Root cause analysis method and device, electronic equipment, medium and program product

Abstract

Root cause analysis method and device, electronic equipment, medium and program product. The root cause analysis method comprises: extracting a propagation graph from an annotated knowledge graph, wherein the propagation graph comprises an abnormal node that appears an abnormal situation and a node that has a propagation relationship with the abnormal node (S102); and analyzing a root cause of the abnormal situation of the abnormal node based on attributes of the nodes in the propagation graph (S104).

Description

Technical Field

[0001] This disclosure generally relates to the field of industrial technology, and more specifically, to root cause analysis methods, apparatus, electronic devices, media, and program products. Background Technology

[0002] In the manufacturing industry, key performance indicators (KPIs) can be used as an important tool for evaluating and controlling the production process in many aspects, such as machinery and equipment, production scheduling and execution, products, and inventory.

[0003] However, without effective analysis of these aspects, only very limited insights can be provided. The value of analysis depends heavily on the quality of the data, the data / context, the tools used, and the analytical techniques employed.

[0004] Root cause analysis of abnormal KPIs or performance degradation is a common scenario in KPI analysis. Especially in manufacturing processes, abnormal KPIs typically indicate potential risks of economic loss in the event of failure. Root cause analysis is a very challenging task for the following reasons:

[0005] 1. Fault propagation and cumulative effects

[0006] 2. Complex rule combinations

[0007] 3. Huge amount of data and data types

[0008] Domain knowledge is fundamental to such analysis. However, in reality, the bottleneck lies in leveraging individual human capabilities for knowledge fusion, processing, and reasoning. For example, determining whether an OR / AND gate is functioning correctly is relatively easy, but finding faults requires significantly more work if two gates are connected in series or parallel. Imagine if hundreds of such "simple" elements were combined—it would be an almost impossible task for humans.

[0009] In particular, cloud platforms can collect and visualize data from different information silos. However, the cloud itself cannot semantically link data and requires a significant amount of extract-transform-load (ETL) tasks before analysis can be performed. A solution is needed that can embed domain knowledge into the propagation chain and semantically integrate data.

[0010] Root cause analysis can be divided into two main types: data-driven and deductive. Its applications are very broad, extending beyond factory process control, computer system performance, program debugging, and wireless networks.

[0011] Reference 1 (WO2017118380A1, “Root Cause Analysis of Fingerprint Recognition in Cellular Systems”) involves learning rules based on historical performance data to characterize the correlation between indicators, monitor anomalies, and match rules.

[0012] Reference 2 (US20150074035A1, "Detecting Root Causes of Transaction Degradation Using Causal Bayesian Networks") associates states with application transactions and components. The determined states are used as input to construct a Bayesian network, and the set of root causes is derived by traversing the Bayesian network.

[0013] Reference 3 (US10210189B2, "Root Cause Analysis of Performance Problems") calculates database performance values ​​based on monitored KPIs and database performance output. To determine if a database performance value is below a threshold, KPI correlation coefficients and a correlation matrix are generated and used to determine the objective function. Summary of the Invention

[0014] A brief overview of the invention is given below to provide a basic understanding of certain aspects of it. It should be understood that this overview is not an exhaustive summary of the invention. It is not intended to identify key or essential parts of the invention, nor is it intended to limit the scope of the invention. Its purpose is merely to present certain concepts in a simplified form as a prelude to the more detailed description that follows.

[0015] According to one aspect of this disclosure, a root cause analysis method is provided, comprising: extracting a propagation graph from an annotated knowledge graph, wherein the propagation graph includes anomalous nodes where anomalies occur and nodes that have a propagation relationship with the anomalous nodes; and analyzing the root cause of the anomalous nodes' anomalies based on the attributes of the nodes in the propagation graph.

[0016] Optionally, in one example of the above aspects, before extracting the propagation graph from the annotated knowledge graph, the method further includes: constructing a knowledge graph based on an ontology model, and adding a propagation attribute to the relationship between at least one pair of nodes in the constructed knowledge graph, wherein the propagation attribute includes two sub-attributes: direction and context, the direction representing the propagation direction between the two nodes, and the context representing the scenario in which root cause analysis is to be performed.

[0017] Optionally, in one example of the above aspects, extracting a propagation graph from an annotated knowledge graph includes: using a query to extract a propagation graph related to the anomalous node from the annotated knowledge graph.

[0018] Alternatively, in one example of the above aspects, the propagation graph also includes propagation directions between nodes.

[0019] Optionally, in one example of the above aspects, analyzing the root cause of the abnormality of the abnormal node based on the attributes of the nodes in the propagation graph includes:

[0020] All nodes in the propagation graph are arranged in descending order of their weights;

[0021] Perform the following operations starting from the first node in the sort:

[0022] The probability of an anomaly of a node is calculated based on at least one factor that affects the state of the node.

[0023] If the probability of an anomaly exceeds a predetermined threshold, the node is determined to be the root cause of the anomaly, and the operation is stopped.

[0024] Otherwise, perform the operation on the next node, and so on, until the operation has been performed on all nodes.

[0025] Optionally, in one example of the above aspects, the weight of the node is determined based on at least one of the following: the number of paths from the node to the anomalous node, the distance from the node to the anomalous node, and whether the node is an intermediary node.

[0026] Optionally, in one example of the above aspects, calculating the anomalous probability of a node based on at least one factor affecting the state of the node includes: calculating the anomalous probability of the node based on the degree of influence of the dominant and latent factors among the at least one factor affecting the state of the node on the anomalous situation, and the moving average difference of each factor.

[0027] According to another aspect of this disclosure, a root cause analysis apparatus is provided, comprising: a propagation graph extraction unit configured to extract a propagation graph from an annotated knowledge graph, wherein the propagation graph includes anomalous nodes exhibiting abnormal conditions and nodes with propagation relationships to the anomalous nodes; and an analysis unit configured to analyze the root cause of the anomalous nodes exhibiting abnormal conditions based on the attributes of the nodes in the propagation graph.

[0028] Optionally, in one example of the above aspects, the apparatus further includes: a knowledge graph annotation unit, configured to construct a knowledge graph based on an ontology model, and add an annotation attribute to the relationship between at least one pair of nodes in the constructed knowledge graph, wherein the annotation attribute includes two sub-attributes: direction and context, the direction representing the propagation direction between the two nodes, and the context representing the scenario in which root cause analysis is to be performed.

[0029] Optionally, in one example of the above aspects, the propagation graph extraction unit is further configured to: extract the propagation graph related to the abnormal node from the annotated knowledge graph using a query statement.

[0030] Alternatively, in one example of the above aspects, the propagation graph also includes propagation directions between nodes.

[0031] Optionally, in one example of the above aspects, the analysis unit is further configured to:

[0032] All nodes in the propagation graph are arranged in descending order of their weights;

[0033] Perform the following operations starting from the first node in the sort:

[0034] The probability of an anomaly of a node is calculated based on at least one factor that affects the state of the node.

[0035] If the probability of an anomaly exceeds a predetermined threshold, the node is considered to be the root cause of the anomaly, and the operation is stopped.

[0036] Otherwise, perform the operation on the next node, and so on, until the operation has been performed on all nodes.

[0037] Optionally, in one example of the above aspects, the weight of the node is determined based on at least one of the following: the number of paths from the node to the anomalous node, the distance from the node to the anomalous node, and whether the node is an intermediary node.

[0038] Optionally, in one example of the above aspects, the analysis unit is further configured to calculate the probability of an anomaly of the node based on the degree of influence of the dominant and latent factors among at least one factor affecting the node state on the anomaly, and the moving average difference of each factor.

[0039] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory coupled to said at least one processor, said memory for storing instructions that, when executed by said at least one processor, cause the processor to perform the method as described above.

[0040] According to another aspect of this disclosure, a non-transitory machine-readable storage medium is provided that stores executable instructions, which, when executed, cause the machine to perform the method described above.

[0041] According to another aspect of this disclosure, a computer program is provided, including computer-executable instructions that, when executed, cause at least one processor to perform the method described above.

[0042] According to another aspect of this disclosure, a computer program product is provided, which is tangibly stored on a computer-readable medium and includes computer-executable instructions that, when executed, cause at least one processor to perform the method as described above.

[0043] According to the method and apparatus of this disclosure, knowledge of fault propagation can be embedded into an ontology, which fully leverages the advantages of knowledge graphs for large-scale data integration, and requires only a small amount of work to construct an annotated propagation graph.

[0044] According to the method and apparatus disclosed herein, data can be semantically integrated and linked across systems, formats, and locations through a unified architecture. This overcomes limitations in data volume and type, and enables more complex data applications and analysis tasks.

[0045] According to the method and apparatus of this disclosure, by utilizing a unified integration template based on an ontology model, data quality can be ensured and the problem of data silos can be solved. Attached Figure Description

[0046] The above and other objects, features, and advantages of the present invention will be more readily understood by referring to the following description of embodiments of the invention in conjunction with the accompanying drawings. The components in the drawings are merely for illustrating the principles of the invention. In the drawings, the same or similar technical features or components will be represented by the same or similar reference numerals.

[0047] Figure 1 This is a flowchart illustrating an exemplary process of a root cause analysis method according to an embodiment of the present disclosure;

[0048] Figure 2A-2C These are schematic diagrams representing different propagation relationships;

[0049] Figure 3 This is a schematic diagram illustrating a specific example of a propagation diagram;

[0050] Figure 4 This is a schematic diagram of another specific example of a propagation diagram;

[0051] Figure 5 This is a schematic diagram illustrating yet another specific example of a propagation diagram;

[0052] Figure 6 It is shown Figure 1 A flowchart illustrating an exemplary process of the operation of box S104 in the diagram;

[0053] Figure 7 This is a block diagram illustrating an exemplary configuration of a root cause analysis apparatus 700 according to an embodiment of the present disclosure; and

[0054] Figure 8 A block diagram of an electronic device 1000 for root cause analysis according to an embodiment of the present disclosure is shown.

[0055] Figure Labels

[0056] 100: Root Cause Analysis Methods S101, S102, S104, S1042

[0057] S1044, S1046, S1048, S1049: Steps

[0058] 201: Parent object 202: Child object

[0059] 203: Object 1 204: Object 2

[0060] 205: Object 3 206: Object 4

[0061] 300, 400, 500: Transmission diagram PL: Production line

[0062] U1…Un: Unit 1…Unit n M1…Mk: Machine Tool 1…Machine Tool k

[0063] M: Machine tool; LA: Production line A

[0064] U1: Unit 1 M1: Machine Tool 1

[0065] S1: Sensor 1 U2: Unit 2

[0066] M2: Machine tool 2 S2: Sensor 2

[0067] CT: Cycle Time S3: Sensor 3

[0068] W: Worker; WO: Work Order

[0069] WP: Work Plan P: Product

[0070] M: Material PO: Purchase Order

[0071] SL: Supplier WH: Warehouse

[0072] U3: Unit 3 U4: Unit 4

[0073] LB: Production Line B 700: Root Cause Analysis Unit

[0074] 702: Propagation Graph Extraction Unit; 704: Analysis Unit

[0075] 701: Knowledge Graph Annotation Unit; 800: Electronic Devices

[0076] 802: Processor; 804: Memory Detailed Implementation

[0077] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed merely to enable those skilled in the art to better understand and implement the subject matter described herein, and are not intended to limit the scope, applicability, or examples set forth in the claims. The function and arrangement of the elements discussed may be changed without departing from the scope of this disclosure. Various processes or components may be omitted, substituted, or added as needed in the various examples. For example, the described methods may be performed in a different order than described, and steps may be added, omitted, or combined. Furthermore, features described in some examples may be combined in other examples.

[0078] As used herein, the term "comprising" and its variations are open terms meaning "including but not limited to". The term "based on" means "at least partially based on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other definitions, whether explicit or implicit, may be included below. Unless explicitly stated in the context, the definition of a term remains consistent throughout the specification.

[0079] This disclosure provides a solution for embedding domain knowledge in a propagation chain and semantically integrating data. The method according to embodiments of this disclosure can leverage knowledge base assistance to reduce reliance on human intervention.

[0080] The root cause analysis method according to embodiments of the present disclosure will now be described with reference to the accompanying drawings.

[0081] Figure 1 This is a flowchart illustrating an exemplary process of a root cause analysis method 100 according to an embodiment of the present disclosure.

[0082] First, in block S102, a propagation graph is extracted from the knowledge graph with added annotations, wherein the propagation graph includes abnormal nodes where abnormal situations occur and nodes that have a propagation relationship with the abnormal nodes.

[0083] This disclosure proposes the concept of a propagation graph. A propagation graph is a subgraph extracted from an annotated knowledge graph.

[0084] In the method according to embodiments of this disclosure, annotations are added to the knowledge graph to assist in generating a propagation graph. Specifically, a propagation attribute is defined, and a propagation attribute is added to the relationship between at least one pair of nodes in the knowledge graph. The propagation attribute may include two sub-attributes: direction and context. The direction represents the propagation direction between the two nodes, and the context is used to limit the specific scenario involved in the knowledge graph.

[0085] Propagation refers to the relationship between two events: the second event occurs after the first event, and the first event serves as a cause for the occurrence of the second event in some way.

[0086] Generally speaking, the propagation relationship between two events can include the following three types.

[0087] The first type is inclusion propagation, which is a flow from child to parent, such as... Figure 2A As shown, the flow from child object 202 to parent object 201 illustrates how a child fault can cause a parent fault. For example, a faulty tool has a 90% chance of rendering a CNC (Computerized Numerical Control) machine tool unusable. Generally, the inclusion propagation pattern is likely applicable to most hierarchical system architectures, such as the ISA-95 Enterprise Model.

[0088] The second type is upstream-downstream propagation, which is a flow from upstream to downstream, such as... Figure 2B The diagram illustrates the flow from object 1203 to object 2204. That is, an upstream failure causes a downstream failure. For example, a longer processing time on machine 1 causes a longer waiting time on machine 2, or a supplier's delay causes a delay in the product schedule. This upstream-downstream propagation pattern can be used to describe relationships between independent events.

[0089] The third type is the equivalence relation, such as Figure 2C As shown, object 3 205 and object 4 206 are equivalent. Flow equivalence means there is no (no need for) propagation; that is, if object 3 fails, then object 4 will also necessarily fail. This pattern can be used to describe bound events, such as product quality and quality testing, which are equivalent (without considering the test error itself).

[0090] A knowledge graph built on an ontology model is a ternary dataset, consisting of objects and relationships between them, where relationships are directional. However, the propagation direction may differ from the general relationship direction defined in the ontology. In other words, propagation is a specific type of relationship determined by objective facts rather than subjective descriptions. For example, the relationship "A has component B" from A to B is equivalent to the relationship "B is a component of A" from B to A. However, for both "has a component" and "is a component of," the propagation direction is always from B to A (propagation relationships involving schemas).

[0091] Therefore, in the embodiments according to this disclosure, the added propagation attribute includes a direction sub-attribute to indicate whether the propagation direction of the relationship between two nodes is consistent with the direction defined in the ontology.

[0092] The code below shows an example of an added annotation.

[0093]

[0094] As can be seen from this code, the attribute "propagation" has two sub-attributes: "context" and "direction". Taking "hasPart" as an example, this annotation means that in the context of tracking anomalies in "CycleTime", the propagation direction is opposite to the direction of the attribute "hasPart".

[0095] Furthermore, all propagation relationships should be defined using specific contexts or scenarios, as the relationship between two events may differ in different contexts. For example, considering testing errors, the relationship between product quality and quality testing described above should be considered an upstream-downstream relationship, since even a perfect product may have failed test results.

[0096] Therefore, in embodiments according to this disclosure, the added propagation attributes also include context, which can define the specific scenarios involved in the knowledge graph. Furthermore, the context can also define the boundaries of the propagation graph.

[0097] In summary, by adding a propagation attribute to the relationships between nodes in a knowledge graph built on an ontology model, an annotated knowledge graph is obtained, from which a propagation graph can be extracted.

[0098] In one example, a propagation graph can be extracted from a knowledge graph using a query language (such as SPARQL). Those skilled in the art will understand the specific operations of extracting a propagation graph related to nodes experiencing anomalies from a knowledge graph by writing queries in a query language, which will not be detailed here.

[0099] Figure 3 A schematic diagram of a specific example 300 of the propagation diagram of a production line is shown. Figure 3 It includes production line PL, unit 1 U1 to unit n Un, machine tool 1 to machine tool k and machine tool M.

[0100] Figure 3 The propagation graph shown is modeled as a tree with vertical hierarchies and horizontal connections, which is a combination of containment and upstream / downstream relationships.

[0101] Figure 4 This is a schematic diagram of the production management process (Figure 400).

[0102] This is a more specific example, showing a propagation diagram in the context of a KPI of "cycle time of production line A". It includes production line A LA, unit 1 U1, machine tool 1 M1, sensor 1 S1, unit 2 U2, machine tool 2 M2, sensor 2 S2, cycle time CT, sensor 3 S3, worker W, work order WO, work schedule WP, product P, material M, purchase order PO, supplier SL, warehouse WH, unit 3 U3, unit 4 U4, and production line B LB. Figure 3 The left side represents the relevant physical objects / facilities, while the right side represents the relevant information objects. Figure 3 The dashed box in the diagram represents an anomaly in the cycle time CT of production line A LA. Although the KPI is dominated by the physical object "production line A", factors that may affect the KPI are not limited to the physical object. In fact, the entire propagation graph is built by enumerating the propagation relationship of each pair of object nodes.

[0103] In one example, before performing the operation of extracting the propagation graph in box S102, the operation in box S101 can be performed first: constructing a knowledge graph based on the ontology model, and adding a propagation attribute to the relationship between at least one pair of nodes in the constructed knowledge graph. The propagation attribute can include two sub-attributes: direction and context. The direction represents the propagation direction between the two nodes, and the context represents the scenario in which root cause analysis is performed.

[0104] Those skilled in the art will understand that, in another example, a knowledge graph can be pre-built, and a propagation attribute can be added to the relationship between at least one pair of nodes in the built knowledge graph. This annotated knowledge graph can then be stored in a medium for querying without having to perform the operation in block S101 each time.

[0105] After generating the propagation graph, the operation in block S104 can be performed: analyze the root cause of the abnormality of the abnormal node based on the attributes of the nodes in the propagation graph.

[0106] For root cause analysis, the key lies in assessing the likelihood of a candidate cause as the root cause. Two metrics are proposed in the method according to embodiments of this disclosure for evaluating nodes: the node's weight and the node's anomaly probability.

[0107] 1. Node weights

[0108] The weight of a node is used to represent the importance of a node in the entire propagation graph. The importance of a node can be determined based on factors such as the number of paths from the node to the starting node where the anomaly occurred, the distance from the node to the starting node, and whether the node is an intermediary node.

[0109] In one example, the weight of a node can be calculated using the following equation (1).

[0110]

[0111] Where path_num represents the number of paths from node n to m; dist(n,m) represents the shortest distance from node n to m.

[0112] Here, node m represents the starting node (also called the anomalous node) where the abnormal situation begins. For example, in Figure 4 The term "Cycle Time (CT)" is represented by the dashed box. Node n represents any node along the propagation flow. The number of paths indicates how many paths are there from the anomalous node to this node; the shortest distance indicates the number of nodes traversed from this node to the anomalous node.

[0113] Those skilled in the art will understand that the calculation of node weight is not limited to the above formula (1), but can be calculated using any function related to factors such as the number of paths from the node to the abnormal node, the distance from the node to the abnormal node, and whether the node is an intermediary node. Furthermore, the factors considered are not limited to these few, but can also include any other factors related to the importance of the node, such as the conditional probability of the node mentioned below, which will not be detailed here.

[0114] Figure 5 The propagation diagram related to the node "Cycle Time CT" is shown, where the node "Cycle Time CT" within the dashed box represents an anomalous node exhibiting an abnormal condition. Table 1 below shows... Figure 5 The weight of each node in the algorithm.

[0115] node Number of paths The shortest distance from n to m Weight Production line LA - 0 - Unit 1 U1 1 1 1 Unit 2 U2 1 1 1 Machine Tool 1 M1 3 2 1.5 Machine tool 2 M2 2 2 1 Sensor 1 S1 0 - - Sensor 2 S2 1 1 1 Sensor 3 S3 1 1 1

[0116] Table 1

[0117] exist Figure 5In this context, "Production Line A LA" is defined as equivalent to "Cycle Time CT", therefore both are starting points. "Sensor 1 S1" has no path to either "Production Line A LA" or "Cycle Time CT", therefore it should not be within the scope of the cause of the anomaly, so it can be seen that sensor 1 S1 has no weight in Table 1.

[0118] 2. Node anomaly probability

[0119] The probability of a node being in an abnormal state is used to represent the likelihood that a node is in an abnormal state. In the method according to embodiments of this disclosure, factors are considered in determining the likelihood that a node is in an abnormal state.

[0120] This includes explicit and implicit factors. Explicit factors are those explicitly specified in the node's attributes, such as the input to the KPI formula; the remaining factors can be called implicit factors, such as environmental temperature and humidity.

[0121] In one example, to assess whether a node is anomalous, a moving average deviation can be calculated for each of its factors. The moving average deviation measures the deviation between a factor's short-term and long-term behavior; for example, it could be the degree of change of a factor's value relative to its normal value. The length of the moving window can be specified as needed. By calculating the moving average deviation for each factor, each factor can be quantified, and the probability of a node's anomalousness can be calculated based on these quantified factors.

[0122] In one example, the anomalous probability of a node can be calculated using equation (2) below.

[0123]

[0124] Where, p ab It is the probability of an anomaly in a node, w i It is the weight of the factors, diff(f) i ) is the moving average difference.

[0125] The weight of a factor represents its contribution to the estimation of the probability of an anomalous state. For example, dominant factors are generally more important than latent factors. If there is no prior knowledge about a factor, a default value can be set.

[0126] The above equation (2) can be used to calculate the probability of an anomalous node by weighted summing of the moving average differences of all factors of that node. If the calculated probability of an anomalous node is greater than a predetermined threshold, then the node can be considered anomalous, that is, the node may be the root cause of the anomalous situation.

[0127] Those skilled in the art will understand that the method for calculating the anomaly probability of a node is not limited to the method in equation (2) above. For example, it can also be calculated in the following way: using different data of each factor of each node as sample data for machine learning, and then using the model obtained by machine learning to calculate the anomaly probability of a node. Therefore, in the method according to the embodiments of this disclosure, there is no limitation on the specific method for calculating the anomaly probability of a node based on the factors affecting the state of the node.

[0128] In one example, the annotations added to nodes can also include probability information about the node, which can represent the uncertainty of the causal relationship between the node and its parent nodes. The resulting propagation graph resembles a Bayesian network. Each node in the propagation graph has a probability information table, which includes the conditional probabilities between the node and its direct parent nodes. It's understandable that a node may have different probability information tables in different contexts.

[0129] When the added annotation includes the node's probability information, this probability information can be considered as a factor when calculating the node's weight. If the annotation does not include the node's probability information, it is equivalent to a probability of 1 or 0, meaning that there is a propagation relationship between the two nodes or no propagation relationship exists.

[0130] Based on the above, we can determine the weight and anomaly probability of each node, and then begin root cause analysis. In root cause analysis, node weights are primarily used to determine which node to start analyzing and in what order, thus improving the speed and efficiency of the analysis; the anomaly probability of a node is used to determine whether that node represents the root cause of an abnormal situation. See below for reference. Figure 6 This describes an exemplary process for analyzing the root cause of anomalies in abnormal nodes based on the attributes of nodes in the propagation graph.

[0131] Figure 6 This is a flowchart illustrating an exemplary process of the operation in block S104.

[0132] First, in block S1042, all nodes in the propagation graph are arranged in descending order of node weight.

[0133] Next, starting with the first node in the sorted sequence, perform the following operations:

[0134] In box S1044: The probability of an anomaly of a node is calculated based on at least one factor that affects the state of the node;

[0135] In decision box S1046: Determine whether the calculated anomaly probability is greater than a predetermined threshold. If the anomaly probability is greater than the predetermined threshold, represented as Y in the figure, then proceed to the operation in box S1048; otherwise, represented as N in the figure, then perform the operation in box S1044 on the next node.

[0136] In box S1048: This node is determined to be the root cause of the anomaly.

[0137] Finally, the operation ends in S1049.

[0138] The predetermined threshold here can be preset by those skilled in the art based on experience.

[0139] pass Figure 6 The exemplary process shown can be used to analyze the root cause of anomalies in abnormal nodes and identify the root cause of the anomaly.

[0140] Those skilled in the art will understand that the analysis method according to the embodiments of this disclosure may also fail to find the root cause of the anomaly in the propagation graph. In this case, the operation is terminated after all nodes have been operated on.

[0141] Based on the method disclosed herein, improvements have been made in the following aspects to address the problems existing in the prior art.

[0142] Compared to fault derivation, propagation between two directly linked "simple" elements is more deterministic and easier to clarify. Such domain knowledge can be embedded in a knowledge base through annotation, thus transforming fault propagation within large networks into a subgraph extraction problem.

[0143] Annotations encompass both direction and context. To define an annotation, domain knowledge should first be decomposed into its smallest elements, implying a very specific and definite description of the propagation. Context can limit the boundaries of the propagation graph to reduce complexity. With the aid of graph algorithms, quantitative metrics help evaluate rule fulfillment. For example, the distance from device A to device B can be used to evaluate the level of influence of device A on device B.

[0144] By leveraging ontology and knowledge graphs, and through a unified architecture, data can be semantically integrated and linked across systems, formats, and locations. This overcomes limitations in data volume and type, enabling more complex data applications and analysis tasks.

[0145] According to the method disclosed herein, knowledge of fault propagation can be embedded into an ontology, which fully leverages the advantages of knowledge graphs for large-scale data integration, and requires only a small amount of work to build an annotated propagation graph.

[0146] There are many mature technical solutions based on knowledge graphs to address the problem of data silos. Ontology models serve as a unified template for integration, thereby ensuring data quality.

[0147] By adding annotations to the knowledge graph, the construction of the propagation graph is transformed into a query task. Furthermore, the query results can be dynamically adjusted based on the input context included in the annotations.

[0148] Digitalization is based on accessible data and systemic knowledge. Thanks to IoT technology, data acquisition has overcome bottlenecks, enabling more events to be interconnected. The purpose of digitalization is not merely "digitalization" itself, but rather to leverage data and knowledge to gain added value. The method according to this invention provides an excellent technical solution for gaining business insights from data. In particular, this invention is not limited to KPI tracking problems, but proposes a method for evaluating the impact of individuals on the entire network. In the context of the manufacturing industry, this could include: the importance of equipment / materials / people; quality tracking; order delivery analysis, etc. Most of the above problems are very challenging due to their complexity and reliance on analytical skills. Graph-assisted reasoning can save manpower and help people make more accurate judgments using graphs.

[0149] Figure 7 This is a block diagram illustrating an exemplary configuration of a root cause analysis apparatus 700 according to an embodiment of the present disclosure.

[0150] like Figure 7 As shown, the root cause analysis device 700 includes a propagation map extraction unit 702 and an analysis unit 704.

[0151] The propagation graph extraction unit 702 is configured to extract a propagation graph from an annotated knowledge graph, wherein the propagation graph includes abnormal nodes where abnormal situations occur and nodes that have a propagation relationship with the abnormal nodes.

[0152] The analysis unit 704 is configured to analyze the root cause of the abnormality of the abnormal node based on the attributes of the nodes in the propagation graph.

[0153] In one example, the root cause analysis device 700 may further include a knowledge graph annotation unit 701, configured to construct a knowledge graph based on an ontology model and add an annotation attribute to the relationship between at least one pair of nodes in the constructed knowledge graph. The annotation attribute includes two sub-attributes: direction and context. The direction represents the propagation direction between the two nodes, and the context defines the specific scenario involved in the knowledge graph.

[0154] The propagation graph extraction unit 702 is further configured to: extract the propagation graph related to the abnormal node from the annotated knowledge graph using a query statement.

[0155] The propagation graph also includes the propagation direction between nodes.

[0156] The analysis unit 704 is further configured as follows:

[0157] All nodes in the propagation graph are arranged in descending order of their weights;

[0158] Perform the following operations starting from the first node in the sort:

[0159] The probability of an anomaly of a node is calculated based on at least one factor that affects the state of the node.

[0160] If the probability of an anomaly exceeds a predetermined threshold, the node is considered to be the root cause of the anomaly, and the operation is stopped.

[0161] Otherwise, perform the operation on the next node, and so on, until the operation has been performed on all nodes.

[0162] The weight of the node is determined based on at least one of the following:

[0163] The number of paths from the node to the abnormal node, the distance from the node to the abnormal node, and whether the node is an intermediary node.

[0164] The analysis unit 704 is further configured to calculate the probability of an anomaly of the node based on the degree of influence of the dominant and latent factors among at least one factor affecting the node state on the anomaly, and the moving average difference of each factor.

[0165] Details of the operation and function of each part of the root cause analysis device 700 can be obtained by referring to, for example, [reference needed]. Figure 1-6 The relevant parts of the embodiments of the root cause analysis method 100 described herein are the same or similar, and will not be described in detail here.

[0166] It should be noted here that... Figure 7 The structure of the root cause analysis device 700 and its constituent units shown is merely exemplary; those skilled in the art can modify it as needed. Figure 7 The structural diagram shown is modified.

[0167] As per the above reference Figures 1 to 7Embodiments of the root cause analysis method and apparatus according to embodiments of the present disclosure have been described. The root cause analysis apparatus described above can be implemented in hardware, software, or a combination of hardware and software.

[0168] Figure 8 A block diagram of an electronic device 800 performing root cause analysis according to an embodiment of the present disclosure is shown. According to one embodiment, the electronic device 800 may include at least one processor 802 that executes at least one computer-readable instruction (i.e., the elements implemented in software above) stored or encoded in a computer-readable storage medium (i.e., memory 804).

[0169] In one embodiment, computer-executable instructions are stored in memory 804, which, when executed, cause at least one processor 802 to perform the following actions: extracting a propagation graph from an annotated knowledge graph, wherein the propagation graph includes anomalous nodes where anomalies occur and nodes that have propagation relationships with the anomalous nodes; and analyzing the root cause of the anomalous nodes' anomalies based on the attributes of the nodes in the propagation graph.

[0170] It should be understood that the computer-executable instructions stored in memory 804, when executed, cause at least one processor 802 to perform the above-described combinations in the various embodiments of this disclosure. Figure 1-7 The description includes various operations and functions.

[0171] According to one embodiment, a non-transitory machine-readable medium is provided. This non-transitory machine-readable medium may have machine-executable instructions (i.e., the elements implemented in software as described above), which, when executed by a machine, cause the machine to perform the above-described combinations in the various embodiments of this disclosure. Figure 1-7 The description includes various operations and functions.

[0172] According to one embodiment, a computer program is provided, including computer-executable instructions that, when executed, cause at least one processor to perform the above-described embodiments of the present disclosure. Figure 1-7 The description includes various operations and functions.

[0173] According to one embodiment, a computer program product is provided, including computer-executable instructions that, when executed, cause at least one processor to perform the above-described embodiments of the present disclosure. Figure 1-7 The description includes various operations and functions.

[0174] The specific embodiments described above with reference to the accompanying drawings are exemplary embodiments, but do not represent all embodiments that can be implemented or fall within the scope of the claims. The term "exemplary" as used throughout this specification means "serving as an example, instance, or illustration" and does not imply that it is "preferred" or "advantageous" compared to other embodiments. Specific details are included to provide an understanding of the described techniques. However, these techniques can be practiced without these specific details. In some instances, well-known structures and apparatuses are shown in block diagram form to avoid obscuring the concepts of the described embodiments.

[0175] The foregoing description of this disclosure is provided to enable any person skilled in the art to implement or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein can be applied to other variations without departing from the scope of this disclosure. Therefore, this disclosure is not limited to the examples and designs described herein, but is consistent with the widest scope of the principles and novel features disclosed herein.

Claims

1. Root cause analysis methods, including: A knowledge graph is constructed based on an ontology model, and a propagation attribute is added to the relationship between at least one pair of nodes in the constructed knowledge graph. The propagation attribute includes two sub-attributes: direction and context. The direction represents the propagation direction between the two nodes, and the context represents the scenario in which the root cause analysis is to be performed. The ontology model is a unified template for integration. A propagation graph is extracted from the annotated knowledge graph. This propagation graph is a subgraph extracted from the annotated knowledge graph. It includes anomalous nodes exhibiting abnormal conditions and nodes with propagation relationships to these anomalous nodes. These anomalous nodes and nodes with propagation relationships are nodes in the production process of a manufacturing industry. The abnormal conditions are: abnormal key performance indicators (KPIs) or performance degradation. The root cause of the abnormality of the abnormal node is analyzed based on the attributes of the nodes in the propagation graph. The analysis of the root cause of the abnormality of the abnormal node based on the attributes of the nodes in the propagation graph includes: All nodes in the propagation graph are arranged in descending order of their weights, where the weight of a node represents the importance of a node in the entire propagation graph. Starting from the first node in the sorted sequence, perform the following operations: The abnormal probability of a node is calculated based on at least one factor affecting the node's state. It is then determined whether the calculated abnormal probability exceeds a predetermined threshold. If the abnormal probability exceeds the predetermined threshold, the node is determined to be the root cause of the abnormal situation, and the operation is stopped. Otherwise, the operation is performed on the next node until all nodes have been processed. The factors affecting the node's state are those that determine the probability of a node being in an abnormal state. The calculation of the abnormal probability based on at least one factor affecting the node's state involves calculating the abnormal probability of the node based on the moving average difference of at least one factor affecting the node's state, where the moving average difference measures the deviation between the short-term and long-term behavior of a factor.

2. The method as described in claim 1, wherein, Extracting propagation graphs from annotated knowledge graphs includes: The propagation graph related to the abnormal node is extracted from the annotated knowledge graph using a query statement.

3. The method as described in claim 1, wherein, The propagation diagram also includes the propagation direction between nodes.

4. The method of claim 1, wherein, The weight of the node is determined based on at least one of the following: The number of paths from the node to the abnormal node, the distance from the node to the abnormal node, and whether the node is an intermediary node.

5. The method of claim 1, wherein, Calculating the probability of an anomaly of a node based on at least one factor affecting its state includes: The probability of an anomaly of a node is calculated based on the degree of influence of the explicit and implicit factors among at least one factor affecting the node's state on the anomaly, as well as the moving average difference of each factor.

6. Root cause analysis device (700), comprising: The knowledge graph annotation unit (701) is configured to construct a knowledge graph based on an ontology model and add an annotation attribute to the relationship between at least one pair of nodes in the constructed knowledge graph. The annotation attribute includes two sub-attributes: direction and context. The direction represents the propagation direction between the two nodes, and the context represents the scenario in which root cause analysis is to be performed. The ontology model is a unified template for integration. The propagation graph extraction unit (702) is configured to extract a propagation graph from an annotated knowledge graph, wherein the propagation graph is a subgraph extracted from the annotated knowledge graph, the propagation graph includes abnormal nodes where abnormal situations occur and nodes with propagation relationships to the abnormal nodes, the abnormal nodes and nodes with propagation relationships to the abnormal nodes being nodes in the production process of a manufacturing industry, and the abnormal situations being: abnormal key performance indicators (KPIs) or performance degradation; and The analysis unit (704) is configured to analyze the root cause of the abnormality of the abnormal node based on the attributes of the nodes in the propagation graph. The analysis unit (704) analyzes the root cause of the abnormality of the abnormal node based on the attributes of the nodes in the propagation graph, including: All nodes in the propagation graph are arranged in descending order of their weights, where the weight of a node represents the importance of a node in the entire propagation graph. Starting from the first node in the sorted sequence, perform the following operations: The abnormal probability of a node is calculated based on at least one factor affecting the node's state. It is then determined whether the calculated abnormal probability exceeds a predetermined threshold. If the abnormal probability exceeds the predetermined threshold, the node is determined to be the root cause of the abnormal situation, and the operation is stopped. Otherwise, the operation is performed on the next node until all nodes have been processed. The factors affecting the node's state are those that determine the probability of a node being in an abnormal state. The calculation of the abnormal probability based on at least one factor affecting the node's state involves calculating the abnormal probability of the node based on the moving average difference of at least one factor affecting the node's state, where the moving average difference measures the deviation between the short-term and long-term behavior of a factor.

7. The apparatus (700) as claimed in claim 6, wherein, The propagation graph extraction unit (702) is further configured to: The propagation graph related to the abnormal node is extracted from the annotated knowledge graph using a query statement.

8. The apparatus (700) as claimed in claim 6, wherein, The propagation diagram also includes the propagation direction between nodes.

9. The apparatus (700) as claimed in claim 6, wherein, The weight of the node is determined based on at least one of the following: The number of paths from the node to the abnormal node, the distance from the node to the abnormal node, and whether the node is an intermediary node.

10. The apparatus of claim 6, wherein, The analysis unit (704) is further configured as follows: The probability of an anomaly of a node is calculated based on the degree of influence of the explicit and implicit factors among at least one factor affecting the node's state on the anomaly, as well as the moving average difference of each factor.

11. Electronic equipment (800), including: At least one processor (802); as well as A memory (804) coupled to the at least one processor (802), the memory being used to store instructions that, when executed by the at least one processor (802), cause the processor (802) to perform the method as described in any one of claims 1 to 5.

12. A non-transitory machine-readable storage medium storing executable instructions that, when executed, cause the machine to perform the method as described in any one of claims 1 to 5.

13. A computer program comprising computer-executable instructions, which, when executed, cause at least one processor to perform the method according to any one of claims 1 to 5.

14. A computer program product tangibly stored on a computer-readable medium and comprising computer-executable instructions that, when executed, cause at least one processor to perform the method according to any one of claims 1 to 5.

Images