Cloud native system fault analysis method, apparatus and device, and storage medium

Abstract

The invention relates to the technical field of computers, can be applied to the fields of medical health, financial science and technology and the like, and discloses a cloud native system fault analysis method, device and equipment and a storage medium, and the method comprises the steps: obtaining multi-modal observation data of a plurality of service entities in a cloud native system; performing feature fusion on the multi-modal observation data through a multi-modal data fusion tool to generate time sequence representation; based on the time sequence representation, a root cause entity causing the fault is positioned through a root cause positioning tool; based on the root cause entity, determining a fault type of the root cause entity through a fault classification tool; integrating the root cause entity, the fault type and pre-stored system context information into a text prompt according to a preset format; and inputting the text prompt into a big language model expert agent, and generating a root cause analysis report. By means of the method, the data size input into the large language model is reduced, the analysis accuracy is improved, reasoning illusion is effectively avoided, and the reliability of the positioning result is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of computer technology and can be applied to fields such as medical health and financial technology. In particular, it relates to a method, apparatus, device and storage medium for fault analysis of cloud-native systems. Background Technology

[0002] With the rapid development of fintech, insurtech, and digital healthcare, core business systems across various sectors are accelerating their migration to cloud-native architectures to meet the demands of high concurrency and high availability. In the financial sector, systems relying on core scenarios such as online transactions, mobile payments, intelligent underwriting, and rapid claims processing have significantly improved business iteration efficiency and resource elasticity through microservice decomposition and containerized deployment. In the healthcare sector, key systems such as online consultation platforms, electronic medical record systems, telemedicine services, and medical equipment data monitoring have also leveraged cloud-native technologies to achieve cross-institutional data interoperability and agile service expansion, providing technical support for precision medicine and health management.

[0003] However, while cloud-native architectures offer flexibility and scalability, they also exponentially increase system complexity. In financial scenarios, a complete transaction chain may involve hundreds of interdependent microservices, such as user authentication, account management, payment gateways, risk control, and clearing and settlement. Even minor anomalies in one service (such as network latency or CPU overload) can propagate rapidly through the call chain, triggering a "snowball effect," leading to transaction interruptions, abnormal fund settlements, and resulting in huge economic losses and reputational risks. In healthcare scenarios, microservice failures in electronic medical record systems may cause patient data retrieval failures, and chain anomalies in telemedicine services may delay treatment decisions; their impact directly affects medical quality and patient safety. Therefore, in these two domains with extremely high requirements for system stability and continuity, quickly and accurately locating the root cause of failures and achieving business recovery becomes crucial to ensuring the operation of core services.

[0004] Existing root cause analysis methods have significant limitations when dealing with the above scenarios: Traditional operation and maintenance methods rely on experts to set static thresholds and rule-based alarms, or on basic statistical analysis. In the context of dynamically changing service dependencies in financial systems (such as temporary service expansion during peak trading periods on holidays) and complex cross-institutional data interactions in medical systems, these methods are difficult to adapt to the dynamic nature of the topology. Not only are rule maintenance costs high, but they also fail to capture subtle anomaly patterns, leading to frequent problems such as false alarms in transaction risks and missed alarms in medical devices.

[0005] While deep learning-based methods (such as neural networks) can integrate multimodal data such as logs, metrics, and data links, and perform reasonably well in specific financial or medical scenarios (such as known types of payment failures and device offline alarms), these models are mostly "black box" designs, and their reasoning processes cannot be explained. For example, they cannot explain why a certain microservice is determined to be the root cause of transaction failure, or why a certain log is associated with device failure. Furthermore, their generalization ability is limited, and they are not adaptable enough to new types of failures such as service anomalies caused by new types of network attacks in the financial field and cross-system data synchronization errors in the medical field. Ultimately, a large number of domain experts are still required to make decisions, which is difficult to meet the high-efficiency response requirements of real-time financial transactions and emergency medical treatment.

[0006] While Large Language Model (LLM)-based methods have shown potential in natural language reasoning, their direct application to root cause analysis in financial and healthcare cloud-native systems faces three core challenges: First, context window limitations: the massive scale of financial transaction logs and medical device monitoring data far exceeds the processing capacity of LLM, and key information (such as the timestamp of an abnormal transaction or the instantaneous peak value of a device) is easily lost. Second, multimodal input constraints: LLM has weak processing capabilities for financial time-series indicators (such as the number of transactions per second) and medical structured data (such as the sequence of equipment operating parameters), and direct input can lead to data feature distortion. Third, the illusion of dynamic dependencies: real-time topology adjustments such as temporary expansion of financial services and changes in cross-hospital collaboration links in medical systems exceed the scope of LLM's static pre-training knowledge, and during reasoning, it is easy to generate fault propagation paths that do not match reality (such as misjudging an idle service as the source of transaction interruption or misidentifying offline devices as data anomaly nodes), leading to misdiagnosis. Summary of the Invention

[0007] The purpose of this invention is to provide a cloud-native system fault analysis method, apparatus, device, and storage medium, aiming to solve the problems of limited context window and dynamic dependency illusion in existing fault root cause analysis methods.

[0008] In a first aspect, embodiments of the present invention provide a cloud-native system fault analysis method, including: Acquire multimodal observation data of multiple service entities in a cloud-native system, including log data, metric data, and link data; The multimodal observation data is fused using a multimodal data fusion tool to generate a time series representation; Based on the time series representation, the root cause entity causing the failure is located using the root cause localization tool; Based on the root cause entity, the fault type of the root cause entity is determined by a fault classification tool; The root cause entity, the fault type, and the pre-stored system context information are integrated into a text prompt according to a preset format. The text prompts are input into the large language model expert agent to generate a root cause analysis report.

[0009] Secondly, embodiments of the present invention provide a cloud-native system fault analysis device, comprising: The acquisition unit is used to acquire multimodal observation data of multiple service entities in the cloud-native system. The multimodal observation data includes log data, indicator data, and link data. The fusion unit is used to perform feature fusion on the multimodal observation data using a multimodal data fusion tool to generate a time series representation; The localization unit is used to locate the root cause entity causing the failure based on the time series representation using a root cause localization tool. The determining unit is used to determine the fault type of the root cause entity based on the root cause entity using a fault classification tool; An integration unit is used to integrate the root cause entity, the fault type, and pre-stored system context information into a text prompt according to a preset format. The generation unit is used to input the text prompts into the large language model expert agent to generate a root cause analysis report.

[0010] Thirdly, embodiments of the present invention provide a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the cloud-native system fault analysis method described in the first aspect.

[0011] Fourthly, embodiments of the present invention also provide a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the cloud-native system fault analysis method described in the first aspect.

[0012] This invention discloses a method, apparatus, device, and storage medium for fault analysis in cloud-native systems, comprising: acquiring multimodal observation data of multiple service entities in a cloud-native system, wherein the multimodal observation data includes log data, indicator data, and link data; performing feature fusion on the multimodal observation data using a multimodal data fusion tool to generate a time series representation; locating the root cause entity causing the fault using a root cause localization tool based on the time series representation; determining the fault type of the root cause entity using a fault classification tool based on the root cause entity; integrating the root cause entity, the fault type, and pre-stored system context information into a text prompt according to a preset format; and inputting the text prompt into a large language model expert agent to generate a root cause analysis report. This invention uses dedicated processing tools to refine massive, raw observation data into concise, high-information-density structured conclusions, effectively reducing the amount of data input to the large language model, enabling it to perform efficient and accurate reasoning within a limited context. Simultaneously, by employing a diffusion model, it can effectively fuse heterogeneous multimodal data to generate a unified and feature-rich representation, avoiding information loss when the large language model directly processes time series data, and improving the accuracy of the analysis. Furthermore, by employing specialized root cause localization tools to learn and construct dynamic causal relationship graphs from data in real time, rather than relying on the static knowledge of large language models, this approach accurately captures the dynamic changes in service dependencies within the cloud-native environment, effectively avoiding inference illusions and ensuring the reliability of the localization results. In addition, by positioning the large language model as an expert agent utilizing domain knowledge for advanced reasoning and decision generation, this framework enables the final generated report to not only provide accurate diagnoses but also more targeted and actionable remediation suggestions, helping to reduce the average time to repair system failures. This invention also provides a cloud-native system failure analysis device, a computer-readable storage medium, and a computer device, all possessing the aforementioned beneficial effects, which will not be elaborated upon further here. Attached Figure Description

[0013] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a schematic diagram of an application environment for a cloud-native system fault analysis method according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the fault analysis method for cloud-native systems. Figure 3 This is another flowchart illustrating the fault analysis method for cloud-native systems. Figure 4A schematic diagram illustrating the working principle of a multimodal data fusion tool; Figure 5 A schematic diagram illustrating the working principle of a root cause localization tool; Figure 6 A schematic block diagram of a cloud-native system fault analysis device; Figure 7 A schematic diagram of the structure of a cloud-native system fault analysis device; Figure 8 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention; Figure 9 This is another structural schematic diagram of a computer device according to one embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] It should be understood that, when used in this specification and the appended claims, the terms “comprising” and “including” indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more of its features, integrals, steps, operations, elements, components and / or collections thereof.

[0017] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0018] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0019] The cloud-native system fault analysis method provided in this invention can be applied to, for example... Figure 1In this application environment, the client communicates with the server via a network. The server can obtain multimodal observation data of multiple service entities in the cloud-native system through the client. This multimodal observation data includes log data, indicator data, and link data. A multimodal data fusion tool is used to perform feature fusion on the multimodal observation data to generate a time series representation. Based on the time series representation, a root cause localization tool is used to locate the root cause entity causing the failure. Based on the root cause entity, a failure classification tool is used to determine the failure type of the root cause entity. The root cause entity, the failure type, and pre-stored system context information are integrated into a text prompt according to a preset format. The text prompt is input to a large language model expert agent to generate a root cause analysis report. In this invention, a dedicated processing tool extracts massive amounts of raw observation data into concise, high-information-density structured conclusions, effectively reducing the amount of data input to the large language model, enabling it to perform efficient and accurate reasoning within a limited context. Simultaneously, by employing a diffusion model, heterogeneous multimodal data can be effectively fused to generate a unified and feature-rich representation, avoiding information loss when the large language model directly processes time series data, thus improving the accuracy of the analysis. Furthermore, it utilizes specialized root cause localization tools to learn and construct dynamic causal relationship graphs from data in real time, rather than relying on the static knowledge of large language models. This accurately captures the dynamic changes in service dependencies in cloud-native environments, effectively avoiding inference illusions and ensuring the reliability of localization results. In addition, by positioning the large language model as an expert agent utilizing domain knowledge for advanced reasoning and decision generation, this framework enables the final generated report to not only provide accurate diagnoses but also more targeted and actionable remediation recommendations, helping to reduce the average repair time for financial system failures. The client can be, but is not limited to, various personal computers, laptops, smartphones, tablets, AR devices, and portable wearable devices. The server can be implemented using a standalone server or a server cluster consisting of multiple servers. The invention will be described in detail below through specific embodiments.

[0020] Please see Figure 2 and Figure 3 This embodiment provides a cloud-native system fault analysis method, including: S101: Obtain multimodal observation data of multiple service entities in the cloud-native system, wherein the multimodal observation data includes log data, indicator data, and link data; Specifically, in this embodiment, the system monitoring platform is responsible for acquiring multimodal observation data of multiple key service entities in the cloud-native environment. In cloud-native payment systems in the fintech field, when an abnormal drop in payment success rate is detected, the system automatically triggers a multimodal observation data collection process. For core service entities such as user authentication service, payment gateway service, and risk control service, log data output by each service container is acquired through log collection tools, including "Token verification failure" error logs of user authentication service, "upstream service timeout" warning logs of payment gateway, and rule engine execution anomaly records of risk control service; indicator data is collected with the help of the monitoring system, covering time-series indicators such as P99 response latency of payment gateway, CPU utilization of risk control service, and database connection count of account service, as well as business indicators such as number of transactions per second and percentage of failed transactions; and link data is captured through a distributed tracing system, including the entire link call relationship from user initiation of payment to completion of settlement, such as the time taken for payment gateway to call risk control service, abnormal call markers of each node, and cross-service network transmission latency.

[0021] In cloud-native electronic medical record systems in the healthcare field, a multimodal data acquisition mechanism is activated when a sudden increase in patient data query response latency is detected. For key service entities such as patient information service, data synchronization service, and permission verification service, log data was collected using Logstash (an open-source data collection engine primarily used for collecting, processing, and outputting log data from various sources. It supports multiple input sources and output targets for log analysis and visualization. Its core functions include data ingestion, transformation, processing, and transmission, suitable for scenarios such as centralized log management and data analysis). This included "cross-hospital data retrieval failure" logs from the data synchronization service and "role permission matching anomaly" records from the permission verification service. Metric data was collected using GrafanaLoki (an open-source log aggregation system developed by GrafanaLabs, designed specifically for cloud-native environments), covering metrics such as memory usage of the patient information service, throughput of the data synchronization service, average response time of the query interface, number of data queries per minute, and cross-institutional data interaction success rate. Link data was obtained from the tracking system, covering the complete call chain from when a patient initiates a query request, through permission verification, information retrieval, data aggregation, to result return, including the call order, time consumption, and abnormal jump markers of each service node. This provides a comprehensive and fine-grained data foundation for subsequent root cause analysis.

[0022] S102: Using a multimodal data fusion tool, feature fusion is performed on the multimodal observation data to generate a time series representation; For details, please refer to Figure 4By using multimodal data fusion tools, feature fusion is performed on multimodal observation data to generate time series representations, including: The log data is processed by template matching and pattern extraction to obtain standardized log templates; The standardized log template is encoded to obtain the text pattern conditions; The KPI sequence is extracted from the link data, and the extracted KPI sequence is then embedded using a multilayer perceptron to obtain the time feature conditions. The text pattern conditions, time feature conditions, and index data are input into the diffusion model for inverse denoising to generate a time series representation.

[0023] More specifically, in a cloud-native e-commerce transaction system, a multimodal data fusion tool performs feature fusion on multimodal observation data from order services, payment services, and inventory services: For the log data of each service, the Drain algorithm is used for template matching and pattern extraction. For example, from the order service's "2023-10-01 10:05: From the log "12Order

[12345] creationfailedduetoinventoryshortage", extract "Order[]creat The standardized log template for "ionfailedduetoinventoryshortage" is used, where "[]" replaces variable parameters such as order ID. Then, the standardized template is encoded using a pre-trained RoBERTa model (RoBERTa is a pre-trained language model based on BERT, proposed by Facebook AI Research in 2019), converting the text semantics into a 384-dimensional vector to obtain the text pattern conditions. Simultaneously, KPI sequences are extracted from the link data, including the response latency of the order service calling the inventory service (e.g., [15ms, 20ms, 50ms, ...]) and the success rate of the payment service and order service calls (e.g., [99.8%, 99.5%, 90.2%, ...]) as they change over time. The metrics are embedded into a multilayer perceptron (MLP) with two hidden layers to convert the KPI sequences into 128-dimensional temporal feature vectors, which serve as temporal feature conditions. Finally, the original time series data of the text mode conditions, temporal feature conditions, and metrics such as CPU utilization (e.g., [20%, 25%, 70%, ...]) and memory usage (e.g., [1.2GB, 1.3GB, 2.1GB, ...]) of the order service are input into a two-branch collaborative diffusion model. The model performs a reverse denoising process under the collaborative guidance of the two conditions. At each denoising step, textual semantic features and temporal dynamic features are introduced to constrain the denoising direction, gradually fusing cross-modal information to ultimately generate a unified time series representation that includes log anomaly semantics, link dynamic features, and metric numerical changes.

[0024] This embodiment extracts and embeds the link KPI sequence into MLP, preserving the temporal dynamics of service interactions while achieving structured compression of time-series information through fixed-dimensional transformation. This ensures that the dynamic dependency features of the links are effectively incorporated into the fusion process, avoiding the fusion difficulties caused by inconsistent dimensions and complex formats of the original KPI sequences. Simultaneously, the reverse denoising process of the dual-branch collaborative diffusion model, guided by the synergistic combination of textual pattern conditions and temporal feature conditions, constrains the fusion direction at each denoising step to both anchor the abnormal semantics of logs and associate them with the dynamic interaction features of the links, while integrating the numerical changes of indicators. The resulting unified time-series representation simultaneously covers log semantics, link dynamics, and indicator status, achieving deep coupling of multimodal information. This fusion approach avoids the one-sidedness of single-modal information and provides a comprehensive and coherent feature foundation for subsequent root cause localization, significantly improving the accuracy and efficiency of fault analysis in complex cloud-native systems.

[0025] The KPI sequence refers to a set of time-series indicators extracted from cloud-native system link data, reflecting key performance aspects of inter-service interactions. These indicators change dynamically over time, quantifying performance and interaction status during service calls.

[0026] Taking an e-commerce transaction system as an example, the KPI sequence extracted from the link data includes "response latency of the order service calling the inventory service" and "success rate of the payment service calling the order service". The response latency sequence records the time taken for a single call at different time points (e.g., every second or every 100 milliseconds) (e.g., 15ms, 20ms, 50ms, etc.), directly reflecting the real-time efficiency of communication between the two services. The call success rate sequence represents the percentage of successfully completed calls per unit time out of the total number of calls (e.g., 99.8%, 99.5%, 90.2%, etc.), reflecting the stability of service interaction.

[0027] The core function of these KPI sequences is to capture the temporal characteristics of dynamic interactions between services, providing crucial time-series information for multimodal data fusion. Through multilayer perceptron (MLP) embedding processing, these sequences are transformed into vectors of a unified dimension, enabling effective fusion with the textual semantic features of logs and the numerical features of indicator data. Ultimately, this generates a unified time-series representation containing cross-modal information, providing a comprehensive data foundation for subsequent root cause analysis of failures.

[0028] The dual-branch collaborative diffusion model uses textual pattern features extracted from log data as a condition in its first branch and temporal features extracted from link data as a condition in its second branch. These two branches collaboratively guide the denoising process of the diffusion model, injecting both textual semantic information and temporal dynamic information into the original indicator data to generate a fused time-series representation. The diffusion model is a deep learning method based on a probabilistic generative model. Its core idea is to generate new data by simulating the reverse process of data gradually "diffusion" from noise to real samples. Specifically, the model first defines a forward diffusion process, gradually adding Gaussian noise to the real data until it becomes pure noise; then it trains a neural network to learn the reverse diffusion process, starting from pure noise and gradually denoising to ultimately generate samples consistent with the distribution of the real data.

[0029] In cloud-native payment systems within the fintech field, multimodal data fusion tools process data according to the following process: For log data generated by payment gateways, risk control services, etc., the Drain algorithm is used for template matching and pattern extraction. For example, from logs such as "[Time]Upstreamservicetimeoutforrequest[ID]" from payment gateways, a standardized log template of "Upstreamservicetimeoutforrequest[]" is extracted, where "[]" replaces variable parameters. This standardized template is then encoded using a pre-trained BERT model, converting the text information into a fixed-dimensional vector to obtain text pattern conditions. Simultaneously, key KPI sequences are extracted from the link data, such as end-to-end latency of payment gateway calls to risk control services and cross-service call success rates, which change over time. These KPI sequences are then embedded using a multilayer perceptron (MLP) to convert them into a unified-dimensional time feature vector, serving as time feature conditions. Finally, the original time series data of text mode conditions, time feature conditions, and indicators such as CPU utilization and memory usage of the payment gateway are input into the two-branch collaborative diffusion model. Under the joint guidance of the two conditions, the model performs a reverse denoising process, gradually integrating text semantics and time dynamic features to generate a unified time series representation containing cross-modal information.

[0030] In cloud-native electronic medical record systems in the healthcare field, the multimodal data fusion tool processes data as follows: For log data from data synchronization and permission verification services, a template matching algorithm is used to extract patterns. For example, from the "[Timestamp]Failedtopulldatafromhospital[Code]" log from the data synchronization service, a standardized log template "Failedtopulldatafromhospital[*]" is extracted. This template is then encoded using a pre-trained language model to generate text pattern conditions. KPI sequences, such as response latency in cross-hospital data interaction and data synchronization success rate, are extracted from the link data and embedded using an MLP network to obtain time feature conditions. Subsequently, these two conditions, along with the original time series data of network throughput, memory usage, and other metrics from the data synchronization service, are input into a diffusion model. During the reverse denoising process, the model integrates the abnormal semantics of the text patterns with the time dynamics of the KPIs, ultimately generating a unified time series representation that integrates multimodal information.

[0031] In some embodiments, template matching and pattern extraction processing is performed on log data to obtain standardized log templates, including: Set the initial window size, and divide the log data into multiple windows according to the time sequence and the window size; Perform word segmentation on the log entries in each window, and extract keywords and parameter position information; The first layer of clustering is performed based on keyword similarity, grouping log entries containing the same core keywords into one category; Within the same class, a second-level clustering is performed based on the consistency of parameter location information to identify log entries with the same structure but different parameter values, resulting in multiple clustering results. Pattern extraction is performed on each clustering result. The unchanging text portion in the clustering result is determined as the template skeleton, and the changing parameter portion is replaced with a preset placeholder to generate a standardized log template.

[0032] Specifically, in the log processing workflow of a cloud-native payment system, when performing template matching and pattern extraction on the log data of the payment gateway service, the initial window size is first set to 100 log entries (the window size can be adjusted according to the actual situation). Continuous logs are divided into multiple windows according to the chronological order of their creation, ensuring that the logs within each window have temporal correlation. For each log entry within a window, a word segmentation tool is used to break the text down into word units. For example, for the log "2024-05-20 14:30:02 Upstream"... After segmenting the string "servicetimeoutforrequest87654", keywords such as "Upstream", "service", "timeout", and "request" were extracted, and the position information of parameters like "87654" in the sentence was recorded (e.g., the first position after "request"). Then, a first-level clustering was performed, calculating the cosine similarity of keywords across different log entries. Logs containing core keywords such as "Upstream", "timeout", and "request" were grouped into the same category, initially filtering out log groups with similar semantics. Within this category, a second-level clustering was further performed based on the consistency of parameter position information. For example, comparing "Upstreamservicetimeoutforrequest87654"... The queries "quest87654" and "Upstreamservicetimeoutforreques98765" were analyzed. The request ID was found to be after "request" in both, indicating consistent parameter order. Therefore, they were grouped into the same sub-cluster. Pattern extraction was performed on each sub-cluster result, identifying the invariant text portion "Upstreamservicetimeoutfor" within the cluster. The template skeleton is determined by "request", and the changing request ID and other parameters are uniformly replaced with the preset placeholder "[]", and finally the standardized log template "Upstreamservicetimeoutforrequest[]" is generated.

[0033] This embodiment significantly improves the accuracy of pattern extraction through a two-layer clustering mechanism: the first layer is based on keyword similarity clustering, which can quickly aggregate logs with similar semantics (such as logs containing "Upstream" and "timeout" in the example), filter out irrelevant log interference, and focus on core abnormal topics; the second layer is based on parameter position consistency clustering, which further distinguishes structural differences on the basis of semantic similarity, accurately identifies logs with "same structure but different parameters" (such as timeout logs with different request IDs), avoids misjudging different patterns due to changes in parameter values, and ensures the isomorphism of clustering results.

[0034] In cloud-native intelligent claims systems within the fintech field, when performing template matching and pattern extraction on log data from claims review services, the initial window size is set to 60 log entries. Continuous logs are divided into multiple windows according to their generation time, ensuring that each window reflects the service operation status within the same time period. For each log entry within a window, a word segmentation tool is used to split the text. For example, after segmenting the log "2025-03-10 09:15:30 Claims Application [LC20250310001] Review Failed: Incomplete Materials," keywords such as "claims application," "review failed," and "incomplete materials" are extracted, and the parameter "LC20250310001" is recorded as the first position after "claims application." Based on the cosine similarity of the keywords, a first-level clustering is performed, grouping logs containing the core keywords "claims application" and "review failed" into one category, thus initially aggregating semantically related logs. In this type of log, a second-level clustering is performed based on the consistency of parameter position information. For example, comparing "Claim application [LC20250310001] failed review: Incomplete materials" and "Claim application [LC20250310002] failed review: Incomplete materials", it is found that the position of the claim number in both is after "Claim application", and the parameter position is consistent, so they are classified into the same sub-cluster. Pattern extraction is performed on this sub-cluster, and the unchanging text part "Claim application failed review: Incomplete materials" is used as the template skeleton, and the changing claim number is replaced with the preset placeholder "[]", generating a standardized log template "Claim application [] failed review: Incomplete materials".

[0035] In cloud-native remote diagnostic systems in the healthcare field, when processing log data from image analysis services, the initial window size is set to 100 log entries. The logs are divided into multiple windows in chronological order, covering image processing records from different time periods. Each log entry within a window is segmented into words. For example, the entry "2025-04-05 14:20:15 Patient [P12345] CT image analysis timed out: processing time 180s" is broken down into word units, extracting keywords such as "patient," "CT image analysis," and "timeout." The parameter "P12345" is recorded as the first position after "patient," and "180s" is recorded as the first position after "processing time." Based on keyword similarity, a first-level clustering is performed, grouping logs containing the core keywords "CT image analysis" and "timeout" into one category. In this category, a second-level clustering is performed based on the consistency of parameter location information. For example, comparing "Patient [P12345]'s CT image analysis timeout: processing time 180s" and "Patient [P67890]'s CT image analysis timeout: processing time 210s", it is confirmed that the patient ID and processing time are in the same position and are classified into the same sub-cluster. For this sub-cluster, the invariant text "Patient's CT image analysis timeout: processing time" is used as the template skeleton, and the patient ID and processing time are replaced with placeholders "[]" to generate a standardized log template "Patient []'s CT image analysis timeout: processing time [*]".

[0036] S103: Based on the time series representation, locate the root cause entity causing the failure using the root cause localization tool; For details, please refer to Figure 5 Based on time series representation, the root cause entities identified by the root cause localization tool include: Perform a Fast Fourier Transform on the time series representation to obtain the frequency domain representation; High-pass filtering is applied to the frequency domain representation to obtain the high-frequency components; Based on high-frequency components, a causal dependency graph between multiple service entities is constructed through a self-attention mechanism; On the causal dependency graph, a graph attention network is applied to propagate and aggregate features, calculate the importance score of each service entity, and identify the entity with the highest score as the root cause entity.

[0037] More specifically, when an order processing delay occurs on a cloud-native e-commerce platform, root cause localization is performed based on a unified time series representation generated by the system: First, a Fast Fourier Transform is performed on the time series representation to transform the time-series features of multiple entities such as order services, inventory services, and payment services from the time domain to the frequency domain, obtaining a frequency domain representation containing different frequency components; then, a high-pass filter is used to process the frequency domain representation, filtering out low-frequency normal business fluctuation signals (such as periodic changes in daily order volume) and retaining high-frequency components related to the fault (such as sudden jumps in order processing delays); based on these high-frequency components, a self-attention mechanism is introduced to calculate the root cause of each service entity. The association weights between entities are calculated, such as the matching degree between high-frequency features of order service and high-frequency features of inventory service. The weight values ​​are used as quantitative indicators of causal association between services to construct a dynamic causal dependency graph that includes service nodes such as order, inventory, and payment and the strength of association between nodes. Finally, a graph attention network (GAT) is applied to this graph to simulate the transmission path of faults between services through multi-layer feature propagation (such as how inventory service anomalies affect order processing). The importance scores of each node are aggregated. Among them, the inventory service has the most significant high-frequency anomaly signal and the highest association weight with other services, so it ranks first and is identified as the root cause entity causing order processing delays.

[0038] This embodiment constructs a causal dependency graph based on high-frequency components using a self-attention mechanism. It relies entirely on the high-frequency anomaly association features of service entities in real-time data, rather than statically preset dependency rules. This accurately reflects the dynamically changing call relationships and fault propagation paths between services in cloud-native systems, avoiding the "illusion" problem caused by relying on fixed knowledge. Simultaneously, by leveraging graph attention networks for feature propagation and aggregation on the causal dependency graph, it not only simulates the actual transmission path of faults between services (e.g., how inventory service anomalies affect order processing) but also identifies the most critical root cause entity from complex relationships by quantifying the importance scores of each entity. This significantly improves the accuracy and specificity of root cause localization, making it particularly suitable for cloud-native system scenarios with numerous services and complex dependencies.

[0039] In the fintech field, a leading bank's online transaction system experienced a sudden payment delay failure during the Double Eleven shopping festival. The system performed a Fast Fourier Transform on the time series representation to obtain a frequency domain representation to identify performance fluctuation characteristics. High-pass filtering was applied to the frequency domain representation to retain high-frequency components (reflecting instantaneous anomalies in critical services such as the payment gateway and risk control engine). Based on the high-frequency components, a causal dependency graph between service entities was constructed using a self-attention mechanism (such as the call chain of user authentication service → payment gateway → clearing and settlement service). Graph attention networks were applied to this graph for feature propagation and aggregation, calculating the importance score of each service entity. Ultimately, the CPU overload (98% utilization) of the payment gateway was identified as the root cause, successfully locating the source of the failure. In the healthcare field, a tertiary hospital's telemedicine platform experienced image processing interruptions during peak emergency hours. The system, based on time-series representation, performed FFT and high-pass filtering to extract high-frequency components to capture the dynamic relationship between patient data management services and image analysis services. By constructing a service dependency graph (such as the link from patient-side devices to data management to image analysis) through a self-attention mechanism and applying graph attention networks to calculate scores, the system accurately identified network bandwidth bottlenecks as the root cause, effectively preventing interruptions in medical services and ensuring emergency response efficiency.

[0040] In some embodiments, constructing a causal dependency graph among multiple service entities based on high-frequency components using a self-attention mechanism includes: The high-frequency components are divided according to the service entities to obtain the high-frequency feature sequence corresponding to each service entity; Based on the high-frequency feature sequence, a service entity and time step matrix is ​​constructed, where the row vectors represent service entities and the column vectors represent the high-frequency feature values ​​of different time steps; Based on the service entity and time step matrix, the query vector, key vector and value vector of each service entity are generated through linear transformation. The dot product of the query vector of each service entity and the key vector of other service entities is calculated and normalized to obtain the attention weight between service entities. Attention weights are used as a quantitative indicator of the strength of causal relationships between service entities to construct an initial causal dependency graph, where nodes in the graph are service entities and edge weights are the corresponding attention weights. Set a weight threshold, filter out edges with weights below the threshold, and generate the final causal dependency graph between multiple service entities.

[0041] Specifically, in a fault analysis scenario of a cloud-native e-commerce platform, the process of constructing a causal dependency graph between service entities based on high-frequency components is as follows: First, the high-frequency components obtained through high-pass filtering are divided according to service entities to obtain high-frequency feature sequences corresponding to order service, payment service, and inventory service. For example, the high-frequency sequence of inventory service reflects its sudden performance fluctuations, while the high-frequency sequence of order service reflects abnormal latency jumps. Then, a service entity and time step matrix is ​​constructed, where the row vectors represent the three service entities (order, payment, and inventory) and the column vectors correspond to the high-frequency feature values ​​of 100 consecutive time steps, forming a 3×100 matrix structure. Based on this matrix, a query vector (Q), key vector (K), and value vector (V) for each service entity are generated through linear transformation. The Q vector of the order service is multiplied by the K vectors of the payment service and inventory service, and after SoftMax normalization, attention weights are obtained—for example, the weight between the order service and inventory service is 0.8, the weight between the order service and payment service is 0.3, and the weight between the payment service and inventory service is 0.6. These weights are used as quantitative indicators of the strength of causal relationships to construct an initial causal dependency graph: the nodes in the graph represent three service entities, and the edge weights are 0.8, 0.3, and 0.6, respectively. Finally, a weight threshold of 0.5 is set to filter out edges with weights below the threshold (such as 0.3 for order and payment), and retain the edges for order-inventory (0.8) and payment-inventory (0.6) to generate the final causal dependency graph, which clearly presents the significant dynamic relationships between services.

[0042] This embodiment achieves dynamic quantification of the strength of associations between service entities by introducing a self-attention mechanism: through the dot product operation of query vectors and key vectors, it can automatically capture the similarity and dependency relationships of high-frequency features of different services. The normalized attention weights objectively reflect the tightness of the association, avoiding the limitations of traditional static rules that pre-set dependency relationships, and can adapt to dynamic changes in system topology. In addition, an initial graph is constructed based on the attention weights, and low-weight edges are filtered out by thresholding. This preserves the core causal relationships while eliminating noise interference, making the final causal dependency graph more concise and accurate. It can intuitively present the critical path of fault propagation and provide a clear structural basis for subsequent root cause localization. This method is particularly suitable for cloud-native systems with numerous services and dynamically changing dependencies, effectively improving the accuracy and efficiency of causal relationship analysis.

[0043] In intelligent settlement systems within the fintech field, when an anomaly in interbank transfer delays is detected, the process of constructing a causal dependency graph based on high-frequency components is as follows: First, the high-frequency components after high-pass filtering are divided according to service entities, resulting in high-frequency feature sequences corresponding to account services, clearing services, and risk control services. For example, the high-frequency sequence of clearing services exhibits sudden fluctuations in transaction reconciliation response time, while the high-frequency sequence of risk control services reflects abnormal jumps in risk rule verification time. Based on these sequences, a service entity and time step matrix is ​​constructed, where the row vectors represent the three service entities, and the column vectors correspond to the high-frequency feature values ​​of 50 consecutive time steps, forming a 3×50 matrix. A linear transformation is used to generate the query vector (Q), key vector (K), and value vector (V) for each entity. The attention weights for account services and clearing services are calculated to be 0.75, clearing services and risk control services to be 0.68, and account services and risk control services to be 0.2. An initial causal dependency graph is constructed using these weights, with nodes representing the three service entities and edge weights corresponding to the aforementioned values. The weight threshold is set to 0.5, and the edge between account service and risk control service (0.2) is filtered out. Finally, the edge between account-clearing (0.75) and clearing-risk control (0.68) is retained to generate a causal dependency graph that reflects the core relationship.

[0044] In telemedicine platforms in the healthcare field, to address the issue of delayed access to patient medical records, a causal dependency graph is constructed based on high-frequency components. First, the high-frequency components are divided into patient information services, image analysis services, and consultation scheduling services to obtain the high-frequency feature sequences of each entity. For example, the high-frequency sequence of the image analysis service reflects a sharp increase in image data decoding time. A 4×80 service entity-time step matrix (including data platform services) is constructed. After generating vectors through linear transformation, the attention weights of patient information services and image analysis services are calculated to be 0.82, image analysis services and consultation scheduling services to be 0.71, and data platform services and patient information services to be 0.35. After setting a threshold of 0.6, low-weight edges are filtered out, and the final causal dependency graph retains two core related edges: patient information-image analysis (0.82) and image analysis-consultation scheduling (0.71).

[0045] In some embodiments, a graph attention network is applied to the causal dependency graph for feature propagation and aggregation, calculating the importance score of each service entity, and identifying the entity with the highest score as the root cause entity. Obtain a causal dependency graph containing multiple service entities, where nodes represent service entities and edge weights are quantitative indicators of the strength of causal relationships between service entities. Apply a graph attention network to the causal dependency graph. The graph attention network achieves feature propagation by calculating the attention coefficients between each service entity and its neighboring entities. Specifically, it assigns dynamic attention weights to the features of each neighboring entity based on edge weights, and then propagates the neighboring features to the current service entity in a weighted manner. Aggregate the propagated features by fusing the service entity's own features with the attention-weighted neighboring features to generate a fused feature vector for each service entity. Calculate the importance score of each service entity based on the fused feature vector. The score comprehensively reflects the coreness of the service entity in the causal relationship and its weight in influencing the failure. The service entity with the highest importance score is identified as the root cause entity. The calculation of the importance score is based on the strength of the service entity's own anomalous features, the closeness of its relationship with other entities, and the cumulative impact during feature propagation.

[0046] This embodiment aggregates the features of the service entity itself with the attention-weighted features of its neighbors, thus preserving the entity's own abnormal information and incorporating the influence of other entities in the associated network. This achieves effective integration of multi-source information and avoids the one-sidedness caused by focusing only on the features of a single entity.

[0047] For example, consider a causal dependency graph containing order services, payment services, and inventory services. The nodes in the graph represent three service entities, and the edge weights are 0.8 for order-inventory, 0.6 for order-payment, and 0.3 for payment-inventory, quantifying the strength of the causal relationship between services. When applying a Graph Attention Network (GAT) to this graph, GAT first calculates the attention coefficients between each service and its neighbors: for the order service, its neighbors are the inventory service and the payment service. Based on the edge weights, the attention weight for order to inventory is calculated to be 0.7, and the attention weight for order to payment is 0.3. Then, the high-frequency anomaly features of the inventory service are passed to the order service with a weight of 0.7, and the features of the payment service with a weight of 0.3. Similarly, the inventory service receives features from order (weight 0.8) and payment (weight 0.2), and the payment service receives features from order (weight 0.67) and inventory (weight 0.33). Next, the propagated features are aggregated. For example, the order service fuses its own delayed features with the weighted features from inventory and payment to generate a fused feature vector containing multi-source information. When calculating importance scores based on fused feature vectors, the abnormal intensity of each service (e.g., the inventory service has the largest high-frequency fluctuation range), the degree of correlation (inventory and order have the highest correlation weight), and the cumulative impact of feature propagation are comprehensively considered. Finally, the inventory service scores 0.92, the order service scores 0.78, and the payment service scores 0.65. The inventory service with the highest score is identified as the root cause entity causing order processing failure.

[0048] S104: Based on the root cause entity, determine the fault type of the root cause entity using a fault classification tool; Specifically, based on the root cause entity, the failure type of the root cause entity is determined using failure classification tools, including: Preprocessing of time series representations; Local anomaly patterns in the preprocessed unified time series representation are extracted using multiple convolutional kernels of different sizes to obtain the convolutional result; The convolution result is reduced in dimensionality by a pooling layer to obtain the pooling result. The pooling result is nonlinearly transformed by a fully connected layer to obtain a fully connected result; The fully connected results are classified by a classifier to obtain the probability value of the root cause entity belonging to each preset fault type. The preset fault types include CPU overload, memory leak, network packet loss, disk I / O blockage, and service dependency timeout. The failure type with the highest probability value is determined as the final failure type of the root cause entity.

[0049] Specifically, in a cloud-native logistics scheduling system, when the root cause entity is located as a warehouse scheduling service, the process of determining its fault type through a fault classification tool is as follows: First, the unified time series representation of the service is preprocessed, including using Z-score standardization to eliminate the dimensional differences of different indicators, and then the service is divided into fixed-length feature segments through a sliding window with a window size of 10, each segment containing feature values ​​of 10 time steps. The preprocessed feature fragments are input into a fault classification tool. This tool uses three different sizes of convolutional kernels (3×1, 5×1, and 7×1) to extract local anomaly patterns in the fragments at short, medium, and long periods, respectively. For example, the 3×1 convolutional kernel captures instantaneous indicator jumps, while the 7×1 convolutional kernel identifies continuous abnormal trends, resulting in multi-dimensional convolutional results. Subsequently, the convolutional results are dimensionality-reduced using a max pooling layer, retaining the maximum value of each feature region, compressing the data dimensionality while strengthening key anomaly features. The dimensionality-reduced features are then input into a fully connected layer containing a ReLU activation function, undergoing nonlinear transformation to fuse anomaly features from different levels, resulting in a fully connected result. The fully connected result is then input into a softmax classifier, which outputs the probability values ​​of the warehouse scheduling service belonging to each preset fault type, where the probability is 82% for CPU overload, 10% for memory leak, 5% for network packet loss, 2% for disk I / O blocking, and 1% for service dependency timeout. Finally, the highest probability "CPU overload" is determined as the fault type of the root cause entity.

[0050] This embodiment outputs probability values ​​for each preset fault type through a classifier, presenting the degree of matching between the root cause entity and various fault types in a quantitative manner. The type with the highest probability is selected as the result, ensuring the objectivity of the classification while reflecting the confidence level of the classification through probability distribution. This method is designed for typical fault types such as CPU overload and memory leaks, adapting to common fault scenarios in cloud-native systems, and improving the overall accuracy and efficiency of fault type identification.

[0051] In intelligent payment systems in the fintech field, when the root cause entity is located as a payment clearing service, the fault classification tool determines its fault type according to the following process: first, the unified time series representation of the service is preprocessed, and the data is scaled to the [0, 1] interval using Min-Max standardization, and then divided into fixed-length feature segments with 20 time steps as windows. The preprocessed features are input into a convolutional layer containing three kernel sizes (3×1, 5×1, and 9×1). The 3×1 kernel captures abnormal fluctuations caused by instantaneous transaction peaks, while the 9×1 kernel extracts delay patterns lasting more than 10 seconds, resulting in multi-dimensional convolutional results. The convolutional results are then dimensionality-reduced using an average pooling layer, preserving the mean features of each feature region. The dimensionality-reduced features are then non-linearly transformed by a fully connected layer containing the LeakyReLU activation function, fusing abstract features that can distinguish different faults. The fully connected results are then input into a softmax classifier, which outputs the probability values ​​of the payment clearing service belonging to each preset fault type: CPU overload 68%, memory leak 12%, network packet loss 8%, disk I / O blocking 5%, and service dependency timeout 7%. Finally, the "CPU overload" fault, which has the highest probability, is determined as the fault type of the root cause entity. In remote diagnostic platforms within the healthcare field, the fault classification tool for root cause entity image analysis services processes the following: During the preprocessing of its time series representation, Z-score normalization is used to eliminate the influence of device differences, and feature segments are generated using 15 time steps as windows. Convolutional layers employ 2×1, 4×1, and 6×1 kernels to extract local patterns such as short-cycle data transmission anomalies and medium-to-long-cycle image processing delays, respectively. After dimensionality reduction via max-pooling layers, peak features of each feature region are retained. Features are then fused through a fully connected layer containing ReLU activation, and input into the classifier to obtain a probability distribution: service dependency timeout 53%, network packet loss 22%, CPU overload 15%, memory leak 7%, and disk I / O blocking 3%. Ultimately, "service dependency timeout" is identified as the fault type for the image analysis service. In some embodiments, local anomaly patterns are extracted from the preprocessed unified time series representation using multiple convolutional kernels of different sizes, resulting in the following convolutional results: A unified time series representation is obtained after preprocessing. Preprocessing includes standardizing the original time series to eliminate dimensional differences and segmenting continuous time series data into fixed-length feature segments using a sliding window. Each feature segment contains feature values ​​for a preset number of time steps. Multiple convolutional kernels of different sizes are configured, including small (corresponding to 1-3 time steps), medium (corresponding to 4-6 time steps), and large (corresponding to 7-10 time steps), to capture local anomaly patterns at different time scales. Small-sized convolutional kernels are used for anomalies such as instantaneous indicator jumps, medium-sized kernels for short-term persistent fluctuations, and large-sized kernels for medium- to long-term anomalies. Trend deviation anomalies: The preprocessed unified time series representation is input into a convolutional layer containing multiple convolutional kernels of different sizes. Through sliding convolution operations of each convolutional kernel in the time dimension, local anomaly features in each feature segment are extracted. The convolution operation calculates the inner product of the convolutional kernel and the feature values ​​within the corresponding time window, and outputs a feature map reflecting the intensity of local anomalies. Based on the extraction results of each convolutional kernel, a multi-dimensional convolution result is formed. The convolution result contains local anomaly pattern features at different time scales, which can simultaneously represent instantaneous, short-term, and medium-to-long-term anomaly features, providing fine-grained local feature inputs for subsequent tasks such as fault classification and root cause analysis.

[0052] Specifically, when processing the unified time series representation of the payment gateway service, preprocessing is performed first: the original time series contains indicators such as the service's response latency (in ms) and CPU utilization (in %). Z-score standardization is used to eliminate the difference in units. Then, the continuous time series data is divided into fixed-length feature segments by a sliding window (window size 10). Each segment contains feature values ​​of 10 time steps (e.g., a segment is [1.2, 1.3, 2.1, 2.3, 1.8, 2.5, 3.0, 2.8, 3.2, 3.5], corresponding to the standardized response latency change). Subsequently, multiple convolutional kernels of different sizes are configured: small-sized kernels use 2×1 kernels (corresponding to 2 time steps) to capture anomalies such as instantaneous indicator jumps (e.g., feature values ​​suddenly increase from 1.3 to 3.0 within 2 time steps); medium-sized kernels use 5×1 kernels (corresponding to 5 time steps) to target anomalies such as short-term sustained fluctuations (e.g., feature values ​​fluctuate between 2.0 and 3.0 for 5 consecutive time steps); and large-sized kernels use 8×1 kernels (corresponding to 8 time steps) to target anomalies such as medium- to long-term trend deviations (e.g., feature values ​​continuously increase from 1.2 to 3.2 within 8 time steps). The preprocessed feature fragments are input into a convolutional layer containing the above kernels, and each kernel slides along the time dimension: the 2×1 kernel calculates the inner product with the corresponding 2 time step feature values ​​for each slide, outputting a high-value feature map at instantaneous jumps; the 5×1 kernel calculates the inner product over 5 time steps, outputting a high value in the short-term fluctuation range; and the 8×1 kernel outputs a feature map for trend changes over 8 time steps. Finally, the extraction results of the three convolutional kernels are integrated to form a multi-dimensional convolutional result. This result simultaneously contains abnormal features such as instantaneous jumps, short-term fluctuations, and medium- to long-term trends, providing fine-grained local feature inputs for subsequent fault classification of payment gateway services.

[0053] S105: Integrate the root cause entity, the fault type, and the pre-stored system context information into a text prompt according to a preset format; The preset formats include: root cause localization results, fault classification results, system architecture background, and task objectives.

[0054] Specifically, the system integrates the root cause entities and their confidence scores output by the root cause localization tool, the specific fault types determined by the fault classification tool, and pre-stored system context information into a structured text prompt according to a preset format. This prompt format clearly includes four components: the root cause localization results section details the identified root cause entities, related entities, and their confidence scores; the fault classification results section clearly describes the fault type and its key characteristic symptoms; the system architecture background section provides the current microservice deployment structure, inter-service dependencies, and resource deployment information; and the task objectives section clearly specifies the specific tasks to be completed, such as fault analysis, impact assessment, and remediation suggestion generation. Through this structured information integration method, the scattered analysis results and background knowledge are organized into a complete and standardized prompt input, providing a sufficient and orderly information foundation for accurate reasoning by the expert agent in the subsequent large language model.

[0055] In the fintech field, after a leading bank's payment platform experienced a transaction delay during the Double Eleven shopping festival, it integrated the root cause entity (payment gateway service CPU utilization of 98%), the fault type (performance fault), and pre-stored system context information (system architecture background: the microservice call chain is a real-time dynamic dependency of user authentication → payment gateway → risk control engine; historical fault data: 92% of similar faults in the past 30 days originated from CPU overload) into a structured text prompt according to a preset format. The template content is "Root cause location result: payment gateway service CPU overload; fault classification result: performance fault; system architecture background: the payment chain contains 3 key microservices, and the dependency relationship changes dynamically in real time; task objective: locate and resolve the transaction delay problem." In the healthcare field, a tertiary hospital's telemedicine platform experienced an interruption in image processing during peak emergency hours. The system integrated the root cause (network bandwidth bottleneck), fault type (network failure), and system context information (system architecture background: link topology of patient-side devices → data management service → image analysis service; historical fault data: network outage rate increased by 35% during emergency hours) using the same template. The generated text prompt accurately included "Root cause location result: insufficient network bandwidth; Fault classification result: network failure; System architecture background: real-time monitoring and dynamic adjustment of link dependencies; Task objective: restore the continuity of image processing services," providing standardized input for subsequent large language model analysis.

[0056] S106: Input the text prompt into the large language model expert agent to generate a root cause analysis report.

[0057] Specifically, the system inputs the integrated structured text prompts into the large language model expert agent. Based on the received complete contextual information, including root cause localization results, fault classification results, system architecture background, and task objectives, the agent activates its deep inference engine. Through parsing and understanding the text prompts, the large language model expert agent first analyzes the fault propagation path in conjunction with the system architecture background, clarifying the specific impact chain starting from the root cause entity; then, based on its internalized domain knowledge, it assesses the scope of the fault's impact, including affected service modules, user groups, and business functions; finally, based on the fault type characteristics, it generates actionable remediation suggestions, including immediate emergency measures and long-term optimization plans. The entire process requires no manual intervention; the large language model expert agent automatically outputs a structurally complete and logically clear root cause analysis report, achieving fully automated intelligent processing from fault identification to solution generation.

[0058] In the fintech field, a leading bank's payment platform inputs integrated structured text prompts (including root cause localization results: payment gateway service CPU utilization 98%, fault classification results: performance fault, system architecture background: microservice call chain is user authentication → payment gateway → risk control engine real-time dynamic dependency, task objective: solve transaction delay problem) into an expert agent of a large language model trained on financial domain corpus via API interface. The agent generates a root cause analysis report containing root cause description, scope of impact, and specific operational suggestions. For example, the root cause is: payment gateway CPU overload caused transaction delay; the impact is: the transaction failure rate increased to 15% during the Double Eleven promotion; the suggestion is: immediately expand CPU resources and adjust the load balancing strategy. In the healthcare field, a tertiary hospital's telemedicine platform inputs text prompts (root cause analysis result: network bandwidth bottleneck, fault classification result: network fault, system architecture background: real-time monitoring link is the dynamic topology of patient-end device → data management service → image analysis service, task objective: restore image processing continuity) into a healthcare-optimized big data model expert agent. The generated report clearly identifies the network bandwidth bottleneck as the root cause and provides solutions to increase bandwidth quotas and optimize data transmission protocols, ensuring the rapid recovery of emergency services.

[0059] This embodiment utilizes dedicated processing tools to extract concise, high-information-density structured conclusions from massive amounts of raw observation data, effectively reducing the amount of data input to the large language model and enabling it to perform efficient and accurate reasoning within limited contexts. Simultaneously, by employing a diffusion model, it effectively integrates heterogeneous multimodal data, generating a unified and feature-rich representation, avoiding information loss when the large language model directly processes time-series data, and improving the accuracy of the analysis. Furthermore, a dedicated root cause localization tool learns and constructs a dynamic causal relationship graph from the data in real time, rather than relying on the static knowledge of the large language model, accurately capturing the dynamic changes in service dependencies in the cloud-native environment, effectively avoiding reasoning illusions and ensuring the reliability of the localization results. In addition, by positioning the large language model as an expert agent utilizing domain knowledge for advanced reasoning and decision generation, this framework ensures that the final generated report not only provides accurate diagnoses but also offers more targeted and actionable remediation suggestions, helping to reduce the mean time to repair system failures.

[0060] Please see Figure 6 and Figure 7 This embodiment provides a cloud-native system fault analysis device 600, including: The acquisition unit 601 is used to acquire multimodal observation data of multiple service entities in the cloud-native system, wherein the multimodal observation data includes log data, indicator data and link data; The fusion unit 602 is used to perform feature fusion on the multimodal observation data using a multimodal data fusion tool to generate a time series representation; The location unit 603 is used to locate the root cause entity causing the failure using a root cause location tool based on the time series representation. The determining unit 604 is used to determine the fault type of the root cause entity based on the root cause entity using a fault classification tool; Integration unit 605 is used to integrate the root cause entity, the fault type, and pre-stored system context information into a text prompt according to a preset format; The generation unit 606 is used to input the text prompts into the large language model expert agent to generate a root cause analysis report.

[0061] Furthermore, the fusion unit 602 includes: The processing subunit is used to perform template matching and pattern extraction on the log data to obtain a standardized log template; The encoding subunit is used to encode the standardized log template to obtain text pattern conditions; The embedding subunit is used to extract the KPI sequence from the link data and perform multilayer perceptron embedding processing on the extracted KPI sequence to obtain time feature conditions. The denoising subunit is used to input the text pattern conditions, the time feature conditions, and the index data into the diffusion model for inverse denoising to generate a time series representation.

[0062] Furthermore, the processing subunit includes: Divide into sub-units to set the initial window size, and divide the log data into multiple windows according to the time sequence and the window size; The word segmentation processing subunit is used to segment log entries in each window and extract keywords and parameter position information; The first clustering subunit is used to perform the first-level clustering based on keyword similarity, grouping log entries containing the same core keywords into one category; The second clustering subunit is used to perform a second-level clustering within the same class based on the consistency of parameter location information, to identify log entries with the same structure but different parameter values, and to obtain multiple clustering results. The pattern extraction subunit is used to extract patterns from each clustering result, determine the unchanging text part in the clustering result as the template skeleton, replace the changing parameter part with preset placeholders, and generate a standardized log template.

[0063] Furthermore, the positioning unit 603 includes: The Fourier transform subunit is used to perform a fast Fourier transform on the time series representation to obtain a frequency domain representation; A filtering subunit is used to perform high-pass filtering on the frequency domain representation to obtain high-frequency components; Construct sub-units to build a causal dependency graph between multiple service entities based on the high-frequency components through a self-attention mechanism; The feature propagation subunit is used to apply a graph attention network to perform feature propagation and aggregation on the causal dependency graph, calculate the importance score of each service entity, and determine the entity with the highest score as the root cause entity.

[0064] Furthermore, the building subunit includes: The component partitioning subunit is used to partition the high-frequency components according to the service entities to obtain the high-frequency feature sequence corresponding to each service entity. The matrix construction subunit is used to construct a service entity and time step matrix based on the high-frequency feature sequence, where the row vectors represent service entities and the column vectors represent high-frequency feature values ​​at different time steps. The normalization processing subunit is used to generate the query vector, key vector and value vector of each service entity through linear transformation based on the service entity and the time step matrix, calculate the dot product of the query vector of each service entity and the key vector of other service entities and perform normalization processing to obtain the attention weight between service entities. The relationship graph construction subunit is used to construct an initial causal dependency graph by using attention weight as a quantitative indicator of the strength of causal association between service entities. In this graph, the nodes are service entities and the weights of the edges are the corresponding attention weights. The filtering subunit is used to set weight thresholds, filter out edges with weights below the threshold, and generate the final causal dependency graph between multiple service entities.

[0065] Furthermore, the determining unit 604 includes: A preprocessing subunit is used to preprocess the time series representation; The convolutional subunit is used to extract local anomaly patterns in the preprocessed unified time series representation through multiple convolutional kernels of different sizes to obtain the convolution result; The dimensionality reduction subunit is used to perform dimensionality reduction processing on the convolution result through a pooling layer to obtain the pooling result; The nonlinear transformation subunit is used to perform a nonlinear transformation on the pooling result through a fully connected layer to obtain a fully connected result. The classification subunit is used to classify the fully connected result by a classifier to obtain the probability value of the root cause entity belonging to each preset fault type, wherein the preset fault types include CPU overload, memory leak, network packet loss, disk I / O blocking and service dependency timeout. The type determination subunit is used to determine the fault type with the highest probability value as the final fault type of the root cause entity.

[0066] Furthermore, the preset formats include: root cause localization results, fault classification results, system architecture background, and task objectives.

[0067] This invention provides a cloud-native system fault analysis device. First, it acquires multimodal observation data from multiple service entities in the cloud-native system, including log data, indicator data, and link data. Then, using a multimodal data fusion tool, it performs feature fusion on the multimodal observation data to generate a time-series representation. Based on the time-series representation, a root cause localization tool identifies the root cause entity causing the fault. Based on the root cause entity, a fault classification tool determines the fault type of the root cause entity. The root cause entity, the fault type, and pre-stored system context information are integrated into a text prompt according to a preset format. The text prompt is then input to a large language model expert agent to generate a root cause analysis report. By using dedicated processing tools, massive amounts of raw observation data are refined into concise, high-information-density structured conclusions, effectively reducing the amount of data input to the large language model, enabling efficient and accurate reasoning within a limited context. Simultaneously, by employing a diffusion model, heterogeneous multimodal data can be effectively fused to generate a unified and feature-rich representation, avoiding information loss when the large language model directly processes time-series data, thus improving the accuracy of the analysis. Furthermore, by employing specialized root cause analysis tools to learn and construct dynamic causal graphs from data in real time, rather than relying on the static knowledge of large language models, this framework accurately captures the dynamic changes in service dependencies in cloud-native environments, effectively avoiding inference illusions and ensuring the reliability of the root cause analysis results. In addition, by positioning the large language model as an expert agent leveraging domain knowledge for advanced reasoning and decision generation, this framework enables the final report to not only provide accurate diagnoses but also more targeted and actionable remediation recommendations, helping to reduce the average time to repair financial system failures.

[0068] Specific limitations regarding the cloud-native system fault analysis device can be found in the limitations of the cloud-native system fault analysis method described above, and will not be repeated here. Each unit in the aforementioned cloud-native system fault analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These units can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each unit.

[0069] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a cloud-native system fault analysis method on the server side.

[0070] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps on the client side of a cloud-native system fault analysis method.

[0071] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps: Acquire multimodal observation data of multiple service entities in a cloud-native system, including log data, metric data, and link data; The multimodal observation data is fused using a multimodal data fusion tool to generate a time series representation; Based on the time series representation, the root cause entity causing the failure is located using the root cause localization tool; Based on the root cause entity, the fault type of the root cause entity is determined by a fault classification tool; The root cause entity, the fault type, and the pre-stored system context information are integrated into a text prompt according to a preset format. The text prompts are input into the large language model expert agent to generate a root cause analysis report.

[0072] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor: Acquire multimodal observation data of multiple service entities in a cloud-native system, including log data, metric data, and link data; The multimodal observation data is fused using a multimodal data fusion tool to generate a time series representation; Based on the time series representation, the root cause entity causing the failure is located using the root cause localization tool; Based on the root cause entity, the fault type of the root cause entity is determined by a fault classification tool; The root cause entity, the fault type, and the pre-stored system context information are integrated into a text prompt according to a preset format. The text prompts are input into the large language model expert agent to generate a root cause analysis report.

[0073] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions on the server side and client side in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0074] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0075] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0076] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A cloud-native system failure analysis method, characterized in that, include: Acquire multimodal observation data of multiple service entities in a cloud-native system, including log data, metric data, and link data; The multimodal observation data is fused using a multimodal data fusion tool to generate a time series representation; Based on the time series representation, the root cause entity causing the failure is located using the root cause localization tool; Based on the root cause entity, the fault type of the root cause entity is determined by a fault classification tool; The root cause entity, the fault type, and the pre-stored system context information are integrated into a text prompt according to a preset format. The text prompts are input into the large language model expert agent to generate a root cause analysis report. 2.The cloud-native system fault analysis method of claim 1, wherein, The step of using a multimodal data fusion tool to perform feature fusion on the multimodal observation data to generate a time series representation includes: The log data is subjected to template matching and pattern extraction to obtain a standardized log template; The standardized log template is encoded to obtain text pattern conditions; The KPI sequence is extracted from the link data, and the extracted KPI sequence is embedded using a multilayer perceptron to obtain time feature conditions. The text pattern conditions, the time feature conditions, and the index data are input into the diffusion model for inverse denoising to generate a time series representation. 3.The cloud-native system failure analysis method of claim 2, wherein, The process of performing template matching and pattern extraction on the log data to obtain a standardized log template includes: Set the initial window size, and divide the log data into multiple windows according to the time sequence and the window size; Perform word segmentation on the log entries in each window, and extract keywords and parameter position information; The first-level clustering is performed based on keyword similarity, grouping log entries containing the same core keywords into one category; Within the same class, a second-level clustering is performed based on the consistency of parameter location information to identify log entries with the same structure but different parameter values, resulting in multiple clustering results. Pattern extraction is performed on each clustering result. The unchanging text portion in the clustering result is determined as the template skeleton, and the changing parameter portion is replaced with a preset placeholder to generate a standardized log template. 4.The cloud-native system fault analysis method of claim 1, wherein, The step of locating the root cause entity of the failure using a root cause localization tool based on the time series representation includes: Perform a Fast Fourier Transform on the time series representation to obtain a frequency domain representation; High-pass filtering is applied to the frequency domain representation to obtain high-frequency components; Based on the high-frequency components, a causal dependency graph between multiple service entities is constructed using a self-attention mechanism; On the causal dependency graph, a graph attention network is applied to perform feature propagation and aggregation, calculate the importance score of each service entity, and determine the entity with the highest score as the root cause entity. 5.The cloud-native system failure analysis method of claim 4, wherein, The construction of the causal dependency graph among the multiple service entities based on the high-frequency components and using a self-attention mechanism includes: The high-frequency components are divided according to the service entities to obtain the high-frequency feature sequence corresponding to each service entity; Based on the high-frequency feature sequence, a service entity and time step matrix is ​​constructed, where the row vectors represent service entities and the column vectors represent high-frequency feature values ​​at different time steps. Based on the service entities and time step matrix, a query vector, key vector, and value vector for each service entity are generated through linear transformation. The dot product of the query vector of each service entity and the key vector of other service entities is calculated and normalized to obtain the attention weights between service entities. Attention weights are used as a quantitative indicator of the strength of causal relationships between service entities to construct an initial causal dependency graph, where nodes in the graph are service entities and edge weights are the corresponding attention weights. Set a weight threshold, filter out edges with weights below the threshold, and generate the final causal dependency graph between multiple service entities. 6.The cloud-native system failure analysis method of claim 1, wherein, The process of determining the fault type of the root cause entity using a fault classification tool, based on the root cause entity, includes: The time series representation is preprocessed; Local anomaly patterns in the preprocessed unified time series representation are extracted using multiple convolutional kernels of different sizes to obtain the convolutional result; The convolution result is reduced in dimensionality by a pooling layer to obtain the pooling result; The pooling result is nonlinearly transformed by a fully connected layer to obtain a fully connected result; The fully connected results are classified by a classifier to obtain the probability value of the root cause entity belonging to each preset fault type. The preset fault types include CPU overload, memory leak, network packet loss, disk I / O blockage, and service dependency timeout. The fault type with the highest probability value is determined as the final fault type of the root cause entity.

7. The cloud-native system failure analysis method of claim 1, wherein, The preset formats include: root cause localization results, fault classification results, system architecture background, and task objectives. 8.A cloud-native system failure analysis apparatus, characterized in that, include: The acquisition unit is used to acquire multimodal observation data of multiple service entities in the cloud-native system. The multimodal observation data includes log data, indicator data, and link data. The fusion unit is used to perform feature fusion on the multimodal observation data using a multimodal data fusion tool to generate a time series representation; The localization unit is used to locate the root cause entity causing the failure based on the time series representation using a root cause localization tool. The determining unit is used to determine the fault type of the root cause entity based on the root cause entity using a fault classification tool; An integration unit is used to integrate the root cause entity, the fault type, and pre-stored system context information into a text prompt according to a preset format. The generation unit is used to input the text prompts into the large language model expert agent to generate a root cause analysis report.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the cloud-native system fault analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to perform the cloud-native system fault analysis method as described in any one of claims 1 to 7.

Images