CN-121996463-A - Micro-service abnormality detection method based on multi-modal feature fusion

CN121996463ACN 121996463 ACN121996463 ACN 121996463ACN-121996463-A

Abstract

The invention provides a microservice anomaly detection method based on multi-mode feature fusion, and belongs to the technical field of computers. Firstly, semantic feature extraction is carried out on a log template by combining BERT and knowledge distillation technology, and category features of the log template are learned while log semantic information is enhanced. Secondly, using LSTM and TCN to extract time sequence characteristics of log template sequence and KPis data. And then, designing a two-way cross-mode transducer module, respectively extracting the cooperative information and the redundant shared information between the log and the KPIs, and carrying out weighted fusion through an improved gating unit to obtain a final fusion feature vector. And finally, reconstructing the fusion feature vector by using a diffusion model, calculating a reconstruction error and comparing the reconstruction error with an abnormal threshold value to realize abnormal detection. Experimental results show that the method is superior to the existing mainstream method in terms of various indexes of micro-service abnormality detection, and has higher detection precision and robustness.

Inventors

ZHANG XIUGUO
CHEN ZIHAN
CAO ZHIYING

Assignees

大连海事大学

Dates

Publication Date: 20260508
Application Date: 20260211

Claims (7)

1. The micro-service abnormality detection method based on multi-mode feature fusion is characterized by comprising the following steps of: Acquiring log data and KPIs data of micro service operation; After the log data are subjected to block sampling, a log template sequence is generated, the log template sequence is input into a log feature extraction link, the log feature extraction link firstly performs log template sentence feature extraction based on BERT and knowledge distillation, and then performs log template sequence semantic feature extraction on log template sentence feature vectors based on LSTM; Performing serialization processing on the KPIs data to generate KPIs time series, and inputting the KPIs time series into a KPIs feature extraction link, wherein the KPIs feature extraction link performs KPIs time feature extraction based on a TCN model; Performing interactive feature extraction based on a dual-path cross-modal converter on a log template sequence semantic feature vector extracted by a log feature extraction link and a KPIS time feature vector extracted by a KPIS feature extraction link, wherein the interactive features comprise cooperative features and redundant features, performing interactive feature weighted fusion based on an improved gating unit on the obtained cooperative feature vector and redundant feature vector, and generating a feature fusion vector; and carrying out feature reconstruction on the feature fusion vector based on a diffusion model so as to obtain a reconstruction error, and judging whether the micro service is abnormal or not according to the size relation between the reconstruction error and an abnormal threshold.
2. The method for detecting micro-service anomalies based on multi-modal feature fusion according to claim 1, wherein the method for extracting log template sentence features based on BERT and knowledge distillation comprises inputting the log template sentence features into a trained log template sentence feature extraction model, wherein the log template sentence feature extraction model is constructed based on an improved BERT model and comprises a plurality of Encoder layers stacked in series, the output of each layer is used as the input of the next layer to form a deep feed-forward network, and the pre-training is performed through knowledge distillation, and the pre-training comprises: Taking the log template sentence feature extraction model as a student model and taking the BERT model as a teacher model; The log template sentence feature vectors output by the student model and the teacher model are combined for output alignment to obtain response distillation loss; Performing dimension reduction on the log template sentence feature vector output by the student model by using a multi-layer perceptron MLP to obtain a category probability vector, and calculating cross entropy loss based on the category probability vector and a training label; student model parameters were optimized with response distillation loss and cross entropy loss sum as loss back propagation.
3. The method for detecting micro-service anomalies based on multi-modal feature fusion according to claim 1, wherein the student model performs parameter initialization based on TinyBERT.
4. The method for detecting micro-service anomalies based on multi-modal feature fusion according to claim 1, wherein the TCN model comprises two serially connected residual modules, each residual module comprising two serially connected causal expansion convolutional layers and one 1 A 1 convolution layer using one-dimensional convolution and setting a convolution fill parameter padding = expansion parameter x (convolution kernel size-1) while filling zeros only to the left of the current position to ensure that the current output depends only on the current and past time inputs and expanding the receptive field with the expansion convolution to capture KPs time series long distance dependencies, said 1 The convolution 1 is used for nonlinear transformation, so that the input and output dimensions of the residual modules are consistent, residual addition is used in each residual module to achieve residual linking, and the final output of the residual module=the input of the residual module and the output of a main path formed by two causal expansion convolution layers in the residual module.
5. The method for detecting micro-service anomalies based on multi-modal feature fusion according to claim 1, wherein the dual-path cross-modal transformers comprise two parallel cross-modal transformers, each cross-modal Transformer internally comprising The system comprises a layer stack cross-modal attention module, a log template sequence semantic feature vector and KPIs time feature vector, wherein the cross-modal attention module comprises a cross-modal attention mechanism and a feedforward neural network, and the cross-modal attention mechanism and the feedforward neural network are subjected to residual linking; The input of the cross-modal attention of the first layer cross-modal attention module of the first cross-modal transducer uses the log template sequence semantic feature vector as a query vector Using KPIs temporal feature vectors as key vectors Sum vector The input of the cross-modal attention of the first layer cross-modal attention module of the second cross-modal transducer unit uses KPIs time feature vectors as query vectors Using log template sequence semantic feature vectors as key vectors Sum vector Then inputting the intermediate representation vector of the cross-modal attention output using the first-layer cross-modal attention module into a feedforward neural network to perform nonlinear transformation to obtain the output of the single-layer cross-modal attention module Sum vector As in the first layer, but with the input query vector And outputting the cross-modal attention module of the upper layer, so that the interaction feature vector output by the cross-modal transducer is obtained after passing through the cross-modal attention module of the D layer.
6. The method for detecting micro-service anomalies based on multi-modal feature fusion according to claim 5, wherein the first cross-modal transducer is used for capturing collaborative information between a first modality and a second modality, and the second cross-modal transducer is used for capturing redundant information between the first modality and the second modality for extraction.
7. The method for detecting micro-service anomalies based on multi-modal feature fusion according to claim 1, wherein performing interactive feature weighted fusion based on an improved gating unit on the collaborative feature vector and the redundant feature vector comprises: respectively performing nonlinear transformation on the input cooperative feature vector and redundant feature vector to obtain a cooperative hidden feature vector Redundant hidden feature vectors : Wherein, the And Is a matrix of weights that are to be used, A non-linear activation function is used, Is a co-operative feature vector that is, Is a redundant feature vector; Will be And And (3) performing cosine similarity calculation on the row vector corresponding to the middle timestamp, and then splicing the similarity values according to the sequence of the timestamps in the window to obtain a final cosine similarity vector: Wherein, the The representative time period has A time stamp is used for the time stamp, Is that First, the The number of row vectors is a function of the number of column vectors, Is that Is the first of (2) The number of row vectors is a function of the number of column vectors, Is that First, the Individual row vectors First, the The cosine similarity of the individual row vectors, Representative of And An overall similarity vector over a period of time; For a pair of And Performing dot product calculation of the attention mechanism, and then combining the dot product calculation result with cosine similarity vector Multiplying by phase and then passing Activating the function to obtain an information importance weight matrix: Wherein, the Is that Is used in the manufacture of a printed circuit board, A non-linear activation function is used, Is an information importance weight matrix, Representing the transpose operation, Is a network parameter matrix; different information is weighted and aggregated through the obtained weight matrix, complementary information and dependency relations of different modes are further supplemented, and a final feature fusion vector is obtained : Wherein, the Is a matrix with all the elements being 1, Is the final feature fusion vector.

Description

Micro-service abnormality detection method based on multi-modal feature fusion Technical Field The invention relates to the technical field of computers, in particular to a micro-service abnormality detection method based on multi-modal feature fusion. Background The state, behavior and the like of the software system are recorded in log information and KPIs, and abnormal behavior of the system can be effectively avoided through analysis of the log and the KPIs. The abnormal detection based on log sequences and KPIs plays a vital role in ensuring the normal operation of the system. The log sequence consists of a series of logs which are arranged according to the execution sequence of the system. The single log generated by the system contains rich information such as events, parameters, time stamps and the like, and can be divided into a variable part and a constant part as a whole, wherein the variable part records the time stamps, IP addresses and other attributes of the system, and the constant part records the content of the log events, and the constant part consists of fixed character strings and is a template of log messages. KPIs are key performance indicators monitored on application services, such as response time, availability, or resource consumption, represent key states of physical devices, systems, or users, and provide valuable information supporting industrial decision-based. The method is characterized in that the general ideas of the method are that the log sequence and the KPIs are respectively subjected to feature extraction, then the feature fusion of the multi-modal features is carried out through the middle fusion, which is also called feature level fusion, namely, different modal data are firstly converted into high-dimensional feature expression, and then the proper positions are selected for fusion by utilizing the common features of the different modal data in the high-dimensional space. And finally, judging an abnormality detection result based on the obtained multi-mode feature fusion vector. For example, SCWarn models log and index data into different time sequences, adopts LSTM to perform feature extraction on each group of data in a feature extraction stage, then captures multi-mode connection information by a shared representation layer, constructs the layer by combining units and connections from a plurality of mode specific paths to obtain a fusion vector, and finally performs micro-service abnormality detection by predicting future values. The DAM also performs feature extraction on the log and KPIs data through LSTM, then splices the obtained feature vectors, extracts important information through an attention mechanism, and finally performs anomaly detection through a threshold selection method POT. SCWarn and DAM use LSTM to extract characteristics of log and KPIs, so that the extracted characteristics are single, and the relations among different KPI indexes and global information of log sequences are difficult to learn, so that hidden information of data is not easy to fully mine. On the other hand, the method for carrying out multi-mode feature fusion by the two methods is too simple, SCWarn is to splice by projecting different mode features into a public space, and DAM is to automatically extract important information from spliced feature vectors through an attention mechanism, and none of the two methods enables the information of different modes to interact. Hades respectively adopting a causal convolution and a Transformer to extract characteristics of KPIs data and log data, carrying out characteristic fusion on the obtained characteristic vector through a cross-modal attention mechanism, and finally carrying out micro-service abnormality detection through an MLP and a self-attention mechanism. However, hades is difficult to learn global information of KPIs by using causal convolution, and a single-layer cross-modal attention module used by the global information is difficult to extract deep collaborative and redundant information, so that the accuracy of a detection result is reduced. Although the method utilizes different mode information, compared with a detection method based on single mode information, the detection precision is improved to a certain extent, hidden information of data is not fully mined in a feature extraction stage, the sufficiency of interaction among different mode information is difficult to ensure, complementary information and dependency relationship among different mode data cannot be effectively utilized, and further improvement of the detection precision is limited. Disclosure of Invention Aiming at the problems of low abnormality detection precision and low robustness caused by insufficient extraction of complementary information and dependency relationship of different modes in the conventional micro-service abnormality detection method, the invention provides a micro-service abnormality detection method based on multi-mode feat