Business full-link log intelligent analysis and tracing system and method

Abstract

The application discloses a service full-link log intelligent analysis and tracing system and method, and belongs to the technical field of log tracing. The method specifically comprises the following steps: mapping collected logs into event segments on a continuous time sequence interval, performing folding processing on event segments with time overlap or semantic continuous relationship, obtaining a time sequence folding chain structure, extracting state change characteristics of each event segment in the time sequence folding chain, constructing a link state vector, applying controllable disturbance coding, obtaining a disturbance coding sequence, when an abnormal event is detected, based on the disturbance coding sequence, calculating a contribution path of each upstream event segment to the abnormal event, generating an abnormal propagation inversion sequence, determining an abnormal source event and a corresponding service node, and outputting a tracing result. The application can reduce the dependence on rule matching and manual experience in a multi-node, heterogeneous and time-inconsistent log environment, and improve the pertinence and stability of abnormal positioning.

Description

Technical Field

[0001] This invention belongs to the field of log tracing technology, specifically a business end-to-end log intelligent analysis and tracing system and method. Background Technology

[0002] With the widespread adoption of distributed and microservice architectures, business systems typically involve multiple nodes, including a gateway layer, application service layer, message middleware, and data storage layer, collaborating to complete a single business request. During operation, each node continuously generates a large amount of log data. These logs differ in source, format, granularity, and time frame, forming a highly heterogeneous and discrete log set.

[0003] To address the needs of log analysis and fault localization, existing solutions often employ keyword retrieval, rule matching, or call chain tracing to investigate anomalies. In complex business scenarios, anomalies often propagate gradually across multiple nodes in a hidden manner, with multiple levels of indirect correlation between their triggering source and final manifestation. Traditional analysis methods struggle to achieve unified temporal alignment of logs across nodes, resulting in discontinuous or misaligned anomaly propagation paths, which in turn affects the accuracy of root cause localization. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention proposes an intelligent analysis and tracing system and method for the entire business log chain. It can perform unified modeling in heterogeneous log environments and support reverse parsing of cross-node anomaly propagation paths, enabling in-depth analysis and tracing of the entire business log chain.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] Intelligent analysis and source tracing methods for the entire business log chain include:

[0007] Heterogeneous logs from different business nodes are collected and mapped to event fragments on a continuous time interval. Event fragments with overlapping time or semantic continuity are folded to obtain a time-series folding chain structure. The time-series folding chain is used to eliminate time drift and log fragmentation in a distributed environment.

[0008] Extract the state change features of each event segment in the temporal folding chain, construct the link state vector, and apply controllable perturbation coding to obtain the perturbation coding sequence;

[0009] When an abnormal event is detected, the perturbation coding sequence where the abnormal event is located is taken as the observation endpoint. Backpropagation is performed based on the reversibility of the perturbation coding sequence to calculate the contribution path of each upstream event segment to the abnormal event and generate an abnormal propagation inversion sequence. The backpropagation is based on the perturbation elimination consistency constraint to backtrack step by step and locate the source event segment that satisfies the minimum recovery cost of the perturbation as the source of the abnormality.

[0010] Based on the anomaly propagation inversion sequence, the anomaly source event and its corresponding business node are determined, and the source tracing results, including the anomaly trigger location, propagation path interval, and state change segment, are output.

[0011] Specifically, the process of collecting heterogeneous logs from different business nodes and mapping the collected logs to event segments on continuous time intervals, followed by folding event segments with overlapping times or semantic continuity to obtain a time-series folded chain structure, includes:

[0012] The original log stream is received in the order in which the logs of the business nodes are generated. Based on the log source identifier, thread context identifier, call entry identifier, and state change identifier, the original log stream is initially split, and logs belonging to the same business evolution process are aggregated into candidate log sequences.

[0013] Extract the state change boundaries recorded in the logs of the candidate log sequence, including the trigger start point, state inflection point and termination point, and divide the logs between adjacent boundaries into discrete event units, and mark the start and end times of each discrete event unit to form intervalized event segments;

[0014] Based on the contextual transmission relationship and processing sequence relationship between logs, the start and end times of the intervalized event segments are aligned, and event segments belonging to the same business transmission process are mapped to a unified timeline.

[0015] On a unified timeline, determine the continuity relationship between adjacent intervalized event segments and mark event segments that meet the continuity conditions as collapsible segment pairs;

[0016] The foldable fragment pairs are concatenated according to the temporal sequence, and the concatenated event segments are chained with the unconcatenated event segments to generate a temporal folding chain structure.

[0017] Specifically, the step of concatenating the foldable fragment pairs according to temporal order, and then concatenating the concatenated event segments with the unconcatenated event segments to generate a temporal folding chain structure includes:

[0018] According to the succession order information on the unified timeline, sort each pair of collapsible segments, and group multiple pairs of collapsible segments with common event segments into a group of segments to be merged.

[0019] For the group of segments to be merged, the start marker, end marker and state change boundary of each intervalized event segment are read sequentially, and the first start marker and the last end marker are used as the merge boundary to generate a continuous event segment.

[0020] After generating the continuous event segment, the concatenated interval event segments are registered as folded segments, and their original segment order, node source and state change boundary are preserved to form the fold index of the continuous event segment.

[0021] Following the chronological order of a unified timeline, the continuous event segments are concatenated with the intervalized event segments that are not registered as folded segments, and a transmission order mark is written for adjacent concatenated objects to generate a time-folded chain structure.

[0022] Specifically, the step of extracting the state change features of each event segment in the temporal folding chain, constructing a link state vector, and applying controllable perturbation coding to obtain a perturbation coding sequence includes:

[0023] Following the sequence of the temporal folding chain structure, the state entry item, state transition item, and state exit item of each event segment are read sequentially, and the state entry item, state transition item, and state exit item belonging to the same event segment are registered as segment state records.

[0024] Based on the fragment state record, extract the changes of the event fragment in the execution state, return state, resource occupation state, call waiting state and data consistency state, and arrange them in order of the position of the event fragment in the time-series folding chain to form a fragment state change set;

[0025] The state change set of the segment is processed by state bit slotting, which maps the state change items generated by different service nodes to a unified state slot, and generates the link state vector of the corresponding event segment according to the arrangement order of the state slots.

[0026] Based on the link location, node source, and state change type of the event segment, a disturbance label corresponding to the event segment is generated, and the disturbance label is embedded in the link state vector to obtain a segment state vector with disturbance label;

[0027] According to the concatenation order of the time-series folding chain, the state vectors of each segment with perturbation identifier are sequentially arranged, and perturbation propagation markers are written between adjacent segment state vectors to obtain a perturbation coding sequence.

[0028] Specifically, based on the link location, node origin, and state change type of the event segment, a disturbance label corresponding to the event segment is generated, including:

[0029] Read the predecessor, current and successor segments of the event segment in the time folding chain, and generate segment position markers according to the order of the three;

[0030] Extract the business node source corresponding to the event fragment, and generate a node source tag based on the hierarchical affiliation of the business node source in the current business link;

[0031] Identify the types of state changes in the event segments and generate state change markers according to the location where the state changes occur;

[0032] The tags are concatenated according to the generation order of the fragment position marker, node source marker, and state change marker, and the perturbation bits of the concatenated tags are registered to obtain the perturbation tags corresponding to the event fragments.

[0033] Specifically, according to the concatenation order of the time-series folding chain, the state vectors of each segment with perturbation identifier are sequentially arranged, and perturbation propagation markers are written between adjacent segment state vectors to obtain a perturbation coding sequence, including:

[0034] According to the transmission order mark in the time-series folding chain, read the state vector of each segment with perturbation mark in sequence and register it as a vector sequence to be arranged;

[0035] For two adjacent segment state vectors in the vector sequence to be arranged, read the perturbation label of the previous segment state vector and the perturbation label of the next segment state vector, and generate the corresponding perturbation succession record.

[0036] Based on the disturbance inheritance record, the disturbance inheritance items, disturbance change items, and disturbance termination items between adjacent segment state vectors are identified, and the identification results are written between adjacent segment state vectors to form a disturbance transmission mark;

[0037] According to the arrangement order of the vector sequence to be arranged, the state vectors of each segment are alternately arranged with the corresponding perturbation propagation markers to generate a perturbation coding sequence.

[0038] Specifically, when an abnormal event is detected, the perturbation coding sequence where the abnormal event is located is taken as the observation endpoint. Based on the reversibility of the perturbation coding sequence, backpropagation is performed to calculate the contribution path of each upstream event segment to the abnormal event, generating an abnormal propagation inversion sequence, including:

[0039] When an abnormal event is detected, the event segment corresponding to the abnormal event is determined, and the code segment to be inverted is extracted from the perturbation coding sequence with the event segment as the termination position.

[0040] Read the perturbation propagation markers between adjacent event segments in the coded segment to be inverted, and establish backtracking nodes sequentially in the opposite direction to the temporal folding chain;

[0041] For each backtracking node, based on its perturbation propagation marker, perturbation label, and fragment state vector, perturbation elimination matching is performed to obtain the succession result of the backtracking node relative to the next backtracking node.

[0042] When the received result meets the disturbance elimination consistency condition, the corresponding event segment is registered as an anomaly propagation candidate segment, and adjacent anomaly propagation candidate segments are connected in backtracking order to form a candidate contribution path;

[0043] The recovery costs of each candidate contribution path are sorted, and the event segment with the lowest recovery cost and whose backtracking starting point meets the source determination condition is identified as the abnormal source. An abnormal propagation inversion sequence is generated based on the backtracking path from the abnormal source to the abnormal event.

[0044] Specifically, when the acceptance result meets the disturbance elimination consistency condition, the corresponding event segment is registered as an anomaly propagation candidate segment, and adjacent anomaly propagation candidate segments are connected in backtracking order to form a candidate contribution path, including:

[0045] Extract disturbance elimination items, state rollback items, and link back pointer items from the current backtracking node's acceptance results;

[0046] When the disturbance cancellation term and the state rollback term correspond to the same event segment, and the link back pointer term points to the preceding event segment of the event segment, the event segment is registered as an abnormal propagation candidate segment;

[0047] Read adjacent anomaly propagation candidate segments in the backtracking order and determine whether the link back pointer of the later anomaly propagation candidate segment points to the previous anomaly propagation candidate segment.

[0048] When the judgment result is yes, the adjacent abnormal propagation candidate segments are written into the same candidate contribution path and connected in the backtracking order until a link back-pointing break occurs or the starting position of the coding segment to be inverted is reached.

[0049] Specifically, the process of ranking the recovery costs of each candidate contribution path, identifying the event segment with the lowest recovery cost and whose backtracking starting point meets the source determination criteria as the anomaly source, and generating an anomaly propagation inversion sequence based on the backtracking path from the anomaly source to the anomaly event includes:

[0050] Read the abnormal propagation candidate segments in each candidate contribution path respectively, and count the recovery operation records of each abnormal propagation candidate segment in the process of disturbance elimination, state rollback, link back pointer and segment continuation.

[0051] The recovery operation records are merged and registered according to the order of appearance of the recovery operation records in each candidate contribution path to generate a recovery cost record corresponding to each candidate contribution path.

[0052] Based on the recovery cost record, sort each candidate contribution path, read the backtracking starting point of the first candidate contribution path, and determine whether the event segment corresponding to the backtracking starting point has a preceding eliminable disturbance.

[0053] When the event segment corresponding to the backtracking starting point has no preceding eliminable perturbation, the event segment is identified as the source of the anomaly, and the corresponding candidate contribution paths are rearranged according to the order from the source of the anomaly to the anomaly event to generate an anomaly propagation inversion sequence.

[0054] The business end-to-end log intelligent analysis and tracing system is used to implement the business end-to-end log intelligent analysis and tracing method, including: a log collection module, a perturbation coding module, an anomaly inversion module, and a tracing module;

[0055] The log collection module is used to collect heterogeneous logs from different business nodes and map the collected logs into event fragments on a continuous time interval. Event fragments with overlapping time or semantic continuity are folded to obtain a time-series folding chain structure. The time-series folding chain is used to eliminate time-series drift and log fragmentation in a distributed environment.

[0056] The perturbation coding module is used to extract the state change features of each event segment in the temporal folding chain, construct the link state vector, and apply controllable perturbation coding to obtain the perturbation coding sequence.

[0057] The anomaly inversion module is used to, when an anomaly event is detected, take the perturbation coding sequence where the anomaly event is located as the observation endpoint, perform backpropagation derivation based on the reversibility of the perturbation coding sequence, calculate the contribution path of each upstream event segment to the anomaly event, and generate an anomaly propagation inversion sequence. The backpropagation derivation is based on perturbation elimination consistency constraints to backtrack step by step and locate the source event segment that satisfies the minimum recovery cost of perturbation as the source of the anomaly.

[0058] The source tracing module is used to determine the source event of the anomaly and its corresponding business node based on the anomaly propagation inversion sequence, and output the source tracing results including the anomaly trigger location, propagation path interval, and state change segment.

[0059] Compared with the prior art, the beneficial effects of the present invention are:

[0060] This invention proposes an intelligent analysis and tracing system and method for business end-to-end logs. It constructs a continuous event representation based on a time-series folded chain, and extracts state change features from event fragments to form a link state vector. Controllable perturbation coding is introduced to generate a perturbation coding sequence. Furthermore, the reversible nature of the perturbation coding is utilized to perform backpropagation derivation, tracing the anomaly propagation path step by step and determining the anomaly source. This achieves structured modeling and tracing analysis of business end-to-end logs. Through this technical solution, the anomaly propagation process can be continuously characterized and reverse-analyzed in log environments with multiple nodes, heterogeneity, and inconsistent time, reducing reliance on rule matching and human experience, and improving the targeting and stability of anomaly localization. Attached Figure Description

[0061] Figure 1 Flowchart of the intelligent analysis and tracing method for the entire business log provided by this invention;

[0062] Figure 2 This is a schematic diagram for determining the succession relationship provided by the present invention;

[0063] Figure 3 This is a schematic diagram of the generation of the temporal folded chain structure provided by the present invention;

[0064] Figure 4 The architecture diagram of the intelligent analysis and tracing system for the entire business log provided by this invention. Detailed Implementation

[0065] The present application will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present application, but do not limit the present application in any way. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application. These all fall within the protection scope of the present application.

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] It should be noted that, unless there is a conflict, the various features in the embodiments of this application can be combined with each other, all of which are within the protection scope of this application. Furthermore, although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than the module division in the device or the order in the flowchart. In addition, the terms "first," "second," and "third" used in this application do not limit the data or execution order, but only distinguish identical or similar items with essentially the same function and effect.

[0068] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The term "and / or" as used in this specification includes any and all combinations of one or more of the associated listed items.

[0069] Example 1

[0070] Please see Figures 1-3 The present invention provides an embodiment of a method for intelligent analysis and tracing of business end-to-end logs, comprising the following specific steps:

[0071] Step S1: Collect heterogeneous logs from different business nodes and map the collected logs to event fragments on a continuous time interval. Fold event fragments with overlapping time or semantic continuity to obtain a time-folded chain structure. The time-folded chain is used to eliminate time drift and log fragmentation in a distributed environment.

[0072] The specific steps of step S1 are as follows:

[0073] Step S101: Receive the original log stream according to the log generation order of the business nodes, and perform initial diversion on the original log stream based on the log source identifier, thread context identifier, call entry identifier and state change identifier, and gather the logs belonging to the same business evolution process into candidate log sequences.

[0074] In this embodiment, raw log data is collected in real time from the standard output stream of all business service instances through a distributed log collection agent. Each raw log contains fields such as timestamp, log source, thread number, tracing number, span number, parent span number, call entry, status code, message content, event type, operation number, and execution duration. Subsequently, log cleaning is performed to filter out non-business logs containing debugging information, performance statistics, and heartbeat detection, delete invalid logs with empty content or incomplete format, desensitize log fields containing sensitive information (such as user passwords and bank card numbers), and uniformly convert logs of different formats into structured log objects.

[0075] Next, log deduplication is performed, removing duplicate log records based on the hash value of the log content. For logs with duplicate span numbers under the same tracing number, the one with the earliest timestamp is retained. Finally, the cleaned structured logs are grouped by tracing number, with each group corresponding to a complete business request chain. The logs are then serialized in a standard serialization format and stored in the original log column family of the key-value database. The key is a byte array of tracing number and span number, and the value is the serialized structured log byte stream.

[0076] Step S102: Extract the state change boundaries recorded in the candidate log sequence, including the trigger start point, state inflection point and termination point, and divide the logs between adjacent boundaries into discrete event units, and mark the start and end times of each discrete event unit to form intervalized event segments.

[0077] In this embodiment, all structured logs under the same link tracing number are read from the original log column family of the key-value database. An initial call tree is constructed according to the parent-child relationship of the span number, with each leaf node corresponding to an independent operation unit. Then, log interval processing is performed, and all logs corresponding to each operation unit are arranged in chronological order. The timestamp of the first log is used as the original start time, and the timestamp of the last log is used as the original end time. The service instance number, call entry, status code, and execution duration information of the operation unit are extracted.

[0078] Next, the status information of the event fragment is generated. The start and end states are extracted from the event type field of the log. The start state is the initial state at the start of the operation, and the end state is the final state after the operation is completed. The global identifier set (such as order number, user ID, transaction serial number) is extracted from the message content of the log. The SHA-256 hash value of all log content of the event fragment is calculated as the log content hash. Then, the above information is assembled into an event fragment object. Each event fragment contains a fragment number (an unsigned unique integer generated by the snowflake algorithm), original start time, original end time, service instance number, start state, end state, global identifier set, log content hash, tracing number, span number, and parent span number fields. Finally, all generated event fragments are arranged in ascending order of their original start time to form an initial event fragment list. After being serialized in a standard serialization format, the fragments are stored in the original fragment column family of the key-value database. The key is a byte array of tracing number and fragment number, and the value is the serialized event fragment byte stream.

[0079] Step S103: Based on the contextual transmission relationship and processing sequence relationship between logs, the start and end times of the intervalized event segments are aligned, and event segments belonging to the same business transmission process are mapped to a unified timeline.

[0080] In this embodiment, all event fragments under the same link tracing number are read from the original fragment column family of the key-value database, and the service instance number and original timestamp information of each event fragment are extracted. Then, NTP clock calibration is performed. The NTP clock offset corresponding to each service instance is read from the service metadata column family of the key-value database, and the original start time and original end time of each event fragment are added to the corresponding NTP clock offset to obtain the preliminary calibration time.

[0081] Next, causal timing alignment is performed to determine the causal relationship between event segments. For event segments with parent-child call relationships, it is ensured that the original start time of the child segment is later than the original start time of the parent segment, and the original end time of the child segment is earlier than the original end time of the parent segment. If there is a timing reversal, the calibration time is adjusted according to the logical order of the vector clock. Then, the global time offset of each event segment is calculated, which is the time difference between the calibration start time of the event segment and the calibration start time of the root segment of the entire business link.

[0082] Finally, an alignment start time, alignment end time, and global time offset field are added to each event segment. The calibrated event segment list is serialized in a standard serialization format and stored in the calibration segment column family of the key-value database. The key is a byte array of link tracing number and segment number, and the value is the serialized calibration event segment byte stream.

[0083] like Figure 2 As shown, step S104: On the unified timeline, determine the connection relationship between adjacent intervalized event segments, and mark the event segments that meet the connection conditions as collapsible segment pairs.

[0084] In this embodiment, all calibration event segments under the same link tracing number are read from the calibration segment column family of the key-value database and arranged in ascending order according to the alignment start time to form a list of segments to be judged. Then, a set of collapsible segment pairs is initialized, and all adjacent event segment pairs are traversed (the current segment is the i-th element in the list, and the next adjacent segment is the (i+1)-th element). Four collapsible judgment conditions are checked in sequence: First, the relational continuity condition is called to check whether the span number of the current segment is equal to the parent span number of the next segment, or whether the two segments have the same parent span number; Second, the temporal continuity condition is checked to check the alignment start time of the next segment. The time difference between the current segment's end time and the current segment's end time is less than a preset threshold (default 100 milliseconds); third, state transition condition, check whether the end state of the current segment is consistent with the start state of the next segment, or whether there is a clear state transition relationship; fourth, semantic similarity condition, calculate the semantic similarity of the two segment call entry points based on semantic similarity (using a known method, such as TF-IDF cosine similarity), if the similarity is greater than or equal to 0.8, it is determined to be semantically similar; if and only if all four conditions are met, the pair of segments is marked as a collapsible segment pair, assigned a unique collapsible segment pair number, and the folding basis is recorded.

[0085] It should be noted that the set of valid state transitions includes: initialization → running, running → successful execution, running → failed execution, successful execution → transaction commit, failed execution → transaction rollback, call wait → return success / return failure; an invalid transition is defined as a transition in which the result state and the initial state have semantic conflicts and there is no intermediate transition state to support it. For example, the transition from failed execution to successful execution (without a retry event) is considered invalid.

[0086] Finally, all collapsible fragment pairs are serialized in a standard serialization format and stored in the collapsible pair column family of the key-value database. The key is a byte array of link tracing number and collapsible fragment pair number, and the value is the serialized collapsible fragment pair byte stream.

[0087] exist Figure 2 In this code, E1 indicates receiving a request, E2 indicates creating an order, E3 indicates reserving inventory, E4 indicates starting a transaction, E5 indicates writing an order, E6 indicates calling the inventory service, E7 indicates deducting inventory, E8 indicates committing the transaction, E9 indicates returning a response, E10 indicates confirming payment, E11 indicates returning a result, E12 indicates logging, and E13 indicates returning a response.

[0088] like Figure 3 As shown, step S105: The foldable segment pairs are concatenated according to the temporal sequence, and the concatenated event segments are connected in series with the unconcatenated event segments to generate a temporal folding chain structure.

[0089] In this embodiment, all collapsible fragment pairs under the same link tracing number are read from the collapsible pair family of the key-value database. The disjoint-set data structure algorithm is used to group all collapsible fragment pairs with common fragments into fragment groups to be merged. Each fragment group to be merged contains multiple event fragments with succession relationships.

[0090] Subsequently, a continuous event segment is generated for each group of segments to be merged, and a unique segment number is assigned. All original segments within the group are traversed, and the minimum value of the alignment start time of all segments is calculated as the merge start time. The maximum value of the alignment end time of all segments is calculated as the merge end time. The state boundary points of all segments are merged and duplicates are removed to form a merged state boundary set.

[0091] Next, a parent segment number field is added to each merged original segment, with the value being the segment number of the corresponding consecutive event segment. At the same time, a folded index mapping table is constructed, using the folded index number as the key and the folded index array containing information about all merged original segments as the value, to establish the association between consecutive event segments and underlying original segments. Then, a time-series folded chain is constructed, which sorts all unmerged independent event segments and all consecutive event segments in ascending order of the merge start time to form a segment list. The time-series folded chain object contains the segment list, the folded index mapping table, the root segment number, and the total segment number segment.

[0092] Finally, the time-series folded chain is serialized in a standard serialization format and stored in the folded chain column family of the key-value database. The key is a byte array of the link tracing number, and the value is the serialized time-series folded chain byte stream.

[0093] Step S2: For each event segment in the time-series folding chain, extract its state change features and construct a link state vector. Apply controllable perturbation coding to the link state vector to obtain a perturbation coding sequence. The perturbation coding sequence is used to explicitly amplify the state differences between different nodes during the anomaly propagation process, forming a distinguishable anomaly propagation feature trajectory.

[0094] The specific steps of step S2 are as follows:

[0095] Step S201: According to the serial order of the time-series folded chain structure, read the state entry item, state transition item and state exit item of each event segment in sequence, and register the state entry item, state transition item and state exit item belonging to the same event segment as segment state record.

[0096] In this embodiment, time-series folded chain data under the same link tracing number is read from the folded chain column family of the key-value database, and all continuous event segments are expanded to obtain a complete list of original event segments. Then, the segment state record list is initialized, each original event segment is traversed, and all its state boundary point information is extracted. An independent state record is generated for each state boundary point: a unique state record number and boundary point number are assigned, and the atomic state, message digest, and boundary type (divided into three categories: trigger start, state transition, and termination end) corresponding to the boundary point are extracted. The alignment timestamp and the segment number to which the boundary point belongs are recorded.

[0097] Next, a status record integrity check is performed, verifying whether all fields of each status record are complete and whether the timestamp is within the aligned time interval of its segment. If any missing or incorrect fields are found, the record is marked as incomplete and the error information is recorded; otherwise, it is marked as complete. Then, all status records are grouped according to their segment numbers, with each segment corresponding to a set of status records. Finally, all segment status records are serialized in a standard serialization format and stored in the status record column family of the key-value database. The key is a byte array of link tracing number: segment number: status record number, and the value is the serialized status record byte stream.

[0098] Step S202: Based on the fragment state record, extract the changes of the event fragment in the execution state, return state, resource occupation state, call waiting state and data consistency state, and arrange them in order of the position of the event fragment in the time sequence folding chain to form a fragment state change set.

[0099] In this embodiment, all fragment status records under the same link tracing number are read from the status record column family of the key-value database and arranged in ascending order according to the aligned timestamp to form a status record processing queue. Then, the fragment status change set is initialized, and each pair of adjacent status records in the status record processing queue is traversed (the previous record is the i-th element in the queue, and the next record is the (i+1)-th element). If two records belong to the same event fragment, a status change item is generated: the atomic state of the previous record is extracted as the state value before the change, and the atomic state of the next record is used as the state value after the change. According to the type of atomic state, the status change item is divided into five categories: execution status type, return status type, resource occupation status type, call waiting status type, and data consistency status type. The timestamp of the status change and the fragment number to which it belongs are recorded.

[0100] Next, all state change items for each event segment are deduplicated and merged, removing duplicate state change records and merging consecutive state changes of the same type. Then, the set of state change items for each event segment is assembled into a segment state change set object, which includes the segment number, the list of state change items, and the total number of state changes. Finally, all segment state change sets are serialized in a standard serialization format and stored in the state change column family of the key-value database, with the key being a byte array of the link tracing number and the value being the serialized state change set byte stream.

[0101] Step S203: Perform state bit allocation processing on the fragment state change set, map the state change items generated by different service nodes to a unified state slot, and generate the link state vector of the corresponding event fragment according to the arrangement order of the state slots.

[0102] In this embodiment, the state change set of all segments under the same link tracing number is read from the state change column family of the key-value database, and the predefined state vector slot mapping table is read from the metadata column family of the key-value database. Then, a 64-dimensional floating-point state vector is generated for each event segment, all slot values ​​are initialized to 0, all state change items of the segment are traversed, and the state change items are mapped to the corresponding slot range according to the state type: the execution state type corresponds to slots 0-6, the return state type corresponds to slots 7-15, the resource occupancy state type corresponds to slots 16-31, the call wait state type corresponds to slots 32-47, the data consistency state type corresponds to slots 48-62, and slot 63 is used as a folding marker bit.

[0103] Specifically, 0: Initialization, 1: Running, 2: Successful execution, 3: Execution failed, 4: Execution timed out, 5: Retry execution, 6: Execution canceled, 7: Hypertext Transfer Protocol 200 (Success), 8: Hypertext Transfer Protocol 400 (Request Error), 9: Hypertext Transfer Protocol 401 (Unauthorized), 10: Hypertext Transfer Protocol 404 (Resource Not Found), 11: Hypertext Transfer Protocol 500 (Internal Server Error), 12: Hypertext Transfer Protocol 502 (Gateway Error), 13: Hypertext Transfer Protocol 503 (Service Unavailable), 14: Business Error Code 1 (Parameter Validation Failed), 15: Business Error Code 2 (Data Not Found), 16: CPU Usage, 17: Memory Usage, 18: Disk Usage, 19: Disk I / O. 0: Read / write rate, 20: Network I / O send rate, 21: Network I / O receive rate, 22: Database connection pool utilization, 23: Thread pool utilization, 24: Message queue backlog, 25-31: Reserved extension bits, 32: Thread pool wait time, 33: Database connection wait time, 34: Message queue consumption wait time, 35: Remote call response time, 36: Lock wait time, 37-47: Reserved extension bits, 48: Data validation passed, 49: Data validation failed, 50: Transaction started, 51: Transaction committed, 52: Transaction rolled back, 53: Cache hit, 54: Cache miss, 55: Data duplicated, 56: Data lost, 57-62: Reserved extension bits, e.g., 0: Initialization, indicating the initialization state corresponds to slot 0.

[0104] Next, each slot value is normalized, mapping state values ​​of different magnitudes to the 0-1 range. For enumerated state values, different values ​​are assigned based on the degree of abnormality (e.g., 1.0 for execution failure and 0.0 for execution success). For numeric state values, they are normalized by dividing by the maximum value (e.g., CPU utilization, with a fixed maximum value of 100; memory utilization, with a fixed maximum value of 100). Then, a folding flag is set. If the parent segment number of the segment is not empty, the value of slot 63 is set to 1; otherwise, it is set to 0. Finally, a valid flag field is added to each state vector. If all slot values ​​are within the valid range, they are marked as valid; otherwise, they are marked as invalid. The state vectors of all segments are serialized in a standard serialization format and stored in the state vector column family of the key-value database. The key is a byte array of link tracing number and segment number, and the value is the serialized state vector byte stream.

[0105] Step S204: Based on the link location, node source, and state change type of the event segment, generate a disturbance label corresponding to the event segment, and embed the disturbance label into the link state vector to obtain a segment state vector with disturbance label.

[0106] In this embodiment, all segment state vectors under the same link tracing number are read from the state vector column family of the key-value database, and a predefined 16-bit perturbation bit mapping table (as shown in Table 1) is read from the metadata column family of the key-value database. Then, a perturbation bit vector is generated for each event segment, and all bits of the 16-bit binary string are initialized to 0. Each slot of the state vector is traversed. If the slot value is greater than or equal to the preset abnormal threshold (default 0.7, as shown in Table 1), the corresponding position in the perturbation bit vector is set to 1 according to the perturbation type of the slot.

[0107] Table 1 16-bit perturbation bit mapping table

[0108]

[0109] Next, perturbation labels are generated, which consist of three parts: fragment position marker (in the format of level_position, indicating the position of the fragment in the time-series folding chain), node source marker (in the format of service name_instance number, indicating the service instance to which the fragment belongs), and anomaly sub-marker (containing the perturbation type name corresponding to the bit with a value of 1 in all perturbation bit vectors).

[0110] Then, an association transfer marker is generated. By querying the preceding segment number of the segment, the perturbation bit vector of the preceding segment is obtained. The difference between the two perturbation bit vectors is calculated by bit XOR operation. Bits with a value of 1 in the difference bit and the corresponding bit in the current segment's perturbation bit vector are also 1 are included in the change bit set. Bits with a value of 1 in the difference bit and the corresponding bit in the preceding segment's perturbation bit vector are included in the termination bit set. Bits with a value of 1 in both segment perturbation bit vectors are included in the inheritance bit set.

[0111] Finally, the perturbation tag, perturbation bit vector, association transfer marker, and fragment number are associated, serialized in a standard serialization format, and stored in the perturbation record column family of the key-value database. The key is a byte array of link tracing number and fragment number, and the value is the serialized perturbation record byte stream.

[0112] Step S205: Arrange the state vectors of each segment with perturbation identifier in sequence according to the concatenation order of the time-series folding chain, and write perturbation propagation markers between adjacent segment state vectors to obtain a perturbation coding sequence.

[0113] In this embodiment, perturbation records corresponding to all event segments under the same link tracing number are read from the perturbation record column family of the key-value database. The byte stream is deserialized into a structured object using the parsing method of the official serialization library, and the perturbation tag, perturbation bit vector, and associated transfer marker field of each segment are extracted. At the same time, the 64-dimensional state vectors corresponding to all segments are read from the state vector column family, and the segment list and fold index mapping table of the time-series fold chain are read from the fold chain column family. All consecutive event segments are expanded to obtain a complete original segment sequence arranged in ascending order according to the aligned start time.

[0114] Subsequently, the perturbation propagation verification result list and the initial perturbation propagation sub-chain set are initialized. The element type of the verification result list is a structured object containing the preceding segment number, the current segment number, the inherited perturbation verification result, the changed perturbation verification result, the terminated perturbation verification result, the verification confidence, and the valid marker. The element type of the initial perturbation propagation sub-chain set is a structured object containing the sub-chain number, the segment number sequence, the perturbation type sequence, the sub-chain start time, the sub-chain end time, the average verification confidence, and the segment number to which it belongs.

[0115] Next, following the complete original fragment sequence, all adjacent event fragment pairs are traversed (the preceding fragment is the i-th element in the sequence, and the current fragment is the (i+1)-th element), and a three-level perturbation propagation consistency check is performed: The first level performs inheritance perturbation check, traversing the inheritance bit set in the association propagation marker. For each perturbation type, the state vector slot mapping table is queried to obtain the state dimension slot range corresponding to that perturbation type. The Manhattan distance between the current fragment and the preceding fragment within that slot range is calculated. If the distance is less than or equal to a preset threshold of 3, the inheritance perturbation is deemed valid; otherwise, it is marked as invalid inheritance, and the state difference value is recorded. If at least one invalid inheritance exists in the inheritance bit set, the basic confidence of the propagation relationship is reduced by 0.3. The second level performs change perturbation check, traversing the change bit set in the association propagation marker. For each perturbation type, the slot value of the current fragment's corresponding state dimension is checked to see if it is greater than or equal to the anomaly threshold of 0.7 and the slot value of the preceding fragment is less than or equal to 0.3. If these conditions are met, the perturbation is deemed valid. If the change perturbation is valid, it is marked as invalid and the slot values ​​before and after are recorded. If there is at least one invalid change in the set of change bits, the basic confidence of the transit relationship is reduced by 0.4. The third level performs termination perturbation verification. It iterates through the set of termination bits in the associated transit markers. For each perturbation type, it checks whether the slot value of the state dimension corresponding to the preceding segment is greater than or equal to 0.7 and the slot value corresponding to the current segment is less than or equal to 0.3. If the conditions are met, the termination perturbation is determined to be valid. Otherwise, it is marked as invalid termination and the slot values ​​before and after are recorded. If there is at least one invalid termination in the set of termination bits, the basic confidence of the transit relationship is reduced by 0.2. After the three-level verification is completed, the final verification confidence is calculated. The basic confidence is initialized to 1.0. After deducting the score corresponding to the invalid perturbation, it is multiplied by the complement of the cosine similarity of the two segment state vectors (1 minus the cosine distance) to obtain the final verification confidence in the range of 0-1. If the final verification confidence is greater than or equal to the preset threshold of 0.6, the valid mark is set to true. Otherwise, it is set to false.

[0116] After encapsulating all verification results into verification result objects and adding them to the verification result list, the preliminary perturbation propagation chain construction operation is performed. All valid perturbation propagation relationships marked as true are connected in segment time sequence to form multiple independent preliminary perturbation propagation sub-chains. For propagation sub-chains with a length greater than or equal to 3, the arithmetic mean of the verification confidence of all propagation relationships in the sub-chain is calculated as the average confidence of the sub-chain, and all sub-chains are sorted in descending order of average confidence.

[0117] Next, the perturbation propagation relationship within consecutive event segments is processed. For all internal segments with non-empty parent segment numbers, their respective propagation sub-chains are marked as internal sub-chains within the segment. The segment number field is added to the sub-chain information, and the sub-chain is associated with the top-level propagation node of the corresponding consecutive event segment to ensure that the internal perturbation propagation path can still be quickly located in the collapsed view. Then, isolated perturbation segment marking is performed. All event segments with perturbation bit vectors set are traversed, and it is checked whether the segment exists in any preliminary perturbation propagation sub-chain. If it does not exist, it is marked as an isolated perturbation segment, and its segment number, perturbation type, and alignment timestamp are recorded as potential source candidates for subsequent root cause analysis.

[0118] Finally, all valid perturbation propagation verification results, preliminary perturbation propagation subchain set, and isolated perturbation fragment list are associated, serialized in a standard serialization format, and stored in the perturbation propagation pre-verification column family of the key-value database. The key is the link tracing number: the pre-verification byte array, and the value is the serialized pre-verification result byte stream.

[0119] It should be noted that controllable disturbance coding is achieved by discretizing and marking the link state vector. Specifically, each state slot in the link state vector is mapped one-to-one with a preset disturbance type, and each disturbance type corresponds to a unique binary identifier bit, forming a disturbance bit vector of fixed length. When the value of a certain state slot exceeds the corresponding abnormal threshold, the disturbance bit corresponding to that slot is set to 1, otherwise it is kept at 0, thereby mapping the continuous state space to a discrete disturbance space. The disturbance label is composed of the disturbance bit vector, fragment position information, and node source information.

[0120] Step S3: When an abnormal event is detected, the perturbation coding sequence where the abnormal event is located is taken as the observation endpoint. Based on the reversibility of the perturbation coding sequence, backpropagation is performed to calculate the contribution path of each upstream event segment to the abnormal event and generate an abnormal propagation inversion sequence. The backpropagation is based on the perturbation elimination consistency constraint to backtrack step by step and locate the source event segment that satisfies the minimum recovery cost of the perturbation as the source of the abnormality.

[0121] The specific steps of step S3 are as follows:

[0122] Step S301: When an abnormal event is detected, determine the event segment corresponding to the abnormal event, and extract the coding segment to be inverted from the perturbation coding sequence with the event segment as the termination position.

[0123] In this embodiment, an abnormal event notification pushed by the monitoring and alarm system is first received. The abnormal occurrence time, abnormal level, abnormal description and corresponding link tracing number are extracted from the notification message. The complete time-series folded chain data is read from the folded chain column family of the key-value database using the link tracing number as the key. The byte stream is deserialized into a structured object containing a segment list, a folded index mapping table, a root segment number and a total number of segments using the parsing method of the official serialization library. The segment list arranges all top-level independent segments and continuous event segments in time sequence. Each segment contains a unique segment number, a merge start time, a merge end time, a merge state boundary set and a parent segment number field.

[0124] Then, the abnormal termination node is located. All segments of the time-series folding chain and all internal original fragments expanded through the folding index mapping table are traversed. The end state and perturbation label of each fragment are extracted. Fragments with the end state of execution failure, abnormal termination, or perturbation label containing the highest priority abnormal marker are selected. The fragment with the latest aligned end time is identified as the abnormal termination event fragment, and its fragment number, aligned end time, abnormal type, and service name are recorded. Next, the backtracking parameters are initialized. The maximum backtracking depth is set to 1.5 times the total number of fragments. The starting boundary of the encoding segment to be inverted is set to the root fragment number of the time-series folding chain, and the ending boundary is set to the fragment number of the abnormal termination event fragment. At the same time, the backtracking status is initialized to in progress, and the backtracking start timestamp is recorded.

[0125] Then, a queue of fragments to be processed is constructed. Using a breadth-first traversal algorithm, starting from the abnormal termination event fragment, all event fragments with direct or indirect call relationships are traversed upstream through the preceding fragment associations of the time-series folding chain. All traversed fragments are added to the queue of fragments to be processed, and the backtracking level of each fragment is marked (the backtracking level of the abnormal termination event fragment is 0, and the backtracking level is incremented by 1 for each upstream traversal). Traversal stops when the root fragment number is reached or the maximum backtracking depth is reached. Finally, the abnormal termination event fragment information, backtracking parameters, the queue of fragments to be processed, and the backtracking status mark are associated, serialized in a standard serialization format, and stored in the backtracking task column family of the key-value database. The key is the link tracing number: target fragment number: task byte array, and the value is the serialized backtracking task data byte stream.

[0126] Step S302: Read the perturbation propagation markers between adjacent event segments in the coding segment to be inverted, and establish backtracking nodes sequentially in the opposite direction to the time-series folding chain.

[0127] In this embodiment, the backtracking task data stored in step S301 is first read from the backtracking task column family of the key-value database, using the link tracing number: target segment number: task as the key. The byte stream is deserialized into a structured object using the parsing method of the official serialization library, and the pending segment queue, abnormal termination event segment number, root segment number, and maximum backtracking depth are extracted. At the same time, the segment status records corresponding to all pending segments are read from the status record column family of the key-value database, and the perturbation records corresponding to all pending segments are read from the perturbation record column family. Then, the backtracking node array is initialized, and the array element type contains backtracking node number, segment number, status vector, and perturbation label. The system is a structured object containing a perturbation bit vector, an association propagation flag, a backtracking level, an alignment timestamp, and an internal node flag. The backtracking node number is a bit-unsigned unique integer generated by the snowflake algorithm. Then, the system traverses the queue of fragments to be processed in descending order of the backtracking level (i.e., from the root node to the abnormal termination node) to construct a corresponding backtracking node for each fragment. First, the system extracts the state vector (a 3D floating-point array), alignment start time, alignment end time, and parent segment number of the fragment from the fragment state record using the fragment number. The alignment end time is used as the alignment timestamp of the backtracking node. If the parent segment number is not empty, the internal node flag is set to true; otherwise, it is set to false.

[0128] Then, the perturbation tag and perturbation bit vector (16-bit binary string) of the segment are extracted from the perturbation record by segment number. The perturbation tag includes segment position marker, node source marker, and anomaly sub-marker. Each bit of the perturbation bit vector corresponds to a preset perturbation type. Subsequently, an association transit marker is generated. By querying the previous segment number of the segment, the perturbation bit vector of the previous segment is extracted from the perturbation record of the previous segment. The difference between the current segment and the previous segment perturbation bit vector is calculated by bit XOR operation. Bits with a value of 1 in the difference bit and the corresponding bit in the current segment perturbation bit vector are included in the change bit set. Bits with a value of 1 in the difference bit and the corresponding bit in the previous segment perturbation bit vector are included in the termination bit set. Bits with a value of 1 in both segment perturbation bit vectors are included in the inheritance bit set. The inheritance bit set, change bit set, termination bit set, current segment number, previous segment number, and internal transit marker are encapsulated into an association transit marker object. Then, all the above information is assembled into a backtrack node object and added to the backtrack node array.

[0129] After traversal, the backtracking node array is sorted in ascending order of backtracking level (i.e., after sorting, array index 0 corresponds to the root node, and the maximum index corresponds to the abnormal termination node). At the same time, integrity verification is performed to check whether there are missing backtracking levels or duplicate segment numbers in the array. If they exist, a verification error is recorded and the backtracking status is marked as abnormal. Finally, the backtracking node array that passes the verification is associated with the link tracing number, target segment number, and total number of backtracking nodes, and serialized in a standard serialization format and stored in the backtracking node column family of the key-value database. The key is link tracing number: target segment number: backtracking byte array, and the value is the serialized backtracking node array byte stream.

[0130] Step S303: For each backtracking node, perform perturbation elimination matching based on its perturbation propagation marker, perturbation label, and fragment state vector to obtain the succession result of the backtracking node relative to the next backtracking node.

[0131] In this embodiment, the backtracking node array stored in step S302 is first read from the backtracking node column family of the key-value database, using the link tracing number: target segment number: backtracking as the key. The byte stream is deserialized into a structured object containing the total number of backtracking nodes and the backtracking node array using the parsing method of the official serialization library. The index 0 of the backtracking node array corresponds to the root node segment of the time-series folded chain, and the index of the total number of backtracking nodes minus 1 corresponds to the target termination event segment. Each backtracking node contains a backtracking node number, segment number, state vector (3D floating-point array), perturbation label, perturbation bit vector (16-bit binary string), association transfer flag, backtracking level, alignment timestamp, and internal node flag fields. Then, the receiving result list is initialized, and the list element type is containing the current backtracking node. The system generates a structured object containing the node number, the next backtracking node number, the inherited perturbation list, the changed perturbation list, the termination perturbation list, the state vector difference, and the acceptance confidence. Then, following the index order of the backtracking node array, it iterates through each pair of adjacent backtracking nodes (current node is index i, next node is index i+1) from index 0 to the index of the total number of backtracking nodes minus 2, performing perturbation elimination matching: First, it obtains the association transmission marker field of the current node. If this field is empty, it initializes the acceptance confidence to 0.3 and records the note for the missing transmission marker; otherwise, it uses the conversion method of the standard bit set class to convert the inherited bit set, changed bit set, and termination bit set of the association transmission marker into bit set objects, and simultaneously converts the perturbation bit vectors of the current node and the next node into bit set objects.

[0132] Next, inheritance perturbation matching is performed. The bit indices (range 0-15) in the inheritance bit set that are true are traversed. The corresponding perturbation type is obtained by querying the 16-bit perturbation bit mapping table (stored in the key "perturbation bit mapping" of the key-value database metadata column family, containing the type code, type description, and impact dimension of each bit) that is identical to step S204. Simultaneously, the slot values ​​of the corresponding impact dimensions in the state vectors of the current node and the next node are compared (e.g., execution state dimension corresponds to slots 0-6, resource usage dimension corresponds to slots 16-31). If the change in slot value conforms to the logic of perturbation inheritance (e.g., execution state remains unchanged from failure, or CPU utilization remains in the 75%-85% range), then the perturbation type is added to the inheritance perturbation list, and the slot value change is recorded. Then, change perturbation matching is performed. The bit indices in the change bit set that are true are traversed to obtain the corresponding perturbation type. The slot values ​​of the corresponding impact dimensions in the state vectors of the next node and the current node are compared. If the change in slot value conforms to the logic of perturbation inheritance (e.g., execution state remains unchanged from failure, or CPU utilization remains in the 75%-85% range), then the perturbation type is added to the inheritance perturbation list, and the slot value change is recorded. If the perturbation type matches the logic for adding a new perturbation (e.g., the value of slot 5 (failure) in the next node is 1 while the current node is 0, or the value of slot 16 (maximum CPU utilization) in the next node changes from 30% to 90% in the current node), then the perturbation type is added to the change perturbation list, and the slot value change is recorded. Then, termination perturbation matching is performed, traversing the bit indices of the termination bit set that are true to obtain the corresponding perturbation type, comparing the slot values ​​of the corresponding affected dimensions in the state vectors of the current node and the next node. If the change in the slot value matches the logic for terminating the perturbation (e.g., the value of slot 5 in the current node is 1 while the next node is 0, or the value of slot 16 in the current node is 90% while the next node is 40%), then the perturbation type is added to the termination perturbation list, and the slot value change is recorded. Subsequently, the state vector difference is calculated. The cosine similarity formula is used to calculate the cosine value of the state vectors of the current node and the next node. 1 minus this cosine value is taken as the difference, and the difference range is 0-1. The smaller the value, the more similar the state vectors are.

[0133] Next, the acceptance confidence is calculated, which consists of three weighted components: perturbation bit matching degree (the number of bits in the inherited bit set, change bit set, and termination bit set that pass logical verification with the perturbation bit vectors of the current node and the next node, divided by the total number of bits, with a weight of 0.5), the complement of the state vector difference degree (1 minus the state vector difference degree, with a weight of 0.3), and perturbation label consistency (add 0.2 if the node source tags of the current node and the next node belong to the same service level, otherwise add 0, with a weight of 0.2). The sum of these three is the acceptance confidence, ranging from 0 to 1. Finally, all matching results are encapsulated into acceptance result objects and added to the acceptance result list. After traversal, the acceptance result list is associated with the link tracing number, target fragment number, and total number of inherited results, serialized in a standard serialization format, and stored in the inheritance result column family of the key-value database. The key is the link tracing number: target fragment number: inherited byte array, and the value is the serialized acceptance result list byte stream.

[0134] Step S304: When the receiving result meets the disturbance elimination consistency condition, the corresponding event segment is registered as an anomaly propagation candidate segment, and adjacent anomaly propagation candidate segments are connected in backtracking order to form a candidate contribution path.

[0135] In this embodiment, the inheritance result list stored in step S303 is first read from the inheritance result column family of the key-value database with the link tracing number: target segment number: inheritance as the key. The byte stream is deserialized into a structured object using the parsing method of the official serialization library. The total number of inheritance results and the inheritance result array are extracted. Each inheritance result object contains the current backtracking node number, the next backtracking node number, the inheritance perturbation list, the change perturbation list, the termination perturbation list, the state vector difference degree, the inheritance confidence degree, and the association transmission mark field. The association transmission mark field contains three link attributes: the current segment number, the previous segment number, and the internal transmission mark.

[0136] Subsequently, the candidate fragment set and candidate contribution path list for anomaly propagation are initialized. The candidate fragment set uses a hash set structure to store fragment numbers to avoid duplication, and the candidate contribution path list uses a dynamic array structure to store path objects. Each path object contains a path number (a bit-unsigned unique integer generated by the snowflake algorithm), a fragment number sequence, a perturbation sequence, a path confidence score, and a complete path marker field. Then, each receiving result is processed sequentially according to the index order of the backtracking node array, from index 0 to the index where the total number of inherited results is reduced by 1. Three extraction operations are performed: First, the perturbation elimination item is extracted. The termination perturbation list of the receiving results is traversed, and a perturbation elimination item is generated for each termination perturbation, containing three attributes: perturbation type, elimination fragment number (i.e., the current fragment number of the receiving result), and elimination timestamp (taken from the alignment timestamp of the current backtracking node). Second, the state rollback item is extracted, based on predefined... An abnormal state threshold table (stored in the key abnormal state threshold of the key-value database metadata column family, specifying that execution state dimension slots 5 and 6 are abnormal values, resource usage dimension slots 16 and 18 greater than 80 are abnormal values, and call wait dimension slot 34 greater than 3 is an abnormal value, etc.) compares the corresponding slot values ​​of the state vector of the current backtracking node with those of the next backtracking node, filters out the dimensions where the next node is an abnormal value and the current node is a normal value, and generates a state backtracking item for each dimension that meets the conditions, which includes three attributes: state dimension, abnormal value (next node slot value), normal value (current node slot value), and backtracking fragment number (i.e., the current fragment number of the receiving result); third, extracting link backtracking items, extracting the current fragment number and the previous fragment number from the association transmission mark of the receiving result, generating link backtracking items, which include two attributes: current fragment number and the pointed previous fragment number (i.e., the previous fragment number).

[0137] Subsequently, the anomaly propagation candidate segment determination is performed. The event segment corresponding to the eliminated segment number is registered as an anomaly propagation candidate segment if and only if the following four conditions are met simultaneously: Condition 1, there is at least one disturbance elimination item and at least one state rollback item, and the eliminated segment number of all disturbance elimination items is exactly the same as the rollback segment number of all state rollback items; Condition 2, the current segment number of the link back pointer item is equal to the above eliminated segment number; Condition 3, the preceding segment number pointed to by the link back pointer item is equal to the segment number of the preceding event segment of the current backtracking node in the time-series folded chain (verified by the secondary index link tracing number: segment number: preceding query of the key-value database folded chain column family); Condition 4, the acceptance confidence of the acceptance result is greater than or equal to the preset threshold of 0.7.

[0138] After the determination is completed, all eligible segment numbers are added to the anomaly propagation candidate segment set, and a corresponding perturbation elimination item list and state rollback item list are attached to each candidate segment. Next, the candidate contribution path connection operation is performed, traversing the anomaly propagation candidate segment set in backtracking order (i.e., from the anomaly termination node to the root node, corresponding to the backtracking node array index in descending order). The current path segment list and the current path perturbation list are initialized, the first traversed candidate segment is added to the current path segment list, and its corresponding perturbation elimination item is added to the current path perturbation list. Subsequent segments are then processed sequentially. For each candidate segment, check if the preceding segment number pointed to by the link back pointer of the candidate segment exists in the last element of the current path segment list. If it exists, append the candidate segment to the end of the current path segment list and append its corresponding perturbation elimination item to the end of the current path perturbation list. If it does not exist, encapsulate the current path segment list and the perturbation list into a candidate contribution path object, calculate the path confidence as the geometric mean of the confidence of all the succession results in the path, set the complete path marker field to false, and reinitialize the current path segment list and perturbation list after adding it to the candidate contribution path list.

[0139] When the traversal reaches the starting position of the segment to be inverted (i.e., the root node segment corresponding to index 0 of the backtracking node array), if the current path segment list is not empty, it is encapsulated as the last candidate contribution path object. If the first segment of the path is the root node segment, the complete path flag field is set to true. Finally, all candidate contribution paths are sorted in descending order of path length and path confidence to generate the final candidate contribution path set. After being serialized in the standard serialization format, it is stored in the candidate contribution path column family of the key-value database. The key is the link tracing number: target segment number: path byte array, and the value is the serialized candidate contribution path set byte stream.

[0140] Step S305: Sort the recovery costs of each candidate contribution path, determine the event segment with the lowest recovery cost and whose backtracking starting point meets the source determination condition as the abnormal source, and generate an abnormal propagation inversion sequence based on the backtracking path from the abnormal source to the abnormal event.

[0141] In this embodiment, firstly, the candidate contribution path set stored in step S304 is read from the candidate contribution path column family of the key-value database, using the link tracing number: target fragment number: path as the key. The byte stream is deserialized into a structured object using the parsing method of the official serialization library, and the sorted path array (a candidate contribution path array sorted in descending order of path length and path confidence) is extracted. Simultaneously, the backtracking node array corresponding to the link tracing number is read from the backtracking node column family, and the inheritance result list corresponding to the link tracing number is read from the inheritance result column family. Each candidate contribution path contains a path number, a fragment number sequence (an array of anomaly propagation candidate fragment numbers arranged in backtracking order, with the first element being the backtracking start point and the last element being the anomaly termination event fragment), a perturbation sequence, path confidence, and a complete path marker field. Subsequently, recovery operation record statistics are performed. The fragment number sequence array of each candidate contribution path is traversed. For each anomaly propagation candidate fragment number, the corresponding backtracking node is found through the fragment number index of the backtracking node array, and the corresponding inheritance result is found through the current backtracking node number index of the inheritance result list. Statistics are then compiled. Four types of recovery operation records: The first type is disturbance elimination operation records. This involves iterating through the list of terminated disturbances in the received results, generating an operation record for each terminated disturbance, including the operation type as disturbance elimination, disturbance type, base cost of 10, and cost multiplier (2.0 for execution status exception, 1.5 for return status exception, 1.0 for resource usage exception, 0.8 for call wait exception, and 1.8 for data consistency exception). The second type is status rollback operation records. This involves iterating through the list of status rollback items in the received results, generating an operation record for each status dimension rollback, including the operation type as status. The system includes the following parameters: rollback, state dimension, base cost of 5, and cost multiplier (execution state is 2.0, data consistency state is 1.8, return state is 1.5, resource consumption is 1.0, and call wait is 0.8); the third type of link back pointer operation record generates an operation record for each valid link back pointer item, including operation type link back pointer, base cost of 3, and cost multiplier of 1.0; the fourth type of segment continuation operation record generates an operation record for each pair of adjacent anomaly propagation candidate segments, including operation type segment continuation, base cost of 2, and cost multiplier of 1.0.

[0142] Next, a recovery cost record is generated. For each candidate contribution path, all its recovery operation records are merged according to the operation type. The total number of operations and the total cost for each type are calculated. The total cost is the sum of the base cost of each operation record multiplied by the cost multiplier. At the same time, a cost detail field is generated to store the total cost of each operation type in key-value pairs. Finally, a recovery cost record containing path number, total recovery cost, total number of operations, cost details, and path confidence is formed.

[0143] Subsequently, recovery cost sorting and source determination are performed. All candidate contribution paths are sorted a second time according to total recovery cost in ascending order and path confidence in descending order, generating a cost-priority ranked path list. The sorted candidate contribution paths are read sequentially, and the first element of its segment number sequence array is extracted as the backtracking starting point segment number. Source determination is then performed: if the backtracking starting point is the root node segment of the time-series folded chain (verified by querying the link tracing number of the folded chain column family in the key-value database: root segment number key), then it is directly determined to meet the source determination condition; if the backtracking starting point is not the root node, then the secondary index of the result column family is inherited from the key-value database. Link tracing number: Segment number: Precedence query the succession result corresponding to the preceding event segment of the backtracking starting point, check whether the termination perturbation list of the succession result is empty, or whether the succession confidence of all termination perturbations is less than 0.5. If the conditions are met, it is determined that there is no preceding removable perturbation, which meets the source determination condition; when the first candidate contribution path that meets the source determination condition is found, the event segment corresponding to its backtracking starting point is determined as the abnormal source, and the segment number, service name, instance Internet Protocol address, alignment start time, and anomaly type (taken from the highest priority anomaly in its perturbation label) of the abnormal source are recorded.

[0144] Finally, an anomaly propagation inversion sequence is generated. The segment number sequence array and perturbation sequence array of the candidate contribution path are reversed and rearranged to convert it into a forward propagation order from the anomaly source to the anomaly event. Each segment number after rearrangement is traversed, and the corresponding state vector, perturbation label, and alignment timestamp are extracted from the backtracking node array. The corresponding perturbation transmission information is extracted from the acceptance result list. An inversion node object containing sequence number, segment number, service name, instance Internet Protocol address, timestamp, state snapshot, transmitted perturbation, and propagation delay is generated. All inversion node objects are assembled into an anomaly propagation inversion sequence in sequence, and metadata information is attached, including link tracing number, root cause segment number, anomaly event segment number, total propagation time, path length, and confidence score. Finally, the anomaly propagation inversion sequence is serialized in a standard serialization format and stored in the root cause result column family of the key-value database. The key is a byte array of link tracing number: target segment number: root cause, and the value is the serialized inversion sequence byte stream.

[0145] Step S4: Based on the anomaly propagation inversion sequence, determine the anomaly source event and its corresponding business node, and output the source tracing results including the anomaly trigger location, propagation path interval, and state change segment.

[0146] In this embodiment, the anomaly propagation inversion sequence stored in step S305 is read from the root cause result column family of the key-value database with the link tracing number: target fragment number: root cause as the key. The byte stream is deserialized into a structured object using the parsing method of the official serialization library. The link tracing number, root cause fragment number, anomaly event fragment number, total propagation time, path length, confidence score, and inversion node array are extracted from it. At the same time, the pre-built business node metadata mapping table is read from the service metadata column family of the key-value database, the complete time-series folded chain structure corresponding to the link tracing number is read from the folded chain column family, and all associated fragment status records are read from the status record column family.

[0147] Subsequently, the source event of the anomaly and its corresponding business node were identified. The source inversion node was retrieved using index 0 of the inversion node array, and its fragment number, service name, instance internet protocol address, alignment start time, and highest priority exception type were extracted. Using the secondary index "service name: instance internet protocol address" in the key-value database, detailed business node information corresponding to the instance was queried from the business node metadata mapping table. This included the service's business domain, cluster name, data center location, container orchestration system namespace, container name, deployment version number, and contact information of the responsible person. Simultaneously, the full-text search engine's application programming interface was used to retrieve the original log text that generated the state boundary point, using the log number of the state record item associated with the source node as the query condition. The exception stack field of the log was used to extract the code class name, method name, and line number where the exception occurred; the request parameter snapshot that triggered the exception was extracted from the request parameter field; and the specific description of the exception was extracted from the exception message field. The system generates an exception trigger location record accurate to the code level, containing the physical node where the exception occurred, the application instance, the code location, and the triggering conditions. Next, it generates propagation path intervals, traversing all adjacent inversion node pairs in the exception propagation inversion sequence. For each node pair, it generates an independent propagation path interval, each interval containing an interval number, upstream node information, downstream node information, propagation time interval (from the upstream node alignment end time to the downstream node alignment start time), propagation delay (the downstream node alignment start time minus the upstream node alignment end time), a list of propagated disturbance types (taken from the exception sub-tags in the disturbance labels of the upstream node), and the scope of affected business data (taken from the global identifier set in the upstream node state change set). Simultaneously, it expands folded segments within continuous event segments into sub-intervals, retaining a segment-level aggregated view in the main path and displaying the propagation details of all original segments in the details view, forming a hierarchical propagation path structure.

[0148] Then, state mutation segments are identified, and the Manhattan distance is used to calculate the state change amplitude of adjacent inversion node state vectors, that is, the sum of the absolute values ​​of the differences between the corresponding slot values ​​of the two vectors. The preset state mutation threshold is 15. When the Manhattan distance is greater than or equal to 15, the adjacent node interval is marked as a state mutation segment. At the same time, the state dimension and the values ​​before and after the difference are extracted for all slots with a difference greater than or equal to 2. The original log that triggered the state mutation is obtained by indexing the log number in the key-value database. The specific operation, input data and system environment information of the mutation are extracted from the log to form a state mutation detail record. This record includes the time point of the mutation, the state comparison before and after the mutation, the mutation amplitude and the direct triggering reason.

[0149] Finally, a structured source tracing result is generated, organized in a standard data exchange format, comprising six parts: The first part is basic anomaly information, including the link tracing number, anomaly occurrence time, anomaly level, anomaly type, and confidence level; the second part is anomaly source details, including anomaly trigger location records, business node information, and original log links; the third part is propagation path details, including a hierarchical list of propagation path intervals, total propagation time, and the percentage of propagation delay for each interval; the fourth part is state mutation details, including a list of all state mutation segments and an analysis of the cause of mutation for each segment; the fifth part is the associated evidence chain, including all used fragment state records, disturbance... The first part is the unique identifier of the propagation marker and the original log; the sixth part is the preliminary repair suggestions, which match the corresponding suggestions from the pre-built repair knowledge base according to the anomaly type and business node information. For example, for database connection pool exhaustion anomalies, it is recommended to adjust the maximum number of connections in the connection pool. For thread pool queue full anomalies, it is recommended to increase the number of core threads or optimize the task execution logic. After the generation is completed, the tracing results are stored in the final tracing result column family of the key-value database in a standard data exchange format. The key is a byte array of link tracing number: timestamp. At the same time, a visualization report in hypertext markup language format is generated. The report includes a directed graph of the propagation path, a time sequence diagram of state changes, and a highlighted display of the original log.

[0150] To facilitate understanding of the processing flow of this invention, a simplified example is given below: Assume there are three consecutive event segments A, B, and C, where segment A is normal, segment B exhibits resource occupancy anomaly, and segment C exhibits execution failure anomaly. During the perturbation coding stage, corresponding perturbation bit vectors are generated, where the resource occupancy perturbation bit for segment B is 1, and the execution failure perturbation bit for segment C is 1. During perturbation propagation, the perturbation inheritance relationship between B and C is recorded. When segment C is identified as an abnormal event, the process traces back from C to B, identifying that the execution failure perturbation originates from the propagation of the resource occupancy anomaly. This determines B as a key node in the anomaly propagation path. Furthermore, combining this with the characteristic that segment A has no abnormal perturbation, the source of the anomaly is located at the business node corresponding to segment B.

[0151] Example 2

[0152] Please see Figure 4 Another embodiment of the present invention provides: a business end-to-end log intelligent analysis and tracing system, comprising: a log collection module, a disturbance coding module, an anomaly inversion module, and a tracing module;

[0153] The log collection module is used to collect heterogeneous logs from different business nodes and map the collected logs into event fragments on a continuous time interval. Event fragments with overlapping time or semantic continuity are folded to obtain a time-series folding chain structure. The time-series folding chain is used to eliminate time-series drift and log fragmentation in a distributed environment.

[0154] The perturbation coding module is used to extract the state change features of each event segment in the temporal folding chain, construct the link state vector, and apply controllable perturbation coding to obtain the perturbation coding sequence.

[0155] The anomaly inversion module is used to, when an anomaly event is detected, take the perturbation coding sequence where the anomaly event is located as the observation endpoint, perform backpropagation derivation based on the reversibility of the perturbation coding sequence, calculate the contribution path of each upstream event segment to the anomaly event, and generate an anomaly propagation inversion sequence. The backpropagation derivation is based on perturbation elimination consistency constraints to backtrack step by step and locate the source event segment that satisfies the minimum recovery cost of perturbation as the source of the anomaly.

[0156] The source tracing module is used to determine the source event of the anomaly and its corresponding business node based on the anomaly propagation inversion sequence, and output the source tracing results including the anomaly trigger location, propagation path interval, and state change segment.

[0157] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0158] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for intelligent analysis and source tracing of business end-to-end logs, characterized in that, include: Heterogeneous logs from different business nodes are collected and mapped to event fragments on a continuous time interval. Event fragments with overlapping time or semantic continuity are folded to obtain a time-series folding chain structure. The time-series folding chain is used to eliminate time drift and log fragmentation in a distributed environment. Extract the state change features of each event segment in the temporal folding chain, construct the link state vector, and apply controllable perturbation coding to obtain the perturbation coding sequence; When an abnormal event is detected, the perturbation coding sequence where the abnormal event is located is taken as the observation endpoint. Backpropagation is performed based on the reversibility of the perturbation coding sequence to calculate the contribution path of each upstream event segment to the abnormal event and generate an abnormal propagation inversion sequence. The backpropagation is based on the perturbation elimination consistency constraint to backtrack step by step and locate the source event segment that satisfies the minimum recovery cost of the perturbation as the source of the abnormality. Based on the anomaly propagation inversion sequence, the anomaly source event and its corresponding business node are determined, and the source tracing results, including the anomaly trigger location, propagation path interval, and state change segment, are output.

2. The intelligent analysis and tracing method for the entire business log as described in claim 1, characterized in that, The process of collecting heterogeneous logs from different business nodes and mapping the collected logs to event segments on a continuous time-series interval, followed by folding event segments with overlapping times or semantic continuity to obtain a time-series folded chain structure, includes: The original log stream is received in the order in which the logs of the business nodes are generated. The original log stream is initially split, and logs belonging to the same business evolution process are aggregated into candidate log sequences. Extract the state change boundaries recorded in the logs in the candidate log sequence, divide the logs between adjacent boundaries into discrete event units, and mark the start and end times of each discrete event unit to form intervalized event segments; Based on the contextual transmission relationship and processing sequence relationship between logs, the start and end times of the intervalized event segments are aligned, and event segments belonging to the same business transmission process are mapped to a unified timeline. On a unified timeline, determine the continuity relationship between adjacent intervalized event segments and mark event segments that meet the continuity conditions as collapsible segment pairs; The foldable fragment pairs are concatenated according to the temporal sequence, and the concatenated event segments are chained with the unconcatenated event segments to generate a temporal folding chain structure.

3. The intelligent analysis and tracing method for the entire business log as described in claim 2, characterized in that, The step of concatenating the foldable fragment pairs according to temporal order, and then concatenating the concatenated event segments with the unconcatenated event segments to generate a temporal folding chain structure includes: According to the succession order information on the unified timeline, sort each pair of collapsible segments, and group multiple pairs of collapsible segments with common event segments into a group of segments to be merged. For the group of segments to be merged, the start marker, end marker and state change boundary of each intervalized event segment are read sequentially, and the first start marker and the last end marker are used as the merge boundary to generate a continuous event segment. After generating the continuous event segment, the concatenated interval event segments are registered as folded segments, and their original segment order, node source and state change boundary are preserved to form the fold index of the continuous event segment. Following the chronological order of a unified timeline, the continuous event segments are concatenated with the intervalized event segments that are not registered as folded segments, and a transmission order mark is written for adjacent concatenated objects to generate a time-folded chain structure.

4. The intelligent analysis and tracing method for the entire business log as described in claim 1, characterized in that, The process involves extracting the state change features of each event segment in the temporal folding chain, constructing a link state vector, and applying controllable perturbation coding to obtain a perturbation coding sequence, including: Following the sequence of the temporal folding chain structure, the state entry item, state transition item, and state exit item of each event segment are read sequentially, and the state entry item, state transition item, and state exit item belonging to the same event segment are registered as segment state records. Based on the fragment state record, extract the changes of the event fragment in the execution state, return state, resource occupation state, call waiting state and data consistency state, and arrange them in order of the position of the event fragment in the time-series folding chain to form a fragment state change set; The state change set of the segment is processed by state bit slotting, which maps the state change items generated by different service nodes to a unified state slot, and generates the link state vector of the corresponding event segment according to the arrangement order of the state slots. Based on the link location, node source, and state change type of the event segment, a disturbance label corresponding to the event segment is generated, and the disturbance label is embedded in the link state vector to obtain a segment state vector with disturbance label; According to the concatenation order of the time-series folding chain, the state vectors of each segment with perturbation identifier are sequentially arranged, and perturbation propagation markers are written between adjacent segment state vectors to obtain a perturbation coding sequence.

5. The intelligent analysis and tracing method for the entire business log as described in claim 4, characterized in that, Based on the link location, node origin, and state change type of the event segment, a disturbance label corresponding to the event segment is generated, including: Read the predecessor, current and successor segments of the event segment in the time folding chain, and generate segment position markers according to the order of the three; Extract the business node source corresponding to the event fragment, and generate a node source tag based on the hierarchical affiliation of the business node source in the current business link; Identify the types of state changes in the event segments and generate state change markers according to the location where the state changes occur; The tags are concatenated according to the generation order of the fragment position marker, node source marker, and state change marker, and the perturbation bits of the concatenated tags are registered to obtain the perturbation tags corresponding to the event fragments.

6. The intelligent analysis and tracing method for the entire business log as described in claim 5, characterized in that, According to the concatenation order of the time-series folding chain, the state vectors of each segment with perturbation identifier are sequentially arranged, and perturbation propagation markers are written between adjacent segment state vectors to obtain a perturbation coding sequence, including: According to the transmission order mark in the time-series folding chain, read the state vector of each segment with perturbation mark in sequence and register it as a vector sequence to be arranged; For two adjacent segment state vectors in the vector sequence to be arranged, read the perturbation label of the previous segment state vector and the perturbation label of the next segment state vector, and generate the corresponding perturbation succession record. Based on the disturbance inheritance record, the disturbance inheritance items, disturbance change items, and disturbance termination items between adjacent segment state vectors are identified, and the identification results are written between adjacent segment state vectors to form a disturbance transmission mark; According to the arrangement order of the vector sequence to be arranged, the state vectors of each segment are alternately arranged with the corresponding perturbation propagation markers to generate a perturbation coding sequence.

7. The intelligent analysis and tracing method for end-to-end business logs as described in claim 1, characterized in that, When an abnormal event is detected, the perturbation coding sequence containing the abnormal event is taken as the observation endpoint. Based on the reversibility of the perturbation coding sequence, backpropagation is performed to calculate the contribution path of each upstream event segment to the abnormal event, generating an abnormal propagation inversion sequence, including: When an abnormal event is detected, the event segment corresponding to the abnormal event is determined, and the code segment to be inverted is extracted from the perturbation coding sequence with the event segment as the termination position. Read the perturbation propagation markers between adjacent event segments in the coded segment to be inverted, and establish backtracking nodes sequentially in the opposite direction to the temporal folding chain; For each backtracking node, based on its perturbation propagation marker, perturbation label, and fragment state vector, perturbation elimination matching is performed to obtain the succession result of the backtracking node relative to the next backtracking node. When the received result meets the disturbance elimination consistency condition, the corresponding event segment is registered as an anomaly propagation candidate segment, and adjacent anomaly propagation candidate segments are connected in backtracking order to form a candidate contribution path; The recovery costs of each candidate contribution path are sorted, and the event segment with the lowest recovery cost and whose backtracking starting point meets the source determination condition is identified as the abnormal source. An abnormal propagation inversion sequence is generated based on the backtracking path from the abnormal source to the abnormal event.

8. The intelligent analysis and tracing method for the entire business log as described in claim 7, characterized in that, When the received result meets the disturbance elimination consistency condition, the corresponding event segment is registered as an anomaly propagation candidate segment, and adjacent anomaly propagation candidate segments are connected in backtracking order to form a candidate contribution path, including: Extract disturbance elimination items, state rollback items, and link back pointer items from the current backtracking node's acceptance results; When the disturbance cancellation term and the state rollback term correspond to the same event segment, and the link back pointer term points to the preceding event segment of the event segment, the event segment is registered as an abnormal propagation candidate segment; Read adjacent anomaly propagation candidate segments in the backtracking order and determine whether the link back pointer of the later anomaly propagation candidate segment points to the previous anomaly propagation candidate segment. When the judgment result is yes, the adjacent abnormal propagation candidate segments are written into the same candidate contribution path and connected in the backtracking order until a link back-pointing break occurs or the starting position of the coding segment to be inverted is reached.

9. The intelligent analysis and tracing method for full-link business logs as described in claim 8, characterized in that, The process of sorting the candidate contribution paths by recovery cost, identifying the event segment with the lowest recovery cost and whose backtracking starting point meets the source determination criteria as the anomaly source, and generating an anomaly propagation inversion sequence based on the backtracking path from the anomaly source to the anomaly event includes: Read the abnormal propagation candidate segments in each candidate contribution path respectively, and count the recovery operation records of each abnormal propagation candidate segment in the process of disturbance elimination, state rollback, link back pointer and segment continuation. The recovery operation records are merged and registered according to the order of appearance of the recovery operation records in each candidate contribution path to generate a recovery cost record corresponding to each candidate contribution path. Based on the recovery cost record, sort each candidate contribution path, read the backtracking starting point of the first candidate contribution path, and determine whether the event segment corresponding to the backtracking starting point has a preceding eliminable disturbance. When the event segment corresponding to the backtracking starting point has no preceding eliminable perturbation, the event segment is identified as the source of the anomaly, and the corresponding candidate contribution paths are rearranged according to the order from the source of the anomaly to the anomaly event to generate an anomaly propagation inversion sequence.

10. A business end-to-end log intelligent analysis and tracing system, used to implement the business end-to-end log intelligent analysis and tracing method according to any one of claims 1-9, characterized in that, include: Log collection module, perturbation coding module, anomaly inversion module, and source tracing module; The log collection module is used to collect heterogeneous logs from different business nodes and map the collected logs into event fragments on a continuous time interval. Event fragments with overlapping time or semantic continuity are folded to obtain a time-series folding chain structure. The time-series folding chain is used to eliminate time-series drift and log fragmentation in a distributed environment. The perturbation coding module is used to extract the state change features of each event segment in the temporal folding chain, construct the link state vector, and apply controllable perturbation coding to obtain the perturbation coding sequence. The anomaly inversion module is used to, when an anomaly event is detected, take the perturbation coding sequence where the anomaly event is located as the observation endpoint, perform backpropagation derivation based on the reversibility of the perturbation coding sequence, calculate the contribution path of each upstream event segment to the anomaly event, and generate an anomaly propagation inversion sequence. The backpropagation derivation is based on perturbation elimination consistency constraints to backtrack step by step and locate the source event segment that satisfies the minimum recovery cost of perturbation as the source of the anomaly. The source tracing module is used to determine the source event of the anomaly and its corresponding business node based on the anomaly propagation inversion sequence, and output the source tracing results including the anomaly trigger location, propagation path interval, and state change segment.

Images