近年來，雲原生架構與微服務廣泛應用於企業資訊系統，在提升部署彈性與交付效率的同時，也增加維運管理的複雜性。服務異常時，故障症狀可能沿 Pod、Node 與 Service 的部署、承載及服務調用關係跨層傳播，使維運人員難以快速發現異常並定位問題節點。然而，依賴完整日誌與追蹤資料的方法，須先投入資料治理、跨服務資料串接與平台整合；僅使用監控指標的方法，則常忽略 Kubernetes 三層部署語義，且將異常偵測與根因排序分開處理。動態調度亦會改變 Pod 身分，使依賴固定識別碼的模型難以套用至後續部署拓樸。 為解決上述問題，本研究提出主聚合注意力異質圖網路（Principal Attention Heterogeneous Graph Network， PAHGNet），以監控指標優先進行雲原生根因定位。PAHGNet 依每日 Kubernetes 拓樸將 Pod、Node 與 Service 建構為異質圖，以通道注意力辨識重要監控訊號，透過主聚合保留鄰域趨勢與局部異常，再由共享編碼器以多任務學習同時處理 L1 異常偵測與 L2 根因排序，篩選排查時間窗並提供根因候選的查核順序。 本研究採用 AIOps Challenge 2022 資料集，與統計式基準、同質與異質圖神經網路及傳統兩階段方法比較。結果顯示，PAHGNet 在異常偵測與根因排序上均維持良好表現，消融實驗亦支持各項設計的必要性。PAHGNet 並非取代維運人員，而是利用既有監控指標將事故初期的開放式搜尋轉為依序查核根因候選，可降低資料治理門檻、縮小人工排查範圍、提升跨團隊診斷一致性，並支援雲原生事故管理。;In recent years， cloud-native architectures and microservices have been widely adopted in enterprise information systems， improving deployment flexibility and delivery efficiency while increasing operational complexity. During anomalies， fault symptoms may propagate across deployment， hosting， and service-call relationships among Pods， Nodes， and Services， complicating rapid anomaly detection and component localization. However， methods dependent on complete logs and traces require prior investment in data governance， cross-service correlation， and platform integration. Metrics-only methods often omit Kubernetes three-layer semantics and separate anomaly detection from root cause ranking. Dynamic scheduling also changes Pod identities， limiting models dependent on fixed identifiers. To address these problems， this study proposes the Principal Attention Heterogeneous Graph Network (PAHGNet)， a monitoring-metrics-first approach to cloud-native root cause localization. PAHGNet constructs daily heterogeneous graphs of Pods， Nodes， and Services based on Kubernetes deployment semantics. Channel attention identifies key monitoring signals， principal aggregation preserves neighborhood trends and local anomalies， and a shared encoder jointly performs L1 anomaly detection and L2 root cause ranking. The model screens investigation windows before prioritizing root cause candidates. Using the AIOps Challenge 2022 dataset， this study compares PAHGNet with statistical baselines， homogeneous and heterogeneous graph neural networks， and conventional two-stage methods. The results show favorable anomaly detection and root cause ranking performance， while ablation experiments support the proposed design. Rather than replacing operations personnel， PAHGNet uses existing metrics to convert open-ended incident searches into prioritized candidate examination. It can lower data-governance requirements， narrow manual investigation， improve cross-team diagnostic consistency， and support cloud-native incident management.
