A micro-service call chain root cause positioning method based on a graph neural network

Abstract

The application relates to the technical field of graph neural networks, and more particularly to a micro-service call chain root cause positioning method based on a graph neural network.The method comprises the following steps: step 1: determining a fault period according to an abnormal alarm, constructing a service dependency graph, generating an edge attribute vector, a fault period feature vector and a historical same-period normal portrait feature vector; step 2: generating an edge aggregation coefficient in a symbol adaptive message passing layer according to input representation vectors and edge attribute vectors of two-side service nodes, performing low-pass aggregation or high-pass aggregation according to the positive and negative signs, outputting an abnormal score and accumulating to obtain a global abnormal score, and selecting a root cause candidate node; and step 3: performing a counterfactual replacement operation on the root cause candidate node and re-reasoning, reordering according to a counterfactual elimination amount, determining and outputting a final root cause. The application retains and amplifies root cause feature differences, realizes quantitative differentiation between root causes and symptoms, and improves positioning accuracy.

Description

Technical Field

[0001] This invention relates to the field of graph neural network technology, and in particular to a method for locating the root cause of microservice call chains based on graph neural networks. Background Technology

[0002] Microservice architecture breaks down a monolithic application into numerous independently deployable services, which collaborate to complete business requests through remote calls. As the number of services and the call hierarchy grow, a single user request often spans dozens of services. A failure in any link can propagate along the call chain, triggering widespread alerts in a short period, making it difficult to directly pinpoint the source of the fault. Distributed tracing technology records the path, latency, and status of each call across a span of data, providing a data foundation for fault localization. However, automatically and accurately identifying the root cause remains a challenge.

[0003] There are three main types of existing fault location methods. The first type relies on manual experience and threshold alarms to troubleshoot each node, which is time-consuming and heavily dependent on the experience of operations and maintenance personnel. The second type executes a random walk algorithm on the service dependency graph and sorts nodes according to transition probabilities. Transition rules need to be manually set, and densely connected hub nodes are prone to being ranked too high. The third type uses graph convolutional networks or graph attention networks to score nodes for anomalies. Its neighborhood aggregation is essentially a low-pass filter, but faults tend to spread along call edges, causing neighboring nodes' metrics to converge. In this scenario, low-pass aggregation smooths out the differences in root cause features, becoming more pronounced with deeper layers. Furthermore, the score only reflects the relevance of the anomaly; hub nodes that aggregate global symptoms receive artificially high scores. It cannot answer whether the system anomaly disappears after a node recovers, and it generally ignores the role of call direction and the statistical state of the call edge itself in fault propagation modeling.

[0004] Therefore, there is a need for a microservice call chain root cause localization method that can preserve the differences in root cause characteristics and perform causal tests on candidate root causes in scenarios where indicators converge. Summary of the Invention

[0005] In view of this, the present invention provides a microservice call chain root cause localization method based on graph neural networks, which solves the problems of existing graph neural network-based localization methods, such as the decrease in localization accuracy caused by the spread of faults along call edges, the convergence of neighbor service node indicators and the smoothing of root cause feature differences by low-pass aggregation, and the difficulty in distinguishing between true root cause and symptomatic service nodes by correlation-based anomaly scoring.

[0006] The technical solution adopted in this invention is as follows:

[0007] A microservice call chain root cause localization method based on graph neural networks includes the following three steps:

[0008] Step 1: Determine the fault period based on the abnormal alarms of the microservice system, collect the call chain data within the fault period, construct a service dependency graph including service nodes and call edges from the initiator to the receiver, and generate the edge attribute vector of each call edge and the fault period feature vector and historical normal profile feature vector of each service node.

[0009] Step 2: Input the service dependency graph, edge attribute vector, and fault period feature vector into a pre-trained graph neural network model. The graph neural network model includes stacked symbolic adaptive message passing layers. In each symbolic adaptive message passing layer, for each transmission direction of each call edge, generate an edge aggregation coefficient with values ​​between -1 and 1 based on the input representation vectors of the information sending service node and the information receiving service node and the edge attribute vector. According to the sign of the edge aggregation coefficient, the feature information of the information sending service node is fed into the information receiving service node in a low-pass aggregation or high-pass aggregation manner. The anomaly scores of all service nodes output by the graph neural network model are accumulated to obtain a global anomaly score. Select a preset number of service nodes with the highest anomaly scores as root cause candidate nodes to form an initial candidate sequence.

[0010] Step 3: Perform counterfactual replacement operation on each root cause candidate node in the initial candidate sequence as the target: replace the fault period feature vector of the target with the historical normal profile feature vector of the target during the same period, and set the edge attribute vector of all calling edges of the target as the initiator or receiver to all zero vectors, while keeping the other inputs as is; feed the input after the counterfactual replacement operation into the graph neural network model for re-inference, and sum the anomaly scores of all service nodes obtained by the re-inference to obtain the counterfactual global anomaly score; determine the difference between the global anomaly score and the counterfactual global anomaly score as the counterfactual elimination amount, reorder all root cause candidate nodes in descending order of counterfactual elimination amount, and determine and output the final root cause based on the reordered candidate order.

[0011] Furthermore, in step 1, based on the moment when the microservice system triggers an anomaly alarm, the system traces backward for a first preset duration and extends backward for a second preset duration, defining the covered time range as the fault period. The call chain data is collected from the distributed tracing component of the microservice system. Each call chain data includes multiple span records, and each span record includes the service identifier of the initiating call, the service identifier of the receiving call, the time of the call, the call latency, and the call status code. Each microservice in the microservice system is defined as a service node. All span records are traversed, and a call edge is established between the service node corresponding to the service identifier of the initiating call and the service node corresponding to the service identifier of the receiving call, pointing from the initiator to the receiver. The call edges pointing to the same service nodes at both ends are merged, and all service nodes and all merged call edges constitute a service dependency graph.

[0012] Furthermore, in step 1, for each merged call edge, all span records belonging to the call edge during the fault period are summarized, and the average call latency, the proportion of span records with call status codes belonging to the preset error category, and the total number of span records are statistically analyzed to obtain three edge statistics. Using the mean and standard deviation of the three edge statistics for the same call edge during the historical normal operation period, the three edge statistics during the fault period are standardized item by item. The standardized three edge statistics are concatenated in the preset statistical order to obtain the edge attribute vector. When the call edge only appears during the fault period and the number of span records during the historical normal operation period is 0, the edge attribute vector is set to a zero vector. The zero vector represents that the corresponding call edge is at the historical normal expected level under the standardized semantics.

[0013] Furthermore, in step 1, for each service node, six operational metrics are collected at preset sampling intervals during the fault period: mean response latency, 95th percentile response latency, requests per second, request error rate, processor utilization, and memory utilization. For each operational metric, the mean and standard deviation of the same operational metric during the historical normal operation period of the same service node are used to standardize the values ​​of each sampling point during the fault period. The average values ​​of each standardized operational metric across all sampling points during the fault period are then calculated. The average results of the six operational metrics are concatenated in the preset metric order to obtain a fault period feature vector with a dimension of 6.

[0014] Furthermore, in step 1, for each service node, a preset number of historical reference time periods are selected from historical monitoring data. The historical reference time periods must simultaneously meet the following three conditions: they belong to the same week type as the fault period (meaning both are weekdays or rest days); the start and end times within a day are the same as those of the fault period within a day; the microservice system is in normal operating condition within the historical reference time period, and normal operating condition is determined by the number of abnormal alarms being 0 within the corresponding time period; for each historical reference time period, it is processed using the same indicator type, the same standardization method, the same averaging method, and the same concatenation order as the feature vector of the fault period to obtain a reference feature vector; the preset number of reference feature vectors are averaged dimension by dimension to obtain the historical normal profile feature vector for the same period; when the number of historical reference time periods that can be selected by a service node is less than the preset number of reference time periods, the time period closest to the fault period and meeting the conditions for normal operating condition is used to make up the difference, and the duration of the make-up time period is consistent with the duration of the fault period.

[0015] Furthermore, the graph neural network model includes an input transformation network composed of fully connected layers, a symbolic adaptive message passing layer with a predetermined number of stacked layers, and an anomaly scoring network composed of fully connected layers and a sigmoid activation function. The input transformation network maps the fault period feature vector of each service node to an initial representation vector with a predetermined representation dimension, and the initial representation vector serves as the input representation vector of the first symbolic adaptive message passing layer. Each call edge carries two transmission directions, including a downlink transmission direction from the initiator to the receiver and an uplink transmission direction from the receiver to the initiator. Each symbolic adaptive message passing layer... The adaptive message passing layer is equipped with an edge coefficient network, which consists of a fully connected layer and a hyperbolic tangent activation function. For each transmission direction of each call edge, the input representation vector of the information sending service node, the input representation vector of the information receiving service node, and the edge attribute vector are concatenated in a fixed order and then input into the edge coefficient network. The hyperbolic tangent activation function maps the output of the fully connected layer to edge aggregation coefficients. Each call edge obtains two independent edge aggregation coefficients corresponding to the two transmission directions in each symbol adaptive message passing layer.

[0016] Furthermore, each symbol-adaptive message passing layer also performs the following operations: For each edge aggregation coefficient, the edge aggregation coefficient is divided by the square root of the product of the number of connected call edges of the two service nodes at both ends of the call edge to obtain the normalized aggregation coefficient. The connected call edges of the service node include all call edges where the service node is the initiator and the service node is the receiver. Each service node in the service dependency graph is taken as the current service node, and all connected call edges of the current service node are traversed. The normalized aggregation coefficient corresponding to the transmission direction with the current service node as the information receiving service node on each connected call edge is selected. The normalized aggregation coefficient is multiplied by the input representation vector of the information sending service node in the transmission direction. The multiplication of all connected call edges is then performed. The results are accumulated dimension by dimension to obtain the neighborhood aggregation vector. When the normalized aggregation coefficient is positive, the feature information of the information sending service node is incorporated into the neighborhood aggregation vector in the same direction to achieve low-pass aggregation. When the normalized aggregation coefficient is negative, the feature information of the information sending service node is incorporated into the neighborhood aggregation vector in the opposite direction to achieve high-pass aggregation. The initial representation vector of the current service node is multiplied by the preset residual weight and then added dimension by dimension to the neighborhood aggregation vector to obtain the output representation vector of the current service node in this layer. The output representation vector is used as the input representation vector of the next symbol adaptive message passing layer. The output representation vector of the last symbol adaptive message passing layer is input into the anomaly scoring network to output the anomaly score of each service node, which takes values ​​between 0 and 1.

[0017] Furthermore, the graph neural network model is pre-trained using historical fault samples with root cause annotations. These historical fault samples are derived from real fault handling records and records accumulated during fault injection experiments in the test environment. Each historical fault sample includes a service dependency graph, edge attribute vectors of all call edges constructed in the same manner as in step 1, fault period feature vectors and historical normal profile feature vectors of all service nodes, and root cause annotations. During training, the following three supervisions are performed for each historical fault sample: The first supervision calculates the binary classification cross-entropy loss with the goal of the abnormal score output by the service node corresponding to the root cause annotation approaching 1 and the abnormal scores output by the other service nodes approaching 0. The first supervision term constructs a counterfactual augmented sample by performing a counterfactual replacement operation on each service node corresponding to the root cause label, with the goal of calculating the binary cross-entropy loss as the anomaly scores output by all service nodes in the counterfactual augmented sample approaching 0. The second supervision term constructs a control augmented sample by randomly selecting one service node other than the one corresponding to the root cause label as the target for performing a counterfactual replacement operation, with the control augmented sample using the same supervision goal as the first supervision term. The losses from the three supervision terms are then weighted and summed according to a preset loss ratio, and all parameters of the graph neural network model are updated using a gradient descent optimization algorithm.

[0018] Furthermore, in step 3, when performing the counterfactual replacement operation, the topology of the service dependency graph, the edge attribute vectors of all other calling edges, the fault period feature vectors of all other service nodes, and all parameters after the graph neural network model training are kept fixed. The counterfactual replacement operation only applies to the input of the graph neural network model, and the counterfactual replacement operation performed in step 3 is the same operation as the counterfactual replacement operation performed during training. The re-inference reuses the same forward inference process as in step 2, and the re-inference corresponding to each root cause candidate node is independent of each other and can be executed in parallel to shorten the localization time. The ratio of the counterfactual elimination amount to the global anomaly score is determined as the counterfactual elimination ratio of the root cause candidate node. When the value of the counterfactual elimination amount is lower than 0, both the counterfactual elimination amount and the counterfactual elimination ratio are corrected to 0.

[0019] Furthermore, in step 3, the reordered candidate order is determined as the root cause localization result; starting from the first-ranked root cause candidate node after reordering, the counterfactual elimination ratio is accumulated item by item in the reordered order. Accumulation stops when the accumulated value first reaches the preset judgment threshold, and all root cause candidate nodes that participated in the accumulation at the time of cessation are jointly determined as the final root cause; when the preset judgment threshold is reached only when the first-ranked root cause candidate node participates in the accumulation, it is determined that the failure was caused by one root cause; when the counterfactual elimination ratio of all root cause candidate nodes has participated in the accumulation and the accumulated value is lower than the preset judgment threshold, all root cause candidate nodes are jointly determined as the final root cause, and the accumulated value is output along with the root cause localization result to indicate the degree of localization confidence; for each root cause candidate node, the counterfactual elimination ratio is output as a percentage as quantitative evidence. The quantitative evidence characterizes the degree to which the overall anomaly of the microservice system is eliminated after the corresponding root cause candidate node returns to normal operation; the root cause localization result and the quantitative evidence are output together for the operation and maintenance process to implement recovery operations in the order of the root cause localization result and to verify the effect according to the quantitative evidence.

[0020] By adopting the above technical solution, the present invention has produced the following beneficial effects:

[0021] This invention generates edge aggregation coefficients independently for each transmission direction of each call edge in each symbol adaptive message passing layer, and incorporates edge attribute vectors into the generation basis. This allows call edges in abnormal states to automatically switch to high-pass aggregation, while call edges in normal states remain in low-pass aggregation. As faults propagate along call edges and neighbor service node indicators converge, this invention preserves and amplifies the feature differences between the true root cause and neighbor service nodes, overcoming the homogenization of representations caused by low-pass neighborhood aggregation, and retaining the fault propagation information carried by the call direction. The training and inference phases employ identical counterfactual substitution operations, establishing a system through the second and third supervision terms. The overall abnormality level drops after root cause replacement, while the judgment remains stable after non-root cause replacement, creating a control-response relationship. This ensures the directionality of counterfactual elimination through training, allowing for quantitative differentiation between true root causes and symptomatic service nodes through reordering, significantly reducing false alarms in symptom hubs. The judgment method of cumulatively determining the number of root causes based on the counterfactual elimination ratio allows for adaptive determination of the number of root causes, handling single-root-cause and multi-root-cause cases uniformly. When the accumulation is insufficient, all candidates and the cumulative value are output to indicate the confidence level. The quantitative evidence output in percentage form provides verifiable basis for operation and maintenance. The re-inference of each root cause candidate node is independent and can be executed in parallel, shortening the location time. Attached Figure Description

[0022] Figure 1 This is a service dependency graph and fault propagation diagram of a microservice system in an embodiment of the present invention;

[0023] Figure 2 This is a schematic diagram of the hyperbolic tangent mapping characteristics of the edge aggregation coefficient in an embodiment of the present invention;

[0024] Figure 3 This is a comparative schematic diagram showing the evolution of the feature difference amplitude with the number of message passing layers in an embodiment of the present invention;

[0025] Figure 4 This is a schematic diagram of the construction and counterfactual replacement operation of the feature vector of normal portraits from the same historical period in an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram comparing the abnormal scoring and counterfactual elimination ratio in an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram of the training convergence curves of the three supervised losses in an embodiment of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention. Without conflict, the following embodiments and their technical features can be combined with each other.

[0029] This embodiment uses a microservice system of an e-commerce platform as an example to illustrate the entire localization process. The example microservice system contains 42 microservices, deployed in a containerized manner. Services collaborate through remote calls to complete business requests. The system has a built-in distributed tracing component compatible with the OpenTelemetry specification, continuously collecting span records generated by each call. The monitoring component outputs operational metrics for each microservice at fixed intervals. The training and inference of the graph neural network model run on a server configured with one graphics processing unit (GPU). The entire localization process is automatically triggered by anomaly alerts.

[0030] The execution process of step 1 is as follows. The example microservice system triggered an anomaly alarm at 14:20 on March 12, 2026. Based on the trigger time, a first preset duration of 10 minutes is traced back, and a second preset duration of 20 minutes is extended forward, defining the 30-minute period from 14:10 to 14:40 as the fault period. The anomaly alarm itself is generated by the monitoring component based on existing threshold rules or anomaly detection mechanisms. This invention does not limit the specific generation method of the alarm, only requiring that the alarm carry the trigger time. The reason for tracing back is that the generation of the alarm usually lags behind the actual occurrence of the fault; tracing back allows the nascent stage of the anomaly to be included in the observation scope. Extending forward ensures that steady-state evidence after the fault has fully manifested is also covered. After combining the two segments, the fault period simultaneously contains early evidence of fault evolution and steady-state evidence, resulting in more stable feature statistics. In one optional implementation, the first preset duration is selected from 5 to 15 minutes, and the second preset duration is selected from 10 to 30 minutes; the fault period can also be manually specified by the operation and maintenance personnel based on the alarm content.

[0031] Subsequently, all call chain data for the fault period is retrieved from the distributed tracing component. Each call chain data corresponds to one complete business request and consists of multiple span records. Each span record includes the service identifier of the initiating call, the service identifier of the receiving call, the time of the call, the call latency, and the call status code. The 42 microservices are identified as service nodes, and multiple running instances of the same microservice are merged into the same service node. Instance-level runtime data is first aggregated on the collection side. All span records are traversed, and call edges pointing from the initiator to the receiver are established between the service node corresponding to the service identifier of the initiating call and the service node corresponding to the service identifier of the receiving call. Call edges with the same pointer at both ends are merged. In this example, 118 call edges are obtained after merging. The 42 service nodes and 118 call edges constitute the service dependency graph. The significance of merging is that tens of thousands of span records are often generated between the same pair of services within 30 minutes. Building edges one by one would cause the graph size to become uncontrollable. Merging preserves the health status of the call edges in the form of statistics, which compresses the scale without losing the evidence needed for localization.

[0032] For each merged call edge, all span records belonging to the call edge during the fault period are summarized, and three edge statistics are calculated: the average call latency, the proportion of span records with call status codes belonging to a preset error category, and the total number of span records. In this embodiment, response status codes with values ​​between 500 and 599 are determined as the preset error category. These status codes correspond to server-side processing failures in the Hypertext Transfer Protocol (HTTP) and are most directly associated with faults. When microservices use other communication protocols, the preset error category is determined according to the set of status codes representing server-side processing failures in the corresponding protocol. Using the mean and standard deviation of each of the three edge statistics for the same call edge during historical normal operation periods, the three edge statistics during the fault period are standardized item by item. The standardization is performed according to the following formula:

[0033] (1)

[0034] in, Indicates the first [number]th ... The values ​​of the term-side statistics; The index represents the edge statistics, with values ​​of 1, 2, and 3, which correspond to the average call latency, the proportion of span records whose call status codes belong to the preset error category, and the total number of span records, respectively. This order is the preset statistics order. and These represent the first and second calls made by the same edge during its historical normal operation period. Mean and standard deviation of the item-margin statistics; This indicates the use of extremely small positive numbers to prevent the denominator from being zero. In this embodiment, we take 0.000001. When the historical values ​​of a certain calling edge are completely constant and the standard deviation is 0, the standardization can still be performed normally. Represents the standardized first Edge statistics. The three standardized edge statistics are concatenated in a preset statistical order to obtain a 3-dimensional edge attribute vector. Standardization is performed based on the historical distribution of the calling edge itself, considering the significant differences in latency baselines between different calling edges. Cache queries are typically only a few milliseconds, while cross-datacenter calls can reach hundreds of milliseconds, making absolute values ​​uncomparable horizontally. Standardization converts each edge statistic into its degree of deviation from its normal level, with 0 representing the historical expected level, making it comparable across calling edges. Based on the same semantics, when a calling edge only appears during the fault period and has 0 span records during historical normal operation periods, the edge attribute vector is set to an all-zero vector, i.e., processed according to the historical expected level, avoiding the misinterpretation of missing historical data as evidence of anomalies.

[0035] The historical normal operation period mentioned above is determined and maintained as follows: Taking the most recent 7 days backward from the start of the failure period as the boundary, the value of 7 days can be adjusted within the range of 3 to 30 days. Periods with abnormal alarms and periods where changes were implemented are excluded, and the remaining time is combined to constitute the historical normal operation period. The mean and standard deviation of each edge's statistics and each service node's operational indicators within the historical normal operation period are updated offline daily and cached. During location execution, the cached results are directly read, without consuming online time. The historical normal operation period and the historical reference period discussed later are two different concepts: the former provides the statistical baseline required for standardization and has a wider time range; the latter is specifically used to construct the historical normal profile feature vector for the same period and must be aligned with the failure period, with a narrower time range.

[0036] by Figure 1 The following example uses a local service dependency graph to illustrate the concept. Figure 1 The diagram illustrates eight service nodes and their call edges related to this failure in the example microservice system. Solid arrows represent call edges, pointing from the initiator to the receiver. The root cause of this failure is the inventory service, indicated by a slash. The order service and gateway service exhibit symptoms due to the failure propagation, indicated by gray fill. After the inventory service failed, numerous calls from the order service to the inventory service timed out. The order service's thread resources gradually became exhausted, degrading its processing capacity. Consequently, calls from the gateway service to the order service also timed out, and latency-related exceptions thus propagated tier by tier along the upward path. Figure 1 The direction of diffusion is indicated by a dashed arrow. Figure 1The data also shows the edge attribute vector of the call edge from the order service to the inventory service, with values ​​of (5.2, 4.1, -0.8). This indicates that the average call latency during the fault period deviated from the historical normal level by approximately 5.2 standard deviations, the error rate deviated by approximately 4.1 standard deviations, and the total number of span records was slightly lower than the historical normal level. These three pieces of evidence collectively characterize a call edge in an abnormal state. Because the fault can spread along the call edge and cause the indicators of multiple adjacent service nodes to deteriorate simultaneously, directly selecting the service node with the most severe anomaly based on a single point indicator is prone to misjudgment. Further steps are needed to further distinguish between the root cause and the symptoms in the graph structure.

[0037] For each service node, six operational metrics are collected at preset sampling intervals of 30 seconds during the failure period: mean response latency, 95th percentile response latency, requests per second, request error rate, processor utilization, and memory utilization. Each metric has 60 sampling points within the 30-minute failure period. The mean response latency reflects overall processing speed, while the 95th percentile reflects tail-end degradation; combining these two metrics simultaneously captures both overall slowdown and long-tail jitter. Requests per second and request error rate characterize traffic and quality; processor utilization and memory utilization characterize resource consumption. These six operational metrics cover the most common manifestations of microservice failures. For each operational metric, the mean and standard deviation of the same operational metric during historical normal operation periods for the same service node are used to standardize the values ​​of each sampling point during the failure period. The standardized values ​​are then averaged across all sampling points, calculated as follows:

[0038] (2)

[0039] in, Indicates service node In the feature vector of the fault period, and the first The components corresponding to each operational indicator; Indicates the sequence number of the service node; The index represents the sequence number of the operating metric, with values ​​from 1 to 6. The order of the indexes corresponds to the preset order of the metrics, namely the average response latency, the 95th percentile of response latency, requests per second, request error rate, processor utilization, and memory utilization. Indicates the sequence number of the sampling point; This represents the total number of sampling points during the fault period, which is 60 in this embodiment; Indicates service node The The operational indicators are in the first The values ​​at each sampling point; and Representing service nodes During the historical normal operation period, the The mean and standard deviation of each performance indicator; The meaning and values ​​are the same as before. The average results of the six operational metrics are concatenated in the preset metric order to obtain a fault period feature vector with a dimension of 6. Standardization is performed first, then averaging, so that each component expresses the average degree of deviation from the normal level. The dimensions are eliminated, allowing direct comparison between different service nodes and different operational metrics. In this example, the fault period feature vector for the inventory service is (3.9, 4.6, -1.1, 4.2, 3.5, 2.4). The first two components indicate a significant deterioration in response latency, the third component is negative, corresponding to a decrease in throughput during the fault, and the last three components indicate a simultaneous increase in error rate and resource consumption. Operational metrics are not limited to the above six items; disk I / O utilization, thread pool utilization, etc., can also be included, increasing the dimension of the fault period feature vector accordingly, while the processing method remains the same.

[0040] The process of constructing the historical normal profile feature vector is as follows. For each service node, five historical reference time periods are selected from the historical monitoring data, with a preset number of reference periods. These historical reference time periods must simultaneously meet three conditions: they belong to the same weekday type as the fault period (meaning both are weekdays or rest days); their start and end times within a day are the same as those of the fault period within a day; and the microservice system is in normal operating condition within the historical reference time period, determined by the number of abnormal alarms being zero within the corresponding time period. The first two conditions address the significant periodicity of the microservice system load: traffic patterns differ between weekdays and rest days, and there are also obvious peaks and troughs within a day. Only normal levels statistically derived from comparable load periods are meaningful for reference; otherwise, using the indicators from the early morning trough to measure the midday peak would misjudge normal load differences as abnormal. The third condition ensures that the reference data itself is clean. For each historical reference period, the same indicator types, standardization methods, averaging methods, and concatenation order as the feature vectors of the fault periods are used to obtain reference feature vectors. Then, the average of the five reference feature vectors is calculated dimension by dimension.

[0041] (3)

[0042] in, Indicates service node In the historical period of normal portrait feature vectors and the first The components corresponding to each operational indicator; This indicates a preset reference quantity, which is 5 in this embodiment; Indicates the sequence number of the historical reference period; Indicates by the first The reference feature vector calculated from the historical reference period is related to the first historical reference period. The components corresponding to the operational indicators. Averaging over multiple historical reference periods can suppress the impact of occasional fluctuations within a single period, making the historical normal profile feature vector a stable characterization of the normal state of the service node. When the service node has been online for a short time and the number of selectable historical reference periods is less than 5, the period closest to the failure period and meeting the conditions for normal operation is used to supplement it. The duration of the supplementary period is consistent with the duration of the failure period to ensure consistent statistical caliber. In this example, the historical normal profile feature vector of the inventory service is (0.1, 0.2, 0.0, -0.1, 0.1, 0.0), with each component near 0, consistent with the semantics of a normal state. Dimensionally averaging can also be replaced by dimensionally taking the median, which is more robust to individual outlier historical reference periods.

[0043] Figure 4 Taking the average response latency of inventory services as an example, the relationship between the two types of characteristics mentioned above is clearly illustrated. Figure 4 In the above analysis, the measured curve is at a low level before the abnormal alarm time, then rises rapidly and remains at a high level. After averaging over 60 sampling points, the component corresponding to the mean response delay in the feature vector of the fault period is 3.9, marked by a horizontal dashed line. Three dotted lines show three reference curves from five historical reference periods, all fluctuating around 0. After averaging over the five historical reference periods, the component corresponding to the mean response delay in the feature vector of the normal profile from the same historical period is 0.1, marked by a horizontal thick solid line. The difference between the two horizontal lines represents the abnormal evidence to be removed in the subsequent counterfactual replacement operation. Figure 4 The vertical arrow in the text indicates the direction of replacement, and the specific execution method of replacement is explained in step 3.

[0044] The execution process of step 2 is as follows. The pre-trained graph neural network model consists of three parts in sequence: an input transformation network composed of fully connected layers, four symbolic adaptive message passing layers stacked in sequence, and an anomaly scoring network composed of fully connected layers and a sigmoid activation function. The input transformation network maps the fault period feature vector of each service node with a dimension of 6 to an initial representation vector with a preset representation dimension of 64.

[0045] (4)

[0046] in, Indicates service node The initial representation vector; Indicates service node The feature vector of the fault period; This represents the weight matrix of the fully connected layer in the input transformation network, with a size of 64 rows and 6 columns; This represents the bias vector of the fully connected layer in the input transformation network, with a dimension of 64. Increasing the dimension to 64 provides sufficient expressive capacity for subsequent message passing. The preset representation dimension can be selected from 32 to 128; the preset number of layers can be selected from 2 to 8. In this embodiment, 4 is chosen, ensuring that the receptive field of any service node covers a 4-hop call relationship, which is comparable to the call depth of common microservice systems.

[0047] Each call edge carries two propagation directions: a downlink propagation direction from the initiator to the receiver, and an uplink propagation direction from the receiver to the initiator. The reason for distinguishing these directions is that different types of exceptions propagate in different directions along the call edge: latency-related exceptions mainly propagate along the uplink direction, causing degradation on the called party and slowing down the initiator; load-related exceptions mainly propagate along the downlink direction, causing a surge in traffic on the initiator or a retry storm that overwhelms the called party. The two propagation directions carry opposite causal semantics; if treated symmetrically, the two types of propagation evidence would cancel each other out. Therefore, in each symbol-adaptive messaging layer, edge aggregation coefficients are generated independently for each propagation direction of each call edge, and each call edge obtains two independent edge aggregation coefficients at each layer.

[0048] Each symbol-adaptive message passing layer has an edge coefficient network, which consists of a fully connected layer and a hyperbolic tangent activation function. For each transmission direction of each call edge, the input representation vector of the information sending service node, the input representation vector of the information receiving service node, and the edge attribute vector are concatenated in a fixed order to obtain a concatenated vector of dimension 131, which is then input into the edge coefficient network.

[0049] (5)

[0050] in, Indicates the first In a symbol-adaptive message passing layer, the service node For the information sending side service node, with service node The edge aggregation coefficient in the transmission direction of the information receiving service node; This indicates the layer number of the symbolic adaptive message passing layer, with a value ranging from 1 to... , This indicates the preset number of layers, which is 4 in this embodiment; Represents the hyperbolic tangent activation function; This indicates that the pieces are joined together in a fixed order, starting and ending. and Representing service nodes With service nodes In the The input representation vector of the first symbol adaptive message passing layer is the initial representation vector, and the input representation vector of each subsequent layer is the output representation vector of the previous layer. Indicates service node With service nodes The edge attribute vector of the edge can be accessed between them; Indicates the first The weight vector of the fully connected layer in the edge coefficient network of the symbolic adaptive message passing layer has a dimension of 131. This represents the bias of the corresponding fully connected layer. A fixed concatenation order allows the edge coefficient network to distinguish between the information sending and receiving sides based on their location. The concatenation order of the two transmission directions of the same calling edge is interchanged, making the edge aggregation coefficients independent and thus preserving directional information. The hyperbolic tangent activation function is chosen for three reasons: the output naturally falls between -1 and 1, preventing any calling edge from dominating aggregation with excessively large coefficients; the function is differentiable everywhere, allowing for end-to-end training with the entire graph neural network model; and the positive or negative sign of the output directly acts as a switch for the aggregation mode, eliminating the need for additional discriminative branches.

[0051] Involving edge attribute vectors in concatenation is a key design element in generating edge aggregation coefficients. For example... Figure 2 As shown, the hyperbolic tangent activation function maps the output values ​​of the fully connected layers in the edge coefficient network to edge aggregation coefficients. When the output value is positive, the edge aggregation coefficient is positive, corresponding to the low-pass aggregation region; when the output value is negative, the edge aggregation coefficient is negative, corresponding to the high-pass aggregation region. For edges in a normal state, the components of the edge attribute vector are close to 0. The output of the fully connected layer is mainly determined by the input representation vectors on both sides. The operating point after training usually falls in the positive range, for example... Figure 2 The output value of the fully connected layer corresponding to the working point of a normal call edge is 1.2. After mapping with the hyperbolic tangent activation function, the edge aggregation coefficient is approximately 0.834, corresponding to low-pass aggregation. For call edges in abnormal states, the significantly higher latency and error evidence in the edge attribute vector push the output of the fully connected layer into the negative range, for example... Figure 2 The fully connected layer output value corresponding to the operator point of the anomalous call edge is -1.8, and the aggregation coefficient after mapping is approximately -0.947, corresponding to high-pass aggregation. The statistical evidence of the anomaly causes the operator point to shift into the negative range, which is a behavior learned by the model during training, and there is no need to manually set switching rules for any call edge.

[0052] After generating the edge aggregation coefficients, perform degree normalization:

[0053] (6)

[0054] in, Represents the normalized aggregation coefficient; and Representing service nodes With service nodes The number of connected call edges for each node; the connected call edges for a service node include all call edges where the service node is the initiator and the receiver. Without constraints, hub nodes like gateway services have a large number of connected call edges, leading to a higher number of terms in the aggregation summation. This naturally results in a larger neighborhood aggregation vector for the hub node, further amplifying the hub's characteristics. Using the square root of the product of the number of connected call edges at both ends as the denominator, a penalty is applied to the connection size at both ends, providing symmetrical scale control. Figure 1 Taking the order service and inventory service as an example, the number of connected call edges for the inventory service is 3, and the number of connected call edges for the order service is 4. The product of the two is 12, and its square root is approximately 3.464. In the upward transmission direction from the inventory service to the order service, the normalized aggregation coefficient is approximately -0.947 divided by 3.464, which is approximately -0.273.

[0055] For each symbol, the adaptive message passing layer updates the representation as follows:

[0056] (7)

[0057] in, Indicates service node In the The output representation vector of a symbolic adaptive message passing layer; This represents the preset residual weight, which is 0.5 in this embodiment, but can be selected within the range of 0.3 to 0.8; Indicates service node The initial representation vector; Representation and service node The set consists of all service nodes directly connected by the connection edge; the product term to the right of the summation sign represents the product term in the summation of service nodes. In the transmission direction of the information receiving service node, the normalized aggregation coefficient is multiplied by the input representation vector of the information sending service node. The multiplication results of all connected call edges are accumulated dimension by dimension to obtain the neighborhood aggregation vector. When the normalized aggregation coefficient is positive, the feature information of the information sending service node is incorporated into the neighborhood aggregation vector in the same direction, achieving low-pass aggregation, which is equivalent to taking a weighted average with the neighbors, and the features are smoothed. When the normalized aggregation coefficient is negative, the feature information is incorporated into the neighborhood aggregation vector in the opposite direction, achieving high-pass aggregation, which is equivalent to taking the difference with the neighbors, and the feature differences are preserved and amplified. The fault propagation scenario is precisely the failure scenario of low-pass aggregation: the service node indicators around the true root cause have converged, and the weighted average will pull the representation of the true root cause to the average level of the neighbors. The deeper the layer, the more homogeneous the representation, and the more indivisible the true root cause becomes. In the same scenario, high-pass aggregation amplifies the remaining differences between the true root cause and the neighbors layer by layer, becoming the basis for differentiation. The design of multiplying the initial representation vector by the preset residual weights and then adding them dimension by dimension serves two purposes: each layer re-injects the unmixed original evidence, so that the deep network will not forget the input; at the same time, it provides anchor points for layer-by-layer amplification and suppresses numerical divergence. Figure 3 The evolution of feature difference magnitude with message passing layer was compared under three aggregation methods: low-pass aggregation with all edge aggregation coefficients being positive causes feature difference to decay layer by layer and approach 0; high-pass aggregation omitting the initial representation vector residual causes feature difference to continue to grow, posing a risk of numerical divergence; the symbolic adaptive aggregation with initial representation vector residual adopted in this invention preserves, amplifies and tends to bounded saturation of feature difference, taking into account both discriminative ability and numerical stability.

[0058] The output representation vector of the last symbol from the adaptive message passing layer is input into the anomaly scoring network:

[0059] (8)

[0060] in, Indicates service node The abnormal score ranges from 0 to 1. Represents the sigmoid activation function; Indicates service node The output representation vector of the last symbol adaptive message passing layer; This represents the weight vector of the fully connected layer in the anomaly scoring network, with a dimension of 64. This represents the bias of the corresponding fully connected layer. The global anomaly score is obtained by summing the anomaly scores of all service nodes.

[0061] (9)

[0062] in, Indicates global anomaly score; The total number of service nodes in the service dependency graph is 42 in this example. The global anomaly score characterizes the overall anomaly level of the entire microservice system. The impact of a fault spreading from the root cause to multiple service nodes is included, which is the basis for measuring candidate contributions by the change in the global anomaly score in step 3. In this example, the global anomaly score is 9.62. The top 8 service nodes, ranked from highest to lowest anomaly score, are selected as root cause candidate nodes, forming the initial candidate sequence. These are: Gateway Service, Order Service, Inventory Service, Payment Service, User Service, Database Proxy Service, Product Service, and Cache Service, with corresponding anomaly scores of 0.95, 0.92, 0.90, 0.83, 0.74, 0.69, 0.61, and 0.55, respectively. The preset number of candidates can be selected from 5 to 20. In an optional implementation, the preset number of candidates is the total number of service nodes. Step 3 degenerates into performing a counterfactual replacement operation on each service node to completely avoid the extreme case where the root cause does not enter the initial candidate sequence, at the cost of increased computation.

[0063] The graph neural network model is pre-trained using historical fault samples with root cause annotations. This embodiment uses 1200 historical fault samples, approximately 300 of which are from real fault handling records, and the remaining approximately 900 are from fault injection experiments conducted in a test environment. Injection types cover processor overload, memory leaks, increased network latency, and unavailability of dependent services, with the injection location being the root cause annotation. Approximately 120 of the injected samples are dual-root-cause samples, simultaneously injecting faults into two microservices, while the rest are single-root-cause samples. Multiple-root-cause scenarios are thus included in the training distribution. Accumulating samples through fault injection alleviates the scarcity of real fault samples and ensures clear injection locations and naturally accurate root cause annotations. Each historical fault sample includes a service dependency graph, edge attribute vectors of all call edges constructed in the same manner as in step 1, fault period feature vectors and historical normal profile feature vectors of all service nodes, and a root cause annotation. The 1200 historical fault samples are divided into training, validation, and test sets of 1000, 100, and 100 samples respectively.

[0064] During training, three supervision terms are performed for each historical fault sample. The first supervision term aims to make the anomaly score output by the service node corresponding to the root cause label approach 1, while the anomaly scores output by other service nodes approach 0, and calculates the binary classification cross-entropy loss:

[0065] (10)

[0066] in, This indicates the loss from the first oversight item; Indicates service node The annotation value is 1 for the service node corresponding to the root cause annotation and 0 for the other service nodes. Represents the natural logarithm; The meaning is the same as before. The second supervision constructs one counterfactual augmented sample. The construction method involves performing a counterfactual replacement operation on each service node corresponding to the root cause label. The specific content of the counterfactual replacement operation is exactly the same as in step 3. The binary classification cross-entropy loss is calculated with the goal that the anomaly scores output by all service nodes in the counterfactual augmented sample approach 0.

[0067] (11)

[0068] in, This indicates the loss from the second oversight; This represents the service nodes of the input graph neural network model representing counterfactual augmented samples. The output anomaly score. The third supervision step constructs a control augmentation sample. This is done by randomly selecting one service node from those not corresponding to the root cause label as the target for a counterfactual substitution operation. This random selection is repeated in each training round to ensure sufficient coverage of the non-root cause space across multiple training rounds. The binary classification cross-entropy loss is calculated using the control augmentation sample, following the same supervision objective as the first supervision step.

[0069] (12)

[0070] in, This indicates the loss from the third oversight item; This represents the service node after inputting the augmented sample into the neural network model. Output of abnormal scores; The meaning is the same as before, that is, the label values ​​of the original sample are used for the comparison augmented sample. The total loss is obtained by weighting and summing the losses of the three supervised items according to the preset loss ratio:

[0071] (13)

[0072] in, This represents the total loss after weighted summation; , and This represents the preset loss ratio, which in this embodiment is 1.0, 0.5, and 0.5 respectively. It can also be adjusted within the range of 0.2 to 1.0. Parameter updates are performed using a gradient descent-type optimization algorithm. In this embodiment, the adaptive moment estimation optimization algorithm is selected, with a learning rate of 0.001 and a batch size of 8 historical fault samples. A total of 200 training rounds are conducted. During training, the total loss is monitored on the validation set. The training stops early when the loss stops decreasing after 20 consecutive rounds, and the set of parameters with the lowest total loss on the validation set is retained as the model parameters after training.

[0073] The second and third supervisions together constitute a comparative design. The purpose of this arrangement is explained below. With only the first supervision, the graph neural network model learns the discriminative relationship from the input to the anomaly score. However, the counterfactual substitution operation in step 3 generates inputs outside the training distribution. The model's response direction to such inputs is not guaranteed, and the global anomaly score may not decrease after replacing the true root cause. The second supervision incorporates the same counterfactual substitution operation as in the inference phase into the training, directly requiring the overall judgment to decrease after root cause replacement with an all-zero target, and writing the expected response relationship into the model parameters. However, supplementing only the second supervision still has loopholes: the counterfactual substitution operation leaves identifiable traces on the input. For example, the edge attribute vectors of the connected call edges of the affected object all become all-zero vectors. The model may learn a shortcut to lower the score whenever a substitution trace appears. In this case, replacing any service node will cause the global anomaly score to decrease, and the counterfactual elimination will lose its discriminative power. The third supervision precisely blocks this shortcut: it performs the same counterfactual substitution operation on non-root causes, keeping the labeled values ​​unchanged, forcing the model to maintain its original judgment while perceiving the substitution traces. The score only drops when the substitution object is indeed the root cause. Together, the three supervisions establish a comparative response relationship where the overall anomaly level decreases after root cause substitution, and the judgment remains stable after non-root cause substitution. Figure 6 As shown, the losses of the three supervised parameters decreased synchronously and converged to a plateau over 200 training rounds, indicating that a control-response relationship has been established.

[0074] Step 3 is executed as follows. For each root cause candidate node in the initial candidate sequence, a counterfactual replacement operation is performed: the fault period feature vector of the target is replaced entirely with the historical normal profile feature vector of the target during the same period. Simultaneously, the edge attribute vectors of all call edges where the target is the initiator or receiver are set to all zeros. The remaining inputs remain unchanged, i.e., the topology of the service dependency graph, the edge attribute vectors of all other call edges, the fault period feature vectors of all other service nodes, and all parameters after the graph neural network model training are fixed. Node features and edge features need to be replaced simultaneously: the anomaly of the target is not only reflected in its own operational metrics but also in the latency and error statistics of its connected call edges. Replacing only the fault period feature vector will leave residual edge-level anomaly evidence. The edge coefficient network will still generate high-pass aggregation coefficients based on the residual evidence, and the anomaly impact will not be completely removed, leading to a systematic underestimation of the counterfactual elimination amount. Setting the edge attribute vectors of connected call edges to all zeros restores the expected historical normal level under standardized semantics, perfectly consistent with the semantics of the all-zero vectors in Step 1. The entire counterfactual substitution operation is equivalent to a single-variable control experiment: the only change is that the object being acted on is returned to the normal state, and the change in the global anomalous score after re-inference can therefore be attributed to the object being acted on. Figure 4The vertical arrow in the image indicates the replacement performed on the inventory service. The component corresponding to the average response latency is replaced from 3.9 to 0.1, and the other components are treated similarly.

[0075] The input after the counterfactual replacement operation is fed into the graph neural network model for re-inference. The re-inference reuses the same forward inference process as step 2. The anomaly scores of all service nodes obtained from the re-inference are summed to obtain the global counterfactual anomaly score corresponding to the affected object. The counterfactual elimination amount and counterfactual elimination ratio are calculated using the following formula:

[0076] (14)

[0077] (15)

[0078] in, Indicates the sequence number of the root cause candidate node; Indicates the first The counterfactual global anomaly score is obtained by performing a counterfactual replacement operation on each root cause candidate node as the target and then re-inferring. Indicates the first The amount of counterfactual elimination for each root cause candidate node; This indicates that the larger of the two values ​​within the parentheses is taken; when the difference is negative, the counterfactual elimination amount is corrected to 0. The meaning is the same as before; Indicates the first The counterfactual elimination ratio of each root cause candidate node. Negative differences occasionally occur, usually due to a slight mismatch or numerical fluctuation between the historical normal profile feature vector and the current load. Negative values ​​do not possess root cause semantics and are uniformly corrected to 0 to avoid interfering with sorting and accumulation. The re-inference corresponding to each root cause candidate node is independent of each other. In this embodiment, the counterfactual inputs of 8 root cause candidate nodes are assembled into 1 batch, and 1 batch forward inference is performed on 1 graphics processor, which takes about 0.6 seconds.

[0079] The result of this re-reasoning is as follows: Figure 5As shown, the counterfactual elimination rates of the eight root cause candidate nodes are as follows: Gateway Service 9%, Order Service 14%, Inventory Service 76%, Payment Service 7%, User Service 4%, Database Proxy Service 11%, Product Service 3%, and Cache Service 0%. The difference for Cache Service was originally negative but has been corrected to 0. Taking Inventory Service as an example, its corresponding global counterfactual anomaly score is 2.31, and the counterfactual elimination amount is 9.62 minus 2.31, which equals 7.31. The counterfactual elimination rate is approximately 76% (7.31 divided by 9.62). Gateway Service, ranked first in the initial candidate sequence, is a typical symptomatic service node: it has the most connected call edges, and all graph symptoms converge towards it, resulting in the highest anomaly score. However, after restoring it to its normal state, the evidence of the true root cause remains, the global anomaly score hardly decreases, and the counterfactual elimination rate is only 9%. Inventory Service, ranked third in anomaly score, has a counterfactual elimination rate of 76%, rising to first place after being reordered by counterfactual elimination amount from largest to smallest. The comparison between the two rankings visually demonstrates the difference between relevance evidence and causal evidence, and the re-ranking enables a quantitative distinction between root causes and symptoms.

[0080] The reordered candidate order is determined as the root cause localization result. Starting from the first-ranked root cause candidate node after reordering, the counterfactual elimination ratio is accumulated item by item: the counterfactual elimination ratio of the inventory service is 76%, the first item reaches the preset judgment threshold of 70%, and the accumulation stops, determining that this failure was caused by one root cause, and the final root cause is the inventory service. The root cause localization result and quantitative evidence are output together: the final root cause quantitative evidence of the inventory service is 76%, indicating that after the inventory service returns to normal operation, the overall anomaly of the microservice system is expected to be eliminated by 76%. In the operation and maintenance process, recovery operations are performed according to the order of the root cause localization results. After recovery, the actual decline in the global anomaly score is compared with the quantitative evidence to verify the localization conclusion. The preset judgment threshold can be selected within the range of 60% to 90%, which means the overall anomaly ratio that the final root cause needs to explain.

[0081] The cumulative determination method naturally covers multiple root cause scenarios. In another failure case, the payment service and the database proxy service failed simultaneously. After reordering, the counterfactual elimination rate of the payment service was 41%. The first cumulative rate did not reach 70%, so the second-ranked database proxy service's 35% was accumulated. When the cumulative value reached 76%, the accumulation stopped, and the payment service and the database proxy service were jointly determined as the final root cause. There is also a fallback scenario: the counterfactual elimination rates of all root cause candidate nodes have been accumulated, but the cumulative value is still below 70%, for example, the cumulative value of a certain failure is only 52%. In this case, all root cause candidate nodes are jointly determined as the final root cause, and the cumulative value of 52% is output along with the root cause location result, indicating that the location confidence level is low. The maintenance personnel can expand the scope of investigation or increase the number of preset candidates and re-execute step 3.

[0082] The localization effect was verified on 100 historical fault samples in the test set, and the first-ranked hit rate and the top-three hit rate of the final root cause were statistically analyzed. The first-ranked hit rate of this invention was 91%, and the top-three hit rate was 97%. In comparison, the hit rates of the two items for the localization method based on graph attention networks were 74% and 87%, respectively, and the hit rates of the two items for the localization method based on random walks were 62% and 76%, respectively. Ablation validation further supported the effectiveness of each design: after removing the second and third supervision items, the first-ranked hit rate decreased to 79%; after forcing all edge aggregation coefficients to be positive and degenerating to pure low-pass aggregation, it decreased to 77%; after removing the edge attribute vectors from the concatenation, it decreased to 82%. The average localization time for a single historical fault sample was 0.9 seconds, which meets the timeliness requirements for online fault handling.

[0083] In addition to the optional implementations already given, the following alternative implementations exist: The edge statistics can be augmented with the 95th percentile of the call latency as the fourth item, correspondingly increasing the dimension of the edge attribute vector to 4; the edge coefficient network can be replaced with a multilayer perceptron consisting of two fully connected layers and one linear rectified activation function, while retaining the hyperbolic tangent activation function at the output to maintain the value range of the edge aggregation coefficients; the anomaly scoring network can be replaced with a combination of two fully connected layers and one linear rectified activation function, while retaining the sigmoid activation function at the end; the gradient descent optimization algorithm can be a stochastic gradient descent algorithm; the entire localization process can be deployed as a persistent localization service automatically triggered by anomaly alarms, or it can be manually triggered by operations personnel. None of the above substitutions change the collaborative relationships between the steps.

[0084] This invention is not limited to the specific embodiments described above. The invention extends to any new feature or combination disclosed in this specification, as well as any new method or process step or combination disclosed herein.

Claims

1. A method for locating the root cause of microservice call chains based on graph neural networks, characterized in that, It includes the following 3 steps: Step 1: Determine the fault period based on the abnormal alarms of the microservice system, collect the call chain data within the fault period, construct a service dependency graph including service nodes and call edges from the initiator to the receiver, and generate the edge attribute vector of each call edge and the fault period feature vector and historical normal profile feature vector of each service node. Step 2: Input the service dependency graph, edge attribute vector, and fault period feature vector into a pre-trained graph neural network model. The graph neural network model includes stacked symbolic adaptive message passing layers. In each symbolic adaptive message passing layer, for each transmission direction of each call edge, generate an edge aggregation coefficient with values ​​between -1 and 1 based on the input representation vectors of the information sending service node and the information receiving service node and the edge attribute vector. According to the sign of the edge aggregation coefficient, the feature information of the information sending service node is fed into the information receiving service node in a low-pass aggregation or high-pass aggregation manner. The anomaly scores of all service nodes output by the graph neural network model are accumulated to obtain a global anomaly score. Select a preset number of service nodes with the highest anomaly scores as root cause candidate nodes to form an initial candidate sequence. Step 3: Perform counterfactual replacement operation on each root cause candidate node in the initial candidate sequence as the target: replace the fault period feature vector of the target with the historical normal profile feature vector of the target during the same period, and set the edge attribute vector of all calling edges of the target as the initiator or receiver to all zero vectors, while keeping the other inputs as is; feed the input after the counterfactual replacement operation into the graph neural network model for re-inference, and sum the anomaly scores of all service nodes obtained by the re-inference to obtain the counterfactual global anomaly score; The difference between the global anomaly score and the counterfactual global anomaly score is determined as the counterfactual elimination amount. All root cause candidate nodes are reordered in descending order of the counterfactual elimination amount. The final root cause is determined and output based on the reordered candidate order.

2. The method according to claim 1, characterized in that, In step 1, based on the moment when the microservice system triggers an anomaly alarm, the system traces backward for a first preset duration and extends forward for a second preset duration, defining the covered time range as the fault period. The call chain data is collected from the distributed tracing component of the microservice system. Each call chain data includes multiple span records, and each span record includes the service identifier of the initiating call, the service identifier of the receiving call, the time of the call, the call latency, and the call status code. Each microservice in the microservice system is defined as a service node. All span records are traversed, and a call edge is established between the service node corresponding to the service identifier of the initiating call and the service node corresponding to the service identifier of the receiving call, pointing from the initiator to the receiver. The call edges pointing to the same service nodes at both ends are merged, and all service nodes and all merged call edges constitute a service dependency graph.

3. The method according to claim 2, characterized in that, In step 1, for each merged call edge, all span records belonging to the call edge during the fault period are summarized, and the average call latency, the proportion of span records with call status codes belonging to the preset error category, and the total number of span records are calculated to obtain three edge statistics. Using the mean and standard deviation of the three edge statistics for the same call edge during the historical normal operation period, the three edge statistics during the fault period are standardized one by one. The standardized three edge statistics are concatenated in the preset statistical order to obtain the edge attribute vector. When the call edge only appears during the fault period and the number of span records during the historical normal operation period is 0, the edge attribute vector is set to a zero vector. The zero vector represents that the corresponding call edge is at the historical normal expected level under the standardized semantics.

4. The method according to claim 1, characterized in that, In step 1, for each service node, six operational metrics are collected at preset sampling intervals during the fault period: mean response latency, 95th percentile response latency, requests per second, request error rate, processor utilization, and memory utilization. For each operational metric, the mean and standard deviation of the same operational metric during the historical normal operation period of the same service node are used to standardize the values ​​of each sampling point during the fault period. The average values ​​of each standardized operational metric across all sampling points during the fault period are then calculated. The average results of the six operational metrics are concatenated in the preset metric order to obtain a fault period feature vector with a dimension of 6.

5. The method according to claim 4, characterized in that, In step 1, for each service node, a preset number of historical reference time periods are selected from the historical monitoring data. The historical reference time periods must simultaneously meet the following three conditions: they belong to the same week type as the fault period, and the same week type means that they are both weekdays or both rest days. The start and end times within a day are the same as the start and end times of the fault period within a day; The microservice system is in normal operation during the historical reference period. Normal operation is determined by the number of abnormal alarms in the corresponding period being 0. For each historical reference period, it is processed according to the same indicator type, the same standardization method, the same averaging method and the same concatenation order as the feature vector of the fault period to obtain the reference feature vector. The reference feature vectors of the preset number of references are averaged one dimension by one to obtain the normal profile feature vector of the same period in history. When the number of historical reference time periods that can be selected by the service node is less than the preset number of reference periods, the time period closest to the fault time period and meeting the normal operation conditions is used to make up the difference, and the duration of the make-up time period is consistent with the duration of the fault time period.

6. The method according to claim 1, characterized in that, The graph neural network model includes an input transformation network consisting of fully connected layers, a symbolic adaptive message passing layer with a predetermined number of stacked layers, and an anomaly scoring network consisting of fully connected layers and a sigmoid activation function. The input transformation network maps the fault period feature vector of each service node to an initial representation vector with a preset representation dimension. The initial representation vector serves as the input representation vector of the first symbol adaptive message passing layer. Each call edge carries two transmission directions, including a downlink transmission direction from the initiator to the receiver and an uplink transmission direction from the receiver to the initiator. Each symbol adaptive message passing layer has an edge coefficient network, which consists of a fully connected layer and a hyperbolic tangent activation function in sequence. For each transmission direction of each call edge, the input representation vector of the information sending service node, the input representation vector of the information receiving service node, and the edge attribute vector are concatenated in this fixed order and input into the edge coefficient network. The hyperbolic tangent activation function maps the output of the fully connected layer to edge aggregation coefficients. Each call edge obtains two independent edge aggregation coefficients corresponding to the two transmission directions in each symbol adaptive message passing layer.

7. The method according to claim 6, characterized in that, In each symbol adaptive message passing layer, the following operations are also performed: For each edge aggregation coefficient, the edge aggregation coefficient is divided by the square root of the product of the number of connected call edges of the two service nodes at both ends of the call edge to obtain the normalized aggregation coefficient. The connected call edges of the service node include all call edges where the service node is the initiator and the service node is the receiver. Each service node in the service dependency graph is treated as the current service node. All connected call edges of the current service node are traversed. A normalized aggregation coefficient is selected for the transmission direction of each connected call edge with the current service node as the information receiving service node. This normalized aggregation coefficient is multiplied by the input representation vector of the information sending service node in the transmission direction. The multiplication results of all connected call edges are accumulated dimension-wise to obtain the neighborhood aggregation vector. When the normalized aggregation coefficient is positive, the feature information of the information sending service node is incorporated into the neighborhood aggregation vector in the same direction, achieving low-pass aggregation. When the normalized aggregation coefficient is negative, the feature information of the information sending service node is incorporated into the neighborhood aggregation vector in the opposite direction, achieving high-pass aggregation. The initial representation vector of the current service node is multiplied by a preset residual weight and then added dimension-wise to the neighborhood aggregation vector to obtain the output representation vector of the current service node in this layer. This output representation vector serves as the input representation vector for the next symbolic adaptive message passing layer. The output representation vector of the last symbolic adaptive message passing layer is input into the anomaly scoring network, which outputs an anomaly score for each service node, with values ​​between 0 and 1.

8. The method according to claim 1, characterized in that, The graph neural network model is pre-trained using historical fault samples with root cause annotations. These historical fault samples are derived from real fault handling records and records accumulated during fault injection experiments in a test environment. Each historical fault sample includes a service dependency graph, edge attribute vectors of all call edges constructed in the same manner as in step 1, fault period feature vectors and historical normal profile feature vectors of all service nodes, and root cause annotations. During training, the following three supervision measures are performed for each historical fault sample: The first supervision measure calculates a binary classification cross-entropy loss with the objective that the anomaly score output by the service node corresponding to the root cause annotation approaches 1, while the anomaly scores output by the other service nodes approach 0; The second supervision measure... Two supervisions construct one counterfactual augmented sample. The construction method is to perform a counterfactual replacement operation on each service node corresponding to the root cause label, and calculate the binary cross-entropy loss with the goal that the anomaly scores output by all service nodes in the counterfactual augmented sample are close to 0. The third supervision constructs one control augmented sample. The construction method is to randomly select one service node other than the service node corresponding to the root cause label as the target to perform a counterfactual replacement operation, and calculate the binary cross-entropy loss using the supervision goal of the first supervision. The losses of the three supervisions are weighted and summed according to a preset loss ratio, and all parameters of the graph neural network model are updated through a gradient descent optimization algorithm.

9. The method according to claim 8, characterized in that, In step 3, when performing the counterfactual replacement operation, the topology of the service dependency graph, the edge attribute vectors of all other called edges, the fault period feature vectors of all other service nodes, and all parameters after the graph neural network model is trained are kept fixed. The counterfactual replacement operation only applies to the input of the graph neural network model, and the counterfactual replacement operation performed in step 3 is the same operation as the counterfactual replacement operation performed during training. The re-inference reuses the same forward inference process as in step 2, and the re-inference corresponding to each root cause candidate node is independent of each other and can be executed in parallel to shorten the localization time. The ratio of counterfact elimination amount to global anomaly score is determined as the counterfact elimination ratio of root cause candidate nodes. When the counterfact elimination amount is less than 0, both the counterfact elimination amount and the counterfact elimination ratio are corrected to 0.

10. The method according to claim 9, characterized in that, In step 3, the reordered candidate order is determined as the root cause localization result; starting from the root cause candidate node ranked first after reordering, the counterfactual elimination ratio is accumulated item by item in the reordered order. When the accumulated value first reaches the preset judgment threshold, the accumulation stops, and all root cause candidate nodes that have participated in the accumulation at the time of cessation are jointly determined as the final root cause. When the preset judgment threshold is reached when only the first-ranked root cause candidate node participates in the accumulation, the fault is determined to be caused by one root cause. When the counterfact elimination ratio of all root cause candidate nodes has been accumulated and the accumulated value is lower than the preset judgment threshold, all root cause candidate nodes will be jointly determined as the final root cause, and the accumulated value will be output along with the root cause localization result to indicate the localization confidence level. For each root cause candidate node, the counterfactual elimination rate is output as a percentage as quantitative evidence. The quantitative evidence represents the degree to which the overall anomaly of the microservice system is eliminated after the corresponding root cause candidate node returns to normal operation. The root cause location results and quantitative evidence are output together, so that the operation and maintenance process can carry out recovery operations in the order of the root cause location results and verify the effect according to the quantitative evidence.

Images