IT operation and maintenance fault tracing method and device based on knowledge graph

Abstract

The invention provides a knowledge graph-based IT operation and maintenance fault tracing method and device, and the method solves the problem of low fault positioning efficiency in a high-complexity heterogeneous network through fusing a topological path and a knowledge graph of a fault propagation mode, and specifically comprises the steps: firstly, carrying out the fusion of the knowledge graph, and carrying out the positioning of a fault through the fusion of the knowledge graph; the incidence relation between the physical connection and the fault logic is represented, so that the reduction accuracy of a cross-equipment fault propagation path is improved; secondly, manual troubleshooting participation degree is reduced through semantic similarity analysis, and priority ranking of fault roots is achieved in a complex network environment; and finally, the reliability of fault positioning is guaranteed through consistency verification, and misjudgment caused by simple rule matching is avoided.

Description

Technical Field

[0001] This application relates to the field of IT operations and maintenance technology, and in particular to a method and apparatus for tracing IT operations and maintenance faults based on knowledge graphs. Background Technology

[0002] IT operations and maintenance fault tracing technology is used to ensure the stable operation of large-scale and complex IT systems. Specifically, it ensures business continuity by locating the root cause of system failures.

[0003] In highly complex and heterogeneous IT environments, fault location is achieved by using manual experience-based troubleshooting or simple rule-based matching. These techniques rely on the accumulation of first-hand historical fault records to establish a correspondence between equipment status and fault phenomena in order to achieve preliminary source tracing.

[0004] However, the above-mentioned IT operation and maintenance fault tracing methods have low efficiency in reconstructing fault propagation paths and low accuracy in fault location when facing large-scale heterogeneous network environments. Summary of the Invention

[0005] This application provides a knowledge graph-based method and apparatus for tracing IT operation and maintenance faults to solve the problems of low efficiency in reconstructing fault propagation paths and low accuracy in fault location.

[0006] Firstly, this application provides a knowledge graph-based method for tracing IT operation and maintenance faults, including:

[0007] Acquire device data, which includes first historical fault records, device status data, and impact range data;

[0008] The device data is modeled using entity relationships to generate triples;

[0009] Based on the triples, a first knowledge graph is constructed. The first knowledge graph includes a topology path graph and a fault propagation pattern graph. The fault propagation pattern graph includes multiple fault propagation patterns.

[0010] Based on the topological path graph, the semantic similarity between the target node and the fault propagation pattern is obtained to generate a candidate set of fault root causes.

[0011] Based on the first node weight and the first associated edge confidence of the first knowledge graph, the source tracing score of the nodes in the candidate set of fault root causes is calculated to generate a fault root cause sequence.

[0012] Traverse the neighboring nodes of the target node of the fault root cause sequence on the topology path graph, verify the consistency relationship between the influence range data and the path in the first knowledge graph, and generate verification results;

[0013] If the verification result is greater than or equal to a preset threshold, the target node and adjacent nodes of the fault root cause sequence are merged to generate a fault node set.

[0014] In some feasible embodiments, constructing the first knowledge graph based on the triples includes:

[0015] Based on the entity relationship of the triple, the physical connection relationship between network devices and connection ports is set, so as to establish a topology path graph based on the physical connection relationship;

[0016] Based on the entity relationship of the triple and the first historical fault record, causal data between fault events is obtained, and a fault propagation pattern diagram is established based on the causal data. The fault propagation pattern diagram is used to characterize the fault propagation logic.

[0017] Generate an initial knowledge graph, which includes multiple nodes and associated edges;

[0018] In the initial knowledge graph, relational attributes are added to the nodes and associated edges to establish mapping relationships. These mapping relationships include the mapping relationship between topological paths and physical connections, and the mapping relationship between fault propagation patterns and causal data.

[0019] The first knowledge graph is constructed using the mapping relationship.

[0020] In some feasible embodiments, obtaining the semantic similarity between the target node and the fault propagation pattern based on the topology path graph includes:

[0021] Based on the topology path in the topology path graph, the target node is obtained, and the target node is the abnormal node corresponding to the target device in the topology path graph.

[0022] Using a graph neural network model, a first feature vector and a second feature vector are extracted. The first feature vector is the feature vector of the target node, and the second feature vector is the feature vector of the fault propagation mode.

[0023] Calculate the cosine similarity between the first feature vector and the second feature vector;

[0024] If the cosine similarity is greater than the similarity threshold, the target node is added to the candidate set of root causes of the fault.

[0025] In some feasible embodiments, generating the fault root cause sequence includes:

[0026] The weight of the first node and the confidence of the first associated edge are weighted to obtain the source tracing score of the nodes in the candidate set of fault root causes; the weight of the first node includes the historical fault frequency of the device and / or the importance level of the device, and the confidence of the first associated edge includes the link reliability and / or the fault propagation probability.

[0027] Based on preset sorting rules, the source tracing scores are sorted to generate a fault root cause sequence.

[0028] In some feasible embodiments, generating the verification result includes:

[0029] The topological structure of the affected area data is compared with the topological path of the standard fault propagation path in the first knowledge graph using a subgraph isomorphic matching algorithm.

[0030] Calculate the topology path coverage to generate validation results.

[0031] In some feasible embodiments, the method further includes:

[0032] Based on the set of faulty nodes, the priority of the topology path is obtained;

[0033] The failure propagation probability is weighted by the priority to generate an execution order;

[0034] Based on the execution order, a troubleshooting instruction is generated to instruct the target device to execute the troubleshooting instruction and generate the collection results;

[0035] Compare the collected results with the preset threshold, and, in conjunction with the fault propagation mode, generate investigation and verification data;

[0036] Based on the investigation and verification data, verify the consistency between the abnormal pattern and the historical fault path to generate fault location results.

[0037] In some feasible embodiments, after generating the fault location result, the method further includes:

[0038] Based on the fault location results, update the first historical fault record to generate a second historical fault record;

[0039] The feature vectors of the second historical fault records are extracted using a graph neural network model to generate a fault mode library.

[0040] Subgraph fusion is performed on the fault mode library and the fault propagation mode graph. The decay coefficient of the first node weight and the first associated edge confidence is calculated by the reinforcement learning algorithm to generate the second node weight and the second associated edge confidence.

[0041] A second knowledge graph is generated based on the weight of the second node and the confidence of the second associated edge.

[0042] The priority is adjusted using the second knowledge graph.

[0043] In some feasible embodiments, adjusting the priority using the second knowledge graph includes:

[0044] Based on the second knowledge graph, the probability of fault propagation between the target node and its neighboring nodes is calculated using the probability model of the fault propagation mode.

[0045] If the failure propagation probability is greater than or equal to the probability threshold, a potential failure path is marked, wherein the potential failure path is the path formed by the target node and its adjacent nodes;

[0046] Generate alarm signals;

[0047] A pre-processing instruction set is generated based on the alarm signal. The pre-processing instruction set includes a device port isolation strategy and a redundant resource scheduling strategy.

[0048] The preprocessing instruction set is executed and response data is collected. The response data is fed back to the reinforcement learning algorithm as incremental training samples so as to iteratively update the first node weight, the decay coefficient of the first associated edge confidence, and the priority through the reinforcement learning algorithm.

[0049] In some feasible embodiments, calculating the failure propagation probability between the target node and its neighboring nodes using a probabilistic model of the failure propagation mode includes:

[0050] Based on the second knowledge graph, extract the set of topological paths from the target node to its neighboring nodes, and obtain the second node weight and the second associated edge confidence of the topological path;

[0051] The decay coefficient, topology path weight factor, normalization factor, and cosine similarity between the first feature vector and the second feature vector are obtained to calculate the fault propagation probability between the target node and its neighboring nodes. The first feature vector is the feature vector of the target node, and the second feature vector is the feature vector of the fault propagation mode.

[0052] Secondly, this application provides an IT operations and maintenance fault tracing device based on a knowledge graph, comprising:

[0053] The knowledge graph construction module is used to acquire equipment data, including first historical fault records, equipment status data, and impact range data; and to model the equipment data through entity relationships to generate triples; and to construct a first knowledge graph based on the triples, the first knowledge graph including a topology path graph and a fault propagation pattern graph, the fault propagation pattern graph including multiple fault propagation patterns.

[0054] The candidate set generation module is used to obtain the semantic similarity between the target node and the fault propagation pattern based on the topology path graph, so as to generate a candidate set of fault root causes.

[0055] The source tracing scoring module is used to calculate the source tracing score of the nodes in the candidate set of fault roots based on the first node weight and the first associated edge confidence of the first knowledge graph, so as to generate a fault root source sequence.

[0056] The fault verification module is used to traverse the neighboring nodes of the target node of the fault root cause sequence on the topology path graph, verify the consistency relationship between the influence range data and the path in the first knowledge graph, so as to generate a verification result; and when the verification result is greater than or equal to a preset threshold, merge the target node and neighboring nodes of the fault root cause sequence to generate a fault node set.

[0057] As can be seen from the above technical solutions, this application provides an IT operation and maintenance fault tracing method and apparatus based on knowledge graph. The method includes: acquiring equipment data, wherein the equipment data includes first historical fault records, equipment status data, and impact range data; modeling the equipment data through entity relationships; constructing a first knowledge graph based on generated triples, the first knowledge graph including a topology path graph and a fault propagation pattern graph; acquiring the semantic similarity between the target node and the fault propagation pattern based on the topology path graph; generating a fault root cause candidate set; calculating the tracing score of the nodes in the fault root cause candidate set based on the first node weight and the first associated edge confidence of the first knowledge graph; generating a fault root cause sequence; traversing the adjacent nodes of the target node in the fault root cause sequence on the topology path graph; verifying the consistency relationship between the impact range data and the path in the first knowledge graph to generate a verification result; and merging the target node and adjacent nodes of the fault root cause sequence to generate a fault node set when the verification result is greater than or equal to a preset threshold. The proposed method addresses the problem of low fault location efficiency in highly complex heterogeneous networks by integrating knowledge graphs of topological paths and fault propagation patterns. During implementation, entity relationship modeling transforms multi-source heterogeneous data into structured triples, overcoming the deficiency of incomplete topological relationship modeling. Attached Figure Description

[0058] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A flowchart illustrating the knowledge graph-based IT operations and maintenance fault tracing method provided in this application embodiment;

[0060] Figure 2 This is a flowchart illustrating the process of generating fault location results provided in an embodiment of this application.

[0061] Figure 3 This is a schematic diagram of the structure of the knowledge graph-based IT operation and maintenance fault tracing device provided in the embodiments of this application. Detailed Implementation

[0062] The embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described below do not represent all embodiments consistent with this application. They are merely examples of systems and methods consistent with some aspects of this application as detailed in the claims.

[0063] In highly complex and heterogeneous IT environments, taking the global IT system of a large financial group as an example, the hybrid architecture deployed across regions includes traditional physical servers (IBM Power series), cloud virtual machines (AWS EC2 / Azure VMs), container clusters (Kubernetes Pods), and edge IoT devices, resulting in a large number of nodes. The multi-layered topology involves SD-WAN backbone, MPLS leased lines, and 5G edge access, with dynamically changing dependencies between devices. The business chain consists of dozens of microservices, and a single point of failure can propagate across layers along the path of "database - application service - API gateway - front end".

[0064] Traditional operations and maintenance employ two methods for tracing the root cause: manual experience-based troubleshooting relies on engineers analyzing monitoring alerts (such as Zabbix alert emails and Prometheus metrics). For example, when a payment system experiences a sudden increase in latency, engineers need to manually correlate database thread pools, application service queues, and network link status, which typically takes a long time to pinpoint the root cause.

[0065] Simple rule matching is based on preset rules in the historical fault database (such as "Redis connection count greater than 1000 triggers an alarm"). For example, when the rule database does not cover the new scenario of "cloud storage bucket rate limiting - video transcoding service timeout", the system misjudges it as network packet loss, resulting in the incorrect expansion of bandwidth resources.

[0066] In other words, the above-mentioned IT operation and maintenance fault tracing methods have low efficiency in restoring fault propagation paths and low accuracy in fault location when facing large-scale heterogeneous network environments.

[0067] This application provides a knowledge graph-based method for tracing IT operation and maintenance faults. By fusing a knowledge graph with a topology path graph and a fault propagation pattern graph, heterogeneous data sources are deconstructed. Semantic similarity is used to replace rule matching, and node weights and edge confidence are used to quantify risks. Subgraph isomorphism is used to verify the propagation path, thereby improving topology integrity and efficiency.

[0068] like Figure 1 As shown, the method includes:

[0069] S100: Acquire device data.

[0070] Equipment data is a heterogeneous data set collected in the IT operations and maintenance environment, used to build fault tracing. This equipment data includes first-hand historical fault records, equipment status data, and impact range data.

[0071] The first historical fault record contains historical fault events and their handling results. Device status data represents the real-time operating parameters of network devices, and the impact scope data represents the affected business systems and related devices at the time of the fault. Device data is obtained from IT monitoring systems through standardized interfaces, such as collecting server CPU load data from the Zabbix platform or capturing packet loss rate information from network traffic probes.

[0072] The method provided in this application is applied to a computing device with data storage and processing capabilities. The computing device includes at least a memory and a processor. The memory is used to store historical fault records, device status data, and impact range data. The processor is used to execute data modeling, knowledge graph construction, and fault tracing analysis programs.

[0073] S200: Model the device data using entity relationships to generate triples.

[0074] Triples are standardized data structures generated through entity relationship modeling, used to represent the logical relationships between device data.

[0075] In one implementation, triples are formatted as entity-relationship-attribute. A triple contains an entity, a relation, and an attribute, representing the relationships between data in a structured way. For example, a triple instance of switch A-connection-core router B can be formed, with the switch as the entity, fiber optic connection as the relation, and port status as the attribute. The modeling process can employ natural language processing techniques to extract entities and relations from device logs, ensuring a structured representation of network topology and fault logic.

[0076] For example, in an IT operations and maintenance fault tracing scenario, when the network system detects a service anomaly, it first obtains device data from the monitoring platform, including historical fault databases, real-time device status data, and fault impact reports. Through entity relationship resolution, the raw data is converted into a sequence of triples. For instance, the port Eth1 / 1-connection-server Node5 triple is extracted from the switch logs, or a memory leak-cause-service timeout causal chain is generated from the fault report.

[0077] S300: Construct a first knowledge graph based on the triples.

[0078] In IT system operation and maintenance scenarios, when it is necessary to quickly locate device failures in a large-scale heterogeneous network environment, computing devices obtain real-time device status and impact range information through data interfaces, and use historical data in memory to construct a knowledge graph that integrates topology paths and fault propagation patterns.

[0079] The first knowledge graph is a knowledge base constructed from triples, containing two substructures: a topology path graph and a fault propagation pattern graph. The topology path graph represents the physical connections between devices; for example, it transforms the hardware links from server to switch to firewall into graph nodes and associated edges. The fault propagation pattern graph abstracts the causal chains of fault events, such as the logical path from power failure to server crash to database interruption. The graph is stored in a graph database, supporting efficient traversal and querying.

[0080] When constructing the first knowledge graph based on triples, the topology path graph module parses the physical connection relationships of devices to generate a hierarchical network structure, and the fault propagation pattern graph analyzes the causal relationships of historical faults to form a logical propagation chain. These are then integrated into a unified knowledge base through node attribute mapping.

[0081] S400: Based on the topology path graph, obtain the semantic similarity between the target node and the fault propagation pattern to generate a candidate set of fault root causes.

[0082] The target node is the graph location point in the topology path diagram corresponding to the currently abnormal device, serving as the starting point for fault tracing analysis. The target node is bound to the knowledge graph node through a device identifier, such as an IP address or hostname. For example, a database server with response delay is mapped as "DB_Node7" in the graph.

[0083] When the network monitoring system detects that the video streaming server latency exceeds the standard, it extracts the device identifier "VideoSvr_09", searches for a node with the same name in the topology path map, and confirms the node association path, namely load balancer LB_12-VideoSvr_09-content distribution node CDN_05.

[0084] The target node's current abnormal device corresponds to a point in the fault map, for example, a server node with response delay. Based on the target node's output first feature vector, a fault propagation mode is selected from the fault propagation mode graph, and a second feature vector is output. The semantic similarity between the first and second feature vectors is calculated, compared with a similarity threshold, and then a candidate set of fault root causes is generated.

[0085] Semantic similarity is a measure of the association between the feature vectors of a target node and the fault propagation pattern. It is used to screen potential fault sources. The similarity calculation uses a graph neural network to extract feature vectors and uses a cosine similarity algorithm to quantify the degree of matching. When the similarity is higher than a preset threshold, the target node is added to the fault root cause candidate set to achieve preliminary screening.

[0086] By using semantic similarity analysis, we can avoid the limitations of traditional technologies that rely on human experience or simple rule matching, reduce human involvement, improve the efficiency and accuracy of screening candidate nodes for the root cause of faults in complex network environments, and lay a data foundation for subsequent source tracing.

[0087] S500: Based on the weight of the first node and the confidence of the first associated edge in the first knowledge graph, calculate the source tracing score of the nodes in the candidate set of fault root causes to generate a fault root cause sequence.

[0088] The first node weight is a quantitative risk indicator for device nodes in a knowledge graph, used to characterize the potential failure tendency and business impact level of the device in fault tracing. The first node weight includes two types of parameters: the historical failure frequency of the device and the importance level of the device.

[0089] The historical failure frequency of equipment is statistically analyzed to count the number of abnormal events that occurred within a specific period. For example, a server may have triggered three overload alarms in the past three months. Equipment importance levels are set according to the criticality of the business services carried by the equipment. For example, core database servers are marked as the highest level (Level 9), while edge testing equipment is marked as Level 2. Weight values ​​are generated by fusing frequency and level parameters using a normalization algorithm, with higher-weighted equipment ranked higher in the failure root cause sequence.

[0090] The first associated edge confidence score characterizes the reliability of the physical or logical connection between devices and is used to assess the probability of a fault propagating along the link. The first associated edge confidence score includes link reliability and fault propagation probability. Link reliability is calculated based on physical channel performance metrics. The fault propagation probability is determined by analyzing historical data to determine the proportion of causal triggers; for example, if a switch failure event results in 70% of associated server response timeouts, the propagation probability is set to 0.7. The first associated edge confidence score is dynamically updated to characterize the network link status.

[0091] The source tracing score is calculated based on node weights and associated edge confidence levels to determine the priority of fault root causes. Node weights include the historical failure frequency of the device and the device's importance level; for example, core routers receive higher weights due to their high failure frequency. Associated edge confidence levels include link reliability and fault propagation probability, such as the bit error rate (BER) of an optical fiber link. The weighted calculation model combines these parameters to generate a score, which is then arranged in descending order to form a fault root cause sequence.

[0092] S600: Traverse the neighboring nodes of the target node in the fault root cause sequence on the topology path graph, verify the consistency between the impact range data and the path in the first knowledge graph, and generate verification results.

[0093] The target nodes of the fault root cause sequence, such as abnormal router nodes, can be traversed according to the topological path of the knowledge graph. The adjacent nodes on the topological path, such as the firewall nodes associated with the abnormal router nodes, can be used to verify the consistency between the real-time impact range data and the topological structure of the graph path through a subgraph isomorphic matching algorithm, such as the VF2 algorithm. For example, when the target node is a core router, the adjacent access switches and server nodes on its topological path can be traversed, and the current fault impact range can be verified through a subgraph isomorphic matching algorithm to verify whether it is consistent with the path pattern of router failure - cascaded switch failure in the graph.

[0094] Consistency verification is achieved through a subgraph isomorphic matching algorithm, comparing the real-time impact range data with the topology of the graph paths. The validity of the fault propagation path is confirmed when the coverage rate exceeds a preset threshold, calculated by the topology path coverage rate. The verification result triggers the generation of a fault node set, merging the target node and its adjacent nodes to form a complete fault link.

[0095] S700: If the verification result is greater than or equal to the preset threshold, merge the target node and adjacent nodes of the fault root cause sequence to generate a fault node set.

[0096] When the topology path coverage rate in the verification results exceeds a preset threshold, such as 90%, the target node and its adjacent nodes on the topology path are merged to generate a set of faulty nodes, such as a group of faulty nodes including router faults and cascaded switches. The path verification mechanism replaces the traditional manual experience analysis, which solves the shortcomings of insufficient fault propagation pattern analysis and difficulty in handling cross-device propagation and causal correlation of faults in complex networks. It realizes the dynamic verification of fault propagation paths and accurate matching of the scope of impact in complex networks.

[0097] The source tracing and scoring module traverses the candidate set nodes, calling the weight and confidence parameters from the knowledge graph. The node weight is set based on the device's historical failure rate; for example, a storage device with frequent downtime has a weight of 0.9. The edge confidence is dynamically updated based on link quality; for example, an unstable fiber optic link has a confidence of 0.6. After weighted calculation, a scoring sequence is generated, and high-scoring nodes are given priority in the investigation process.

[0098] The verification phase traverses the adjacent devices of the target node in the fault root cause sequence, such as the associated firewalls of the anomalous router. A subgraph isomorphic matching algorithm is used to compare the topology of the network under investigation with the standardized fault paths stored in the knowledge graph. When the real-time topology matching of the knowledge graph path coverage reaches 95%, the fault propagation path is confirmed to be valid, and the target node and its adjacent nodes are merged to generate a set of faulty nodes.

[0099] Specifically, node weights can be calculated based on attributes such as historical failure frequency and equipment importance level of nodes in the knowledge graph. Combined with confidence parameters such as communication link reliability and failure propagation probability of associated edges, a weighted fusion model, such as entropy weight method or fuzzy comprehensive evaluation, can be used to calculate the comprehensive score of each node in the candidate set of fault root causes. The nodes are then arranged in descending order of score to generate a source tracing priority sequence.

[0100] The VF2 subgraph isomorphic matching algorithm can be used to perform a structured comparison between the topological structure of the real-time impact range data and the standardized fault propagation path pattern in the knowledge graph. By matching node labels, aligning edge relationships, and calculating path coverage, the consistency between the two in terms of topological features and semantic logic can be verified. When the verification results show that the matching degree and feature similarity between the fault propagation path of the target node and the fault pattern defined in the knowledge graph exceed the dynamic threshold, the target node and its directly associated nodes on the topological path are merged into a fault node set, forming a complete fault link including the primary fault point, secondary fault points, and potentially affected equipment.

[0101] The proposed method acquires historical fault records, device status, and impact range data, models them as triples, and constructs a knowledge graph that integrates topology paths and fault propagation patterns. This fully characterizes the physical connection relationships of network devices and the causal dependency logic of faults, addressing the shortcomings of traditional technologies such as incomplete topology modeling and insufficient fault propagation pattern analysis. It analyzes the semantic similarity between abnormal nodes and fault propagation patterns to filter candidate sets, avoiding reliance on manual experience or simple rule matching, reducing human intervention, and improving troubleshooting efficiency. Based on node weights and edge confidence, it calculates and ranks source tracing scores, and combines this with a subgraph isomorphic matching algorithm to verify the consistency between impact range data and graph paths. This enables the location of fault root causes and dynamic verification of propagation paths, effectively handling the cross-device propagation and causal association problems of faults in complex networks, improving the accuracy and efficiency of IT operation and maintenance fault tracing, and meeting the needs of modern IT systems for rapid fault location and intelligent handling.

[0102] To construct the first knowledge graph, in some embodiments, the method includes: setting physical connection relationships between network devices and connection ports based on the entity relationships of the triples, so as to establish a topology path graph based on the physical connection relationships, wherein each triple includes a subject, a predicate, and an object, used to represent the logical association between entities such as network devices, connection ports, and fault events.

[0103] Entity relationships are logical association rules between network components in device data, used to structurally define device interaction behavior. Entity relationships are generated by parsing device configuration files and communication protocols. For example, connection relationships can be extracted from router port configurations, or causal chains can be identified from fault logs. Entity relationship modeling ensures that triples accurately represent the network physical architecture and fault evolution logic.

[0104] Physical connectivity represents the hardware link topology between devices and forms the basis for constructing the topology path diagram. Physical connectivity is based on device interface data definitions, such as fiber optic port mapping and network cable interface binding. Through standardized transformation, the raw data of server A - network port Eth0 - connection - switch B - port Gig1 / 1 is transformed into a machine-readable connection graph.

[0105] Based on the entity relationships of the triples and the first historical fault record, causal data between fault events is obtained, and a fault propagation pattern diagram is established based on the causal data.

[0106] Causal data characterizes the chains between failure events, driving the generation of failure propagation pattern diagrams. Causal data extracts time series and impact ranges from historical failure records; for example, it analyzes the chronological order and correlation strength of "power fluctuation event - server crash event - database timeout event" in logs.

[0107] Fault propagation pattern diagrams are used to represent fault propagation logic. Through causal reasoning algorithms, such as Bayesian networks and decision trees, the conditional probabilities between events are quantified to form a computable propagation logic.

[0108] An initial knowledge graph is then generated, which is an unfused intermediate state of two graphs, including basic nodes and connecting edges. Nodes represent network entities, such as servers and switches, while connecting edges represent relationships between entities, such as connections and influences. The graph framework uses an attribute graph model for storage and supports subsequent expansion of attribute fields.

[0109] In the initial knowledge graph, relational attributes are added to the nodes and associated edges. The relational attributes are semantic tags added to the nodes and edges. Then, a mapping relationship is established based on the semantic tags. The mapping relationship is a topological path attribute, such as the mapping relationship between port bandwidth, link delay and physical connection relationship, and the mapping relationship between fault propagation mode and causal data.

[0110] The first knowledge graph is constructed using the aforementioned mapping relationships, which include mappings between topological paths and physical connections, and mappings between fault propagation patterns and causal data. The mapping mechanism is implemented through node ID binding; for example, a physical switch node ID is associated with a "traffic overload" fault mode node ID, causing hardware state changes to trigger logical rule matching.

[0111] When constructing the first knowledge graph, the entity relationships in the triples are parsed first. For physical connection relationships, the interface definitions in the device configuration data are scanned to identify the MAC address binding relationship between the server network card and the switch port, generating triples such as server Node3-physical connection-core switch Port5 / 1. Based on this, a topology path graph is built, abstracting devices as nodes and physical links as edges.

[0112] For fault propagation logic, the causal chain of the first historical fault record is analyzed, the timestamp and impact range of the fault event are extracted, and the event dependency probability is calculated using a Bayesian network. For example, if two out of three power module anomaly records cause the associated server to crash, a triplet of power anomaly - causing - server crash is generated, with the edge attribute set to a propagation probability of 66.7%. Based on such triplets, a fault propagation pattern graph is constructed, where nodes represent fault states, such as database response timeout, and edges represent state transition relationships, such as connection limit exceeded - triggering - response timeout.

[0113] When generating the initial knowledge graph, a shared namespace is created. The server nodes in the topology path graph and the service failure nodes in the fault propagation pattern graph share the unique ID "SVR_Node3". The initial graph only includes basic node labels and edge types; attribute parameters have not yet been injected.

[0114] In the attribute addition phase, physical attributes are extended for topology path nodes, a bandwidth utilization threshold of 85% is added for switch port nodes, and a redundant power supply status of "active" is added for server nodes. Simultaneously, logical attributes are extended for fault propagation nodes, an attribute affecting business (e.g., transaction system) is added for memory leak nodes, and a propagation latency of 200ms is added for the causing edge. Through attribute mapping, the bandwidth utilization of physical ports is correlated with the overload trigger probability of fault propagation edges, forming a cross-domain parameter binding.

[0115] When constructing the first knowledge graph, dual-graph entity alignment is performed. The core router-connection-firewall link in the physical connection relationship is associated with the routing table error-trigger-firewall policy failure logical path in the fault propagation mode through mapping relationship.

[0116] For example, in a data center network outage event, the topology path diagram constructs a link of "core switch A - physical connection - load balancer"; the fault propagation pattern diagram generates a rule of "session count exceeded - resulting in - load balancer failure" based on historical data. By adding the attribute of "maximum number of sessions = 50000" to the load balancer node and mapping this attribute to the "threshold trigger condition" of the fault propagation edge, dynamic coupling between physical resource status and fault logic is achieved.

[0117] By driving the separation and attribute fusion of the topology path graph and the fault propagation pattern graph through entity relationships, the problem of the separation between physical topology and fault logic in traditional technologies is solved.

[0118] In some embodiments, obtaining the semantic similarity between the target node and the fault propagation pattern based on the topology path graph includes the following steps:

[0119] Based on the topological paths in the aforementioned topological path graph, the target node is obtained. A topological path is a physical connection link between devices in the knowledge graph, used to locate the target device's position within the graph. The topological path is determined by the interface binding relationships of network devices, such as the physical channel between a server's network interface card (NIC) and a switch port. In the topological path graph, a path is a combination of a sequence of nodes and associated edges.

[0120] The target node is the target device, that is, the abnormal node corresponding to the abnormal device in the topology path graph, representing the initial object for troubleshooting. The target node is bound to the graph node through a device identifier, such as IP address or hostname. For example, a database server with response delay is marked as "DB_Node7" in the graph.

[0121] For example, when an IT system detects a device malfunction, it locates the target node in the topology path graph. Taking the case of increased latency on a cloud platform's API gateway as an example, the monitoring system identifies the malfunctioning device as "gateway instance GW_09" and matches it with a node of the same name in the knowledge graph. The topology path of this node includes the associated load balancer (upstream node) and the microservice cluster (downstream node), forming a physical link of "load balancer LB_12 - gateway GW_09 - service cluster SVC_Group5".

[0122] By utilizing a graph neural network model, the first and second feature vectors are extracted. The graph neural network then fuses the topological structure with real-time parameters, overcoming the difficulty of quantifying human experience and making the matching of abnormal states and fault modes more objective.

[0123] Graph neural network (Graph NNN) models are computational engines for extracting feature vectors to quantify the semantic associations between devices and failure modes. The input to a Graph NNN model includes topological neighborhood features of the target node, such as structured representations of associated device states, link quality, and failure propagation patterns. The output of a Graph NNN model is a fixed-dimensional feature vector; for example, a 256-dimensional vector can be generated using the GraphSAGE algorithm to capture the semantic location of a node within the failure logic.

[0124] Feature vectors are high-dimensional numerical representations of devices and failure modes. The first feature vector represents the operating status of the target node, including parameters such as resource utilization and error log frequency; the second feature vector represents the logical characteristics of the failure propagation mode, such as abstract attributes like triggering conditions and scope of impact. The vector generation process integrates graph structure and attribute information, ensuring that similar failure scenarios are close in distance within the vector space.

[0125] Calculate the cosine similarity between the first feature vector and the second feature vector. If the cosine similarity is greater than the similarity threshold, add the target node to the candidate set of root causes of the fault.

[0126] Cosine similarity is an index that measures the directional consistency between two feature vectors, used to evaluate the semantic matching degree between a target node and a fault propagation pattern. It is calculated as the ratio of the vector dot product to the product of their magnitudes, with a result in the range [-1, 1]. When the value is close to 1, it indicates that the target node's operating state highly matches the characteristics of that fault pattern. The similarity threshold is a preset screening threshold that determines whether a target node enters the candidate set of fault root causes. The threshold is set based on historical fault data statistics. For example, after analyzing 100 similar faults, 0.75 is determined as the effective dividing point; target nodes exceeding the threshold are marked as potential fault sources, triggering subsequent scoring and verification.

[0127] After generating the candidate set of fault root causes, a fault root cause sequence is generated based on the source tracing score, including the following steps:

[0128] The weight of the first node and the confidence of the first associated edge are weighted to obtain the source tracing score of the nodes in the candidate set of fault root causes; the weight of the first node includes the historical fault frequency of the device and / or the importance level of the device, and the confidence of the first associated edge includes the link reliability and / or the fault propagation probability.

[0129] Based on preset sorting rules, the source tracing scores are sorted to generate a fault root cause sequence.

[0130] Once the candidate set of root causes of a fault is generated, the source tracing score is calculated by traversing the candidate nodes. Taking a live streaming buffering event on a video platform as an example, the candidate set includes three nodes: the streaming media server (node ​​A), the content distribution node (node ​​B), and the edge computing gateway (node ​​C).

[0131] Among them, Node A is converted into a weight value of 0.85 based on the historical fault frequency parameter (3 overload events in the past 30 days); the equipment importance level (core transcoding equipment) is marked as level 9, and the weight is added to 0.92; Node B has a fault frequency weight of 0.7 (single fault record); importance level 7, comprehensive weight 0.75; Node C has a fault frequency weight of 0.6 (no historical faults); importance level 6, comprehensive weight 0.63.

[0132] For the link from A to B, the confidence level for link reliability (fiber delay fluctuation rate 12%) is 0.65, the confidence level for fault propagation probability (70% probability of A failure causing B anomaly in historical data) is 0.7, and the overall value is 0.68; for the link from B to C, the confidence level for link reliability (wireless channel interference rate 8%) is 0.8, the confidence level for fault propagation probability (40%) is 0.4, and the overall value is 0.55.

[0133] A weighted calculation model is applied to node A, with a node weight of 0.92 multiplied by the confidence of the associated edge of 0.68, resulting in a score of 0.626. Similarly, the score for node B is calculated, with a score of 0.412. Node C, as the end node of the path, uses only its own weight of 0.63. Nodes are sorted in descending order of score: node A, node C, and node B, indicating that streaming media servers are prioritized for investigation according to the rules.

[0134] During implementation, the statistical analysis of historical equipment failure frequencies ensures the objectivity of weighting parameters; the dual assessment of link reliability and propagation probability enables edge confidence to comprehensively characterize path risks; and the weighted calculation model transforms complex topological relationships into rankable scalar scores.

[0135] In some embodiments, the method further includes: obtaining the priority of the topology path based on the set of faulty nodes;

[0136] The failure propagation probability is weighted by the priority to generate an execution order;

[0137] Based on the execution order, a troubleshooting instruction is generated to instruct the target device to execute the troubleshooting instruction and generate the collection results;

[0138] Compare the collected results with the preset threshold, and, in conjunction with the fault propagation mode, generate investigation and verification data;

[0139] Based on the investigation and verification data, verify the consistency between the abnormal pattern and the historical fault path to generate fault location results.

[0140] Based on the set of faulty nodes already identified in the first knowledge graph, i.e. the set of faulty nodes, a set of troubleshooting instructions with execution order can be generated by evaluating the fusion value of the priority weight of the topology path and the probability of fault propagation.

[0141] In one implementation, a topology path priority matching algorithm, such as Dijkstra's algorithm, is used to determine the critical path order by combining the importance weight of the equipment. A fault propagation probability weighted model, such as a hidden Markov model, is introduced to predict the credibility of the propagation path. Priority parameters and execution timing constraints are assigned to each investigation node to form an executable operation sequence.

[0142] The protocol adaptation layer can send detection commands to specified network devices, such as port status query and traffic mirroring capture. Executing this command sequence can collect the operating parameters and log data returned by the device in real time, and compare and analyze them with preset performance thresholds, such as packet loss rate >1% and response latency >50ms.

[0143] By combining the pre-defined fault propagation patterns in the knowledge graph, such as the causal chain template of device overheating → link jitter → service interruption, the rule engine performs semantic reasoning on the investigation results to verify whether the observed anomalies are consistent with the fault propagation logic defined in the knowledge graph, and generates investigation verification data including intermediate state markers.

[0144] In some embodiments, a subgraph isomorphic matching algorithm is used to compare the topological structure of the influence range data with the topological path of the standard fault propagation path in the first knowledge graph, and calculate the topological path coverage to generate verification results.

[0145] Subgraph isomorphic matching algorithms, such as the VF2 algorithm, can be used to perform a structured comparison between the verified abnormal patterns and the historical fault subgraphs in the knowledge graph, and calculate the topological similarity and attribute matching degree. When the comprehensive similarity exceeds the dynamic threshold, the impact range prediction mechanism can be triggered by combining historical fault pattern learning, dynamic adjustment of real-time network status and propagation probability, weighting of device importance, and multi-dimensional verification mechanisms. Based on the dependency relationship of related devices in the knowledge graph and the fault propagation probability, a fault location result report including a list of affected devices, service interruption level, and risk diffusion path can be generated.

[0146] Subgraph isomorphic matching is a mathematical tool for verifying the consistency of topological structures, used to compare real-time network states with standard paths in knowledge graphs. This algorithm determines the inclusion relationship between two graph structures by matching node labels and aligning edge relationships. In fault tracing, the algorithm takes as input a topological subgraph of real-time impact range data and standardized fault paths stored in the knowledge graph, and outputs the structural similarity determination result.

[0147] By implementing a closed-loop verification mechanism, intelligent reasoning is achieved from local anomaly detection to global impact assessment, thereby improving the accuracy of fault location and the efficiency of handling.

[0148] After generating the fault location results, such as Figure 2 As shown, in some embodiments, it also includes:

[0149] Based on the fault location results, the first historical fault record is updated to generate a second historical fault record. The second historical fault record is an incremental dataset derived from the fault location results, including newly added fault events, equipment status, and handling responses. This record is generated by associating the fault node set with investigation and verification data, such as adding the located database thread pool exhaustion event and its impact scope to the historical database.

[0150] The feature vectors of the second historical fault records are extracted using a graph neural network model to generate a fault mode library.

[0151] Subgraph fusion is performed on the fault mode library and the fault propagation mode graph. The decay coefficient of the first node weight and the first associated edge confidence is calculated by the reinforcement learning algorithm to generate the second node weight and the second associated edge confidence.

[0152] A second knowledge graph is generated based on the weight of the second node and the confidence of the second associated edge.

[0153] The priority is adjusted using the second knowledge graph.

[0154] Specifically, based on the newly added abnormal pattern data in the fault location results, an incremental data update strategy can be adopted to manage the versioning of historical fault records. Through graph neural network models, such as GraphSAGE, the temporal features, equipment association features and propagation path features of new fault events can be jointly embedded to generate fault mode feature vectors with discriminative characteristics, and a dynamic fault mode library can be constructed.

[0155] Subgraph fusion is a structural integration process that combines a dynamic fault pattern database with the fault propagation pattern graph of an existing knowledge graph. The fusion algorithm identifies common nodes and edge relationships between patterns, and the fusion result forms an enhanced fault logic network.

[0156] By using reinforcement learning algorithms, such as deep Q-networks, node weights are dynamically adjusted using indicators such as fault location accuracy and path coverage as reward signals. For example, device fault probability, propagation influence, and edge confidence, as well as link reliability and attenuation coefficients for causal correlation strength, are used. The attenuation coefficient represents the attenuation rate of the influence of historical parameters on the current state. The timeliness coefficient used to adjust weights and confidence is dynamically calculated through reinforcement learning to achieve adaptive evolution of the knowledge graph and optimize the representation capability of fault propagation patterns.

[0157] Based on the updated node attributes and edge relationships in the optimized knowledge graph, a dynamic priority queue algorithm is adopted, such as a weighted round-robin strategy combined with a time decay factor to recalculate the priority matching rules of the topological path. Through a cyclic iterative mechanism of data update-pattern fusion-parameter optimization-rule adjustment, the adaptive evolution of the knowledge graph and the continuous improvement of fault tracing capabilities are achieved.

[0158] After adjusting the priority using the second knowledge graph, in some embodiments, the failure propagation probability between the target node and its neighboring nodes is calculated based on the second knowledge graph using a probability model of the failure propagation mode; if the failure propagation probability is greater than or equal to a probability threshold, a potential failure path is marked, wherein the potential failure path is the path formed by the target node and its neighboring nodes.

[0159] The probabilistic model of fault propagation patterns is a mathematical framework for quantifying the risk of fault propagation between nodes and is used to predict potential fault paths. The model takes topological parameters of the target node and its neighboring nodes as input and outputs propagation probability values. The calculation process integrates topological path features with fault mode similarity; for example, it balances the contribution weights of physical links and logical rules through path weight factors.

[0160] In some embodiments, based on the second knowledge graph, a set of topological paths from the target node to neighboring nodes is extracted, and the second node weight and second associated edge confidence of the topological paths are obtained;

[0161] Obtain the attenuation coefficient, topology path weight factor, normalization factor, and cosine similarity between the first and second feature vectors, and calculate the fault propagation probability between the target node and its neighboring nodes using the following formula:

[0162]

[0163] Among them, P f (v i →v j ) is the target node v i to adjacent node v j The failure propagation probability, λ is the dynamic attenuation coefficient, α is the configurable topology path weight factor, P ij Let w be the set of topological paths. k For edge e k The confidence level, i.e., the confidence level of the second associated edge, β p =∫(∏n∈pW n ) represents the node weight W on path p. n The normalization factor of the product, n∈p, is a node on path p, sim(F i F j ) is the target node F iWith neighboring node F j The cosine similarity of the fault mode feature vectors, N i For target node v i The set of adjacent nodes.

[0164] Specifically, based on the second knowledge graph, the target node v can be extracted using graph traversal algorithms, such as breadth-first search. i to adjacent node v j The set of all potential topological paths P ij And aggregate the device weight parameters {W} of each node on the path in real time. n For example, historical failure frequency, port stability score, and confidence level of associated edges. k For example, link failure transmission rate and protocol compatibility coefficient are calculated using a composite calculation model that integrates feature similarity and topology weight. The influence weight of historical propagation mode is adjusted by a dynamic attenuation coefficient λ, and the coupling relationship between path length and node importance is balanced by a configurable topology path weight factor α.

[0165] Using the normalization factor β of the product of node weights on path p k The weight product of path nodes is proportionally corrected, and the cosine similarity sim(F) of the fault mode feature vectors is used. i F j ) Calculate and comprehensively evaluate the target node v i To adjacent node v j The probability of fault propagation is determined. Through a dynamic parameter calibration mechanism, the probability of fault propagation path risks in complex network environments is accurately quantified, providing crucial decision-making support for intelligent early warning and proactive defense.

[0166] For example, after the second knowledge graph is deployed, the status of the target node is monitored in real time. When the real-time load of the target node (core router R1) rises to 95%, the propagation probability to the neighboring node (firewall FW2) is calculated using a probabilistic model. The topology path, R1-FW2 (single-hop path), is extracted, and the parameters are obtained: R1 weight 0.92, edge confidence 0.75, and path weight factor 0.6. Then, the feature similarity is calculated. The similarity between the overload feature of R1 and the historical failure mode of FW2 is 0.88, and the formula outputs a probability value of 0.86. The comparison probability threshold is 0.8, and the potential failure path "R1-FW2" is marked. Here, the potential failure path is a high-risk propagation link marked by the probabilistic model, which consists of the target node and its neighboring node sequence. The potential failure path includes the complete topology connection relationship and propagation probability parameters.

[0167] The probability threshold is the critical value that triggers an early warning, dynamically calibrated based on historical fault data. When the propagation probability exceeds the threshold, it indicates that the fault in the target node is highly likely to spread to adjacent devices. The probability threshold can be set to consider the importance level of the devices; for example, a more sensitive threshold, such as 0.7, is used for core business systems, while a threshold of 0.85 is used for non-critical devices.

[0168] If the probability of fault propagation is greater than or equal to a probability threshold, an alarm signal is also generated. This alarm signal serves as a risk indication of a potential fault path, including a list of affected devices and a propagation prediction. The signal format is standardized and integrated into the operations and maintenance platform. For example, the Kafka message stream includes path ID, probability value, and a list of device IPs, driving the visualization of the alarm dashboard.

[0169] A pre-processing instruction set is generated based on the alarm signal. The pre-processing instruction set includes a device port isolation policy and a redundant resource scheduling policy. The port isolation policy cuts off the propagation path by disabling high-risk ports, and the redundant resource scheduling policy diverts traffic by enabling backup links. The pre-processing instruction set is then executed and response data is collected. The response data is fed back to the reinforcement learning algorithm as incremental training samples so that the reinforcement learning algorithm iteratively updates the weight of the first node, the decay coefficient of the confidence of the first associated edge, and the priority.

[0170] Response data is the network status feedback after executing pre-handling instructions, including parameters such as port status, traffic metrics, and service recovery rate. This response data serves as incremental samples input to the reinforcement learning algorithm to verify the effectiveness of the handling and optimize model parameters. The reinforcement learning algorithm uses the response data as training samples to iteratively update node weight decay coefficients and topology path priorities. The reinforcement learning algorithm abstracts the network state into a Markov decision process, where the state space consists of node or edge parameters, the action space is the decay rate adjustment, and the reward function is designed based on the fault blocking success rate. It approximates the optimal operation and maintenance decision through policy gradient updates.

[0171] For example, streaming data processing technology can be used to obtain the operational status data of target nodes in the topology path in real time, such as device logs, traffic characteristics, and performance indicators. Then, through a pre-built fault propagation probability model in the knowledge graph, such as a time-series-based Markov chain model or a graph convolutional network prediction model, the fault propagation probability between the target node and its neighboring nodes can be calculated. When the calculated value exceeds a threshold dynamically calibrated based on historical fault data, such as a threshold dynamically adjusted by using the EWMA exponential weighted moving average method combined with the device importance coefficient, an alarm is triggered, and the node pair that triggered the alarm and its associated path are marked as potential fault paths.

[0172] By combining the propagation pattern rules in the knowledge graph with the causal reasoning engine, alarm signals are generated, including a list of affected business systems, key devices, and risk spread predictions. Based on the severity and scope of the alarm signals, a hierarchical pre-handling instruction set is generated. The instruction set includes device-level isolation policies, such as STP protocol port blocking and VLAN isolation, and resource-level scheduling policies, such as traffic redirection and backup link activation. These are then converted into executable device control instructions by the policy engine.

[0173] By synchronously executing the pre-processing instruction set through the orchestration engine and collecting response data such as network traffic changes, device load status, and service recovery indicators after processing in real time, these incremental data are used as training samples for reinforcement learning. The Deep Deterministic Policy Gradient (DDPG) algorithm is used to dynamically optimize the node weights in the knowledge graph, such as the contribution of device fault propagation and edge confidence, and the attenuation coefficient of fault propagation path reliability. At the same time, the Monte Carlo tree search algorithm is used to optimize the priority matching rules of the topology path, forming a continuous improvement closed loop of monitoring-early warning-processing-optimization, thereby enhancing the system's proactive defense capability against unknown fault modes.

[0174] In existing technologies, topology modeling and fault analysis are separated. This application integrates topology paths and fault propagation patterns through knowledge graphs to fully represent network architecture and fault logic, improving the accuracy of source tracing. It introduces GNNs and subgraph isomorphic matching algorithms to automate candidate set selection and path verification, improving troubleshooting efficiency and reducing manual intervention. Through incremental updates and reinforcement learning, the knowledge graph can dynamically adapt to network changes and new fault modes, shortening the response time to new fault modes. Subgraph isomorphic matching verifies multi-node fault links, effectively handling cross-device propagation of faults in complex networks and improving the accuracy of causal association identification. Based on a fault propagation probability model, it achieves potential fault early warning and pre-treatment, transforming passive troubleshooting into proactive defense and shortening fault handling time.

[0175] Based on the above knowledge graph-based IT operations and maintenance fault tracing method, such as Figure 3 As shown, some embodiments of this application also provide an IT operations and maintenance fault tracing device based on a knowledge graph, including:

[0176] The knowledge graph construction module 101 is used to acquire equipment data, including first historical fault records, equipment status data, and impact range data; and to model the equipment data through entity relationships to generate triples; and to construct a first knowledge graph based on the triples, the first knowledge graph including a topology path graph and a fault propagation pattern graph, the fault propagation pattern graph including multiple fault propagation patterns.

[0177] The candidate set generation module 102 is used to obtain the semantic similarity between the target node and the fault propagation mode based on the topology path graph, so as to generate a candidate set of fault root causes.

[0178] The source tracing scoring module 103 is used to calculate the source tracing score of the nodes in the candidate set of fault roots based on the first node weight and the first associated edge confidence of the first knowledge graph, so as to generate a fault root source sequence.

[0179] The fault verification module 104 is used to traverse the adjacent nodes of the target node of the fault root cause sequence on the topology path graph, verify the consistency relationship between the influence range data and the path in the first knowledge graph, so as to generate a verification result; and when the verification result is greater than or equal to a preset threshold, merge the target node and adjacent nodes of the fault root cause sequence to generate a fault node set.

[0180] In some embodiments, the apparatus further includes a feedback optimization module 105, configured to: update the first historical fault record based on the fault location result to generate a second historical fault record;

[0181] The feature vectors of the second historical fault records are extracted using a graph neural network model to generate a fault mode library.

[0182] Subgraph fusion is performed on the fault mode library and the fault propagation mode graph. The decay coefficient of the first node weight and the first associated edge confidence is calculated by the reinforcement learning algorithm to generate the second node weight and the second associated edge confidence.

[0183] A second knowledge graph is generated based on the weight of the second node and the confidence of the second associated edge.

[0184] The priority is adjusted using the second knowledge graph.

[0185] The content of this device embodiment can be found in the content provided in the above method embodiment, and will not be repeated here.

[0186] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the knowledge graph-based IT operations and maintenance fault tracing method described above.

[0187] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0188] Similar parts between the embodiments provided in this application can be referred to mutually. The specific implementation methods provided above are only a few examples under the overall concept of this application and do not constitute a limitation on the scope of protection of this application. For those skilled in the art, any other implementation methods extended from the solution of this application without creative effort shall fall within the scope of protection of this application.

Claims

1. A knowledge graph-based method for tracing IT operation and maintenance faults, characterized in that, include: Acquire device data, which includes first historical fault records, device status data, and impact range data; The device data is modeled using entity relationships to generate triples; Based on the triples, a first knowledge graph is constructed. The first knowledge graph includes a topology path graph and a fault propagation pattern graph. The fault propagation pattern graph includes multiple fault propagation patterns. Based on the topological path graph, the semantic similarity between the target node and the fault propagation pattern is obtained to generate a candidate set of fault root causes. Based on the first node weight and the first associated edge confidence of the first knowledge graph, the source tracing score of the nodes in the candidate set of fault root causes is calculated to generate a fault root cause sequence. Traverse the neighboring nodes of the target node of the fault root cause sequence on the topology path graph, verify the consistency relationship between the influence range data and the path in the first knowledge graph, and generate verification results; If the verification result is greater than or equal to a preset threshold, the target node and adjacent nodes of the fault root cause sequence are merged to generate a fault node set.

2. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 1, characterized in that, The construction of the first knowledge graph based on the triples includes: Based on the entity relationship of the triple, the physical connection relationship between network devices and connection ports is set, so as to establish a topology path graph based on the physical connection relationship; Based on the entity relationship of the triple and the first historical fault record, causal data between fault events is obtained, and a fault propagation pattern diagram is established based on the causal data. The fault propagation pattern diagram is used to characterize the fault propagation logic. Generate an initial knowledge graph, which includes multiple nodes and associated edges; In the initial knowledge graph, relational attributes are added to the nodes and associated edges to establish mapping relationships. These mapping relationships include the mapping relationship between topological paths and physical connections, and the mapping relationship between fault propagation patterns and causal data. The first knowledge graph is constructed using the mapping relationship.

3. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 1, characterized in that, The step of obtaining the semantic similarity between the target node and the fault propagation pattern based on the topology path graph includes: Based on the topology path in the topology path diagram, the target node is obtained, and the target node is the abnormal node corresponding to the target device in the topology path diagram. Using a graph neural network model, a first feature vector and a second feature vector are extracted. The first feature vector is the feature vector of the target node, and the second feature vector is the feature vector of the fault propagation mode. Calculate the cosine similarity between the first feature vector and the second feature vector; If the cosine similarity is greater than the similarity threshold, the target node is added to the candidate set of root causes of the fault.

4. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 1, characterized in that, The generation of the fault root cause sequence includes: The weight of the first node and the confidence of the first associated edge are weighted to obtain the source tracing score of the nodes in the candidate set of fault root causes; the weight of the first node includes the historical fault frequency of the device and / or the importance level of the device, and the confidence of the first associated edge includes the link reliability and / or the fault propagation probability. Based on preset sorting rules, the source tracing scores are sorted to generate a fault root cause sequence.

5. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 1, characterized in that, The generation of verification results includes: The topological structure of the affected area data is compared with the topological path of the standard fault propagation path in the first knowledge graph using a subgraph isomorphic matching algorithm. Calculate the topology path coverage to generate validation results.

6. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 4, characterized in that, The method further includes: Based on the set of faulty nodes, the priority of the topology path is obtained; The failure propagation probability is weighted by the priority to generate an execution order; Based on the execution order, a troubleshooting instruction is generated to instruct the target device to execute the troubleshooting instruction and generate the collection results; Compare the collected results with the preset threshold, and, in conjunction with the fault propagation mode, generate investigation and verification data; Based on the investigation and verification data, verify the consistency between the abnormal pattern and the historical fault path to generate fault location results.

7. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 6, characterized in that, After generating the fault location result, the method further includes: Based on the fault location results, update the first historical fault record to generate a second historical fault record; The feature vectors of the second historical fault records are extracted using a graph neural network model to generate a fault mode library. Subgraph fusion is performed on the fault mode library and the fault propagation mode graph. The decay coefficient of the first node weight and the first associated edge confidence is calculated by the reinforcement learning algorithm to generate the second node weight and the second associated edge confidence. A second knowledge graph is generated based on the weight of the second node and the confidence of the second associated edge. The priority is adjusted using the second knowledge graph.

8. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 7, characterized in that, The step of adjusting the priority through the second knowledge graph includes: Based on the second knowledge graph, the probability of fault propagation between the target node and its neighboring nodes is calculated using the probability model of the fault propagation mode. If the failure propagation probability is greater than or equal to the probability threshold, a potential failure path is marked, wherein the potential failure path is the path formed by the target node and its adjacent nodes; Generate alarm signals; A pre-processing instruction set is generated based on the alarm signal. The pre-processing instruction set includes a device port isolation strategy and a redundant resource scheduling strategy. The preprocessing instruction set is executed and response data is collected. The response data is fed back to the reinforcement learning algorithm as incremental training samples so as to iteratively update the first node weight, the decay coefficient of the first associated edge confidence, and the priority through the reinforcement learning algorithm.

9. The IT operation and maintenance fault tracing method based on knowledge graphs according to claim 8, characterized in that, The calculation of the failure propagation probability between the target node and its neighboring nodes using the probability model of the failure propagation mode includes: Based on the second knowledge graph, extract the set of topological paths from the target node to its neighboring nodes, and obtain the second node weight and the second associated edge confidence of the topological path; The decay coefficient, topology path weight factor, normalization factor, and cosine similarity between the first feature vector and the second feature vector are obtained to calculate the fault propagation probability between the target node and its neighboring nodes. The first feature vector is the feature vector of the target node, and the second feature vector is the feature vector of the fault propagation mode.

10. A knowledge graph-based IT operations and maintenance fault tracing device, characterized in that, include: The map construction module is used to acquire equipment data, which includes first historical fault records, equipment status data, and impact range data. And by modeling the device data through entity relationships, triples are generated; And based on the triples, a first knowledge graph is constructed, the first knowledge graph including a topology path graph and a fault propagation pattern graph, the fault propagation pattern graph including multiple fault propagation patterns; The candidate set generation module is used to obtain the semantic similarity between the target node and the fault propagation pattern based on the topology path graph, so as to generate a candidate set of fault root causes. The source tracing scoring module is used to calculate the source tracing score of the nodes in the candidate set of fault roots based on the first node weight and the first associated edge confidence of the first knowledge graph, so as to generate a fault root source sequence. The fault verification module is used to traverse the adjacent nodes of the target node of the fault root cause sequence on the topological path graph, verify the consistency relationship between the influence range data and the path in the first knowledge graph, and generate verification results. And if the verification result is greater than or equal to a preset threshold, the target node and adjacent nodes of the fault root cause sequence are merged to generate a fault node set.

Images