A method and apparatus for anomaly detection in cloud data graphs that integrates time-series awareness and location coding

Abstract

This invention discloses a cloud data graph anomaly detection method and apparatus that integrates time-series awareness and location coding. The method includes: employing time-first feature extraction, extracting deep temporal dynamic features of nodes from a constructed graph sample dataset using first-order difference and Transformer; constructing a K-nearest neighbor machine association graph based on Pearson correlation coefficient and extracting random walk location codes; inputting the deep temporal dynamic features and random walk location codes of nodes into DC-GGE, outputting the final spatiotemporal embedding of nodes; and based on the final spatiotemporal embedding of nodes, performing graph-level feature reading using global max pooling, and combining weighted cross-entropy loss to complete anomaly classification. The apparatus includes a processor and a memory. This invention solves the technical problems of difficulty in dynamic topology awareness and the easy submergence of local high-frequency anomaly signals in cloud environment operation and maintenance scenarios.

Description

Technical Field

[0001] This invention relates to the field of abnormal data detection, and in particular to a method and apparatus for detecting anomalies in cloud data graphs that integrates time-series awareness and location coding. Background Technology

[0002] Cloud data anomaly detection is one of the core tasks of cloud data network operation and maintenance management and data security assurance, and is widely used in cloud data monitoring, fault diagnosis, data security protection, and resource optimization scheduling. However, cloud data anomaly detection faces unprecedented challenges:

[0003] First, the infrastructure is highly dynamic. In microservices and containerized architectures, the lifecycle of a container instance (Pod) often lasts only a few minutes, accompanied by frequent scaling up, down, and migration. This "topology drift" phenomenon makes it difficult for traditional static graph neural networks (GNNs) to build stable physical dependencies, and they are prone to false positives due to the lag in graph structure.

[0004] Secondly, resource coupling interference is exacerbated. In multi-tenant shared cloud environments, different business loads run intertwined, easily generating "noisy neighbors." When physical machine resources (such as CPU, memory bandwidth) compete for resources, the instantaneous fluctuations of a single metric are often masked by a large amount of seemingly normal background traffic. Existing Spatiotemporal Graph Networks (STGNNs) mostly follow a "space-first" aggregation logic, which is prone to causing feature "oversmoothing" effects, making it impossible for the model to accurately identify local, subtle anomalous signals among a large number of normal nodes.

[0005] In addition, cloud data has extremely high cardinality and nonlinear characteristics. Existing mapping methods based on simple correlations (such as Pearson coefficients) are unable to capture the complex nonlinear causal dependencies between microservices, which limits the ability to diagnose cross-node cascading failures. Summary of the Invention

[0006] This invention provides a cloud data graph anomaly detection method and apparatus that integrates time-series awareness and location coding. Based on the TCPE-GatedGAD cloud data graph anomaly detection platform, this invention aims to solve the technical problems of difficulty in dynamic topology perception and easy submersion of local high-frequency anomaly signals in cloud environment operation and maintenance scenarios with limited computational overhead. Details are described below:

[0007] A first aspect is a cloud data graph anomaly detection method that integrates time-series awareness and location coding, the method comprising:

[0008] A time-first feature extraction method is adopted, and deep temporal dynamic features of nodes are extracted from the constructed graph sample dataset through first-order difference and Transformer.

[0009] A K-nearest neighbor machine association graph was constructed based on the Pearson correlation coefficient, and random walk position codes were extracted.

[0010] The deep temporal dynamic features of the nodes and the random walk position encoding are input into DC-GGE, and the final spatiotemporal embedding of the nodes is output.

[0011] Based on the final spatiotemporal embedding of nodes Global max pooling is used for graph-level feature extraction, and weighted cross-entropy loss is used to complete anomaly classification.

[0012] Specifically, the temporal-first feature extraction method extracts deep temporal dynamic features of nodes from the constructed graph sample dataset using first-order difference and Transformer:

[0013] At the single-node level, let Indicates the first The machine is at all times of To preserve the original indicator characteristics, first calculate the first-order difference of the original monitoring sequence to pre-amplify the instantaneous abrupt change points in the sequence:

[0014] The original features and the difference features are concatenated along the feature dimension to construct the enhanced node input vector. ;

[0015] The enhanced node input vector Projected via linear mapping to The relative position information of the injected time step is input into the Transformer encoder with set parameters after superimposing standard sinusoidal time position encoding in 3D space and then input into the Transformer encoder with set parameters for processing.

[0016] The output sequence of the Transformer encoder Perform time-series pooling to obtain dimension . The temporal characteristics are obtained through a linear projection matrix. This time series feature is extracted from the time series feature space. Align to graph hidden layer feature space The final generated dimension is The node's higher-order initial temporal embedding vector This serves as a deep temporal dynamic feature of the node.

[0017] The extraction of random walk position encoding is as follows:

[0018] Based on symmetric adjacency matrix degree matrix Calculate the state transition matrix :

[0019]

[0020] in, Adjacency matrix Middle node With nodes Connection weights between them;

[0021] node The structural position coding is based on the number of elements in the diagram from 1 to... The probability sequence of returning to itself after one random walk consists of:

[0022]

[0023] in, For nodes The random walk position encoding vector; For the node Departure process Return to node after one random walk The probability value; Let be any machine node in the graph. Let be the set of real numbers.

[0024] The final spatiotemporal embedding of the node is as follows:

[0025] Construct a dual-channel gating graph encoding mechanism to acquire non-normalized gating signals. ;

[0026] Based on attention weights The model updates the features and positions of the deep temporal dynamic features and random walk position codes of the nodes, respectively.

[0027] After After propagation in the layered graph network, the higher-order representations of the nodes are extracted and processed through a mapping matrix. and The final temporal and positional representations are linearly fused to obtain the final spatiotemporal embedding of the node.

[0028] The construction of a dual-channel gating graph encoding mechanism is described above, which acquires non-normalized gating signals. for:

[0029] The initial temporal features of the nodes after processing by the pre-module With position encoding Common input to In the dual-channel gated graph encoder of the layer, among which, Encode the projection matrix for learnable locations; For nodes The random walk position encoding vector;

[0030] In the In the information flow of layers, nodes are utilized With nodes Calculate the hidden state and positional features of the upper layer to obtain the nonnormalized gated signal. :

[0031]

[0032] In the formula, This represents vector concatenation. , The shared weights that can be learned in this layer. For the first Layer neighbor nodes The temporal characteristics, For the first Layer neighbor nodes Location features, For the first Layer nodes The temporal characteristics, For the first Layer nodes Locational characteristics.

[0033] The results of the feature update and position update are as follows:

[0034]

[0035]

[0036] in, and The first Nodes after layer update Temporal and positional characteristics; , , , All are the first The learnable linear transformation weight matrix of the layer; For nodes The temporal characteristics of the upper layer, For neighboring nodes The temporal characteristics of the upper layer, For nodes edge features, For neighboring nodes edge features, The normalized gating weight is used to control the aggregation strength of neighbor node information; For nodes The location features of the upper layer For nodes The location features of the upper layer This is for element-wise multiplication.

[0037] Wherein, the final spatiotemporal embedding of the node :

[0038]

[0039] in, For the process Updated nodes of the dual-channel gating graph encoder The timing representation, For the process Updated nodes of the dual-channel gating graph encoder The position is represented by d, where d is the feature dimension of the final spatiotemporal embedding vector. and For the mapping matrix, Let be the set of real numbers.

[0040] In a second aspect, a cloud data map anomaly detection device integrating time-series awareness and location coding is provided. The device includes a processor and a memory, wherein the memory stores program instructions, and the processor invokes the program instructions stored in the memory to cause the device to execute the method described in any one of the first aspects.

[0041] Third aspect, a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of the first aspects.

[0042] The beneficial effects of the technical solution provided by this invention are:

[0043] 1. Dynamic topology awareness mechanism to solve the "environment drift" problem: In response to the challenges of short container lifecycles and frequent topology changes in cloud environments, this invention abandons the traditional static graph building method and introduces dynamic K-nearest neighbor implicit graph building based on sliding windows; by calculating the correlation between nodes in real time and combining physical topology constraints, it ensures that the graph structure can evolve in real time with business traffic, effectively adapting to the dynamic start-up, shutdown and migration of containers.

[0044] 2. "Time-first" feature extraction to solve the "neighbor noise" problem: To address resource contention and background noise interference in multi-tenant environments, this invention proposes a "time-first" feature encoding strategy. Before spatial aggregation, first-order difference and Transformer depth extraction are used to extract the deep temporal dynamics of the nodes themselves. This mechanism establishes the principle of "node autonomy" in physical logic, effectively stripping away high-frequency instantaneous jitter signals and preventing them from being assimilated or submerged by the "seemingly normal" neighbor features during graph convolution.

[0045] 3. Location coding collaborative update to enhance “sparse association” capture: In view of the highly sparse and heterogeneous characteristics of the cloud environment's associated network, this invention introduces random walk location coding (RWPE) and dual-channel gated graph encoder (DC-GGE); through the joint update of location flow and semantic flow, the model can adaptively align the roles of nodes in the dynamic topology, accurately identify complex cascading faults across devices and services, and significantly improve the operational robustness of cloud data centers;

[0046] 4. Applying the cloud data graph detection results of this invention to fault diagnosis can output the abnormal probability judgment of the cluster status in real time: when the detected graph-level abnormal probability exceeds a preset threshold (e.g., 0.5), the system can immediately trigger an alarm and locate the root cause node of the abnormality; this mechanism significantly improves the fault detection rate while maintaining a high accuracy rate, effectively solving the problem of missed reports caused by weak or complex propagation of abnormal signals in traditional operation and maintenance, thereby ensuring the continuity and high availability of cloud data center services. Attached Figure Description

[0047] Figure 1 A flowchart of an overall method for anomaly detection in cloud data graphs that integrates time-awareness and location coding;

[0048] Figure 2 This is a diagram showing the overall structure of the TCPE-GatedGAD module;

[0049] Figure 3 This is a schematic diagram of the structure for time-first feature extraction;

[0050] Figure 4 This is a schematic diagram of a dual-channel gated graph encoder (DC-GGE). Detailed Implementation

[0051] To make the technical solutions and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below.

[0052] This invention provides a cloud data graph anomaly detection method that integrates time-series awareness and location encoding. The method's innovations primarily lie in two dimensions: feature encoding and spatiotemporal coordination.

[0053] First, a "time-first" feature extraction method was established in the feature encoding stage. Through a parallel architecture of first-order differential enhancement and Transformer (a deep neural network architecture based on self-attention mechanism) deep encoding, high-frequency mutation features (such as instantaneous CPU jitter) in the physical server monitoring sequence were explicitly amplified. This ensured that minute abnormal signals were fully represented before spatial aggregation, fundamentally preventing early fault symptoms from being submerged by normal data and effectively solving the problem of difficulty in early anomaly detection. Second, to suppress feature degradation, a local structure perception mechanism based on random walk position encoding (RWPE) was introduced, and a dual-channel gated graph encoder (DC-GGE) was constructed to achieve adaptive joint update of topological position prior and dynamic temporal semantics. While ensuring detection accuracy, this significantly improved the cloud data center's ability to capture cross-node cascading anomalies, solving the problem of difficulty in diagnosing cascading anomalies and concurrent faults.

[0054] Based on the above-mentioned innovative technologies, this invention constructs a graph anomaly detection framework that integrates temporal change perception and location encoding. It aims to achieve real-time identification of the operating status of cloud data centers by automatically learning cluster topology and dynamic temporal characteristics, thereby providing technical support for operation and maintenance personnel to locate faults and make decisions.

[0055] The following provides explanations of the terms used in the embodiments of the present invention, as detailed in the description below:

[0056] 1. Monitoring indicators:

[0057] Assuming the cluster contains Machines, in consecutive timestamps Below, each machine produces Monitoring indicators. This embodiment of the invention uses a sliding window mechanism to construct samples, with a time window length of [value missing]. Step size is For the first The original cluster time series characteristics of each time window can be represented as follows: ,in, This is the original temporal feature tensor within this time window. It represents the real number field (i.e., each element in the tensor is a real number).

[0058] 2. Attribute diagram:

[0059] To describe the complex dependencies in multivariate monitoring metric data, this embodiment of the invention will... Data within a time window is used to construct an attribute graph. ,in:

[0060] For a set of machine nodes, ;

[0061] It is a set of edges inferred based on correlation.

[0062] The node temporal features after first-order difference enhancement (feature dimensions are...) Expand to );

[0063] Encode the initial position of the node (using) (RWPE); RWPE is a random walk position coding method;

[0064] This represents the normalized edge weight features.

[0065] 3. Graph-level anomaly labels:

[0066] Graph-level anomaly label definition: In real-world operation and maintenance scenarios, graph-level anomaly detection can provide a macroscopic view of the system's operational status, offering greater decision-making value than single-indicator detection. Represents a node At any moment The actual state (1 represents an anomaly).

[0067] This invention embodiment will use graph-level anomaly tags. Defined as: as long as within the time window If any machine in the cluster experiences an anomaly, the graph sample is marked as an anomaly graph, i.e.:

[0068]

[0069] in, For the first in the cluster Index of physical machines. This refers to the set of machine nodes built within this time window.

[0070] Based on the above definition, the model aims to learn an end-to-end mapping function. To output the probability of anomalies in the cluster state corresponding to the current time window. . The graph anomaly detection model that integrates temporal change perception and location encoding is constructed for embodiments of the present invention. Represents the set of trainable parameters of the model. For the first The topology graph corresponding to each time window, with symbols This represents the mapping relationship from graph-structured data to scalar anomaly probabilities.

[0071] Example 1

[0072] A cloud data graph anomaly detection method integrating time-series awareness and location coding, see [link to relevant documentation]. Figures 1-4 This method comprises five core steps: cloud dataset construction and preprocessing, time-series-based feature extraction, association graph construction and local location encoding, collaborative update of dual-channel gated graph encoder, and graph-level readout and anomaly detection. The specific steps are as follows:

[0073] 101: Preprocess and slice the monitoring data of machine nodes in the cloud data center into time windows to construct an anomaly detection dataset, and divide the anomaly detection dataset into training set, validation set and test set;

[0074] This step includes three stages: data input, feature standardization, and graph sample construction, such as... Figure 1 As shown. First, multivariate monitoring metrics data for each machine node are extracted from the cloud environment (e.g., Alibaba Cluster Data v2018), including parameters reflecting hardware operating status such as physical server CPU utilization, memory utilization, network inbound and outbound traffic, and disk I / O. Second, to eliminate the differences in units between different metrics and alleviate the imbalance in data distribution, a logarithmic transformation is applied to long-tail feature sequences such as network traffic, and min-max normalization is used to uniformly map all features to the [0,1] interval. The calculation method is as follows:

[0075]

[0076] in, These are the observed values ​​of the original monitoring indicators. This represents the minimum value of the indicator within the current time window. This represents the maximum value of the indicator within the current time window.

[0077] Then, in this embodiment of the invention, the constructed anomaly detection dataset is divided into a training set, a validation set, and a test set in a 6:2:2 ratio.

[0078] Finally, to transform continuous time series data into a model-readable input format, a sliding window mechanism is used to construct graphical sample data. This is achieved by setting the time window length. (For example and sliding step size (For example The continuous time series is divided into independent analysis windows that characterize the evolution of the machine's operating state. The resulting graph sample dataset will serve as the input basis for model training and anomaly detection algorithms in subsequent steps (i.e., step 102).

[0079] 102: The "Time-first" feature extraction method is adopted to extract deep temporal dynamic features of nodes through first-order difference and Transformer;

[0080] Combination Figure 2 The "Temporal Variation-aware Encoding" part and Figure 3 This step specifically includes the following processing procedures, the main purpose of which is to avoid high-frequency weak anomalies being masked by oversmoothing effects in the early stages of graph aggregation through a "time-first" extraction method:

[0081] (1) Calculation of differential features: At the single-node level, let Indicates the first The machine is at all times of The original index characteristics are analyzed. First, the first-order difference is calculated on the original monitoring sequence to pre-amplify instantaneous abrupt changes in the sequence:

[0082]

[0083] in, Let be the characteristic of the rate of change of the index of the m-th machine at time t (i.e., the difference characteristic). For the m-th machine at the previous moment The original indicator characteristics, This is the difference compensation value at the initial time (set to 0 to maintain consistent sequence length).

[0084] (2) Feature concatenation and enhancement: The original features and the difference features are concatenated along the feature dimension to construct the enhanced node input vector. ;

[0085]

[0086] in, This is the enhanced feature dimension after concatenation (i.e., the sum of the original feature dimension F and the difference feature dimension F).

[0087] (3) Deep temporal dependency extraction: The enhanced node input vector Projected via linear mapping to The system is designed to be used in 3D space, and after superimposing standard sinusoidal time position encoding, the relative position information of the injected time step is input into a Transformer encoder with set parameters (e.g., 2 layers, 4 heads) for processing.

[0088] (4) Initial temporal embedding generation: the output sequence of the Transformer encoder Performing temporal pooling yields a dimension of The temporal characteristics. To adapt to the input requirements of graph neural networks, a linear projection matrix is ​​then used. This time series feature is extracted from the time series feature space. Align to graph hidden layer feature space The final generated dimension is The node's higher-order initial temporal embedding vector :

[0089]

[0090] in, It is a sequence of deep temporal features of nodes after processing by the Transformer encoder. It contains dynamic evolution information of the original features and difference features extracted through the self-attention mechanism. It is a learnable linear weight matrix used to project the temporal feature dimension of the Transformer output onto the hidden layer dimension of the graph neural network. This represents the total number of machine nodes currently in the monitoring window. It is the hidden layer feature dimension of the graph neural network.

[0091] This vector serves as the initial state for subsequent spatial information propagation and aggregation by the dual-channel gated graph encoder (DC-GGE).

[0092] 103: Construct a KNN (K-Nearest Neighbors) machine association graph based on Pearson correlation coefficient and extract random walk position codes (RWPE).

[0093] like Figure 1 As shown, the specific design logic of this step includes two stages: graph topology construction and local structural feature extraction.

[0094] (1) Construction of KNN machine association graph

[0095] To address the issue of cloud clusters lacking explicit physical topology, based on the current inference time... The real-time monitoring sequence at each time step calculates the values ​​between any two machine nodes. and Pearson correlation coefficient between .

[0096] Select the nodes with the highest relevance 1. 2. 3. 4. 5. 6. 7. 8. (i.e., if node j belongs to node j) The former One neighbor, then Otherwise, it is 0). Subsequently, to ensure the undirected nature of information propagation, the maximum value operation is used to... Transform into a symmetric KNN adjacency matrix (Where M is the total number of cluster machine nodes):

[0097]

[0098] in, This is the transpose of the initial asymmetric adjacency matrix, used to transform unidirectional dependencies into bidirectional symmetric connections.

[0099] The corresponding edge weight feature is defined as the correlation strength after normalization based on the global maximum absolute value. :

[0100]

[0101] In the formula, Represented by the adjacency matrix A defined set of graph edges. and Each is a set of edges The index of any two connected machine nodes. For nodes With nodes The Pearson correlation coefficient between them.

[0102] This design aims to maintain the sparsity of the network topology while preserving the strength of key spatial dependencies. Finally, the edge weights of each node are aggregated (averaged) to generate node-level edge context features. This feature will be used as an auxiliary feature input in step 104.

[0103] (2) Extraction of Random Walk Position Code (RWPE)

[0104] To enable the model to perceive extremely sparse and heterogeneous local network topologies, this embodiment of the invention introduces random walk position encoding. This is based on a symmetric adjacency matrix. degree matrix (diagonal elements) ), calculate the state transition matrix :

[0105]

[0106] in, Adjacency matrix Middle node With nodes The connection weights (0 or 1) between them.

[0107] node The structural position code is determined by its position in the figure from 1 to... Step (e.g.) The probability sequence of a random walk returning to itself is constituted as follows:

[0108]

[0109] in, For nodes The random walk position encoding vector; For the node Departure process Return to node after one random walk The probability value; Let be any machine node in the graph. Let be the set of real numbers.

[0110] This encoding will serve as the initial structural feature. It then participates in the collaborative propagation of temporal semantics in the subsequent DC-GGE (dual-channel gated graph encoder).

[0111] 104: Input the deep temporal dynamic features and random walk position encoding of the node into DC-GGE, and output the final spatiotemporal embedding of the node;

[0112] like Figure 4 As shown, the specific design logic of this step is as follows: by constructing a dual-channel gated graph encoding mechanism, while coordinating the propagation of node temporal semantics and spatial topological information, an asymmetric decoupling update strategy is used to avoid interference from local high-frequency temporal noise on graph topology learning.

[0113] First, the initial temporal features of the nodes processed by the pre-processing module are... With position encoding Common input to In the dual-channel gating encoder of the layer.

[0114] in, The learnable positional encoding projection matrix is ​​used to map the original random walk positional encoding to the same feature dimension as the node's hidden state.

[0115] In the In the information flow of layers, nodes are used first. With nodes Calculate the hidden state and positional features of the upper layer to obtain the nonnormalized gated signal. :

[0116]

[0117] In the formula, This represents vector concatenation. , The shared weights that can be learned in this layer. For the first Layer neighbor nodes The temporal characteristics, For the first Layer neighbor nodes Location features, For the first Layer nodes The temporal characteristics, For the first Layer nodes Locational characteristics.

[0118] Subsequently, attention weights for message aggregation are obtained through Sigmoid function activation and local neighborhood normalization. :

[0119]

[0120]

[0121] in, To prevent extremely small positive numbers with a denominator of zero, For nodes To the node The normalized gating weights, For neighboring nodes To the node The normalized gating weights, For nodes any of the neighboring nodes, For nodes The set of first-order neighbor nodes.

[0122] Based on attention weights The model updates the features and positions of the nodes based on their deep temporal dynamic features and random walk position encodings, respectively (e.g., ...). Figure 4 (As shown in the module on the right)

[0123]

[0124]

[0125] in, and The first Nodes after layer update Temporal and positional characteristics; , , , All are the first The learnable linear transformation weight matrix of the layer; For nodes The temporal characteristics of the upper layer, For neighboring nodes The temporal characteristics of the upper layer, For nodes edge features, For neighboring nodes edge features, The normalized gating weight is used to control the aggregation strength of neighbor node information; For nodes The location features of the upper layer For nodes The location features of the upper layer This is for element-wise multiplication.

[0126] It is worth noting that in terms of location features The update only aggregated the location information of neighbors and did not incorporate temporal features. This mathematically blocks the path of high-frequency temporal fluctuations propagating to topological features.

[0127] Finally, after After propagation in the layered graph network, the higher-order representations of the nodes are extracted and processed through a mapping matrix. and The final temporal and positional representations are linearly fused to obtain the final spatiotemporal embedding of the node. :

[0128]

[0129] in, For the process Updated nodes of the dual-channel gating graph encoder The timing representation, For the process Updated nodes of the dual-channel gating graph encoder The position is represented by d, which is the feature dimension of the final spatiotemporal embedding vector. To maintain symbol consistency, d is the same as the hidden layer dimension of the Transformer in step 102.

[0130] 105: Node-based final spatiotemporal embedding Global max pooling is used for graph-level feature extraction, and weighted cross-entropy loss is used to complete anomaly classification.

[0131] This step involves designing the model's output and optimization objective, and specifically includes the following three sub-processes:

[0132] (1) Graph-level feature reading: To address the problem that local minor anomalies are easily overwhelmed by the features of normal nodes in the whole graph, global max pooling is used instead of mean aggregation to extract the most representative anomaly signals from the high-order spatiotemporal embeddings of nodes and generate graph-level representations. :

[0133]

[0134] In the formula, It is a collection of machine nodes in a cloud cluster.

[0135] (2) Anomaly probability prediction: The above-mentioned graph-level features The data is fed into a two-layer multilayer perceptron (MLP) for nonlinear transformation, and finally output through a sigmoid function to determine the probability of system anomalies within the current time window. :

[0136]

[0137] at this time, , and , This represents the weight matrix and bias parameters of each layer of the classifier. This is used to modify the activation function of the linear unit and introduce nonlinear feature representation capabilities.

[0138] (3) Weighted loss calculation and determination: In view of the severe imbalance between normal data and abnormal data, a weighted binary cross-entropy loss (Weighted BCE) is introduced during the training process to guide model optimization:

[0139]

[0140] In the formula, This refers to the training batch size; Labels representing the actual system state; hyperparameters (For example As a positive sample weight coefficient, it is used to amplify the penalty for the model's underreporting of a few abnormal samples, thereby solving the class imbalance problem.

[0141] In the actual deployment and determination of the model, if the predicted probability... The system determines that the cluster status within the current time window is abnormal and then generates an operation and maintenance instruction. This instruction is sent to the cloud management platform through the physical network interface, driving the platform to perform fault location highlighting or automatic container restart operations, thereby completing a complete technical loop from "data awareness" to "physical control".

[0142] In summary, the embodiments of the present invention, through steps 101-105 above, significantly improve the fault detection rate while maintaining a high accuracy rate, effectively solving the problem of missed reports caused by weak or complex propagation of abnormal signals in traditional operation and maintenance, thereby ensuring the continuity and high availability of cloud data center services.

[0143] Example 2

[0144] This invention also provides a cloud data graph anomaly detection device that integrates time-series awareness and location coding. The device's logical architecture completely corresponds to the detection method in Embodiment 1, aiming to achieve intelligent monitoring of cloud service operation status through modular software entities. Referring to the technical logic of Embodiment 1, the device specifically includes:

[0145] 201: Data Acquisition and Preprocessing Module;

[0146] This module is used to collect raw monitoring metric sequences (such as CPU, memory, network I / O, etc.) from each machine node in the cloud data center. The module integrates a logarithmic transformation component, a Min-Max normalization component, and a sliding window slicing component. The logarithmic transformation component is used to perform... To compress long-tail features; a sliding window slicing component is used to slice according to a set length. =30 and step size =5 encapsulates the preprocessed sequence into a graph sample tensor with spatiotemporal properties.

[0147] 202: Feature extraction module based on a "time-first" architecture;

[0148] This module is one of the core inventive points of this invention, used to preferentially extract high-frequency temporal features of nodes before spatial aggregation. Specifically, the module consists of a first-order difference calculation unit, a feature concatenation operator, and a Transformer deep coding unit.

[0149] The first-order difference calculation unit is used to execute the formula. To capture transient mutation patterns; the feature concatenation operator fuses the difference features with the original features to obtain the augmented vector; the Transformer deep coding unit consists of a 2-layer, 4-head self-attention mechanism, which performs global correlation modeling on the augmented vector and outputs the initial temporal embedding of the node in the early stage of graph aggregation. .

[0150] 203: Topology sensing and location encoding generation module;

[0151] This module is used to perceive the extremely sparse and heterogeneous machine association topology in a cloud environment. The module includes a KNN (K-Nearest Neighbors) mapping component and a RWPE (Random Walk Position Encoding) extraction unit. The KNN implicit mapping component selects nodes based on the Pearson correlation coefficient between their indices. A neighbor (e.g.) Construct the adjacency matrix; the RWPE extraction unit is used to execute the random walk algorithm by calculating the transition matrix. Extracting nodes through 1 to Step (e.g., 10 steps) returns its own probability sequence, generating explicit local location encoding prior information. .

[0152] 204: Dual-channel gated graph encoding module (DC-GGE);

[0153] This module, another core inventive point of this invention, is used to achieve adaptive collaborative updating of temporal features and positional encoding. Internally, the module establishes a temporal semantic flow channel and a structural positional flow channel. The module utilizes edge features to generate dynamic gating signals. The temporal semantic flow channel is responsible for aggregating the hybrid spatiotemporal features of the neighborhood; the structural location flow channel strictly executes the "asymmetric update" logic, that is, it only aggregates the location encoding information of the neighborhood to prevent high-frequency temporal fluctuations from interfering with the propagation of topological features. Finally, after... Layer propagation outputs a high-order spatiotemporal embedding that incorporates topological priors.

[0154] 205: Anomaly detection and indicator reading module.

[0155] This module is used for anomaly detection across the entire graph. It integrates a Global Max Pooling component and an MLP classification head. The Global Max Pooling component extracts the maximum response score from all nodes in the graph to accurately locate subtle local anomaly signals. The MLP classification head, combined with a weighted binary cross-entropy loss function, outputs the final anomaly probability value. This enables high-precision real-time monitoring of the cloud service's operational status. In addition, the anomaly detection module is also equipped with an instruction triggering unit. When the probability of an anomaly read exceeds a preset threshold (0.5), the unit does not simply output a label, but activates the hardware execution interface to send control instructions (such as Pod eviction instructions) to the external cloud infrastructure, thereby enabling proactive control of the cloud data center's operational status.

[0156] In summary, the embodiments of the present invention, through the above steps 201-205, significantly improve the fault detection rate while maintaining a high accuracy rate, effectively solving the problem of missed reports caused by weak or complex propagation of abnormal signals in traditional operation and maintenance, thereby ensuring the continuity and high availability of cloud data center services.

[0157] Example 3

[0158] A cloud data graph anomaly detection device integrating time-awareness and location coding (i.e., a physical device carrying the TCPE-GatedGAD framework) includes: a processor (such as a multi-core CPU with a clock speed of not less than 3.80 GHz), a GPU accelerator (such as a high-performance graphics card with 24 GB or more of video memory, used for parallel computation of graph tensors and Transformers), a memory, a high-speed network input / output interface, and a communication module. The memory stores program instructions, and the processor calls the program instructions stored in the memory to make the device execute all the steps in Embodiment 1.

[0159] A time-first feature extraction method is adopted, and deep temporal dynamic features of nodes are extracted from the constructed graph sample dataset through first-order difference and Transformer.

[0160] A K-nearest neighbor machine association graph was constructed based on the Pearson correlation coefficient, and random walk position codes were extracted.

[0161] The deep temporal dynamic features of the nodes and the random walk position encoding are input into DC-GGE, and the final spatiotemporal embedding of the nodes is output.

[0162] Based on the final spatiotemporal embedding of nodes Global max pooling is used for graph-level feature extraction, and weighted cross-entropy loss is used to complete anomaly classification.

[0163] Specifically, a time-first feature extraction method is used, which extracts deep temporal dynamic features of nodes from the constructed graph sample dataset through first-order difference and Transformer:

[0164] At the single-node level, let Indicates the first The machine is at all times of To preserve the original indicator characteristics, first calculate the first-order difference of the original monitoring sequence to pre-amplify the instantaneous abrupt change points in the sequence:

[0165] The original features and the difference features are concatenated along the feature dimension to construct the enhanced node input vector. ;

[0166] The enhanced node input vector Projected via linear mapping to The relative position information of the injected time step is input into the Transformer encoder with set parameters after superimposing standard sinusoidal time position encoding in 3D space and then input into the Transformer encoder with set parameters for processing.

[0167] The output sequence of the Transformer encoder Perform time-series pooling to obtain dimension . The temporal characteristics are obtained through a linear projection matrix. This time series feature is extracted from the time series feature space. Align to graph hidden layer feature space The final generated dimension is The node's higher-order initial temporal embedding vector This serves as a deep temporal dynamic feature of the node.

[0168] The random walk position encoding is extracted as follows:

[0169] Based on symmetric adjacency matrix degree matrix Calculate the state transition matrix :

[0170]

[0171] in, Adjacency matrix Middle node With nodes Connection weights between them;

[0172] node The structural position coding is based on the number of elements in the diagram from 1 to... The probability sequence of returning to itself after one random walk consists of:

[0173]

[0174] in, For nodes The random walk position encoding vector; For the node Departure process Return to node after one random walk The probability value; Let be any machine node in the graph. Let be the set of real numbers.

[0175] The final spatiotemporal embedding of the node is as follows:

[0176] Construct a dual-channel gating graph encoding mechanism to acquire non-normalized gating signals. ;

[0177] Based on attention weights The model updates the features and positions of the deep temporal dynamic features and random walk position codes of the nodes, respectively.

[0178] After After propagation in the layered graph network, the higher-order representations of the nodes are extracted and processed through a mapping matrix. and The final temporal and positional representations are linearly fused to obtain the final spatiotemporal embedding of the node.

[0179] Among these measures, a dual-channel gating graph encoding mechanism is constructed to obtain non-normalized gating signals. for:

[0180] The initial temporal features of the nodes after processing by the pre-module With position encoding Common input to In the dual-channel gated graph encoder of the layer, among which, Encode the projection matrix for learnable locations; For nodes The random walk position encoding vector;

[0181] In the In the information flow of layers, nodes are utilized With nodes Calculate the hidden state and positional features of the upper layer to obtain the nonnormalized gated signal. :

[0182]

[0183] In the formula, This represents vector concatenation. , The shared weights that can be learned in this layer. For the first Layer neighbor nodes The temporal characteristics, For the first Layer neighbor nodes Location features, For the first Layer nodes The temporal characteristics, For the first Layer nodes Locational characteristics.

[0184] The results of feature update and position update are as follows:

[0185]

[0186]

[0187] in, and The first Nodes after layer update Temporal and positional characteristics; , , , All are the first The learnable linear transformation weight matrix of the layer; For nodes The temporal characteristics of the upper layer, For neighboring nodes The temporal characteristics of the upper layer, For nodes edge features, For neighboring nodes edge features, The normalized gating weight is used to control the aggregation strength of neighbor node information; For nodes The location features of the upper layer For nodes The location features of the upper layer This is for element-wise multiplication.

[0188] Among them, the final spatiotemporal embedding of the node :

[0189]

[0190] in, For the process Updated nodes of the dual-channel gating graph encoder The timing representation, For the process Updated nodes of the dual-channel gating graph encoder The position is represented by d, where d is the feature dimension of the final spatiotemporal embedding vector. and For the mapping matrix, The set is a real number set. This device can be flexibly deployed in the following real-world cloud operations and maintenance scenarios:

[0191] (1) Cloud-based global modeling scenario: This scenario is deployed on the core operation and maintenance platform (SaaS / PaaS layer) of the cloud data center. It relies on the computing power of high-performance GPU clusters (such as 24GB or more of video memory) and mainly undertakes model training and global topology discovery tasks. The device is connected to the network monitoring data bus and performs computationally intensive global KNN implicit graph building and dual-channel gated graph space aggregation. It uses the abundant video memory resources in the cloud to process the full graph tensor of thousands of nodes, accurately mine the complex cascading fault patterns across racks and services, and regularly generate high-precision global anomaly detection models. After pruning or quantization, the models are distributed to the edge as the baseline version.

[0192] (2) Cloud cluster node-level autonomous monitoring scenario: This device is deployed on the host node (Worker Node) of a large-scale microservice and containerized (such as Kubernetes) cluster as a node-level lightweight daemon set, providing millisecond-level diagnosis of "neighbor noise" problems caused by dynamic changes in business containers (Pods) and multi-tenant resource contention. In view of the limited computing resources of a single node, it loads a lightweight inference engine distributed from the cloud, adopts operator fusion and INT8 quantization technology, and only enables the "time-first" feature extraction mechanism during local inference. This "node autonomy" mode can capture the instantaneous jitter or local minor anomalies of the physical machine resources of the node in milliseconds. Even in the event of a cluster emergency, it can still operate independently, accurately identify the source of resource contention, and provide low-latency decision guarantee for rapid circuit breaking or Pod eviction of a single node;

[0193] (3) Cloud-Edge Collaborative Architecture Scenario: This device constructs a layered processing pipeline of "edge feature extraction - cloud-based correlation aggregation," resolving the contradiction between insufficient computing power on a single edge side and limited bandwidth on a single cloud side. On the edge side, the device only performs data cleaning and alignment and deep temporal feature extraction on a single node, compressing the high-dimensional original monitoring data into low-dimensional feature vectors (Embedding), significantly reducing uplink bandwidth usage; the cloud side aggregates the feature vectors uploaded by each edge node, performing dual-channel gated graph space aggregation and global anomaly detection. This mode effectively avoids the computing power bottleneck of running complex graph networks on the edge side, while avoiding the bandwidth pressure of uploading the original full data to the cloud, achieving the optimal balance between real-time detection and global accuracy.

[0194] Example 4

[0195] To comprehensively verify the effectiveness and robustness of the anomaly detection method proposed in this invention under real cloud environments and complex industrial scenarios, this embodiment selects representative public datasets for extensive experimental evaluation. Specifically, the Alibaba Cluster Data v2018 dataset (the 2018 version of Alibaba's tracking data) and the Server Machine Dataset (SMD) were used. Alibaba Cluster Data v2018 originates from a real cloud data center production environment and records multi-dimensional monitoring metrics (such as CPU, memory, network traffic, etc.) of physical servers in a large-scale cluster, accurately reflecting the hardware operating status and failure modes in a cloud environment. The SMD dataset, on the other hand, is collected from a long-running server cluster and contains a large number of labeled anomaly segments, serving as one of the standard benchmarks for evaluating the performance of time-series anomaly detection algorithms.

[0196] To quantify the model's detection performance, this embodiment selects the following five key evaluation metrics: AUC (Area Under Curve) measures the model's overall classification ability at different thresholds; F1 score (F1-Score) is the harmonic mean of precision and recall, comprehensively reflecting the model's balanced performance; precision assesses the proportion of samples judged as anomalous by the model that are actually anomalous; recall measures the proportion of anomalous samples successfully detected by the model out of all true anomalous samples; and accuracy reflects the overall proportion of correct predictions made by the model.

[0197] Table 1 presents the detailed experimental results of the method of the present invention on the two datasets mentioned above. The experimental data show that the present invention achieves an AUC value of 0.9067 and an F1 score of 0.8754 on the Alibaba dataset, and even reaches an AUC value of 0.9644 on the SMD dataset, which fully demonstrates the superiority and stability of the present invention in handling multivariate time series anomaly detection tasks.

[0198] Table 1. Experimental results of this invention on Alibaba Cluster Data v2018 and SMD dataset.

[0199]

[0200] The entire system supports hot-swapping of detection models, concurrent access to multi-source monitoring time-series data (such as Prometheus and Zabbix), dynamic evaluation capabilities for layered anomaly scenarios (such as Traffic Spike and Trend Drift), and can automatically export visualization and quantitative reports of detection results (CSV), seamlessly integrating into existing enterprise-level AIOps intelligent operation and maintenance platforms.

[0201] Unless otherwise specified, the model numbers of the various devices in this embodiment of the invention are not limited, and any device that can perform the above functions is acceptable.

[0202] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0203] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cloud data graph anomaly detection method integrating time-series awareness and location coding, characterized in that, The method includes: A time-first feature extraction method is adopted, and deep temporal dynamic features of nodes are extracted from the constructed graph sample dataset through first-order difference and Transformer. A K-nearest neighbor machine association graph was constructed based on the Pearson correlation coefficient, and random walk position codes were extracted. The deep temporal dynamic features of the nodes and the random walk position encoding are input into DC-GGE, and the final spatiotemporal embedding of the nodes is output. Based on the final spatiotemporal embedding of nodes Global max pooling is used for graph-level feature extraction, and weighted cross-entropy loss is used to complete anomaly classification.

2. The cloud data map anomaly detection method integrating time-series awareness and location coding according to claim 1, characterized in that, The temporal-first feature extraction method extracts deep temporal dynamic features of nodes from the constructed graph sample dataset using first-order difference and Transformer: At the single-node level, let Indicates the first The machine is at all times of To preserve the original indicator characteristics, first calculate the first-order difference of the original monitoring sequence to pre-amplify the instantaneous abrupt changes in the sequence: The original features and the difference features are concatenated along the feature dimension to construct the enhanced node input vector. ; The enhanced node input vector Projected via linear mapping to The relative position information of the injected time step is input into the Transformer encoder with set parameters after superimposing standard sinusoidal time position encoding in 3D space and then input into the Transformer encoder with set parameters for processing. The output sequence of the Transformer encoder Perform time-series pooling to obtain dimension . The temporal characteristics are obtained through a linear projection matrix. This time series feature is extracted from the time series feature space. Align to graph hidden layer feature space The final generated dimension is The node's higher-order initial temporal embedding vector This serves as a deep temporal dynamic feature of the node.

3. The cloud data graph anomaly detection method integrating time-series awareness and location coding according to claim 1, characterized in that, The extracted random walk position encoding is as follows: Based on symmetric adjacency matrix degree matrix Calculate the state transition matrix : ； in, Adjacency matrix Middle node With nodes Connection weights between them; node The structural location coding is based on the sequence of elements in the diagram from 1 to... The probability sequence of returning to itself after one random walk consists of: ； in, For nodes The random walk position encoding vector; For the node Departure process Return to node after one random walk The probability value; Let be any machine node in the graph. Let be the set of real numbers.

4. The cloud data map anomaly detection method integrating time-series awareness and location coding according to claim 1, characterized in that, The final spatiotemporal embedding of the node is: Construct a dual-channel gating graph encoding mechanism to acquire non-normalized gating signals. ; Based on attention weights The model updates the features and positions of the deep temporal dynamic features and random walk position codes of the nodes, respectively. After After propagation in the layered graph network, the higher-order representations of the nodes are extracted and processed through a mapping matrix. and The final temporal and positional representations are linearly fused to obtain the final spatiotemporal embedding of the node.

5. The cloud data map anomaly detection method integrating time-series awareness and location coding according to claim 1, characterized in that, The dual-channel gating graph encoding mechanism is constructed to obtain non-normalized gating signals. for: The initial temporal features of the nodes after processing by the pre-module With position encoding Common input to In the dual-channel gated graph encoder of the layer, among which, Encode the projection matrix for learnable locations; For nodes The random walk position encoding vector; In the In the information flow of layers, nodes are utilized With nodes Calculate the hidden state and positional features of the upper layer to obtain the nonnormalized gated signal. : ； In the formula, This represents vector concatenation. , The shared weights that can be learned in this layer. For the first Layer neighbor nodes The temporal characteristics, For the first Layer neighbor nodes Location features, For the first Layer nodes The temporal characteristics, For the first Layer nodes Locational characteristics.

6. The cloud data map anomaly detection method integrating time-series awareness and location coding according to claim 1, characterized in that, The results of the feature update and position update are as follows: ； ； in, and The first Nodes after layer update Temporal and positional characteristics; , , , All are the first The learnable linear transformation weight matrix of the layer; For nodes The temporal characteristics of the upper layer, Neighboring nodes The temporal characteristics of the upper layer, For nodes edge features, Neighboring nodes edge features, The normalized gating weight is used to control the aggregation strength of neighbor node information; For nodes The location characteristics of the upper layer For nodes The location characteristics of the upper layer This is for element-wise multiplication.

7. The cloud data map anomaly detection method integrating time-series awareness and location coding according to claim 1, characterized in that, The final spatiotemporal embedding of the node : ； in, For the process Updated nodes of the dual-channel gating graph encoder The timing representation, For the process Updated nodes of the dual-channel gating graph encoder The position is represented by d, where d is the feature dimension of the final spatiotemporal embedding vector. and For the mapping matrix, Let be the set of real numbers.

8. A cloud data map anomaly detection device integrating time-series awareness and location coding, characterized in that, The device includes a processor and a memory, the memory storing program instructions, the processor invoking the program instructions stored in the memory to cause the device to perform the method according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of claims 1-7.

Images