一句话：提出 DyAlert，用动态图神经网络预测由同一故障传播触发的告警链接，缓解告警风暴下的故障分析负担。
大型在线服务系统中，由于业务与组件依赖关系复杂，一次故障常触发大量告警，形成"告警风暴"，值班工程师难以从中找出与系统故障相关的告警来做根因分析。论文提出 DyAlert：其核心洞察是告警由故障传播触发，即一条告警的传播可能导致另一条告警发生，因此两条告警是否应当关联取决于二者之间是否存在传播关系。据此，作者设计了一种描述告警传播过程的动态图（Alert-Metric Dynamic Graph），并在该动态图上训练神经网络模型来预测告警链接。评估使用某大型企业真实在线服务系统的数据，该系统运行 85 个业务单元、约 30,000 个不同服务。结果表明 DyAlert 能有效预测告警链接，F1-score 相较当前最佳方法平均提升 0.259。
A fault in large online service systems often triggers numerous alerts due to the complex business and component dependencies among services, which is known as “alert storm”. In a short time, an online service system may generate a huge amount of alert data. This poses a challenge for on-call engineers to identify alerts that are associated with a system failure for root cause analysis. In this paper, we propose DyAlert, a dynamic graph neural networks-based approach for linking alerts that might be triggered by a same fault to reduce the burden of on-call engineers in the fault analysis. Our insight is that alerts are often triggered by alert propagation when a system failure occurs, e.g., alert $a$ would lead to the occurrence of alert $b$. Whether two alerts should be linked depends on if one alert is triggered by the propagation of the other. Leveraging this insight, we design a dynamic graph (namely Alert-Metric Dynamic Graph) that describes the propagation process of alerts. Based on the dynamic graph, we train a neural networks-based model to predict alert links. We evaluate DyAlert with real-world data collected from an online service system running 85 business units and about 30,000 different services in a large enterprise. The results show that DyAlert is effective in predicting alert links and it outperforms the state-of-the-art approaches with an average increase of 0.259 in F1-score.
@inproceedings{ChenZDYPOYWQL23,
title = {Dynamic Graph Neural Networks-Based Alert Link Prediction for Online Service Systems},
author = {Yiru Chen and Chenxi Zhang and Zhen Dong and Dingyu Yang and Xin Peng and Jiayu Ou and Hong Yang and Zheshun Wu and Xiaojun Qu and Wei Li},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00177}
}