Learning from distributed traces for anomaly detection and root cause analysis
Techniques facilitating anomaly detection and root cause analysis using distributed trace data. In one example, a system can comprise a processor that executes computer executable components stored in memory. The computer executable components comprise: a preprocessing component; and a monitor component. The preprocessing component can generate a trace frame comprising a vectorized representation of textual trace data produced by microservices of a microservice application. The monitor component can identify a state of the microservice application using the trace frame.
1. A system, comprising:
a processor that executes the following computer-executable components stored in memory:
a preprocessing component that generates a trace frame comprising a vectorized representation of textual trace data produced by microservices of a microservice application; and
a monitor component that identifies a state of the microservice application using the trace frame.
2. The system of claim 1 , wherein the preprocessing component generates the trace frame with a machine learning model trained using a graph traversal algorithm, a word embedding technique, or a combination thereof.
3. The system of claim 1 , wherein the monitor component identifies the state of the microservice application by comparing the trace frame with a reconstructed trace frame generated by a machine learning model.
4. The system of claim 3 , wherein the machine learning model captures spatial and temporal dependencies between the microservices of the microservice application when operating in a normal state.
5. The system of claim 1 , wherein the monitor component identifies the state of the microservice application by comparing a sequence of trace frames with a sequence of reconstructed trace frames generated by a machine learning model, the sequence of trace frames comprising the trace frame.
6. The system of claim 5 , wherein the machine learning model encodes the sequence of trace frames.
7. The system of claim 1 , further comprising:
a diagnostic component that performs root cause analysis by evaluating a contribution of each microservice to a given reconstruction loss.
8. A computer-implemented method, comprising:
generating, by a system operatively coupled to a processor, a trace frame comprising a vectorized representation of textual trace data produced by microservices of a microservice application; and
identifying, by the system, a state of the microservice application using the trace frame.
9. The computer-implemented method of claim 8 , wherein the system generates the trace frame with a machine learning model trained using a graph traversal algorithm, a word embedding technique, or a combination thereof.
10. The computer-implemented method of claim 8 , wherein the system identifies the state of the microservice application by comparing the trace frame with a reconstructed trace frame generated by a machine learning model.
11. The computer-implemented method of claim 10 , wherein the machine learning model captures spatial and temporal dependencies between the microservices of the microservice application when operating in a normal state.
12. The computer-implemented method of claim 8 , wherein the system identifies the state of the microservice application by comparing a sequence of trace frames with a sequence of reconstructed trace frames generated by a machine learning model, the sequence of trace frames comprising the trace frame.
13. The computer-implemented method of claim 12 , wherein the machine learning model is a convolutional long short term memory (ConvLSTM)-based autoencoder model.
14. The computer-implemented method of claim 8 , further comprising:
performing, by the system, root cause analysis by evaluating a contribution of each microservice to a given reconstruction loss.
15. A non-transitory computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
generate, by the processor, a trace frame comprising a vectorized representation of textual trace data produced by microservices of a microservice application; and
identify, by the processor, a state of the microservice application using the trace frame.
16. The non-transitory computer program product of claim 15 , the program instructions executable by the processor to further cause the processor to:
generate, by the processor, the trace frame with a machine learning model trained using a graph traversal algorithm, a word embedding technique, or a combination thereof.
17. The non-transitory computer program product of claim 15 , the program instructions executable by the processor to further cause the processor to:
identify, by the processor, the state of the microservice application by comparing the trace frame with a reconstructed trace frame generated by a machine learning model.
18. The non-transitory computer program product of claim 17 , wherein the machine learning model captures spatial and temporal dependencies between the microservices of the microservice application when operating in a normal state.
19. The non-transitory computer program product of claim 15 , the program instructions executable by the processor to further cause the processor to:
identify, by the processor, the state of the microservice application by comparing a sequence of trace frames with a sequence of reconstructed trace frames generated by a machine learning model, the sequence of trace frames comprising the trace frame.
20. The non-transitory computer program product of claim 15 , the program instructions executable by the processor to further cause the processor to:
perform, by the processor, root cause analysis by evaluating a contribution of each microservice to a given reconstruction loss.