A time window adaptive based timing log anomaly detection method

Abstract

The application relates to the technical field of data anomaly detection, in particular to a time sequence log anomaly detection method based on an adaptive time window; operation logs of service nodes are collected, discrete operation logs belonging to the same order submission request are time sequence correlated based on request link tracking identification, and cross-service log sequences are constructed; in a basic sliding time window, link state parameters are identified for the gathered batch cross-service log sequences; the starting boundary and time span of a target analysis time window are dynamically calculated according to the link state parameters, an adaptive time window covering the cross-service abnormal calling track is generated; in the adaptive time window, the interaction link of the service node is mapped into a service calling topology network, time sequence features, propagation features and cascade blocking features are extracted, an abnormal state prediction network model is input, and the evolution probability of the service node is output; when the evolution probability exceeds a dynamic protection baseline, a non-blocking link protection instruction is generated and executed.

Description

Technical Field

[0001] This invention relates to the field of data anomaly detection technology, specifically to a time-series log anomaly detection method based on adaptive time windows. Background Technology

[0002] With the continuous evolution of digital computing and data processing technologies, distributed transaction systems based on microservice architecture are widely used in complex business scenarios. When handling massive concurrent requests, a single user operation often triggers concurrent calls to multiple underlying microservice nodes, generating massive amounts of time-series runtime logs. Analyzing these runtime logs to monitor system operation status and schedule computing resources is a key means to ensure the stability of digital computing systems.

[0003] In complex business scenarios such as combined product settlement, to ensure strong data consistency in distributed transactions, core data nodes need to hold exclusive underlying resource locks until all concurrently invoked subordinate business nodes return confirmation signals. However, in actual data processing, core data is often deducted extremely quickly, while peripheral auxiliary business nodes process it more slowly, resulting in core computing resources and underlying database connections being ineffectively occupied for extended periods, leading to idle waiting.

[0004] Existing log anomaly detection methods typically employ fixed-length time windows to segment and independently analyze continuous data streams. This mechanical segmentation mechanism has drawbacks when dealing with concurrent network calls with significant time differences: the fixed time window forcibly severs the temporal correlation between faster main processes and slower peripheral processes, fragmenting the anomaly evolution trajectory of the same cross-service call into different data observation slices. This physical disruption of the cross-service anomaly propagation chain prevents the monitoring system from extracting the temporal causal relationship between underlying resource lock occupancy and subsequent global response timeouts.

[0005] Because it's impossible to accurately pinpoint which specific edge node is causing the core computing power to idle within a complex microservice call network, existing systems typically only trigger a response passively after a large number of timeout errors occur on the core node. This delayed intervention easily misjudges normal business traffic spikes as system failures, making it impossible to accurately degrade and isolate the lagging nodes in the early stages. Ultimately, this often results in global blocking and rate limiting, causing a large number of normal transaction requests to be rejected, leading to a waste of computing resources and widespread rollback of underlying transactions.

[0006] To address this, a time-series log anomaly detection method based on adaptive time windows is proposed. Summary of the Invention

[0007] The purpose of this invention is to provide a time-series log anomaly detection method based on adaptive time windows, which identifies the evolution probability of service nodes through an anomaly state prediction network model; when the evolution probability exceeds the dynamic protection baseline, a non-blocking link protection command is generated and executed.

[0008] To achieve the above objectives, the present invention provides the following technical solution: A time-series log anomaly detection method based on adaptive time windows includes: Collect the operation logs of the service nodes, and based on the request link tracing identifier, associate the discrete operation logs belonging to the same order submission request in a time sequence to construct a cross-service log sequence; Within the basic sliding time window, for the aggregated batch cross-service log sequences, identify the link status parameters used for dynamic scaling of the time window; the link status parameters include at least the data request density, the duration of the persistent lock wait, and the depth of anomaly propagation; Based on the link status parameters, the starting boundary and time span of the target analysis time window are dynamically calculated to generate an adaptive time window covering the cross-service abnormal call trajectory. Within the adaptive time window, the interaction links of service nodes are mapped to a service call topology network, and time-series features, propagation features, and cascading obstruction features containing combined product dependencies are extracted. The extracted features are input into a preset abnormal state prediction network model, and the output is the evolution probability of the interaction link of the service node transforming into an abnormal state within a preset time period in the future; when the evolution probability exceeds the dynamic protection baseline, a non-blocking link protection instruction for scheduling is generated and executed.

[0009] Preferably, the process of constructing a cross-service log sequence includes: Obtain the operation logs output by the gateway node, order node, and inventory node; extract information from the operation logs using a structured parsing engine to obtain structured log fields containing log generation timestamps, request tracing identifiers, node interface names, call execution time, and upstream and downstream call relationships; Using the request tracing identifier as the primary key, the structured log fields that are discretely distributed across various service nodes are aggregated. Under the same request tracing identifier, the structured log fields with clear upstream and downstream call relationships are sequentially concatenated according to the order of the log generation timestamps to generate a complete cross-service log sequence that records the flow path and timing status of a single order submission across various service nodes.

[0010] Preferably, the identified link status parameters specifically include: Calculate the total number of cross-service log sequences for product objects within the basic sliding time window and output the data request density parameter. Extract the timestamp of the resource locking execution of the inventory node in the cross-service log sequence, calculate the time difference between the current observation time and the resource locking timestamp, and output the parameter of the continuous lock waiting time. Based on the concurrent call branch data initiated by the gateway node in the cross-service log sequence, the main transaction branch responsible for locking the core underlying data and the other edge branches are parsed and distinguished; the return time of the main transaction branch is extracted, and the expected time of the edge branches that have not yet returned is identified; The edge branch with the longest expected execution time is defined as the edge bottleneck branch; the execution time range between the main transaction branch and the edge bottleneck branch is calculated to generate an anomaly propagation depth parameter that reflects the degree of concurrent fan-out dispersion; The link state parameters are generated by combining the data request density parameter, the duration of the persistent lock wait parameter, and the anomaly propagation depth parameter.

[0011] Preferably, the process of generating an adaptive time window covering cross-service abnormal call trajectories includes: The generated link status parameters are compared with a preset security threshold; when the abnormal propagation depth parameter is determined to exceed the security threshold, the time boundary recalculation engine is triggered. The starting boundary of the target analysis time window remains unchanged as the initial start time of the main trading branch, while the ending boundary of the target analysis time window is stretched towards the future time direction. Lock the edge branch until the edge branch log shows that the execution has ended or a timeout has occurred. Use this time as the adjusted termination boundary to generate an adaptive time window that can fully encompass the entire lifecycle of the main transaction branch and the edge branch.

[0012] Preferably, the process of extracting temporal features, propagation features, and cascade hindrance features includes: Traverse all cross-service log sequences within the adaptive time window, map the central node initiating concurrent calls and the edge node receiving calls to topology entity nodes; map concurrent call relationships to directed communication edges, and construct a service call topology network that presents concurrent fan-out and aggregation states; In the service call topology network, the receiving call node pointed to by the edge short branch is identified as the edge short node with the longest time consumption during the settlement of combined goods; The time it takes for the main trading branch to complete core processing and the time it takes for the main trading branch to release synchronization waiting are obtained, and the time difference between the two is taken as the waiting idle time. The waiting idle time is used as a cascaded hindrance feature, which is concatenated with the execution time range of adjacent events as a timing feature and the number of abnormal propagation hops as a propagation feature to output a comprehensive feature tensor.

[0013] Preferably, the process of identifying abnormal states based on the abnormal state prediction network model includes: The generated comprehensive feature tensor is input into a graph attention neural network model pre-trained using historical fault map data; In the hidden layer of the graph attention neural network model, the correlation between the numerical distribution of the cascaded blocking features and the deadlock risk is learned through the self-attention allocation mechanism, thereby improving the contribution of the cascaded blocking features of the edge bottleneck nodes to the risk assessment value. Combining the topological network structure characteristics and temporal characteristics after weighting parameters, forward propagation is performed through the fully connected layer of the graph attention neural network model to calculate the risk assessment value of global distributed transactions being forced to roll back due to execution lag of local edge bottleneck nodes and deadlock events in the underlying database. The risk assessment value is output as the evolution probability of the target abnormal state.

[0014] Preferably, the evolution probability of the monitoring output is compared with the dynamic protection baseline; when the value of the evolution probability is greater than the dynamic protection baseline, the defense scheduling engine is activated. For the identified edge bottleneck nodes that cause global waiting, the corresponding service degradation isolation policy is extracted from the scheduling policy library, and a non-blocking link protection instruction is generated. Non-blocking link protection commands are sent to the corresponding service node control panel, downgrading the original synchronous strong consistency verification scheduling mode of the edge short-board node to an asynchronous delayed processing mode, thus completing the logical isolation and computing power release of the abnormal call link.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention introduces a dynamic time boundary calculation mechanism based on link state parameters. When an anomaly propagation depth is detected to exceed the safety limit, the settlement action of the current time window is automatically suspended. The initial start time of the main transaction branch is maintained unchanged at the starting boundary, and the termination boundary is continuously stretched towards the future time direction until the termination time of the edge bottleneck branch is accurately anchored and locked. This mechanism successfully constructs an adaptive time window that can encompass the entire lifecycle of the backbone and bottlenecks, eliminating the risk of abnormal evolution trajectory breakage caused by mechanical segmentation, ensuring the integrity of the causal chain of cross-microservice calls and the continuity of monitoring data, and reducing the risk of hidden congestion and missed detection.

[0016] 2. This invention proposes a mechanism for extracting cascading bottleneck features. By mapping the interaction links to a service call topology network, it accurately identifies the edge bottleneck nodes with the longest processing time. The time difference between the time the main transaction branch completes its core processing and the time it takes to release synchronization waiting is used as the waiting idle time. This effectively filters out the illusion of normal computational time consumption within the microservice itself, providing a topology input with high discriminative power for the prediction model.

[0017] 3. This invention leverages an anomaly state prediction network model to autonomously learn and weight cascading congestion features. This allows it to deduce the probability of an interactive link transforming into an abnormal deadlock state before a local congestion escalates into a global distributed transaction rollback. When the risk exceeds the dynamic protection baseline, a non-blocking link protection command is issued to the specific edge node causing the congestion, forcibly downgrading its original synchronous strong consistency check scheduling mode to an asynchronous delayed processing mode. While severing the edge node's synchronous binding to the main transaction branch, it also immediately releases the underlying exclusive write lock. The entire defense process does not discard real transaction data nor interrupt the core backbone network, thus preventing global lock-waiting resource blocking and transaction rollback risks. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a time-series log anomaly detection method based on an adaptive time window according to the present invention. Figure 2 This is a logical schematic diagram of a time-series log anomaly detection method based on an adaptive time window according to the present invention; Figure 3 This is a schematic diagram of the abnormal state prediction network model of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example 1: This invention proposes a time-series log anomaly detection method based on adaptive time windows. The process of the method is as follows: Figure 1 As shown, the logic of the method is as follows: Figure 2 As shown, it specifically includes: Collect the operation logs of the service nodes, and based on the request link tracing identifier, associate the discrete operation logs belonging to the same order submission request in a time sequence to construct a cross-service log sequence; Within the basic sliding time window, for the aggregated batch cross-service log sequences, identify the link status parameters used for dynamic scaling of the time window; the link status parameters include at least the data request density, the duration of the persistent lock wait, and the depth of anomaly propagation; Based on the link status parameters, the starting boundary and time span of the target analysis time window are dynamically calculated to generate an adaptive time window covering the cross-service abnormal call trajectory. Within the adaptive time window, the interaction links of service nodes are mapped to a service call topology network, and time-series features, propagation features, and cascading obstruction features containing combined product dependencies are extracted. The extracted features are input into a preset abnormal state prediction network model, and the output is the evolution probability of the interaction link of the service node transforming into an abnormal state within a preset time period in the future; when the evolution probability exceeds the dynamic protection baseline, a non-blocking link protection instruction for scheduling is generated and executed.

[0021] Preferably, the process of constructing a cross-service log sequence includes: Obtain the operation logs output by the gateway node, order node, and inventory node; extract information from the operation logs using a structured parsing engine to obtain structured log fields containing log generation timestamps, request tracing identifiers, node interface names, call execution time, and upstream and downstream call relationships; Using the request tracing identifier as the primary key, the structured log fields that are discretely distributed across various service nodes are aggregated. Under the same request tracing identifier, the structured log fields with clear upstream and downstream call relationships are sequentially concatenated according to the order of the log generation timestamps to generate a complete cross-service log sequence that records the flow path and timing status of a single order submission across various service nodes.

[0022] In the specific implementation process, each service node continuously generates raw operation log text while processing business requests. The raw operation log text is appended to disk or pushed to the log collection channel. Raw operation log text is continuously collected from service nodes such as gateway node, order node, inventory node, promotion node, points node, and gift node, and then merged into a unified unparsed buffer.

[0023] The structured parsing engine scans each line of the original runtime log text in the parsing buffer according to a pre-configured parsing rule template. The parsing rule template pre-sets field location rules for different node log output formats. Based on these rules, the engine locates and extracts five types of fields from each log text: log generation timestamp, request tracing identifier, node interface name, call execution time, and upstream / downstream call relationship. The extracted results are then organized into a structured log field record. The log generation timestamp records the absolute time when the log was generated, expressed in milliseconds relative to a baseline time in this embodiment; the request tracing identifier marks the request to which the log belongs; the node interface name identifies the specific service node and interface that generated the log; the call execution time records the execution duration of the call itself; and the upstream / downstream call relationship records the initiator and receiver of the call, used to reconstruct the direction of the call.

[0024] After structured parsing, the request tracing identifier is used as the aggregation key. The structured log fields extracted from the entire network are then hash-bucketed and aggregated, ensuring that all structured log fields belonging to the same order submission request are grouped into the same logical group. Within each logical group, logs are sorted in ascending order based on their generation timestamps. Then, based on upstream and downstream call relationships, the order of fields generated at the same or similar times is determined. Finally, all structured log fields within the group are concatenated sequentially to obtain a cross-service log sequence.

[0025] For example, the structured log fields belonging to the order submission request, after aggregation and sorting, are as follows: the gateway node receives the request at millisecond 0, the inventory node acquires an exclusive write lock at millisecond 10, the inventory node completes the core inventory deduction process at millisecond 25, the inventory node returns the processing result at millisecond 30, the promotion node returns at millisecond 35, the points node returns at millisecond 45, and the gift node returns at millisecond 280. These records are concatenated to form a complete cross-service log sequence recording the flow path and timing status of the order across various service nodes. This cross-service log sequence is then used as input data for subsequent link status parameter identification.

[0026] The rationale behind this design is as follows: Aggregating requests using the request chain tracing identifier as the primary key allows for the reconstruction of the complete call sequence across multiple physically distributed service nodes; strict ascending order based on log generation timestamps ensures the correct causal sequence of the call events. The combination of these two methods provides a unified time benchmark and a complete event chain for subsequently identifying execution gaps between the main transaction branch and peripheral bottleneck branches, preventing distortion in the quantification of these gaps due to discrete log distribution or disordered timing.

[0027] This invention aggregates discrete runtime logs using request link tracing identifiers as the primary key and performs strict temporal sorting and concatenation based on log generation timestamps. This reassembles previously isolated runtime logs scattered across multiple physical locations such as gateway nodes, order nodes, and inventory nodes into a complete cross-service log sequence depicting the entire process of a single order submission request. This process allows for continuous observation of the entire lifecycle of a single request, from entering the gateway to concurrent fan-out and then to the aggregated return, alleviating the problem of call trajectory breaks caused by log dispersion. It provides a complete, orderly, and comparable data foundation for subsequent identification of main and secondary branch discrepancies and quantification of bottleneck effects, ensuring the accuracy of subsequent parameter identification and feature extraction.

[0028] Preferably, the identified link status parameters specifically include: Calculate the total number of cross-service log sequences for product objects within the basic sliding time window and output the data request density parameter. Extract the timestamp of the resource locking execution of the inventory node in the cross-service log sequence, calculate the time difference between the current observation time and the resource locking timestamp, and output the parameter of the continuous lock waiting time. Based on the concurrent call branch data initiated by the gateway node in the cross-service log sequence, the main transaction branch responsible for locking the core underlying data and the other edge branches are parsed and distinguished; the return time of the main transaction branch is extracted, and the expected time of the edge branches that have not yet returned is identified; The edge branch with the longest expected execution time is defined as the edge bottleneck branch; the execution time difference between the main transaction branch and the edge bottleneck branch is calculated to generate an anomaly propagation depth parameter that reflects the degree of concurrent fan-out dispersion; the data request density parameter, the duration of the sustained lock wait parameter, and the anomaly propagation depth parameter are combined to generate the link state parameter.

[0029] A calling branch is identified as the main transaction branch when it meets at least two of the following three conditions: resource locking event, association with core product object, and participation in order master status submission. Other calling branches that do not directly control core data locks and do not participate in order master status submission are identified as edge branches. For edge branches that have not yet returned, the 95th percentile timeout of the interface in the last 24 hours or the last 1000 normal calls is obtained, and the larger value between the current runtime and the 95th percentile timeout is taken as the expected timeout. If the historical samples of the interface are less than the preset number, the interface timeout threshold is taken as the expected timeout.

[0030] In practice, the aggregated batch cross-service log sequences are processed within the basic sliding time window to generate link status parameters sequentially. The window length of the basic sliding time window is set to 30 seconds, and the sliding step size is set to 5 seconds. For late logs, backfilling is allowed within a 2-second lateness tolerance period; logs exceeding the lateness tolerance period enter the compensation statistics channel.

[0031] Regarding the data request density parameter, using product objects as the statistical dimension, each cross-service log sequence involving the same popular product combination object is counted within the current basic sliding time window. In this embodiment, the popular product combination object has a cumulative total of 800 cross-service log sequences within the current basic sliding time window, therefore the data request density parameter is set to 800. This parameter reflects the intensity of concurrent requests for a specific product object during a major promotional period; a higher value indicates greater concurrent pressure on the product object.

[0032] Regarding the duration of the persistent lock wait, the resource locking and resource release events of the inventory node for the corresponding data row of the product are located in the cross-service log sequence. The inventory node corresponding to the resource locking event successfully acquired an exclusive write lock at the 10th millisecond. Since the edge short-board branch has not yet returned at this time, the underlying data resources have not been released yet. The persistent lock wait time parameter is obtained by subtracting the resource locking time from the current system observation time (for example, let's say the current time is the 50th millisecond). This parameter represents the length of time that the underlying data row has been continuously occupied and cannot serve other requests.

[0033] Regarding the anomaly propagation depth parameter, firstly, based on the concurrent call branch data initiated by the gateway node, the call path corresponding to the inventory node was identified as the first to successfully acquire the exclusive write lock of the underlying database, thus defining it as the main transaction branch. Simultaneously, the call paths corresponding to the promotion node, points node, and gift node, which do not control the core write lock, were defined as edge branches. The return time of the main transaction branch was extracted as 30 milliseconds. Subsequently, for each edge branch, its historical execution time sliding statistics were read as the expected execution time: the expected execution time for the promotion node branch was approximately in the tens of milliseconds, the expected execution time for the points node branch was approximately in the tens of milliseconds, and the expected execution time for the gift node branch, due to its reliance on external rights verification, had a significantly higher historical sliding statistics, with an expected execution time in the hundreds of milliseconds. The expected execution times of each edge branch were sorted, and the gift node branch with the longest expected execution time was defined as the edge bottleneck branch.

[0034] After identifying the edge bottleneck branch, the execution time range between the main transaction branch and the edge bottleneck branch is calculated as 250 milliseconds by subtracting the return time of the main transaction branch from the return time of the edge bottleneck branch (280 milliseconds). This range is then output as the anomaly propagation depth parameter. The reason for using the execution time range between the main transaction branch and the edge bottleneck branch, rather than the traditional microservice call hop count, is that in a concurrent fan-out mesh call structure, what truly determines whether the underlying data row locks can be released in a timely manner is not the number of node layers traversed by the call, but rather the time difference between the fastest returning main transaction branch and the slowest returning edge bottleneck branch. The larger this time difference, the more severe the invalidation of the underlying data row locks, even though the main transaction branch has completed its core logic. Therefore, quantifying the anomaly propagation depth using the execution time range more directly and sensitively reflects the severity of concurrent fan-out dispersion and the bottleneck effect.

[0035] Finally, the data request density parameter, the sustained lock wait time parameter of 40 milliseconds, and the anomaly propagation depth parameter of 250 milliseconds are combined. The request density is normalized according to the historical high percentile count of the same product object, and the difference between the sustained lock wait time and the execution time is normalized according to the historical high percentile time consumption of the same interface. Then, the parameters are concatenated in a fixed field order to form a link state parameter vector, which serves as the driving input for subsequent adaptive time window dynamic calculation.

[0036] This invention, while retaining conventional parameters such as data request density and lock wait time, introduces an edge bottleneck branch identification mechanism and imbues the anomaly propagation depth parameter with a new meaning: quantification based on the execution time range between the main transaction branch and the edge bottleneck branch. Compared to traditional monitoring methods that rely solely on global error rate or call hop count, this scheme can preemptively identify delay paths using historical sliding statistics before the edge bottleneck branch actually returns, and accurately characterize the severity of the bottleneck effect caused by the difference between the main and secondary branches using the time range. Thus, it can identify the link status that truly poses a hidden danger before the underlying data row lock is invalidally occupied for a long time or even evolves into global congestion, providing a sensitive and reliable quantitative basis for the pre-triggered and precise definition of subsequent adaptive time windows.

[0037] Preferably, the process of generating an adaptive time window covering cross-service abnormal call trajectories includes: The generated link state parameters are compared with the preset security threshold; when the abnormal propagation depth parameter is determined to exceed the security threshold, the time boundary recalculation engine is triggered; the starting boundary of the target analysis time window is kept unchanged by the initial start time of the main transaction branch, while the ending boundary of the target analysis time window is stretched towards the future time direction. Lock the edge branch until the edge branch log shows that the execution has ended or a timeout has occurred. Use this time as the adjusted termination boundary to generate an adaptive time window that can fully encompass the entire lifecycle of the main transaction branch and the edge branch.

[0038] In the specific implementation process, the time window generation first executes a trigger judgment; the anomaly propagation depth parameter of 250 milliseconds is compared with the preset safety threshold of 150 milliseconds. Since the anomaly propagation depth parameter has significantly exceeded the safety threshold, it indicates that the difference between the main and secondary branches of this concurrent fan-out has reached a level sufficient to disrupt the complete business cycle. Based on this, the time boundary recalculation engine is triggered, and the right boundary long-tail alignment process begins. It should be noted that the value of the safety threshold is preset based on the tolerance requirements for the complete business cycle; the smaller the value, the more sensitive it is to the bottleneck effect and the earlier the intervention.

[0039] Once the time boundary recalculation engine is triggered, it first determines the starting boundary of the target analysis time window. This engine reads the initial start time of the main transaction branch, which is the 8th millisecond after the inventory node begins processing the request, and locks it as the starting boundary of the target analysis time window, maintaining this boundary throughout the subsequent process. The reason for anchoring the starting boundary to the initial start time of the main transaction branch is that the main transaction branch is the starting point for core inventory deduction and underlying data row locking. Only by using this starting point as the left boundary of the observation window can the entire process from the time the core resource is occupied until its final release be fully covered, avoiding omissions of the initial stage of lock occupancy.

[0040] Subsequently, the time boundary recalculation engine performs right boundary long-tail alignment. Unlike the basic sliding time window, which truncates observations after a fixed span, this engine suspends the settlement action of the current observation window, continuously stretching the termination boundary of the target analysis time window towards future time. Simultaneously, it locks and registers continuous monitoring for the branches corresponding to the gift nodes defined as edge short branches. During monitoring, the time boundary recalculation engine continuously waits for the termination event of the edge short branches. When the log record of the edge short branch shows that its execution has ended, the engine anchors that moment as the adjusted termination boundary. In this embodiment, the branch corresponding to the gift node returns and terminates at 280 milliseconds, therefore the termination boundary is anchored at 280 milliseconds.

[0041] To prevent edge branches from failing to return for extended periods due to malfunctions, thus causing the observation window to be stretched indefinitely, the time boundary recalculation engine also incorporates timeout blocking protection. A maximum stretch limit is set for the termination boundary, for example, not exceeding a preset maximum observation span from the starting boundary. If an edge branch fails to return by the maximum stretch limit, the engine determines that a timeout has occurred and uses the moment the timeout is triggered as the adjusted termination boundary. This ensures observation integrity while preventing the memory cache from being occupied indefinitely.

[0042] After the above processing, the time boundary recalculation engine, using a start boundary of 8 milliseconds and an end boundary of 280 milliseconds, actually allocates a data cache entity with a span of 272 milliseconds in computer memory, namely the adaptive time window. This adaptive time window completely encompasses the entire lifecycle of the rapidly completing main transaction branch and the slowly returning edge bottleneck branch on the physical timeline. Compared to the fixed-span basic sliding time window, which physically cuts off the complete business cycle when the difference between the main and secondary branches is huge, the adaptive time window ensures that the complete causal process of the bottleneck branch dragging the main transaction branch is included in the same observation interval, laying the foundation for subsequently constructing the topology network and extracting cascading obstruction features within a unified window.

[0043] This invention, through a right-boundary long-tail alignment mechanism, changes the traditional fixed-time-window approach that mechanically truncates the observation interval with a constant span. When the anomaly propagation depth parameter exceeds a safety threshold, the solution locks the initial start time of the main transaction branch as the starting boundary and dynamically extends the termination boundary to the closing time of the edge short-board branch, while using timeout blocking protection to prevent the window from stretching indefinitely. The resulting adaptive time window can completely encompass the entire process from core resource occupancy to final release in settlement scenarios with large time differences between the main and sub-branches. This solves the problem that fixed-time windows physically cut off the complete business cycle, causing the causal process of the short-board branch dragging the main transaction branch to be unable to be continuously observed, ensuring that the data trajectory on which subsequent anomaly feature extraction depends is complete and without omission.

[0044] Preferably, the process of extracting temporal features, propagation features, and cascade hindrance features includes: Traverse all cross-service log sequences within the adaptive time window, map the central node initiating concurrent calls and the edge node receiving calls to topology entity nodes; map concurrent call relationships to directed communication edges, and construct a service call topology network that presents concurrent fan-out and aggregation states; In the service call topology network, the receiving call node pointed to by the edge short branch is identified as the edge short node with the longest time consumption during the settlement of combined goods. The time it takes for the main trading branch to complete core processing and the time it takes for the main trading branch to release synchronization waiting are obtained, and the time difference between the two is taken as the waiting idle time. The waiting idle time is used as a cascaded hindrance feature, which is concatenated with the execution time range of adjacent events as a timing feature and the number of abnormal propagation hops as a propagation feature to output a comprehensive feature tensor.

[0045] In the specific implementation process, topology mapping and feature extraction are performed within an adaptive time window. First, all cross-service log sequences within the adaptive time window are traversed. Based on the upstream and downstream call relationships, central nodes such as gateway nodes that initiate concurrent calls and edge nodes such as inventory nodes, promotion nodes, points nodes, and gift nodes that receive calls are mapped as topology entity nodes. The concurrent call relationships initiated by gateway nodes to each edge node are mapped as directed communication edges from central nodes to edge nodes, thereby constructing a service call topology network that presents concurrent fan-out and aggregation states. This topology network is visualized to depict the mesh call structure of this request, which fans out from the center and then aggregates back to the center.

[0046] Subsequently, edge bottleneck nodes are identified in the service call topology network. Based on the identified edge bottleneck branches, the receiving call node it points to in the topology network is located, which is the gift node with the longest processing time during the combined product checkout, and is identified as the edge bottleneck node. This edge bottleneck node is the physical source of this congestion and also the precise target for subsequent protection commands.

[0047] After identifying the bottleneck node, calculate the waiting idle time. The time when the main trading branch completes its core processing refers to the moment when the main trading branch finishes its own core inventory deduction business logic calculation, which is earlier than the moment it returns the processing result to the upstream. The time when the main trading branch releases synchronization waiting refers to the moment when the main trading branch is no longer forced to wait for all concurrent branches to return, thus releasing the underlying exclusive write lock. Obtain the time when the main trading branch completes its core processing and the time when the main trading branch releases synchronization waiting; use the time difference between the two as the waiting idle time. If this time difference is less than zero, set the waiting idle time to zero.

[0048] The design basis for this calculation is that the main transaction branch completes core processing in 25 milliseconds, and the main transaction branch unsynchronizes in 280 milliseconds, so the idle waiting time is 255 milliseconds. During these 255 milliseconds, although the core inventory resources are occupied by exclusive locks, they do not serve the effective calculation of the main transaction branch or the effective calculation of the gift node. Instead, they are simply in a passively idle state while waiting for the slow edge bottleneck node to finish. It should be noted that although both the waiting idle time and the anomaly propagation depth parameter are related to the difference between the main and secondary branches, their measurement methods and uses are different: the waiting idle time is based on the main transaction branch itself, calculated from the 25th millisecond after it completes core processing to the 280th millisecond after it releases synchronization waiting. It measures the idle time of core resources that are still invalidally occupied by exclusive locks after completing effective computation, with a value of 255 milliseconds. This value is assigned as a cascading blocking feature to edge bottleneck nodes and input into the anomaly prediction network model. The anomaly propagation depth parameter is calculated as the range between the 30th millisecond of the main transaction branch's return time and the 280th millisecond of the edge bottleneck branch's return time, with a value of 250 milliseconds. It reflects the dispersion of concurrent fan-out and is used to drive the boundary calculation of the adaptive time window. The two parameters have different values ​​and meanings, serving two different stages: feature modeling and time window calculation.

[0049] The aforementioned waiting idle time is transformed into graph structure node attributes and assigned to edge bottleneck nodes in the service call topology network, thereby obtaining the cascading blockage feature. As a unique topology attribute of edge bottleneck nodes, the cascading blockage feature quantifies the dangerous situation where core high-value inventory business is continuously dragged down by low-value gift business. Simultaneously, the execution time range of adjacent events is extracted as a temporal feature, i.e., the maximum difference in execution time between two adjacent call events across the service log sequence. In this embodiment, due to the significant interval between the return time of the gift node and its previous adjacent event, the execution time range of adjacent events is 235 milliseconds. The abnormal propagation hop count is also extracted as a propagation feature, i.e., the number of node hops affected by the blockage from the edge bottleneck node in the topology network, which is 3 hops in this embodiment.

[0050] Finally, the waiting idle time (as a cascading inhibition feature), the execution time range of adjacent events (as a temporal feature), and the 3-hop count of anomaly propagation (as a propagation feature) are concatenated and upgraded to form a standardized comprehensive feature tensor, which serves as the input to the subsequent anomaly prediction network model. The comprehensive feature tensor simultaneously carries information from the temporal, propagation, and cascading inhibition dimensions; it is organized by node and feature dimensions; each row corresponds to a topological entity node, and each column corresponds to a node feature; temporal features are normalized to their historical maximum values, and state features are encoded using zero-one encoding.

[0051] This invention proposes waiting idle time and cascading blockage features, accurately separating the normal computation time of edge nodes, quantifying the absolute duration of core resources being ineffectively occupied, and transforming this into a unique topological attribute of edge bottleneck nodes in the service call topology network. Compared to traditional features that rely solely on surface error rates or call durations, cascading blockage features can penetrate the appearance of normal traffic, directly pointing to the inherently dangerous situation where core high-value services are continuously dragged down by low-value services. The resulting comprehensive feature tensor provides a highly discriminative input for subsequent prediction models to accurately pinpoint the physical source that truly triggers global congestion, significantly improving the targeting and accuracy of anomaly prediction.

[0052] Preferably, the process of identifying abnormal states based on the abnormal state prediction network model includes: The generated comprehensive feature tensor is input into a graph attention neural network model pre-trained using historical fault map data; In the hidden layer of the graph attention neural network model, the correlation between the numerical distribution of the cascaded blocking features and the deadlock risk is learned through the self-attention allocation mechanism, thereby improving the contribution of the cascaded blocking features of the edge bottleneck nodes to the risk assessment value. Combining the topological network structure characteristics and temporal characteristics after weighting parameters, forward propagation is performed through the fully connected layer of the graph attention neural network model to calculate the risk assessment value of global distributed transactions being forced to roll back due to execution lag of local edge bottleneck nodes and deadlock events in the underlying database. The risk assessment value is output as the evolution probability of the target abnormal state.

[0053] In practical implementation, the abnormal state prediction network model is implemented using a graph attention neural network model; the structure of this model is as follows: Figure 3 As shown, it consists of an input layer, a graph attention hidden layer, and a fully connected output layer in sequence.

[0054] The input layer receives the output comprehensive feature tensor and organizes the temporal, propagation, and cascaded hindrance features of each topological entity node into its initial feature vector. Simultaneously, it reads the directed communication edges of the service call topology network to determine the adjacency relationships between nodes. The graph attention hidden layer is the core of the model. In this embodiment, two stacked graph attention hidden layers are used. Each graph attention hidden layer contains four parallel attention heads. Each attention head independently calculates the attention weights between nodes before converging them to enhance the stability of feature representation. The fully connected output layer integrates the overall structural features output by the graph attention hidden layer and maps them to a single risk assessment value.

[0055] The model's recognition process is as follows: After the comprehensive feature tensor enters from the input layer, it triggers the graph attention mechanism algorithm in the graph attention hidden layer. For each topological entity node in the service call topology network, the graph attention mechanism algorithm reads its own and its neighboring nodes' feature vectors, calculates the attention correlation between nodes pairwise, and obtains the attention weight parameters after normalization. The model does not rely on manually assigned weights by hard rules, but rather discovers patterns in historical fault maps through the autonomous learning mechanism of deep learning: nodes with higher cascade blockage feature values ​​have a stronger correlation with the risk of deadlock. Therefore, during forward propagation, the graph attention mechanism algorithm naturally learns and assigns higher attention weight parameters to such nodes.

[0056] In this embodiment, the cascading hindrance feature value of the edge short board node, i.e. the gift node, is significantly higher than that of the other nodes. Therefore, the graph attention mechanism relies on the internal weight distribution learned by itself to dynamically allocate the highest attention weight parameter to the edge short board node, so that it will dominate in the subsequent overall inference; while the other nodes will obtain relatively low attention weight parameters.

[0057] After attention weighting, the model combines the topological network structure characteristics and temporal features after weighting parameters, and performs forward propagation through a fully connected layer. The fully connected layer comprehensively considers the high-weight characteristics of edge bottleneck nodes and the temporal evolution of the overall call structure, calculating a risk assessment value for global distributed transaction rollback and underlying database deadlock events caused by execution stalls of local edge bottleneck nodes. This risk assessment value ranges from 0 to 1, with a higher value indicating a higher risk of global deadlock or transaction rollback within a preset time period. The model outputs this risk assessment value as the evolution probability of the target abnormal state. In this embodiment, the evolution probability is 87%, indicating that under the current situation where the main transaction branch is dragged down by edge bottleneck nodes for a long time, the risk of global deadlock or transaction rollback within a preset time period is already high.

[0058] The model training process is as follows: Training data comes from historical fault map data, which consists of call topology snapshots that have actually experienced distributed transaction rollbacks or underlying database deadlocks during historical operations. Each call topology snapshot constructs a service call topology network and extracts a comprehensive feature tensor including cascading blocking features. It is also labeled as a positive or negative sample based on whether the snapshot subsequently evolves into a global deadlock or transaction rollback. During training, each set of comprehensive feature tensors is input into the graph attention neural network model to obtain the model's predicted evolution probability. The deviation between the predicted evolution probability and the true label of the sample is then used to construct a loss. Based on this loss, the model's attention weight calculation parameters and fully connected layer parameters are iteratively adjusted, enabling the model to gradually learn to associate high-level cascading blocking features with high deadlock risk. In this embodiment, the training iterations are conducted for approximately 100 rounds. The model employs a binary classification cross-entropy loss function. The training, validation, and test sets are divided in a 7:2:1 ratio. Positive samples are snapshots of call topologies where transaction rollbacks, database deadlocks, or lock wait timeouts occur within a preset future time period. Negative samples are snapshots of call topologies that complete normally without experiencing these conditions. This process continues until the model's prediction bias on the validation data converges to a stable level. Through this training, the model can accurately focus its attention on edge nodes with prominent cascading blocking features when faced with new comprehensive feature tensors, and output reliable evolution probabilities.

[0059] The rationale behind this design is that in high-concurrency scenarios such as major sales events, normal traffic itself presents a complex and ever-changing appearance. If the model treats all nodes equally, it is easily overwhelmed by the superficial normal fluctuations, making it difficult to pinpoint the true source of the problem. This application uses cascading blocking features to guide attention allocation, enabling the model to ignore the superficial illusion of complex normal traffic and focus its judgment on the edge nodes where core resources are most severely underutilized. This allows for accurate assessment of the risk of triggering a global deadlock, significantly improving the accuracy of predictions.

[0060] This invention utilizes the unique cascading blockage feature as the primary allocation basis for the graph attention mechanism. This allows the graph attention neural network model to dynamically allocate the highest attention weights to the edge nodes that truly trigger global blockages, based on the numerical distribution of the cascading blockage feature. Combined with deadlock risk mapping capabilities trained on historical fault map data, the evolution probability output by the model through forward propagation can penetrate the complex appearance of normal traffic in high-concurrency scenarios, accurately pinpointing the dangerous situation of core resources being ineffectively occupied. Compared to traditional prediction methods that treat all nodes equally, this scheme significantly reduces the interference of normal fluctuations on prediction results, improves the accuracy and lead time for assessing global deadlock and transaction rollback risks, and provides a reliable probabilistic basis for the accurate issuance of subsequent non-blocking protection commands.

[0061] Preferably, the evolution probability of the monitoring output is compared with the dynamic protection baseline; when the value of the evolution probability is greater than the dynamic protection baseline, the defense scheduling engine is activated. For the identified edge bottleneck nodes that cause global waiting, the corresponding service degradation isolation policy is extracted from the scheduling policy library, and a non-blocking link protection instruction is generated. Non-blocking link protection commands are sent to the corresponding service node control panel, downgrading the original synchronous strong consistency verification scheduling mode of the edge short-board node to an asynchronous delayed processing mode, thus completing the logical isolation and computing power release of the abnormal call link.

[0062] In the specific implementation process, the evolution probability is continuously monitored and compared with the dynamic protection baseline. The dynamic protection baseline is calculated based on the current overall load: In this embodiment, due to the high concurrency during an e-commerce promotion, the CPU and memory loads are high, so the dynamic protection baseline is lowered to 60% to allow the protection mechanism to intervene earlier under high load. Comparing the evolution probability of 87% with the dynamic protection baseline of 60%, since the former is greater than the latter, it is determined that a dangerous situation close to a global deadlock has been identified, and the defense scheduling engine is activated. The dynamic protection baseline is calculated based on a weighted average of processor utilization, memory utilization, database connection pool occupancy, transaction rollback rate, and lock wait queue length.

[0063] Specifically, each load indicator is normalized to 0 to 1, and the comprehensive load value is obtained by weighted summation of each indicator, with the weights defaulting to equal weights and a sum of 1. The dynamic protection baseline decreases in segments according to the comprehensive load value, and a minimum and maximum value are set. Specifically, the maximum protection baseline is subtracted from the product of the comprehensive load value and the adjustment coefficient, and the result is limited to between the minimum and maximum protection baselines. The minimum and maximum protection baselines and the adjustment coefficient are calibrated based on system stress testing and historical events. In this embodiment, the calibration result makes the dynamic protection baseline 60% during high concurrency periods.

[0064] Once the defense scheduling engine is activated, it extracts the corresponding service degradation isolation policy from the scheduling policy library for the identified edge bottleneck nodes (gift nodes) causing global waiting. The scheduling policy library pre-stores degradation isolation policies for different edge node types, each policy specifying the processing mode and isolation method to be adopted when the corresponding node is degraded. Based on the identification result that the edge bottleneck node is a gift node, the defense scheduling engine retrieves the degradation isolation policy corresponding to the gift-type service and generates a non-blocking link protection instruction accordingly. This instruction explicitly requires targeted degradation isolation of the gift node without discarding real transaction data or interrupting the main transaction branch.

[0065] The defense scheduling engine then sends a non-blocking link protection command to the control panel of the service node corresponding to the gift node. Upon receiving the command, the service node control panel downgrades the gift node's original synchronous strong consistency check scheduling mode to an asynchronous delayed processing mode. Under the original synchronous strong consistency check scheduling mode, the gift node had to wait for confirmation signals from all concurrent participants, forcing the main transaction branch to continuously hold underlying data row locks while waiting for the gift node to complete its task. After downgrading to the asynchronous delayed processing mode, the gift node immediately returns a success signal to the main transaction branch and allows the process to proceed, pushing the rights verification task that originally needed to be completed synchronously into a background queue for slow retrying. Furthermore, the asynchronous delayed processing mode is suitable for compensable edge businesses such as points distribution, gift rights compensation, and non-core marketing rights verification; asynchronous downgrading is not performed for inventory deduction, payment confirmation, order amount settlement, and order master status submission.

[0066] After the aforementioned mode switch, the gift node no longer synchronously occupies the waiting space of the main transaction branch. The main transaction branch is then able to release its exclusive write lock on the underlying inventory data rows ahead of time, thus completing the logical isolation of the abnormal call chain and releasing the underlying computing power. It is important to emphasize that this protection mechanism only applies to the micro-target identified as the bottleneck, the gift node. The core inventory transactions carried by the main transaction branch continue as normal, its real transaction data is not discarded, and the backbone network is not interrupted. Compared to traditional global rate limiting, which is triggered only after a large number of orders time out and indiscriminately rejects all user requests, this solution uses non-blocking link logical isolation to only downgrade low-value edge bottleneck nodes to asynchronous delayed processing. This releases the underlying global data row lock, resolves the blocking of waiting resources, and does not interfere with the normal operation of the main core commodity transactions.

[0067] When a near-global deadlock is anticipated, this invention targets only the identified edge bottleneck nodes. It extracts the corresponding degradation and isolation strategy from the scheduling strategy library and generates a non-blocking link protection instruction, degrading the node from a synchronous strong consistency check scheduling mode to an asynchronous delayed processing mode. As a result, the sluggish edge bottleneck nodes no longer synchronously bind to and drag the main transaction branch, allowing the main transaction branch to release its underlying data row locks in advance, thus resolving global lock-waiting resource congestion. Simultaneously, because the protection action only applies to low-value edge bottleneck nodes without discarding real transaction data or interrupting the backbone network, this invention ensures that no real transaction data is discarded.

[0068] Example 2: A time-series log anomaly detection method based on adaptive time windows includes: Collect the operation logs of the service nodes, and based on the request link tracing identifier, associate the discrete operation logs belonging to the same order submission request in a time sequence to construct a cross-service log sequence; Within the basic sliding time window, for the aggregated batch cross-service log sequences, identify the link status parameters used for dynamic scaling of the time window; the link status parameters include at least the data request density, the duration of the persistent lock wait, and the depth of anomaly propagation; Based on the link status parameters, the starting boundary and time span of the target analysis time window are dynamically calculated to generate an adaptive time window covering the cross-service abnormal call trajectory. Within the adaptive time window, the interaction links of service nodes are mapped to a service call topology network, and time-series features, propagation features, and cascading obstruction features containing combined product dependencies are extracted. The extracted features are input into a preset abnormal state prediction network model, and the output is the evolution probability of the interaction link of the service node transforming into an abnormal state within a preset time period in the future; when the evolution probability exceeds the dynamic protection baseline, a non-blocking link protection instruction for scheduling is generated and executed.

[0069] Based on Embodiment 1, the present invention further includes the following steps; Furthermore, when the dynamic calculation target analysis time window terminates, it identifies whether the current service call topology network crosses the physical data center boundary; when it is detected that the receiving call node of the edge short branch is located in a remote data center, it extracts the difference between the high quantile and median values ​​of the round-trip delay between the first data center and the second data center in the most recent preset time period as the tolerance compensation duration, and sets a compensation upper limit to compensate for the reference delay caused by the physical fiber transmission distance.

[0070] In large-scale distributed transaction systems, microservice nodes responsible for different business operations are often deployed in independent data centers in different cities. When the settlement of combined goods involves edge service calls across geographically dispersed data centers, the execution time recorded in the cross-service log sequence includes the inherent latency caused by physical fiber optic transmission. To avoid misjudging inherent network latency as service processing blockage, a cross-regional architecture awareness module is configured to maintain a network latency benchmark table between data centers. When the target network address of the edge bottleneck branch is resolved to belong to a geographically dispersed data center, the difference between the high quantile and median values ​​of the recent round-trip latency between the two data centers is extracted from the latency benchmark table according to a preset sampling period. This difference is used as a tolerance compensation duration, and a compensation upper limit is set and superimposed on the termination boundary of the target analysis time window calculated based on the edge bottleneck branch, thus eliminating objective fluctuation interference in the timing judgment.

[0071] This invention endows anomaly detection with objective perception capabilities across geographically active-active architectures. By extracting the physical network latency range as a tolerance compensation duration, it can reduce the probability of misjudging cross-regional network jitter as service processing congestion, thereby lowering the false alarm rate of early warnings under geographically active-active deployment architectures.

[0072] Furthermore, when extracting cascading hindrance features containing dependencies of combined products, a product connectivity subgraph mapping the association state of primary and secondary products is constructed within the inventory microservice node of the service call topology network. The time for the primary product to complete core inventory processing and the time for the independent secondary product to release the inventory pre-deduction action are obtained in the product connectivity subgraph, and the time difference between the two is used as the secondary product suspension waiting time. The secondary product suspension waiting time is multiplied by the total number of sub-products contained in the combined product to generate a cascading hindrance coefficient. The cascading hindrance coefficient is used as a local topology feature to determine the forward propagation weights of the abnormal state prediction network model.

[0073] For bundled product settlement in e-commerce scenarios, due to the strong consistency requirements of distributed transactions, dependency waiting can easily occur between different product data rows. Based on the macro-level service call topology network, a micro-level product connectivity subgraph is constructed within the inventory nodes. By parsing order details, the connectivity between the main product and the accompanying product is established. While the main product holds an exclusive write lock on the underlying data row, the duration for which the accompanying product is forced to queue due to the main product's transaction not yet being committed is extracted. Specifically: the time it takes for the main product to complete core inventory processing and the time it takes for the accompanying product's inventory pre-deduction action to be released from queuing are obtained, and the time difference between the two is used as the accompanying product's queuing duration. The accompanying product's queuing duration is multiplied by the total number of accompanying products in the bundled product to generate a cascading hindrance coefficient. This product represents the degree of resource waste caused by internal waiting and is subsequently input into the network model as a node attribute, guiding the model to assign a matching attention weight to the node.

[0074] This invention addresses the technical problem of micro-level data congestion during bundled product promotions being overlooked by macro-level monitoring. By quantifying the cascading blocking effect between primary and secondary products and providing clear coefficient quantification logic, it improves the accuracy of identifying inventory transaction deadlock risks caused by business rule binding.

[0075] Furthermore, when extracting the comprehensive feature tensor, the terminal device fingerprint and network interconnection protocol address information recorded by the gateway node at the head of the cross-service log sequence are extracted simultaneously; the terminal device fingerprint information entropy and spatiotemporal clustering parameter of the batch cross-service log sequences aggregated within the adaptive time window are calculated; if the terminal device fingerprint information entropy is lower than the preset security lower limit threshold, the spatiotemporal clustering parameter is multiplied by the preset penalty weight to generate a penalty feature vector; the penalty feature vector is input as an additional attribute into the abnormal state prediction network model to dynamically adjust the trigger threshold of the non-blocking link protection command.

[0076] In high-concurrency promotional scenarios, underlying resource lock waiting anomalies can be caused by high-frequency concurrent access initiated by automated scripts. Conventional monitoring methods struggle to distinguish between normal business traffic peaks and abnormal automated access. In the feature extraction phase, the source of the call is traced back, extracting the terminal device fingerprint and network interconnection protocol address that initiated the request from the gateway node logs within the adaptive time window. Subsequently, the information entropy of the device fingerprint distribution within the current time window is calculated using the Shannon information entropy principle. Normal user access exhibits fingerprint diversity and higher information entropy; while automated scripts often use single or similar fingerprints, resulting in lower information entropy. When the information entropy falls below a preset safety lower limit threshold, the request density within the same address segment is calculated as a spatiotemporal clustering parameter. This spatiotemporal clustering parameter is multiplied by a pre-set penalty weight to transform it into a penalty feature vector, which is input into the graph network model. This guides the model to increase the output base value of the evolution probability, thereby triggering business degradation isolation strategies earlier.

[0077] This invention enhances the security screening capabilities of anomaly detection in the face of automated concurrent access. By introducing the fingerprint information entropy of the terminal device and the spatiotemporal clustering parameter to calculate the penalty vector, it can effectively identify and suppress the invalid occupation of underlying database resources by abnormal traffic, ensuring the processing efficiency of normal business operations.

[0078] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A time-series log anomaly detection method based on adaptive time windows, characterized in that, include: Collect the operation logs of the service nodes, and based on the request link tracing identifier, associate the discrete operation logs belonging to the same order submission request in a time sequence to construct a cross-service log sequence; Within the basic sliding time window, for the aggregated batch cross-service log sequences, identify the link status parameters used for dynamic scaling of the time window; the link status parameters include at least the data request density, the duration of the persistent lock wait, and the depth of anomaly propagation; Based on the link status parameters, the starting boundary and time span of the target analysis time window are dynamically calculated to generate an adaptive time window covering the cross-service abnormal call trajectory. Within the adaptive time window, the interaction links of service nodes are mapped to a service call topology network, and time-series features, propagation features, and cascading obstruction features containing combined product dependencies are extracted. The process of extracting temporal features, propagation features, and cascade blockade features includes: Traverse all cross-service log sequences within the adaptive time window, map the central node initiating concurrent calls and the edge node receiving calls to topology entity nodes; map concurrent call relationships to directed communication edges, and construct a service call topology network that presents concurrent fan-out and aggregation states; In the service call topology network, the receiving call node pointed to by the edge short branch is identified as the edge short node with the longest time consumption during the settlement of combined goods. Obtain the time it takes for the main transaction branch to complete core processing, and the time it takes for the main transaction branch to release synchronization waiting, and use the time difference between the two as the waiting idle time; The waiting idle time is used as a cascaded retardation feature, which is concatenated with the execution time range of adjacent events as a timing feature and the number of abnormal propagation hops as a propagation feature to output a comprehensive feature tensor. The extracted features are input into a preset abnormal state prediction network model, and the model outputs the evolution probability of the interaction links of service nodes transforming into abnormal states within a preset time period in the future; when the evolution probability exceeds the dynamic protection baseline, a non-blocking link protection instruction for scheduling is generated and executed. Non-blocking link protection commands are sent to the corresponding service node control panel, downgrading the original synchronous strong consistency verification scheduling mode of the edge short-board node to an asynchronous delayed processing mode, thus completing the logical isolation and computing power release of the abnormal call link.

2. The time-series log anomaly detection method based on adaptive time windows according to claim 1, characterized in that: The process of building a cross-service log sequence includes: Obtain the operation logs output by the gateway node, order node, and inventory node; extract information from the operation logs using a structured parsing engine to obtain structured log fields containing log generation timestamps, request tracing identifiers, node interface names, call execution time, and upstream and downstream call relationships; Using the request tracing identifier as the primary key, the structured log fields that are discretely distributed across various service nodes are aggregated. Under the same request tracing identifier, the structured log fields with clear upstream and downstream call relationships are sequentially concatenated according to the order of the log generation timestamps to generate a complete cross-service log sequence that records the flow path and timing status of a single order submission across various service nodes.

3. The time-series log anomaly detection method based on adaptive time windows according to claim 1, characterized in that: The specific link status parameters to be identified include: Calculate the total number of cross-service log sequences for product objects within the basic sliding time window and output the data request density parameter. Extract the timestamp of the resource locking execution of the inventory node in the cross-service log sequence, calculate the time difference between the current observation time and the resource locking timestamp, and output the parameter of the continuous lock waiting time. Based on the concurrent call branch data initiated by the gateway node in the cross-service log sequence, the main transaction branch responsible for locking the core underlying data and the other edge branches are parsed and distinguished; the return time of the main transaction branch is extracted, and the expected time of the edge branches that have not yet returned is identified; The edge branch with the longest expected execution time is defined as the edge bottleneck branch; the execution time range between the main transaction branch and the edge bottleneck branch is calculated to generate an anomaly propagation depth parameter that reflects the degree of concurrent fan-out dispersion; The link state parameters are generated by combining the data request density parameter, the duration of the persistent lock wait parameter, and the anomaly propagation depth parameter.

4. The time-series log anomaly detection method based on adaptive time windows according to claim 3, characterized in that: The process of generating an adaptive time window that covers cross-service exception call trajectories includes: The generated link status parameters are compared with a preset security threshold; when the abnormal propagation depth parameter is determined to exceed the security threshold, the time boundary recalculation engine is triggered. The starting boundary of the target analysis time window remains unchanged as the initial start time of the main trading branch, while the ending boundary of the target analysis time window is stretched towards the future time direction. Lock the edge branch until the edge branch log shows that the execution has ended or a timeout has occurred. Use this time as the adjusted termination boundary to generate an adaptive time window that can fully encompass the entire lifecycle of the main transaction branch and the edge branch.

5. The time-series log anomaly detection method based on adaptive time windows according to claim 1, characterized in that: The process of identifying abnormal states based on an abnormal state prediction network models includes: The generated comprehensive feature tensor is input into a graph attention neural network model pre-trained using historical fault map data; In the hidden layer of the graph attention neural network model, the correlation between the numerical distribution of the cascaded blocking features and the deadlock risk is learned through the self-attention allocation mechanism, thereby improving the contribution of the cascaded blocking features of the edge bottleneck nodes to the risk assessment value. Combining the topological network structure characteristics and temporal characteristics after weighting parameters, forward propagation is performed through the fully connected layer of the graph attention neural network model to calculate the risk assessment value of global distributed transactions being forced to roll back due to execution lag of local edge bottleneck nodes and deadlock events in the underlying database. The risk assessment value is output as the evolution probability of the target abnormal state.

6. The time-series log anomaly detection method based on adaptive time windows according to claim 1, characterized in that: The evolution probability of the monitoring output is compared with the dynamic protection baseline; when the value of the evolution probability is greater than the dynamic protection baseline, the defense scheduling engine is activated. For the identified edge bottleneck nodes that cause global waiting, the corresponding service degradation isolation policy is extracted from the scheduling policy library, and a non-blocking link protection instruction is generated.

Images