Anomaly detection for a microservices platform

Patent metadata

Field	Value
Publication number	US-2025315356-A1
Application number	US-202418627626-A
Country	US
Kind code	A1
Filing date	Apr 5, 2024
Priority date	Apr 5, 2024
Publication date	Oct 9, 2025
Grant date	—

Abstract

Architectures and techniques are described that can generate or receive a dependency graph of a microservices platform. The dependency graph can be constructed based on run time operation of microservices such that the nodes of the graph can represent microservices and the edges can represent the interactions during run time. The dependency graph along with an anomaly pattern can be embedded into an embedding space, and based on an examination of the embedding space, it can be determined whether the anomaly pattern exists in the dependency graph.

First claim

What is claimed is:

1 . A device, comprising:
at least one processor; and at least one memory that stores executable instructions that, when executed by the at least one processor, facilitate performance of operations, comprising:
receiving a dependency graph that characterizes microservices of a microservices platform as nodes of the dependency graph and associated interactions that occur during run time execution of the microservices as edges of the dependency graph;
receiving an anomaly pattern indicative of a node and edge pattern that was identified, according to a defined criterion, to be problematic for operation of the microservices platform;
generating an embedding space for the dependency graph, wherein the embedding space comprises dimensions representing different properties of the microservices, and wherein a subgraph, representing a portion of the dependency graph, is represented in the embedding space by a first multidimensional vector having first respective values for the dimensions;
transforming the anomaly pattern to a second multidimensional vector of the embedding space having second respective values for the dimensions; and
determining that the anomaly pattern exists in the dependency graph in response to a determination that each of the first respective values is each greater than an associated one of the second respective values.

2 . The device of claim 1 , wherein the dependency graph is a directed graph in which an edge of the edges represents an application programming interface (API) call invoked by a microservice of the microservices.

3 . The device of claim 1 , wherein the anomaly pattern is an anti-pattern that occurs during the run time execution of the microservices.

4 . The device of claim 3 , wherein the anti-pattern is at least one of a cyclical dependency pattern, a knot pattern, a bottleneck pattern, a size mismatch pattern, or a service knot pattern.

5 . The device of claim 1 , wherein the portion of the dependency graph represented by the subgraph comprises a decomposition of the dependency graph as a first node of the nodes and only others of the nodes and the edges that are within two hops of the first node, wherein a hop of the hops represents a traversal of a connected edge.

6 . The device of claim 1 , wherein the transforming of the anomaly pattern to the second multidimensional vector comprises selecting a pattern node of the anomaly pattern as an anchor point and embedding the anchor point into the embedding space.

7 . The device of claim 1 , wherein the operations further comprise generating the dependency graph in response to receiving a dependency map that is determined in response to the run time execution of the microservices via the microservices platform.

8 . The device of claim 7 , wherein the dependency map comprises at least one of operational metric data associated with at least one of the microservices, trace data associated with at least one of the microservices, run time data associated with at least one of the microservices, or service dependency data associated with at least one of the microservices.

9 . The device of claim 1 , wherein the operations further comprise classifying the nodes of the dependency graph or the edges of the dependency graph according to a graph spatial analysis of relationships between the microservices.

10 . The device of claim 9 , wherein the graph spatial analysis comprises at least one of a degree centrality analysis, a betweenness centrality analysis, an eigenvector analysis, a label propagation analysis, or a connectedness analysis.

11 . A method, comprising:
receiving, by a device comprising at least one processor, a dependency graph that characterizes microservices of a microservices platform as nodes of the dependency graph and associated interactions that occur during run time operation of the microservices as edges of the dependency graph; generating, by the device, an embedding space for the dependency graph, wherein the embedding space comprises dimensions representing different properties of the microservice, and wherein a subgraph, representing a portion of the dependency graph, is represented in the embedding space by a first multidimensional vector having first respective values for the dimensions; based on an anomaly pattern indicative of a node and edge pattern that was identified to be problematic for operation of the microservices platform generating, by the device, a second multidimensional vector of the embedding space that is representative of the anomaly pattern; and determining, by the device, that the anomaly pattern exists in the dependency graph when the first multidimensional vector comprises first respective values of the dimensions that are greater than associated second respective values of the dimensions for the second multidimensional vector.

12 . The method of claim 11 , wherein the determining that the anomaly pattern exists comprises determining that an anti-pattern exists in the dependency graph.

13 . The method of claim 11 , further comprising generating, by the device, the dependency graph in response to receiving input data that is determined in response to the run time operation of the microservices via the microservices platform.

14 . The method of claim 11 , further comprising classifying, by the device, the nodes of the dependency graph or the edges of the dependency graph according to a graph spatial analysis of relationships between the microservices operating on the microservices platform.

15 . A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising at least one processor to perform operations, comprising:
receiving a dependency graph that characterizes software components of a cloud services platform as nodes of the dependency graph and associated interactions, which occur during execution of the software components, as edges of the dependency graph; generating an embedding space of the dependency graph in which a subgraph, representing a portion of the dependency graph, is represented by a first multidimensional vector having first respective values of dimensions of the embedding space, resulting in the first multidimensional vector representing different properties of the software components; receiving a query comprising an anomaly pattern indicative of a portion of the nodes and the edges arranged in a manner determined to be problematic for operation of the cloud services platform; converting the anomaly pattern to a second multidimensional vector of the embedding space; and determining that the anomaly pattern exists in the dependency graph when the first multidimensional vector comprises first respective values of the dimensions that are greater than associated second respective values of the dimensions for the second multidimensional vector.

16 . The non-transitory computer-readable medium of claim 15 , wherein the anomaly pattern is an anti-pattern that occurs during the run time execution of the microservices.

17 . The non-transitory computer-readable medium of claim 16 , wherein the anti-pattern is at least one of a cyclical dependency pattern, a knot pattern, a bottleneck pattern, a size discrepancy pattern, or a service knot pattern.

18 . The non-transitory computer-readable medium of claim 15 , wherein the portion of the dependency graph represented by the subgraph comprises a decomposition of the dependency graph as a first node of the nodes and only others of the nodes and the edges that are within

Assignees

• Dell Products Lp

Inventors

• Sawal Vinay
• Liu Jason
• Savir Amihai
• Krishna Deepak
• Jiang Alice
• Leventis Jordan

Classifications

• G06F2201/865

  Monitoring of software · CPC title

• G06F11/302

  where the computing system component is a software system · CPC title

• H04L67/02 Primary

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G06F11/079

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/3006 Primary

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title