A deep learning-based distributed system anomaly monitoring method

Abstract

The application discloses a kind of distributed system abnormal monitoring methods based on deep learning, it is related to deep learning technical field, comprising: step one, collection running index data and call chain log data, generate node runtime sequence data;Step two, generate state coding sequence;Step three, generate abnormal evolution gene chain;Step four, build cross-node abnormal evolution chromosome network;Step five, to cross-node abnormal evolution chromosome network is encoded, generates abnormal evolution chromosome embedding vector;Step six, abnormal evolution chromosome embedding vector is input into improved TranAD model, executes chromosome split coding, chromosome recombination deduction and chromosome evolution matching processing, generates abnormal score vector;Step seven, generate abnormal score distribution;Step eight, execute abnormal propagation path analysis, generate abnormal propagation path.The application realizes the intelligent monitoring and propagation path identification of distributed system exception.

Description

Technical Field

[0001] This invention relates to the field of deep learning and intelligent operation and maintenance technology for distributed systems, and in particular to a method for anomaly monitoring of distributed systems based on deep learning. Background Technology

[0002] With the widespread application of distributed systems in cloud computing, microservices, and containerized platforms, real-time monitoring of system operation status and anomaly identification are directly related to the stability of the platform and the availability of services. Existing technologies primarily rely on single-node metric monitoring, log analysis, or simple time-series anomaly detection models for fault discovery. However, these technologies generally suffer from the following problems in real-world distributed systems: Traditional node monitoring methods can only acquire single operational metrics such as CPU, memory, disk, and network, making it difficult to fully characterize cross-node service calls and anomaly propagation relationships, resulting in insufficient ability to perceive complex anomaly patterns; Single-sequence anomaly detection methods cannot effectively capture the propagation path and state evolution patterns of inter-service call chains, often leading to missed detections or delayed identification when anomalies propagate across nodes or exhibit multi-stage evolution; Existing methods mostly rely on static thresholds or simple aggregation statistics to process metrics, lacking the ability to dynamically model state evolution characteristics and cross-node relationships, and failing to generate globally structured data that can be used for anomaly propagation analysis; Furthermore, the application of existing deep learning anomaly detection models in distributed systems is still in its early stages, with most only processing single-node time series, failing to fully utilize cross-node anomaly evolution information, and not introducing recombination and evolution mechanisms based on structured gene chains, making it difficult to support the identification and propagation path analysis of complex anomaly patterns.

[0003] Therefore, how to provide a deep learning-based method for anomaly monitoring in distributed systems is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a deep learning-based method for monitoring anomalies in distributed systems. This invention constructs an anomaly evolution gene chain and a cross-node anomaly evolution chromosome network, and combines graph embedding with the chromosome splitting encoding, recombination inference, and evolutionary matching mechanism of the improved TranAD model to generate node anomaly score vectors and map service node anomalies. Based on the anomaly score distribution analysis, the cross-node propagation path is analyzed, effectively capturing state evolution characteristics and anomaly propagation information, and achieving structural sensitivity, multi-dimensional fusion, and intelligent identification of anomalies in distributed systems.

[0005] A deep learning-based method for detecting anomalies in a distributed system according to an embodiment of the present invention includes the following steps: Step 1: Collect operational metrics data and call chain log data from each service node of the distributed system to generate node runtime sequence data; Step 2: Perform state encoding processing on the node runtime sequence data to generate a state encoding sequence corresponding to each service node; Step 3: Extract the adjacent state transition relationships in the state coding sequence, convert each state transition relationship into a gene fragment, and arrange the gene fragments in chronological order to generate the abnormal evolution gene chain corresponding to each service node; Step 4: Based on the abnormal evolution gene chain and service call relationship corresponding to each service node, perform chromosome combination and chromosome recombination to construct a cross-node abnormal evolution chromosome network; Step 5: Encode the cross-node abnormal evolution chromosome network input graph into the network, extract chromosome recombination structural features, and generate abnormal evolution chromosome embedding vectors; Step 6: Input the embedded vector of the abnormally evolved chromosome into the improved TranAD model, complete the abnormal evolution modeling based on the chromosome splitting coding module, chromosome recombination inference module and chromosome evolution matching module, and output the abnormality score vector; Step 7: Map the abnormal score vector to nodes to generate the abnormal score distribution corresponding to each service node; Step 8: Based on the abnormal score distribution and the cross-node abnormal evolution chromosome network, perform abnormal propagation path analysis to generate abnormal propagation paths.

[0006] Optionally, step one specifically includes: Collect operational metrics data generated by each service node of the distributed system within a continuous time segment. The operational metrics data include processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts. Collect call chain log data between each service node, and parse the call chain log data into call records. The call records include the call initiating node identifier, the call receiving node identifier, the call start time, the call end time, the call status, and the call duration. The operation index data and call records are sorted by timestamp, the time difference between adjacent sampling times is calculated, and the time difference is sorted by numerical value and the time difference corresponding to the median position is selected as the adaptive sampling interval. The running indicator data is sliced ​​into time segments according to the adaptive sampling interval, and the call records falling into the same time segment are assigned to the corresponding time segments to form node indicator segments and node call segments. The node indicator fragments and node call fragments are concatenated according to the service node identifier, time segment order, running indicator name, and call record field to generate node runtime sequence data.

[0007] Optionally, step two specifically involves: The runtime sequence data of the nodes are divided according to the service node identifier to form a set of time-series indicators corresponding to each service node. For each service node, the changes in processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts between adjacent time segments are calculated to form an indicator change vector. The cumulative value, fluctuation value, direction of change and duration of change of each indicator are statistically analyzed in chronological order for multiple consecutive time segments to form a state representation vector. The similarity of the state representation vectors corresponding to each service node is calculated, and the states are classified according to the similarity calculation results to generate state labels. Arrange the status identifiers corresponding to each time segment in chronological order to form a status code sequence for each service node.

[0008] Optionally, step three specifically includes: Read the status code sequence corresponding to each service node in chronological order and extract the state transition relationship between adjacent status identifiers; For each state transition relationship, record the starting state identifier, the target state identifier, the state duration, and the state transition position to form a state transition record; Construct a state transition feature group based on the starting state identifier, target state identifier, state duration, and state transition position in the state transition record; The state transition feature group is combined and encoded to form a gene description unit by combining the initial state identifier, the target state identifier, the state duration, and the state switching position. A corresponding gene identifier is generated based on the gene description unit to form a gene fragment. Arrange gene fragments in chronological order, record the transfer order between adjacent gene fragments, establish the sequential connection relationship between adjacent gene fragments, and form a gene fragment sequence. By connecting the gene fragments according to their sequence order, an abnormal evolution gene chain corresponding to each service node is generated.

[0009] Optionally, step four specifically involves: Read the abnormal evolution gene chain and service call relationship corresponding to each service node, and establish gene chain association relationship according to the call initiating node and the call receiving node; For each service call relationship, extract the abnormal evolution gene chain corresponding to the call initiating node and the abnormal evolution gene chain corresponding to the call receiving node, and align them according to the call start time and call end time to form an associated gene chain group; In the associated gene chain group, identify gene segments with overlapping time intervals and gene segments with call-and-transfer relationships, and establish cross-node gene association records; Based on cross-node gene association records, associated gene fragments in different abnormal evolution gene chains are combined, and the order of the associated gene fragments in the original abnormal evolution gene chain is preserved to form candidate chromosomes; For the associated gene segments in the candidate chromosomes, the gene connection relationship is re-established according to the cross-node gene association record, and chromosome recombination is performed on the candidate chromosomes to form cross-node abnormal evolution chromosomes; The number of shared gene segments, the number of gene connections, and the number of cross-node gene association records among chromosomes with anomalous evolution across nodes were counted to establish the connection relationships between chromosomes. By treating each cross-node anomalously evolved chromosome as a chromosome node and the connections between chromosomes as connecting edges, a cross-node anomalously evolved chromosome network is constructed.

[0010] Optionally, step five specifically includes: The cross-node anomalous evolution chromosome network is input into the graph embedding network, and multi-layer node embedding calculation is performed according to the topology of chromosome nodes and connecting edges to generate an initial embedding vector for each chromosome node. During the node embedding computation, the node embedding vector is weighted by combining the gene segment arrangement order in the chromosome, the number of gene connection relationships, and cross-node gene association information to form a structure-enhanced embedding. Information aggregation processing is performed on the structural enhancement embeddings of all chromosome nodes to statistically analyze the distribution of node neighborhood features, the combination patterns of neighborhood gene fragments, and the propagation relationships between nodes, thereby generating a cross-node global feature representation. The structure-enhanced embedding and global feature representation are fused and encoded to generate the aberrant evolution chromosome embedding vector corresponding to each cross-node aberrant evolution chromosome.

[0011] Optionally, step six specifically includes: The embedding vector of the aberrantly evolved chromosome is input into the improved TranAD model; The improved TranAD model includes a sequentially connected chromosome splitting coding module, a chromosome recombination deduction module, and a chromosome evolution matching module; The chromosome splitting coding module uses cross-node associated gene fragments and gene connection breakpoints as the splitting positions to perform link splitting on the chromosome structure corresponding to the abnormally evolved chromosome embedding vector, forming multiple chromosome sub-chain representations. The number of gene segments, gene connection span, and number of cross-node associations in each chromosome subchain are counted to form the corresponding subchain structure description sequence. Read the structural description sequences of each sub-chain according to the gene connection order, and establish the evolutionary connection relationship between different chromosome sub-chains to form a set of chromosome evolution paths; The chromosome recombination deduction module reads the set of chromosome evolution paths; Extract common gene fragment sequences between any two chromosome evolutionary paths, and establish path intersection relationships using these common gene fragment sequences as path intersection points; Preserve the gene connection order before the path intersection point and replace the daughter chain fragments after the path intersection point to form multiple candidate chromosome structures; The changes in gene connection order, cross-node migration, and chromosome length were statistically analyzed in each candidate chromosome structure. Multiple candidate chromosome structures are sorted based on changes in gene connection order, changes in cross-node migration, and changes in chromosome length to form a set of candidate chromosome structures; The chromosome evolution matching module reads the candidate chromosome structure set and the actual chromosome structure; Gene connection sequences were extracted from the candidate chromosome structure set and the actual chromosome structure, respectively. Calculate the number of differences in gene connection positions, cross-node associations, chromosome paths, and chromosome lengths between candidate chromosome structures and actual chromosome structures. Evolutionary matching results are constructed based on the number of differences in gene connection locations, the number of differences in cross-node associations, the number of differences in chromosome paths, and the number of differences in chromosome length. An anomaly score vector is generated based on the evolutionary matching results.

[0012] Optionally, the path intersection relationship specifically refers to: Read the gene fragment sequences corresponding to any two chromosome evolutionary pathways; Compare the gene identifiers in the two gene fragment sequences and extract the gene fragments corresponding to the same gene identifiers as common gene fragments. The common gene segments are arranged in order of their position in the two chromosome evolutionary pathways to form a common gene segment sequence; For each common gene segment, record the position number of the common gene segment in the first chromosome evolutionary path and the position number in the second chromosome evolutionary path; Calculate the absolute value of the difference between the two location numbers to form the path intersection offset; The common gene fragment, two location numbers, and path intersection offset are combined to form a path intersection unit; Connect the intersection units of each pathway according to the order of arrangement in the common gene fragment sequence to form a pathway intersection relationship.

[0013] Optionally, step seven specifically includes: Read the anomaly score vector and the cross-node anomalous evolution chromosome network; Extract the chromosome identifiers corresponding to each scoring element in the abnormal scoring vector, and establish a mapping relationship between the scoring elements and the cross-node abnormal evolution chromosomes; Read the set of gene fragment numbers and the set of service node identifiers corresponding to each cross-node abnormal evolution chromosome; Based on the mapping relationship between the scoring elements and the cross-node aberrant evolution chromosomes, each scoring element is assigned to the corresponding cross-node aberrant evolution chromosome; For each service node, count the scoring elements corresponding to all cross-node anomalous evolution chromosomes containing the service node identifier; The corresponding scoring elements are accumulated and calculated according to the service node identifier, and then normalized according to the number of corresponding scoring elements to form the service node abnormal score value. Read the service node anomaly score values ​​corresponding to the same service node in chronological order to form a service node anomaly score sequence. The abnormal score values ​​of service nodes at each time location are statistically analyzed, and an abnormal score distribution is constructed based on the abnormal score sequence of all service nodes to generate the abnormal score distribution corresponding to each service node.

[0014] Optionally, step eight specifically includes: Read the abnormal score distribution and the cross-node abnormal evolution chromosome network; Extract chromosome nodes, chromosome connection relationships, and corresponding service node identifiers from cross-node anomalous evolution chromosome networks; Establish a node correspondence between the abnormal score distribution and the cross-node abnormal evolution chromosome network based on the service node identifier; For each chromosome node, the changes in the abnormal score value of the corresponding service node at continuous time positions are statistically analyzed to form a node abnormal evolution sequence; Read the abnormal evolution sequence of adjacent chromosome nodes according to the chromosome connection relationship; Calculate the number of times the abnormal score change direction is consistent and the time interval of abnormal score change between the abnormal evolution sequences of adjacent nodes to form a node propagation association record; Based on the number of times the abnormal score change direction is consistent and the time interval of abnormal score change, the propagation connection relationship between chromosome nodes is established to form a set of candidate propagation paths; Connect the corresponding chromosome nodes according to the propagation connection order in the candidate propagation path set to form multiple candidate abnormal propagation paths; Count the number of nodes, the number of propagation levels, the number of propagation connections, and the number of node propagation-related records in each candidate anomaly propagation path; Multiple candidate abnormal propagation paths are sorted based on the number of nodes, the number of propagation levels, the number of propagation connections, and the number of propagation-related records of each node to determine the abnormal propagation path.

[0015] The beneficial effects of this invention are: This invention constructs node runtime sequence data by collecting operational metrics and call chain log data from each service node of a distributed system. It then transforms the state encoding sequence into anomaly evolution gene chains. Combining a collaborative design of cross-node anomaly evolution chromosome networks and graph embedding networks, it addresses the challenge of single-node monitoring's inability to characterize cross-node anomaly propagation and state evolution patterns. A proposed anomaly scoring generation strategy based on chromosome splitting encoding, path intersection recombination, and evolutionary matching significantly improves the ability to capture anomaly propagation paths and state transition features. Furthermore, in the graph embedding stage, a structure-enhanced node embedding and global feature aggregation mechanism is introduced. This is achieved by weighting the gene fragment arrangement order, the number of gene connections, and cross-node association information to improve... By extracting local and global anomaly features, high-fidelity encoding of cross-node anomalous evolution chromosomes is achieved. An improved TranAD model is introduced in the anomaly score generation stage, employing a chromosome splitting encoding module, a chromosome recombination inference module, and a chromosome evolution matching module to perform evolutionary matching between candidate chromosome structures and actual chromosome structures, forming node-level anomaly score vectors. These vectors are then mapped to each service node to generate anomaly score distributions, effectively capturing node anomalies and cross-node propagation information. Finally, based on the anomaly score distribution and the cross-node anomalous evolution chromosome network, anomaly propagation path analysis is performed, outputting the anomaly propagation paths of each service node. This achieves structural sensitivity, multi-dimensional fusion, and intelligent identification of anomalies in distributed systems. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the overall process of a distributed system anomaly monitoring method based on deep learning proposed in this invention; Figure 2 This is an overall structural diagram of the improved TranAD model in the deep learning-based distributed system anomaly monitoring method proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-2 A deep learning-based method for anomaly detection in distributed systems includes the following steps: Step 1: Collect operational metrics data and call chain log data from each service node of the distributed system to generate node runtime sequence data; Step 2: Perform state encoding processing on the node runtime sequence data to generate a state encoding sequence corresponding to each service node; Step 3: Extract the adjacent state transition relationships in the state coding sequence, convert each state transition relationship into gene fragments, and arrange the gene fragments in chronological order to generate the abnormal evolution gene chain corresponding to each service node; Step 4: Based on the abnormal evolution gene chain and service call relationship corresponding to each service node, perform chromosome combination and chromosome recombination to construct a cross-node abnormal evolution chromosome network; Step 5: Embed the cross-node anomalous evolution chromosome network input graph into the network for encoding, extract chromosome recombination structural features, and generate anomalous evolution chromosome embedding vectors; Step 6: Input the abnormal evolution chromosome embedding vector into the improved TranAD model, complete the abnormal evolution modeling based on the chromosome splitting coding module, chromosome recombination inference module and chromosome evolution matching module, and output the abnormality score vector; Step 7: Map the anomaly score vector to nodes to generate the anomaly score distribution for each service node; Step 8: Analyze the abnormal propagation path based on the abnormal score distribution and the cross-node abnormal evolution chromosome network, and generate the abnormal propagation path.

[0019] In this embodiment, step one specifically includes: Collect operational metrics data generated by each service node of the distributed system within a continuous time segment. The operational metrics data include processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts. Collect call chain log data between each service node, parse the call chain log data into call records, and the call records include the call initiating node identifier, the call receiving node identifier, the call start time, the call end time, the call status, and the call duration; The operation index data and call records are sorted by timestamp, the time difference between adjacent sampling times is calculated, and the time difference is sorted by numerical value and the time difference corresponding to the median position is selected as the adaptive sampling interval. The running indicator data is sliced ​​into time segments according to the adaptive sampling interval, and the call records falling into the same time segment are assigned to the corresponding time segments to form node indicator segments and node call segments. The node metric fragments and node call fragments are concatenated according to the service node identifier, time segment order, running metric name, and call record fields to generate node runtime sequence data.

[0020] In this implementation, operational metric data and call chain log data are associated and managed using a unified event identifier mechanism. Each call record corresponds to a unique event identifier, which is synchronously written to the data records of both the call initiating node and the call receiving node. After time slicing is completed, node operation snapshots are constructed on a time-segment basis. Each node operation snapshot contains a set of operational metrics and a set of associated call records within the same time segment. For call records that persist across time segments, they are allocated to the corresponding time segments according to the proportion of call duration, and information on changes in call direction and call status is recorded. Node runtime sequence data is organized using node identifiers, time order, and event associations, ensuring a synchronous mapping between the operational status changes of the same service node and the call propagation process between different service nodes. This forms a node runtime sequence data structure with temporal continuity and call association, providing a unified data foundation for subsequent state encoding, abnormal evolution gene chain construction, and abnormal evolution chromosome network construction.

[0021] In this embodiment, step two specifically involves: The runtime sequence data of the nodes are divided according to the service node identifier to form a set of time-series indicators corresponding to each service node. For each service node, the changes in processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts between adjacent time segments are calculated to form an indicator change vector. The cumulative value, fluctuation value, direction of change and duration of change of each indicator are statistically analyzed in chronological order for multiple consecutive time segments to form a state representation vector. The similarity of the state representation vectors corresponding to each service node is calculated, and the states are classified according to the similarity calculation results to generate state labels. Arrange the status identifiers corresponding to each time segment in chronological order to form a status code sequence for each service node.

[0022] In this implementation, state identifiers are recorded using discrete encoding, with each identifier corresponding to a stable operating mode. During state classification, the state representation vector corresponding to the same service node participates in the classification calculation, while different service nodes maintain independent classification processes. After state classification is completed, the transition order, number of transitions, and dwell time between each state identifier are recorded, and a state transition record table is established. The state transition record table is continuously updated in chronological order, ensuring that the state encoding sequence simultaneously retains information on changes in operating state and state evolution. To ensure the continuity of the state encoding sequence, when adjacent time segments correspond to the same state identifier, the state duration is recorded; when the state identifier changes, the state switching position is recorded, thus forming a state encoding sequence with both temporal continuity and state transition characteristics, providing a unified state expression basis for constructing the abnormal evolution gene chain.

[0023] In this embodiment, step three specifically includes: Read the status code sequence corresponding to each service node in chronological order and extract the state transition relationship between adjacent status identifiers; For each state transition relationship, record the starting state identifier, the target state identifier, the state duration, and the state transition position to form a state transition record; Construct a state transition feature group based on the starting state identifier, target state identifier, state duration, and state transition position in the state transition record; The state transition feature group is combined and encoded to form a gene description unit by combining the initial state identifier, the target state identifier, the state duration, and the state switching position. The corresponding gene identifier is then generated based on the gene description unit to form a gene fragment. Arrange gene fragments in chronological order, record the transfer order between adjacent gene fragments, establish the sequential connection relationship between adjacent gene fragments, and form a gene fragment sequence. By connecting the gene fragments according to their sequence order, an abnormal evolution gene chain corresponding to each service node is generated.

[0024] In this implementation, gene description units are stored using a uniform-length data structure, with each unit corresponding to a complete state transition process. After gene fragments are generated, each fragment is assigned a unique gene ID, and a correspondence table between gene IDs and state transition records is established. During gene fragment sequence construction, the connection direction and frequency of occurrence between adjacent gene fragments are recorded synchronously, forming a gene connection record table. The anomalous evolution gene chain is organized using an ordered chain structure, with the head of the chain corresponding to the state transition process in the earliest time segment and the tail corresponding to the state transition process in the latest time segment. As new time segments are continuously generated, new gene fragments are added to the end of the anomalous evolution gene chain in chronological order, updating the gene connection record table. This ensures that the anomalous evolution gene chain continuously retains the evolutionary trajectory information and migration association information of the service node's operating state, providing a unified gene expression basis for the construction of anomalous evolution chromosomes.

[0025] In this embodiment, step four specifically includes: Read the abnormal evolution gene chain and service call relationship corresponding to each service node, and establish gene chain association relationship according to the call initiating node and the call receiving node; For each service call relationship, extract the abnormal evolution gene chain corresponding to the call initiating node and the abnormal evolution gene chain corresponding to the call receiving node, and align them according to the call start time and call end time to form an associated gene chain group; In the associated gene chain group, identify gene segments with overlapping time intervals and gene segments with call-and-transfer relationships, and establish cross-node gene association records; Based on cross-node gene association records, associated gene fragments in different abnormal evolution gene chains are combined, and the order of the associated gene fragments in the original abnormal evolution gene chain is preserved to form candidate chromosomes; For the associated gene segments in the candidate chromosomes, the gene connection relationship is re-established according to the cross-node gene association record, and chromosome recombination is performed on the candidate chromosomes to form cross-node abnormal evolution chromosomes; The number of shared gene segments, the number of gene connections, and the number of cross-node gene association records among chromosomes with anomalous evolution across nodes were counted to establish the connection relationships between chromosomes. By treating each cross-node anomalously evolved chromosome as a chromosome node and the connections between chromosomes as connecting edges, a cross-node anomalously evolved chromosome network is constructed.

[0026] In this implementation, cross-node gene association records are stored using an association table structure. The association table records the service node identifier, call direction, association time order, and association count corresponding to the associated gene fragments. During candidate chromosome construction, each candidate chromosome corresponds to a set of gene fragments with call association relationships, and the order of gene fragments in the candidate chromosome is consistent with the call propagation order. After chromosome recombination, a unique chromosome identifier is assigned to each cross-node anomalous evolution chromosome, and the set of gene fragment numbers and gene connection relationships constituting the chromosome are recorded. When constructing the cross-node anomalous evolution chromosome network, chromosome nodes continuously receive new gene association information and update connection relationships, enabling the cross-node anomalous evolution chromosome network to simultaneously retain service call propagation characteristics, state transition characteristics, and cross-node evolution characteristics, providing a unified data carrier for subsequent chromosome structure encoding and anomalous evolution modeling.

[0027] In this embodiment, step five specifically includes: The cross-node anomalous evolution chromosome network is input into the network and embedded into the network. Multi-layer node embedding calculation is performed according to the topological structure of chromosome nodes and connecting edges to generate the initial embedding vector for each chromosome node. During the node embedding computation, the node embedding vector is weighted by combining the gene segment arrangement order in the chromosome, the number of gene connection relationships, and cross-node gene association information to form a structure-enhanced embedding. Information aggregation processing is performed on the structural enhancement embeddings of all chromosome nodes to statistically analyze the distribution of node neighborhood features, the combination patterns of neighborhood gene fragments, and the propagation relationships between nodes, thereby generating a cross-node global feature representation. The structural enhancement embedding and global feature representation are fused and encoded to generate the anomalous evolution chromosome embedding vector corresponding to each cross-node anomalous evolution chromosome.

[0028] In this implementation, during the node embedding calculation, the initial embedding vector of each chromosome node is weighted by combining its gene segment arrangement order and the number of gene connections, and then weighted summed to form a structure-enhanced embedding. When aggregating node neighborhood information, the mean, variance, and gene segment combination patterns of the neighborhood node embeddings are statistically analyzed, and cross-node global feature representations are generated by combining these with the gene propagation relationships between nodes. The structure-enhanced embedding and the global feature representation are fused and encoded to form an anomalous evolutionary chromosome embedding vector, thereby simultaneously preserving local gene segment features and cross-node propagation features.

[0029] In this embodiment, step six specifically includes: Input the embedding vector of anomalously evolved chromosomes into the improved TranAD model; The improved TranAD model includes a sequentially linked chromosome splitting coding module, a chromosome recombination deduction module, and a chromosome evolution matching module; The chromosome splitting coding module uses cross-node associated gene segments and gene connection breakpoints as the splitting positions to perform link splitting on the chromosome structure corresponding to the embedding vector of abnormally evolved chromosomes, forming multiple chromosome sub-chain representations; The number of gene segments, gene connection span, and number of cross-node associations in each chromosome subchain are counted to form the corresponding subchain structure description sequence. Read the structural description sequences of each sub-chain according to the gene connection order, and establish the evolutionary connection relationship between different chromosome sub-chains to form a set of chromosome evolution paths; The chromosome recombination deduction module reads the set of chromosome evolution paths; Extract common gene fragment sequences between any two chromosome evolutionary paths, and establish path intersection relationships using these common gene fragment sequences as path intersection points; Preserve the gene connection order before the path intersection point and replace the daughter chain fragments after the path intersection point to form multiple candidate chromosome structures; The changes in gene connection order, cross-node migration, and chromosome length were statistically analyzed in each candidate chromosome structure. Multiple candidate chromosome structures are sorted based on changes in gene connection order, changes in cross-node migration, and changes in chromosome length to form a set of candidate chromosome structures; The chromosome evolution matching module reads the candidate chromosome structure set and the actual chromosome structure; Gene connection sequences were extracted from the candidate chromosome structure set and the actual chromosome structure, respectively. Calculate the number of differences in gene connection positions, cross-node associations, chromosome paths, and chromosome lengths between candidate chromosome structures and actual chromosome structures. Evolutionary matching results are constructed based on the number of differences in gene connection locations, the number of differences in cross-node associations, the number of differences in chromosome paths, and the number of differences in chromosome length. Anomaly score vectors are generated based on the evolutionary matching results.

[0030] In this implementation, the chromosome splitting coding module organizes chromosome sub-chains using a hierarchical link representation. Each chromosome sub-chain retains the gene connection direction information and cross-node association sequence information from the original aberrantly evolved chromosome. After the chromosome evolution path set is constructed, a path identifier is assigned to each chromosome evolution path, and a correspondence is established between the path identifier and the constituent gene segments. During the candidate chromosome structure generation process, the source information of the chromosome sub-chains involved in recombination and the sub-chain splicing sequence information are recorded simultaneously to form a chromosome recombination record table. In the evolutionary matching stage, the chromosome recombination record table is used to track the formation process of candidate chromosome structures, and the actual chromosome structure is mapped to the same structural expression space. This allows for a difference comparison between the candidate chromosome structure and the actual chromosome structure at a unified structural scale, thereby ensuring that the aberration scoring vector can simultaneously reflect gene connection change characteristics, cross-node propagation change characteristics, and evolutionary path change characteristics. Both the improved TranAD model and the original TranAD model are anomaly detection models based on the Transformer architecture. They both employ encoding, modeling, and matching analysis to learn the evolutionary patterns in the input data and generate anomaly scores based on the differences between the modeling results and the actual data. Both retain the ability to model sequence relationships, enabling them to analyze trends in continuous time processes and use anomaly scores to characterize the degree of anomaly. The improved TranAD model addresses the cross-node propagation and complex evolutionary characteristics of distributed systems by introducing a chromosome splitting encoding module, a chromosome recombination inference module, and a chromosome evolution matching module. The chromosome splitting encoding module segments abnormally evolving chromosomes based on cross-node relationships, forming chromosome sub-chains; the chromosome recombination inference module establishes path intersection relationships based on common gene fragments and constructs candidate chromosome structures; the chromosome evolution matching module performs evolutionary matching analysis between candidate chromosome structures and actual chromosome structures, generating an anomaly scoring vector. Through the above improvements, the model is no longer limited to modeling a single time sequence, but instead performs structured modeling around the formation, recombination, and evolution processes of the anomalous evolutionary chromosome. This allows the model to simultaneously characterize state transition features, service call propagation features, and cross-node evolution features. The generated anomaly score vector can reflect the degree of structural changes during the anomaly propagation process, improving the anomaly identification and propagation perception capabilities in complex anomaly scenarios of distributed systems.

[0031] In this embodiment, the path intersection relationship is specifically as follows: Read the gene fragment sequences corresponding to any two chromosome evolutionary pathways; Compare the gene identifiers in the two gene fragment sequences and extract the gene fragments corresponding to the same gene identifiers as common gene fragments. The common gene segments are arranged in order of their position in the two chromosome evolutionary pathways to form a common gene segment sequence; For each common gene segment, record the position number of the common gene segment in the first chromosome evolutionary path and the position number in the second chromosome evolutionary path; Calculate the absolute value of the difference between the two location numbers to form the path intersection offset; The common gene fragment, two location numbers, and path intersection offset are combined to form a path intersection unit; Connect the intersection units of each pathway according to the order of arrangement in the common gene fragment sequence to form a pathway intersection relationship.

[0032] In this implementation, path convergence units are stored using an ordered record structure, with each unit corresponding to one cross-path gene convergence event. When constructing path convergence relationships, connections are established according to the order in which common gene fragments appear in different chromosome evolutionary paths, and the number of spacer gene fragments between adjacent path convergence units is recorded. For chromosome evolutionary paths with multiple common gene fragments, path convergence units are organized in ascending order of path convergence offset to maintain continuous evolutionary characteristics. During chromosome recombination deduction, path convergence relationships are used as indexes for chromosome sub-chain replacement positions. The position numbers in the path convergence units determine the sub-chain splicing positions, and the path convergence offset characterizes the structural similarity between different evolutionary paths, thus forming candidate chromosome structures with evolutionary continuity and providing a unified structural association basis for subsequent chromosome evolution matching.

[0033] In this embodiment, step seven specifically includes: Read the abnormal score vector and the cross-node abnormal evolution chromosome network; Extract the chromosome identifiers corresponding to each scoring element in the abnormal scoring vector, and establish a mapping relationship between the scoring elements and the cross-node abnormal evolution chromosomes; Read the set of gene fragment numbers and the set of service node identifiers corresponding to each cross-node abnormal evolution chromosome; Based on the mapping relationship between the scoring elements and the cross-node aberrant evolution chromosomes, each scoring element is assigned to the corresponding cross-node aberrant evolution chromosome; For each service node, count the scoring elements corresponding to all cross-node anomalous evolution chromosomes containing the service node identifier; The corresponding scoring elements are accumulated and calculated according to the service node identifier, and then normalized according to the number of corresponding scoring elements to form the service node abnormal score value. Read the service node anomaly score values ​​corresponding to the same service node in chronological order to form a service node anomaly score sequence. The abnormal score values ​​of service nodes at each time location are statistically analyzed, and an abnormal score distribution is constructed based on the abnormal score sequence of all service nodes to generate the abnormal score distribution corresponding to each service node.

[0034] In this implementation, a one-to-one correspondence is established between the anomaly score value of a service node and its corresponding service node identifier, and the scores are written into the node score record table in chronological order. The anomaly score distribution is stored using a two-dimensional organizational structure composed of time location and service node identifier, where each time location corresponds to one anomaly score update result. During the construction of the anomaly score distribution, the identifiers of cross-node anomaly evolution chromosomes participating in the score calculation and the source information of the corresponding score elements are recorded synchronously, enabling the anomaly score value of a service node to be traced back to the corresponding chromosome structure and gene fragment set. For service nodes that appear simultaneously in multiple cross-node anomaly evolution chromosomes, the source records and mapping relationships of each score element are retained, thereby forming an anomaly score distribution with temporal continuity, structural correlation, and propagation correlation, providing a unified scoring basis and node correlation basis for anomaly propagation path analysis.

[0035] In this embodiment, step eight specifically includes: Read the abnormal score distribution and cross-node abnormal evolution chromosome network; Extract chromosome nodes, chromosome connection relationships, and corresponding service node identifiers from cross-node anomalous evolution chromosome networks; Establish a node correspondence between the abnormal score distribution and the cross-node abnormal evolution chromosome network based on the service node identifier; For each chromosome node, the changes in the abnormal score value of the corresponding service node at continuous time positions are statistically analyzed to form a node abnormal evolution sequence; Read the abnormal evolution sequence of adjacent chromosome nodes according to the chromosome connection relationship; Calculate the number of times the abnormal score change direction is consistent and the time interval of abnormal score change between the abnormal evolution sequences of adjacent nodes to form a node propagation association record; Based on the number of times the abnormal score change direction is consistent and the time interval of abnormal score change, the propagation connection relationship between chromosome nodes is established to form a set of candidate propagation paths; Connect the corresponding chromosome nodes according to the propagation connection order in the candidate propagation path set to form multiple candidate abnormal propagation paths; Count the number of nodes, the number of propagation levels, the number of propagation connections, and the number of node propagation-related records in each candidate anomaly propagation path; Multiple candidate abnormal propagation paths are sorted based on the number of nodes, the number of propagation levels, the number of propagation connections, and the number of propagation-related records of each node to determine the abnormal propagation path.

[0036] In this implementation, the candidate propagation path set is organized using a directed path structure. Each candidate propagation path corresponds to a unique path identifier and records the starting chromosome node, ending chromosome node, and intermediate chromosome nodes traversed by the path. After the node propagation association records are generated, a propagation association index table is simultaneously established to record the propagation direction and association order between chromosome nodes. During the construction of candidate abnormal propagation paths, chromosome nodes are connected sequentially according to the propagation direction, and the time position range corresponding to each node connection is recorded. For candidate abnormal propagation paths that share some chromosome nodes, their independent propagation association indices are retained, allowing for path analysis of different propagation processes separately. After the abnormal propagation path is determined, the set of service nodes and the set of chromosome nodes corresponding to the path are recorded simultaneously, thus forming an abnormal propagation path structure with time sequence characteristics, propagation direction characteristics, and cross-node association characteristics.

[0037] Example 1: To verify the feasibility of this invention in practice, it was applied to the microservice cloud platform of a large internet company. This platform is deployed across multiple server clusters, running 128 microservice nodes including order service, user service, payment service, inventory service, message service, gateway service, and log service. It processes approximately 230 million business requests daily, generating an average of about 150,000 operational metric data entries and about 800,000 call chain log entries per minute. During long-term operation, due to the complex dependencies between services, anomalies often do not occur on a single node but spread gradually across nodes. For example, when the payment service experiences increased response latency, it may trigger timeout retries in the order service, subsequently causing a backlog in the message service, ultimately resulting in multiple service nodes experiencing simultaneous anomalies. While traditional monitoring methods can detect anomalies in individual node metrics, they struggle to accurately identify the anomaly propagation path and the location of the anomaly's source.

[0038] In this embodiment, the processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts of each service node are first collected, along with call chain logs between services. The runtime data and call records are then uniformly aligned based on timestamps to form node runtime sequence data. Subsequently, the node runtime sequence data is state-encoded to construct a state-encoded sequence for each service node. The system continuously records the state change process of service nodes, converting state transition relationships into gene fragments and forming an abnormal evolution gene chain.

[0039] When a payment service node experiences database connection pool exhaustion, the payment service state first transitions from a stable state to a high-load state, corresponding to the formation of new gene fragments. Due to the call relationship between the payment service and the order service, the order service subsequently experiences request backlog, forming new state transition gene fragments. The message service and inventory service are further affected. The system combines and recombines the abnormal evolution gene chains corresponding to multiple service nodes based on call relationships and time correlations, constructing a cross-node abnormal evolution chromosome network. At this point, the anomaly no longer manifests as a single-node anomaly, but rather as an abnormal evolution relationship between multiple service nodes.

[0040] The constructed cross-node anomalous evolution chromosome network is input into a graph embedding network for encoding. The graph embedding network comprehensively considers gene segment arrangement, gene connectivity, and cross-node association information to structurally encode the anomalous evolution chromosomes, forming an anomalous evolution chromosome embedding vector. Subsequently, this embedding vector is input into an improved TranAD model. The improved TranAD model uses a chromosome splitting encoding module to decompose the complex propagation structure into multiple chromosome sub-chains, a chromosome recombination inference module to construct multiple candidate propagation structures, and a chromosome evolution matching module to calculate the evolutionary difference between candidate structures and actual structures, generating anomaly score vectors.

[0041] The system establishes anomaly score distribution for service nodes based on anomaly score vectors and continuously analyzes changes in anomaly scores. When an anomaly occurs in the payment service, the payment service anomaly score rises first; subsequently, the anomaly scores for the order service, message service, and inventory service rise in sequence. The system constructs node propagation association records based on the direction and time interval of anomaly score changes, and ultimately generates anomaly propagation paths.

[0042] After 30 consecutive days of testing, the present invention was compared and verified with traditional single-node time series detection methods and traditional TranAD models. The experimental results are shown in Table 1.

[0043] Table 1 Comparison of Anomaly Monitoring Results in Distributed Systems

[0044] As shown in Table 1, the present invention significantly outperforms traditional rule-based monitoring methods and the original TranAD model in terms of anomaly identification accuracy, anomaly source location accuracy, anomaly propagation path identification accuracy, and cross-node anomaly identification accuracy. Specifically, the anomaly identification accuracy reaches 96.18%, the anomaly propagation path identification accuracy reaches 94.83%, and the average anomaly detection time is reduced to 24 seconds, verifying that the present invention possesses high anomaly identification and propagation analysis capabilities in complex anomaly propagation scenarios within distributed systems.

[0045] This invention achieves structured modeling of complex anomaly propagation processes in distributed systems by constructing an abnormal evolution gene chain, a cross-node abnormal evolution chromosome network, and an improved TranAD model. It can not only identify single-node anomalies but also accurately reconstruct the anomaly propagation path and diffusion process, improving the accuracy, real-time performance, and propagation analysis capabilities of anomaly monitoring in distributed systems. This verifies the effectiveness and engineering application value of this invention in large-scale distributed system scenarios.

[0046] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for anomaly monitoring in a distributed system based on deep learning, characterized in that, Includes the following steps: Step 1: Collect operational metrics data and call chain log data from each service node of the distributed system to generate node runtime sequence data; Step 2: Perform state encoding processing on the node runtime sequence data to generate a state encoding sequence corresponding to each service node; Step 3: Extract the adjacent state transition relationships in the state coding sequence, convert each state transition relationship into a gene fragment, and arrange the gene fragments in chronological order to generate the abnormal evolution gene chain corresponding to each service node; Step 4: Based on the abnormal evolution gene chain and service call relationship corresponding to each service node, perform chromosome combination and chromosome recombination to construct a cross-node abnormal evolution chromosome network; Step 5: Encode the cross-node abnormal evolution chromosome network input graph into the network, extract chromosome recombination structural features, and generate abnormal evolution chromosome embedding vectors; Step 6: Input the embedded vector of the abnormally evolved chromosome into the improved TranAD model, complete the abnormal evolution modeling based on the chromosome splitting coding module, chromosome recombination inference module and chromosome evolution matching module, and output the abnormality score vector; Step 7: Map the abnormal score vector to nodes to generate the abnormal score distribution corresponding to each service node; Step 8: Based on the abnormal score distribution and the cross-node abnormal evolution chromosome network, perform abnormal propagation path analysis to generate abnormal propagation paths.

2. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step one specifically involves: Collect operational metrics data generated by each service node of the distributed system within a continuous time segment. The operational metrics data include processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts. Collect call chain log data between each service node, and parse the call chain log data into call records. The call records include the call initiating node identifier, the call receiving node identifier, the call start time, the call end time, the call status, and the call duration. The operation index data and call records are sorted by timestamp, the time difference between adjacent sampling times is calculated, and the time difference is sorted by numerical value and the time difference corresponding to the median position is selected as the adaptive sampling interval. The running indicator data is sliced ​​into time segments according to the adaptive sampling interval, and the call records falling into the same time segment are assigned to the corresponding time segments to form node indicator segments and node call segments. The node indicator fragments and node call fragments are concatenated according to the service node identifier, time segment order, running indicator name, and call record field to generate node runtime sequence data.

3. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step two specifically involves: The runtime sequence data of the nodes are divided according to the service node identifier to form a set of time-series indicators corresponding to each service node. For each service node, the changes in processor utilization, memory usage, disk read / write speed, network throughput, request response time, number of request failures, and number of service restarts between adjacent time segments are calculated to form an indicator change vector. The cumulative value, fluctuation value, direction of change and duration of change of each indicator are statistically analyzed in chronological order for multiple consecutive time segments to form a state representation vector. The similarity of the state representation vectors corresponding to each service node is calculated, and the states are classified according to the similarity calculation results to generate state labels. Arrange the status identifiers corresponding to each time segment in chronological order to form a status code sequence for each service node.

4. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step three specifically involves: Read the status code sequence corresponding to each service node in chronological order and extract the state transition relationship between adjacent status identifiers; For each state transition relationship, record the starting state identifier, the target state identifier, the state duration, and the state transition position to form a state transition record; Construct a state transition feature group based on the starting state identifier, target state identifier, state duration, and state transition position in the state transition record; The state transition feature group is combined and encoded to form a gene description unit by combining the initial state identifier, the target state identifier, the state duration, and the state switching position. A corresponding gene identifier is generated based on the gene description unit to form a gene fragment. Arrange gene fragments in chronological order, record the transfer order between adjacent gene fragments, establish the sequential connection relationship between adjacent gene fragments, and form a gene fragment sequence. By connecting the gene fragments according to their sequence order, an abnormal evolution gene chain corresponding to each service node is generated.

5. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step four specifically involves: Read the abnormal evolution gene chain and service call relationship corresponding to each service node, and establish gene chain association relationship according to the call initiating node and the call receiving node; For each service call relationship, extract the abnormal evolution gene chain corresponding to the call initiating node and the abnormal evolution gene chain corresponding to the call receiving node, and align them according to the call start time and call end time to form an associated gene chain group; In the associated gene chain group, identify gene segments with overlapping time intervals and gene segments with call-and-transfer relationships, and establish cross-node gene association records; Based on cross-node gene association records, associated gene fragments in different abnormal evolution gene chains are combined, and the order of the associated gene fragments in the original abnormal evolution gene chain is preserved to form candidate chromosomes; For the associated gene segments in the candidate chromosomes, the gene connection relationship is re-established according to the cross-node gene association record, and chromosome recombination is performed on the candidate chromosomes to form cross-node abnormal evolution chromosomes; The number of shared gene segments, the number of gene connections, and the number of cross-node gene association records among chromosomes with anomalous evolution across nodes were counted to establish the connection relationships between chromosomes. By treating each cross-node anomalously evolved chromosome as a chromosome node and the connections between chromosomes as connecting edges, a cross-node anomalously evolved chromosome network is constructed.

6. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step five specifically involves: The cross-node anomalous evolution chromosome network is input into the graph embedding network, and multi-layer node embedding calculation is performed according to the topology of chromosome nodes and connecting edges to generate an initial embedding vector for each chromosome node. During the node embedding computation, the node embedding vector is weighted by combining the gene segment arrangement order in the chromosome, the number of gene connection relationships, and cross-node gene association information to form a structure-enhanced embedding. Information aggregation processing is performed on the structural enhancement embeddings of all chromosome nodes to statistically analyze the distribution of node neighborhood features, the combination patterns of neighborhood gene fragments, and the propagation relationships between nodes, thereby generating a cross-node global feature representation. The structure-enhanced embedding and global feature representation are fused and encoded to generate the aberrant evolution chromosome embedding vector corresponding to each cross-node aberrant evolution chromosome.

7. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step six specifically involves: The embedding vector of the aberrantly evolved chromosome is input into the improved TranAD model; The improved TranAD model includes a sequentially connected chromosome splitting coding module, a chromosome recombination deduction module, and a chromosome evolution matching module; The chromosome splitting coding module uses cross-node associated gene fragments and gene connection breakpoints as the splitting positions to perform link splitting on the chromosome structure corresponding to the abnormally evolved chromosome embedding vector, forming multiple chromosome sub-chain representations. The number of gene segments, gene connection span, and number of cross-node associations in each chromosome subchain are counted to form the corresponding subchain structure description sequence. Read the structural description sequences of each sub-chain according to the gene connection order, and establish the evolutionary connection relationship between different chromosome sub-chains to form a set of chromosome evolution paths; The chromosome recombination deduction module reads the set of chromosome evolution paths; Extract common gene fragment sequences between any two chromosome evolutionary paths, and establish path intersection relationships using these common gene fragment sequences as path intersection points; Preserve the gene connection order before the path intersection point and replace the daughter chain fragments after the path intersection point to form multiple candidate chromosome structures; The changes in gene connection order, cross-node migration, and chromosome length were statistically analyzed in each candidate chromosome structure. Multiple candidate chromosome structures are sorted based on changes in gene connection order, changes in cross-node migration, and changes in chromosome length to form a set of candidate chromosome structures; The chromosome evolution matching module reads the candidate chromosome structure set and the actual chromosome structure; Gene connection sequences were extracted from the candidate chromosome structure set and the actual chromosome structure, respectively. Calculate the number of differences in gene connection positions, cross-node associations, chromosome paths, and chromosome lengths between candidate chromosome structures and actual chromosome structures. Evolutionary matching results are constructed based on the number of differences in gene connection locations, the number of differences in cross-node associations, the number of differences in chromosome paths, and the number of differences in chromosome length. An anomaly score vector is generated based on the evolutionary matching results.

8. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, The specific path intersection relationship is as follows: Read the gene fragment sequences corresponding to any two chromosome evolutionary pathways; Compare the gene identifiers in the two gene fragment sequences and extract the gene fragments corresponding to the same gene identifiers as common gene fragments. The common gene segments are arranged in order of their position in the two chromosome evolutionary pathways to form a common gene segment sequence; For each common gene segment, record the position number of the common gene segment in the first chromosome evolutionary path and the position number in the second chromosome evolutionary path; Calculate the absolute value of the difference between the two location numbers to form the path intersection offset; The common gene fragment, two location numbers, and path intersection offset are combined to form a path intersection unit; Connect the intersection units of each pathway according to the order of arrangement in the common gene fragment sequence to form a pathway intersection relationship.

9. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step seven specifically involves: Read the anomaly score vector and the cross-node anomalous evolution chromosome network; Extract the chromosome identifiers corresponding to each scoring element in the abnormal scoring vector, and establish a mapping relationship between the scoring elements and the cross-node abnormal evolution chromosomes; Read the set of gene fragment numbers and the set of service node identifiers corresponding to each cross-node abnormal evolution chromosome; Based on the mapping relationship between the scoring elements and the cross-node aberrant evolution chromosomes, each scoring element is assigned to the corresponding cross-node aberrant evolution chromosome; For each service node, count the scoring elements corresponding to all cross-node anomalous evolution chromosomes containing the service node identifier; The corresponding scoring elements are accumulated and calculated according to the service node identifier, and then normalized according to the number of corresponding scoring elements to form the service node abnormal score value. Read the service node anomaly score values ​​corresponding to the same service node in chronological order to form a service node anomaly score sequence. The abnormal score values ​​of service nodes at each time location are statistically analyzed, and an abnormal score distribution is constructed based on the abnormal score sequence of all service nodes to generate the abnormal score distribution corresponding to each service node.

10. The method for anomaly monitoring in a distributed system based on deep learning according to claim 1, characterized in that, Step eight specifically involves: Read the abnormal score distribution and the cross-node abnormal evolution chromosome network; Extract chromosome nodes, chromosome connection relationships, and corresponding service node identifiers from cross-node anomalous evolution chromosome networks; Establish a node correspondence between the abnormal score distribution and the cross-node abnormal evolution chromosome network based on the service node identifier; For each chromosome node, the changes in the abnormal score value of the corresponding service node at continuous time positions are statistically analyzed to form a node abnormal evolution sequence; Read the abnormal evolution sequence of adjacent chromosome nodes according to the chromosome connection relationship; Calculate the number of times the abnormal score change direction is consistent and the time interval of abnormal score change between the abnormal evolution sequences of adjacent nodes to form a node propagation association record; Based on the number of times the abnormal score change direction is consistent and the time interval of abnormal score change, the propagation connection relationship between chromosome nodes is established to form a set of candidate propagation paths; Connect the corresponding chromosome nodes according to the propagation connection order in the candidate propagation path set to form multiple candidate abnormal propagation paths; Count the number of nodes, the number of propagation levels, the number of propagation connections, and the number of node propagation-related records in each candidate anomaly propagation path; Multiple candidate abnormal propagation paths are sorted based on the number of nodes, the number of propagation levels, the number of propagation connections, and the number of propagation-related records of each node to determine the abnormal propagation path.

Images