Model training method, root cause determination method, device, equipment and storage medium

Abstract

The present application discloses a model training method, a root cause location method, an apparatus, a device and a storage medium. The model training method includes: inputting feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurs in a set system that integrates multiple microservices; the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices and devices; based on the first root cause corresponding to each first abnormal event and the corresponding calibrated root cause, updating the model parameters of the root cause detection model.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a model training method, a root cause location method, an apparatus, a device, and a storage medium. Background Art

[0002] With the development of computer technology, more and more technologies, such as blockchain, big data, and distributed technologies, are being applied in the financial field. The traditional financial industry is gradually transforming into financial technology. However, due to the security and real-time requirements of the financial industry, financial technology also places higher demands on technology. In the field of financial technology, when an abnormal event occurs in a microservice system that integrates multiple microservices, the root cause of the abnormal event is determined by the root cause detection rules pre-set in the expert system, or the root cause corresponding to the abnormal event is predicted by the trained neural network model. However, in related technologies, the root cause detection rules in the expert system do not match the abnormal events that may occur in the microservice system, or the accuracy of the trained neural network model is low, resulting in a low accuracy of the determined root cause. Summary of the Invention

[0003] In view of this, the embodiments of the present application provide a model training method, a root cause location method, an apparatus, a device, and a storage medium to solve the technical problem of low accuracy of the root cause determined in the related art.

[0004] To achieve the above objectives, the technical solution of this application is implemented as follows:

[0005] The present invention provides a model training method, including:

[0006] Inputting feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; and the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices, and devices;

[0007] Based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event, the model parameters of the root cause detection model are updated.

[0008] In the above solution, the method further includes:

[0009] Determining first information corresponding to the first abnormal event based on a business flow log corresponding to the first abnormal event; the first information at least represents the microservice corresponding to the first abnormal event, the third-party organization, the first subsystem called by the microservice, and the second subsystem and server related to the first subsystem;

[0010] Determining, based on the device deployment log, second information of a server related to the first subsystem; wherein the second information at least represents a host machine, a network area, and a network device corresponding to the server;

[0011] Determining alarm information related to the first abnormal event based on the alarm log corresponding to the first abnormal event;

[0012] Based on the business indicators corresponding to the first abnormal event, the microservices corresponding to the business indicators, and the determined first information, second information, and alarm information, a heterogeneous graph corresponding to the first abnormal event is constructed.

[0013] In the above solution, the characteristic information of the heterogeneous graph includes at least one of the following:

[0014] The correlation between nodes in a heterogeneous graph;

[0015] The maximum depth of the heterogeneous graph, the out-degree of the nodes in the heterogeneous graph, and the warning information corresponding to the nodes.

[0016] In the above solution, determining the characteristic information of the heterogeneous graph includes:

[0017] Determine multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event;

[0018] Determine the total number of occurrences of each node in multiple random walk paths;

[0019] Based on the determined total number of occurrences of each node, determining at least one first random walk path from the plurality of random walk paths; wherein the first random walk path includes first N nodes with the largest total number of occurrences, where N is an integer greater than or equal to 2;

[0020] Based on the determined first random walk path, correlations between nodes in the heterogeneous graph are determined.

[0021] In the above solution, the determining of multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event includes:

[0022] Based on the heterogeneous graph corresponding to the first abnormal event and the set meta-path corresponding to the first abnormal event, a plurality of random walk paths are determined.

[0023] In the above solution, determining the correlation between nodes in the heterogeneous graph based on the determined first random walk path includes:

[0024] Determine a first vector corresponding to every two nodes in the first random walk path;

[0025] Based on the similarity between the first vectors, the correlation between the corresponding nodes is determined.

[0026] In the above solution, the number of first random walk paths determined is at least two;

[0027] Before determining the correlation between corresponding nodes based on the similarity between the first vectors, the method further includes:

[0028] Based on the correlation between the first vectors corresponding to different first random walk paths, deduplication processing is performed on the determined first vectors.

[0029] In the above solution, the method further includes:

[0030] The set feature information corresponding to each first abnormal event is input into the root cause detection model.

[0031] This embodiment of the present application also provides a root cause determination method, including:

[0032] When a second abnormal event is detected in a setting system that integrates multiple microservices, characteristic information of a heterogeneous graph corresponding to the second abnormal event is determined; the heterogeneous graph at least represents a relationship between the second abnormal event and related business indicators, microservices, and devices;

[0033] Inputting the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model to obtain the root cause corresponding to the second abnormal event; wherein,

[0034] The first model is a root cause detection model trained using the above-mentioned model training method.

[0035] In the above solution, the method further includes:

[0036] Based on the heterogeneous graph corresponding to the second abnormal event, at least one first path is output; the starting node of the first path is the second abnormal event, and the ending node of the first path is the fault node represented by the root cause corresponding to the second abnormal event.

[0037] The present application also provides a model training device, including:

[0038] A training unit is configured to input feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; and the heterogeneous graph represents at least a relationship between the first abnormal event and related business indicators, microservices, and devices;

[0039] An updating unit is configured to update model parameters of the root cause detection model based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event.

[0040] The present application also provides a root cause determination device, including:

[0041] A first determining unit is configured to, upon detecting that a second abnormal event occurs in a setting system that integrates multiple microservices, determine characteristic information of a heterogeneous graph corresponding to the second abnormal event; the heterogeneous graph at least characterizing a relationship between the second abnormal event and related business indicators, microservices, and devices;

[0042] The second determining unit is configured to input the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model to obtain the root cause corresponding to the second abnormal event; wherein,

[0043] The first model is a root cause detection model trained using the above-mentioned model training method.

[0044] An embodiment of the present application further provides an electronic device, comprising: a processor and a memory for storing a computer program that can be run on the processor,

[0045] Wherein, when the processor is used to run the computer program, it executes the steps of any of the above-mentioned model training methods or root cause determination methods.

[0046] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned model training methods or root cause determination methods are implemented.

[0047] In an embodiment of the present application, the feature information of the heterogeneous graph corresponding to at least one first abnormal event is input into the root cause detection model to obtain the first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices, and devices; based on the first root cause corresponding to each first abnormal event and the corresponding calibrated root cause, the model parameters of the root cause detection model are updated. Since the heterogeneous graph corresponding to the first abnormal event represents the relationship between the business indicators, microservices, and devices related to the first abnormal event, rich feature information can be extracted from the heterogeneous graph. Based on the feature information of the heterogeneous graph corresponding to a small amount of abnormal events, a root cause detection model with higher accuracy can be trained, thereby improving the accuracy of the root cause detection model. Therefore, when the root cause detection model is used to locate the root cause, the root cause corresponding to the abnormal event is determined to be more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of the implementation flow of the model training method provided in the embodiment of the present application;

[0049] Figure 2A schematic diagram of an implementation flow of a method for constructing a heterogeneous graph provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of a heterogeneous graph provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of an implementation flow of a method for determining feature information of a heterogeneous graph provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the implementation flow of the model training method provided in the application embodiment of this application;

[0053] Figure 6 A schematic diagram of the implementation flow of the root cause determination method provided in an embodiment of the present application;

[0054] Figure 7 A schematic diagram of the structure of a model training device provided in an embodiment of the present application;

[0055] Figure 8 A schematic diagram of the structure of a root cause determination device provided in an embodiment of the present application;

[0056] Figure 9 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In related technologies, the root causes of abnormal events occurring in microservice systems are usually predicted through pre-set root cause detection rules in expert systems or neural network models trained based on historical abnormal events.

[0058] However, the root cause detection rules set in the expert system rely on the expert's experience. They need to set corresponding root cause detection rules for each alarm or abnormal event. For example, for an abnormal event such as a server connection failure, the root cause detection rule set may indicate that the server connection failure is due to a poor network card connection. If the microservice system changes due to business upgrades, the experts may not have enough time to update the root cause detection rules in the expert system. As a result, the root cause detection rules in the expert system do not match the abnormal events that may occur in the microservice system. This leads to low accuracy in the root cause determination.

[0059] In addition, the probability of failure in a mature microservice system is very low, and there is a serious deviation between the positive examples (abnormal events that did not cause microservice system operation failures) and the negative examples (abnormal events that caused microservice system operation failures) in historical abnormal events. Therefore, it is impossible to obtain enough historical abnormal events that caused system failures. The accuracy of the neural network model trained based on historical abnormal events is low, resulting in low accuracy of the determined root cause.

[0060] Based on this, an embodiment of the present application provides a model training method, which inputs the feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurs in a set system that integrates multiple microservices; the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices, and devices; based on the first root cause corresponding to each first abnormal event and the corresponding calibrated root cause, the model parameters of the root cause detection model are updated. Since the heterogeneous graph corresponding to the first abnormal event represents the relationship between the business indicators, microservices, and devices related to the first abnormal event, rich feature information can be extracted from the heterogeneous graph. Based on the feature information of the heterogeneous graph corresponding to a small amount of abnormal events, a root cause detection model with higher accuracy can be trained, thereby improving the accuracy of the root cause detection model. Therefore, when the root cause detection model is used to locate the root cause, the root cause corresponding to the abnormal event is determined to be more accurate.

[0061] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0062] Figure 1 This is a schematic diagram of the implementation process of the model training method provided in the embodiment of the present application, wherein the execution subject of the process is an electronic device such as a terminal device and a server. Figure 1 As shown, the model training method includes:

[0063] Step 101: Input feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; and the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices, and devices.

[0064] Here, the first abnormal event refers to a historical abnormal event that occurred during the operation of a setting system that integrates multiple microservices. A setting system that integrates multiple microservices is also called a microservice system.

[0065] The electronic device determines at least one first abnormal event from a training set, and constructs a heterogeneous graph corresponding to each first abnormal event based on relevant information of each determined first abnormal event; extracts multiple feature information of the heterogeneous graph corresponding to each first abnormal event from the heterogeneous graph corresponding to each first abnormal event; inputs the multiple feature information corresponding to the determined first abnormal event into a root cause detection model, and processes the feature information corresponding to each first abnormal event through the root cause detection model to obtain a first root cause corresponding to each first abnormal event. The first root cause is a root cause predicted by the root cause detection model.

[0066] Among them, the relevant information of the first abnormal event includes the business indicators corresponding to the first abnormal event, the logs related to the first abnormal event, etc. The heterogeneous graph at least represents the relationship between the first abnormal event and the related business indicators, microservices and devices. The first abnormal event, business indicators, microservices and devices are all nodes in the heterogeneous graph; wherein the first abnormal event is the root node of the heterogeneous graph. In other words, the heterogeneous graph includes multiple types of nodes and edges between nodes, and the edges between nodes represent the relationship between nodes. The devices here refer to the devices related to the subsystem corresponding to the microservice related to the first abnormal event, including servers and network devices. Network devices include the mother machine to which the server belongs, the intranet switch corresponding to the server, and the extranet switch, etc.

[0067] In practical applications, the feature information of the heterogeneous graph corresponding to the first abnormal event can be represented by a matrix. The feature information of the heterogeneous graph includes at least one type, such as the correlation between nodes, and each type of feature information can be present in multiple quantities. Since feature information can be represented by vectors, in some embodiments, a vector matrix can be used to represent multiple feature information of the heterogeneous graph corresponding to the first abnormal event.

[0068] The root cause detection model is a classification model, such as a support vector machine (SVM). The SVM input is a vector corresponding to the feature information, and the SVM output is one of two categories, represented as 0 or 1. 0 indicates that the first root cause corresponding to the first abnormal event is not the calibrated root cause, and 1 indicates that the first root cause corresponding to the first abnormal event is the calibrated root cause.

[0069] The following uses the SVM root cause detection model as an example to illustrate the implementation process of the root cause detection model processing the feature information corresponding to each first abnormal event to obtain the corresponding first root cause:

[0070] The feature information corresponding to each first abnormal event is converted into a first vector, and the first vector corresponding to each first abnormal event in at least one first abnormal event is input into the SVM. Each first vector is mapped to a corresponding second vector through the intrinsic kernel function f of the SVM, and the second vector is classified through the hyperplane (or classification vector) of the feature space where the input first vector is located. Based on the relative position between the second vector and the hyperplane, the first root cause corresponding to the first abnormal event corresponding to the second vector is obtained.

[0071] Among them, when the second vector is above (or to the left of) the hyperplane, the first abnormal event corresponding to the second vector belongs to the positive class, that is, the classification result corresponding to the first abnormal event is 1, and the first root cause corresponding to the first abnormal event is the same as the calibration root cause; when the second vector is below (or to the right of) the hyperplane, the first abnormal event corresponding to the second vector belongs to the negative class, that is, the classification result corresponding to the first abnormal event is 0, and the first root cause corresponding to the first abnormal event is different from the calibration root cause; when the second vector is in the hyperplane, the corresponding second vector is a support vector, and the confidence level of the first root cause corresponding to the first abnormal event is 0.5.

[0072] It should be noted that the purpose of training SVM is to design a hyperplane that separates two second vectors of different categories and maximizes the closest distance between any second vector and the hyperplane. For example, the distance between any second vector and the hyperplane is greater than or equal to 1. In the process of training SVM, the hyperplane can be obtained by continuously adjusting the weight of the basis of each second vector and solving the normal vector and intercept of the hyperplane. Among them, any vector a (including the zero vector) can be represented by two non-zero and non-collinear vectors (e1, e2), that is, a = xe1 + ye2 (x, y are arbitrary real numbers). The two non-zero vectors e1 and e2 used to represent vector a are called a set of bases of vector a.

[0073] In order to improve the accuracy of the root cause detection model, in some embodiments, the method further includes: inputting set feature information corresponding to each first abnormal event into the root cause detection model.

[0074] The characteristic information set by microservice system experts or root cause analysts is based on their experience in root cause analysis and is specific to each abnormal event. The characteristic information set includes network latency and / or alarm type.

[0075] In this solution, the root cause detection model is trained based on the feature information extracted from the heterogeneous graph and the set feature information, which further enriches the feature information corresponding to the first abnormal event. This can effectively reduce the demand for the first abnormal event, reduce the difficulty of model training, improve the accuracy of the root cause detection model, and avoid the problem of insufficient model training due to the small number of first abnormal events.

[0076] To improve the accuracy of the root cause detection model, in some embodiments, the feature information of the heterogeneous graph includes at least one of the following:

[0077] The correlation between nodes in a heterogeneous graph;

[0078] The maximum depth of the heterogeneous graph, the out-degree of the nodes in the heterogeneous graph, and the warning information corresponding to the nodes.

[0079] Here, the correlation between nodes in a heterogeneous graph represents the dependency relationship or degree of dependency between nodes in the heterogeneous graph; the out-degree of a node in a heterogeneous graph represents the number of edges emanating from the node. The maximum depth of a heterogeneous graph is determined based on the longest path from the root node to each node in the heterogeneous graph. The maximum depth refers to the maximum number of nodes between the root node and the last node in the heterogeneous graph.

[0080] Based on the topological structure of the heterogeneous graph, the electronic device can determine the maximum depth of the heterogeneous graph and the out-degree of each node in the heterogeneous graph; and obtain the alarm information for each node from the attribute information of each node in the heterogeneous graph. In practical applications, the characteristic information of the heterogeneous graph includes at least the correlation degree and alarm information of each node in the heterogeneous graph. The characteristic information of the heterogeneous graph may also include the maximum depth of the heterogeneous graph, the out-degree of each node, and the alarm type to which the alarm information belongs.

[0081] It should be noted that the alarm information is the external manifestation of the fault, which includes the direct observation results of the fault itself and the phenomena accompanying the occurrence of the fault, such as the spontaneous alarm information of the program or the alarm issued by the designed anomaly detector.

[0082] Figure 2 A schematic diagram of the implementation flow of a method for constructing a heterogeneous graph provided in an embodiment of the present application is shown as follows: Figure 2 As shown, in some embodiments, the method further includes:

[0083] Step 201: Based on the business flow log corresponding to the first abnormal event, determine the first information corresponding to the first abnormal event; the first information at least represents the microservice corresponding to the first abnormal event, the third-party organization, the first subsystem called by the microservice, and the second subsystem and server related to the first subsystem.

[0084] Here, the business flow log includes at least the business flow number corresponding to the first abnormal event, the microservice, the subsystem related to the microservice, and the server corresponding to the subsystem.

[0085] When the electronic device obtains the business flow log corresponding to the first abnormal event, it parses the business flow log to obtain a parsing result; and determines the first information corresponding to the first abnormal event from the parsing result. The first information includes at least the microservice, the third-party organization, the first subsystem called by the microservice, the second subsystem related to the first subsystem, and the server related to the first subsystem.

[0086] The second subsystem related to the first subsystem includes an upstream subsystem of the first subsystem and a downstream subsystem of the first subsystem, wherein the first subsystem depends on the upstream subsystem of the first subsystem and the downstream subsystem of the first subsystem depends on the first subsystem.

[0087] The servers associated with the first subsystem include at least the servers corresponding to the first subsystem and may also include the servers corresponding to the second subsystem. The servers corresponding to the first subsystem are servers that provide services to the first subsystem. The servers corresponding to the second subsystem are servers that provide services to the second subsystem.

[0088] Third-party institutions include partners corresponding to microservices, banks and institutions with business dealings, etc.

[0089] In some embodiments, the business flow log may also include an Internet Data Center (IDC), at least one logical block corresponding to the IDC, a host, and a virtual group to which the logical block belongs. The logical block is divided by the IDC. The host is deployed in the logical block divided by the IDC. The host typically refers to a server.

[0090] The electronic device can determine the network device corresponding to the IDC related to the first abnormal event based on the set correspondence between the IDC and the network device; determine the message bus cluster corresponding to the logical block corresponding to the IDC related to the first abnormal event based on the set correspondence between the logical block and the message bus cluster, and determine the service node corresponding to the message bus cluster. Network devices include network switches, routers, etc. In other words, the first information determined by the electronic device may also include the IDC related to the first abnormal event, the network device corresponding to the IDC, the logical block corresponding to the IDC, the message bus cluster corresponding to the logical block, the service node corresponding to the message bus cluster, etc.

[0091] Step 202: Determine second information of a server related to the first subsystem based on the device deployment log; the second information at least represents the host machine, network area, and network device corresponding to the server.

[0092] Among them, the device deployment log represents the deployment relationship between devices, the network configuration of the devices, etc.

[0093] When the electronic device determines the server associated with the first abnormal event, based on the identifier of the server associated with the first abnormal event, it determines the configuration information corresponding to the server associated with the first abnormal event from the device deployment log, and then determines the second information corresponding to the server associated with the first subsystem from the determined configuration information. The second information includes the host machine, network area, intranet switch, and extranet switch. The network area is used to determine the network device that communicates with the server, for example, the network device corresponding to the IDC.

[0094] Step 203: Based on the alarm log corresponding to the first abnormal event, determine alarm information related to the first abnormal event.

[0095] When the electronic device determines the alarm log corresponding to the first abnormal event, it determines alarm information related to the first abnormal event from the alarm log corresponding to the first abnormal event, wherein the alarm information corresponds to a business indicator, microservice, subsystem, or device.

[0096] Step 204: Based on the business indicators corresponding to the first abnormal event, the microservices corresponding to the business indicators, and the determined first information, second information, and alarm information, a heterogeneous graph corresponding to the first abnormal event is constructed.

[0097] Here, the electronic device determines the business indicator corresponding to the first abnormal event based on the set correspondence between the abnormal event and the business indicator. Based on the set correspondence between the business indicator and the microservice, the electronic device determines the microservice corresponding to the business indicator corresponding to the first abnormal event.

[0098] Based on the business indicator corresponding to the first abnormal event, the microservice corresponding to the business indicator corresponding to the first abnormal event, the determined first information and the second information, a topological structure of a heterogeneous graph corresponding to the first abnormal event is constructed, and the alarm information determined in step 203 is added to the attribute information of the corresponding node to obtain a constructed heterogeneous graph. For example, the constructed heterogeneous graph is as follows: Figure 3 shown.

[0099] In this embodiment, a heterogeneous graph corresponding to the first abnormal event is constructed based on device deployment logs, business indicators corresponding to the first abnormal event, business flow logs, and alarm logs. This constructed heterogeneous graph includes multiple types of nodes related to the first abnormal event. This allows for the extraction of richer feature information from the heterogeneous graph corresponding to an abnormal event, thereby improving the accuracy of the root cause detection model.

[0100] Figure 4Schematic diagram of the implementation flow of the method for determining the characteristic information of a heterogeneous graph provided in the embodiment of the present application. In order to improve the accuracy of the correlation between nodes in the determined heterogeneous graph, the accuracy of the determined root cause detection model is further improved; Figure 4 As shown, in some embodiments, determining feature information of a heterogeneous graph includes:

[0101] Step 401: Based on the heterogeneous graph corresponding to the first abnormal event, a plurality of random walk paths are determined.

[0102] Here, the electronic device uses the first abnormal event in the heterogeneous graph corresponding to the first abnormal event as a starting point and performs a random walk in the corresponding heterogeneous graph based on a deep walk algorithm to obtain multiple random walk paths, wherein the starting point of each random walk path is the first abnormal event in the heterogeneous graph.

[0103] It should be noted that, based on the topological structure of the heterogeneous graph, the electronic device randomly selects an edge connected to the corresponding node at each node of the heterogeneous graph for wandering.

[0104] In order to improve the accuracy of the root cause detection model and reduce the time consumed by random walks, in some embodiments, the determining of multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event includes:

[0105] Based on the heterogeneous graph corresponding to the first abnormal event and the set meta-path corresponding to the first abnormal event, a plurality of random walk paths are determined.

[0106] Here, the set meta-path is set by the experts or root cause analysts of the microservice system for each abnormal event. The set meta-path is an important feature for analyzing the root cause, also known as the key meta-path. Each meta-path includes two path points and one path edge. The path point represents the category of the node in the heterogeneous graph, such as the server, rather than the specific node entity in the heterogeneous graph, such as server No. 1. The path edge is the category of the edge in the heterogeneous graph. For example, the path edge is: server-router, rather than the specific edge entity in the heterogeneous graph, such as server No. 1-router No. 2. The number of set meta-paths corresponding to the first abnormal event can be one or at least two.

[0107] The electronic device determines a random walk interval in the heterogeneous graph corresponding to the first abnormal event based on the set meta-path corresponding to the first abnormal event; and determines multiple random walk paths based on the topological structure corresponding to the first abnormal event and the determined random walk interval. The electronic device performs random walk only within the determined random walk interval. The random walk interval includes a starting node and an ending node. Each determined random walk path includes a first sub-path and a second sub-path. The first sub-path represents a path determined based on a non-random walk interval, for example, a path between a root node in a heterogeneous graph and a starting node of a random walk interval; the second sub-path represents a path obtained by random walk in the random walk path interval.

[0108] It's important to note that, unlike a purely random walk on a heterogeneous graph, this approach restricts the random walk range by setting meta-paths. That is, random walks are performed based on routes that satisfy the meta-path constraints, which can shorten the random walk time. The multiple random walk paths determined based on the set meta-paths all include the nodes corresponding to the set meta-paths. The set meta-paths are important features for root cause analysis, and analyzing root causes based on these important features can improve the accuracy of the root cause detection model.

[0109] Step 402: Determine the total number of occurrences of each node in the plurality of random walk paths.

[0110] Here, the electronic device determines the nodes included in each random walk path based on the determined multiple random walk paths, and determines the sum of the number of occurrences of each node in the multiple random walk paths to obtain the total number of occurrences of each node.

[0111] Step 403: Based on the total number of occurrences of each node in the heterogeneous graph, determine at least one first random walk path from the multiple random walk paths; the first random walk path includes the first N nodes with the largest number of occurrences, where N is an integer greater than or equal to 2.

[0112] Here, the electronic device determines N nodes based on the total number of occurrences of each node determined, in descending order of the total number of occurrences; and determines a random walk path that includes the N nodes from the multiple random walk paths determined to obtain a first random walk path.

[0113] Step 404: Determine the correlation between nodes in the heterogeneous graph based on the determined first random walk path.

[0114] Here, the electronic device can determine the correlation between nodes in the heterogeneous graph based on the connection relationship between the nodes included in each first random walk path. Among them, the correlation between directly connected nodes is the highest. For example, all subsystems on servers deployed in the same computer room need to communicate with the outside world through the router of the computer room. Among the multiple paths generated by random walk, the total frequency of occurrence of servers and routers in the computer room is relatively high. Therefore, the determined first random walk paths all include servers in the computer room and routers in the computer room. The correlation between servers and routers in the computer room is relatively high.

[0115] The electronic device may also determine the correlation between nodes in the heterogeneous graph based on the vectors corresponding to every two nodes in each first random walk path. For example, the correlation between the corresponding nodes may be determined by measuring the similarity between the vectors corresponding to every two nodes. The greater the similarity between the vectors, the higher the correlation between the corresponding nodes.

[0116] It should be noted that, based on the determination of multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event and the set meta-path corresponding to the first abnormal event, the electronic device can also increase the correlation between the nodes corresponding to the set meta-path after determining the correlation between the nodes in the heterogeneous graph based on the determined first random walk path, thereby enhancing the correlation between the nodes related to the set meta-path, thereby further improving the accuracy of the root cause detection model.

[0117] It should be noted that determining the characteristic information of the heterogeneous graph may also include: determining the maximum depth of the heterogeneous graph and the out-degree of each node in the heterogeneous graph based on the topological structure of the heterogeneous graph; and determining the alarm information corresponding to the node from the attribute information of each node in the heterogeneous graph.

[0118] It should be noted that the characteristic information of the heterogeneous graph includes the correlation between nodes in the heterogeneous graph. The greater the correlation, the greater the corresponding weight.

[0119] In order to more accurately determine the correlation between nodes, in some embodiments, determining the correlation between nodes in the heterogeneous graph based on the determined first random walk path includes:

[0120] Determine a first vector corresponding to every two nodes in the first random walk path;

[0121] Based on the similarity between the first vectors, the correlation between the corresponding nodes is determined.

[0122] Here, the electronic device determines the first vectors corresponding to every two nodes in the first random walk path, calculates the cosine similarity between every two first vectors, and obtains the similarity between every two first vectors. Based on the similarity between every two first vectors among all first vectors corresponding to the first random walk path, the electronic device determines the correlation between the corresponding nodes. The greater the similarity between the first vectors, the greater the correlation between the corresponding nodes.

[0123] Considering that in practical applications, the number of determined first random walk paths may be one or at least two; when there are at least two determined first random walk paths, two identical nodes may correspond to different first vectors in different first random walk paths. Such repeated first vectors not only increase the amount of data processing but may also introduce some errors. Therefore, in order to reduce redundant features extracted from heterogeneous graphs and improve the accuracy and model training efficiency of the root cause detection model, in some embodiments, when there are at least two determined first random walk paths, before determining the correlation between the corresponding nodes based on the similarity between the first vectors, the method further includes:

[0124] Based on the correlation between the first vectors corresponding to different first random walk paths, deduplication processing is performed on the determined first vectors.

[0125] In statistics, the Pearson correlation coefficient, mutual information, and maximum information coefficient are often used to measure the degree of correlation between two variables X and Y. Therefore, the electronic device measures the correlation between the first vectors by calculating the Pearson correlation coefficient, mutual information, or maximum information coefficient between the first vectors.

[0126] Here, the electronic device calculates the Pearson correlation coefficient, mutual information or maximum information coefficient between the first vectors corresponding to different first random walk paths to obtain the correlation between the corresponding first vectors; based on the correlation between the first vectors corresponding to different first random walk paths, the first vectors determined by multiple random walk paths are deduplicated so as to determine the correlation between the corresponding nodes based on the similarity between the deduplicated first vectors.

[0127] Among them, since the correlation between different first vectors corresponding to the same two nodes is very high, a corresponding threshold can be set for the Pearson correlation coefficient, mutual information or maximum information coefficient. When the determined Pearson correlation coefficient, mutual information or maximum information coefficient is greater than the corresponding set threshold, the corresponding two first vectors are deduplicated and only one corresponding first vector is retained.

[0128] Step 102: Based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event, update the model parameters of the root cause detection model.

[0129] Here, the electronic device updates the model parameters of the root cause detection model based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event, thereby improving the accuracy of the prediction results output by the root cause detection model. The model parameters of the root cause detection model include a weight parameter of the root cause detection model and a weight assigned to the feature information corresponding to each first abnormal event. The calibrated root cause refers to the actual root cause marked for the first abnormal event.

[0130] When the root cause detection model is an SVM, the model parameters of the root cause detection model include at least the weight of the basis of the second vector, the normal vector and the intercept of the hyperplane, and may further include the basis of the second vector.

[0131] The following uses an SVM root cause detection model as an example to illustrate the implementation process of the electronic device updating the model parameters of the root cause detection model based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event:

[0132] When the first root cause corresponding to the first abnormal event is different from the corresponding calibrated root cause, the electronic device calculates the distance from the second vector to the hyperplane (or classification vector) in the feature space where the first vector is located. This distance is also called the loss value; based on the calculated distance, the weight of the basis of the second vector is updated. For example, by taking the inverse of the distance, the weight of the basis of each second vector is calculated to be updated according to the value of this distance, and the weight of the basis of the corresponding second vector is updated to the calculated value. Since the distribution of the second vector will be updated as the weight of the basis of the second vector is updated, the hyperplane will also change when the distribution of the second vector changes. At this time, based on the updated basis of the second vector and the weight of the basis, the normal vector and intercept of the changed hyperplane are solved to obtain a new hyperplane, so that the root cause corresponding to the first abnormal event can be continued to be classified using the updated hyperplane. The electronic device uses the weight parameters obtained after this round of update as the weight parameters used for the next training of the root cause detection model. Among them,

[0133] An update stop condition can be set. When the update stop condition is met, the weight parameter obtained by the last update is determined as the weight parameter used by the trained root cause detection model.

[0134] The update stopping condition may be that the loss value corresponding to each of the at least one first abnormal event is less than or equal to a set loss threshold, or the accuracy of the prediction result is greater than or equal to a set threshold. Of course, the update stopping condition is not limited to this, and may also be, for example, a set training epoch. A training epoch is the process of training the root cause detection model once based on the feature information corresponding to each of the at least one first abnormal event.

[0135] It should be noted that during the training of the root cause detection model, the root cause detection model will assign different weights to different features corresponding to the first abnormal event, and continuously adjust these weights during the training process so that the predicted root cause output by the root cause detection model is as consistent as possible with the calibrated true root cause.

[0136] It should be noted that the root cause detection model in this embodiment can be a binary classification model or a multi-classification model. For example, when the number of calibrated root causes corresponding to the first abnormal event is 1, the root cause detection model is a binary classification model; the binary classification model can be a support vector machine (SVM), a Bayesian model, or a linear regression model. When the number of calibrated root causes corresponding to the first abnormal event is greater than or equal to 2, the root cause detection model is a multi-classification model, which can be a neural network model.

[0137] In an embodiment of the present application, the feature information of the heterogeneous graph corresponding to at least one first abnormal event is input into the root cause detection model to obtain the first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices, and devices; based on the first root cause corresponding to each first abnormal event and the corresponding calibrated root cause, the model parameters of the root cause detection model are updated. Since the heterogeneous graph corresponding to the first abnormal event represents the relationship between the business indicators, microservices, and devices related to the first abnormal event, rich feature information can be extracted from the heterogeneous graph. Based on the feature information of the heterogeneous graph corresponding to a small amount of abnormal events, a root cause detection model with higher accuracy can be trained, thereby improving the accuracy of the root cause detection model. Therefore, when the root cause detection model is used to locate the root cause, the root cause corresponding to the abnormal event is determined to be more accurate.

[0138] Figure 5 This is a schematic diagram of the implementation flow of the model training method provided in the application embodiment of this application. Figure 5 As shown, the model training method includes:

[0139] Step 501: construct a heterogeneous graph corresponding to the first abnormal event based on the device deployment log, the business indicators corresponding to the first abnormal event, the business flow log and the alarm log.

[0140] The implementation process of step 504 is described in the above steps 201 to 204 and will not be repeated here.

[0141] Step 502: Determine multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event and the set meta-path corresponding to the first abnormal event.

[0142] The implementation process of step 502 is described in detail in step 401 above and will not be repeated here.

[0143] Step 503: Determine the total number of occurrences of each node in the multiple random walk paths.

[0144] Among them, step 503 is the same as step 402. Please refer to the relevant description of step 402 for the implementation process.

[0145] Step 504: Based on the determined total number of occurrences of each node, determine at least one first random walk path from the plurality of random walk paths.

[0146] Among them, step 504 is the same as step 403. Please refer to the relevant description of step 403 for the implementation process.

[0147] Step 505: Based on the determined first random walk path, the topological structure of the heterogeneous graph, and the attribute information of the nodes, characteristic information of the heterogeneous graph corresponding to the first abnormal event is determined.

[0148] The feature information extracted from the heterogeneous graph includes the correlation between nodes in the heterogeneous graph, the maximum depth of the heterogeneous graph, the out-degree of the nodes in the heterogeneous graph, and the warning information corresponding to the nodes.

[0149] Based on the determined first random walk path, the correlation between nodes in the heterogeneous graph is determined. For the implementation process, please refer to the relevant description in step 404. In actual applications, after the correlation between nodes in the heterogeneous graph is determined based on the determined first random walk path, the correlation between nodes corresponding to the set meta-path can be increased to enhance the correlation between nodes related to the set meta-path, thereby further improving the accuracy of the root cause detection model.

[0150] Step 506: Inputting the feature information of the heterogeneous graph corresponding to at least one first abnormal event and the set feature information corresponding to each first abnormal event into the root cause detection model to obtain the first root cause corresponding to each first abnormal event.

[0151] The set characteristic information corresponding to the first abnormal event can be obtained from a set expert experience database.

[0152] Step 507: Based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event, update the model parameters of the root cause detection model.

[0153] As another embodiment of the present application, after the root cause detection model is trained, it can be put into use. For example, in a root cause location scenario, an electronic device can use the root cause detection model trained using the above embodiment to perform root cause detection to determine the root cause corresponding to the abnormal event. It should be noted that the electronic device in the embodiment corresponding to the training of the root cause detection model can be different from or the same as the electronic device used in this embodiment to perform root cause detection using the root cause detection model.

[0154] like Figure 6 As shown, the implementation process of the electronic device using the trained root cause detection model to perform root cause detection is as follows:

[0155] Step 601: When a second abnormal event is detected in a setting system that integrates multiple microservices, characteristic information of a heterogeneous graph corresponding to the second abnormal event is determined; the heterogeneous graph at least represents information on business indicators, microservices, and devices related to the second abnormal event.

[0156] Here, when an electronic device detects a second abnormal event in a configuration system that integrates multiple microservices, it constructs a heterogeneous graph corresponding to the second abnormal event based on the device deployment log, the business indicators corresponding to the second abnormal event, the business transaction log, and the alarm log. Feature information corresponding to the second abnormal event is extracted from the constructed heterogeneous graph. The second abnormal event is an abnormal event detected in real time by the configuration system that integrates multiple microservices after the root cause detection model has been trained.

[0157] The method of extracting characteristic information corresponding to the second abnormal event from the constructed heterogeneous graph is the same as the method of extracting characteristic information from the heterogeneous graph corresponding to the first abnormal event in step 101, and is not described here in detail.

[0158] Step 602: Input the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model to obtain the root cause corresponding to the second abnormal event; wherein the first model is a root cause detection model trained using any of the above-mentioned model training methods.

[0159] Here, the electronic device inputs the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model, and obtains the root cause corresponding to the second abnormal event determined by the first model based on the feature information of the heterogeneous graph.

[0160] The method for predicting the root cause corresponding to the second abnormal event is the same as the method for predicting the first root cause corresponding to the first abnormal event in step 101 , and will not be described in detail here.

[0161] In order to improve the accuracy of the determined root cause corresponding to the second abnormal event, in some embodiments, set feature information corresponding to the second abnormal event is input into the first model.

[0162] The set characteristic information corresponding to the second abnormal event is set by an expert or root cause analyst of the microservice system based on experience. The electronic device can obtain the set characteristic information corresponding to the second abnormal event from a setting database. The setting database stores the set characteristic information set by the expert or root cause analyst of the microservice system based on their experience in root cause analysis for different abnormal events.

[0163] Considering that if any node in the heterogeneous graph fails, it may affect the downstream nodes of the node, and the failed node may also fail due to the influence of the upstream node. In order to facilitate relevant personnel to perform fault analysis and improve the efficiency of fault analysis, in some embodiments, the method further includes:

[0164] Based on the heterogeneous graph corresponding to the second abnormal event, at least one first path is output; wherein the starting node of the first path is the second abnormal event, and the ending node of the first path is the fault node represented by the root cause corresponding to the second abnormal event.

[0165] Here, when the electronic device determines the root cause corresponding to the second abnormal event, based on the fault node represented by the root cause corresponding to the second abnormal event and based on the topological structure of the heterogeneous graph corresponding to the second abnormal event, it determines at least one first path from the heterogeneous graph corresponding to the second abnormal event, and outputs all the determined first paths, so that relevant personnel can determine the nodes connected to the fault node represented by the root cause corresponding to the second abnormal event from the first paths, and then perform fault analysis.

[0166] In this embodiment, rich feature information can be extracted from the heterogeneous graph corresponding to the second abnormal event. Since the root cause detection model trained by the above method has high accuracy, root cause detection based on the root cause detection model trained by the above method can accurately predict the root cause corresponding to the second abnormal event.

[0167] In order to implement the model training method of the embodiment of the present application, the embodiment of the present application also provides a model training device, such as Figure 7 As shown, the model training device includes:

[0168] A training unit 71 is configured to input feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; and the heterogeneous graph represents at least the relationship between the first abnormal event and related business indicators, microservices, and devices;

[0169] The updating unit 72 is configured to update the model parameters of the root cause detection model based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event.

[0170] In some embodiments, the model training apparatus further comprises:

[0171] A first determining unit is configured to determine first information corresponding to the first abnormal event based on a business flow log corresponding to the first abnormal event; the first information at least represents a microservice corresponding to the first abnormal event, a third-party organization, a first subsystem called by the microservice, and a second subsystem and server related to the first subsystem;

[0172] A second determining unit is configured to determine, based on the device deployment log, second information of a server related to the first subsystem; the second information at least represents a host machine, a network area, and a network device corresponding to the server;

[0173] a third determining unit, configured to determine alarm information related to the first abnormal event based on the alarm log corresponding to the first abnormal event;

[0174] A construction unit is used to construct a heterogeneous graph corresponding to the first abnormal event based on the business indicators corresponding to the first abnormal event, the microservices corresponding to the business indicators, and the determined first information, second information and alarm information.

[0175] In some embodiments, the feature information of the heterogeneous graph includes at least one of the following:

[0176] The correlation between nodes in a heterogeneous graph;

[0177] The maximum depth of the heterogeneous graph, the out-degree of the nodes in the heterogeneous graph, and the warning information corresponding to the nodes.

[0178] In some embodiments, the model training apparatus further comprises:

[0179] a fourth determining unit, configured to determine a plurality of random walk paths based on the heterogeneous graph corresponding to the first abnormal event;

[0180] a fifth determining unit, configured to determine a total number of occurrences of each node in the plurality of random walk paths;

[0181] a sixth determining unit, configured to determine, based on the determined total number of occurrences of each node, at least one first random walk path from the plurality of random walk paths; wherein the first random walk path includes first N nodes having the largest total number of occurrences, where N is an integer greater than or equal to 2;

[0182] The seventh determining unit is configured to determine the correlation between nodes in the heterogeneous graph based on the determined first random walk path.

[0183] In some embodiments, the fourth determining unit is specifically configured to determine a plurality of random walk paths based on the heterogeneous graph corresponding to the first abnormal event and the set meta-path corresponding to the first abnormal event.

[0184] In some embodiments, the seventh determining unit is specifically configured to:

[0185] Determine a first vector corresponding to every two nodes in the first random walk path;

[0186] Based on the similarity between the first vectors, the correlation between the corresponding nodes is determined.

[0187] In some embodiments, the determined first random walk paths are at least two; and the electronic device further includes:

[0188] The deduplication unit is configured to perform deduplication processing on the determined first vectors based on the correlation between the first vectors corresponding to different first random walk paths.

[0189] In practical applications, each of the above units can be implemented by a processor in the model training device, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU), or a field-programmable gate array (FPGA). Of course, the processor needs to run the program stored in the memory to implement the functions of the above program modules.

[0190] It should be noted that the model training device provided in the above embodiment only uses the division of the above program modules as an example when performing model training. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the model training device provided in the above embodiment and the model training method embodiment are of the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0191] In order to implement the root cause determination method of the embodiment of the present application, the embodiment of the present application also provides a root cause determination device, such as Figure 8 As shown, the root cause determination device includes:

[0192] A first determining unit 81 is configured to, upon detecting that a second abnormal event occurs in a setting system that integrates multiple microservices, determine characteristic information of a heterogeneous graph corresponding to the second abnormal event; the heterogeneous graph at least characterizing a relationship between the second abnormal event and related business indicators, microservices, and devices;

[0193] The second determining unit 82 is configured to input the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model to obtain the root cause corresponding to the second abnormal event; wherein,

[0194] The first model is a root cause detection model trained using the above-mentioned model training method.

[0195] In some embodiments, the root cause determination apparatus further comprises:

[0196] The output unit is configured to output at least one first path based on the heterogeneous graph corresponding to the second abnormal event; the starting node of the first path is the second abnormal event, and the ending node of the first path is the fault node represented by the root cause corresponding to the second abnormal event.

[0197] In practical applications, each of the aforementioned units can be implemented by a processor in the root cause determination device, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU), or a field-programmable gate array (FPGA). Of course, the processor needs to run programs stored in memory to implement the functions of the aforementioned program modules.

[0198] It should be noted that the root cause determination device provided in the above embodiments uses the aforementioned division of program modules as an example only. In actual applications, the aforementioned processing can be assigned to different program modules as needed, i.e., the internal structure of the device can be divided into different program modules to complete all or part of the aforementioned processing. Furthermore, the root cause determination device provided in the above embodiments and the root cause determination method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0199] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an electronic device. Figure 9This is a schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. Figure 9 As shown, the electronic device 9 includes:

[0200] Communication interface 91, capable of exchanging information with other devices such as network devices;

[0201] The processor 92 is connected to the communication interface 91 to implement information exchange with other devices and is used to execute the model training method or root cause determination method provided by one or more of the above technical solutions when running a computer program. The computer program is stored in the memory 93.

[0202] Of course, in actual application, the various components in the electronic device 9 are coupled together through the bus system 94. It is understood that the bus system 94 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 94 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 9 Various buses are labeled as bus system 94.

[0203] The memory 93 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 9. Examples of such data include: any computer program used to operate on the electronic device 9.

[0204] It is understood that the memory 93 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a magnetic disk memory or a magnetic tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory 93 described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memory.

[0205] The methods disclosed in the above-mentioned embodiments of the present application can be applied to or implemented by the processor 92. The processor 92 may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above-mentioned methods can be completed by hardware integrated logic circuits in the processor 92 or by software instructions. The above-mentioned processor 92 can be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 92 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application can be directly implemented as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 93. The processor 92 reads the program in the memory 93 and completes the steps of the above-mentioned method in combination with its hardware.

[0206] Optionally, when the processor 92 executes the program, it implements the corresponding processes implemented by the terminal in each method of the embodiment of the present application, which will not be described here for the sake of brevity.

[0207] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, specifically, a computer-readable storage medium, including, for example, a first memory 93 storing a computer program. The computer program can be executed by a processor 92 of a terminal to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0208] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0209] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0210] In addition, all functional units in the embodiments of the present application can be integrated into one processing module, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0211] Those skilled in the art will appreciate that all or part of the steps of the above-mentioned method embodiments may be implemented by hardware associated with program instructions, and the aforementioned program may be stored in a computer-readable storage medium. When the program is executed, the program executes the steps of the above-mentioned method embodiments. The aforementioned storage medium includes various media that can store program codes, such as mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0212] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0213] It should be noted that the term "and / or" in the embodiments of the present application is merely a description of an association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent three situations: the existence of A alone, the simultaneous existence of A and B, and the existence of B alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of items. For example, at least one of A, B, and C can represent any one or more elements selected from the set consisting of A, B, and C.

[0214] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A model training method, characterized in that: include: Inputting feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; and the heterogeneous graph at least represents the relationship between the first abnormal event and related business indicators, microservices, and devices; Based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event, updating the model parameters of the root cause detection model; The method further comprises: Determining first information corresponding to the first abnormal event based on a business transaction log corresponding to the first abnormal event; the first information at least represents a microservice corresponding to the first abnormal event, a third-party organization, a first subsystem called by the microservice, a second subsystem related to the first subsystem, and a server; the business transaction log at least includes a business transaction number corresponding to the first abnormal event, a microservice, a subsystem related to the microservice, and a server corresponding to the subsystem; Determining second information of a server related to the first subsystem based on the device deployment log; the second information at least represents a host machine, a network area, and a network device corresponding to the server; the device deployment log represents a deployment relationship between devices and / or a network configuration of the devices; Determining alarm information related to the first abnormal event based on the alarm log corresponding to the first abnormal event; Based on the business indicators corresponding to the first abnormal event, the microservices corresponding to the business indicators, and the determined first information, second information, and alarm information, a heterogeneous graph corresponding to the first abnormal event is constructed.

2. The method according to claim 1, characterized in that The characteristic information of the heterogeneous graph includes at least one of the following: The correlation between nodes in a heterogeneous graph; The maximum depth of the heterogeneous graph, the out-degree of the nodes in the heterogeneous graph, and the warning information corresponding to the nodes.

3. The method according to claim 1, characterized in that The characteristic information of the heterogeneous graph includes: Determine multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event; Determine the total number of occurrences of each node in multiple random walk paths; Based on the determined total number of occurrences of each node, determining at least one first random walk path from the plurality of random walk paths; wherein the first random walk path includes first N nodes with the largest total number of occurrences, where N is an integer greater than or equal to 2; Based on the determined first random walk path, correlations between nodes in the heterogeneous graph are determined.

4. The method according to claim 3, characterized in that The determining of multiple random walk paths based on the heterogeneous graph corresponding to the first abnormal event includes: Based on the heterogeneous graph corresponding to the first abnormal event and the set meta-path corresponding to the first abnormal event, a plurality of random walk paths are determined.

5. The method according to claim 3, characterized in that The determining of the correlation between nodes in the heterogeneous graph based on the determined first random walk path includes: Determine a first vector corresponding to every two nodes in the first random walk path; Based on the similarity between the first vectors, the correlation between the corresponding nodes is determined.

6. The method according to claim 5, characterized in that The number of first random walk paths determined is at least two; Before determining the correlation between corresponding nodes based on the similarity between the first vectors, the method further includes: Based on the correlation between the first vectors corresponding to different first random walk paths, deduplication processing is performed on the determined first vectors.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: The set feature information corresponding to each first abnormal event is input into the root cause detection model.

8. A root cause determination method, characterized in that: include: When a second abnormal event is detected in a setting system that integrates multiple microservices, characteristic information of a heterogeneous graph corresponding to the second abnormal event is determined; The heterogeneous graph at least represents the relationship between the second abnormal event and related business indicators, microservices and devices; Inputting the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model to obtain the root cause corresponding to the second abnormal event; wherein, The first model is a root cause detection model trained using the model training method according to any one of claims 1 to 7.

9. The method according to claim 8, characterized in that The method further comprises: Based on the heterogeneous graph corresponding to the second abnormal event, at least one first path is output; the starting node of the first path is the second abnormal event, and the ending node of the first path is the fault node represented by the root cause corresponding to the second abnormal event.

10. A model training device, characterized in that: include: A training unit is configured to input feature information of a heterogeneous graph corresponding to at least one first abnormal event into a root cause detection model to obtain a first root cause corresponding to each first abnormal event; wherein the first abnormal event represents a historical abnormal event that occurred in a set system that integrates multiple microservices; and the heterogeneous graph represents at least a relationship between the first abnormal event and related business indicators, microservices, and devices; an updating unit, configured to update a model parameter of the root cause detection model based on the first root cause and the corresponding calibrated root cause corresponding to each first abnormal event; The training unit is also used to determine the first information corresponding to the first abnormal event based on the business flow log corresponding to the first abnormal event; the first information at least represents the microservice corresponding to the first abnormal event, the third-party organization, the first subsystem called by the microservice, the second subsystem related to the first subsystem and the server; the business flow log at least includes the business flow number, microservice, subsystem related to the microservice and the server corresponding to the subsystem corresponding to the first abnormal event; based on the device deployment log, determine the second information of the server related to the first subsystem; the second information at least represents the mother machine, network area and network device corresponding to the server; the device deployment log represents the deployment relationship between devices and / or the network configuration of the device; based on the alarm log corresponding to the first abnormal event, determine the alarm information related to the first abnormal event; based on the business indicators corresponding to the first abnormal event, the microservices corresponding to the business indicators, and based on the determined first information, second information and alarm information, construct a heterogeneous graph corresponding to the first abnormal event.

11. A root cause determination device, characterized in that: include: A first determining unit is configured to, when detecting that a second abnormal event occurs in a setting system that integrates multiple microservices, determine characteristic information of a heterogeneous graph corresponding to the second abnormal event; The heterogeneous graph at least represents the relationship between the second abnormal event and related business indicators, microservices and devices; The second determining unit is configured to input the feature information of the heterogeneous graph corresponding to the second abnormal event into the first model to obtain the root cause corresponding to the second abnormal event; wherein, The first model is a root cause detection model trained using the model training method according to any one of claims 1 to 7.

12. An electronic device, characterized in that: include: a processor and a memory for storing a computer program capable of being executed on the processor, The processor is configured to execute at least one of the following when running the computer program: The steps of the method according to any one of claims 1 to 7; The steps of the method according to any one of claims 8 to 9.

13. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, at least one of the following is achieved: The steps of the method according to any one of claims 1 to 7; The steps of the method according to any one of claims 8 to 9.

Images