtain an output vector.

[0020] According to another aspect of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the microservice log classification method of any of the above-described information systems.

[0021] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the microservice log classification method of any of the above information systems.

[0022] In this invention, microservice log information of the target information system is collected, and context information associated with the microservice log information is obtained. The context information and microservice log information are processed to generate an input sequence, determine the system type of the target information system, and process the input sequence using a preset classification model corresponding to the system type to obtain a classification result. This solves the technical problem of low accuracy in classifying microservice logs of information systems in related technologies.

[0023] This invention employs a semantic fusion approach, integrating microservice log information with its associated contextual information. By constructing an input sequence and inputting a pre-defined classification model that matches the system type, it achieves unified semantic classification of heterogeneous microservice logs. This enables intelligent identification and semantic alignment of error logs across technology stacks, thus solving the problem of low classification accuracy caused by the difficulty of traditional rule-based or general NLP models in handling diverse log formats, specialized terminology, and strong contextual dependencies in information systems. The pre-defined classification model in this invention includes an encoder structure and a classification structure. The encoder structure captures word-level and context-level semantic associations in the input sequence, while the classification structure adapts the output to the corresponding fault category (such as timeout, connection failure, etc.) according to the system type, ensuring high generalization and high accuracy of the model. It eliminates the need for manual rules or feature engineering, enabling end-to-end, deployable intelligent log analysis. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a classification method for microservice logs of an information system is shown.

[0026] Figure 2 This is a flowchart of a method for classifying microservice logs in an information system according to Embodiment 1 of the present invention;

[0027] Figure 3 This is a schematic diagram of an optional information system microservice log classification device according to an embodiment of the present invention;

[0028] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, have taken necessary security measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained; if the user chooses to refuse, the process enters the expert decision-making process.

[0032] In this invention, microservice log information of the target information system is collected, and associated context information is obtained. By concatenating the context information with the microservice log information, an input sequence containing a complete semantic background is generated, thus overcoming the limitations of traditional classification that relies solely on the log text itself. Then, based on the system type of the target information system, a pre-defined classification model matching it is invoked. This model consists of an encoder structure and a classification structure. The encoder structure can fully capture the multi-dimensional, unstructured semantic features in the concatenated input sequence, while the classification structure performs accurate discrimination based on the encoded vectors, achieving efficient differentiation of log semantics with diverse expressions, large differences in technology stacks, and strong contextual dependencies. In this way, without relying on keyword matching or a general semantic model, the accuracy and adaptability of microservice log classification can be significantly improved, effectively solving the classification error problem caused by inconsistent log expressions, complex technical environments, and missing context information in related technologies, thereby improving log analysis efficiency and enhancing the intelligent level of system operation and maintenance.

[0033] The present invention will now be described in detail with reference to various embodiments.

[0034] Example 1

[0035] According to an embodiment of this application, an embodiment of a method for classifying microservice logs of an information system is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0036] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1A hardware block diagram of a computer terminal (or mobile device) for implementing a method for classifying microservice logs in an information system is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0037] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0038] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the microservice log classification method of the information system in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the microservice log classification method of the information system described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0039] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0040] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0041] Under the aforementioned operating environment, this application provides the following: Figure 2 The classification method for microservice logs in the information system is shown. Figure 2 This is a flowchart of a microservice log classification method for an information system according to Embodiment 1 of the present invention, as shown below. Figure 2 As shown, the method includes the following steps:

[0042] Step S201: Collect microservice log information of the target information system and obtain context information associated with the microservice log information.

[0043] In this embodiment of the invention, information system logs often involve strong context dependencies, and the same error code may represent different severity levels in different services and different call chains. For example, if a "timeout" occurs in a core transaction chain (such as order creation), its risk is far higher than that of a peripheral service. If contextual information such as service name, caller, and time window is ignored, it will be difficult to achieve refined risk assessment. Therefore, microservice log information of the target information system (such as a power information system) can be collected first, and the contextual information associated with the microservice log information can be obtained.

[0044] Here, microservice log information consists of unstructured text output by microservice components in the target information system during runtime. Context information comprises structured metadata directly associated with the log event, including the service name (e.g., "OrderService") and the service provider's address (e.g., "dubbo: / / 10.2"). .3 0.4 :2 The data includes " / OrderService", call chain identifier (Trace ID), protocol type (such as RPC (Remote Procedure Call) or HTTP (Hypertext Transfer Protocol)) and timestamp, which come from log collection agents or distributed tracing systems.

[0045] Step S202: Process the context information and microservice log information to generate an input sequence.

[0046] In this embodiment of the invention, context information and microservice log information can be concatenated according to a preset format to form a single continuous text sequence. For example, the service name "OrderService" and the interface address "dubbo: / / 10.2" can be concatenated. .3 0.4 :2 The string " / OrderService" combined with the log text "Read timed out" forms the string "[Service Name] OrderService[Interface] dubbo: / / 10.2 .3 0.4 :2 " / OrderService [log] Read timed out". This concatenation process does not change the original text content, but only achieves structured embedding through fixed field identifiers (such as "[service name]"). In this way, unstructured logs and structured contexts can be merged into a unified semantic input, enabling the model to simultaneously perceive the fault semantics and occurrence context during the encoding stage, thereby improving the accuracy and context sensitivity of classification.

[0047] Step S203: Determine the system type of the target information system, and process the input sequence using a preset classification model corresponding to the system type to obtain the classification result. The preset classification model includes at least an encoder structure and a classification structure. The encoder structure is used to encode the input sequence, and the classification structure is used to classify the received encoded vector.

[0048] In this embodiment of the invention, the system type of the target information system can be determined first, such as power type or business travel type. Since the log data generated by different types of information systems contain different professional terms, it is necessary to call a preset classification model trained with different data to process the input sequence through the preset classification model and thus obtain the classification result.

[0049] Here, the preset classification model is a model pre-trained and deployed for this system type. Its encoder structure adopts a BERT-like architecture (Bidirectional Encoder Representations from Transformers) to perform context-aware semantic encoding on the input sequence, and the output is a fixed-dimensional vector representation. The classification structure is a multi-classifier based on fully connected layers and a Softmax function, which receives the encoded vector and outputs the probability distribution of predefined fault categories (such as "timeout error", "connection failure", "rate limiting rejection").

[0050] In summary, by semantically fusing microservice log information with its associated contextual information, and by constructing an input sequence and inputting a pre-defined classification model that matches the system type, the goal of semantically unifying the classification of heterogeneous microservice logs is achieved. This enables intelligent identification and semantic alignment of error logs across technology stacks, thus solving the technical problem that traditional rule-based or general NLP models struggle to handle the diverse log formats, specialized terminology, and strong contextual dependencies in information systems, leading to low classification accuracy. The pre-defined classification model in this invention includes an encoder structure and a classification structure. The encoder structure captures word-level and context-level semantic associations in the input sequence, while the classification structure adapts the output to the corresponding fault category (such as timeout, connection failure, etc.) according to the system type, ensuring high generalization and high accuracy of the model. It eliminates the need for manual rules or feature engineering, enabling end-to-end, deployable intelligent log analysis.

[0051] To improve the accuracy of obtaining context information, in the microservice log classification method of the information system provided in Embodiment 1 of this application, the following steps are taken: determining the tracking identifier of the microservice log information; obtaining the call chain based on the tracking identifier, and obtaining the service topology based on the call chain; determining the timestamp of the collected microservice log information; and representing the call chain, service topology, and timestamp as context information.

[0052] In this embodiment of the invention, the trace identifier of the microservice log information can be determined first. Here, the trace identifier refers to a globally unique ID (Identifier) ​​that identifies the distributed call chain, such as a Trace ID. It is generated at the request entry point by the service gateway or chain tracing middleware and is passed down level by level to each microservice node along the call chain. This trace identifier is embedded in the metadata field of the microservice log information. For example, the log contains the phrase "traceId=7a3b8c2d1e9f4a6b". The trace identifier can be extracted by parsing the log content or associating it with the metadata field in the log collection system.

[0053] In this embodiment of the invention, the call chain refers to a complete execution path record formed by multiple microservices in the order of their calls within a single business request. It includes the call time, response status, execution time, and upstream / downstream dependencies of each service, originating from the aggregation of Span (smallest tracing unit) data associated with the tracing identifier by the distributed tracing system. The service topology refers to the directed graph structure of the microservice nodes involved in the system during this call and their call relationships, including service names, call directions, protocol types, and call counts. It is dynamically constructed by the tracing system based on the Span dependencies of the call chain. By using the tracing identifier as a query key, the corresponding Span set can be retrieved from the tracing platform database to reconstruct the call chain and generate the service topology.

[0054] In this embodiment of the invention, a timestamp refers to the specific point in time when microservice log information is recorded by the system, expressed with millisecond or microsecond precision. It is typically added automatically by the log collection agent when writing logs, and is formatted as UTC (Coordinated Universal Time) or the system's local time, such as "2024-06-15T10:23:45.123Z". This timestamp originates from the built-in time field of the log framework or is injected by the log collector of the container platform. It can be extracted by parsing the beginning of the log line or metadata fields.

[0055] Then, structured data such as call chains, service topologies, and timestamps are converted into text or embedded descriptions that can be concatenated with microservice log information according to a preset semantic format, such as "[Call Chain] traceId=7a3b8c2d1e9f4a6b [Service Topology] OrderService→InventoryService→PaymentService [Timestamp] 2024-06-15T10:23:45.123Z". This representation process does not change the original data semantics, but only performs format standardization and semantic tag encapsulation.

[0056] In this embodiment, by using trace identifiers, call chains, service topology, and timestamps as contextual information for structured representation, and inputting them into the classification model along with microservice log information, the model can identify the risk level differences of the same fault semantics in different system locations based on the topological features of the call path, service dependencies, and time distribution. This improves the classification accuracy and semantic completeness of the results for complex distributed fault scenarios.

[0057] Optionally, the context information includes at least: service topology, call chain, and timestamp. To improve the accuracy of the generated input sequence, in the microservice log classification method of the information system provided in Embodiment 1 of this application, the microservice log information is cleaned to obtain cleaned microservice log information; the service topology is transformed to generate a call path string; the call chain is feature extracted to obtain link features; the call path string, link features, and timestamp are used as prefixes and concatenated to the cleaned microservice log information to obtain the input sequence.

[0058] In this embodiment of the invention, non-semantic, redundant, or inconsistent character sequences in the original microservice log information can be removed, standardized, or replaced using preset rules and regular expressions. This includes, but is not limited to: removing timestamp prefixes (e.g., "[2024-06-15 10:23:45,123]"), clearing non-critical lines from stack traces (e.g., "atjava.lang.Thread.run"), and standardizing IP (Internet Protocol) addresses and port formats (e.g., "dubbo: / / 10.2"). .3 0.4 :2 "Unified as "dubbo: / / <ip> : <port>Replace variable placeholders (e.g., "method: createOrder" should be replaced with "method:"). <method>The system logs are cleaned by filtering out meaningless system log markers (such as "DEBUG" and "WARN" level logs). The cleaned microservice logs retain the core fault semantics and are formatted uniformly, with irrelevant noise removed. This eliminates semantic interference caused by log source heterogeneity, improving input consistency and model convergence efficiency for subsequent semantic modeling.

[0059] In this embodiment of the invention, the service topology is a directed graph structure composed of microservice nodes and their calling relationships, including elements such as service name, calling direction, calling protocol (e.g., RPC / HTTP), and number of calls. The calling path string is a linearized representation of the directed graph in the calling order, connected by delimiters (e.g., "→"), for example, "OrderService→InventoryService→PaymentService". This transformation can be achieved by traversing the parent-child dependencies of the Spans in the calling chain, extracting service names according to the execution order, removing duplicate nodes (e.g., circular calls), and retaining unique calling paths.

[0060] In this embodiment of the invention, the call chain is a record of all microservice nodes traversed by a complete request in a distributed system, along with their execution sequence, response status, and time consumption. Numerical structured statistics can be extracted from the call chain to obtain link features, including: total call duration, maximum single-node time consumption, number of abnormal nodes, average response latency, percentage of timeout nodes, and protocol type distribution (such as RPC call percentage). This feature extraction can be generated by aggregating Span data recorded by the tracking system and combining it with preset algorithms (such as mean, percentile, and count). The results are output in the form of floating-point arrays or key-value pairs, such as "[duration: 4120ms, max_latency: 1980ms, timeout_ratio: 0.33]". In this way, the timing and performance indicators of the call chain can be transformed into low-dimensional semantic vectors that can be numerically perceived by the model, enhancing the ability to quantitatively identify performance anomalies.

[0061] Then, string concatenation can be used to linearly organize the call path string, link characteristics, timestamp, and cleaned microservice log information in the format "[Call Path] {Call Path String} [Link Characteristics] {Link Characteristics} [Timestamp] {Timestamp} {Cleaned Log Information}" to obtain the input sequence. For example, "[Call Path] OrderService→InventoryService→PaymentService [Link Characteristics] [duration:4120,max_latency:1980,timeout_ratio:0.33] [Timestamp] 2024-06-15T10:23:45.123Z org.apache.dubbo.rpc.RpcException: Invoke remote method timeout.method: <method>This concatenation process can be completed by the preprocessing module, ensuring that the length of the input sequence meets the maximum input length limit of the BERT-like model, and truncating any excess. In this way, non-textual system context information (path, performance, timing) can be transformed into a unified text input that the model can process, achieving semantic enhancement and context awareness.

[0062] In this embodiment, by cleaning the microservice log information, converting the service topology and call chain into structured text and numerical features, and concatenating them with timestamps into an input sequence, the BERT-like model can comprehensively perceive the system path, performance, and timing of the fault during the classification process. This significantly improves the ability to distinguish between faults with the same semantics but different contexts (such as core link timeouts and edge service timeouts), and enhances the accuracy and interpretability of the classification results in the information system.

[0063] To improve the accuracy of constructing the initial classification model, in the classification method for microservice logs of the information system provided in Embodiment 1 of this application, before processing the input sequence using a preset classification model corresponding to the system type to obtain the classification result, an encoder structure is constructed, wherein the encoder structure includes: multiple encoding layers, each encoding layer including: attention network and neural network; a classification structure is constructed, wherein the classification structure includes: fully connected layer; and an initial classification model is constructed based on the encoder structure and the classification structure.

[0064] In this embodiment of the invention, an initial classification model can be designed collaboratively using a multi-layer encoder structure based on the Transformer architecture and a classification output layer. The encoder structure consists of stacked multi-layer encoding layers, each containing a multi-head self-attention network and a feedforward neural network. The multi-head self-attention network is used to compute the semantic dependencies between words at different positions in the input sequence in parallel, while the feedforward neural network performs non-linear transformations and feature reorganization on the attention output. The classification structure consists of a single fully connected layer whose input dimension is consistent with the output dimension of the last layer of the encoder. The output dimension is equal to the number of predefined fault classification categories, used to map the context-aware semantic vector output by the encoder to the probability distribution of each fault category. The encoder structure and the classification structure are connected end-to-end to form the initial classification model. The model input is the concatenated augmented log sequence, and the output is the predicted probability vector for the corresponding fault category.

[0065] In this embodiment, an encoder structure containing a multi-layer attention network and a feedforward neural network, as well as a classification structure based on a fully connected layer, are constructed to form an end-to-end trainable initial classification model. This enables the model to have the ability to deeply model the semantics of microservice logs and to have high generalization in category discrimination. This lays a structural foundation for subsequent fine-tuning by combining domain corpora and fusing contextual information to improve classification accuracy.

[0066] To improve the prediction accuracy of the classification model, in the microservice log classification method of the information system provided in Embodiment 1 of this application, after constructing an initial classification model based on the encoder structure and classification structure, for each system type, multiple historical microservice logs corresponding to the system type and historical context information associated with each historical microservice log are collected; the set of fault types corresponding to the system type is determined; based on the set of fault types, all historical microservice logs are labeled to obtain the actual fault types corresponding to the historical microservice logs; the historical microservice logs and historical context information are concatenated to obtain multiple concatenated data; the initial classification model is trained using all concatenated data until the loss value is less than a preset loss threshold to obtain a preset classification model, wherein the loss value is determined by a loss function based on the actual fault type and the predicted fault type output by the initial classification model.

[0067] In this embodiment of the invention, to train preset classification models for different system types, historical microservice logs generated in the production environment for each system type and their associated historical context information can be collected. Historical microservice logs are unstructured text recorded during system operation, and the historical context information includes service name, caller IP address, interface path, call chain ID, timestamp, and service topology level. Then, for each system type, based on the fault diagnosis specifications of the domain involved in that system type, its corresponding fault type set is determined. For example, for a power information system, its corresponding fault type set includes predefined categories such as "timeout error," "connection failure," "network anomaly," "rate limiting rejection," and "connection pool exhaustion." Based on this fault type set, the collected historical microservice logs are labeled, assigning each log its corresponding real fault type, forming a labeled corpus. Then, each historical microservice log and its associated historical context information are concatenated into a single input sequence according to a preset format; the concatenation method can be to append structured fields before the original log text. Next, all the spliced ​​data is used as training samples and input into the initial classification model to obtain the predicted fault type. The model parameters are iteratively updated by calculating the cross-entropy loss value between the predicted fault type and the actual fault type and using the backpropagation algorithm until the loss value converges to the preset loss threshold (such as 0.05). Training is then stopped and the preset classification model is output.

[0068] In this embodiment, by collecting historical logs with contextual associations for different system types, constructing a standardized set of fault types, implementing annotation and semantic splicing, and training the model based on a loss function, a preset classification model with domain adaptability and context awareness is formed. This effectively solves the problem of classification failure caused by strong log heterogeneity, semantic ambiguity, and severe context dependence in information systems, significantly improves the model's unified recognition accuracy of error semantics across technology stacks, and provides a high-precision and reusable semantic classification foundation for the subsequent construction of a high-reliability fault prediction and service governance system.

[0069] To improve the accuracy of classification results, in the microservice log classification method of the information system provided in Embodiment 1 of this application, the input sequence is encoded to obtain an initial vector; the initial vector is processed by the first encoding layer in the encoder structure to obtain an output vector, and the output vector is processed by the next encoding layer in the encoder structure until the last encoding layer to obtain a semantic vector; the semantic vector is linearly transformed by the fully connected layer in the classification structure to obtain a target vector; the target vector is processed by an activation function to obtain the probability value of each fault type corresponding to the system type; when the maximum probability value is greater than or equal to a preset probability threshold, the fault type corresponding to the maximum probability value is determined as the target fault type, and the classification result is obtained.

[0070] In this embodiment of the invention, during the inference stage of the preset classification model, the concatenated input sequence can be input into the encoder structure, and converted into a word-level initial vector through the embedding layer. The initial vector is a dense representation of each word in a high-dimensional semantic space. Then, the first encoding layer in the encoder structure performs multi-head self-attention calculation and feedforward neural network transformation on the initial vector, outputting the first layer output vector. This output vector serves as the input to the next encoding layer, and is processed layer by layer by subsequent encoding layers in the encoder structure. Each encoding layer models long-range dependencies between words through a self-attention mechanism and performs nonlinear feature recombination through a feedforward network until the last encoding layer outputs a high-order semantic vector. Its dimension is consistent with the width of the encoder's hidden layer, representing the global semantic representation of the input sequence. The semantic vector is then input into the fully connected layer in the classification structure, where a linear transformation is performed to obtain the target vector. The dimension of this vector is equal to the number of categories in the fault type set corresponding to the system type, and each dimension corresponds to the unnormalized score of a fault type. After the target vector is processed by the Softmax activation function, the normalized probability value corresponding to each fault type of the system type is output, forming a probability distribution. In this probability distribution, if the maximum probability value is greater than or equal to the preset probability threshold (e.g., 0.8), the fault type corresponding to the maximum probability value is determined as the target fault type, forming the final classification result; if the threshold condition is not met, "unrecognized" is output, indicating that the log does not belong to any predefined category or there is no fault.

[0071] In this embodiment, the semantic features of the input sequence are modeled layer by layer by the encoder structure and a high-dimensional semantic vector is output. By combining the linear transformation of the classification structure and Softmax normalization, the probabilistic discrimination of microservice log fault types is realized. Confidence filtering is performed based on a preset probability threshold, which effectively improves the accuracy and robustness of the classification results. This ensures that the model can stably output high-confidence fault category judgments in the complex log context of information systems, providing reliable semantic output for subsequent fault root cause analysis and automatic response.

[0072] In order to accurately implement the processing of the encoding layer, in the classification method of microservice logs of the information system provided in Embodiment 1 of this application, the attention network in the encoding layer is used to perform attention calculation on the received vector to obtain a weighted vector; the neural network in the encoding layer is used to linearly transform the weighted vector to obtain an output vector.

[0073] In this embodiment of the invention, in each encoding layer of the encoder structure, the input vector is first fed into the attention network of that layer. The attention network employs a multi-head self-attention mechanism, which calculates the relevance weights between each word in the input sequence and weights and aggregates the vector representation of each word to generate a weighted vector corresponding to each word. The weighted vector is a representation of the input vector reweighted according to contextual dependencies in the semantic space, and its dimension is consistent with the input vector. Next, the weighted vector is input into a feedforward neural network in the same encoding layer. This neural network consists of two linear transformation layers and an intermediate nonlinear activation function, which performs linear transformations and nonlinear mappings on the weighted vector, outputting an output vector with the same dimension. This output vector serves as the input to the next encoding layer, and is passed sequentially to subsequent encoding layers until the semantic encoding of the entire encoder structure is completed. In this embodiment, this mechanism is repeatedly executed in each encoding layer, realizing the layer-by-layer abstraction and reconstruction of semantic associations in information system logs.

[0074] In this embodiment, by sequentially applying an attention network and a feedforward neural network in the encoding layer, a two-stage processing mechanism with semantic dynamic focusing and nonlinear feature enhancement capabilities is constructed. This enables the encoder structure to effectively handle the complexity and diversity of heterogeneous logs in the information system in terms of semantic expression, significantly improves the model's ability to abstract and normalize fault semantics under conditions without explicit rules, and provides a basic semantic encoding guarantee for achieving high-precision log classification across technology stacks.

[0075] The microservice log classification method for information systems provided in this application adopts a semantic fusion approach, integrating microservice log information with its associated contextual information. By constructing an input sequence and inputting a preset classification model that matches the system type, it achieves the goal of semantically unifying the classification of heterogeneous microservice logs. This enables intelligent identification and semantic alignment of error logs across technology stacks, thereby solving the technical problem that traditional rule-based or general NLP models struggle to handle the diverse log formats, specialized terminology, and strong contextual dependencies in information systems, resulting in low classification accuracy. The preset classification model in this invention includes an encoder structure and a classification structure. The encoder structure captures word-level and context-level semantic associations in the input sequence, while the classification structure adapts the output to the corresponding fault category (such as timeout, connection failure, etc.) according to the system type, ensuring high generalization and high accuracy of the model. It eliminates the need for manual rules or feature engineering, enabling end-to-end, deployable intelligent log analysis.

[0076] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0077] Example 2

[0078] This application also provides a microservice log classification device for an information system. It should be noted that the microservice log classification device for an information system provided in this application can be used to execute the microservice log classification method for an information system provided in this application. The following describes the microservice log classification device for an information system provided in this application.

[0079] According to an embodiment of this application, an apparatus for classifying microservice logs of the aforementioned information system is also provided. Figure 3 This is a schematic diagram of an optional microservice log classification device for an information system according to an embodiment of the present invention, such as... Figure 3 As shown, the classification device may include: an acquisition unit 30, a first processing unit 31, and a second processing unit 32.

[0080] The acquisition unit 30 is used to collect microservice log information of the target information system and obtain context information associated with the microservice log information.

[0081] The first processing unit 31 is used to process context information and microservice log information to generate an input sequence;

[0082] The second processing unit 32 is used to determine the system type of the target information system and process the input sequence using a preset classification model corresponding to the system type to obtain a classification result. The preset classification model includes at least an encoder structure and a classification structure. The encoder structure is used to encode the input sequence, and the classification structure is used to classify the received encoded vector.

[0083] The microservice log classification device for information systems provided in this application embodiment employs a semantic fusion approach, integrating microservice log information with its associated contextual information. By constructing an input sequence and inputting a preset classification model that matches the system type, it achieves semantically unified classification of heterogeneous microservice logs. This enables intelligent identification and semantic alignment of error logs across technology stacks, thereby solving the technical problem of low classification accuracy caused by the difficulty of traditional rule-based or general NLP models in handling diverse log formats, specialized terminology, and strong contextual dependencies in information systems. The preset classification model in this invention includes an encoder structure and a classification structure. The encoder structure captures word-level and context-level semantic associations in the input sequence, while the classification structure adapts and outputs corresponding fault categories (such as timeouts and connection failures) according to the system type, ensuring high generalization and high accuracy of the model. It eliminates the need for manual rules or feature engineering, enabling end-to-end, deployable intelligent log analysis.

[0084] Optionally, the acquisition unit includes: a first determining module, used to determine the tracing identifier of the microservice log information; a first acquisition module, used to acquire the call chain based on the tracing identifier, and acquire the service topology based on the call chain; a second determining module, used to determine the timestamp of the collected microservice log information; and a first characterization module, used to characterize the call chain, service topology, and timestamp as context information.

[0085] Optionally, the context information includes at least: service topology, call chain, and timestamp. The concatenation unit includes: a first cleaning module for cleaning the microservice log information to obtain cleaned microservice log information; a first transformation module for transforming the service topology to generate a call path string; a first extraction module for extracting features from the call chain to obtain link features; and a first concatenation module for using the call path string, link features, and timestamp as prefixes and concatenating them to the cleaned microservice log information to obtain an input sequence.

[0086] Optionally, the classification device further includes: a first construction module for constructing an encoder structure before processing the input sequence using a preset classification model corresponding to the system type to obtain a classification result, wherein the encoder structure includes: multiple encoding layers, each encoding layer including: an attention network and a neural network; a second construction module for constructing a classification structure, wherein the classification structure includes: a fully connected layer; and a third construction module for constructing an initial classification model based on the encoder structure and the classification structure.

[0087] Optionally, the classification device further includes: a first acquisition module, used to acquire multiple historical microservice logs corresponding to each system type and historical context information associated with each historical microservice log after constructing an initial classification model based on the encoder structure and classification structure; a third determination module, used to determine the set of fault types corresponding to the system type; and to label all historical microservice logs based on the set of fault types to obtain the actual fault types corresponding to the historical microservice logs; a second splicing module, used to splice the historical microservice logs and historical context information to obtain multiple spliced ​​data; and a first training module, used to train the initial classification model using all spliced ​​data until the loss value is less than a preset loss threshold to obtain a preset classification model, wherein the loss value is determined by a loss function based on the actual fault type and the predicted fault type output by the initial classification model.

[0088] Optionally, the second processing unit includes: a first encoding module for encoding the input sequence to obtain an initial vector; a first processing module for processing the initial vector using the first encoding layer in the encoder structure to obtain an output vector, and then processing the output vector using the next encoding layer in the encoder structure until the last encoding layer to obtain a semantic vector; a first linear transformation module for performing a linear transformation on the semantic vector using a fully connected layer in the classification structure to obtain a target vector; a second processing module for processing the target vector using an activation function to obtain a probability value for each fault type corresponding to the system type; and a fourth determination module for determining the fault type corresponding to the maximum probability value as the target fault type when the maximum probability value is greater than or equal to a preset probability threshold, thereby obtaining a classification result.

[0089] Optionally, the first processing module includes: a first calculation submodule, used to perform attention calculation on the received vector using an attention network in the coding layer to obtain a weighted vector; and a first linear transformation submodule, used to perform a linear transformation on the weighted vector using a neural network in the coding layer to obtain an output vector.

[0090] The classification device described above may also include a processor and a memory. The acquisition unit 30, the first processing unit 31, the second processing unit 32, etc., are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0091] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured. By adjusting kernel parameters, the system type of the target information system is determined, and a preset classification model corresponding to the system type is used to process the input sequence to obtain the classification result.

[0092] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0093] It should be noted that the acquisition unit 30, the first processing unit 31, and the second processing unit 32 mentioned above correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by the above units and the corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0094] Example 3

[0095] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0096] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the microservice log classification method and apparatus of the information system in this embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the microservice log classification method of the information system described above. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0097] The processor can invoke information and applications stored in the memory through the transmission device to perform the following steps: collect microservice log information of the target information system and obtain context information associated with the microservice log information; process the context information and microservice log information to generate an input sequence; determine the system type of the target information system and process the input sequence using a preset classification model corresponding to the system type to obtain a classification result. The preset classification model includes at least an encoder structure and a classification structure. The encoder structure is used to encode the input sequence, and the classification structure is used to classify the received encoded vector.

[0098] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: determine the trace identifier of the microservice log information; obtain the call chain based on the trace identifier, and obtain the service topology based on the call chain; determine the timestamp of the collected microservice log information; and represent the call chain, service topology, and timestamp as context information.

[0099] The processor can access information and applications stored in memory via a transmission device to perform the following steps: clean the microservice log information to obtain cleaned microservice log information; transform the service topology to generate a call path string; extract features from the call chain to obtain link features; and concatenate the call path string, link features, and timestamp as prefixes into the cleaned microservice log information to obtain the input sequence.

[0100] The processor can access information and applications stored in memory via a transmission device to perform the following steps: constructing an encoder structure, wherein the encoder structure includes: multiple coding layers, each coding layer including: an attention network and a neural network; constructing a classification structure, wherein the classification structure includes: a fully connected layer; and constructing an initial classification model based on the encoder structure and the classification structure.

[0101] The processor can access information and applications stored in memory via a transmission device to perform the following steps: For each system type, collect multiple historical microservice logs corresponding to the system type and historical context information associated with each historical microservice log; determine the set of fault types corresponding to the system type; based on the set of fault types, label all historical microservice logs to obtain the actual fault types corresponding to the historical microservice logs; concatenate the historical microservice logs and historical context information to obtain multiple concatenated data; train the initial classification model using all concatenated data until the loss value is less than a preset loss threshold to obtain the preset classification model, wherein the loss value is determined by a loss function based on the actual fault types and the predicted fault types output by the initial classification model.

[0102] The processor can access information and application programs stored in memory via a transmission device to perform the following steps: encoding the input sequence to obtain an initial vector; processing the initial vector using the first encoding layer in the encoder structure to obtain an output vector, and then processing the output vector using the next encoding layer in the encoder structure until the last encoding layer to obtain a semantic vector; linearly transforming the semantic vector using a fully connected layer in the classification structure to obtain a target vector; processing the target vector using an activation function to obtain the probability value of each fault type corresponding to the system type; and determining the fault type corresponding to the maximum probability value as the target fault type when the maximum probability value is greater than or equal to a preset probability threshold, thus obtaining the classification result.

[0103] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: using the attention network in the coding layer to perform attention calculation on the received vector to obtain a weighted vector; using the neural network in the coding layer to perform a linear transformation on the weighted vector to obtain an output vector.

[0104] This application provides a scheme for classifying microservice logs in an information system. By semantically fusing microservice log information with its associated contextual information, and constructing an input sequence and inputting a pre-defined classification model that matches the system type, it achieves a unified semantic classification of heterogeneous microservice logs. This enables intelligent identification and semantic alignment of error logs across technology stacks, thus solving the problem that traditional rule-based or general NLP models struggle to handle the diverse log formats, specialized terminology, and strong contextual dependencies in information systems, leading to low classification accuracy. The pre-defined classification model in this invention includes an encoder structure and a classification structure. The encoder structure captures word-level and context-level semantic associations in the input sequence, while the classification structure adapts the output to the corresponding fault category (such as timeout, connection failure, etc.) based on the system type, ensuring high generalization and high accuracy. It eliminates the need for manual rules or feature engineering, enabling end-to-end, deployable intelligent log analysis.

[0105] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0106] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0107] Example 4

[0108] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the microservice log classification method of the information system provided in Embodiment 1.

[0109] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0110] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a method for classifying microservice logs of an information system.

[0111] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0112] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0113] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0114] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0115] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0116] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0117] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.< / method> < / method> < / port> < / ip>

Claims

1. A method for classifying microservice logs of an information system, characterized in that, include: Collect microservice log information from the target information system and obtain context information associated with the microservice log information; The context information and the microservice log information are processed to generate an input sequence; The system type of the target information system is determined, and the input sequence is processed using a preset classification model corresponding to the system type to obtain a classification result. The preset classification model includes at least an encoder structure and a classification structure. The encoder structure is used to encode the input sequence, and the classification structure is used to classify the received encoded vector.

2. The classification method according to claim 1, characterized in that, The step of obtaining context information associated with the microservice log information includes: Determine the tracking identifier for the microservice log information; Based on the tracing identifier, obtain the call chain, and based on the call chain, obtain the service topology; Determine the timestamp for collecting the microservice log information; The call chain, the service topology, and the timestamp are represented as the context information.

3. The classification method according to claim 1, characterized in that, The context information includes at least: service topology, call chain, and timestamp. The steps of processing the context information and the microservice log information to generate the input sequence include: The microservice log information is cleaned to obtain the cleaned microservice log information. The service topology is transformed to generate a call path string; Feature extraction is performed on the call chain to obtain link features; The input sequence is obtained by using the call path string, the link feature, and the timestamp as prefixes and concatenating them with the cleaned microservice log information.

4. The classification method according to claim 1, characterized in that, Before processing the input sequence using a preset classification model corresponding to the system type to obtain the classification result, the process further includes: The encoder structure is constructed as follows: the encoder structure includes: multiple coding layers, each coding layer including: an attention network and a neural network; Construct the classification structure, wherein the classification structure includes: a fully connected layer; Based on the encoder structure and the classification structure, an initial classification model is constructed.

5. The classification method according to claim 4, characterized in that, After constructing the initial classification model based on the encoder structure and the classification structure, the process further includes: For each system type, collect multiple historical microservice logs corresponding to the system type, as well as historical context information associated with each historical microservice log; Determine the set of fault types corresponding to the system type; Based on the set of fault types, all the historical microservice logs are labeled to obtain the actual fault types corresponding to the historical microservice logs. The historical microservice logs and the historical context information are concatenated to obtain multiple concatenated data entries. The initial classification model is trained using all the concatenated data until the loss value is less than a preset loss threshold, thereby obtaining the preset classification model. The loss value is determined by a loss function based on the actual fault type and the predicted fault type output by the initial classification model.

6. The classification method according to claim 4, characterized in that, The step of processing the input sequence using a preset classification model corresponding to the system type to obtain a classification result includes: The input sequence is encoded to obtain an initial vector; The initial vector is processed by the first coding layer in the encoder structure to obtain an output vector, and the output vector is processed by the next coding layer in the encoder structure until the last coding layer to obtain a semantic vector. The semantic vector is linearly transformed using the fully connected layer in the classification structure to obtain the target vector; The target vector is processed using an activation function to obtain the probability value of each fault type corresponding to the system type; If the maximum probability value is greater than or equal to a preset probability threshold, the fault type corresponding to the maximum probability value is determined as the target fault type, and the classification result is obtained.

7. The classification method according to claim 6, characterized in that, The processing steps of the coding layer include: The attention network in the coding layer is used to perform attention calculation on the received vector to obtain a weighted vector; The weighted vector is linearly transformed using the neural network in the encoding layer to obtain the output vector.

8. A classification device for microservice logs of an information system, characterized in that, include: The acquisition unit is used to collect microservice log information of the target information system and obtain context information associated with the microservice log information; The first processing unit is used to process the context information and the microservice log information to generate an input sequence; The second processing unit is used to determine the system type of the target information system and process the input sequence using a preset classification model corresponding to the system type to obtain a classification result. The preset classification model includes at least an encoder structure and a classification structure. The encoder structure is used to encode the input sequence, and the classification structure is used to classify the received encoded vector.

9. A computer program product, characterized in that, The system includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the microservice log classification method of the information system according to any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the microservice log classification method of the information system according to any one of claims 1 to 7.

Images