Network system failure prediction method based on microservice architecture

Abstract

The present application relates to the field of micro-service architecture, and particularly relates to a network system failure prediction method based on micro-service architecture. The method deploys a traffic monitoring process in a data exchange network layer, collects the transmission control protocol retransmission rate and packet out-of-order rate of the communication link between nodes as the network-side input features, and obtains the service interface request queue depth of the micro-service gateway layer as the gateway-side input features. The long short-term memory network is used to extract the time sequence change rule of the network-side input features and the queue backlog trend of the gateway-side input features respectively, the extracted feature vectors are weighted and fused through the attention mechanism, and the prediction result of the resource exhaustion failure of the micro-service node is output through the classifier. The scheme combines the congestion features of the data exchange network layer and the gateway queuing state for joint prediction, outputs the prediction result at the stage when the packet retransmission and out-of-order occur in the underlying network and the application layer resource has not been exhausted, and prolongs the prediction window period for the resource exhaustion failure.

Description

Technical Field

[0001] This invention relates to the field of microservice architecture, and more specifically to a method for predicting network system failures based on microservice architecture. Background Technology

[0002] Current network system fault prediction in microservice architectures typically focuses on application-layer resource monitoring. Conventional solutions deploy agents on microservice nodes to collect application-layer resource metrics such as CPU utilization and memory usage in real time. When these metrics exceed preset static thresholds, the system determines that a fault has occurred or is about to occur. Some improved solutions employ time-series models to extract features from the collected historical CPU and memory data, predicting resource change trends over a future period to achieve early warning.

[0003] The aforementioned conventional technical solutions suffer from predictive lag in scenarios where underlying network anomalies propagate to the application layer. Before a microservice node experiences resource exhaustion, the underlying data exchange network often already experiences packet retransmissions and out-of-order delivery due to a backlog of requests. At this point, the application layer's CPU and memory metrics have not yet reached alarm thresholds. Conventional solutions do not integrate the underlying network communication status with gateway queuing mechanisms, relying solely on application-layer metrics, resulting in an excessively short prediction window that fails to capture early warning signs at the network layer. Summary of the Invention

[0004] The purpose of this invention is to provide a method for predicting network system faults based on a microservice architecture, which can effectively solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0006] A network system fault prediction method based on microservice architecture includes: deploying a traffic monitoring process at the data exchange network layer to collect the transmission control protocol retransmission rate and packet out-of-order rate of the communication links between nodes in the microservice cluster in real time, and obtaining the request queue depth of each service interface in the microservice gateway layer.

[0007] A resource congestion awareness model is constructed, with the transmission control protocol retransmission rate and the packet out-of-order rate as network-side input features and the request queue depth as gateway-side input features. The temporal variation pattern of the network-side input features and the queue backlog trend of the gateway-side input features are extracted by a long short-term memory network.

[0008] The extracted temporal variation feature vector and the queue backlog trend feature vector are weighted and fused using an attention mechanism, and the classifier outputs the prediction result that the microservice node is about to experience resource exhaustion failure.

[0009] Preferably, the real-time acquisition of the transmission control protocol retransmission rate and message out-of-order rate of the communication links between nodes in the microservice cluster includes: the traffic monitoring process intercepts the original data packets of the data exchange network layer according to a set time granularity, and parses the sequence number field and acknowledgment number field of the transmission control protocol header of the original data packets;

[0010] The number of repeatedly received data packets is counted based on the difference between the sequence number field and the acknowledgment number field, and the retransmission rate of the transmission control protocol is calculated by combining the total number of data packets received within the set time granularity.

[0011] The message out-of-order rate is calculated based on the number of out-of-order arrivals in the sequence number field and the total number of data packets arriving within the set time granularity.

[0012] Preferably, obtaining the request queue depth of each service interface in the microservice gateway layer includes: reading the current length value of the receive buffer queue corresponding to each service interface in the microservice gateway, and using the current length value as the original value of the request queue depth;

[0013] The original values ​​of the request queue depth are aggregated according to the service interface identification information to construct a request queue depth matrix with the service interface identification information as the row index and the time step as the column index.

[0014] The request queue depth matrix is ​​padded with mean value, and the processed request queue depth matrix is ​​used as the gateway-side input feature and input into the resource congestion awareness model.

[0015] Preferably, the step of extracting the temporal variation pattern of the network-side input features through the long short-term memory network includes: expanding the network-side input features into a network-side time-series input vector group according to the time dimension, and inputting the network-side time-series input vector group into the first long short-term memory network;

[0016] In each time step of the first long short-term memory network, the current time step vector of the network-side time series input vector group is concatenated with the hidden state of the previous time step. The state candidate value is calculated through the input gate, the historical cell state is forgotten through the forget gate, the cell state of the current time step is updated, and the cell state is mapped to the network-side hidden layer feature vector through the output gate.

[0017] Preferably, the step of extracting the queue backlog trend of the gateway-side input features through the long short-term memory network includes: expanding the gateway-side input features into a gateway-side time series input vector group according to the time dimension, and inputting the gateway-side time series input vector group into the second long short-term memory network;

[0018] In the second long short-term memory network, a queue state transition bias term is introduced. The current time step vector of the gateway-side time series input vector group is added to the queue state transition bias term and then input into the forget gate. The cell state update amplitude of the second long short-term memory network is adjusted according to the output result of the forget gate, and the gateway-side hidden layer feature vector containing the queue backlog trend is extracted.

[0019] Preferably, the step of weighted fusion of the extracted temporal change pattern feature vector and the queue backlog trend feature vector using an attention mechanism includes: using the temporal change pattern feature vector as a query vector and the queue backlog trend feature vector as a key vector and a value vector;

[0020] The attention score matrix is ​​obtained by multiplying the query vector and the transpose of the key vector.

[0021] The attention score matrix is ​​subjected to softmax normalization. The normalized attention score matrix is ​​multiplied by the value vector to obtain the attention weight feature vector. The attention weight feature vector is concatenated with the temporal change pattern feature vector to obtain the fused feature vector.

[0022] Preferably, after calculating the Transmission Control Protocol retransmission rate and the message out-of-order rate, the method further includes: extracting the source Internet Protocol address and destination Internet Protocol address of the original data packet, and constructing a microservice node communication link adjacency matrix based on the source Internet Protocol address and the destination Internet Protocol address;

[0023] The transmission control protocol retransmission rate and the message out-of-order rate are used as the weight attributes of the corresponding edges in the adjacency matrix of the microservice node communication links.

[0024] Spatial feature aggregation is performed on the adjacency matrix of the communication links of the microservice nodes with the weight attributes using a graph convolutional network, and the aggregated spatial feature vector replaces the network-side input features.

[0025] Preferably, after constructing a request queue depth matrix with the service interface identifier information as the row index and the time step as the column index, the method further includes: querying the service registry to obtain the service priority tag corresponding to each service interface identifier information;

[0026] Generate a priority weight diagonal matrix based on the service priority tags;

[0027] Perform matrix multiplication between the priority weight diagonal matrix and the request queue depth matrix to obtain the weighted request queue depth matrix;

[0028] The weighted request queue depth matrix is ​​padded with mean value, and the processed weighted request queue depth matrix is ​​used as the input feature of the gateway side.

[0029] Preferably, after concatenating the current time step vector of the network-side time series input vector group with the hidden state of the previous time step, the method further includes: extracting the absolute value of the retransmission rate difference and the absolute value of the out-of-order rate difference between adjacent time steps in the network-side time series input vector group.

[0030] The absolute value of the retransmission rate difference is added to the absolute value of the out-of-order rate difference to obtain the fluctuation characteristic scalar.

[0031] The fluctuation feature scalar is multiplied by a preset fluctuation coefficient and then superimposed on the bias term of the forget gate. The forgetting ratio of the historical cell state is updated based on the superimposed bias term of the forget gate.

[0032] Preferably, after concatenating the attention weight feature vector with the temporal change pattern feature vector to obtain a fused feature vector, the method further includes: inputting the fused feature vector into a fully connected classifier layer to calculate an initial value of the fault occurrence probability;

[0033] Get the running timestamp of the current microservice cluster and query the set of failure probability baseline thresholds corresponding to multiple pre-established time segments;

[0034] Match the target baseline threshold corresponding to the running timestamp from the set of fault probability baseline thresholds;

[0035] The initial value of the failure occurrence probability is compared with the target baseline threshold. When the initial value of the failure occurrence probability is greater than the target baseline threshold, a prediction result of the microservice node being about to experience resource exhaustion failure is output.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] 1. This invention collects Transmission Control Protocol (TCP) retransmission rate and out-of-order packet rate as network-side input features by deploying a traffic monitoring process at the data exchange network layer, and simultaneously obtains the service interface request queue depth as gateway-side input features. It utilizes a Long Short-Term Memory (LSTM) network to extract the temporal variation patterns and queue backlog trends of these two types of features, and then performs weighted fusion using an attention mechanism. This scheme jointly predicts the congestion characteristics of the underlying data exchange network and the queuing status of the microservice gateway, changing the single mode of monitoring only application-layer indicators. This allows the prediction system to output fault prediction results when underlying network packet retransmissions and out-of-order packets occur, but before application-layer resources are exhausted, thus extending the prediction window for resource exhaustion faults.

[0038] 2. By constructing a microservice node communication link adjacency matrix and combining it with a graph convolutional network to aggregate spatial features of retransmission rate and out-of-order rate, the propagation path of network anomalies between nodes was clarified. A weighted diagonal matrix was generated based on the service priority labels of service interfaces to perform weighted operations on the request queue depth matrix, distinguishing the backlog impact of different business interfaces under network congestion. The absolute values ​​of the differences in retransmission rate and out-of-order rate between adjacent time steps were transformed into fluctuation feature scalars and superimposed on the forget gate bias term of the Long Short-Term Memory network, increasing the model's response speed to sudden changes in network state. Classification was performed based on matching the corresponding target baseline threshold according to the runtime timestamp, adapting to the traffic cycle changes of microservice businesses at different time periods. Attached Figure Description

[0039] Figure 1 This is an overall flowchart of the network system fault prediction method based on microservice architecture of the present invention;

[0040] Figure 2 This is a flowchart of the network-side input feature acquisition and processing of the present invention;

[0041] Figure 3 This is a flowchart of the gateway-side input feature acquisition and processing of the present invention;

[0042] Figure 4 This is a flowchart of the long short-term memory network feature extraction process of the present invention;

[0043] Figure 5 This is a flowchart of the attention mechanism weighted fusion of the present invention;

[0044] Figure 6 This is a flowchart of the fault prediction and threshold matching process of the present invention. Detailed Implementation

[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] Please refer to Figure 1This embodiment provides a network system fault prediction method based on a microservice architecture. The microservice cluster contains multiple interconnected business service nodes. Each service node transmits messages across nodes through a data exchange network layer. External access requests from service nodes are uniformly forwarded and traffic controlled through the microservice gateway layer. A traffic monitoring process is deployed in the data exchange network layer. The traffic monitoring process runs as a user-space process in the host operating system of each cluster node. It establishes a data capture channel with the virtual network interface card (NIC) device in the data exchange network layer and collects the transmission control protocol retransmission rate and out-of-order message rate of the communication links between nodes in the microservice cluster in real time. Specifically, the traffic monitoring process continuously acquires bidirectional message data flowing through the virtual NIC in the data exchange network layer through the data capture channel. It performs layer-by-layer parsing of the message data at the link layer, network layer, and transport layer, extracts the core fields of the transmission control protocol messages, and counts the number of retransmitted messages and out-of-order messages within a set time granularity. The transmission control protocol retransmission rate and out-of-order message rate of the corresponding communication link are calculated respectively. Concurrently, a queue monitoring component is deployed at the microservice gateway layer. This component establishes a data reading channel with the request scheduling module of the microservice gateway to obtain the request queue depth of each service interface in the microservice gateway layer in real time. Specifically, the queue monitoring component reads the queue length of the request receive buffer corresponding to each service interface in the microservice gateway at the same set time granularity as the traffic monitoring process, and uses this queue length as the request queue depth value of the corresponding service interface at the current time step.

[0047] A resource congestion awareness model is constructed, comprising a feature input layer, a dual-branch temporal feature extraction layer, an attention fusion layer, and a classification output layer. Transmission Control Protocol (TCP) retransmission rate and message out-of-order rate are used as network-side input features, and request queue depth is used as gateway-side input features. Long Short-Term Memory (LSTM) networks are used to extract the temporal variation patterns of the network-side input features and the queue backlog trends of the gateway-side input features, respectively. Specifically, the feature input layer aligns the network-side and gateway-side input features along the time dimension, segmenting them into sequences with the same time step length to generate equal-length network-side and gateway-side time series. The dual-branch temporal feature extraction layer contains two independent LSM branches. The first LSM branch receives the network-side time series, extracts the temporal variation patterns of the network-side input features within consecutive time steps, and outputs a temporal variation pattern feature vector. The second LSM branch receives the gateway-side time series, extracts the queue backlog trends of the gateway-side input features within consecutive time steps, and outputs a queue backlog trend feature vector.

[0048] The extracted temporal variation pattern feature vector and queue backlog trend feature vector are weighted and fused using an attention mechanism. A classifier then outputs a prediction of an impending resource exhaustion failure for the microservice node. Specifically, the attention fusion layer receives the temporal variation pattern feature vector and the queue backlog trend feature vector. Using the temporal variation pattern feature vector as a benchmark, it calculates the contribution weight of each dimension in the queue backlog trend feature vector to the failure prediction. A weighted operation is then performed to fuse the two types of features, generating a fused feature vector. The classification output layer contains a fully connected layer and a sigmoid classification function. The fused feature vector is input into the fully connected layer for dimension mapping. The mapped feature vector is then input into the sigmoid classification function, which outputs a failure prediction probability value in the range of 0 to 1. When the failure prediction probability value exceeds a preset classification threshold, the prediction of an impending resource exhaustion failure for the microservice node is output.

[0049] The resource congestion awareness model is trained using supervised learning. The training dataset includes network-side and gateway-side feature data collected during the historical operation of the microservice cluster, along with corresponding fault labels. Fault labels are assigned as positive samples based on feature data within a preset timeframe before a fault occurs, and negative samples based on feature data during normal operation. The training process uses a binary cross-entropy loss function as the optimization objective and the Adam optimizer for iterative updates of the weight parameters. The batch size is set to 32, and the training epochs are set to 100. An early stopping strategy is implemented: if the validation set loss value does not decrease for 10 consecutive training epochs, the training process is terminated, and the current model weight parameters are saved as usable parameters for the inference phase.

[0050] Table 1. Definition of input and output parameters for each layer of the resource congestion awareness model.

[0051] Feature Input Layer Original features on the network side, original features on the gateway side On the network side, the parameters are Transmission Control Protocol (TCP) retransmission rate and out-of-order packet rate; on the gateway side, the parameters are the request queue depth for each service interface. Aligned time series data Network-side time series and gateway-side time series with consistent time step length and matching dimensions Dual-branch temporal feature extraction layer Aligned time series data Equal-length network-side time series and gateway-side time series output from the feature input layer Dual-branch feature vector The feature vectors of time-series change patterns and queue backlog trends have the same dimension. Attention Fusion Layer Dual-branch feature vector The feature vector of time-series change pattern and the feature vector of queue backlog trend Fusion feature vectors The high-dimensional feature vector after attention-weighted fusion contains joint feature information from both the network and gateway sides. Classification output layer Fusion feature vectors The fused feature vector output by the attention fusion layer Fault prediction results Predictions of impending resource exhaustion failures or determinations of normal operation for microservice nodes.

[0052] This table clarifies the physical meaning and data format of the input and output parameters at each level of the resource congestion awareness model, ensuring the traceability and feasibility of the model's data flow process, and providing clear parameter specifications for the deployment and implementation of the model.

[0053] In this embodiment, feature data from the network side and the gateway side are collected simultaneously through traffic monitoring of the data exchange network layer and queue monitoring of the microservice gateway layer. The temporal patterns and backlog trends of the two types of features are extracted based on the dual-branch long short-term memory network. After attention-weighted fusion, fault prediction is completed, realizing joint modeling of the underlying network communication status and gateway queuing status, and completing fault warning before the application layer resource indicators show abnormalities.

[0054] In an alternative embodiment, refer to Figures 2 to 4The traffic monitoring process captures raw data packets from the data exchange network layer according to a set time granularity, and parses the sequence number and acknowledgment number fields of the Transmission Control Protocol (TCP) header of the raw data packets. The time granularity is set to 100 milliseconds. At the end of each time granularity, the traffic monitoring process parses all raw data packets captured within that time window. First, it strips the Ethernet frame header and Internet Protocol (IP) header of the raw data packets, extracts the TCP header data, and reads the 32-bit sequence number and 32-bit acknowledgment number fields from the TCP header data. Simultaneously, it records the source IP address, destination IP address, source port number, and destination port number corresponding to each data packet. A unique communication link is identified by a four-tuple of these four-tuples. For each communication link identified by a four-tuple, retransmission rate and out-of-order rate are calculated separately to ensure that the characteristic data of different communication links are isolated from each other and to avoid interference between the transmission states of different links.

[0055] The number of repeatedly received data packets is counted based on the difference between the sequence number field and the acknowledgment number field. This, combined with the total number of data packets received within a set time granularity, yields the Transmission Control Protocol (TCP) retransmission rate. For a quadruple identifier on the same communication link, the total number of received data packets within a set time granularity T is... The data packets are sorted according to their arrival time, and the sequence number field of each packet is processed sequentially. The maximum sequence number for this link within the current time granularity is initialized. If the value is 0, iterate through each data packet i and read the sequence number of that data packet. With load length ,when When the data packet is determined to be a retransmitted data packet that has been received repeatedly, the retransmission data packet count is incremented by 1; when Update for Complete the processing of the current data packet. After traversal, count the number of retransmitted data packets within this time granularity. Transmission Control Protocol retransmission rate The calculation formula is:

[0056] in, This represents the transmission control protocol retransmission rate of the current communication link within a set time granularity. This sets the number of retransmitted data packets for this communication link within a given time granularity. This sets the total number of data packets received by the communication link within a given time granularity.

[0057] The message out-of-order rate is calculated based on the number of out-of-order arrivals in the sequence number field combined with the total number of data packet arrivals within a set time granularity. For a quadruple identifier on the same communication link, the total number of data packet arrivals within a set time granularity T is... Record the sequence number of each data packet in the order of its arrival time. Simultaneously record the payload length corresponding to each data packet. Initialize the current desired sequence number. The unordered arrival count is initialized to 0. The process begins with the second arriving data packet. For the k-th arriving data packet (k≥2), if... If it arrives out of order, it is considered an out-of-order arrival, and the out-of-order arrival count is incremented by 1; if Then update for Complete the processing of the current data packet. After the traversal is complete, count the total number of unordered arrivals within this time granularity. Message out-of-order rate The calculation formula is:

[0058] in, This represents the out-of-order message rate of the current communication link within a set time granularity. To define the total number of out-of-order message arrivals on this communication link within a given time granularity, This sets the total number of data packets arriving on this communication link within a given time granularity.

[0059] The current length of the receive buffer queue corresponding to each service interface in the microservice gateway is read and used as the raw value for the request queue depth. The request scheduling module of the microservice gateway maintains an independent receive buffer queue for each service interface. This queue stores user requests that have not yet been forwarded to backend service nodes. The current length of the queue represents the number of requests waiting to be processed in the current time step. The maximum queue length is determined by the gateway's configuration parameters. When the queue length reaches its maximum, new requests will be discarded. The queue monitoring component synchronously reads the current length of the receive buffer queues corresponding to all service interfaces according to the set time granularity through the gateway's built-in extended interface. It also records the service interface identifier information and collection timestamp corresponding to each queue length value. The service interface identifier information is a unique identity assigned to the service interface in the service registry, possessing global uniqueness.

[0060] The raw values ​​of the request queue depth are aggregated based on the service interface identification information to construct a request queue depth matrix with the service interface identification information as the row index and the time step as the column index. L consecutive time steps constitute a feature sequence window, where L is the same as the input sequence length of the Long Short-Term Memory network, set to 30. For each time step within the sequence window, the raw values ​​of the request queue depth corresponding to M service interfaces are collected, and a request queue depth matrix D of dimension M×L is constructed. The row index of the matrix is ​​the unique identification information of the M service interfaces, and the column index is the L consecutive time steps within the sequence window. This represents the original request queue depth of the m-th service interface at time step l. For service interfaces that have not collected valid data within the sequence window, the elements in the corresponding row are initialized to null values, awaiting subsequent filling.

[0061] The request queue depth matrix is ​​padded with a mean, and this padded matrix is ​​then used as the gateway-side input feature to the resource congestion awareness model. For each row vector in the request queue depth matrix, which represents the queue depth data within the sequence window corresponding to each service interface, the number of non-empty values ​​in that row is counted, along with the sum of the non-empty values. The arithmetic mean of this row is calculated using the following formula:

[0062] in, Let m be the set of valid time steps for the m-th service interface within the sequence window. The number of elements is , This is the arithmetic mean of the queue depths of the m-th service interface within the sequence window. Replace all null elements in that row of the matrix with the calculated arithmetic mean. The filling process for that row is completed. The mean filling process for the entire matrix is ​​completed by traversing all rows of the matrix. The filled matrix does not have any null elements and can be directly used as the input feature of the gateway side to the resource congestion awareness model.

[0063] The network-side input features are expanded along the time dimension into a network-side time-series input vector set, which is then input into the first Long Short-Term Memory (LSTM) network. The network-side input features are the Transmission Control Protocol (TCP) retransmission rate and message out-of-order rate for each time step. The input data for each time step is a 2D vector, and the sequence window length is L. Therefore, the network-side time-series input vector set is... Each of them This is a 2D vector, corresponding to the network-side input feature data at the l-th time step. The first Long Short-Term Memory network is a single-layer unidirectional structure with 64 hidden layer neurons. The length of the input sequence is the same as the feature sequence window length L, the input feature dimension is 2, and the output feature dimension is 64.

[0064] In each time step of the first Long Short-Term Memory (LSTM) network, the current time-step vector of the network's time-series input vector group is concatenated with the hidden state of the previous time step. A candidate state value is calculated through the input gate, and the historical cell states are forgotten through the forget gate. The cell state of the current time step is then updated, and the cell state is mapped to the network's hidden layer feature vector through the output gate. The calculation process for the input gate, forget gate, candidate cell state value, cell state, output gate, and hidden state of the first LSM network in the l-th time step is as follows:

[0065] Input gate The calculation formula is:

[0066] Forgotten Gate The calculation formula is:

[0067] Cell state candidate values The calculation formula is:

[0068] Current time step cell state The calculation formula is:

[0069] Output gate The calculation formula is:

[0070] Current time step hidden state The calculation formula is:

[0071] Where σ is the sigmoid activation function, which is used to map the gated output to the interval between 0 and 1 to control the information transmission; This is the Hadamard product operation, used to perform element-wise multiplication of matrix elements; , , , These are the weight matrices corresponding to the input vectors, with dimensions of 64×2, 64×2, 64×2, and 64×2, respectively. , , , This is the weight matrix corresponding to the hidden state of the previous time step, with dimensions of 64×64; , , , These are the bias vectors for the corresponding gates, each with a dimension of 64×1; For the first The hidden states at each time step have a dimension of 64×1; For the first The cell states at each time step are represented, with a dimension of 64×1. At the last time step L of the sequence, the hidden states are output. This refers to the feature vector of the hidden layer on the network side, which is the feature vector of the temporal change pattern, with a dimension of 64×1.

[0072] The gateway-side input features are expanded along the time dimension into a gateway-side time-series input vector set, which is then input into the second Long Short-Term Memory (LSTM) network. The gateway-side input features are mean-padded request queue depth matrices. The input data at each time step is an M-dimensional vector, corresponding to the request queue depth values ​​of M service interfaces at that time step. The sequence window length is L. Therefore, the gateway-side time-series input vector set is... Each of them The vector is M-dimensional, corresponding to the gateway-side input feature data at the l-th time step. The second Long Short-Term Memory network is a single-layer unidirectional structure with 64 hidden layer neurons, consistent with the hidden layer dimension of the first Long Short-Term Memory network. The length of the input sequence is consistent with the length L of the feature sequence window. The input feature dimension is M, and the output feature dimension is 64.

[0073] In the second Long Short-Term Memory (LSTM) network, a queue state transition bias term is introduced. The current time step vector of the gateway-side time-series input vector group is added to the queue state transition bias term and then input into the forget gate. The cell state update amplitude of the second LSM network is adjusted based on the output of the forget gate, and the gateway-side hidden layer feature vector containing the queue backlog trend is extracted. (Queue state transition bias term) Let be an M-dimensional vector, where each dimension represents the average rate of change of queue depth for the corresponding service interface in historical training data. This average rate of change is calculated as the arithmetic mean of the queue depth differences between adjacent time steps in the historical sequence data, and is used to characterize the inherent trend of queue depth changes for the corresponding service interface. At each time step l, the gateway-side input vector for the current time step is... With queue state transition bias term By adding elements one by one, we obtain the adjusted input vector. ,Will The forgetting gate, input into the second long short-term memory network, is calculated using the following formula:

[0074] in, The input vector weight matrix corresponding to the forgetting gate of the second long short-term memory network has a dimension of 64×M; The weight matrix of the hidden state of the previous time step corresponding to the forgetting gate of the second long short-term memory network is 64×64. This is the basic bias vector of the forgetting gate in the second long short-term memory network, with a dimension of 64×1; For the second long short-term memory network The hidden states at each time step have a dimension of 64×1. The computational logic for the input gates, candidate cell states, cell states, output gates, and hidden states of the second Long Short-Term Memory network is consistent with that of the first Long Short-Term Memory network, except that the input vector is replaced with the original gateway-side input vector. Output via the adjusted forget gate The update amplitude of cell states is adjusted. When the queue depth shows a continuous increasing trend, the output value of the forget gate is reduced to decrease the forgetting of historical queue backlog states and enhance the feature extraction of queue backlog trends. At the last time step L of the sequence, the hidden state is output. This is the hidden layer feature vector on the gateway side, which is also the queue backlog trend feature vector, with a dimension of 64×1.

[0075] Table 2. Correspondence between Transmission Control Protocol Header Field Parsing and Feature Calculation

[0076] Serial number field 32-bit The sequence number that identifies the first byte in the current message data segment, used to identify the message's position in the data stream. Retransmission statistics and out-of-order message determination serve as the core basis for calculating retransmission rate and out-of-order rate. Confirmation number field 32-bit The sequence number that identifies the first byte of the next message the receiver expects to receive, used to acknowledge received message data. It assists in verifying the continuity of message transmission and, in conjunction with the sequence number field, enables accurate determination of retransmitted messages. Data offset field 4 people The Transmission Control Protocol (TCP) header is 4 bytes long and is used to locate the start of a data segment. Accurately strip the Transmission Control Protocol header, extract the message payload length, and verify the continuity of the auxiliary sequence number. Flag field 6 people It contains six flag bits: URG, ACK, PSH, RST, SYN, and FIN, used to identify the transmission control type of the message. Filter out abnormal control messages, calculate retransmission rate and out-of-order rate only for data transmission messages, and eliminate invalid data interference. Window size field 16-bit Identifies the receiver's receive window size for flow control. This analysis assists in understanding network congestion and provides reference data for feature validity verification.

[0077] This table clarifies the correspondence between each field in the Transmission Control Protocol header and the calculation of retransmission rate and out-of-order rate, providing a clear implementation basis for the calculation of input features on the network side and ensuring the reproducibility and accuracy of the feature calculation process.

[0078] In this embodiment, the retransmission rate and out-of-order rate are accurately calculated by parsing the sequence number and acknowledgment number fields in the Transmission Control Protocol header. The request queue depth matrix is ​​constructed by aggregating service interface identifiers and missing values ​​are filled. The network-side temporal features and gateway-side backlog trend features are extracted by a dual-branch long short-term memory network. The second long short-term memory network introduces a queue state transition bias term to enhance the perception of queue backlog trends, providing a high-quality feature foundation for subsequent feature fusion and fault prediction.

[0079] In an alternative embodiment, refer to Figure 5 The extracted temporal variation pattern feature vector and the queue backlog trend feature vector are weighted and fused using an attention mechanism, and a scaled dot product attention structure is used to complete the feature fusion process. The temporal variation pattern feature vector is used as the query vector Q, and the queue backlog trend feature vector is used as the key vector K and value vector V. The dimensions of the query vector Q, key vector K, and value vector V are all 1. ,in The dimension of the feature vector is set to 64, consistent with the number of hidden layer neurons in the Long Short-Term Memory network.

[0080] The attention score matrix is ​​obtained by multiplying the transpose of the query vector and the key vector. To avoid the vanishing gradient problem of the softmax function due to excessively large inner product values ​​when the vector dimension is high, a scaling factor is introduced during the calculation. The scaling factor is the square root of the feature dimension. The formula for calculating the attention score matrix S is as follows:

[0081] in, Let K be the transpose matrix of the key vector K, with dimension 1. , This is a scaling factor used to scale the vector inner product result, ensuring the numerical stability of the attention score.

[0082] The attention rating matrix is ​​subjected to softmax normalization. The normalized attention rating matrix is ​​then multiplied by the value vector to obtain the attention weight feature vector. Softmax normalization maps all elements of the attention rating matrix to the interval 0 to 1, and the sum of all elements is 1, resulting in the attention weight matrix A. The calculation formula is as follows:

[0083] in, Let be the j-th element of the attention scoring matrix S, and exp be the natural exponential function. Multiplying the attention weight matrix A by the value vector V yields the attention weight feature vector. The calculation formula is:

[0084] Attention weight feature vector The dimension is The value of each dimension incorporates the weight information of the corresponding dimension in the queue backlog trend feature vector. The weight is determined by the correlation between the time-series change pattern feature vector and the queue backlog trend feature vector.

[0085] The attention weight feature vector and the temporal variation pattern feature vector are concatenated to obtain a fused feature vector. The concatenation operation is performed along the channel dimension, combining the two dimensions... The feature vectors are concatenated into a single dimension. The fused feature vector F is calculated using the following formula:

[0086] in, The concatenation function is a channel-dimensional function that integrates the feature vector F, which contains both the original feature information of the network-side temporal variation pattern and the gateway-side queue backlog trend feature information after attention weighting, thus achieving deep fusion of the two types of features.

[0087] After calculating the Transmission Control Protocol (TCP) retransmission rate and message out-of-order rate, the source and destination Internet Protocol (IP) addresses of the original data packets are extracted. Based on these addresses, a communication link adjacency matrix for the microservice nodes is constructed. Each service node in the microservice cluster corresponds to a unique IP address. The total number of nodes in the cluster is N, and the construction dimension is [missing information]. undirected adjacency matrix , where matrix elements This represents the weight attribute of the communication link from source node p to destination node q. For each original data packet, its source and destination Internet Protocol (IP) addresses are extracted and mapped to the corresponding node numbers p and q, respectively, thus completing the correspondence between nodes and communication links.

[0088] Transmission Control Protocol (TCP) retransmission rate and message out-of-order rate are used as weight attributes for the corresponding edges in the adjacency matrix of the communication links between microservice nodes. For the communication link between node p and node q, if there are valid communication messages within a set time granularity, the TCP retransmission rate of that link within the current time granularity is calculated. With message out-of-order rate Corresponding elements in the adjacency matrix The value is Where 0.6 and 0.4 are the weighting coefficients for retransmission rate and out-of-order rate, respectively; if there are no valid communication messages between node p and node q within the set time granularity, then The value is 0. Simultaneously, a dimension of is constructed. degree matrix degree matrix It is a diagonal matrix, where the diagonal elements are... Adjacency matrix The sum of all elements in the p-th row represents the communication connectivity of the corresponding node.

[0089] Spatial features are aggregated from the adjacency matrix of communication links between microservice nodes with weighted attributes using a graph convolutional network (Graph Convolutional Network). The aggregated spatial feature vector replaces the input features on the network side. A two-layer Graph Convolutional Network is used to complete the spatial feature aggregation. The layer propagation formula for the Graph Convolutional Network is as follows:

[0090] in, I is The identity matrix is ​​used to add self-loop features to nodes, preventing the loss of node feature information during the aggregation process; for The corresponding degree matrix is ​​a diagonal matrix; For the first The input feature matrix of the layer has a dimension of ,in For the first The number of feature channels in the layer; Let be the trainable weight matrix of the l-th layer, with dimension . ,in For the first The number of feature channels in the layer; σ is the ReLU activation function, used to introduce a non-linear transformation. The input feature matrix of the first layer of the graph convolutional network. Let be the initial feature matrix of the nodes, with dimension . Each row vector is a 2D vector composed of the average retransmission rate and average out-of-order rate of the corresponding node within a set time granularity. The number of output channels of the first layer of the graph convolutional network is set to 32, and the number of output channels of the second layer of the graph convolutional network is set to 64. The feature matrix output by the two layers of graph convolutional networks. The dimension is N×64, for Global average pooling is performed to obtain a spatial feature vector with a dimension of 1×64. This spatial feature vector replaces the original network-side input features and is then input into the first long short-term memory network for temporal feature extraction.

[0091] After constructing a request queue depth matrix with service interface identifiers as row indexes and time steps as column indexes, the service registry is queried to obtain the service priority tag corresponding to each service interface identifier. The service registry is used for the registration, discovery, and configuration management of all service interfaces within the microservice cluster. Each service interface is configured with a corresponding service priority tag during registration. The priority tag identifies the business importance of the service interface, and there are three priority tags: P0, P1, and P2. P0 represents core business interfaces, P1 represents important business interfaces, and P2 represents ordinary business interfaces. The queue monitoring component uses the open interface of the service registry to batch query the service priority tags corresponding to all service interface identifiers, establishing a mapping relationship between service interface identifiers and priority tags.

[0092] A priority weight diagonal matrix is ​​generated based on service priority tags. Corresponding weight values ​​are assigned to different priority tags: P0 tag corresponds to a weight of 1.5, P1 tag to a weight of 1.0, and P2 tag to a weight of 0.5. The weight values ​​are positively correlated with the business importance of the service interface. Changes in queue depth for core business interfaces have a greater impact on fault prediction, therefore, higher weight values ​​are assigned to them. The construction dimension is... Priority weight diagonal matrix diagonal elements Let be the weight value corresponding to the m-th service interface. All other off-diagonal elements of the matrix are 0 to ensure that the weight processing of different service interfaces is independent and there is no cross-interference.

[0093] Perform matrix multiplication between the priority weight diagonal matrix and the request queue depth matrix to obtain the weighted request queue depth matrix. The matrix multiplication operation is performed according to standard matrix multiplication rules. The calculation formula is:

[0094] Where D is the original request queue depth matrix, with dimension 1. , This is a priority weight diagonal matrix with dimension 1. The weighted request queue depth matrix obtained by calculation Dimensions Each element is the product of the original queue depth value and the corresponding weight value of the corresponding service interface, which realizes the differentiated weighted processing of the queue depth features of service interfaces with different priorities.

[0095] The weighted request queue depth matrix is ​​padded with a mean, and the padded matrix is ​​used as the input feature of the gateway. The logic of the mean padding is the same as in the previous embodiment. For each row vector in the weighted request queue depth matrix, the arithmetic mean of the non-empty values ​​in that row is calculated, and all empty elements in that row are replaced with the arithmetic mean to complete the full matrix padding. The padded weighted request queue depth matrix has no empty elements and can be directly used as the input feature of the gateway to the second long short-term memory network for queue backlog trend extraction.

[0096] After concatenating the current time step vector of the network-side time series input vector group with the hidden state of the previous time step, the absolute values ​​of the retransmission rate difference and the out-of-order rate difference between adjacent time steps are extracted from the network-side time series input vector group. For the network-side time series input vector group... In the At each time step, the retransmission rate at the current time step is... The disorder rate The retransmission rate of the previous time step The disorder rate Calculate the absolute value of the retransmission rate difference between adjacent time steps. The absolute value of the difference in disorder rate between adjacent time steps The absolute value of the difference is used to characterize the fluctuation range of network features between adjacent time steps. The larger the absolute value of the difference, the higher the degree of abrupt change in the network state.

[0097] The fluctuation characteristic scalar is obtained by adding the absolute value of the retransmission rate difference to the absolute value of the out-of-order rate difference. The calculation formula is The value of the fluctuation characteristic scalar ranges from 0 to 2. The larger the value, the higher the degree of fluctuation of the network state between adjacent time steps, and the greater the possibility of a sudden change in the network state.

[0098] The fluctuation feature scalar is multiplied by a preset fluctuation coefficient and then added to the bias term of the forgetting gate. The forgetting ratio of historical cell states is updated based on the added bias term of the forgetting gate. The preset fluctuation coefficient λ is set to 0.8 to adjust the influence of the fluctuation feature scalar on the forgetting gate bias term. The fluctuation feature scalar is multiplied by the preset fluctuation coefficient and then added to the original bias term of the forgetting gate of the first long short-term memory network. In the middle, the adjusted forget gate bias term is obtained. The adjusted formula for calculating the forgetting gate in the First Long Short-Term Memory Network is as follows: When the network state undergoes a sudden change, the value of ΔF increases, the bias term of the forget gate increases, the output value of the forget gate increases, the proportion of forgetting historical cell states is increased, the feature extraction of the current network state is strengthened, the interference of historical stationary state features on the feature extraction of the current sudden state is reduced, and the model's response speed to network state changes is improved.

[0099] Table 3. Correspondence between Service Priority Tags and Weights

[0100] P0 Core business interfaces 1.5 Core transaction interfaces such as payment transactions, order creation, and inventory deduction. P1 Important business interfaces 1.0 Important interfaces such as user information query, product list display, and login authentication. P2 Standard business interface 0.5 Common interfaces such as log reporting, behavior statistics, and non-core data queries

[0101] This table clarifies the weight values ​​and applicable scenarios corresponding to different service priority labels, providing a clear implementation basis for the weighted processing of the request queue depth matrix, and ensuring that the queue status changes of core business interfaces receive higher attention during feature extraction.

[0102] In this embodiment, the weighted fusion of network-side and gateway-side features is achieved through a scaling dot product attention mechanism, the spatial feature aggregation of microservice node communication links is achieved through a graph convolutional network, the weighted processing of request queue depth is achieved through a service priority weight matrix, and the forget gate bias term of the long short-term memory network is adjusted through a fluctuation feature scalar. This further enhances the model's ability to perceive network spatial propagation features, business priority differences, and network state changes, and improves the richness of feature representation.

[0103] In an alternative embodiment, refer to Figure 6After concatenating the attention weight feature vector with the temporal variation pattern feature vector to obtain a fused feature vector, this fused feature vector is input into a fully connected classifier layer to calculate the initial value of the fault occurrence probability. The fully connected classifier layer consists of two fully connected layers. The first fully connected layer has an input dimension of 128, consistent with the dimension of the fused feature vector, and an output dimension of 32, using the ReLU activation function for non-linear transformation. The second fully connected layer has an input dimension of 32 and an output dimension of 1, using the sigmoid activation function for output mapping. The fused feature vector is input into the first fully connected layer for dimension compression and non-linear transformation, resulting in an intermediate feature vector of dimension 1×32. This intermediate feature vector is then input into the second fully connected layer, mapped to the 0-1 interval using the sigmoid activation function, and outputs the initial value of the fault occurrence probability. The initial value of the failure probability is positively correlated with the likelihood that a microservice node will experience resource exhaustion failure.

[0104] The system retrieves the current runtime timestamp of the microservice cluster and queries a pre-established set of baseline thresholds for fault probability corresponding to multiple time segments. The runtime timestamp is the system time at which fault prediction is executed, accurate to the hour, used to match the corresponding time segments. The pre-established set of baseline thresholds for fault probability is constructed based on historical business traffic data of the microservice cluster. A 24-hour day is divided into multiple consecutive time segments, each one hour long, for a total of 24 time segments. For each time segment, the number of historical fault occurrences and the number of normal operations within that segment are statistically analyzed. The optimal baseline threshold for fault probability is determined through receiver operating characteristic (ROC) curve analysis. The criterion for the optimal threshold is that the difference between the true positive rate and the false positive rate of fault prediction reaches its maximum at that threshold. The baseline thresholds corresponding to all time segments constitute the set of baseline thresholds for fault probability. This set is periodically updated according to changes in the business traffic of the microservice cluster to ensure the adaptability of the thresholds.

[0105] Match the target baseline threshold corresponding to the running timestamp from the set of failure probability baseline thresholds. Parse the hour corresponding to the current running timestamp to determine the time segment to which the timestamp belongs, and extract the baseline threshold corresponding to that time segment from the set of failure probability baseline thresholds as the target baseline threshold for this failure prediction. For scenarios where business traffic exhibits significant cyclical variations, the dimensions for dividing time segments can be expanded to include different dates and hours within a week, further improving the match between baseline thresholds and business traffic characteristics.

[0106] The initial probability of failure is compared with a target baseline threshold. When the initial probability of failure is greater than the target baseline threshold, a prediction of resource exhaustion failure in the microservice node is output. Specifically, the initial probability of failure is... Compared with the target baseline threshold When performing numerical comparisons, When a microservice node is determined to be facing resource exhaustion within a preset timeframe, the system outputs the corresponding prediction result, along with the associated node identifier, communication link information, and service interface identifier, providing a reference for subsequent fault localization and handling. When a microservice node is determined to be in normal operating condition, a normal operating condition determination result is output, and no fault warning is triggered.

[0107] In this embodiment, the traffic monitoring process uses eBPF technology to capture raw data packets at the data exchange network layer. The eBPF program is attached to the traffic processing hook point of the virtual network interface card, performing preliminary filtering and parsing of data packets in kernel mode. Only the Transmission Control Protocol (TCP) messages that need processing are transmitted to the traffic monitoring process in user mode, reducing the data copy overhead between kernel mode and user mode and improving the real-time performance and efficiency of traffic collection. The queue monitoring component of the microservice gateway is implemented using the gateway's built-in filter. The filter is deeply integrated with the gateway's request scheduling module, performing queue length statistics simultaneously with requests entering the receive buffer queue, ensuring the real-time performance of queue depth data collection and avoiding feature timing deviations caused by data collection delays.

[0108] The inference process of the resource congestion awareness model is implemented using a streaming processing framework. Collected network-side and gateway-side feature data are written to a message queue in real time. The model inference service consumes feature data from the message queue, aggregates the data according to the sequence window length, performs feature preprocessing, and then inputs it into the model for inference, outputting fault prediction results. The latency of the inference process is controlled within 200 milliseconds to ensure the real-time performance of fault prediction. The model's weight parameters are stored encrypted. During deployment, the weight parameters are decrypted and loaded using a key to prevent unauthorized tampering or theft, ensuring the security of model operation.

[0109] Table 4. Baseline Thresholds for Fault Probability at Different Time Segments

[0110] 00:00-06:00 Low peak flow 0.7 06:00-09:00 Morning rush hour traffic 0.85 09:00-12:00 Off-peak traffic 0.8 12:00-14:00 Midday peak traffic 0.85 14:00-18:00 Off-peak traffic 0.8 18:00-22:00 Evening rush hour traffic 0.9 22:00-24:00 Fallback flow 0.75

[0111] This table clarifies the baseline threshold for the failure probability corresponding to time segments with different business traffic characteristics, providing a basis for dynamic adjustment of failure prediction results. It adapts to the periodic changes in microservice business traffic and avoids the problem of too many false alarms during peak traffic periods and missed alarms during off-peak traffic periods when fixed thresholds are used.

[0112] In this embodiment, the initial value of the probability of failure is calculated through a fully connected classifier layer, and the failure is determined by matching the dynamic baseline threshold of the corresponding time segment based on the running timestamp. At the same time, it integrates all the technical means of network-side spatial feature aggregation, gateway-side priority weighting, temporal feature extraction optimization and attention weighting fusion, realizes end-to-end microservice system failure prediction, adapts to the periodic changes of microservice business traffic, and improves the scenario adaptability of failure prediction.

Claims

1. A network system fault prediction method based on microservice architecture, characterized in that, include: Deploy a traffic monitoring process at the data exchange network layer to collect the transmission control protocol retransmission rate and out-of-order packet rate of the communication links between nodes in the microservice cluster in real time, and at the same time obtain the request queue depth of each service interface in the microservice gateway layer. A resource congestion awareness model is constructed, with the transmission control protocol retransmission rate and the packet out-of-order rate as network-side input features and the request queue depth as gateway-side input features. The temporal variation pattern of the network-side input features and the queue backlog trend of the gateway-side input features are extracted by a long short-term memory network. The extracted temporal variation feature vector and the queue backlog trend feature vector are weighted and fused using an attention mechanism, and the classifier outputs the prediction result that the microservice node is about to experience resource exhaustion failure.

2. The network system fault prediction method based on microservice architecture according to claim 1, characterized in that, The real-time acquisition of transmission control protocol retransmission rate and message out-of-order rate of communication links between nodes in the microservice cluster includes: the traffic monitoring process intercepts the original data packets of the data exchange network layer according to a set time granularity, and parses the sequence number field and acknowledgment number field of the transmission control protocol header of the original data packets. The number of repeatedly received data packets is counted based on the difference between the sequence number field and the acknowledgment number field, and the retransmission rate of the transmission control protocol is calculated by combining the total number of data packets received within the set time granularity. The message out-of-order rate is calculated based on the number of out-of-order arrivals in the sequence number field and the total number of data packets arriving within the set time granularity.

3. The network system fault prediction method based on microservice architecture according to claim 1, characterized in that, The process of obtaining the request queue depth of each service interface in the microservice gateway layer includes: reading the current length value of the receive buffer queue corresponding to each service interface in the microservice gateway, and using the current length value as the original value of the request queue depth; The original values ​​of the request queue depth are aggregated according to the service interface identification information to construct a request queue depth matrix with the service interface identification information as the row index and the time step as the column index. The request queue depth matrix is ​​padded with mean value, and the processed request queue depth matrix is ​​used as the gateway-side input feature and input into the resource congestion awareness model.

4. The network system fault prediction method based on microservice architecture according to claim 1, characterized in that, The step of extracting the temporal variation patterns of the network-side input features through the long short-term memory network includes: expanding the network-side input features into a network-side time-series input vector group according to the time dimension, and inputting the network-side time-series input vector group into the first long short-term memory network; In each time step of the first long short-term memory network, the current time step vector of the network-side time series input vector group is concatenated with the hidden state of the previous time step. The state candidate value is calculated through the input gate, the historical cell state is forgotten through the forget gate, the cell state of the current time step is updated, and the cell state is mapped to the network-side hidden layer feature vector through the output gate.

5. The network system fault prediction method based on microservice architecture according to claim 1, characterized in that, The step of extracting the queue backlog trend of the gateway-side input features through the long short-term memory network includes: expanding the gateway-side input features into a gateway-side time series input vector group according to the time dimension, and inputting the gateway-side time series input vector group into the second long short-term memory network; In the second long short-term memory network, a queue state transition bias term is introduced. The current time step vector of the gateway-side time series input vector group is added to the queue state transition bias term and then input into the forget gate. The cell state update amplitude of the second long short-term memory network is adjusted according to the output result of the forget gate, and the gateway-side hidden layer feature vector containing the queue backlog trend is extracted.

6. The network system fault prediction method based on microservice architecture according to claim 1, characterized in that, The step of weighted fusion of the extracted temporal change pattern feature vector and the queue backlog trend feature vector using an attention mechanism includes: using the temporal change pattern feature vector as a query vector and the queue backlog trend feature vector as a key vector and a value vector; The attention score matrix is ​​obtained by multiplying the query vector and the transpose of the key vector. The attention score matrix is ​​subjected to softmax normalization. The normalized attention score matrix is ​​multiplied by the value vector to obtain the attention weight feature vector. The attention weight feature vector is concatenated with the temporal change pattern feature vector to obtain the fused feature vector.

7. The network system fault prediction method based on microservice architecture according to claim 2, characterized in that, After calculating the Transmission Control Protocol retransmission rate and the message out-of-order rate, the method further includes: extracting the source Internet Protocol address and destination Internet Protocol address of the original data packet, and constructing a microservice node communication link adjacency matrix based on the source Internet Protocol address and the destination Internet Protocol address; The transmission control protocol retransmission rate and the message out-of-order rate are used as the weight attributes of the corresponding edges in the adjacency matrix of the microservice node communication links. Spatial feature aggregation is performed on the adjacency matrix of the communication links of the microservice nodes with the weight attributes using a graph convolutional network, and the aggregated spatial feature vector replaces the network-side input features.

8. The network system fault prediction method based on microservice architecture according to claim 3, characterized in that, After constructing a request queue depth matrix with the service interface identifier information as the row index and the time step as the column index, the method further includes: querying the service registry to obtain the service priority tag corresponding to each service interface identifier information; Generate a priority weight diagonal matrix based on the service priority tags; Perform matrix multiplication between the priority weight diagonal matrix and the request queue depth matrix to obtain the weighted request queue depth matrix; The weighted request queue depth matrix is ​​padded with mean value, and the processed weighted request queue depth matrix is ​​used as the input feature of the gateway side.

9. The network system fault prediction method based on microservice architecture according to claim 4, characterized in that, After concatenating the current time step vector of the network-side time series input vector group with the hidden state of the previous time step, the method further includes: extracting the absolute value of the retransmission rate difference and the absolute value of the out-of-order rate difference between adjacent time steps in the network-side time series input vector group. The absolute value of the retransmission rate difference is added to the absolute value of the out-of-order rate difference to obtain the fluctuation characteristic scalar. The fluctuation feature scalar is multiplied by a preset fluctuation coefficient and then superimposed on the bias term of the forget gate. The forgetting ratio of the historical cell state is updated based on the superimposed bias term of the forget gate.

10. The network system fault prediction method based on microservice architecture according to claim 6, characterized in that, After concatenating the attention weight feature vector with the temporal variation pattern feature vector to obtain a fused feature vector, the method further includes: inputting the fused feature vector into a fully connected classifier layer to calculate an initial value of the fault occurrence probability. Get the running timestamp of the current microservice cluster and query the set of failure probability baseline thresholds corresponding to multiple pre-established time segments; Match the target baseline threshold corresponding to the running timestamp from the set of fault probability baseline thresholds; The initial value of the failure occurrence probability is compared with the target baseline threshold. When the initial value of the failure occurrence probability is greater than the target baseline threshold, a prediction result of the microservice node being about to experience resource exhaustion failure is output.

Images