Communication fault root cause intelligent diagnosis positioning system and method

Abstract

The application discloses a communication fault root cause intelligent diagnosis positioning system and method, and belongs to the technical field of communication, comprising: a collection module, a feature extraction module, an abnormality recognition module and a diagnosis module; the collection module is used for acquiring the topological structure diagram of a target network, and constructing a diagnosis data set; the feature extraction module is used for classifying and normalizing the diagnosis data set, combining feature extraction and topological association labeling, and constructing a diagnosis feature vector; the abnormality recognition module is used for performing multi-channel parallel abnormality recognition on the diagnosis feature vector, performing confidence filtering and association aggregation on the abnormality recognized by each channel, and constructing an abnormal event list; the diagnosis module is used for constructing a fault propagation graph, labeling abnormal events, tracing an abnormal propagation path along the fault propagation graph in a reverse direction through a neural network algorithm, generating a root cause candidate set, performing confidence scoring on the root cause candidate by calculating a deviation abnormality degree, and screening a root cause diagnosis result.

Description

Technical Field

[0001] This invention belongs to the field of communication technology and relates to an intelligent diagnosis and location system and method for communication fault root causes. Background Technology

[0002] In telecommunications networks, when a fault occurs, one or more alarms directly related to the fault are often generated. These alarms are called root cause alarms, or simply root alarms. Root alarms can be used to quickly and effectively analyze and handle faults. Therefore, root alarm location is crucial.

[0003] A Chinese patent with authorization announcement number CN117411773B discloses a method for locating root cause alarms, a method for constructing alarm patterns, and an apparatus. The method includes: acquiring an aggregated fault; splitting the aggregated fault into multiple sub-faults; for each sub-fault, determining a target root alarm in the sub-fault based on the sub-fault and multiple preset alarm patterns, wherein each preset alarm pattern includes a preset root alarm and a preset derived alarm corresponding to the preset root alarm; and merging the target root alarms in all the sub-faults to obtain a final root alarm.

[0004] Although existing technologies improve the accuracy of root alarm location, there are still obvious technical defects in practical applications. Specifically, silent faults are not included in the analysis, that is, performance degradation, configuration drift or intermittent jitter that has actually occurred in the network when no alarms are generated by the network management system. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide an intelligent diagnostic and localization system and method for communication faults. This system proactively identifies silent faults without alarms through multi-channel parallel detection, traces the root cause in reverse by combining causal learning, and achieves threshold adaptation based on a health baseline, thereby eliminating reliance on human experience and adapting to dynamic network changes.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] The intelligent diagnostic and location system for root causes of communication failures includes: a data acquisition module, a feature extraction module, an anomaly identification module, and a diagnostic module.

[0008] The acquisition module obtains a topology diagram containing network element nodes, communication links, hierarchical relationships, and port information through the network management interface of the target network, and performs multi-dimensional data acquisition. Through preprocessing, a diagnostic dataset is constructed.

[0009] The feature extraction module is used to classify and regularize the diagnostic dataset, generate a time-series diagnostic data stream, extract features and perform topological association annotation on the time-series diagnostic data stream, and construct a diagnostic feature vector.

[0010] The anomaly identification module is used to perform multi-channel parallel anomaly identification on the diagnostic feature vector, including single-parameter anomalies, multi-parameter collaborative anomalies, and perceptual anomalies, and to perform confidence filtering and correlation aggregation on the anomalies identified by each channel to obtain anomaly events. By summarizing the anomaly events, an anomaly event list is generated.

[0011] The diagnostic module is used to construct a fault propagation graph and mark abnormal events in the fault propagation graph. Through a neural network algorithm, it traces the abnormal propagation path backward along the fault propagation graph to identify the fault type. Combining the located root cause nodes and root cause parameters, it generates a root cause candidate set. By calculating the deviation from the abnormality, it performs a confidence score on the root cause candidates and filters the root cause diagnosis results.

[0012] Specifically, the steps for constructing diagnostic feature vectors include:

[0013] Traverse each parameter in the time-series diagnostic data stream and extract basic statistical features;

[0014] Using timestamps as the horizontal axis and parameter values ​​as the vertical axis, the trend slope is fitted through linear regression, and the coefficient of variation of each parameter is calculated to obtain trend characteristics and fluctuation characteristics.

[0015] The basic statistical features, trend features, and fluctuation features of each parameter are integrated as diagnostic features to generate a set of statistical features, which are then bound to the corresponding network element nodes to mark the network level and the dependency relationship with related nodes.

[0016] Based on any two network element nodes that are connected, obtain the corresponding network level, and calculate the dependency weight of the topological edge between network element nodes through the distance between the network levels.

[0017] The network element node's network layer, associated nodes, and corresponding dependencies and dependency weights are bound to the corresponding statistical feature set, and the statistical feature set is normalized to generate a diagnostic feature vector.

[0018] Specifically, the steps of multi-channel parallel anomaly identification include:

[0019] By filtering historical normal operation data of the target network and calculating the baseline value of each diagnostic feature under normal conditions through mean operation, a healthy network baseline is constructed.

[0020] The parameters of each network element node in the target network are traversed, and a parameter is randomly selected as the parameter to be identified. The diagnostic features of the current time window are obtained to form a window feature sequence of the parameter to be identified.

[0021] Based on the window feature sequence and the health network baseline, the feature deviation is calculated by comparing the real-time value and the baseline value. The parameter deviation of the parameter to be identified is calculated by summing the feature deviations.

[0022] Call the deviation judgment threshold to perform baseline anomaly verification;

[0023] If the deviation of the parameter is greater than the deviation judgment threshold, the parameter to be identified is determined to be abnormal; otherwise, there is no abnormality.

[0024] Specifically, the steps of multi-channel parallel anomaly identification also include:

[0025] Traverse the network element nodes of the target network, take any network element node as the node to be identified, construct a multi-parameter time series, and combine it with the healthy network baseline to calculate the node deviation through Euclidean distance;

[0026] Obtain the associated nodes of the node to be identified, and retrieve the single-parameter anomaly judgment results of each associated node. Calculate the anomaly ratio of each associated node by the ratio of the number of abnormal parameters to the total number of parameters within the node.

[0027] Read the dependency weights between the node to be identified and each associated node, and calculate the anomaly propagation coefficient of the node to be identified by weighted summation of the anomaly ratios based on the dependency weights.

[0028] A node to be identified is determined to have multi-parameter collaborative anomalies only if the node deviation is not less than the node deviation threshold or the abnormal transmission coefficient is not less than the transmission threshold.

[0029] Calculate the log anomaly score and feedback anomaly score, and combine them with the joint anomaly weight to calculate the joint anomaly determination value;

[0030] If the joint anomaly determination value is greater than the joint determination baseline, then the node to be identified is determined to have a perception anomaly.

[0031] Based on the network element node identifiers, the anomalies identified in the target network are grouped and categorized to generate a preliminary anomaly list for the target network.

[0032] Specifically, the steps for generating a list of exception events include:

[0033] Iterate through each exception entry in the preliminary exception list and call the corresponding exception indicator;

[0034] Using the Sigmoid normalization algorithm, various abnormal indicators are converted into abnormal confidence scores;

[0035] Obtain historical normal and abnormal samples, and obtain the confidence filtering threshold through statistical analysis;

[0036] Remove anomaly entries with an anomaly confidence level lower than the confidence filtering threshold to construct a valid anomaly set;

[0037] Traverse the valid anomaly set. For each network element node, query all anomaly entries under the same time window. If there are two or more anomaly entries, it is determined to be a node association anomaly.

[0038] For node association anomalies, all anomaly entries of network element nodes under the same time window are merged into an anomaly entry of a single integrated network, and the main anomaly type is selected.

[0039] For any abnormal node, traverse the corresponding associated nodes and filter out the associated nodes that also have sequential anomalies, and record them as abnormal associated nodes.

[0040] If the abnormal associated node is related to the abnormal type of the abnormal node, it is determined to be a propagated associated abnormality, a source node is set, and the abnormal information is marked.

[0041] Specifically, the steps for generating a list of exception events also include:

[0042] Based on the merging and labeling of abnormal entries, the set of valid abnormalities is updated. For each abnormal entry in the set of valid abnormalities, the corresponding time series window is used as the initial abnormal window.

[0043] Based on the network element node corresponding to the abnormal entry, query the abnormal identification of the previous time series window. If the same abnormal type exists, the previous time series window is included in the initial abnormal window.

[0044] Repeat the forward query to merge all consecutive abnormal time windows and obtain the abnormal time windows;

[0045] For each abnormal item, the corresponding abnormal indicator and abnormal confidence level are retrieved. The abnormal confidence level is used as the weight of the abnormal indicator. Combined with weight normalization, the abnormal score of the abnormal item is calculated.

[0046] The abnormal entries are sorted in descending order based on their abnormality scores. If the abnormality scores are the same, they are sorted in descending order by the duration of the abnormal time window. All abnormal entries are then summarized to generate an abnormal event list.

[0047] Specifically, the steps for constructing a fault propagation graph include:

[0048] Based on the topology diagram of the target network and the dependency weights between network element nodes, a directed topology prior graph is constructed, and lower-level parameter nodes are added to each network element node.

[0049] Historical diagnostic data of each network element node is retrieved to construct a historical time-series feature sequence. Causal discovery algorithm is used to calculate the causal strength of each topological edge.

[0050] For all parameter nodes in a single network element node, the dependency strength between any two parameter nodes is calculated using conditional mutual information.

[0051] Set a dependency threshold, retain parameter pairs whose dependency strength is greater than the dependency threshold, and construct causal directed edges in the parameter layer;

[0052] For network element node pairs with abnormal propagation correlations, the fault conversion rate and fault propagation rate are calculated based on the causal strength of the node pairs, thereby generating a fault propagation graph.

[0053] Specifically, the steps for tracing the abnormal propagation path in reverse include:

[0054] The abnormal events in the abnormal event list are traversed one by one. Abnormal network element nodes and abnormal parameter nodes are matched with the fault propagation graph and marked as observed abnormal nodes. An abnormal weight is assigned to each observed abnormal node.

[0055] Based on the directed causal edges of the fault propagation graph, the causal direction is reversed to construct a reverse propagation topology;

[0056] Filter out the abnormal causal nodes of the observed abnormal nodes, and calculate the abnormal transition rate between each abnormal causal node and the observed abnormal node.

[0057] By normalizing all abnormal transition rates, the reverse transition probabilities from observed abnormal nodes to each abnormal causal node are obtained, and a reverse transition matrix is ​​constructed.

[0058] Using all observed abnormal nodes as walking nodes, the restart random walk algorithm is used to perform random walks along the inverse transition matrix. After multiple iterations, the steady-state access probability of each node in the fault propagation graph is obtained, which is used as the root cause initial score of the corresponding node.

[0059] Sort all nodes in descending order based on their initial root cause scores, retaining the top-ranked nodes. Each node serves as a root cause candidate node for the corresponding abnormal event, generating a root cause candidate set; among them, This is the default value.

[0060] Specifically, the steps for screening root cause diagnostic results include:

[0061] Iterate through each root cause entry in the root cause candidate set, extract the corresponding anomaly propagation path, and lock all nodes on the path;

[0062] Retrieve the diagnostic features of all nodes on the path within the abnormal time window, and calculate the feature deviation of each node in combination with the health network baseline.

[0063] Using the failure conversion rate as the weight, the node deviation of all nodes on the path is weighted and summed to calculate the full-link anomaly degree of the root cause item.

[0064] Using the initial root cause score, overall abnormality, and path integrity as confidence dimensions, the system calls the preset scoring weights to calculate the confidence score of the root cause item.

[0065] The root cause entry with the highest confidence score is taken as the root cause diagnosis result for the corresponding abnormal event.

[0066] Intelligent diagnostic and localization methods for the root causes of communication failures include:

[0067] Obtain the topology diagram of the target network, collect multidimensional data, and construct a diagnostic dataset through preprocessing;

[0068] The diagnostic dataset is classified, normalized, feature-extracted, and topologically associated with the data to generate diagnostic feature vectors.

[0069] Multi-channel parallel anomaly identification is performed on the diagnostic feature vector. Confidence filtering and correlation aggregation are performed on the anomalies identified in each channel to construct anomaly events. An anomaly event list is generated by summarizing the anomaly events.

[0070] Construct a fault propagation graph and label abnormal events;

[0071] Tracing the abnormal propagation path backward along the fault propagation graph, identifying the fault type, and generating a root cause candidate set by combining the located root cause node and root cause parameters, and then filtering the root cause diagnosis results by combining the deviation anomaly degree.

[0072] The beneficial effects of this invention are:

[0073] By collecting multi-source, multi-dimensional data and constructing features based on topology association, the limitations of relying solely on alarm data are avoided, providing a complete data and feature foundation for anomaly identification in alarm-free scenarios. Relying on a multi-channel parallel anomaly identification mechanism, silent faults such as performance degradation, configuration drift, and intermittent jitter in the network can be proactively captured without network management alarm triggering, realizing a shift in operation and maintenance mode from passive alarm response to proactive anomaly discovery. Simultaneously, a fault propagation graph is constructed through causal relationship learning based on topology constraints, combined with a reverse tracing algorithm to complete fault type identification and refined root cause localization. Unknown fault scenarios can be covered without manually pre-setting fault modes. Based on a negative sample learning mechanism using a healthy network baseline, anomaly quantification and root cause confidence calibration are completed by comparing real-time features with the normal state baseline, eliminating the reliance on manually set static thresholds. This allows for adaptive adaptation to dynamic changes in network operating status, significantly improving the comprehensiveness, accuracy, and timeliness of communication network fault handling, reducing the dependence on manual experience in operation and maintenance work, and effectively ensuring the stable operation of the communication network. Attached Figure Description

[0074] Figure 1 This is a structural diagram of an intelligent diagnostic and location system for the root causes of communication failures.

[0075] Figure 2 This is a flowchart of the multi-channel parallel anomaly identification process in this invention;

[0076] Figure 3 This is a flowchart illustrating the generation of an exception event list in this invention;

[0077] Figure 4 Flowchart of intelligent diagnosis and localization method for root cause of communication faults. Detailed Implementation

[0078] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0079] Example 1

[0080] refer to Figures 1 to 3 As shown in the figure, this embodiment introduces a communication fault root cause intelligent diagnosis and location system, including: a data acquisition module, a feature extraction module, an anomaly identification module, and a diagnosis module;

[0081] The data acquisition module is used to obtain the topology diagram of the target network through the network management interface of the target network. The topology diagram includes two parts: physical topology and logical topology. The physical topology includes network element nodes, communication links, port information and hierarchical relationships, while the logical topology includes VLAN division, VPN configuration and routing protocol connection relationships. Multidimensional data, including terminal communication data, operator network data and call detail records (CDRs), is collected in parallel from the terminal side, network side and service side of the target network. Supplementary data is also obtained based on operation logs and user feedback. The multidimensional data and supplementary data are preprocessed, including cleaning, deduplication, timestamp standardization and format unification, in order to construct a diagnostic dataset.

[0082] The feature extraction module is used to classify and organize the diagnostic dataset in units of a preset time-series window and in combination with network element nodes in the topology diagram. It integrates all parameter data of the same network element node within the current time-series window into a group, thereby generating several time-series diagnostic data streams. Each data stream contains a collection timestamp, data source, network element node identifier, parameter name, and parameter value. By performing feature extraction and topology association annotation on various parameters in the time-series diagnostic data stream, a diagnostic feature vector for a single network element node is generated. Among them, based on historical fault data, the shortest duration of the fault is used as the time-series window.

[0083] The anomaly identification module is used to perform multi-channel parallel anomaly identification on the diagnostic feature vector of each network element node, respectively detecting single-parameter anomalies, multi-parameter collaborative anomalies, and perception anomalies, so as to actively identify various anomalies in the target network. The anomalies identified by each channel are subjected to confidence filtering and correlation aggregation to eliminate redundant anomalies and merge related anomalies. The network element node and anomaly type are combined and encapsulated into an independent anomaly event. Each anomaly event includes anomaly type, network element node, anomaly time window, and anomaly score. All anomaly events are summarized to generate an anomaly event list, realizing the alarm-free proactive discovery of silent faults.

[0084] The diagnostic module learns the causal propagation relationships between network element nodes and within node parameters by analyzing the topology diagram and time-series diagnostic data stream of the target network. It constructs a fault propagation graph and marks abnormal events on the graph based on the network element nodes involved. Using neural network algorithms, such as a graph neural network with restarted random walks, it traces the abnormal propagation path backward along the fault propagation graph to identify the fault type, locate the root cause node and root cause parameters, and generate a root cause candidate set. The module compares the pre-constructed healthy network baseline with the real-time diagnostic features of each network element node, calculates the deviation from anomaly, and scores the confidence of the candidate results based on the deviation from anomaly to filter root cause diagnostic results, including fault type, root cause node, root cause parameters, confidence level, and propagation path.

[0085] Furthermore, the steps for generating the diagnostic feature vector of a single network element node include:

[0086] Iterate through each parameter in the time series diagnostic data stream and extract basic statistical features for the parameter values ​​within the current time series window, including arithmetic mean, variance, interquartile range, and extreme values.

[0087] For silent faults such as intermittent jitter and gradual performance degradation, the timestamp of the time-series diagnostic data stream is used as the horizontal axis and the parameter value is used as the vertical axis. The trend slope is fitted by linear regression as the trend feature of the corresponding parameter. At the same time, the coefficient of variation of each parameter is calculated based on the ratio of the parameter standard deviation to the arithmetic mean as the fluctuation feature.

[0088] The basic statistical characteristics, trend characteristics, and fluctuation characteristics of each parameter are integrated as diagnostic characteristics of each parameter in a single network element node. At the same time, the diagnostic characteristics of all parameters in the network element node are integrated to generate a set of statistical characteristics of a single network element node.

[0089] Based on the topology diagram of the target network, the statistical feature set is bound to the corresponding network element node. At the same time, according to the standard hierarchical division of communication networks, the network layer to which the network element node belongs is marked, including terminal layer, access layer, transmission layer, core layer, and service layer. The marking logic is set by those skilled in the art based on the actual architecture of the target network.

[0090] Traverse the connection relationships of network element nodes in the topology diagram and mark the dependency relationships between the current node and its upstream and downstream related nodes; among them, the related nodes and the current network element node have actual physical transmission channels or logical signaling interaction channels, and the dependency relationships include transmission dependency and signaling dependency;

[0091] Given any two network element nodes with a connection, obtain their corresponding network layers and calculate the network layer distance between them. Use the reciprocal of this distance as the dependency weight of the topological edge between the two nodes. Specifically, if the two network element nodes belong to the same network layer, the corresponding layer distance is 1; if they are separated by one layer, the layer distance is 2, and so on. If there are 1 level, then the level distance is... The connecting edge is the topological edge between two network element nodes;

[0092] The network element node's network layer, associated nodes, and corresponding dependencies and dependency weights are bound to the corresponding statistical feature set, and the statistical feature set is normalized to generate a diagnostic feature vector.

[0093] Furthermore, the steps of performing multi-channel parallel anomaly identification on the diagnostic feature vector of each network element node one by one include:

[0094] Historical normal operation data without faults, alarms, or user complaints is filtered from the target network. The data is then split into dimensions based on individual network element nodes and individual parameters. Using parameters as units, the baseline value of each diagnostic feature under normal conditions is calculated through mean operation. This constructs a healthy network baseline. That is, each parameter under each network element node corresponds to a complete set of baseline diagnostic feature values, including baseline mean, baseline variance, baseline interquartile range, baseline extreme value, baseline trend feature, and baseline fluctuation feature. The baseline extreme value is the maximum or minimum value of all extreme values.

[0095] For each network element node, a parameter is randomly selected as the parameter to be identified, and the diagnostic features of the current time series window are obtained to form a window feature sequence of the parameter to be identified.

[0096] The window feature sequence is compared one by one with the corresponding baseline value of the same network element node and the same parameter in the health network baseline. Based on the relative deviation between the real-time value and the baseline value, the feature deviation is calculated. Min-Max normalization is performed on each feature deviation of a single parameter to eliminate dimensional differences. Fixed weights are assigned according to the sensitivity of the feature to the representation of silent faults. The higher the sensitivity of the feature to the representation of silent faults, the larger the fixed weight is assigned. For example, the weight of trend slope deviation is 0.4, the weight of mean deviation is 0.2, the weight of variance deviation is 0.15, the weight of interquartile range deviation is 0.1, the weight of extreme value deviation is 0.05, and the weight of coefficient of variation deviation is 0.1. The parameter deviation of the parameter to be identified is calculated by weighted summation of the feature deviations.

[0097] The system calls a preset deviation judgment threshold and compares it with the parameter deviation to perform baseline anomaly verification. If the parameter deviation is greater than the deviation judgment threshold, it indicates that the parameter to be identified is abnormal and is marked as abnormal. If the parameter deviation is not greater than the deviation judgment threshold, it indicates that the parameter to be identified is not abnormal. Among them, based on the single parameter feature deviation distribution of historical normal samples of the target network, the 95th percentile value is taken as the deviation judgment threshold to cover 95% of normal operation samples, and judge the low probability abnormal fluctuation samples as abnormal, which is suitable for the needs of silent fault identification in communication networks.

[0098] For example, with the following packet loss rate as the parameter to be identified, the basic statistical characteristics are 0.33%, 0.021%, 0.23%, and 0.52%, respectively, and the corresponding baseline values ​​are 0.12%, 0.03%, 0.08%, and 0.2%, respectively. The trend slope is 0.092, and the corresponding baseline value is 0.005. The coefficient of variation is 0.0438, and the corresponding baseline value is 0.25.

[0099] The deviation from the mean is variance deviation is The deviations are: interquartile range 1.875, extreme values ​​1.45, trend slope 17.4, and coefficient of variation 0.752.

[0100] After performing Min-Max normalization on various deviations, the final deviations are 0.58, 0.3, 0.63, 0.58, 0.87, and 0.5, respectively. Combined with the configured fixed weights, the resulting parameter deviations are... ;

[0101] Perform single-parameter anomaly judgment on all parameters in the network element node in sequence, and generate single-parameter anomaly entries for the abnormal parameters, including the network element node to which they belong, the name of the abnormal parameter, and the anomaly type;

[0102] Traverse the network element nodes in the target network, take any network element node as the node to be identified, extract the diagnostic features of all parameters in the current time window for all parameters of the node to be identified, and construct a multi-parameter time series sequence;

[0103] Based on the multi-parameter time series of the node to be identified, the parameter deviation of each parameter in the node to be identified is calculated. The parameter deviation of all parameters in the same node to be identified is normalized to construct a node feature sequence for the node to be identified. The node feature sequence is compared one by one with the corresponding benchmark value of the same network element node in the healthy network baseline. Based on the relative deviation between the real-time value and the benchmark value, the node deviation between the multi-parameter time series and the benchmark value of the node to be identified is calculated through Euclidean distance, which characterizes the degree to which the overall operating status of the node to be identified deviates from the healthy baseline.

[0104] Obtain the associated nodes of the node to be identified, and retrieve the single-parameter anomaly determination results of each associated node. Calculate the anomaly ratio of each associated node by the ratio of the number of anomaly parameters to the total number of parameters within the node. For example, if an associated node includes 8 monitoring parameters, and 3 of them are determined to be single-parameter anomalies, then the anomaly ratio is: ;

[0105] Read the dependency weights between the node to be identified and each associated node, and calculate the anomaly propagation coefficient of the node to be identified by weighted summation of the anomaly ratios based on the dependency weights.

[0106] The system invokes preset node deviation thresholds and propagation thresholds to determine collaborative anomalies. If the node deviation is less than the node deviation threshold and the anomaly propagation coefficient is less than the propagation threshold, the node to be identified is determined to be free of multi-parameter collaborative anomalies. If the node deviation is not less than the node deviation threshold or the anomaly propagation coefficient is not less than the propagation threshold, the node to be identified is determined to be free of multi-parameter collaborative anomalies, thereby generating collaborative anomaly entries, including abnormal network element nodes and anomaly types. The node deviation threshold and propagation threshold are set by those skilled in the art based on the actual situation of the target network. For example, the node deviation threshold is the 95th percentile of the historical normal sample node deviation distribution, and the propagation threshold is the 50th percentile of the historical fault sample propagation coefficient distribution.

[0107] For the node to be identified, log data containing multiple independent log records within the current time series window is extracted. Abnormal logs are filtered out using preset abnormal log filtering rules. The log abnormality is calculated by the ratio of the number of abnormal logs to the total number of logs in the current time series window. The abnormal log filtering rules are set by those skilled in the art based on actual log data. For example, log records containing fault keywords such as "error" or "fail", or logs marked with the level ERROR, WARN, or CRITICAL, are considered abnormal logs.

[0108] The system acquires user feedback data within the current time window, filters abnormal feedback according to preset abnormal feedback filtering rules, and calculates the feedback abnormality level by the ratio of the number of abnormal feedbacks to the total number of feedbacks in the current time window. The abnormal feedback filtering rules are set by those skilled in the art based on actual feedback data. For example, feedback containing user feedback text containing user feedback with degraded experience keywords such as network lag, frequent disconnections, no network signal, slow loading, high latency, and connection failure is considered abnormal feedback.

[0109] The preset joint anomaly weights are invoked to perform weighted calculations on the log anomaly degree and the feedback anomaly degree to calculate the joint anomaly judgment value. Among them, historical fault samples of the target network are obtained, and the Pearson correlation coefficients of the log anomaly degree and the feedback anomaly degree with the actual perceived anomaly are calculated respectively. The joint anomaly weights are obtained by normalizing the correlation coefficients.

[0110] If the joint judgment baseline is invoked and the joint anomaly judgment value is greater than the joint judgment baseline, the node to be identified is determined to have a perception anomaly, thereby generating a perception anomaly entry, including the current window log data, user feedback data, joint anomaly judgment value, and anomaly type; where the joint judgment baseline is the 95th percentile of the distribution of joint anomaly judgment values ​​of historical normal samples;

[0111] Integrate all anomalies identified under the same network element node, group and classify the anomalies identified in the target network according to the network element node identifier, and generate a preliminary anomaly list of the target network.

[0112] Furthermore, the steps for generating a list of exceptional events include:

[0113] Iterate through each exception entry in the preliminary exception list and call the corresponding exception indicator; among them, the exception indicator for single-parameter exceptions is parameter deviation, the exception indicators for multi-parameter collaborative exceptions are node deviation and exception propagation coefficient, and the exception indicator for perceived exceptions is joint exception judgment value.

[0114] Using the Sigmoid normalization algorithm, various anomaly indicators are converted into anomaly confidence scores for corresponding anomaly entries. For multi-parameter collaborative anomalies, based on historical fault samples in the target network, the Pearson correlation coefficient is used to statistically determine the fault contribution of node deviation and anomaly propagation coefficient to multi-parameter collaborative anomalies. After normalization, collaborative fusion weights are obtained. Node deviation and anomaly propagation coefficient are weighted and fused, and the fused value is then subjected to Sigmoid normalization.

[0115] Obtain historical normal and abnormal samples, calculate the abnormal confidence distribution, and obtain the confidence filtering threshold through the intersection of the two sample distributions;

[0116] If the anomaly confidence level of an anomaly entry is less than the confidence filtering threshold, the current anomaly entry is determined to be a disruptive invalid anomaly and is removed; if the anomaly confidence level is not less than the confidence filtering threshold, it is retained as a valid anomaly entry.

[0117] Integrate all valid exception entries to construct a valid exception set;

[0118] Traverse the valid anomaly set. For each network element node, query all anomaly entries under the same time window. If there are two or more anomaly entries, it is determined to be a node association anomaly.

[0119] For node association anomalies, all anomaly entries of network element nodes under the same time window are merged into a comprehensive network element anomaly entry. All anomaly types and anomaly parameters (including single anomaly parameters or parameter groups in network element nodes) are retained. At the same time, based on the causal strength and temporal sequence, the anomaly type that occurs first in time and has the highest causal strength to other anomalies is determined as the main anomaly type, i.e. the root cause anomaly. If the temporal sequence and causal relationship cannot be determined, the anomaly type with the highest anomaly confidence is selected as the main anomaly type, which facilitates the subsequent determination of the consistency of anomaly types.

[0120] Each network element node is traversed to perform multi-channel parallel anomaly identification. The network element node that is identified as abnormal is defined as an abnormal node. For any abnormal node, the corresponding associated nodes are traversed, and associated nodes that also have continuous time-series anomalies are selected and recorded as abnormal associated nodes. Among them, continuous time-series anomalies refer to the abnormal time-series windows of the abnormal associated nodes and the abnormal time-series windows of the abnormal nodes being adjacent time-series windows, and the abnormal state persisting within the continuous time-series windows.

[0121] If the abnormal associated node is related to the abnormal type of the abnormal node, that is, there is a single parameter abnormality in the previous time series window and a multi-parameter collaborative abnormality in the next time series window, then it is determined to be a propagation associated abnormality.

[0122] For transmission-related anomalies, the upstream node is taken as the source node, that is, the node corresponding to the previous time series window, and the corresponding anomaly entry is taken as the main entry. The anomaly information of non-source nodes is marked in the main entry.

[0123] Based on the merging and labeling of abnormal entries, the set of valid abnormalities is updated. For each abnormal entry in the set of valid abnormalities, the corresponding time sequence window is used as the initial abnormal window, and the start time and end time are extracted. The merging of abnormal entries refers to the merging of multiple abnormal entries of node-related abnormalities, and the labeling of abnormal entries refers to the labeling of abnormal information of the source node and non-source node of the propagating related abnormalities.

[0124] Based on the network element node corresponding to the abnormal entry, query the abnormal identification of the previous time series window. If the same abnormal type exists, the previous time series window is included in the initial abnormal window. If it is a propagated related abnormality, the same type is determined based on the main abnormality type.

[0125] Repeat the forward query, merge all consecutive abnormal time windows, and obtain the final abnormal time window;

[0126] For each abnormal entry, the corresponding abnormal indicator and abnormal confidence level are retrieved. The abnormal confidence level is used as the weight of the abnormal indicator. All abnormal confidence levels in the abnormal entry are weighted and normalized. The abnormal score of the abnormal entry is calculated by weighted summation of each abnormal indicator and its corresponding normalized weight. If there is only one type of abnormality in the abnormal entry, the weight obtained after weight normalization of the abnormal confidence level is 1. In this case, the abnormal score is the abnormal indicator value.

[0127] The abnormal entries are sorted in descending order based on their abnormality scores. If the abnormality scores are the same, they are sorted in descending order by the duration of the abnormal time window. All abnormal entries are then summarized to generate an abnormal event list.

[0128] Furthermore, the steps for constructing a fault propagation graph include:

[0129] Based on the topology of the target network and the dependency weights between network element nodes, a directed topology prior graph is constructed; where nodes in the directed topology prior graph are network element nodes, edges are the dependencies between network element nodes, and edge weights are the corresponding dependency weights.

[0130] Based on the directed topology prior graph, a lower-level parameter node is added to each network element node, that is, the parameters corresponding to the network element node are connected to the corresponding network element node in the form of child nodes, forming a two-layer structure graph of network element layer-parameter layer.

[0131] Based on the constructed health network baseline, the feature distribution under normal conditions is labeled for each node (including network element nodes and parameter nodes);

[0132] Historical diagnostic data from each network element node is retrieved. For the diagnostic feature vector of each time window, a historical time-series feature sequence is constructed. Causal discovery algorithms, such as the PCMCI time-series causal discovery algorithm, are used to adapt to causal identification of nonlinear time-series data in communication networks, avoiding spurious causality caused by transient correlations. Using the edges of the topological prior dependency graph as constraints, the causal propagation relationship between network element nodes is learned to obtain the causal strength of each topological edge. Topological edges with causal strength below a preset threshold or without causal data support are removed. Data is added to verify the existence of latent causal edges, i.e., two network element nodes whose calculated causal strength is not less than the preset threshold but do not have a topological edge. The preset threshold for causal strength is the statistical significance level. The critical value for causal strength is 0.05. When the causal strength is greater than or equal to this critical value, the corresponding p-value is ≤0.05, indicating that there is a statistically significant causal relationship between the nodes. The authenticity of implicit causal edges is verified by Granger causality test to confirm that there is a sequential causal relationship between the abnormal timing of the two nodes, such as the first abnormal node being the cause and the second abnormal node being the effect. It is confirmed that there is a physical / logical fault propagation path between the two nodes, such as belonging to the same base station cluster, the same end-to-end transmission link, and having a signaling interaction relationship. It is confirmed that the node pair has a clear propagation record in historical fault cases. Among them, the topology prior dependency graph is constructed based on the physical topology of the target network and the communication connection relationship between network elements.

[0133] For all parameter nodes in a single network element node, call the historical time series feature sequence of the corresponding network element node, and use conditional mutual information, such as histogram estimation method, to calculate the dependency strength between any two parameter nodes.

[0134] A dependency threshold is set to retain parameter pairs with dependency strength greater than the threshold. At the same time, the causal propagation direction between parameters is determined by combining the temporal sequence relationship and Granger causality check, and causal directed edges are constructed in the parameter layer. The dependency strength is used as the edge weight of the causal directed edges. The dependency threshold is calibrated by those skilled in the art based on the statistical analysis of historical data. Based on the historical distribution of conditional mutual information between parameter nodes, the 75th percentile value is taken as the dependency threshold. The reason is that the median will retain too many weak associations and is prone to introducing false causality, while the 90th percentile is too strict and will lose some effective dependencies of real faults. The 75th percentile takes into account the noise filtering capability and the sensitivity of the identification of effective causal relationships, and is suitable for the silent fault identification scenario of communication network.

[0135] For network element node pairs with abnormal propagation correlation Calling network element nodes to The causal strength is obtained, and the network element nodes are acquired simultaneously. The anomaly score and the preset anomaly baseline threshold are used to obtain the network element node by multiplying the ratio of the anomaly score to the anomaly baseline threshold by the causality strength. to The failure conversion rate characterizes the probability that an anomaly in the source node will trigger anomalies in downstream affected nodes; among which, As the source node, For downstream affected nodes; among them, the abnormal baseline threshold is the 95th percentile of the abnormal score of historical normal samples in the healthy network baseline. The ratio of the abnormal score to the abnormal baseline threshold needs to be truncated, and the maximum value is limited to 1 to ensure that the fault conversion rate is within the range of [0,1].

[0136] Calling network element nodes The node deviation is calculated, and the pre-defined topology coefficients in the network hierarchy are obtained. The network element node is calculated by multiplying the fault conversion rate, node deviation, and topology coefficients. to The fault propagation rate is calculated, and the fault conversion rate and fault propagation rate are marked on the directed topology prior graph to generate a fault propagation graph. The topology coefficients are set according to the fault propagation sensitivity of the network layer. For example, the terminal layer is 1.0, the access layer is 0.8, the transport layer is 0.6, the core layer is 0.4, and the service layer is 0.5.

[0137] Furthermore, the steps to trace the abnormal propagation path in reverse include:

[0138] Each abnormal event in the abnormal event list is traversed one by one. The abnormal network element node and abnormal parameter node corresponding to the abnormal event are matched with the corresponding node in the fault propagation graph and marked as the observed abnormal node, which serves as the starting point for reverse tracing.

[0139] Based on the product of the anomaly score and the anomaly confidence level of the anomaly event, anomaly weights are assigned to each observed anomaly node, and a time series constraint is set as an anomaly time window to lock the time series analysis range of reverse tracing.

[0140] Based on the directed causal edges of the fault propagation graph, the causal direction is reversed to construct a reverse propagation topology, i.e., the cause-effect edge is... This indicates that the fault originated from spread to The reverse edge is This indicates that the tracing direction starts from the abnormal node. Return to the root cause node ;

[0141] In the fault propagation graph, other nodes that have a causal relationship with the observed abnormal node are queried and recorded as abnormal causal nodes.

[0142] The failure transition rate from the abnormal causal node to the observed abnormal node is multiplied by the abnormal weight of the abnormal causal node to obtain the abnormal transition rate between the abnormal causal node and the observed abnormal node. By normalizing the abnormal transition rates of all abnormal causal nodes, the reverse transition probability from the observed abnormal node to each abnormal causal node is obtained, so that the sum of all reverse transition probabilities of the same observed abnormal node is 1. At the same time, the reverse transition probabilities of all observed abnormal nodes in the same abnormal event are integrated to construct the reverse transition matrix.

[0143] Using all observed anomalous nodes as walk nodes, the node access probability distribution is initialized. The sum of the initial access probabilities of all observed anomalous nodes is 1. The initial access probability of a single observed anomalous node is the ratio of the node's anomalous weight to the sum of the anomalous weights of all observed anomalous nodes in the current anomalous event. The initial access probability of other non-observed anomalous nodes is 0. The restart random walk algorithm is used to perform a random walk along the inverse transition matrix. At the same time, walk constraints are set, such as setting the restart probability to 0.15 and the maximum number of walk steps not exceeding the maximum number of levels in the network topology to avoid the walk exceeding the reasonable range of fault propagation. The maximum number of iterations is set to 1000 times to meet the convergence requirements of the communication network topology. The Euclidean distance between the node access probability distributions of two consecutive iterations is less than 1e-6, which is considered convergence.

[0144] After multiple iterations, the steady-state access probability of each node in the fault propagation graph is obtained, which serves as the initial root cause score for the corresponding node.

[0145] Sort all nodes in descending order based on their initial root cause scores, retaining the top-ranked nodes. Each node serves as a root cause candidate node for the corresponding abnormal event. Simultaneously, each root cause candidate node is matched with its corresponding abnormal propagation path, associated abnormal parameters, and network element level information to encapsulate each root cause candidate node, forming a root cause entry, thereby generating a root cause candidate set. The maximum number of levels in the target network topology is set to twice to fully cover the forward, cross-level, and backward propagation paths of the fault along the topology levels, while avoiding excessive latency. For example, setting the maximum number of levels to three would increase computational latency. For instance, if the maximum number of levels in the target network is three, the computational latency would be significantly higher. Take 6.

[0146] Furthermore, the steps for screening root cause diagnostic results include:

[0147] Traverse each root cause entry in the root cause candidate set, extract the corresponding abnormal propagation path, lock all nodes on the path, retrieve the diagnostic features of all nodes on the path within the abnormal time window, and calculate the feature deviation of each node in combination with the healthy network baseline; if it is a parameter node, calculate the parameter deviation, and if it is a network element node, calculate the node deviation.

[0148] Using the failure conversion rate as the weight, the node deviation of all nodes on the path is weighted and summed to calculate the full-link anomaly degree of the root cause item.

[0149] Using the initial root cause score, full-link anomaly degree, and path integrity as confidence dimensions, a weighted sum of the confidence dimensions is applied using preset scoring weights to calculate the confidence score of each root cause item. The root cause item with the highest confidence score is taken as the root cause diagnosis result for the corresponding abnormal event. Specifically, the proportion of observed abnormal nodes in the abnormal propagation path is calculated among all nodes, and the natural logarithm of the total number of path nodes is taken. The ratio of this proportion to the natural logarithm is used as the path integrity. The scoring weights are based on historical fault diagnosis sample data of the target network. The Pearson correlation coefficient method is used to calculate the correlation contribution between each confidence dimension and the actual fault root cause location result. After normalization, the weights are assigned. The initial root cause score and full-link anomaly degree are the core judgment dimensions for root cause location, contributing more to fault tracing. Path integrity is an auxiliary verification dimension, and the corresponding scoring weights are set to 0.4, 0.4, and 0.2, respectively.

[0150] Example 2

[0151] Please see Figure 4 Another embodiment of the present invention provides a method for intelligent diagnosis and localization of communication fault root causes, comprising the following steps:

[0152] Obtain the topology diagram of the target network, collect multidimensional data in parallel from the terminal side, network side and service side of the target network, including terminal communication data, operator network data and call detail records, and obtain supplementary data based on operation logs and user feedback. Perform preprocessing on the multidimensional data and supplementary data, including cleaning, deduplication, timestamp standardization and format unification, to construct a diagnostic dataset.

[0153] Using a preset time window as a unit and combining the network element nodes in the topology diagram, the diagnostic dataset is classified and organized to generate several time-series diagnostic data streams. Through feature extraction and topology association annotation, a diagnostic feature vector for a single network element node is generated.

[0154] Multi-channel parallel anomaly identification is performed on the diagnostic feature vector of each network element node one by one to identify various anomalies in the target network. Confidence filtering and correlation aggregation are performed on the anomalies identified by each channel to construct anomaly events. An anomaly event list is generated by summarizing the anomaly events.

[0155] Construct a fault propagation graph and mark the abnormal events on the fault propagation graph according to the network element nodes of the abnormal events;

[0156] By using a neural network algorithm, the abnormal propagation path is traced backward along the fault propagation graph to identify the fault type, locate the root cause node and root cause parameters, and generate a root cause candidate set.

[0157] The pre-built health network baseline is compared with the real-time diagnostic features of each network element node to calculate the deviation anomaly. The confidence score of the candidate results is then calculated based on the deviation anomaly to screen the root cause diagnosis results.

[0158] Working principle and effects:

[0159] A diagnostic dataset is constructed by collecting and preprocessing multi-source data from the terminal, network, and service sides. Combined with network topology and regularized according to time-series windows, a network element-level time-series diagnostic data stream and diagnostic feature vector are generated. Relying on a multi-channel parallel anomaly identification mechanism, single-parameter, multi-parameter collaborative, and perception-type anomalies can be proactively detected without network management alarm triggering. After confidence filtering and correlation merging, a standardized list of abnormal events is generated, which addresses the root cause of silent faults such as performance degradation, configuration drift, and intermittent jitter that are not included in the analysis, thus achieving proactive fault discovery. Based on the topology and time-series data, a fault propagation graph is constructed by learning causal propagation relationships. Using abnormal events as anchor points, the propagation path is traced backward. Combined with the healthy network baseline, the anomaly degree is quantified to complete root cause calibration and accurate location. This eliminates the dependence on manual thresholds and preset fault modes, adapts to dynamic network changes, and significantly improves fault handling efficiency and network operation and maintenance stability.

[0160] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A communication fault root cause intelligent diagnosis and location system, characterized in that, include: The module includes a data acquisition module, a feature extraction module, an anomaly detection module, and a diagnostic module. The acquisition module obtains a topology diagram containing network element nodes, communication links, hierarchical relationships, and port information through the network management interface of the target network, and performs multi-dimensional data acquisition. Through preprocessing, a diagnostic dataset is constructed. The feature extraction module is used to classify and regularize the diagnostic dataset, generate a time-series diagnostic data stream, extract features and perform topological association annotation on the time-series diagnostic data stream, and construct a diagnostic feature vector. The anomaly identification module is used to perform multi-channel parallel anomaly identification on the diagnostic feature vector, and to perform confidence filtering and correlation aggregation on the anomalies identified in each channel to generate an anomaly event list. The diagnostic module is used to construct a fault propagation graph and mark abnormal events in the fault propagation graph. Through a neural network algorithm, it traces the abnormal propagation path backward along the fault propagation graph to identify the fault type. Combining the located root cause nodes and root cause parameters, it generates a root cause candidate set and filters the root cause diagnosis results by calculating the deviation anomaly degree.

2. The intelligent diagnostic and location system for communication fault root causes according to claim 1, characterized in that, The steps for constructing diagnostic feature vectors include: Traverse each parameter in the time-series diagnostic data stream and extract basic statistical features; Using timestamps as the horizontal axis and parameter values ​​as the vertical axis, the trend slope is fitted through linear regression, and the coefficient of variation of each parameter is calculated to obtain trend characteristics and fluctuation characteristics. The basic statistical features, trend features, and fluctuation features of each parameter are integrated as diagnostic features to generate a set of statistical features, which are then bound to the corresponding network element nodes to mark the network level and the dependency relationship with related nodes. Based on any two network element nodes that are connected, obtain the corresponding network level, and calculate the dependency weight of the topological edge between network element nodes through the distance between the network levels. The network element node's network layer, associated nodes, and corresponding dependencies and dependency weights are bound to the corresponding statistical feature set, and the statistical feature set is normalized to generate a diagnostic feature vector.

3. The intelligent diagnostic and location system for communication fault root causes according to claim 2, characterized in that, The steps of multi-channel parallel anomaly identification include: By filtering historical normal operation data of the target network and calculating the baseline value of each diagnostic feature under normal conditions through mean operation, a healthy network baseline is constructed. The parameters of each network element node in the target network are traversed, and a parameter is randomly selected as the parameter to be identified. The diagnostic features of the current time window are obtained to form a window feature sequence of the parameter to be identified. Based on the window feature sequence and the health network baseline, the feature deviation is calculated by comparing the real-time value and the baseline value. The parameter deviation of the parameter to be identified is calculated by summing the feature deviations. Call the deviation judgment threshold to perform baseline anomaly verification; If the deviation of the parameter is greater than the deviation judgment threshold, the parameter to be identified is determined to be abnormal; otherwise, there is no abnormality.

4. The intelligent diagnostic and location system for communication fault root causes according to claim 3, characterized in that, The steps of multi-channel parallel anomaly identification also include: The network element nodes of the target network are traversed and sequentially identified as nodes to be identified. A multi-parameter time series is constructed, and the node deviation is calculated in combination with the healthy network baseline. Obtain the associated nodes of the node to be identified, and calculate the anomaly ratio of each associated node based on the single-parameter anomaly judgment result of the associated nodes; Read the dependency weights between the node to be identified and each associated node, sum the anomaly ratios by weight, and calculate the anomaly propagation coefficient of the node to be identified. A node to be identified is determined to have multi-parameter collaborative anomalies only if the node deviation is not less than the node deviation threshold or the abnormal transmission coefficient is not less than the transmission threshold. Calculate the log anomaly score and feedback anomaly score, and combine them with the joint anomaly weight to calculate the joint anomaly determination value; If the joint anomaly determination value is greater than the joint determination baseline, then the node to be identified is determined to have a perception anomaly. Based on the network element node identifiers, the anomalies identified in the target network are grouped and categorized to generate a preliminary anomaly list for the target network.

5. The intelligent diagnostic and location system for communication fault root causes according to claim 4, characterized in that, The steps to generate a list of exception events include: Iterate through each exception entry in the preliminary exception list and call the corresponding exception indicator; Using the Sigmoid normalization algorithm, various abnormal indicators are converted into abnormal confidence scores; The confidence filtering threshold is obtained through statistical analysis of historical normal and abnormal samples. Remove anomaly entries with an anomaly confidence level lower than the confidence filtering threshold to construct a valid anomaly set; Traverse the valid anomaly set. For each network element node, query all anomaly entries under the same time window. If there are two or more anomaly entries, it is determined to be a node association anomaly. For node association anomalies, all anomaly entries of network element nodes under the same time window are merged, and the main anomaly type is selected. For any abnormal node, traverse the corresponding associated nodes, filter out the associated nodes that have sequentially consecutive abnormalities, and record them as abnormal associated nodes. If the abnormal associated node is related to the abnormal type of the abnormal node, it is determined to be a propagated associated abnormality, a source node is set, and the abnormal information is marked.

6. The intelligent diagnostic and location system for communication fault root causes according to claim 5, characterized in that, The steps for generating a list of exception events also include: Based on the merging and labeling of abnormal entries, the set of valid abnormalities is updated. For each abnormal entry in the set of valid abnormalities, the corresponding time series window is used as the initial abnormal window. Based on the network element node corresponding to the abnormal entry, query the abnormal identification of the previous time series window. If the same abnormal type exists, the previous time series window is included in the initial abnormal window. Repeat the forward query to merge all consecutive abnormal time windows and obtain the abnormal time windows; For each abnormal item, the corresponding abnormal indicator and abnormal confidence level are retrieved. The abnormal confidence level is used as the weight of the abnormal indicator. Combined with weight normalization, the abnormal score of the abnormal item is calculated. The abnormal entries are sorted in descending order based on their abnormality scores. If the abnormality scores are the same, they are sorted in descending order by the duration of the abnormal time window. All abnormal entries are then summarized to generate an abnormal event list.

7. The intelligent diagnostic and location system for communication fault root causes according to claim 6, characterized in that, The steps to construct a fault propagation graph include: Based on the topology diagram of the target network and the dependency weights between network element nodes, a directed topology prior graph is constructed, and lower-level parameter nodes are added to each network element node. Historical diagnostic data of each network element node is retrieved to construct a historical time-series feature sequence. Causal discovery algorithm is used to calculate the causal strength of each topological edge. For all parameter nodes in a single network element node, the dependency strength between any two parameter nodes is calculated using conditional mutual information. Set a dependency threshold, retain parameter pairs whose dependency strength is greater than the dependency threshold, and construct causal directed edges in the parameter layer; For network element node pairs with abnormal propagation correlations, the fault conversion rate and fault propagation rate are calculated based on the causal strength of the node pairs, thereby generating a fault propagation graph.

8. The intelligent diagnostic and location system for communication fault root causes according to claim 7, characterized in that, The steps to trace the abnormal propagation path in reverse include: Iterate through the abnormal events in the abnormal event list, filter the observed abnormal nodes, and assign an abnormal weight to each observed abnormal node; Based on the directed causal edges of the fault propagation graph, the causal direction is reversed to construct a reverse propagation topology; Filter out the abnormal causal nodes of the observed abnormal nodes, and calculate the abnormal transition rate between each abnormal causal node and the observed abnormal node. Normalize all abnormal transition rates to obtain reverse transition probabilities, and construct a reverse transition matrix; Using all observed abnormal nodes as walking nodes, the restart random walk algorithm is used to perform random walks along the inverse transition matrix. After multiple iterations, the steady-state access probability of each node in the fault propagation graph is obtained, which is used as the root cause initial score of the corresponding node. Sort all nodes in descending order based on their initial root cause scores, retaining the top-ranked nodes. Each node serves as a root cause candidate node for the corresponding abnormal event, generating a root cause candidate set; among them, This is the default value.

9. The intelligent diagnostic and location system for communication fault root causes according to claim 8, characterized in that, The steps for screening root cause diagnostic results include: Iterate through each root cause entry in the root cause candidate set, extract the corresponding anomaly propagation path, and lock all nodes on the path; Retrieve the diagnostic features of all nodes on the path within the abnormal time window, and calculate the feature deviation of each node in combination with the health network baseline. Using the failure conversion rate as the weight, the node deviation of all nodes on the path is weighted and summed to calculate the full-link anomaly degree of the root cause item. Using the initial root cause score, overall abnormality, and path integrity as confidence dimensions, the system calls the preset scoring weights to calculate the confidence score of the root cause item. The root cause entry with the highest confidence score is taken as the root cause diagnosis result for the corresponding abnormal event.

10. A method for intelligent diagnosis and localization of communication fault root causes, implemented based on the intelligent diagnosis and localization system for communication fault root causes as described in any one of claims 1-9, characterized in that, include: Obtain the topology diagram of the target network, collect multidimensional data, and construct a diagnostic dataset through preprocessing; The diagnostic dataset is classified, normalized, feature-extracted, and topologically associated with the data to generate diagnostic feature vectors. Multi-channel parallel anomaly identification is performed on the diagnostic feature vector. Confidence filtering and correlation aggregation are performed on the anomalies identified in each channel to construct anomaly events. An anomaly event list is generated by summarizing the anomaly events. Construct a fault propagation graph and label abnormal events; Tracing the abnormal propagation path backward along the fault propagation graph, identifying the fault type, and generating a root cause candidate set by combining the located root cause node and root cause parameters, and then filtering the root cause diagnosis results by combining the deviation anomaly degree.

Images