CN116450399A - Fault diagnosis and root cause positioning method for micro service system - Google Patents

Abstract

The invention discloses a microservice system fault diagnosis and root cause location method, relates to the field of computer technology, including S1 constructing X abnormality detection models; S2 acquiring monitoring data in the microservice system as a training data set; S3 training and optimizing X abnormality detections S4 builds a fault diagnosis model based on the training results; S5 learns the causality of fault nodes and builds an abnormality propagation map; S6 acquires monitoring data in real time; S7 uses the fault diagnosis model to analyze the fault diagnosis results of monitoring data; Fault diagnosis results locate the cause of the fault; this method automatically selects x models that are most suitable for detecting CPU usage, memory leaks, and network delays from X anomaly detection models through a pre-training mechanism, and cascades these x models to achieve The purpose of fault diagnosis on observation data. By capturing the abnormal pattern of the fault data and combining it with the root cause location method, the purpose of locating the faulty service is achieved.

Description

Microservice system fault diagnosis and root cause location method

technical field

The invention relates to the field of computer technology, in particular to a microservice system fault diagnosis and root cause location method.

Background technique

Microservices is an architectural and organizational approach to developing software consisting of small independent services that communicate through well-defined APIs. These services are handled by various small independent teams. A microservices architecture makes applications easier to scale and faster to develop, accelerating innovation and reducing time-to-market for new features. Microservice architecture has become very popular in web application development due to its high availability, fast evolution and easy scalability. The microservice architecture decomposes the application into multiple small services, making its development and maintenance faster and can provide higher flexibility. At the same time, it is precisely because the microservice architecture disperses the entire application into multiple services, which makes fault diagnosis very difficult, and in production scenarios with a large number of visits, faults are inevitable, so the type of fault can be quickly discovered and Locating the faulty service is crucial to ensure the quality and user experience of microservices.

Microservice systems are often monitored using multivariate time series. Multivariate time series reflect whether a system is running normally by collecting microservice information at each time stamp. System fault diagnosis is to identify faults from real-time sequences and diagnose the causes of abnormalities, and at the same time report the occurrence of microservice fault behaviors. Therefore, in the microservice system, system fault diagnosis is used to report the cause of the fault, such as CPU usage, memory leak, etc. Therefore, system fault diagnosis is of great significance to improve the reliability of microservice systems. In addition, due to the complex dependencies between services in the microservice architecture, when a microservice fails, the failure may propagate to multiple microservices along the dependencies. Therefore, when a failure occurs, the operator needs to quickly find the root cause of the failure of the entire system, that is, root cause location.

Currently, various solutions have been proposed to automate the detection of faults and automatically determine their possible root causes. Existing failure detection solutions rely on identifying anomalies in the behavior of a service that may be symptoms of its possible failure. However, most of the current methods can only detect whether an abnormality has occurred, and cannot implement fault diagnosis, that is, give the specific cause of the fault. This results in that after the fault occurs, the operator cannot quickly find the cause of the fault, resulting in a slowdown in troubleshooting. Slowly, the loss increases. In addition, most existing fault diagnosis methods are supervised fault diagnosis methods. Supervised fault diagnosis methods require training data to be labeled. Human, material and financial resources, which for most companies, the scope of application is limited. At the same time, application operators are hindered since existing solutions for fault diagnosis and root cause analysis are scattered in different literature fragments and often only focus on anomaly detection or root cause analysis.

Moreover, due to the huge amount of data in the microservice architecture and the complex dependencies between services, the existing fault diagnosis and root cause location methods still have the following deficiencies: In the fault diagnosis method, it takes a lot of manpower and financial resources to mark and classify samples . However, the unsupervised fault diagnosis clustering method is not enough to extract the characteristics of monitoring data, and the fault diagnosis accuracy is not satisfactory.

Contents of the invention

The object of the present invention is to design a microservice system fault diagnosis and root cause location method in order to solve the above problems.

The present invention achieves the above object through the following technical solutions:

Microservice system fault diagnosis and root cause location methods, including:

S1. Construct X abnormality detection models;

S2. Obtain monitoring data in the microservice system as a training data set;

S3. Import X abnormality detection models into the training data set, train and optimize them, and obtain X optimized abnormality detection models;

S4. Analyze the training results of X optimized abnormality detection models; and build a fault diagnosis model according to the training results;

S5. Carry out causal relationship learning on faulty nodes, and construct a causal relationship graph between nodes as an abnormality propagation graph;

S6. Obtain monitoring data in real time;

S7. Using the fault diagnosis model to analyze the fault diagnosis results of the monitoring data;

S8. Locate the cause of the fault according to the abnormality propagation diagram and the fault diagnosis result.

The beneficial effect of the present invention is that: the method automatically selects x models most suitable for detecting CPU usage, memory leaks and network delays from x anomaly detection models through a pre-training mechanism, and cascades these x models to realize The purpose of fault diagnosis on observation data. In addition, by capturing the abnormal pattern of the fault data and combining it with the root cause location method, the purpose of locating the faulty service is achieved. At the same time, by comparing the performance of fault diagnosis and root cause location with existing methods on five real microservice data sets, it is proved that this method can achieve higher fault diagnosis and root cause location; In the huge data and complex dependencies of each service, it can effectively diagnose system faults and locate the root cause of the fault.

Description of drawings

Fig. 1 is the architecture diagram of microservice system fault diagnosis and root cause location method of the present invention;

Fig. 2 is the training mechanism flowchart of microservice system fault diagnosis and root cause localization method of the present invention;

Fig. 3 is the fault diagnosis flow chart of microservice system fault diagnosis and root cause location method of the present invention;

Figure 4 is the comprehensive ranking of the present invention and all baseline methods on macro-precision;

Figure 5 is the comprehensive ranking of the present invention and all baseline methods on macro-recall;

Figure 6 is the comprehensive ranking of the present invention and all baseline methods on macro-F1.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, embodiments of the present invention. The components of the embodiments of the invention generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations.

Accordingly, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

It should be noted that like numerals and letters denote similar items in the following figures, therefore, once an item is defined in one figure, it does not require further definition and explanation in subsequent figures.

In the description of the present invention, it should be understood that the orientations or positional relationships indicated by the terms "upper", "lower", "inner", "outer", "left", "right" etc. are based on those shown in the accompanying drawings. Orientation or positional relationship, or the orientation or positional relationship that is usually placed when the product of the invention is used, or the orientation or positional relationship that is commonly understood by those skilled in the art, is only for the convenience of describing the present invention and simplifying the description, rather than indicating or It should not be construed as limiting the invention by implying that a referenced device or element must have a particular orientation, be constructed, and operate in a particular orientation.

In addition, the terms "first", "second", etc. are only used for distinguishing descriptions, and should not be construed as indicating or implying relative importance.

In the description of the present invention, it should also be noted that, unless otherwise specified and limited, terms such as "setting" and "connection" should be understood in a broad sense. For example, "connection" can be a fixed connection or a Detachable connection, or integral connection; it can be mechanical connection or electrical connection; it can be direct connection or indirect connection through an intermediary, and it can be the internal communication of two components. Those of ordinary skill in the art can understand the specific meanings of the above terms in the present invention according to specific situations.

The specific implementation manners of the present invention will be described in detail below in conjunction with the accompanying drawings.

The microservice system fault diagnosis and root cause location method is characterized in that it includes:

S1. Construct X abnormality detection models.

S2. Obtain monitoring data in the microservice system as a training data set.

S3. The training data sets are respectively imported into X abnormality detection models, and are trained and optimized to obtain X optimized abnormality detection models.

S4. Analyze the training results of X optimized abnormality detection models; and build a fault diagnosis model according to the training results;

Analyzing the training results includes: extracting data containing multiple preset features, importing X optimized anomaly detection models respectively, and obtaining the anomaly detection effect of each optimized anomaly detection model on the preset features as the training result.

Construct a fault diagnosis model: select x abnormality detection models among X optimized abnormality detection models according to the training results, and construct a fault diagnosis model by cascading according to the order of the training results, where x is less than X.

S5. Using the PC algorithm to learn the causal relationship of the faulty nodes, and constructing a causal relationship graph between nodes as an anomaly propagation graph.

S6. Obtain monitoring data in real time.

S7. Using the fault diagnosis model to analyze the fault diagnosis result of the monitoring data.

S8. Locating the cause of the fault according to the abnormal propagation diagram and the fault diagnosis result; specifically including:

S81. Use the PageRank algorithm to perform root cause analysis on the abnormal propagation graph, and output the initial causal score v of all faulty nodes, expressed as , where μ represents the number of services in the microservice architecture, α represents the transition probability of the probability matrix, P is the transition probability, and the transition probability P _ij from node i to j is expressed as /> , where w _ij represents the weight between i and j obtained through the PC algorithm;

S82. Using the fault diagnosis results to calculate the abnormality of the fault data respectively, the abnormality is expressed as , where /> Represents monitoring data, γ represents the type of fault, i represents the i-th time step in the sliding window, k represents the number of features, n represents the time length of input fault data, thred _γ is the abnormal threshold returned when the fault type is γ for diagnosis ;

S83. Calculate the final causal score score _γ of each node according to the weighted integration of the initial causal score and abnormality, expressed as , β represents the contribution of the root cause inference score to the final causal score, /> Indicates when a /> occurs The initial causality score of the service node upon failure of type.

S84. Rank the fault importance of the fault node according to the final causal score to locate the fault cause.

Through the pre-training mechanism, this method automatically selects 3 models that are most suitable for detecting CPU usage, memory leaks and network delays from 8 abnormal detection models, and cascades these 3 models to achieve the purpose of fault diagnosis for observation data . In addition, we achieve the purpose of locating the faulty service by capturing the abnormal pattern of the fault data and combining it with the root cause location method. At the same time, by comparing the performance of fault diagnosis and root cause location with existing methods on five real microservice data sets, it is proved that this method can achieve higher fault diagnosis and root cause location; In the huge data and complex dependencies of each service, it can effectively diagnose system faults and locate the root cause of the fault.

The working principle of the microservice system fault diagnosis and root cause location method of the present invention is as follows:

In this illustration of how it works, X=8, x=3

The training data set trains and optimizes 8 anomaly detection models; the sampling data automatically selects the 3 models with the best anomaly detection effect from the optimized 8 anomaly detection models as cascade models for fault diagnosis. In the training optimization of the anomaly detection model, three models with the best detection effects for the three kinds of faults are respectively obtained. Extract the data generated during normal operation of CPU, latency, and memory from the training data and put them into corresponding models for model training, so that the three models can fully learn the characteristics of CPU, latency, and memory during normal operation. The sequence of fault diagnosis is determined by the F1 value when selecting the model. The F1 value of each model is used as the order of diagnosis in descending order.

In the test phase, the three models that have been trained are cascaded to perform fault diagnosis on the input data. The fault diagnosis process is shown in Figure 3. The specific steps are as follows: When the input data passes through the abnormality detection model 1, only fault 1 is detected, and when the detected data is abnormal, the data is output as fault 1, otherwise, it indicates that the data is normal or other types of faults, and then the model is output The data that is not fault 1 is put into the second anomaly detection model, fault 2 is diagnosed, and so on, and finally x faults are output by x anomaly detection models, and the data that does not satisfy the x faults are output as normal data.

In the root cause localization part, in causal structure learning, the goal is to build a causal graph of the monitoring metrics. A causal graph can be viewed as an anomalous propagation path between metrics. A popular method for constructing causal graphs from observational data is the PC algorithm. The PC algorithm uses statistical tests to perform conditional independence analysis to learn the causal relationship between random variables. Define the monitoring data in the microservice system as , where i represents the ith time step in the sliding window and k represents the number of features. Treating each time series as a variable and the data at each time point as a sample, the PC algorithm outputs a directed acyclic graph DAG with k nodes. The details are as follows: connect k points into a fully connected undirected graph G, and test the conditional independence of each adjacent node in G. Edges between two nodes are removed if conditional independence exists. The principle of v-separation is then used to determine the dependency direction of edges in the graph and extend the skeleton to DAG. Usually, when key performance indicators are abnormal, it means that the service has failed. When network delays occur in a microservice, the entire service fails. When an abnormality occurs, the latency feature in the abnormal data is extracted and input into the root cause analysis, and the PC algorithm is used to construct an abnormal propagation map. In order to locate the faulty server from the abnormal propagation graph, the PageRank algorithm is used to analyze the root cause of the abnormal propagation graph. Define P _ij as the transition probability from node i to j, and the specific calculation formula is as follows:

Among them, w _ij represents the weight between i and j obtained through the PC algorithm. After obtaining the probability matrix, calculate the root cause score v of each node, the specific formula is as follows:

where α denotes the transition probability of the probability matrix, which is set to 0.85 in this note of principle.

In addition to topological reasons, during certain system failures, the abnormal pattern of the system can also affect the final root cause results. In order to capture the abnormal pattern of the fault data, the abnormal thresholds during the diagnosis of CPU usage, memory leak and network delay are returned respectively during the fault diagnosis. Use these three anomaly detection thresholds to calculate the abnormality η of the data when three types of faults occur: CPU usage, memory leak, and network delay. The specific calculation formula is as follows:

,

,

,

, /> , /> Indicates the abnormality of the input data when a CPU exception, Memory exception, and Latency exception occur, respectively.

Causal integration: Combine the abnormality and the initial causal score to perform causal integration to obtain the final final causal score. The specific formula is as follows:

,

in , β represents the contribution of the root cause inference score to the final causal score, which is set to 0.5 in this note of principle.

After the final causal score is obtained, all final causal scores are sorted from large to small. The higher the ranking, the more likely it is to prove that the service is the root cause of the service failure.

Experimental procedure

1. Dataset

In the experiment, a sock-shop e-commerce website is deployed, which serves as a benchmark for microservices and cloud-native technologies. The website consists of 13 services, including functional services such as front desk, catalog, shopping cart, users, orders, payment, shipping, and communication services to facilitate communication between different services.

Deploy sock-shop on multiple virtual machines (vm) in the cloud using Kubernetes. The Kubernetes cluster includes 1 master node and 3 working nodes, and each working node is configured as follows: Ubuntu 18.04, 4vCPU, 16G RAMMemory, 80G Disk. Use open source monitoring and visualization tools Prometheus and Grafana on the master node to monitor the system and collect service-level and resource-level data. In addition, the load generation tool Locust is used on the master node to simulate the workload of the microservice application. 13 sock-shop services are deployed on the working nodes, and are automatically assigned to different virtual machines by Kubernetes.

In order to simulate a real running application, three common exceptions are injected: CPU hogging, memory leak, and network latency. Use the Pumba tool to simulate network failures and stress test resources for Docker containers to achieve exception injection. For CPU hog, CPU resources of each service are consumed; for memory leaks, memory is continuously allocated for each service; for network delay, network packets are delayed through flow control. Each exception lasts 1 to 5 minutes, the application runs normally for 10 to 30 minutes, and then repeats the process at least 5 times for each exception. According to the Prometheus configuration, data is collected in real time every 5 seconds, and service-level and resource-level data are collected at the same time. At the service level, the latency of each service is collected. At the resource level, collect container resource-related indicators, including CPU usage, memory usage, disk read and write, and network received and transmitted bytes.

The following comparative experiments are used to compare the performance of this method with existing methods.

2. Data preprocessing

In order to improve the accuracy of the model, data standardization is used to process the training set and test set, and the data of different specifications are converted into a unified specification to reduce the impact of scale, characteristics, and distribution differences on the model. Use min-max normalization.

3. Model training process

① in Figure 1 is the pre-training module of this model. The main purpose of designing this module is to automatically select the most suitable model from the candidate models, and to realize the best detection model for certain types of abnormalities in CPU, memory memory and latency. . The specific process is shown in Figure 2, and random sampling is performed on the training data. The specific steps are: generate a random number on the preprocessed training data, sample the training data according to the random number, and extract a data set with a size of 500 as the training subset. Then randomly extract a piece of data with CPU usage from the training data, and generate a data set with a size of 100 based on the data. The three-segment datasets are stitched together to form a test subset of size 300. Then the CPU features in the randomly sampled training subset and test subset are extracted, put into the candidate model for anomaly detection, and output the F1 value. When performing CPU anomaly detection, other anomalies in the data are regarded as normal data. After taking 5 samples. Output the average F1 value of anomaly detection after 5 samples. Next, find the model with the largest average F1 value and output the model name. In the same way, the most suitable models for detecting network delay and memory leak are respectively obtained.

As shown in ② in Figure 1, in the data pre-training module, the best models for detecting three kinds of faults are respectively obtained. Extract the monitoring data of CPU, latency, and memory during normal operation from the training data and put them into the corresponding models for model training, so that the three models can fully learn the characteristics of CPU, latency, and memory during normal operation. For the order of fault diagnosis, the F1 value of the model selected in the pre-training stage is used to determine. The F1 value of each model is used as the order of diagnosis in descending order.

After the model training is completed, as shown in ③ in Figure 1, the three trained models are cascaded to perform fault diagnosis on the collected data. The specific steps of fault diagnosis are shown in Figure 3. First, the data is input into the first model for anomaly detection. In anomaly detection, an abnormal threshold is set, and when the error between the predicted data and the real data exceeds the threshold, the point is identified as an abnormal point. In order to improve the accuracy of anomaly detection, the best F1 value method is used to search for the best threshold and return the threshold. After the model 1 detects the abnormality of the input data, it outputs abnormal data and normal data, wherein the abnormal data indicates the occurrence of fault 1, and the normal data includes other fault data and data without any fault. Next, put the normal output data into the next model for detection of fault 2. Same as the first model, output fault 2 and normal data, and put the data detected by this model as normal into model 3. Output fault 3 and normal data. In the three fault diagnosis, three abnormal thresholds are obtained, which are used to capture the abnormal pattern of entity measurement data, so as to improve the location accuracy in root cause location.

Put the abnormal data into the root cause location based on causal inference, as shown in Figure 1 ④. In this part, the PC algorithm is used to learn the causal relationship of the fault nodes, and the causal relationship graph between the nodes is constructed, and the causal relationship graph is used as the abnormal propagation graph. Then use PageRank to perform root cause analysis on the anomaly propagation graph, and output the causal score of the faulty node.

In order to further improve the positioning accuracy, the abnormality threshold value returned in the fault diagnosis stage is used to calculate the abnormality of fault data when CPU usage, memory leak and network delay occur. The specific formula is as follows:

Among them, thred is the abnormal threshold returned when diagnosing the corresponding fault.

As shown in ⑤ in Figure 1, the causal score obtained by the root cause inference method based on causal location and the abnormality score of the data are weighted and integrated, and the final causal score of the root cause location score and anomaly degree based on causal inference is adjusted by β contribution. After the final causal score is obtained, the fault importance of the fault nodes is sorted according to the causal score. The higher the ranking, the greater the probability that the node is the root cause of fault propagation.

Model Performance Index

Troubleshooting

The performance comparison of the model uses several main performance indicators based on the confusion matrix of classification: macro precision, macro recall, and macro F1-Score.

The accuracy rate refers to the proportion of the samples that are actually positive among the samples predicted to be positive by the model to the samples that are predicted to be positive. The calculation formula is

The recall rate refers to the proportion of the samples that are predicted to be positive among the samples that are actually positive, and the calculation formula is:

F1 score is the harmonic mean of precision and recall, calculated as:

Macro precision, macro recall and macro F1 respectively refer to the arithmetic mean of each statistical index value of all categories.

In addition, the F1 Average Rank is used to verify the robustness of the model. F1 Average Rank represents the average ranking of the macro F1-score scores of each model in the five datasets

root cause location

In root cause localization, two widely used metrics, PR@k and Avg@k, are used to evaluate the performance of the model. PR@k represents the probability that the top k results of the root cause predicted by the root cause location algorithm contain the real root cause. When k is small, a higher PR@k indicates that the algorithm more accurately identifies the root cause, and the specific formula is as follows:

Among them, A represents the set of faults existing in the system, a represents a type of fault in A, V _a represents the real root cause of fault a, R _a represents the root cause of fault a predicted by the root cause location algorithm , i represents the i-th root cause in the predicted root cause R _a .

Avg@k evaluates the performance of the model in top k prediction reasons from an overall perspective, and evaluates the overall performance of the algorithm by calculating the average PR@k. The specific formula is:

Among them, j represents the cumulative count.

Model Comparison Results

From Figure 4, Figure 5, Figure 6, Table 1, and Table 2, it can be seen that compared with the existing model, the experimental results of this model in the real data set are as follows:

It can be seen from Table 1 that this model is superior to other 11 models for shopping shipping, user login and registration user, and shopping cart carts data sets, including K-means KMeans, Gaussian mixture model GaussianMixture, comprehensive hierarchical aggregation Birch-like algorithm, Wasserstein distance-based generative adversarial network fault diagnosis model WPS, fault diagnosis model CGNN-MHSA-AR based on parallel graph attention network ensemble learning, fault diagnosis model MAD_GAN based on generative adversarial network, unsupervised multivariate time series fault Diagnostic model USAD, fault diagnosis model DAGMM based on deep self-encoding Gaussian mixture model, fault diagnosis model MTAD based on graph attention network, fault diagnosis model OmniAnomaly based on stochastic recurrent neural network, and fault diagnosis based on deep convolutional self-encoding memory network Model CAE_M. On average, our model achieves a macro precision of 78.5%, a macro recall of 95.7%, and a macro F1 score of 82.4%, the highest compared to all other models. For the two data sets of orders and catalogue, the macro F1 score of this model is slightly lower than that of the best model, specifically: on the catalog data set, the fault diagnosis model MTAD based on graph attention network can achieve The optimal macro F1 value is 0.930, which is 3% better than this model; on the orders data set, using the fault diagnosis model OmniAnomaly based on random recurrent neural network can achieve the optimal macro F1 value of 0.979, which is 0.9% better than this model.

As can be seen from Table 2, for CPU faults, the localization accuracy of this method on PR@1 is 0.8, which indicates that there is an 80% possibility of finding the root cause on the top 1 indicator of the ranking. Similarly, for memory leaks and network latency failures, this method has a 60% and 40% probability of finding the root cause on the first index sorted respectively. On the whole, the average Avg@5 positioning accuracy of this method for cpu faults in the five data sets is 0.88. Compared with the best-performing greedy search-based root cause location method (GES-based), this method improves the root cause location accuracy by 32%. From the perspective of memory leak location accuracy, this method is comparable to the best-performing The root cause location method based on causality prediction (PC-based) has increased by 24%; in terms of network delay location accuracy, this method is the best performing root cause location method based on causality prediction (PC-based) Compared with the improvement of 28%, this method is superior to the root cause location method based on the linear non-Gaussian acyclic model (LiNGAM-based) in terms of the positioning accuracy of cpu faults, memory leaks and network delays.

Figure 4, Figure 5, and Figure 6 show the performance of macro-precision, macro-recall and macro-f1 on this model and 11 models respectively. It can be seen from the figure that this model performs well on the three evaluation indicators. It is better, indicating that this model can better select the model suitable for diagnosing three kinds of faults and cascade them to make it have higher performance in fault diagnosis.

Table 1. Comparison of detection performance between this technology and 11 kinds of fault diagnosis on 5 data sets

Table 2. Comparison of average location performance between this technology and three root cause location methods on five data sets

The technical solution of the present invention is not limited to the limitations of the above-mentioned specific embodiments, and all technical modifications made according to the technical solution of the present invention fall within the scope of protection of the present invention.

Claims (9)

1. The fault diagnosis and root cause positioning method for the micro service system is characterized by comprising the following steps:

s1, constructing X abnormal detection models;

s2, acquiring monitoring data in the micro-service system as a training data set;

s3, respectively importing the training data sets into X anomaly detection models, and training and optimizing the training data sets to obtain X optimized anomaly detection models;

s4, analyzing training results of the X optimized anomaly detection models; constructing a fault diagnosis model according to the training result;

s5, performing causal relation learning on the fault nodes, and constructing a causal relation graph between the nodes as an abnormal propagation graph;

s6, acquiring monitoring data in real time;

s7, analyzing fault diagnosis results of the monitoring data by using a fault diagnosis model;

s8, positioning a fault reason according to the abnormal propagation diagram and the fault diagnosis result.

2. The method for fault diagnosis and root cause localization of a micro-service system according to claim 1, wherein analyzing the training results comprises: extracting data containing a plurality of preset features, respectively importing X optimized abnormality detection models, and obtaining an abnormality detection effect of each optimized abnormality detection model on the preset features as a training result.

3. The method for fault diagnosis and root cause positioning of a micro-service system according to claim 1 or 2, wherein X anomaly detection models are selected from X optimized anomaly detection models according to training results to perform cascading to construct a fault diagnosis model, wherein X is smaller than X.

4. The method for fault diagnosis and root cause localization of micro-service system according to claim 3, wherein in S4, the selected x abnormal detection models are cascaded according to the order of the training results to construct a fault diagnosis model.

5. The method for diagnosing and locating root causes of a micro service system according to claim 1, wherein in S5, a causal relation graph among nodes is constructed as an abnormal propagation graph by performing causal relation learning on the faulty nodes by using a PC algorithm.

6. The method for fault diagnosis and root cause localization of a micro service system according to claim 1, wherein S8 comprises:

s81, performing root cause analysis on the abnormal propagation graph by using a PageRank algorithm, and outputting initial causal scores of all fault nodes;

s82, calculating the anomaly degree of the fault data by using the fault diagnosis result respectively;

s83, weighting and integrating the initial causal score and the degree of abnormality to calculate the final causal score of each node;

s84, sorting the fault importance degree of the fault nodes according to the final causal score to locate the fault reason.

7. The method for fault diagnosis and root cause localization of a micro-service system according to claim 6, wherein in S81, an initial causal score v is expressed asWherein μ represents the number of services in the micro-service architecture, α represents the transition probability of the probability matrix, P is the transition probability, and the transition probability P of nodes i to j _ij Denoted as->Wherein w is _ij Representing the weight between i and j obtained through the PC algorithm.

8. The method for fault diagnosis and root cause localization of micro-service system as claimed in claim 7, wherein in S82, the degree of anomaly η of the calculated fault data is expressed asWherein->Representing monitoring data, gamma representing the type of failure, i representing the ith time step in the sliding window, k representing the feature quantity, n generationThe length of time the fault data is entered, the thread _γ An anomaly threshold value returned when the fault type is gamma for diagnosis.

9. The method for fault diagnosis and root cause localization of a micro service system according to claim 8, wherein in S83, a final causal score is calculated _γ Represented asBeta represents the contribution of the root cause inference score to the last causal score, ++>Indicating when +.>Initial causal score of the service node at the time of the type of fault.