A robust root cause analysis method for microservice multi-modal missing scenarios

Abstract

This invention discloses a robust root cause analysis method for multimodal missing scenarios in microservices, comprising: preprocessing multimodal monitoring data to obtain a multivariate time-series dataset; using an asymmetric parallel encoder to extract differential features from the indicator modality, log modality, and tracking modality in the multivariate time-series dataset to obtain independent hidden layer representation vectors for each modality; using a mask-aware gating fusion mechanism and learnable missing placeholders to perform weighted fusion of the hidden layer representation vectors of each modality to obtain instance-level feature vectors; using the instance-level feature vectors as node feature inputs to a graph attention network to obtain enhanced spatiotemporal hidden layer representations of each microservice instance; inputting the spatiotemporal hidden layer representations into a multilayer perceptron for mapping to obtain the reconstruction value of the next time step and calculating the reconstruction error; and constructing a multi-task collaborative diagnostic process based on the reconstruction error to perform anomaly detection, fault classification, and root cause localization.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing intelligent operation and maintenance technology, and in particular relates to a robust root cause analysis method for microservice multimodal missing scenarios. Background Technology

[0002] In recent years, with the rapid development of cloud computing and cloud-native technologies, microservice architecture has become the mainstream software development paradigm. This architecture decouples monolithic applications into multiple fine-grained, loosely coupled functional modules, supporting independent deployment and elastic scaling, significantly improving the maintainability and flexibility of software systems. However, microservice systems typically consist of a large number of service instances, with complex dynamic call dependencies between services. This complex topology leads to high difficulty in system operation and maintenance. When a system failure occurs, how to quickly detect anomalies from massive amounts of monitoring data, accurately determine the type of failure, and precisely locate the root cause instance—the microservice root cause analysis task—faces a significant challenge.

[0003] Current microservice root cause analysis techniques primarily rely on mining and learning from system performance data. Existing technologies often employ offline training based on historical data, using the trained model to guide online diagnosis. However, existing intelligent operation and maintenance methods still face significant technical bottlenecks in real-world production environments. Most existing methods adopt an end-to-end supervised learning paradigm, whose performance is highly dependent on a large amount of training data with fault labels. In real-world production environments, microservice systems are in normal operation most of the time, resulting in extremely scarce fault samples and a severe imbalance between positive and negative samples. This scarcity of samples makes supervised learning models reliant on labels prone to overfitting and struggle to capture unknown fault patterns. Therefore, there is an urgent need to utilize massive amounts of unlabeled normal data for self-supervised learning to reduce reliance on fault labels.

[0004] Furthermore, existing technologies generally lack robust support for scenarios with missing monitoring data modalities. The observability of microservice systems typically relies on the collection of multimodal data such as metrics, logs, and call chains, and this data collection process usually runs independently of business processes. Due to factors such as network fluctuations, collection agent failures, or configuration errors, it is common for data of a particular modality to fail to be collected or to be lost within a specific time period. Although monitoring data may be missing, the microservice system itself may not have failed. However, existing root cause analysis methods typically assume that the input data is complete and multimodal aligned, lacking compensation or adaptation mechanisms for modality missing. Once modality is missing in the input data, the feature extraction capabilities of existing models will suffer a devastating blow, leading to a significant drop in the accuracy of root cause analysis. Currently, there is no mature solution that fully utilizes self-supervised learning mechanisms to address the modality missing problem.

[0005] In summary, how to design a self-supervised learning model that can adaptively fuse remaining modal information and construct a high-quality unified representation of the system under complex constraints such as the lack of fault labels and the potential absence of monitoring modalities, thereby achieving accurate root cause analysis, is a technical challenge that urgently needs to be solved in this field. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a robust root cause analysis method for microservice multimodal missing scenarios, thereby resolving the issues present in the existing technologies.

[0007] To achieve the above objectives, this invention provides a robust root cause analysis method for microservice multimodal missing scenarios, comprising: Preprocessing of multimodal monitoring data yields a multivariate time-series dataset; An asymmetric parallel encoder is used to extract differential features from the index mode, log mode, and tracking mode in the multivariate time series dataset, respectively, to obtain independent hidden layer representation vectors for each mode; A mask-aware gating fusion mechanism and learnable missing placeholders are used to weight and fuse the hidden layer representation vectors of each modality to obtain instance-level feature vectors. The instance-level feature vectors are used as node features to input the graph attention network to obtain the enhanced spatiotemporal hidden layer representation of each microservice instance. The spatiotemporal hidden layer representation is input into a multilayer perceptron for mapping to obtain the reconstruction value at the next time step and calculate the reconstruction error. Based on the reconstruction error, a multi-task collaborative diagnostic process is constructed to perform anomaly detection, fault classification, and root cause localization.

[0008] Optionally, the process of using an asymmetric parallel encoder to extract differential features from the multivariate time-series dataset to obtain modality-independent hidden layer representation vectors includes: A deep convolutional network is used to process the index modality data in the multivariate time series dataset to obtain the index modality hidden layer representation vector; A shallow convolutional network is used to process the log modality data in the multivariate time series dataset to obtain the log modality hidden layer representation vector; A shallow convolutional network is used to process the tracking modality data in the multivariate time series dataset to obtain the tracking modality hidden layer representation vector; Among them, when using deep convolutional networks to process index modal data, based on the continuous performance characteristics of index modal data, high-order temporal dependencies are extracted by stacking multiple convolutional layers to obtain the index modal hidden layer representation vector. When processing log modal data using shallow convolutional networks, based on the discrete and sparse characteristics of the log template frequency vector, log semantic features are extracted by limiting the number of convolutional layers to obtain the log modal hidden layer representation vector. When processing tracking modality data using shallow convolutional networks, based on the discrete and sparse characteristics of the tracking status code frequency vector, tracking semantic features are extracted by limiting the number of convolutional layers to obtain the tracking modality hidden layer representation vector.

[0009] Optionally, during the processing of input data using deep or shallow convolutional networks, parallel small-kernel depthwise convolution operators and large-kernel dilated depthwise convolution operators are used to process the input features respectively to obtain local features and long-range trend features; a concatenation operation is used to merge the local features and the long-range trend features to obtain multi-scale temporal features; point convolution is used to perform linear projection fusion on the multi-scale temporal features to obtain fused temporal features.

[0010] Optionally, point convolution is used to perform linear projection fusion on the multi-scale temporal features to obtain fused temporal features. Then, a channel mixing mechanism is used to process the fused temporal features to obtain enhanced channel features. The process of processing the fused temporal features using a channel mixing mechanism includes: The channel dimension of the input feature is expanded to a multiple of the original dimension by using dimensionality-increasing point convolution to obtain the expanded high-dimensional feature; Grouped convolution is used to perform local interactive processing on the expanded high-dimensional features, and a non-linear activation function is introduced to obtain the interactive features; The interactive features are mapped back to the original dimension using dimensionality-reduced point convolution to obtain the dimensionality-reduced features. The reduced features are added to the input features using residual connections to obtain enhanced channel features.

[0011] Optionally, the fused temporal features are processed using a channel mixing mechanism to obtain enhanced channel features. Then, a point convolution operation with the number of groups equal to the total number of feature channels is applied to the enhanced channel features in the variable dimension to obtain global interactive features across the variable dimension. The global interactive features are added to the enhanced channel features using residual connections to obtain the final hidden layer representation vector.

[0012] Optionally, the process of weighted fusion of the hidden layer representation vectors of each modality using a mask-aware gating fusion mechanism and learnable missing placeholders to obtain instance-level feature vectors includes: A linear projection layer is used to map the hidden layer representation vectors of the indicator modality, the hidden layer representation vectors of the log modality, and the hidden layer representation vectors of the tracking modality, respectively, to obtain indicator projection features, log projection features, and tracking projection features with a unified fusion dimension. Based on the modal mask matrix, the indicator projection features, log projection features, and tracking projection features are subjected to conditional permutation processing to obtain the conditionally permuted indicator features, log features, and tracking features; The corresponding modal identity embeddings are superimposed on the indicator features, log features, and tracking features after the conditional permutation to obtain indicator enhancement features, log enhancement features, and tracking enhancement features carrying identity identifiers; The indicator enhancement features, the log enhancement features, and the tracking enhancement features are input into a multi-head self-attention module for cross-modal context interaction processing to obtain cross-modal interaction features; A linear layer is used to calculate the cross-modal interaction features to obtain the importance score of each modality; The corrected modality scores are obtained by superimposing learnable missing bias terms on the importance scores of missing modalities based on the modality mask matrix. The modified modal scores are normalized using Softmax normalization to obtain the normalized fusion weights for each modality. The cross-modal interaction features and the normalized fusion weights are calculated using a weighted summation method to obtain an instance-level feature vector.

[0013] Optionally, based on the reconstruction error, a multi-task collaborative diagnostic process is constructed, and the process of anomaly detection, fault classification, and root cause localization includes: The reconstructed values ​​and the actual observed values ​​are processed using a mask-corrected error calculation method to obtain a reconstruction error vector; The reconstruction error vector and the spatiotemporal hidden layer representation are merged using a channel-dimensional splicing method to obtain a comprehensive state vector; The system-level deviation score is obtained by aggregating all comprehensive state vectors to summarize the states of all instances in the system. The extreme value distribution in the system-level deviation scoring sequence is modeled using the streaming extreme value theory algorithm, and the shape and scale parameters are obtained online based on the generalized Pareto distribution to calculate the dynamic anomaly threshold. The real-time score is compared with the dynamic anomaly threshold. When the real-time score exceeds the dynamic anomaly threshold, the system is determined to be abnormal, triggering the fault classification and root cause localization process.

[0014] Optionally, after triggering the fault classification and root cause localization process, when performing root cause localization, the comprehensive state vector of a single microservice instance within the anomaly window is used as the instance-level deviation fingerprint; the aggregated result of the comprehensive state vectors of all microservice instances is used as the system-level deviation fingerprint; cosine similarity is used to calculate the similarity score between each instance-level deviation fingerprint and the system-level deviation fingerprint in the vector space; and the microservice instances are sorted in descending order of similarity scores to obtain the root cause node.

[0015] The present invention also provides a computer, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described thereon.

[0016] The present invention also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described thereon.

[0017] Compared with the prior art, the present invention has the following advantages and technical effects: This invention employs an asymmetric parallel encoder to extract differentiated features from three types of heterogeneous data: metrics, logs, and traces. This avoids the information overload problem encountered during feature extraction for continuous metrics and discrete logs. A mask-aware gating fusion mechanism introduces learnable missing placeholders, enabling adaptive compensation for the complete absence of some modalities and significantly improving the model's robustness to data quality fluctuations. Furthermore, it combines graph attention networks to aggregate microservice topology neighborhood information, enhancing the spatiotemporal representation capabilities along fault propagation paths. Finally, a multi-task collaborative diagnostic process is constructed based on reconstruction errors, enabling simultaneous anomaly detection, fault classification, and root cause localization without relying on a large number of fault labels. This invention effectively solves the technical problem of low root cause analysis accuracy in scenarios with missing modalities and scarce labels, enhancing the automated operation and maintenance capabilities of microservice systems. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings: Figure 1 This is an example diagram of a system composed of multiple interdependent microservices according to an embodiment of the present invention; Figure 2 This is a microservice root cause analysis framework diagram according to an embodiment of the present invention. Detailed Implementation

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0021] Example 1 To address the shortcomings of existing technologies in scenarios with missing modalities and scarce labels, this invention proposes a robust self-supervised representation learning and fault diagnosis method for microservices with multimodal missing features. An asymmetric temporal convolutional network is used to differentially encode three types of heterogeneous data: metrics, logs, and traces. A mask-aware gating fusion mechanism is used to introduce learnable missing placeholders, enabling adaptive compensation for incomplete monitoring data. Subsequently, a Graph Attention Network (GAT) is employed to capture the spatiotemporal propagation features along the microservice call chain, generating enhanced spatiotemporal hidden layer representations for each microservice instance. The self-supervised sequence reconstruction error is used as a metric. In cloud-native online scenarios, this method can calculate system-level deviation vectors and instance-level vectors in real time based on monitoring data that may have missing modalities, driving the efficient execution of anomaly detection, fault classification, and root cause localization tasks.

[0022] like Figure 1 As shown, this embodiment provides a robust root cause analysis method for microservice multimodal missing scenarios, including the following steps: 1) Preprocess the multimodal monitoring data to obtain a multivariate time-series dataset, including: defining the preprocessing and alignment of microservice multimodal monitoring data; unifying heterogeneous metric values, log template frequencies, and tracking status code frequencies into a minute-level time-series matrix; employing sliding window and Z-Score normalization; performing zero-value imputation and masking for modal data missing due to collection failures; and constructing a multivariate time-series dataset containing an integrity mask. The specific implementation process includes: 1.1) Definition of microservice system topology and dynamic graph.

[0023] like Figure 1 As shown, this is an application composed of multiple interdependent microservices. This embodiment models the microservice system as a dynamic property graph. .in, Indicating the system A collection of microservice instances; This represents the set of potential call dependencies between services. Despite the system's topology... It is static in the short term, but the nodes Multimodal monitoring data over time Dynamic changes.

[0024] 1.2) Temporal serialization and vectorization of heterogeneous multimodal data.

[0025] For each microservice instance In this embodiment, at the time step Three types of heterogeneous modal data were collected and uniformly mapped into high-dimensional feature vectors. Specifically, for the metric mode (Metric, ), directly collect continuous performance indicators of the system (such as CPU utilization, memory usage, etc.), and record. The indicator feature vector at time t is ,in For the metric dimension; for the log modality (Log, Considering its unstructured text characteristics, this embodiment uses a log parsing algorithm to extract a set of high-frequency log templates. Statistical time steps The frequency of occurrence of various templates within the text stream is used to transform the text stream into a frequency vector. ,in The number of templates to retain; for the trace modality (Trace, Extract latency statistics and HTTP status code counts (such as Status Code 200, 500, etc.) from service calls to construct a tracking feature vector. ,in To track feature dimensions, finally, an instance is obtained through vector concatenation. At any moment The original multimodal feature vector: in This represents a vector concatenation operation, with a total feature dimension. .

[0026] 1.3) Sliding window sampling and data normalization.

[0027] A time-series dataset is constructed using a sliding window mechanism with a fixed step size. The observation window length is defined as... Then the first The time window for each sample is represented as: To eliminate the dimensional differences between different modalities (such as CPU percentage versus log frequency), Z-score normalization is applied to the data within the window. For any feature dimension... Its normalized value The calculation is as follows: in and These are the mean and standard deviation of that dimension on the training set, respectively. To prevent the division by zero of minute quantities.

[0028] 1.4) Mathematical modeling of modal missing and formalization of self-supervised tasks.

[0029] To make the model robust to mode loss, a mode mask matrix is ​​defined. .in Representation of instances of Modality ( () missing.

[0030] Based on this, a masked input tensor is constructed. : in This represents the Hadamard product (element-wise multiplication), where the eigenvalues ​​of a missing mode are forced to zero. .

[0031] This embodiment formalizes the core task of the present invention as a mask self-supervised learning problem. Its goal is to train a parameterized function. Using incomplete observation data within a historical window, predict the next moment. Complete system status: in This is the predicted complete multimodal feature matrix. This is achieved by minimizing the predicted values. Compared with the actual observed value The reconstruction error between them drives the model to learn the normal spatiotemporal evolution law of the system.

[0032] 2) An asymmetric parallel encoder is used to extract differentiated features from the index modality, log modality, and tracking modality in the multivariate time-series dataset, resulting in independent hidden layer representation vectors for each modality. Specifically, an asymmetric self-supervised encoder is constructed to extract multimodal features. For the high-frequency, continuous index modality, a deep convolutional network is used to extract complex fluctuation features, while for the sparse, discrete log and tracking modalities, a lightweight shallow network is used to extract semantic features, resulting in independent hidden layer representation vectors for each modality.

[0033] Furthermore, the process includes: processing the indicator modality data in the multivariate time-series dataset using a deep convolutional network to obtain the indicator modality hidden layer representation vector; processing the log modality data in the multivariate time-series dataset using a shallow convolutional network to obtain the log modality hidden layer representation vector; and processing the tracking modality data in the multivariate time-series dataset using a shallow convolutional network to obtain the tracking modality hidden layer representation vector. Specifically, when processing the indicator modality data using a deep convolutional network, based on the continuous performance characteristics of the indicator modality data, higher-order temporal dependencies are extracted by stacking multiple convolutional layers to obtain the indicator modality hidden layer representation vector. When processing the log modality data using a shallow convolutional network, based on the discrete and sparse characteristics of the log template frequency vector, log semantic features are extracted by limiting the number of convolutional layers to obtain the log modality hidden layer representation vector. When processing the tracking modality data using a shallow convolutional network, based on the discrete and sparse characteristics of the tracking status code frequency vector, tracking semantic features are extracted by limiting the number of convolutional layers to obtain the tracking modality hidden layer representation vector.

[0034] Furthermore, as a specific implementation method of this embodiment, the specific implementation process includes: 2.1) Construct an asymmetric parallel coding architecture that adapts to the characteristics of heterogeneous data.

[0035] To accurately capture early warning signs of failures in microservice systems across different observation dimensions, this invention constructs an asymmetric parallel encoder with three independent channels. Considering that indicator data typically reflects continuous fluctuations in resources such as CPU and memory, and that abnormal patterns (such as gradual increases caused by memory leaks or spikes caused by sudden traffic surges) are often hidden within complex long-term dependencies, this embodiment configures a deep convolutional network to extract high-order temporal features. However, log and tracking data exhibit significant sparsity and discreteness; excessively deep networks can easily lead to overfitting on normal samples, resulting in false alarms. Therefore, a lightweight shallow convolutional network is configured for them. This asymmetric design ensures that the model can simultaneously extract optimal features from both "continuously dense" and "discretely sparse" heterogeneous monitoring signals with limited computational resources. The overall process details are as follows: Figure 2 As shown.

[0036] 2.2) Temporal evolution feature extraction based on multi-scale depthwise separable convolution.

[0037] Microservice failures often exhibit multi-scale temporal characteristics: they include both millisecond-level network jitter and resource exhaustion lasting for several minutes. To capture both types of failure modes simultaneously, this step first performs a temporal mixing operation in the coding unit.

[0038] Specifically, in order to achieve multi-scale receptive fields while ensuring computational efficiency, this invention uses depthwise separable convolution as the basic operator and constructs two parallel convolution branches: For local feature extraction, this invention defines a small kernel depthwise convolution operator. This operator uses a small convolution kernel size and the number of groups equals the number of input channels, meaning that convolution is performed independently on each feature channel without inter-channel information exchange. This branch aims to capture transient changes in the microservice state over a short period of time.

[0039] For long-range trend feature extraction, this invention defines a large-kernel dilated depthwise convolution operator. This operator introduces a dilation rate on top of the convolution kernel, thereby multiplying the receptive field without increasing the number of parameters. This branch aims to capture asymptotic drift in system performance over a longer time span.

[0040] After extracting the local features and long-range trend features respectively, the two are merged using a concatenation operation, and then passed through a point convolution (…). Convolution is used to perform linear projection fusion to obtain the fused temporal features. Let the input features be... The entire multi-scale temporal feature extraction process can be formally represented as: in, This represents a linear projection layer used to fuse multi-scale information. This is an intermediate representation containing complete temporal semantics. This step ensures that the model can extract effective temporal discrimination criteria regardless of whether it faces sudden or gradual failures.

[0041] 2.3) Modeling the correlation between variables based on channel extension.

[0042] After extracting the fused time-series features, it is necessary to further explore the coupling relationships between different monitoring variables (such as CPU utilization, memory, and connection count) within a single microservice instance. To enhance the model's ability to express complex nonlinear relationships, this step employs the following channel fusion mechanism to address this issue.

[0043] Furthermore, the process of processing the fused temporal features using a channel mixing mechanism includes: using dimensionality-increasing point convolution to expand the channel dimension of the input features to a multiple of the original dimension, obtaining expanded high-dimensional features; using group convolution to perform local interactive processing on the expanded high-dimensional features and introducing a non-linear activation function to obtain interactive features; using dimensionality-reducing point convolution to map the interactive features back to the original dimension, obtaining dimensionality-reduced features; and using residual connections to add the dimensionality-reduced features to the input features, obtaining enhanced channel features.

[0044] Furthermore, as a specific implementation method of this embodiment, the specific implementation process includes: The mechanism first uses an up-dimensional point convolution. This involves expanding the feature channel dimension to a multiple of the original dimension and projecting the features into a high-dimensional latent space, resulting in expanded high-dimensional features. Then, grouped convolutions are used in this high-dimensional space. (Group Convolution) performs local interactive processing on the expanded high-dimensional features and introduces a non-linear activation function. This is used to capture the complex combinational logic between variables and obtain the interactive features. Finally, dimensionality-reduced point convolution is used. The interactive features are mapped back to the original dimensions, and overfitting is prevented by using a Dropout layer to obtain dimensionality-reduced features. Residual connections are then used to add the dimensionality-reduced features to the input features to obtain enhanced channel features.

[0045] This process can be formally represented as: Through this process, the model can transform a single indicator value into a high-level semantic feature containing the "joint distribution among indicators," thereby effectively identifying complex hidden dangers where a single indicator may appear normal but the combination logic is abnormal.

[0046] 2.4) Instance mixing across variable dimensions.

[0047] A core characteristic of microservice systems lies in the complex dependencies between different service instances (i.e., variables). To capture this global dependency in a pure convolutional architecture, this step employs a convolutional mechanism based on feature channel grouping to achieve information exchange between variables.

[0048] Furthermore, a channel mixing mechanism is used to process the fused temporal features to obtain enhanced channel features. Then, a point convolution operation with the number of groups equal to the total number of feature channels is applied to the enhanced channel features in the variable dimension to obtain global interactive features across the variable dimension. The global interactive features are added to the enhanced channel features using residual connections to obtain the final hidden layer representation vector.

[0049] Specifically, the model aims to learn the covariance relationships among all microservice instances under the same feature attribute (e.g., examining CPU utilization fluctuations across all instances simultaneously). To this end, this embodiment applies point convolution operations along the variable dimension and introduces channel grouping constraints. The number of groups is set to the total number of feature channels, strictly restricting convolution operations to within each independent feature channel. In this way, the model can perform weighted combinations and nonlinear mappings of the same type of features across all microservice instances without confusing different physical features (e.g., avoiding confusion between CPU and memory), thereby achieving system-wide state information flow.

[0050] This process can be formally represented as: in, The feature tensor output from the previous stage. This means the number of groups equals the feature channel dimension. Point convolution operator, This is a non-linear activation function. The operator iterates through each feature channel, performing fully connected feature fusion on the corresponding microservice instance data.

[0051] Finally, residual connections are introduced to transform the original input features Features after variable mixing Add them together to output the final hidden layer representation vector.

[0052] 3) A mask-aware gating fusion mechanism and learnable missing placeholders are used to weightedly fuse the hidden layer representation vectors of each modality to obtain instance-level feature vectors. These instance-level feature vectors are then used as node features input to a graph attention network (GAT) to obtain the enhanced spatiotemporal hidden layer representations of each microservice instance. Specifically, instance-level spatiotemporal hidden layer representations are generated through mask-aware gating fusion and graph topology enhancement. A multi-head attention mechanism combined with learnable missing placeholders is used to weightedly fuse multimodal features, generating instance-level feature vectors robust to modality missingness. These vectors are then used as node features input to a GAT to aggregate microservice topology neighborhood information, resulting in the enhanced spatiotemporal hidden layer representations of each microservice instance. Finally, a multilayer perceptron is used to predict the reconstructed value for the next time step, and the model is trained using a masked mean squared error (Masked MSE) loss function. Furthermore, the process of weighted fusion of the hidden layer representation vectors of each modality using a mask-aware gating fusion mechanism and learnable missing placeholders to obtain instance-level feature vectors includes: mapping the hidden layer representation vectors of the indicator modality, log modality, and tracking modality respectively using a linear projection layer to obtain indicator projection features, log projection features, and tracking projection features with a unified fusion dimension; performing conditional permutation on the indicator projection features, log projection features, and tracking projection features based on the modality mask matrix to obtain conditionally permuted indicator features, log features, and tracking features; and superimposing the corresponding modality identity embeddings on the conditionally permuted indicator features, log features, and tracking features to obtain... The algorithm incorporates three enhanced features: an indicator feature carrying an identity identifier, a log feature, and a tracking feature. These features are then input into a multi-head self-attention module for cross-modal context interaction processing to obtain cross-modal interaction features. A linear layer is used to calculate the importance score of each modality. Based on the modality mask matrix, a learnable missing bias term is superimposed on the importance score of the missing modality to obtain the corrected modality score. Softmax normalization is used to normalize the corrected modality score, resulting in a normalized fusion weight for each modality. Finally, a weighted summation method is used to calculate the cross-modal interaction features and the normalized fusion weight to obtain an instance-level feature vector.

[0053] Furthermore, as a specific implementation method of this embodiment, the specific implementation process includes: 3.1) Unified projection and missing filling of multimodal feature space.

[0054] After step two, we obtain the hidden layer representation vectors for three modalities: metrics, logs, and tracking. However, their feature dimensions may not be consistent, and some modal data may be missing at the current moment. To achieve effective fusion of heterogeneous features, this step first maps the features of each modality to a unified fusion dimension through a linear projection layer. Simultaneously, to handle the problem of missing modalities, a set of learnable missing placeholder vectors is introduced. Based on the modality mask matrix generated in step one, the projected features are conditionally permuted: if a modality exists, its true projected features are retained; if a modality is missing, it is replaced with the corresponding missing placeholder vector. Let... The three modal inputs of a certain instance at time t are The process is formally represented as: in, These are the projection parameters for each mode. These are learnable placeholders for the corresponding modalities. This mechanism ensures that even if some modalities are completely lost, the subsequent network can still receive a complete input tensor containing the "missing state priors".

[0055] 3.2) Gating fusion based on attention mechanism and missing bias.

[0056] To uncover semantic associations between different modalities (e.g., high CPU utilization is often accompanied by specific log patterns), this step first superimposes a learnable modality identity embedding onto the feature vectors of the three modalities and inputs it into a multi-head self-attention module to achieve cross-modal contextual interaction. Subsequently, a gated scoring mechanism with a missing bias is designed to generate fusion weights. This mechanism uses a linear layer to calculate the importance score of each modality and, based on the mask state, explicitly superimposes a learnable missing bias term onto the score of the missing modality. This allows the model to automatically learn to adjust the confidence level of placeholder information when data is missing.

[0057] Calculate the normalized weights for each mode. and final fusion characterization The formula is as follows: in, Features after self-attention interaction This is a missing bias. The process generates a unified instance-level representation that is robust to missing values.

[0058] 3.3) Spatiotemporal topology enhancement based on graph attention networks.

[0059] Failures in microservice systems often propagate, and the state of a single instance depends not only on itself but also on the services it depends on. Therefore, this step constructs a system topology graph with microservice instances as nodes and call relationships as edges. and the above-mentioned fusion characterization As the initial features of the nodes, the input GAT is used for spatiotemporal feature aggregation.

[0060] For any node in the graph The GAT layer first calculates its relationship with its neighboring nodes. Attention coefficient between This coefficient reflects the degree of influence of neighboring nodes on the state of the central node (i.e., the strength of fault propagation). Subsequently, normalized attention weights are obtained using the LeakyReLU activation function and Softmax normalization. : in For node features, Gather for the neighbors, Indicates splicing.

[0061] 3.4) Neighborhood feature aggregation and multi-layer stacking.

[0062] Based on the calculated attention weights, the node features within the neighborhood are weighted and aggregated, and a non-linear activation function (ELU) is applied to update the nodes. The state representation is described. To capture higher-order topological dependencies, this embodiment stacks multiple graph attention layers, and each layer employs a multi-head attention mechanism for stable training. At the output of each layer, the output features of multiple attention heads are averaged and pooled.

[0063] Finally, after The layer GAT processing outputs an enhanced spatiotemporal hidden layer representation vector. : in The number of attention heads is used. This representation not only contains the multimodal temporal features of the instance itself, but also integrates the operational status of its upstream and downstream dependent services, providing a global view for accurately identifying the root cause of the failure. Finally, the hidden layer representation is mapped back to the original feature space through a multilayer perceptron to obtain the predicted value for the next time step, and the model is trained by combining it with the mask mean square error loss function.

[0064] 4) Construct a multi-task collaborative diagnostic process based on reconstruction errors to perform anomaly detection, fault classification, and root cause localization. Specifically, this involves building a multi-task collaborative diagnostic process based on reconstruction deviations. For anomaly detection, the reconstruction errors of all microservice instances are aggregated to construct a system-level deviation score. Streaming Peaks-over-Threshold (SPOT) theory is used to adaptively learn dynamic thresholds to determine system anomalies. For fault classification, a multi-dimensional statistical tensor is constructed by aggregating the mean, maximum, and standard deviation of the reconstruction errors of each instance within the anomaly window. EXtremeGradient Boosting (XGBoost) is used to identify fault types. For root cause localization, a comprehensive state vector containing reconstruction error vectors and spatiotemporal hidden layer representation vectors is constructed. The system-level deviation is defined as the aggregated vector of all instance representations. The root cause node is located by calculating the cosine similarity between the fingerprints of each instance-level deviation and the system-level deviation vector.

[0065] Furthermore, a multi-task collaborative diagnostic process is constructed based on the reconstruction error. The process of anomaly detection, fault classification, and root cause localization includes: processing the reconstructed value and the true observation value using a mask-corrected error calculation method to obtain a reconstruction error vector; merging the reconstruction error vector and the spatiotemporal hidden layer representation using a channel dimension splicing method to obtain a comprehensive state vector; summarizing the states of all instances in the system by aggregating all comprehensive state vectors to obtain a system-level deviation score; modeling the extreme value distribution in the system-level deviation score sequence using a streaming extreme value theory algorithm, and obtaining shape and scale parameters through online updates based on the generalized Pareto distribution to calculate the dynamic anomaly threshold; comparing the real-time score with the dynamic anomaly threshold, and determining a system anomaly when the real-time score exceeds the dynamic anomaly threshold, triggering the fault classification and root cause localization process.

[0066] Furthermore, as a specific implementation method of this embodiment, the specific implementation process includes: 4.1) Construction of a multidimensional state measurement system based on reconstruction bias.

[0067] After completing the training and inference of the self-supervised model, for any time step... The model outputs the predicted refactoring value for each microservice instance. and spatiotemporal hidden layer representation enhanced by graph encoder To quantify the current deviation of the system, the reconstruction error vector is first calculated. Considering the possibility of missing modes, a mask-corrected error calculation method is adopted, that is, only the dimension error of modes with existing features (Mask=1) is calculated. The reconstruction error vector is defined as follows: Based on this, a comprehensive state vector is constructed for subsequent diagnosis. This vector is composed of the reconstruction error vector. spatiotemporal hidden layer representation It is pieced together along the channel dimension: This design takes into account both explicit numerical deviations and implicit state patterns, providing comprehensive information support for multi-task diagnostics.

[0068] 4.2) Adaptive anomaly detection based on flow cytometry extremum theory.

[0069] The anomaly detection task aims to determine whether the microservice system as a whole is in an unhealthy state at any given moment. First, the comprehensive state vectors of all microservice instances within the system are aggregated (e.g., summed or averaged) to obtain a system-level deviation score reflecting the overall state of the system. Because the load of microservice systems exhibits significant volatility and seasonality, fixed thresholds are difficult to adapt to. Therefore, this embodiment employs the SPOT algorithm for adaptive learning of dynamic thresholds. This algorithm models the distribution of extreme values ​​in the system's rating sequence, typically assuming it follows a Generalized Pareto Distribution (GPD). By updating the parameters of the GPD (shape and scale parameters) online, the dynamic anomaly threshold at a given confidence level is calculated in real time. When real-time rating When an anomaly is detected, the system is determined to have malfunctioned, triggering subsequent classification and location processes.

[0070] 4.3) Fault type classification based on multidimensional statistical pooling.

[0071] Once an anomaly is detected, the system enters the fault classification phase. To accurately identify the specific type of fault (such as CPU overload, memory leak, or network latency), this invention utilizes an anomaly time window... Robust statistical features are extracted within the microservice instance. Instead of using only values ​​at a single moment, multi-dimensional statistical pooling is performed on the reconstructed error sequence for each microservice instance. Specifically, the mean of the error sequence within the window is calculated to represent the average deviation, the maximum value to capture instantaneous spikes, and the standard deviation to characterize fluctuation instability. These three types of statistical features are concatenated to construct a high-dimensional fault feature tensor. The tensor is then fed into an XGBoost classifier. This classifier leverages the advantages of ensemble learning to automatically uncover the nonlinear mapping between statistical features and fault categories, thereby outputting a prediction of the fault type.

[0072] 4.4) Root cause localization based on fingerprint similarity ranking.

[0073] For root cause localization, the goal is to pinpoint the source node causing a failure from numerous microservice instances. This embodiment proposes a cosine similarity-based ranking algorithm based on the assumption that "the behavior pattern of the root cause node is highly similar to the overall deviation pattern of the system." First, an instance-level deviation fingerprint is defined as the comprehensive state vector of a single microservice instance within an anomaly window. Define the system-level deviation fingerprint as the aggregation result of the comprehensive state vectors of all instances. Then, the cosine similarity between each instance fingerprint and the system fingerprint in the vector space is calculated: Finally, all microservice instances are sorted in descending order based on similarity scores. Instances ranked higher indicate that their state changes have dominated the overall system deviation, and are therefore identified as potential root cause nodes. This method does not require pre-labeling of root causes and can effectively achieve fault attribution in heterogeneous microservice topologies in an unsupervised manner.

[0074] This invention provides a robust root cause analysis method for multimodal loss scenarios in microservices. This method employs asymmetric coding design to adapt continuous metrics and discrete log / tracing signals to networks of different depths, avoiding information overload in heterogeneous data feature extraction. Furthermore, it explicitly compensates for missing modalities and suppresses their weights using a mask-aware gating fusion mechanism, significantly improving the model's robustness even when some modalities are completely lost. Simultaneously, it replaces traditional supervised classification with a self-supervised reconstruction paradigm, accurately characterizing fault patterns through joint analysis of reconstruction errors and hidden state representations without relying on massive amounts of fault labels. Therefore, it significantly improves diagnostic accuracy and generalization ability in real-world operational environments when facing data quality fluctuations, enhancing the automated operation and maintenance assurance of microservice systems.

[0075] The present invention also provides a computer, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described thereon.

[0076] The present invention also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described thereon.

[0077] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A robust root cause analysis method for microservice multi-modal missing scenarios, characterized in that, Includes the following steps: Preprocessing of multimodal monitoring data yields a multivariate time-series dataset; An asymmetric parallel encoder is used to extract differential features from the index mode, log mode, and tracking mode in the multivariate time series dataset, respectively, to obtain independent hidden layer representation vectors for each mode; A mask-aware gating fusion mechanism and learnable missing placeholders are used to weight and fuse the hidden layer representation vectors of each modality to obtain instance-level feature vectors. The instance-level feature vectors are used as node features to input the graph attention network to obtain the enhanced spatiotemporal hidden layer representation of each microservice instance. The spatiotemporal hidden layer representation is input into a multilayer perceptron for mapping to obtain the reconstruction value at the next time step and calculate the reconstruction error. Based on the reconstruction error, a multi-task collaborative diagnostic process is constructed to perform anomaly detection, fault classification, and root cause localization.

2. The method of claim 1, wherein, The process of extracting differential features from the multivariate time-series dataset using an asymmetric parallel encoder to obtain modality-independent hidden layer representation vectors includes: A deep convolutional network is used to process the index modality data in the multivariate time series dataset to obtain the index modality hidden layer representation vector; A shallow convolutional network is used to process the log modality data in the multivariate time series dataset to obtain the log modality hidden layer representation vector; A shallow convolutional network is used to process the tracking modality data in the multivariate time series dataset to obtain the tracking modality hidden layer representation vector; Among them, when using deep convolutional networks to process index modal data, based on the continuous performance characteristics of index modal data, high-order temporal dependencies are extracted by stacking multiple convolutional layers to obtain the index modal hidden layer representation vector. When processing log modal data using shallow convolutional networks, based on the discrete and sparse characteristics of the log template frequency vector, log semantic features are extracted by limiting the number of convolutional layers to obtain the log modal hidden layer representation vector. When processing tracking modality data using shallow convolutional networks, based on the discrete and sparse characteristics of the tracking status code frequency vector, tracking semantic features are extracted by limiting the number of convolutional layers to obtain the tracking modality hidden layer representation vector.

3. The method of claim 2, wherein, In the process of processing input data using deep or shallow convolutional networks, parallel small-kernel depthwise convolution operators and large-kernel dilated depthwise convolution operators are used to process the input features respectively to obtain local features and long-range trend features. The local features and the long-range trend features are merged by a splicing operation to obtain multi-scale temporal features; the multi-scale temporal features are then linearly projected and fused by point convolution to obtain fused temporal features.

4. The method of claim 3, wherein, The multi-scale temporal features are linearly projected and fused using point convolution to obtain fused temporal features. Then, a channel blending mechanism is used to process the fused temporal features to obtain enhanced channel features. The process of processing the fused temporal features using a channel mixing mechanism includes: The channel dimension of the input feature is expanded to a multiple of the original dimension by using dimensionality-increasing point convolution to obtain the expanded high-dimensional feature; Grouped convolution is used to perform local interactive processing on the expanded high-dimensional features, and a non-linear activation function is introduced to obtain the interactive features; The interactive features are mapped back to the original dimension using dimensionality-reduced point convolution to obtain the dimensionality-reduced features. The reduced features are added to the input features using residual connections to obtain enhanced channel features.

5. The method of claim 4, wherein, The fused temporal features are processed using a channel mixing mechanism to obtain enhanced channel features. Then, point convolution operations with the number of groups equal to the total number of feature channels are applied to the enhanced channel features in the variable dimension to obtain global interactive features across the variable dimension. The global interactive features are added to the enhanced channel features using residual connections to obtain the final hidden layer representation vector.

6. The method of claim 1, wherein, The process of weighted fusion of hidden layer representation vectors from various modalities using a mask-aware gating fusion mechanism and learnable missing placeholders to obtain instance-level feature vectors includes: A linear projection layer is used to map the hidden layer representation vectors of the indicator modality, the hidden layer representation vectors of the log modality, and the hidden layer representation vectors of the tracking modality, respectively, to obtain indicator projection features, log projection features, and tracking projection features with a unified fusion dimension. Based on the modal mask matrix, the indicator projection features, log projection features, and tracking projection features are subjected to conditional permutation processing to obtain the conditionally permuted indicator features, log features, and tracking features; The corresponding modal identity embeddings are superimposed on the indicator features, log features, and tracking features after the conditional permutation to obtain indicator enhancement features, log enhancement features, and tracking enhancement features carrying identity identifiers; The indicator enhancement features, the log enhancement features, and the tracking enhancement features are input into a multi-head self-attention module for cross-modal context interaction processing to obtain cross-modal interaction features; A linear layer is used to calculate the cross-modal interaction features to obtain the importance score of each modality; The corrected modality scores are obtained by superimposing learnable missing bias terms on the importance scores of missing modalities based on the modality mask matrix. The modified modal scores are normalized using Softmax normalization to obtain the normalized fusion weights for each modality. The cross-modal interaction features and the normalized fusion weights are calculated using a weighted summation method to obtain an instance-level feature vector.

7. The method of claim 1, wherein, Based on the reconstruction error, a multi-task collaborative diagnostic process is constructed, and the process of anomaly detection, fault classification, and root cause localization includes: The reconstructed values ​​and the actual observed values ​​are processed using a mask-corrected error calculation method to obtain a reconstruction error vector; The reconstruction error vector and the spatiotemporal hidden layer representation are merged using a channel-dimensional splicing method to obtain a comprehensive state vector; The system-level deviation score is obtained by aggregating all comprehensive state vectors to summarize the states of all instances in the system. The extreme value distribution in the system-level deviation scoring sequence is modeled using the streaming extreme value theory algorithm, and the shape and scale parameters are obtained online based on the generalized Pareto distribution to calculate the dynamic anomaly threshold. The real-time score is compared with the dynamic anomaly threshold. When the real-time score exceeds the dynamic anomaly threshold, the system is determined to be abnormal, triggering the fault classification and root cause localization process.

8. The method of claim 7, wherein, After triggering the fault classification and root cause localization process, when performing root cause localization, the comprehensive state vector of a single microservice instance within the anomaly window is used as the instance-level deviation fingerprint; the aggregated result of the comprehensive state vectors of all microservice instances is used as the system-level deviation fingerprint; and cosine similarity is used to calculate the similarity score between each instance-level deviation fingerprint and the system-level deviation fingerprint in the vector space. Microservice instances are sorted in descending order of similarity score to obtain root cause nodes.

9. A computer comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in claim 1.

10. A storage medium having stored thereon a computer program, characterized in that When the program is executed by the processor, it implements the method as described in claim 1.

Images