Automatic construction method and device for causal knowledge graph, equipment and medium

Abstract

The embodiment of the invention relates to the technical field of operation and maintenance, and discloses a causal knowledge graph automatic construction method, device, equipment and medium, the method comprises the following steps: obtaining time sequence data corresponding to a historical time period, the time sequence data comprising a scene identifier, the scene identifier being used for identifying a peak scene and an off-peak scene, and the time sequence data being time sequence data corresponding to different services; performing data feature classification on the time series data to obtain a data type corresponding to the time series data; performing causal mining on the time series data based on a causal mining algorithm corresponding to the data type to obtain at least one causal relationship, and obtaining at least one corresponding causal weight, the causal relationship being a causal relationship between different services; and constructing a causal knowledge graph based on the at least one causal relationship and each corresponding causal weight. Correlation analysis is replaced by time sequence driven causal inference, so that false correlation interference can be eliminated, and the accuracy of the determined causal relationship is improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of operation and maintenance, in particular to a method and device for automatically constructing a causal knowledge graph, and a medium. BACKGROUND

[0002] In the prior art, in the current operation and maintenance field, the construction of the causal relationship between services mainly relies on manual input or pre-set fixed rules. The manual input method highly depends on the subjective experience of operation and maintenance experts, which is not only inefficient, but also has limited coverage and uneven accuracy of the causal relationship due to individual cognitive differences. The fixed rule method usually infers the causal relationship based on simple correlation analysis (such as index correlation, event time sequence, etc.), which lacks effective identification and exclusion ability for confounding factors and pseudo-association, and is likely to misjudge the false correlation caused by common upstream disturbance or environmental noise as real causality. More importantly, existing methods generally ignore the dynamic characteristics of the operation and maintenance scene (such as business peak period, holiday, promotion activity, etc.), and do not model the dependency relationship under different loads or business modes, resulting in weak adaptability and high misjudgment rate of the constructed causal relationship in complex and variable actual running environment. Therefore, it can be seen that the existing technology has low efficiency in determining the causal relationship, low accuracy of the determined causal relationship, and weak adaptability of the determined causal relationship to the actual running environment. SUMMARY

[0003] The purpose of the present application is to at least provide a method and device for automatically constructing a causal knowledge graph, which can at least solve the technical problems of low efficiency in determining the causal relationship, low accuracy of the determined causal relationship, and weak adaptability of the determined causal relationship to the actual running environment in the prior art, and can at least achieve the technical effects of improving the efficiency of determining the causal relationship, improving the accuracy of the determined causal relationship, and improving the adaptability to the actual running environment.

[0004] To solve the above technical problems, at least one embodiment of the present application provides a method for automatically constructing a causal knowledge graph, comprising: obtaining time series data corresponding to a historical period, the time series data comprising a scene identifier, the scene identifier being used to identify a peak scene and a non-peak scene, and the time series data being time series data corresponding to different services; classifying data features of the time series data to obtain data types corresponding to the time series data; performing causal mining on the time series data based on a causal mining algorithm corresponding to the data types to obtain at least one causal relationship and at least one corresponding causal weight, the causal relationship being a causal relationship between different services; and constructing a causal knowledge graph based on the at least one causal relationship and the corresponding causal weights.

[0005] Firstly, the time series driven causal inference replaces the correlation analysis to exclude pseudo-correlation interference and improve the accuracy of determined causal relationship. Specifically, the time series data is classified by feature to identify its data type, and the inter-service causal relationship of the time series data is mined based on the causal mining algorithm adapted to the data type. The pseudo-correlation interference caused by confounding factors or indirect correlation is effectively excluded, and the accuracy of causal relationship determination is significantly improved. Secondly, by fusing scene information in the time series data, the determined causal relationship and causal weight are matched with the actual running environment, improving the adaptability of the causal relationship and causal weight to the actual running environment. Specifically, by fusing scene identification information, the causal relationship under different running environments is explicitly distinguished in causal modeling, so that the mined causal relationship and causal weight are more consistent with the actual running environment, and the scene adaptability of the causal relationship and causal weight is enhanced. In addition, the entire construction process of the causal knowledge graph is automatically completed based on data driving, without relying on manual experience input or fixed rule configuration, which greatly reduces the operation and maintenance cost, improves the causal relationship determination efficiency, and also improves the reliability and automation level of the intelligent operation and maintenance system in the scenes of root cause positioning, fault prediction and impact analysis.

[0006] In some examples, the data feature classification of the time series data to obtain the data type corresponding to the time series data comprises: dividing data with periodic regularity in the time series data into periodic data, the periodic data corresponding to a periodic type; taking data other than the periodic data in the time series data as intermediate time series data; obtaining statistical features of the intermediate time series data; dividing the intermediate time series data with a deviation of the statistical features from preset statistical features less than a preset deviation as stationary data, the stationary data corresponding to a stationary type; taking data other than the stationary data in the intermediate time series data as burst data, the burst data corresponding to a burst type.

[0007] In some examples, the causal mining algorithm based on the data type is used to perform causal mining on the time-series data to obtain at least one causal relationship. This includes: dividing the periodic data into scenarios to obtain peak scenario data and off-peak scenario data, wherein the periodic data includes time-series data corresponding to multiple services; for each of the multiple services, taking the service as the target cause service and taking any service other than the target cause service as the target effect service in turn; performing causal mining on the peak scenario data and the off-peak scenario data respectively based on the causal forest algorithm corresponding to the periodic type; taking the data corresponding to the target cause service as the processing variable, taking the data corresponding to the target effect service as the result variable, and taking the data corresponding to other services as covariates; obtaining a first causal probability between the target cause service and the target effect service in the peak scenario; and obtaining a second causal probability between the target cause service and the target effect service in the off-peak scenario; and determining the causal relationship between the target cause service and the target effect service based on the first causal probability and the second causal probability, wherein the target cause service is any service among the multiple services.

[0008] In some examples, the causal mining algorithm based on the data type is used to perform causal mining on the time series data to obtain at least one causal relationship. This includes: using the PC algorithm corresponding to the stationary type to perform causal mining on the stationary data, connecting the services in the stationary data to each other to obtain a complete graph, where the edges of the complete graph represent a direct causal relationship between two services; verifying two services that do not have a direct causal relationship based on conditional independence testing, and deleting the edges between the two services that do not have a direct causal relationship in the complete graph to obtain at least one causal relationship.

[0009] In some examples, the causal mining algorithm based on the data type is used to perform causal mining on the time-series data to obtain at least one causal relationship, including: using a dynamic causal graph algorithm corresponding to the burst type to perform causal mining on the burst data, segmenting the burst data based on a preset window length, and using time-series causal assumptions to perform causal analysis on burst data in different time periods to obtain at least one causal relationship.

[0010] In some examples, obtaining at least one corresponding causal weight includes: for each causal relationship, obtaining historical causal data related to the causal relationship from the time-series data, the historical causal data including the causal relationship, the scene identifier, and feedback information of fault solutions located based on the causal relationship; counting the number of successful fault solutions in the feedback information and the total number of fault solutions; obtaining the corresponding scene weight based on the current scene identifier; calculating the ratio of the number of successful solutions to the total number of fault solutions, and using the product of the ratio and the scene weight as the causal weight of the causal relationship.

[0011] In some examples, the method further includes updating the causal knowledge graph based on the service change event and the fault location feedback information when a service change event or fault location feedback information is detected.

[0012] At least one embodiment of this application also provides an automatic causal knowledge graph construction device, comprising: an acquisition unit, configured to acquire time-series data corresponding to historical time periods, the time-series data including scene identifiers, the scene identifiers being used to identify peak scenes and off-peak scenes, the time-series data being time-series data corresponding to different services; a classification unit, configured to classify the time-series data by data features to obtain the data type corresponding to the time-series data; the acquisition unit is further configured to perform causal mining on the time-series data based on the causal mining algorithm corresponding to the data type, to obtain at least one causal relationship, and to acquire at least one corresponding causal weight, the causal relationship being a causal relationship between different services; and a construction unit, configured to construct a causal knowledge graph based on at least one of the causal relationships and the corresponding causal weights.

[0013] At least one embodiment of this application also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the above-described automatic causal knowledge graph construction method.

[0014] At least one embodiment of this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for automatically constructing a causal knowledge graph. Attached Figure Description

[0015] One or more embodiments are illustrated by way of example with reference to the accompanying drawings, and these illustrative descriptions do not constitute a limitation on the embodiments.

[0016] Figure 1This is a flowchart of an embodiment of the causal knowledge graph automatic construction method provided in this application; Figure 2 This is a schematic diagram of an automatic causal knowledge graph construction device provided in another embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the various embodiments of this application to help readers better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0018] It should be noted that the acquisition or use of data in the embodiments of this application requires the user's consent. The relevant data can only be obtained after the user's authorization, and the acquisition or use of the data complies with the provisions of relevant laws and regulations.

[0019] To facilitate understanding of the embodiments of this application, the relevant content of the automatic construction method of causal knowledge graph is introduced first.

[0020] In current operational and maintenance (O&M) technologies, the construction of causal relationships between services primarily relies on manual input or pre-defined fixed rules. Manual input is highly dependent on the subjective experience of O&M experts, resulting in low efficiency and inconsistent accuracy due to individual cognitive differences. Fixed rule methods, on the other hand, typically infer causal relationships based on simple correlation analysis (such as indicator correlation, event chronological order), lacking the ability to effectively identify and eliminate confounding factors and spurious correlations, easily misjudging false correlations caused by common upstream disturbances or environmental noise as genuine causality. More critically, existing methods generally ignore the dynamic characteristics of O&M scenarios (such as peak business periods, holidays, and promotional activities), failing to differentiate dependency models for different loads or business models. This leads to weak adaptability and a high misjudgment rate in the complex and ever-changing real-world operating environment. Therefore, it is evident that existing technologies suffer from low efficiency in determining causal relationships, low accuracy in the determined causal relationships, and weak adaptability to the actual operating environment.

[0021] To address the aforementioned existing technical problems, this invention proposes an automatic causal knowledge graph construction method. The implementation details of the automatic causal knowledge graph construction method in this embodiment are described below. The following content is only for ease of understanding and is not necessary for implementing this solution.

[0022] Example 1: The automatic causal knowledge graph construction method of this embodiment can be applied to electronic devices with communication, computing, and data storage capabilities. Its specific process can be as follows: Figure 1 As shown, it includes: Step 110: Obtain the time-series data corresponding to the historical time period. The time-series data includes scene identifiers, which are used to identify peak and off-peak scenes. The time-series data is the time-series data corresponding to different services.

[0023] Historical time periods refer to periods ending at the current time or ending at a time prior to the current time. Time-series data includes metric data, log data, historical causal data, and scenario identifiers. Metric data includes server resource data and microservice service performance data. Resource data includes at least CPU utilization, memory usage, and disk I / O. Service performance data includes at least QPS, response latency, and call success rate. Server resource data and microservice service performance data can be collected using Prometheus or Grafana at a preset collection frequency. The preset collection frequency can be set according to actual needs, for example, data can be collected once every 1 second. Log data refers to service error logs collected from ELK (Elasticsearch, Logstash, and Kibana), composed of extracted event types, occurrence events, and associated entities. For example, associated entities can be service names and node IPs. Event types refer to the essential classification of anomalies recorded in the service error logs. Event types are used to identify the fault category to which the service error log belongs; for example, event types can be database connection timeout, null pointer exception, etc. In addition, the event type is also used to identify the operation type or system behavior pattern to which the service error log belongs. The specific content identified by the event type can be set according to actual needs. In this solution, the event type is used to identify the fault category to which the service error log belongs as an example.

[0024] Historical causal data refers to alarm events and causal-related data collected from AlertManager or Zabbix. Alarm events include alarm level (info / warn / critical), trigger time, and related metrics (such as CPU utilization >95%). Causal-related data includes causal relationships, scenario identifiers, and feedback information on fault solutions located based on causal relationships.

[0025] Scene identifiers can also be used to identify holidays and workdays, including national statutory holidays and company-defined holidays. Furthermore, scene identifiers can also identify the day before or after a holiday, as well as the day before or after a non-holiday. For example, a scene identifier can be represented by a 3-bit binary string; for instance, a scene identifier of 110 indicates that the historical period falls within a peak scene, a holiday, or the day before or after a non-holiday. A scene identifier of 001 indicates that the historical period falls within a non-peak scene, not a holiday, but the day before or after a holiday. Peak scenes refer to peak business hours; for example, for e-commerce, the peak business hours are from midnight to 2 AM on Singles' Day (November 11th), and for the financial sector, the peak business hours are from 10 AM to 12 PM on payday.

[0026] Step 120: Classify the time series data by data features to obtain the data type corresponding to the time series data.

[0027] Data feature classification refers to categorizing time-series data into three types based on their characteristics: periodic data, stable data, and burst data. Periodic data exhibits periodicity, with a fixed time cycle. For example, user traffic peaks between 9 AM and 6 PM on weekdays and between 10 AM and 10 PM on weekends. Stable data lacks obvious periodicity and trends. For example, under normal off-peak conditions, server memory usage fluctuates by less than 5%. Burst data lacks periodicity but exhibits burst characteristics, meaning it shows a clear trend. For example, a sudden surge in traffic due to promotional activities.

[0028] Specifically, in step 120 above, the time series data is classified according to its data features to obtain the corresponding data types, including: classifying the time series data with periodic patterns into periodic data, which corresponds to the periodic type; classifying the time series data other than periodic data as intermediate time series data; obtaining the statistical features of the intermediate time series data; classifying the intermediate time series data whose statistical features deviate from the preset statistical features by less than the preset deviation into stationary data, which corresponds to the stationary type; and classifying the intermediate time series data other than stationary data into burst data, which corresponds to the burst type.

[0029] Furthermore, the time series data contains data for multiple indicators, each with its own set of data. For each indicator in the time series data, the autocorrelation coefficient (ACF) and linear regression slope of the multiple indicator data are calculated. If the ACF is greater than a preset first coefficient, the multiple indicator data corresponding to the indicator are determined to be periodic data. If the linear regression slope is greater than a second coefficient, the multiple indicator data corresponding to the indicator are determined to be bursty data. If the ACF is not greater than the preset first coefficient and the linear regression slope is not greater than the second coefficient, the multiple indicator data corresponding to the indicator are determined to be stationary data.

[0030] Here, "indicator" refers to the name of the data, or indicator name, representing the data dimension. Indicator data refers to the specific sampled value corresponding to that indicator collected at a specific time, i.e., the data itself. The first and second coefficients can be set according to actual needs; for example, the first coefficient can be 0.6 and the second coefficient can be 0.1.

[0031] In some examples, the method further includes data preprocessing of the time series data before performing data feature classification, using the preprocessed data as new time series data for data feature classification. Data preprocessing includes data cleaning, time series alignment, and feature extraction.

[0032] Specifically, data cleaning of time series data includes: using the 3σ principle to remove instantaneous outliers from time series data; and using forward filling and linear interpolation to fill missing values ​​in time series data.

[0033] The 3σ principle states that data points exceeding the mean ± 3 standard deviations (3σ) are considered extremely low-probability events, likely noise or acquisition errors, and are therefore deleted. For example, if a server's CPU momentarily reaches 100% and then immediately recovers to 50%, the momentary 100% is considered erroneous data and is therefore deleted. Forward imputation uses the most recent valid historical observation to fill in current and subsequent missing values ​​until the next valid observation is encountered. Linear interpolation imputation uses a straight line constructed from consecutive valid data points to estimate intermediate missing values, and then uses these estimated intermediate missing values ​​to fill missing values ​​in time series data. For example, missing data at time point t is filled using the mean of the data at time t-1 and time point t+1.

[0034] Specifically, time-series data alignment includes: aligning the timestamps of time-series data to the second level to ensure that all data in the time-series data are from the same time period.

[0035] Specifically, feature extraction from time-series data includes: extracting statistical features from the time-series data, and concatenating these statistical features with scene identifiers to obtain new time-series data. These statistical features include standard deviation, mean, and variance. Statistical features can be used to capture data trends and fluctuations.

[0036] In addition, the time-series data after data preprocessing can be stored in a time-series database.

[0037] Step 130: Perform causal mining on time series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship and obtain at least one corresponding causal weight. The causal relationship is the causal relationship between different services.

[0038] Among them, causal weights are used to determine the probability of a causal relationship between two services.

[0039] In an optional embodiment, step 130 above involves performing causal mining on time-series data based on a causal mining algorithm corresponding to the data type to obtain at least one causal relationship. This includes: dividing periodic data into scenarios to obtain peak scenario data and non-peak scenario data, where the periodic data includes time-series data corresponding to multiple services; for each service among the multiple services, using the service as the target cause service and taking turns using any service other than the target cause service as the target effect service; performing causal mining on the peak scenario data and non-peak scenario data based on a causal forest algorithm corresponding to the periodic type; using the data corresponding to the target cause service as processing variables, the data corresponding to the target effect service as result variables, and the data corresponding to other services as covariates to obtain a first causal probability between the target cause service and the target effect service in a peak scenario; and obtaining a second causal probability between the target cause service and the target effect service in a non-peak scenario; and determining the causal relationship between the target cause service and the target effect service based on the first and second causal probabilities, wherein the target cause service is any service among the multiple services.

[0040] In this context, a service refers to an independently deployed microservice unit with a clearly defined business function. A target cause service is an indicator assumed to be the "cause" in causal analysis. A target effect service is an indicator assumed to be influenced by the target cause service in causal analysis. The first causal probability refers to the probability that a causal relationship exists between the target cause service and the target effect service under peak conditions. The second causal probability refers to the probability that a causal relationship exists between the target cause service and the target effect service under off-peak conditions.

[0041] Specifically, the causal relationship between the target cause service and the target effect service is determined based on the first causal probability and the second causal probability, including: obtaining the preset peak scene weight and the preset off-peak scene weight; obtaining the first product of the preset peak scene weight and the first causal probability; obtaining the second product of the preset off-peak scene weight and the second causal probability; adding the first product and the second product to obtain the total causal probability; if the total causal probability is greater than the causal probability threshold, it is considered that there is a causal relationship between the target cause service and the target effect service; otherwise, it is considered that there is no causal relationship between the target cause service and the target effect service.

[0042] Both the preset peak-hour and preset off-peak-hour weights can be set according to actual needs, and the sum of the preset peak-hour and preset off-peak-hour weights is 1. During peak business periods, service loads are high and resource competition is intense, making it easier for dependencies between microservices to be exposed and trigger cascading failures. Therefore, assigning higher weights to peak-hour scenarios allows for more sensitive capture of true causal dependencies on critical paths in comprehensive causal probability calculations. Thus, a larger preset peak-hour weight can be set to prioritize the impact of causal relationships on system stability during peak periods.

[0043] Therefore, by introducing preset peak and off-peak scenario weights, the first and second causal probabilities are weighted and fused to obtain a total causal probability that comprehensively reflects the causal strength under different business loads. This allows for a more accurate and flexible characterization of the dynamic characteristics of service dependencies. This method not only considers the significance of causal effects in absolute strength but also incorporates prior knowledge of business operations that have a greater impact on system stability during peak periods (e.g., assigning higher weights to peak scenarios), thereby effectively improving the accuracy and practicality of causal relationship determination. Compared to single-scenario analysis or simple averaging strategies, this solution significantly reduces the false positive rate, ensuring rapid location of the root cause of failures during high-load critical periods while avoiding noise interference during off-peak periods. This provides a highly reliable causal decision-making basis for intelligent alarms, capacity planning, and adaptive circuit breaking.

[0044] Specifically, determining the causal relationship between the target cause service and the target effect service based on the first causal probability and the second causal probability includes: if the absolute value of the difference between the first causal probability and the second causal probability is greater than the first causal probability threshold, or if the first causal probability is greater than the second causal probability threshold, then the target cause service and the target effect service are considered to have a causal relationship.

[0045] Therefore, by leveraging the differences in causal relationships across different scenarios and the dual judgment logic of strong causal correlation in peak scenarios, dynamic causal relationships sensitive to business scenarios can be accurately identified, providing high-quality input for intelligent alarms, capacity planning, and root cause localization.

[0046] In the second optional embodiment, in step 130 above, causal mining is performed on time-series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship. This includes: using the PC algorithm corresponding to the stationary type to perform causal mining on stationary data, connecting the services in the stationary data to each other to obtain a complete graph, where the edges of the complete graph represent a direct causal relationship between two services; verifying two services that do not have a direct causal relationship based on conditional independence testing, and deleting the edges between the two services that do not have a direct causal relationship in the complete graph to obtain at least one causal relationship.

[0047] Among them, the PC algorithm is a classic constraint-based causal discovery method used to learn the causal graph structure (usually a directed acyclic graph DAG or its equivalent class CPDAG) between variables from observed data.

[0048] For example, the system includes four microservices: A: user-service, B: order-service, C: payment-service, and D: inventory-service. Based on these four microservices, a complete graph is constructed, consisting of six edges: A—B, A—C, A—D, B—C, B—D, and C—D. Each edge is checked to see if it can be independent by a certain condition. For example, if no condition Z is found that makes A and B independent, then A—B is considered to have a direct causal relationship and is retained; otherwise, A—B is deleted.

[0049] In optional embodiment three, in the aforementioned step 130, causal mining is performed on time-series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship, including: performing causal mining on burst data using the dynamic causal graph algorithm corresponding to the burst type, segmenting burst data based on a preset window length, and performing causal analysis on burst data in different time periods using the time-series causal hypothesis to obtain at least one causal relationship.

[0050] Among them, the dynamic causal graph algorithm refers to a causal discovery method that can update the causal structure over time.

[0051] For example, suppose the burst duration is 10 minutes and the preset window length is 2 minutes; then the data is divided into 5 consecutive time periods. For each consecutive time period, a dynamic cause-effect graph algorithm is used to determine the causal relationships between services within that time period, thereby obtaining multiple intermediate causal relationships for each consecutive time period. Intermediate causal relationships that exist continuously within a preset number of time periods are considered causal relationships. The preset number of time periods can be set according to actual needs, for example, it can be 3. For example, if A and B have intermediate causal relationships in 3 consecutive time periods out of the 5 consecutive time periods, then A and B are considered to have a causal relationship.

[0052] Therefore, based on the adaptive selection of causal mining algorithms according to the data characteristics of time-series data, the precise matching of data features and algorithms is achieved, ensuring the accuracy of causal mining for time-series data of different types. For stationary data, a low-complexity PC algorithm is adopted, which effectively improves computational efficiency while ensuring the reliability of causal structure discovery, thereby improving the accuracy and efficiency of causal relationship determination. For bursty data, a dynamic causal graph algorithm is introduced, combined with a sliding window, which can capture the rapid evolution of causal propagation paths in real time, enhancing the sensitivity and positioning accuracy of instantaneous causality, and improving the accuracy of causal relationship determination. For periodic data, the powerful nonlinear modeling and heterogeneity handling capabilities of the causal forest algorithm are utilized to effectively identify conditional causal dependencies between services under different load periods (such as peak and off-peak), improving the accuracy of causal relationship determination. This adaptive mechanism not only avoids misjudgment or performance waste caused by a one-size-fits-all algorithm application, but also fully integrates the dynamic characteristics of operation and maintenance scenarios, providing solid support for building a high-precision and highly robust causal knowledge graph, and significantly improving the root cause analysis and decision-making capabilities of intelligent operation and maintenance systems in complex business environments.

[0053] Specifically, in step 130 above, obtaining at least one corresponding causal weight includes: for each causal relationship, obtaining historical causal data related to the causal relationship from time-series data, the historical causal data including the causal relationship, scene identifier, and feedback information of fault solutions located based on the causal relationship; counting the number of successful fault solutions in the feedback information and the total number of fault solutions; obtaining the corresponding scene weight based on the current scene identifier; calculating the ratio of the number of successful solutions to the total number of fault solutions, and using the product of the ratio and the scene weight as the causal weight of the causal relationship.

[0054] The current scene identifier refers to the scene at the current moment, that is, the scene to which the scene identifier of the data corresponding to the causal relationship collected at the current moment belongs. The scene weight can be set according to actual needs. For example, the scene weight corresponding to off-peak scenes can be set to 1, and the scene weight corresponding to peak scenes can be set to 1.1.

[0055] For example, the causal relationship between QPS greater than 5k and latency greater than 500ms has been successfully verified in 95 out of 100 historical fault resolutions, and the current time is during the peak period. Therefore, the causal weight of the causal relationship between QPS greater than 5k and latency greater than 500ms is (95 / 100) × 1.1.

[0056] Step 140: Construct a causal knowledge graph based on at least one causal relationship and the corresponding causal weights.

[0057] In this causal knowledge graph, the nodes are services (i.e., operational entities). Node information (i.e., information related to the service represented by the node) includes service type, service name, and service status. Edges represent causal relationships between services, and edge information includes causal weight, causal weight update time, and may also include causal direction. A graph database (such as Neo4j) can be used to store the causal knowledge graph. For example, the causal knowledge graph can be represented as follows: the edge between node 1 "Service A" (service type: microservice, service name: order-service, service status: running) and node 2 "Database C" (service type: database, service name: 192.168.1.100, service status: running) is "A sudden increase in requests to Service A caused Database C's connection pool to exhaust itself" (causal weight: 0.95, update time: 2024-05-20 10:05:00).

[0058] In some examples, the method also includes updating the causal knowledge graph based on the service change event and the fault location feedback information when a service change event or fault location feedback information is detected.

[0059] Service change events include operational events such as service launch, service decommissioning, and service topology changes. Fault location feedback information refers to the feedback information on whether the fault has been resolved after a fault has been located based on causal relationships and a fault solution has been provided.

[0060] Specifically, when a service goes online or the service topology changes, real-time time-series data is collected immediately. This data includes scene identifiers, which distinguish between peak and off-peak scenarios. The time-series data corresponds to different services. The real-time time-series data is then classified by data features to obtain the corresponding data types. Causal mining algorithms based on the data types are used to mine the real-time time-series data to obtain at least one causal relationship and acquire at least one corresponding causal weight. These causal relationships are between different services. The causal knowledge graph is updated based on at least one causal relationship and its corresponding causal weights.

[0061] For a detailed explanation of how to obtain causal relationships and causal weights based on real-time time series data, please refer to the aforementioned content on obtaining causal relationships and causal weights based on time series data, which will not be elaborated on here.

[0062] Specifically, when a service goes offline, the edges corresponding to the causal relationships associated with the service are removed from the causal knowledge graph.

[0063] Specifically, if the fault location feedback information is based on the fault solution failing to resolve the fault location, then the causal weights of the same causal relationships in the causal knowledge graph as those in the fault location feedback information are lowered according to a preset lowering coefficient. If the fault location feedback information is based on the fault solution resolving the fault location, then the causal weights of the same causal relationships in the causal knowledge graph as those in the fault location feedback information are increased according to a preset uppering coefficient.

[0064] The preset adjustment coefficient and the preset adjustment coefficient can be the same or different. To avoid the preset adjustment coefficient and the preset adjustment coefficient being too large or too small, the maximum value of the preset adjustment coefficient and the minimum value of the preset adjustment coefficient can be set to 1 and 0.1.

[0065] For example, if the fault location feedback information indicates that the fault has been located based on the fault solution, then the fault location is determined to be successful (i.e., the causal chain is verified to be valid). In this case, the causal weight of the corresponding causal relationship should be increased. For example, the increased causal weight can be the sum of the current weight and 0.05. If the fault location feedback information indicates that the fault has not been located based on the fault solution, then the fault location is determined to be unsuccessful (i.e., the causal relationship is verified to be invalid). In this case, the causal weight of the corresponding causal relationship should be decreased. For example, the decreased causal weight can be the difference between the current weight and 0.1. At the same time, causal mining is triggered again to check for the existence of spurious associations in the causal relationship.

[0066] In some examples, the method further includes: retrieving time-series data corresponding to historical time periods according to a preset cycle; the time-series data includes scene identifiers, which are used to identify peak and off-peak scenes, and the time-series data corresponds to different services; classifying the time-series data by data features to obtain the data type corresponding to the time-series data; performing causal mining on the time-series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship and obtain at least one corresponding causal weight, the causal relationship being the causal relationship between different services; and updating the causal knowledge graph based on at least one causal relationship and the corresponding causal weights.

[0067] The preset period can be set according to actual needs, such as 5 minutes, 10 minutes, or a longer or shorter duration. If the preset period is 5 minutes, the causal knowledge graph will be updated every 5 minutes.

[0068] Specifically, updating the causal knowledge graph based on at least one causal relationship and its corresponding causal weights includes: for each causal relationship, if the causal relationship does not exist in the causal knowledge graph, then adding edges and / or nodes representing the causal relationship in the causal knowledge graph, and using the causal weights corresponding to the causal relationship as edge information. If the causal relationship exists in the causal knowledge graph, but the difference between the causal weight corresponding to the causal relationship and the causal weight corresponding to the causal relationship in the causal knowledge graph is greater than 10% of the ratio of that causal weight in the causal knowledge graph, then updating that causal weight in the causal knowledge graph based on the causal weight.

[0069] Furthermore, if a historical causal relationship exists in the causal knowledge graph that has not been updated for a preset number of consecutive times or a preset duration, that historical causal relationship will be deleted from the causal knowledge graph. The preset number of times and the preset duration can be set according to actual needs. For example, the preset number of times can be 7, 8, or 10 times, and the preset duration can be 7 hours, 7 days, or 7 weeks.

[0070] Therefore, by employing a dual update mechanism—regularly updating the causal knowledge graph and updating it based on event triggers—real-time, fully automated updates of the graph are achieved, significantly improving its real-time performance and environmental adaptability. Furthermore, fault location feedback information is introduced as an optimization signal, feeding back the accuracy of root cause determination in actual operation and maintenance into the causal knowledge graph update process, dynamically correcting causal relationships. This forms a closed-loop processing mechanism of "causal knowledge graph construction - application feedback (fault location feedback information) - update," which not only enhances the accuracy and reliability of the causal knowledge graph but also enables the system to continuously learn and update causal relationships.

[0071] In summary, this solution proposes acquiring time-series data corresponding to historical time periods. This time-series data includes scene identifiers, used to distinguish between peak and off-peak scenarios, and time-series data corresponding to different services. Data feature classification is performed on the time-series data to obtain its corresponding data type. Causal mining algorithms based on the data type are used to perform causal mining on the time-series data, obtaining at least one causal relationship and acquiring at least one corresponding causal weight. These causal relationships represent causal relationships between different services. A causal knowledge graph is constructed based on at least one causal relationship and its corresponding causal weights. First, time-series-driven causal inference replaces association analysis, eliminating false association interference and improving the accuracy of determined causal relationships. Specifically, time-series data is feature-classified to identify its data type, and causal mining algorithms adapted to the data type are used to specifically mine inter-service causal relationships. This effectively eliminates false association interference caused by confounding factors or indirect associations, significantly improving the accuracy of causal relationship determination. Second, by integrating scene information into the time-series data, the determined causal relationships and causal weights are matched with the actual operating environment, improving the adaptability of causal relationships and causal weights to the actual operating environment. Specifically, by integrating scenario identification information, causal relationships in different operating environments are explicitly distinguished during causal modeling. This makes the mined causal relationships and weights more closely aligned with actual operating environments, enhancing their scenario adaptability. Furthermore, the entire causal knowledge graph construction process is automatically completed based on data-driven principles, eliminating the need for manual experience-based input or fixed rule configuration. This significantly reduces operational costs, improves the efficiency of causal relationship determination, and enhances the reliability and automation level of the intelligent operation and maintenance system in scenarios such as root cause localization, fault prediction, and impact analysis.

[0072] Example 2: Another embodiment of this application relates to an automatic causal knowledge graph construction device. The implementation details of this embodiment are described below. The following content is for ease of understanding and is not essential for implementing this solution. A schematic diagram of the automatic causal knowledge graph construction device 20 in this embodiment can be seen as follows: Figure 2 As shown, it includes an acquisition unit 201, a classification unit 202, and a construction unit 203.

[0073] The acquisition unit 201 is used to acquire time-series data corresponding to historical time periods. The time-series data includes scene identifiers, which are used to identify peak scenes and off-peak scenes. The time-series data is time-series data corresponding to different services.

[0074] The classification unit 202 is used to classify the time series data by data features to obtain the data type corresponding to the time series data.

[0075] The acquisition unit 201 is further configured to perform causal mining on the time series data based on the causal mining algorithm corresponding to the data type, obtain at least one causal relationship, and obtain at least one corresponding causal weight, wherein the causal relationship is a causal relationship between different services.

[0076] Construction unit 203 is used to construct a causal knowledge graph based on at least one of the causal relationships and the corresponding causal weights.

[0077] In some examples, when classifying the time-series data to obtain the corresponding data type, the classification unit 202 is specifically used to: classify the data with periodic patterns in the time-series data into periodic data, the periodic data corresponding to a periodic type; classify the data in the time-series data other than the periodic data as intermediate time-series data; obtain the statistical features of the intermediate time-series data; classify the intermediate time-series data whose deviation from the statistical features is less than a preset deviation into stationary data, the stationary data corresponding to a stationary type; and classify the data in the intermediate time-series data other than the stationary data into burst data, the burst data corresponding to a burst type.

[0078] In some examples, when the acquisition unit 201 is used to perform causal mining on the time-series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship, it is specifically used to: divide the periodic data into scenarios to obtain peak scenario data and off-peak scenario data, wherein the periodic data includes time-series data corresponding to multiple services; for each of the multiple services, take the service as the target cause service, and take any service other than the target cause service as the target effect service in turn; perform causal mining on the peak scenario data and the off-peak scenario data respectively based on the causal forest algorithm corresponding to the periodic type; take the data corresponding to the target cause service as the processing variable, take the data corresponding to the target effect service as the result variable, and take the data corresponding to other services as covariates to obtain a first causal probability between the target cause service and the target effect service in the peak scenario; and obtain a second causal probability between the target cause service and the target effect service in the off-peak scenario; determine the causal relationship between the target cause service and the target effect service based on the first causal probability and the second causal probability, wherein the target cause service is any service among the multiple services.

[0079] In some examples, when the acquisition unit 201 is used to perform causal mining on the time series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship, it is specifically used to: use the PC algorithm corresponding to the stationary type to perform causal mining on the stationary data, connect the services in the stationary data to each other to obtain a complete graph, the edges of the complete graph representing a direct causal relationship between two services; verify two services that do not have a direct causal relationship based on conditional independence testing, and delete the edges between the two services that do not have a direct causal relationship in the complete graph to obtain at least one causal relationship.

[0080] In some examples, when the acquisition unit 201 is used to perform causal mining on the time-series data based on the causal mining algorithm corresponding to the data type to obtain at least one causal relationship, it is specifically used to: perform causal mining on the burst data using the dynamic causal graph algorithm corresponding to the burst type, segment the burst data based on a preset window length, and perform causal analysis on the burst data in different time periods using the time-series causal hypothesis to obtain at least one causal relationship.

[0081] In some examples, when acquiring at least one corresponding causal weight, the acquisition unit 201 is specifically used to: for each causal relationship, acquire historical causal data related to the causal relationship from the time-series data, the historical causal data including the causal relationship, the scene identifier, and feedback information of fault solutions located based on the causal relationship; count the number of successful fault solutions in the feedback information and the total number of fault solutions; acquire the corresponding scene weight based on the current scene identifier; calculate the ratio of the number of successful solutions to the total number of fault solutions, and use the product of the ratio and the scene weight as the causal weight of the causal relationship.

[0082] In some examples, the construction unit 203 is also used to update the causal knowledge graph based on the service change event and the fault location feedback information when a service change event or fault location feedback information is detected.

[0083] It is worth mentioning that all units involved in this embodiment are logical units. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovative aspects of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed in this application; however, this does not mean that other units are absent in this embodiment.

[0084] Example 3: Another embodiment of this application relates to an electronic device, such as... Figure 3As shown, it includes: at least one processor 901; and a memory 902 communicatively connected to the at least one processor 901; wherein the memory 902 stores instructions executable by the at least one processor 901, the instructions being executed by the at least one processor 901 to enable the at least one processor 901 to execute the causal knowledge graph automatic construction method in the above embodiments.

[0085] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0086] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0087] Example 4: Another embodiment of this application relates to a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the method embodiments described above.

[0088] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0089] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. A method for automatically constructing a causal knowledge graph, characterized in that, include: Obtain time-series data corresponding to historical time periods. The time-series data includes scene identifiers, which are used to identify peak and off-peak scenarios. The time-series data is time-series data corresponding to different services. The time-series data is classified by data features to obtain the data type corresponding to the time-series data; Based on the causal mining algorithm corresponding to the data type, causal mining is performed on the time series data to obtain at least one causal relationship and obtain at least one corresponding causal weight. The causal relationship is a causal relationship between different services. A causal knowledge graph is constructed based on at least one of the causal relationships and the corresponding causal weights.

2. The method for automatically constructing a causal knowledge graph according to claim 1, characterized in that, The step of classifying the time-series data by data features to obtain the data type corresponding to the time-series data includes: Data exhibiting periodic patterns within the time series data are categorized into periodic data, with each periodic data corresponding to a period type. The data in the time series data other than the periodic data are used as intermediate time series data; Obtain the statistical characteristics of the intermediate time series data; Intermediate time series data whose deviation from the statistical characteristics is less than the preset deviation are classified as stationary data, and the stationary data corresponds to the stationary type. The data in the intermediate time series data other than the stationary data are regarded as burst data, and the burst data corresponds to the burst type.

3. The method for automatically constructing a causal knowledge graph according to claim 2, characterized in that, The causal mining algorithm based on the data type performs causal mining on the time series data to obtain at least one causal relationship, including: The periodic data is divided into scenarios to obtain peak scenario data and off-peak scenario data. The periodic data includes time-series data corresponding to multiple services. For each of the multiple services, the service is designated as the target cause service, and any service other than the target cause service is taken as the target effect service in turn. Based on the causal forest algorithm corresponding to the period type, causal mining is performed on the peak scenario data and the off-peak scenario data respectively. The data corresponding to the target cause service is used as the processing variable, the data corresponding to the target effect service is used as the result variable, and the data corresponding to other services is used as the covariate. The first causal probability between the target cause service and the target effect service is obtained in the peak scenario; and the second causal probability between the target cause service and the target effect service is obtained in the off-peak scenario. The causal relationship between the target cause service and the target effect service is determined based on the first causal probability and the second causal probability, wherein the target cause service is any one of the plurality of services.

4. The method for automatically constructing a causal knowledge graph according to claim 2, characterized in that, The causal mining algorithm based on the data type performs causal mining on the time series data to obtain at least one causal relationship, including: Using the PC algorithm corresponding to the stationary type, causal mining is performed on the stationary data, and the services in the stationary data are interconnected to obtain a complete graph. The edges of the complete graph represent the direct causal relationship between two services. Based on conditional independence testing, verify that there is no direct causal relationship between two services, and delete the edge between the two services in the complete graph that do not have a direct causal relationship to obtain at least one causal relationship.

5. The method for automatically constructing a causal knowledge graph according to claim 2, characterized in that, The causal mining algorithm based on the data type performs causal mining on the time series data to obtain at least one causal relationship, including: The burst data is subjected to causal mining using a dynamic causal graph algorithm corresponding to the burst type. The burst data is segmented based on a preset window length. Causal analysis of the burst data in different time periods is performed using the time-series causal hypothesis to obtain at least one causal relationship.

6. The method for automatically constructing a causal knowledge graph according to claim 1, characterized in that, The acquisition of at least one corresponding causal weight includes: For each causal relationship, historical causal data related to the causal relationship is obtained from the time-series data. The historical causal data includes the causal relationship, the scene identifier, and feedback information of the fault solution located based on the causal relationship. The number of times the fault was successfully resolved in the feedback information, and the total number of times the fault was resolved, are counted. Obtain the corresponding scene weight based on the current scene identifier; Calculate the ratio of the number of successful attempts to the total number of fault resolutions, and use the product of the ratio and the scenario weight as the causal weight of the causal relationship.

7. The method for automatically constructing a causal knowledge graph according to claim 1, characterized in that, The method further includes: When a service change event or fault location feedback information is detected, the causal knowledge graph is updated based on the service change event and the fault location feedback information.

8. An automatic causal knowledge graph construction device, characterized in that, include: The acquisition unit is used to acquire time-series data corresponding to historical time periods. The time-series data includes a scene identifier, which is used to identify peak and off-peak scenes. The time-series data is time-series data corresponding to different services. A classification unit is used to classify the time-series data by data features to obtain the data type corresponding to the time-series data; The acquisition unit is further configured to perform causal mining on the time series data based on the causal mining algorithm corresponding to the data type, obtain at least one causal relationship, and obtain at least one corresponding causal weight, wherein the causal relationship is a causal relationship between different services; A construction unit is used to construct a causal knowledge graph based on at least one of the causal relationships and the corresponding causal weights.

9. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the automatic causal knowledge graph construction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the automatic construction method of causal knowledge graph as described in any one of claims 1 to 7.

Images