A method, device and electronic equipment for locating root cause of fault

Abstract

The present invention provides a method, device and electronic device for locating the root cause of a fault, which solves the problem of low efficiency of existing root cause locating. The method of the present invention includes: obtaining first key performance indicator KPI data between a first moment and a fault mitigation moment, the first moment being a first preset moment before the moment when the fault occurs; determining the KPI mutation moment according to the first KPI data; obtaining KPI mutation characteristics and KPI difference characteristics according to second KPI data related to the KPI mutation moment; determining the root cause KPI of the fault according to the KPI mutation characteristics and KPI difference characteristics. The present invention can accurately and efficiently locate the root cause KPI of the fault under the condition that only the relevant KPI data is known, and the method has low complexity, and the locating process does not require manual intervention, thereby reducing labor costs.

Description

Technical Field

[0001] The present invention relates to the technical field of fault location, and in particular to a method, device and electronic equipment for locating a root cause of a fault. Background Art

[0002] Server downtime, malicious attacks, and network problems can cause interruptions to Internet-based services, which in turn affects user experience and corporate revenue. Operation and maintenance personnel monitor a variety of key performance indicators (KPIs) to locate the KPIs that cause problems, i.e., the root causes, and then solve the problems and restore services. Therefore, accurate and efficient root cause location is crucial to improving operation and maintenance efficiency and user experience.

[0003] The existing root cause location methods, firstly, require operation and maintenance personnel to manually find the problem, which is not only very time-consuming, but also the accuracy depends on the experience of the operation and maintenance personnel, and it is difficult to achieve a uniform level; secondly, the root cause is located by constructing a fault propagation graph, but the information required to construct the fault propagation graph is currently insufficient, and the fault propagation graph will change with the change of service, which makes it difficult to maintain. Summary of the invention

[0004] The object of the present invention is to provide a fault root cause location method, device and electronic equipment, which are used to solve the problem of low efficiency of existing root cause location.

[0005] In order to achieve the above object, the present invention provides a method for locating the root cause of a fault, comprising:

[0006] Acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs;

[0007] Determine the KPI mutation moment according to the first KPI data;

[0008] According to the second KPI data related to the KPI mutation moment, a KPI mutation feature and a KPI difference feature are obtained, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment;

[0009] The fault root cause KPI is determined according to the KPI mutation feature and the KPI difference feature.

[0010] The step of determining the KPI mutation time according to the first KPI data includes:

[0011] A first-order difference calculation is performed on the first KPI data to obtain a KPI mutation time.

[0012] Wherein, according to the second KPI data related to the KPI mutation moment, the KPI mutation feature and the KPI difference feature are obtained, including:

[0013] A KPI mutation feature is calculated based on third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time;

[0014] The KPI difference feature is calculated based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

[0015] The step of calculating the KPI mutation feature according to the third KPI data and the fourth KPI data in the second KPI data includes:

[0016] According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained;

[0017] According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

[0018] The step of calculating the KPI difference feature based on the fifth KPI data and the sixth KPI data in the second KPI data includes:

[0019] Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result;

[0020] The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

[0021] The determining of the fault root cause KPI according to the KPI mutation feature and the KPI difference feature includes:

[0022] The KPI mutation feature and the KPI difference feature are combined to obtain a KPI comprehensive feature;

[0023] Clustering the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters;

[0024] A fault root cause KPI is determined according to the multiple KPI clusters.

[0025] The KPIs are clustered according to the KPI comprehensive characteristics to obtain multiple KPI clusters, including:

[0026] Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated;

[0027] The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

[0028] The determining of the fault root cause KPI according to the multiple KPI clusters includes:

[0029] Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster;

[0030] A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

[0031] The present invention also provides a fault root cause locating device, comprising:

[0032] An acquisition module, used to acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs;

[0033] A first processing module, used to determine a KPI mutation moment according to the first KPI data;

[0034] A second processing module is used to obtain a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment;

[0035] The fault root cause determination module is used to determine the fault root cause KPI according to the KPI mutation feature and the KPI difference feature.

[0036] The present invention also provides an electronic device, comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, and the processor is used to perform the following operations:

[0037] Acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs;

[0038] Determine the KPI mutation moment according to the first KPI data;

[0039] According to the second KPI data related to the KPI mutation moment, a KPI mutation feature and a KPI difference feature are obtained, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment;

[0040] The fault root cause KPI is determined according to the KPI mutation feature and the KPI difference feature.

[0041] The processor is further configured to execute the following process:

[0042] A first-order difference calculation is performed on the first KPI data to obtain a KPI mutation time.

[0043] The processor is further configured to execute the following process:

[0044] A KPI mutation feature is calculated based on third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time;

[0045] The KPI difference feature is calculated based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

[0046] The processor is further configured to execute the following process:

[0047] According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained;

[0048] According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

[0049] The processor is further configured to execute the following process:

[0050] Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result;

[0051] The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

[0052] The processor is further configured to execute the following process:

[0053] The KPI mutation feature and the KPI difference feature are combined to obtain a KPI comprehensive feature;

[0054] Clustering the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters;

[0055] A fault root cause KPI is determined according to the multiple KPI clusters.

[0056] The processor is further configured to execute the following process:

[0057] Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated;

[0058] The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

[0059] The processor is further configured to execute the following process:

[0060] Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster;

[0061] A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

[0062] The present invention also provides an electronic device, comprising a memory, a processor, and a program stored in the memory and executable on the processor; when the processor executes the program, the method for locating the root cause of a fault as described above is implemented.

[0063] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the fault root cause locating method as described above are implemented.

[0064] The above technical solution of the present invention has at least the following beneficial effects:

[0065] In an embodiment of the present invention, by obtaining first key performance indicator KPI data between a first moment and a fault mitigation moment, the first moment being a first preset moment before the moment when the fault occurs; determining a KPI mutation moment according to the first KPI value; obtaining a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, the KPI mutation feature being used to characterize the quantitative difference in KPI values ​​before and after the KPI mutation moment, and the KPI difference feature being used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; determining the fault root cause KPI according to the KPI mutation feature and the KPI difference feature, in this way, the fault root cause KPI can be accurately and efficiently located under the condition that only relevant KPI data is known, and the method has low complexity, and the positioning process does not require manual intervention, thereby reducing labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A schematic diagram showing a flow chart of a method for locating a root cause of a fault according to an embodiment of the present invention;

[0067] Figure 2 A schematic diagram showing a module of a fault root cause locating device according to an embodiment of the present invention;

[0068] Figure 3 A schematic diagram showing the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0070] The present invention aims to solve the problem of low efficiency of existing root cause positioning and provides a fault root cause positioning method, device and electronic equipment.

[0071] like Figure 1 FIG. 1 is a flow chart of a method for locating the root cause of a fault provided by an embodiment of the present invention. The method specifically includes:

[0072] Step 101, obtaining first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs;

[0073] In this step, when a network failure is detected, the time when the failure occurs will be recorded. f and fault relief time T m .

[0074] It should be noted that network failures may include network service interruption, degradation of indicators measuring network quality, etc. For example, when a certain indicator is monitored to be degraded, the indicator degradation time (failure occurrence time) and the cell where the indicator degradation occurs will be recorded.

[0075] Here, the fault occurrence time T is known. f and fault relief time T m According to the delay characteristics of fault propagation, the root cause KPI mutation may occur at T f Therefore, the detection interval of the mutation moment is determined between the first moment and the fault mitigation moment, that is, [T f -ω1,T m ], where T f -ω1 represents the first moment.

[0076] It should be noted that ω1 is a parameter determined according to the KPI time granularity. Here, the KPI time granularity can be understood as the sampling frequency of the KPI data.

[0077] Step 102, determining a KPI mutation time according to the first KPI data;

[0078] This step may specifically include:

[0079] A first-order difference calculation is performed on the first KPI data to obtain a KPI mutation time.

[0080] It should be noted that the time point at which the absolute value of the first-order difference is the KPI mutation time T c .

[0081] Step 103, obtaining a KPI mutation feature and a KPI difference feature according to the second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in KPI values ​​before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the KPI deviation from the expected value after the KPI mutation moment;

[0082] It should be noted that, the KPI mutation time obtained in step 102 can be used to obtain the KPI mutation time T c Related second KPI data.

[0083] Step 104: determine the fault root cause KPI according to the KPI mutation feature and the KPI difference feature.

[0084] The fault root cause location method of the embodiment of the present invention obtains first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; determines a KPI mutation moment according to the first KPI value; obtains a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in KPI values ​​before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; determines the fault root cause KPI according to the KPI mutation feature and the KPI difference feature, thereby accurately and efficiently locating the fault root cause KPI under the condition that only relevant KPI data is known, and the method has low complexity, and the locating process does not require manual intervention, thereby reducing labor costs.

[0085] As an optional implementation, step 103 of the method in the embodiment of the present invention may include:

[0086] A KPI mutation feature is calculated based on third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time;

[0087] In this step, the KPI mutation time T c From the second preset time before to the KPI mutation time T c Denoted as [T c -ω2,T c ), where T c -ω2 is the second preset time; the KPI mutation time T c To the fault relief time T m Denoted as [T c ,T m ].

[0088] Here, the data of the period ω2 before the mutation moment, i.e., the third KPI data, is recorded as {x i}.

[0089] The interval [T c ,T m ], that is, the data between the KPI mutation moment and the fault mitigation moment, that is, the fourth KPI data is recorded as {x j}.

[0090] Here, this step may specifically include:

[0091] According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained;

[0092] Specifically, the third KPI data {x i Substitute it into formula (1) to obtain the probability density function of KPI when no mutation occurs.

[0093]

[0094] Wherein, K(·) is a Gaussian function, and n represents the number of the third KPI data.

[0095] Here, a non-parametric probability density estimation method is used. Specifically, a kernel density method is used to estimate the probability density function of the KPI when no mutation occurs.

[0096] According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

[0097] Specifically, the third KPI data, the fourth KPI data and the probability density function are used to calculate the KPI rising probability through the following formula (2).

[0098]

[0099] Where l represents the number of the fourth KPI data, P(X≥x j |{x i}) is the probability value obtained based on the probability density function.

[0100] Furthermore, the KPI decrease probability is calculated by using the third KPI data, the fourth KPI data and the probability density function through the following formula (3).

[0101]

[0102] Where l represents the number of the fourth KPI data, P(X≤x j |{x i}) is the probability value obtained based on the probability density function.

[0103] Here, P o represents the probability of rising, P u Indicates the probability of decrease.

[0104] Then, the KPI increase mutation degree is calculated by the following formula (4), and the KPI decrease mutation degree is calculated by the following formula (5).

[0105]

[0106]

[0107] Among them, o represents the KPI increase mutation degree, and u represents the KPI decrease mutation degree.

[0108] The KPI difference feature is calculated based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

[0109] In this step, the fifth KPI data is based on the KPI mutation time T c KPI mutation time T predicted by previous KPI data c The KPI data for the future.

[0110] Optionally, in the prediction stage, according to the KPI mutation time T c The previous KPI data was predicted using the exponential smoothing method, the previous cycle substitution method, the Holt method, the Holt-Winters method, the time series decomposition method, the historical simultaneous mean / median method, and the prophet method, and 8 prediction results were obtained, and the average of the 8 prediction results was calculated. That is the fifth KPI data. Among them, the 8 methods mentioned above are all time series prediction methods.

[0111] Here, this step may specifically include:

[0112] Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result;

[0113] Specifically, through formula (6), we can calculate The difference between the actual value F(t) and the KPI difference result is obtained.

[0114]

[0115] The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

[0116] Here, the true value F(t) is the sixth KPI data.

[0117] Here, in order to reduce the different impacts of the magnitudes of different KPI difference features, this step uses feature normalization and feature amplification to process the difference results.

[0118] Specifically, first, the Diff feature is normalized using the z-score method. Then, the normalized Diff is amplified using formula (7) to obtain the KPI difference feature Diff. a .

[0119]

[0120] Among them, x is a variable used to represent each value in the normalized Diff; α and β are known parameters.

[0121] Here, each value in the normalized Diff is substituted into formula (7) to obtain a new array, namely, KPI difference feature Diff a .

[0122] As an optional implementation, step 104 of the method in the embodiment of the present invention may include:

[0123] The KPI mutation feature and the KPI difference feature are combined to obtain a KPI comprehensive feature;

[0124] In this step, the comprehensive KPI feature can be expressed as [Diff a ,u,o], where ,Diff a represents the KPI difference feature, and u and o represent the KPI mutation feature.

[0125] Clustering the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters;

[0126] In this step, optionally, according to the comprehensive characteristics of the KPI, the KPI is clustered using a DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm.

[0127] Here, this step may specifically include:

[0128] Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated;

[0129] Specifically, for any two KPI comprehensive features Keep K i Do not move, make K j In K i Slide up, the sliding range is s∈(-r,r), and the inner product is calculated once for each sliding step. j It can be expressed as:

[0130]

[0131] Here, r represents the length of the KPI comprehensive feature.

[0132] Then, K is calculated by formula (8): i and The inner product of:

[0133]

[0134] Finally, the cross-correlation coefficient is calculated by formula (9):

[0135]

[0136] The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

[0137] In this step, optionally, the cross-correlation coefficient As a distance metric, the DBSCAN algorithm is used to cluster KPIs and obtain multiple KPI clusters.

[0138] A fault root cause KPI is determined according to the multiple KPI clusters.

[0139] Here, this step may specifically include:

[0140] Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster;

[0141] Here, the KPI mutation characteristics include the KPI increase mutation degree u and the KPI decrease mutation degree o.

[0142] A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

[0143] It should be noted that the KPI mutation moments corresponding to the various KPIs in the target KPI cluster are different.

[0144] Here, optionally, each KPI is sorted in ascending order according to the KPI mutation time, and the KPIs ranked in the top n positions in the sorting result are determined as the fault root cause KPIs.

[0145] Finally, the operation and maintenance personnel can take corresponding treatment measures to solve the network failure according to the fault root cause KPI obtained by the above method. Due to the method of the embodiment of the present application, the fault root cause KPI can be accurately and efficiently located, thereby improving the efficiency of subsequent operation and maintenance personnel in solving network failures.

[0146] The fault root cause location method of the embodiment of the present invention obtains first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; determines a KPI mutation moment according to the first KPI value; obtains a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in KPI values ​​before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; determines the fault root cause KPI according to the KPI mutation feature and the KPI difference feature, thereby accurately and efficiently locating the fault root cause KPI under the condition that only relevant KPI data is known, and the method has low complexity, and the locating process does not require manual intervention, thereby reducing labor costs.

[0147] like Figure 2 As shown, an embodiment of the present invention further provides a fault root cause locating device, the device comprising:

[0148] An acquisition module 201 is used to acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before a fault occurs;

[0149] A first processing module 202 is used to determine a KPI mutation moment according to the first KPI data;

[0150] The second processing module 203 is used to obtain a KPI mutation feature and a KPI difference feature according to the second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the KPI deviation from the expected value after the KPI mutation moment;

[0151] The fault root cause determination module 204 is used to determine the fault root cause KPI according to the KPI mutation feature and the KPI difference feature.

[0152] Optionally, the first processing module 202 includes:

[0153] The first processing unit is used to perform first-order difference calculation on the first KPI data to obtain a KPI mutation time.

[0154] Optionally, the second processing module 203 includes:

[0155] A second processing unit is configured to calculate a KPI mutation feature according to third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time;

[0156] The third processing unit is used to calculate the KPI difference feature based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

[0157] Optionally, the second processing unit is specifically configured to:

[0158] According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained;

[0159] According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

[0160] Optionally, the third processing unit is specifically configured to:

[0161] Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result;

[0162] The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

[0163] Optionally, the fault root cause determination module 204 includes:

[0164] A feature concatenation unit, used to concatenate the KPI mutation feature and the KPI difference feature to obtain a KPI comprehensive feature;

[0165] A clustering unit, used to cluster the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters;

[0166] The fault root cause determination unit is used to determine the fault root cause KPI according to the multiple KPI clusters.

[0167] Optionally, the clustering unit is specifically used for:

[0168] Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated;

[0169] The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

[0170] Optionally, the fault root cause determination unit is specifically used to:

[0171] Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster;

[0172] A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

[0173] The fault root cause locating device of the embodiment of the present invention obtains first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; determines a KPI mutation moment according to the first KPI value; obtains a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in KPI values ​​before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; determines the fault root cause KPI according to the KPI mutation feature and the KPI difference feature, thereby being able to accurately and efficiently locate the fault root cause KPI under the condition that only relevant KPI data is known, and the method has low complexity, and the locating process does not require manual intervention, thereby reducing labor costs.

[0174] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0175] In order to better achieve the above goals, Figure 3 As shown, an embodiment of the present invention further provides an electronic device, including a processor 300 and a transceiver 310, wherein the transceiver 310 receives and sends data under the control of the processor, and the processor 300 is used to perform the following process:

[0176] Acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs;

[0177] Determine the KPI mutation moment according to the first KPI data;

[0178] According to the second KPI data related to the KPI mutation moment, a KPI mutation feature and a KPI difference feature are obtained, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment;

[0179] The fault root cause KPI is determined according to the KPI mutation feature and the KPI difference feature.

[0180] Optionally, the processor 300 is further configured to:

[0181] A first-order difference calculation is performed on the first KPI data to obtain a KPI mutation time.

[0182] Optionally, the processor 300 is further configured to:

[0183] A KPI mutation feature is calculated based on third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time;

[0184] The KPI difference feature is calculated based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

[0185] Optionally, the processor 300 is further configured to:

[0186] According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained;

[0187] According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

[0188] Optionally, the processor 300 is further configured to:

[0189] Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result;

[0190] The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

[0191] Optionally, the processor 300 is further configured to:

[0192] The KPI mutation feature and the KPI difference feature are combined to obtain a KPI comprehensive feature;

[0193] Clustering the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters;

[0194] A fault root cause KPI is determined according to the multiple KPI clusters.

[0195] Optionally, the processor 300 is further configured to:

[0196] Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated;

[0197] The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

[0198] Optionally, the processor 300 is further configured to:

[0199] Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster;

[0200] A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

[0201] The electronic device of the embodiment of the present invention obtains first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; determines a KPI mutation moment according to the first KPI value; obtains a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in KPI values ​​before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; determines the fault root cause KPI according to the KPI mutation feature and the KPI difference feature, thereby being able to accurately and efficiently locate the fault root cause KPI when only relevant KPI data is known, and the method has low complexity, and the positioning process does not require manual intervention, thereby reducing labor costs.

[0202] An embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, each process in the embodiment of the fault root cause locating method as described above is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0203] The embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, each process in the above-mentioned fault root cause location method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0204] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0205] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A device that specifies functions in one or more processes and / or one or more blocks.

[0206] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable storage medium produce a paper product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0207] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that the computer or other programmable device executes a series of operating steps to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0208] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for locating the root cause of a fault, characterized in that: include: Acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; Determine the KPI mutation moment according to the first KPI data; According to the second KPI data related to the KPI mutation moment, a KPI mutation feature and a KPI difference feature are obtained, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; Determine the fault root cause KPI according to the KPI mutation feature and the KPI difference feature; According to the second KPI data related to the KPI mutation moment, a KPI mutation feature and a KPI difference feature are obtained, including: A KPI mutation feature is calculated based on third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time; The KPI difference feature is calculated based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

2. The method according to claim 1, characterized in that: Determining the KPI mutation time according to the first KPI data includes: A first-order difference calculation is performed on the first KPI data to obtain a KPI mutation time.

3. The method according to claim 1, characterized in that The calculating and obtaining the KPI mutation feature according to the third KPI data and the fourth KPI data in the second KPI data includes: According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained; According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

4. The method according to claim 1, characterized in that: The calculating and obtaining the KPI difference feature according to the fifth KPI data and the sixth KPI data in the second KPI data includes: Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result; The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

5. The method according to claim 1, characterized in that The determining the fault root cause KPI according to the KPI mutation feature and the KPI difference feature includes: The KPI mutation feature and the KPI difference feature are combined to obtain a KPI comprehensive feature; Clustering the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters; A fault root cause KPI is determined according to the multiple KPI clusters.

6. The method according to claim 5, characterized in that The KPIs are clustered according to the KPI comprehensive features to obtain multiple KPI clusters, including: Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated; The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

7. The method according to claim 5, characterized in that The determining the fault root cause KPI according to the multiple KPI clusters includes: Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster; A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

8. A fault root cause location device, characterized in that: include: An acquisition module, used to acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; A first processing module, used to determine a KPI mutation moment according to the first KPI data; A second processing module is used to obtain a KPI mutation feature and a KPI difference feature according to second KPI data related to the KPI mutation moment, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; A fault root cause determination module, used to determine the fault root cause KPI according to the KPI mutation feature and the KPI difference feature; The second processing module comprises: A second processing unit is configured to calculate a KPI mutation feature according to third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time; The third processing unit is used to calculate the KPI difference feature based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

9. An electronic device comprising a processor and a transceiver, wherein the transceiver receives and sends data under the control of the processor, characterized in that: The processor is configured to perform the following operations: Acquire first key performance indicator KPI data between a first moment and a fault mitigation moment, wherein the first moment is a first preset moment before the fault occurs; Determine the KPI mutation moment according to the first KPI data; According to the second KPI data related to the KPI mutation moment, a KPI mutation feature and a KPI difference feature are obtained, wherein the KPI mutation feature is used to characterize the quantitative difference in the KPI value before and after the KPI mutation moment, and the KPI difference feature is used to characterize the difference in the change of the KPI from the expected value after the KPI mutation moment; Determine the fault root cause KPI according to the KPI mutation feature and the KPI difference feature; The processor is also used to execute the following process: A KPI mutation feature is calculated based on third KPI data and fourth KPI data in the second KPI data, wherein the third KPI data is KPI data between a second preset time before the KPI mutation time and the KPI mutation time, and the fourth KPI data is KPI data between the KPI mutation time and the fault mitigation time; The KPI difference feature is calculated based on the fifth KPI data and the sixth KPI data in the second KPI data, wherein the fifth KPI data is the KPI data after the KPI mutation moment predicted based on the KPI data before the KPI mutation moment, and the sixth KPI data is the KPI data between the KPI mutation moment and the fault occurrence moment.

10. The electronic device according to claim 9, characterized in that: The processor is also used to execute the following process: A first-order difference calculation is performed on the first KPI data to obtain a KPI mutation time.

11. The electronic device according to claim 9, characterized in that: The processor is also used to execute the following process: According to the third KPI data and a preset probability density estimation algorithm, a probability density function of the KPI when no mutation occurs is obtained; According to the probability density function, the third KPI data and the fourth KPI data, the KPI increase mutation degree and the KPI decrease mutation degree are calculated, and the KPI increase mutation degree and the KPI decrease mutation degree are determined as KPI mutation features.

12. The electronic device according to claim 9, characterized in that: The processor is also used to execute the following process: Calculate the difference between the fifth KPI data and the sixth KPI data to obtain a difference result; The difference results are subjected to feature normalization and feature amplification processing to obtain KPI difference features.

13. The electronic device according to claim 9, characterized in that: The processor is also used to perform the following process: The KPI mutation feature and the KPI difference feature are combined to obtain a KPI comprehensive feature; Clustering the KPIs according to the KPI comprehensive characteristics to obtain multiple KPI clusters; A fault root cause KPI is determined according to the multiple KPI clusters.

14. The electronic device according to claim 13, characterized in that: The processor is also used to execute the following process: Based on the comprehensive characteristics of any two KPIs, the cross-correlation coefficient is calculated; The cross-correlation coefficient is used as a distance metric and a preset clustering algorithm is used to cluster the KPIs to obtain a plurality of KPI clusters.

15. The electronic device according to claim 13, characterized in that: The processor is also used to execute the following process: Determine the cluster where the KPI having the maximum average KPI increase mutation degree or the maximum average KPI decrease mutation degree among the KPI mutation characteristics selected from the multiple KPI clusters is located as the target KPI cluster; A preset number of KPIs that are temporally earlier in the KPI mutation moments corresponding to the KPIs in the target KPI cluster are determined as fault root cause KPIs.

16. An electronic device comprising a memory, a processor, and a program stored in the memory and executable on the processor; characterized in that: When the processor executes the program, the fault root cause locating method according to any one of claims 1 to 7 is implemented.

17. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the fault root cause locating method according to any one of claims 1 to 7 are implemented.

Images