A method and apparatus for determining a root cause of a fault

Abstract

The embodiment of the application discloses a kind of fault root cause determination method and device, improve the accuracy of determining fault root cause probability.The method comprises: receiving the M abnormal event information sent by target network element, M abnormal event information is used to indicate M abnormal event, M abnormal event is associated with N target resource object, N target resource object is N resource object in T resource object associated with target network element, every resource object in T resource object is associated with a resource label, resource label is used to indicate the resource type of resource object, M, T, N are all positive integers;According to N target resource object, M abnormal event and the resource label of every resource object in T resource object, determine the target fault root cause probability of every target resource object in N target resource object;According to the target fault root cause probability of every target resource object, determine the fault root cause of generating M abnormal event.

Description

Technical Field

[0001] This application relates to the field of fault analysis technology, and in particular to a method and apparatus for determining the root cause of a fault. Background Technology

[0002] In the telecommunications field, network management equipment (referred to as network administrators) detects and analyzes network anomalies through event information. Event information may include alarms, performance metrics, and logs. When a network failure occurs, the root cause can be analyzed based on the event information. Telecommunications network maintenance personnel can then repair the fault based on the analysis results, thereby restoring services.

[0003] Currently, there is a method for determining the root cause of a fault. When performing root cause analysis, a fault propagation graph is used to determine a fault propagation path, and then root cause deduction analysis is performed based on this path to identify the root cause. However, this approach is only applicable to scenarios where only one fault propagation path is determined from the fault propagation graph. When multiple fault propagation paths are identified in the graph, it becomes impossible to determine the true root cause from these paths. For example, in a cloud core network scenario, the fault propagation graph may contain descriptions of the fault phenomenon from different perspectives, resulting in multiple fault propagation paths and making it impossible to accurately identify the root cause. Summary of the Invention

[0004] This application provides a method and apparatus for determining the root cause of a fault, thereby improving the accuracy of determining the probability of the root cause of a fault.

[0005] To achieve the above objectives, embodiments of this application provide the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a method for determining the root cause of a fault, comprising: receiving M abnormal event information sent by a target network element, wherein the M abnormal event information is used to indicate M abnormal events, the M abnormal events are associated with N target resource objects, the N target resource objects are N resource objects among T resource objects associated with the target network element, each of the T resource objects is associated with a resource tag, the resource tag is used to indicate the resource type of the resource object, and M, T, and N are all positive integers; determining the target fault root cause probability of each target resource object among the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tag of each resource object among the T resource objects; and determining the fault root cause that generated the M abnormal events based on the target fault root cause probability of each target resource object. Through this method, the determining device can perform fault analysis based on N, M, and T to determine the target fault root cause probability of each target resource object among the N target resource objects. In this embodiment of the application, the probability of the root cause of the failure that can be obtained for each resource object is related to the resource tag configured for that resource object, thereby enabling a more accurate acquisition of the probability of the root cause of the failure of the resource object.

[0007] In one possible design, determining the target root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects includes: determining the initial root cause probability of each of the N target resource objects based on the N target resource objects and the M abnormal events; and adjusting the initial root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects to obtain the target root cause probability of each of the N target resource objects. Through this method, in this embodiment of the application, by adjusting the initial root cause probability, the target root cause probability of the target resource object can be obtained, thereby making the target root cause probability more accurately represent the probability that the target resource object is the root cause of the failure. The root cause probability obtainable for each resource object is related to the resource tags configured for that resource object, enabling more accurate acquisition of the root cause probability of the resource object's failure.

[0008] In one possible design, the N target resource objects include Nm target resource objects, all of which have the same resource tag, where Nm is a positive integer; the T resource objects include Tn resource objects, all of which have the same resource tag, and the resource tags of the Nm target resource objects are the same as those of the Tn resource objects, where Tn is a positive integer; determining the target root cause probability of each target resource object among the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tag of each resource object among the T resource objects includes: determining the target root cause probability of each target resource object among the Nm target resource objects based on the Nm target resource objects and the Tn resource objects. In this method, Nm represents the number of target resource objects with the same resource tag associated with an abnormal event, and Tn represents the total number of resource objects with the same resource tag. The device can determine the percentage of the number of target resource objects with the same resource tag to the number of resource objects with the same resource tag by using Nm and Tn. Finally, based on Nm target resource objects and Tn resource objects, it determines the target fault root cause probability of each target resource object among the Nm target resource objects.

[0009] In one possible design, determining the target root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects includes: determining the initial root cause probability of each of the Nm target resource objects based on the abnormal events associated with each of the Nm target resource objects; and adjusting the initial root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects to obtain the target root cause probability of each of the Nm target resource objects. Through this method, after determining the initial root cause probability of each target resource object, the initial root cause probability is adjusted based on the Nm target resource objects and the Tn resource objects to obtain the final target root cause probability.

[0010] In one possible design, adjusting the initial root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects to obtain the target root cause probability of each of the Nm target resource objects includes: obtaining the target root cause probability of any one of the Nm target resource objects as follows: P = Po – (Nm / Tn); where P represents the target root cause probability of any one of the Nm target resource objects, Po represents the initial root cause probability of any one of the Nm target resource objects, Nm represents the number of target resource objects with the same resource tag among the N target resource objects, and Tn represents the number of resource objects with the same resource tag as the Nm target resource objects among the T resource objects. Through this method, Nm / Tn can be used to adjust Po, and the result after adjusting Po is used as the aforementioned target root cause probability P of any one of the Nm target resource objects. For example, if resource objects of the same type fail simultaneously, the probability that these resource objects are the root cause of the failure is reduced. For instance, if resource objects in multiple regions fail, the root cause is likely not the resource objects in those regions; conversely, if only one APN fails, the root cause is likely that APN.

[0011] In one possible design, the method further includes: determining the resource label of each of the T resource objects based on the mapping relationship between resource objects and resource labels. Through this method, the determining device can obtain the mapping relationship between resource objects and resource labels. This mapping relationship represents the resource label corresponding to a resource object, and each resource object can be labeled with a corresponding resource label through this mapping relationship. For example, the determining device pre-determines the mapping relationship between resource objects and resource labels. After obtaining a resource object, it queries the mapping relationship to obtain the resource label of that resource object, configures the corresponding resource label for that resource object, and thus classifies all target resource objects associated with the abnormal event through the resource labels, so as to determine the target fault root cause probability of each target resource object according to the resource objects corresponding to the same resource label.

[0012] In one possible design, the method further includes: acquiring resource adaptation information and resource object information of the target network element, wherein the resource adaptation information includes: resource tag information of resource objects in the target network element, and the resource object information includes: T resource objects obtained by dividing service resources in the target network element according to service type, and the connection relationship between the T resource objects and the target network element; determining the mapping relationship between the resource objects and resource tags based on the resource adaptation information and the resource object information. Through this method, the determining device can acquire the mapping relationship between resource objects and resource tags. The mapping relationship between resource objects and resource tags is used to represent the resource tag corresponding to a resource object. Through the above mapping relationship, each resource object can be assigned a corresponding resource tag. For example, the determining device pre-determines the mapping relationship between resource objects and resource tags. After acquiring a resource object, querying the above mapping relationship can obtain the resource tag of the resource object, configure the corresponding resource tag for the resource object, and thus classify all target resource objects associated with abnormal events through resource tags, so as to determine the target fault root cause probability of each target resource object according to the resource objects corresponding to the same resource tag.

[0013] In one possible design, the resource tag information includes: the type information of the resource object, the name information of the resource object, and the resource tag of the resource object.

[0014] In one possible design, the connection relationship between the T resource objects and the target network element includes: the connection relationship between the target network element and each of the T resource objects; or, the T resource objects include: a first resource object and a second resource object, wherein the first resource object is a resource object connected to the target network element, and the second resource object is an object connected to the first resource object; the connection relationship between the T resource objects and the target network element includes: the connection relationship between the target network element and the first resource object, and the connection relationship between the first resource object and the second resource object.

[0015] In one possible design, determining the root cause of the M abnormal events based on the target root cause probability of each target resource object includes: determining the target resource object with the highest target root cause probability as the target resource object belonging to the root cause of the fault, based on the target root cause probability of each of the N target resource objects. Through this method, after determining the target root cause probability of each of the N target resource objects, the determining device can select the target resource object belonging to the root cause of the fault from the N target resource objects based on the target root cause probability of each target resource object. For example, selecting the target root cause probability with the highest probability from the target root cause probabilities of each target resource object in the N target resource objects is the target resource object belonging to the root cause of the fault. In the embodiments of this application, the target root cause probability of each of the N target resource objects can be used to select the target resource object belonging to the root cause of the fault, thereby accurately finding the target resource object belonging to the true root cause of the fault.

[0016] In one possible design, the N target resource objects include: a first target resource object and a second target resource object; the connection relationship of the N target resource objects includes: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object; after obtaining the target fault root cause probability of each of the N target resource objects, the method further includes: determining at least one fault propagation chain based on the connection relationship of the N target resource objects, wherein the fault propagation chain includes: the connection relationship between the target network element and the first target resource object, and the connection relationship between the first target resource object and the second target resource object; determining the fault probability of the fault propagation chain based on the target fault root cause probability of the first target resource object and the target fault root cause probability of the second target resource object. Through this method, for a fault propagation chain, the fault probability of the fault propagation chain can be obtained from the target fault root cause probabilities of all target resource objects in the fault propagation chain. The calculation method for the fault probability of the fault propagation chain is not limited in this application embodiment. The probability of a failure propagation chain being the true root cause of a failure can be determined by analyzing its failure probability. Therefore, the target resource object that is the true root cause of a failure can be identified using the failure probability of the propagation chain.

[0017] In one possible design, the method further includes: when multiple fault propagation chains are generated, determining the fault propagation chain with the highest fault probability among the multiple fault propagation chains as the fault propagation chain belonging to the root cause of the fault. Through this method, in scenarios where multiple fault propagation chains are generated, the fault propagation chains are sorted according to their fault probability, and the fault propagation chain with the highest fault probability is selected as the fault propagation chain belonging to the root cause of the fault. This obtains the fault propagation chain belonging to the true root cause of the fault. Further analysis of the fault propagation chain belonging to the true root cause of the fault allows the identification of the target resource object that generated the true root cause of the fault within that fault propagation chain.

[0018] In one possible design, determining the failure probability of the fault propagation chain based on the target failure root cause probability of the first target resource object and the target failure root cause probability of the second target resource object includes: calculating the average value of the target failure root cause probability of the first target resource object and the target failure root cause probability of the second target resource object, and using the obtained average value as the failure probability of the fault propagation chain.

[0019] In one possible design, the N target resource objects include: a first target resource object and a second target resource object; the connection relationship of the N target resource objects includes: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object; the step of adjusting the initial root cause probability of each target resource object in the N target resource objects according to the N target resource objects, the M abnormal events, and the resource tags of each resource object in the T resource objects to obtain the target root cause probability of each target resource object in the N target resource objects includes: determining the occurrence time of the abnormal event of the first target resource object and the occurrence time of the abnormal event of the second target resource object; when the occurrence time of the abnormal event of the first target resource object is earlier than the occurrence time of the abnormal event of the second target resource object, increasing the initial root cause probability of the first target resource object by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the first target resource object; decreasing the initial root cause probability of the second target resource object by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the second target resource object. In this method, the preset probability can be an absolute value (e.g., a probability value) used to adjust the initial root cause probability of a fault, or a relative value used to adjust the initial root cause probability of a fault; no limitation is made here. In this embodiment, the initial root cause probability of a fault is adjusted according to the occurrence time of the abnormal event of the target resource object, thereby obtaining the target root cause probability of a fault. The occurrence time of the abnormal event can be used to determine whether the target resource object is the true root cause of the fault.

[0020] Secondly, embodiments of this application provide a determining device, the device comprising: a receiving module and a processing module, wherein,

[0021] The receiving module is used to receive M abnormal event information sent by the target network element. The M abnormal event information is used to indicate M abnormal events. The M abnormal events are associated with N target resource objects. The N target resource objects are N resource objects out of T resource objects associated with the target network element. Each of the T resource objects is associated with a resource tag. The resource tag is used to indicate the resource type of the resource object. M, T, and N are all positive integers.

[0022] The processing module is configured to determine the target fault root cause probability of each target resource object among the N target resource objects, the M abnormal events, and the resource tags of each resource object among the T resource objects; and to determine the fault root cause that generated the M abnormal events based on the target fault root cause probability of each target resource object.

[0023] In one possible design, the processing module is further configured to determine the initial root cause probability of each of the N target resource objects based on the N target resource objects and the M abnormal events; and to adjust the initial root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects, so as to obtain the target root cause probability of each of the N target resource objects.

[0024] In one possible design, the N target resource objects include Nm target resource objects, and the resource tags of the Nm target resource objects are all the same, where Nm is a positive integer.

[0025] The T resource objects include Tn resource objects, all of which have the same resource tags, and the resource tags of the Nm target resource objects are the same as those of the Tn resource objects, where Tn is a positive integer;

[0026] The processing module is further configured to determine the target fault root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects.

[0027] In one possible design, the processing module is further configured to determine the initial root cause probability of each of the Nm target resource objects based on the abnormal events associated with each of the Nm target resource objects; and to adjust the initial root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects, so as to obtain the target root cause probability of each of the Nm target resource objects.

[0028] In one possible design, the processing module is further configured to obtain the target fault root cause probability of any one of the Nm target resource objects in the following manner:

[0029] P = Po – (Nm / Tn);

[0030] Wherein, P represents the target root cause probability of any one of the Nm target resource objects, Po represents the initial root cause probability of any one of the Nm target resource objects, Nm represents the number of target resource objects with the same resource label among the N target resource objects, and Tn represents the number of resource objects with the same resource label as the Nm target resource objects among the T resource objects.

[0031] In one possible design, the processing module is further configured to determine the resource label of each of the T resource objects based on the mapping relationship between resource objects and resource labels.

[0032] In one possible design, the processing module is further configured to determine the target resource object with the highest target fault root cause probability as the target resource object belonging to the fault root cause based on the target fault root cause probability of each of the N target resource objects.

[0033] In one possible design, the N target resource objects include: a first target resource object and a second target resource object;

[0034] The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object;

[0035] The processing module is further configured to, after obtaining the target fault root cause probability of each of the N target resource objects, determine at least one fault propagation chain based on the connection relationship of the N target resource objects, wherein the fault propagation chain includes: the connection relationship between the target network element and the first target resource object, and the connection relationship between the first target resource object and the second target resource object; and determine the fault probability of the fault propagation chain based on the target fault root cause probability of the first target resource object and the target fault root cause probability of the second target resource object.

[0036] In one possible design, the N target resource objects include: a first target resource object and a second target resource object;

[0037] The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object;

[0038] The processing module is further configured to determine the occurrence time of the abnormal event of the first target resource object and the occurrence time of the abnormal event of the second target resource object; when the occurrence time of the abnormal event of the first target resource object is earlier than the occurrence time of the abnormal event of the second target resource object, the initial root cause probability of the first target resource object is increased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the first target resource object; the initial root cause probability of the second target resource object is decreased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the second target resource object.

[0039] In a second aspect of this application, the constituent modules of the apparatus may also perform the steps described in the first aspect and various possible implementations, as detailed in the foregoing description of the first aspect and various possible implementations.

[0040] Thirdly, this application provides an apparatus for performing any of the methods provided in the first aspect. For example, the apparatus may be the determining apparatus described in the second aspect.

[0041] In one possible design approach, this application can divide the defined device into functional modules according to any of the methods provided in the first aspect above. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module.

[0042] For example, this application can divide the determining device into a receiving module and a processing module, etc., according to function. The description of the possible technical solutions and beneficial effects performed by each of the above-described functional modules can be found in the technical solutions provided by the first aspect above or its corresponding possible designs, and will not be repeated here.

[0043] In another possible design, the determining device includes a memory and a processor, coupled together. The memory stores computer instructions, and the processor invokes those instructions to perform methods as provided in the first aspect or its corresponding possible designs.

[0044] Fourthly, this application provides a computer-readable storage medium, such as a non-transient computer-readable storage medium. A computer program (or instructions) is stored thereon, which, when executed on a computer device, causes the computer device to perform the methods provided in the first aspect or a corresponding possible design.

[0045] Fifthly, this application provides a computer program product that, when run on a computer device, causes the method provided by the first aspect or its corresponding possible design to be executed.

[0046] In a sixth aspect, this application provides a chip system comprising: a processor, the processor being configured to retrieve and execute a computer program stored in a memory, performing the methods provided in the first aspect or a corresponding possible design.

[0047] It is understood that the receiving action in any of the technical solutions provided in the second to fifth aspects of the first aspect can be specifically replaced by receiving under the control of the processor.

[0048] It is understood that any of the systems, devices, computer storage media, computer program products or chip systems provided above can be applied to the corresponding methods provided in the first aspect. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0049] In this application, the name of any of the aforementioned devices does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear under other names. As long as the function of each device or functional module is similar to that of this application, it falls within the scope of the claims of this application and its equivalents.

[0050] These or other aspects of this application will become more readily apparent in the following description. Attached Figure Description

[0051] Figure 1A schematic diagram illustrating an application scenario of a method for determining the root cause of a fault provided in an embodiment of this application;

[0052] Figure 2 A flowchart illustrating a method for determining the root cause of a fault, as provided in an embodiment of this application.

[0053] Figure 3 A flowchart illustrating a method for determining the root cause of a fault, as provided in an embodiment of this application.

[0054] Figure 4 A flowchart illustrating a method for determining the root cause of a fault, as provided in an embodiment of this application.

[0055] Figure 5 A flowchart illustrating a method for determining the root cause of a fault, as provided in an embodiment of this application.

[0056] Figure 6 A flowchart illustrating a method for determining the root cause of a fault, as provided in an embodiment of this application.

[0057] Figure 7 A schematic diagram illustrating a scenario for implementing root cause recommendation in a network management system, as provided in an embodiment of this application.

[0058] Figure 8a A schematic diagram illustrating the connection relationship between a network element and a resource object is provided in an embodiment of this application.

[0059] Figure 8b This is a schematic diagram illustrating the assignment of resource tags to resource objects, as provided in an embodiment of this application.

[0060] Figure 8c A schematic diagram illustrating the acquisition of a faulty resource object, provided as an embodiment of this application;

[0061] Figure 8d This is a schematic diagram illustrating the classification of resource objects based on resource tags, provided as an embodiment of this application.

[0062] Figure 9 This is a schematic diagram of the composition of a determining device provided in an embodiment of this application;

[0063] Figure 10 This is a schematic diagram of the composition of a determining device provided in an embodiment of this application. Detailed Implementation

[0064] The following describes some terms and techniques used in the embodiments of this application:

[0065] 1) Fault, abnormal event, abnormal event information, root cause of fault, probability of root cause of fault.

[0066] A fault refers to a problem that occurs in a telecommunications network. For example, a fault could be that an end user cannot access the internet or make a phone call.

[0067] When a fault occurs in a telecommunications network, network elements within the network detect abnormal events. An abnormal event refers to an event in the telecommunications network that differs from normal network behavior. Abnormal events can include: generating alarms, abnormal performance indicators, log anomalies, generating operation logs, etc. The network elements in the telecommunications network generate abnormal event information, which is used to indicate the aforementioned abnormal event. This abnormal event information can include information such as the event type, anomaly description, and the network element to which the event belongs. For example, the abnormal event information can indicate the name of the abnormal event or its identifier.

[0068] For example, in the embodiments of this application, the network element can generate multiple abnormal events. For example, the number of abnormal events is represented by M, where M is a positive integer.

[0069] The root cause of a fault refers to the fundamental reason for a series of faults identified by the network management equipment (hereinafter referred to as the network administrator) after analyzing the abnormal event information reported by network elements in the telecommunications network. Generally, after fixing the root cause, other fault symptoms are also resolved.

[0070] The root cause probability refers to the probability that a network management device, after analyzing abnormal event information, determines that a particular fault is the root cause. The root cause probability can take various values, such as 0, a value between 0 and 1, or -1.

[0071] 2) Network element, target network element.

[0072] A network element is an entity within a network, possessing specific network capabilities. For example, the network element provided in this application embodiment can be a core network element, such as a unified packet gateway (UGW), which specifically includes a public data network gateway (PGW) and a serving gateway (SGW). Another example is a network element that can be a policy and charging control (PCC) or a charge gateway (CG).

[0073] The target network element refers to a network element or a class of network elements specifically referred to in the embodiments of this application. The target network element is a network element defined in the embodiments of this application for clarity and accuracy, and the meaning of the target network element is the same as that of the aforementioned network elements. For example, the target network element may be UGW, PCC, or CG, etc., and is not limited in the embodiments of this application.

[0074] For example, UGW is a network element that enables mobile phones to access the Internet. When the network capability of UGW fails, it will report alarm and other abnormal event information to the network management device.

[0075] 3) Resource objects and resource tags.

[0076] Resource objects are obtained by dividing the service resources provided by the target network element according to its service type. Resource objects are used to determine the service resources that the target network element can provide. The name and type of resource objects can be customized according to the specific services of the target network element. In this embodiment, there can be multiple resource objects. For example, resource objects can include at least one of the following: billing-related, region-related, and access point name (APN)-related. For example, APN-related resource objects include: Internet Protocol Multimedia Subsystem (IMS) under UGW. Therefore, an IMS resource object can also be called Ims (APN). However, in subsequent examples, when multiple resource objects exist, they can be exemplified as APNX, where X can be 1, 2, 3, etc., meaning multiple resource objects can be APN1, APN2, and APN3.

[0077] Optionally, in this embodiment, a connection is established between the resource object and the target network element. Through this connection, all resource objects associated with the target network element can be obtained. For example, if the target network element is a UGW, the resource objects may include: billing-related, region-related, Ims (APN), and APNX. Then, the UGW can connect to the following resource objects respectively: billing-related, region-related, Ims (APN), and APNX.

[0078] Optionally, multiple resource objects can also have parent-child relationships. For example, the parent resource object is Ims(APN), which connects to three child resource objects: IP segment 1, 4G phone call IP segment, IP segment 3, etc.

[0079] In this embodiment, an exception event can be associated with a resource object; here, association means that the exception event is related to a resource object. For example, the occurrence of an exception event involves the name of a resource object. For example, an exception event can be associated with a resource object. Different exception events can be associated with different resource objects, or different exception events can be associated with the same resource object; this is not limited here.

[0080] In this embodiment, resource tags are used to indicate the resource type of a resource object, and each resource object is configured with a corresponding resource tag. Configuring resource tags for resource objects is also called "tagging resource objects," and the process of tagging resource objects can also be called "resource modeling," as detailed in subsequent embodiments. Resource tags can also be called "resource object tags," and resource tags can be customized according to the network element's services. For example, resource tags may include at least one of the following: network element (ne), pipe, service, and flow.

[0081] The classification of resource tags in the embodiments of this application will be explained next. The classification of resource tags is applied to the field of fault analysis. The classification of resource tags is based on the perspective of fault analysis.

[0082] The fault analysis process provided in this application embodiment includes the following steps: First, confirm the scope of the fault's impact. When the entire service is abnormal, check if it is a localized fault. Then, proceed with the fault confirmation process. Once the scope of the fault's impact is determined, identify the main process points in the fault area where the problem occurred. Finally, confirm the fault point. Most services in the cloud core network scenario involve management plane signaling interaction. Analyze specific fault points within the process, such as signaling tracing and call history record (CHR) analysis.

[0083] Based on the above fault analysis process, in this embodiment of the application, resource tags can be determined according to the resource tag types and classification principles shown in Table 1 below.

[0084] Table 1

[0085]

[0086] It is not limited that the above classification of resource tags is just an example, and the classification of resource tags and the meaning of specific resource tags are not limited in the embodiments of this application.

[0087] 4) Determine the device.

[0088] In this embodiment of the application, the determining device is a device that interacts with the target network element. This determining device can also be called a "fault analysis determining device". This determining device can receive abnormal event information reported by the target network element, analyze the abnormal event information, and finally obtain the root cause probability of multiple resource objects. The final result of the root cause of the fault is determined by the root cause probability of multiple resource objects.

[0089] The determining device provided in this application embodiment can be a network management device, also known as a network management system. The network management device can centrally manage network elements, providing various management capabilities for the aforementioned target network element. For example, the management capabilities provided by the network management device include: alarm monitoring, performance indicator monitoring, configuration management, etc. After a fault occurs in the target network element, the network management device collects abnormal events, thereby monitoring and analyzing various network services on the target network element. Simultaneously, by monitoring the target network element through the network management device, fault analysis can be achieved.

[0090] 5) Inference rules.

[0091] To address the issue of too many potential root causes preventing the identification of the true root cause during the inference process, this application embodiment incorporates resource tag information into the root cause analysis to determine inference rules that include this information. The resource tag information includes resource tags configured for resource objects.

[0092] In this embodiment, the enhanced inference rule is the rule used to determine the root cause probability of a resource object's failure. The inference rule is used to determine the root cause probability of a resource object's failure based on the resource tags configured for the resource object and the abnormal events associated with the resource object. Because this enhanced inference rule uses the resource tags configured for the resource object, the root cause probability of failure that can be obtained for each resource object is related to the resource tags configured for that resource object, thereby enabling a more accurate determination of the root cause probability of the resource object's failure.

[0093] Optionally, according to the enhanced inference rules provided in the embodiments of this application, if resource objects of the same type have the same resource tag, and abnormal events occur simultaneously in resource objects of the same type, then the probability that such a resource object is the root cause of the failure is reduced. For example, multiple resource objects with the same resource tag are of the same type. If the resource tag is region-related, then the probability that abnormal events occur simultaneously in all regions is the root cause of the failure will be reduced. Therefore, the probability of obtaining the root cause of the failure for each resource object is related to the resource tag configured for that resource object, thereby enabling a more accurate acquisition of the root cause probability of the failure for the resource object.

[0094] As an example, the inference rule could be: 1. If resource objects of the same type are abnormal simultaneously, the probability that these resource objects are the root cause of the failure will be reduced. For example, if resource objects in multiple regions are abnormal, the root cause of the failure is likely not a resource object of the region type; conversely, if only one APN is abnormal, it is likely that this APN is the root cause of the failure.

[0095] 2. A step or several steps in a business process are referred to as sub-processes. Sub-processes that occur earlier will affect sub-processes that occur later. Thus, the probability that the earlier sub-process is the root cause of the failure is higher than that of the later sub-process. For example, in a phone call service: the PCC completes the package policy (data, bandwidth), and the CG completes the billing, etc. A failure in the PCC sub-process will affect the subsequent billing sub-process. When the PCC sub-process and the CG sub-process fail simultaneously, the PCC sub-process is more likely to be the root cause of the failure.

[0096] 6) Fault propagation chain.

[0097] A fault propagation chain includes a target network element and resource objects connected to that target network element. The resource object that caused the fault can be identified through the fault propagation chain. A single fault propagation chain may include one or more resource objects. For example, a fault propagation chain may include: target network element A, resource object A connected to target network element A, and resource object B connected to resource object A. Resource object B is a child resource object of resource object A, and resource object A is the parent resource object of resource object B. Resource object B is only connected to resource object A and is not connected to the target network element.

[0098] Other terms are explained below:

[0099] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0100] In the embodiments of this application, the terms "second" and "first" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "second" or "first" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0101] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple first messages refer to two or more first messages.

[0102] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0103] It should also be understood that the term "and / or" as used herein refers to and covers any and all possible combinations of one or more of the associated listed items. The term "and / or" describes an association between related objects, indicating that three relationships can exist; for example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this application generally indicates that the preceding and following related objects are in an "or" relationship.

[0104] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0105] It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0106] It should also be understood that the term “comprising” (also referred to as “includes”, “including”, “comprises” and / or “comprising”) as used in this specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0107] It should also be understood that the term “if” can be interpreted as “when” or “upon”, or “in response to determination” or “in response to detection”.

[0108] It should be understood that the phrases "an embodiment," "an embodiment," and "a possible implementation" used throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment or implementation is included in at least one embodiment of this application. Therefore, the phrases "in an embodiment," "an embodiment," or "a possible implementation" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0109] It should also be understood that the "connection" mentioned in the embodiments of this application can be a direct connection or an indirect connection, and can be a wired connection or a wireless connection. That is to say, the embodiments of this application do not limit the connection method between devices. For example, the connection between a network element and a resource object can refer to a communication connection.

[0110] The technical solutions provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0111] Figure 1 This is a schematic diagram of the system structure for an application scenario of a method for determining the root cause of a fault provided in an embodiment of this application. Figure 1 The system shown may include a target network element and a determining device.

[0112] The target network element is used to send M abnormal event information to the determining device, and the M abnormal event information is used to indicate M abnormal events.

[0113] The determining device receives M abnormal event messages from a target network element. These M abnormal event messages indicate M abnormal events, which are associated with N target resource objects. The N target resource objects are N resource objects out of T resource objects associated with the target network element. Each of the T resource objects is associated with a resource tag, which indicates the resource type of the resource object. The values ​​of M, T, and N are all positive integers, and their specific values ​​are not limited. Based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects, the determining device determines the target fault root cause probability of each of the N target resource objects.

[0114] The determining device can receive M abnormal event information sent by the target network element, and the M abnormal event information is used to indicate the M abnormal events. The determining device is pre-configured with T resource objects associated with the target network element, and each of the T resource objects is associated with a resource tag. The determining device determines the target resource object associated with each abnormal event based on the M abnormal events. Since the M abnormal events are associated with N target resource objects, the N target resource objects are the N resource objects among the T resource objects associated with the target network element. Each of the N target resource objects is associated with a resource tag. Based on the N target resource objects, the M abnormal events, and the resource tags of each resource object in the T resource objects, the target fault root cause probability of each of the N target resource objects is determined. In this embodiment, the fault root cause probability obtainable for each resource object is related to the resource tag configured for that resource object, enabling more accurate acquisition of the fault root cause probability of the resource object.

[0115] The following section provides an example of the method for determining the root cause of a fault in a device. Figure 2 The method shown can be derived from Figure 1 The determination device shown is used to complete the task. Figure 2 The method for determining the root cause of a fault, as shown, includes the following steps:

[0116] 201. Receive M abnormal event messages sent by the target network element.

[0117] M abnormal event information is used to indicate M abnormal events. The M abnormal events are associated with N target resource objects. The N target resource objects are N resource objects among the T resource objects associated with the target network element. Each of the T resource objects is associated with a resource tag. The resource tag is used to indicate the resource type of the resource object. M, T and N are all positive integers.

[0118] The target network element receives M abnormal event messages. The target network element sends these M abnormal event messages to the determining device. The determining device parses the M abnormal event messages, obtains the M abnormal events, and further obtains the target resource object associated with each abnormal event. One abnormal event can only be associated with one target resource object, but different abnormal events can be associated with the same target resource object; therefore, M is greater than or equal to N.

[0119] In this embodiment, the target resource object refers to the resource object associated with the abnormal event. For example, the target resource object is the resource object involved in the occurrence of the abnormal event. The target network element is divided into T resource objects according to service type. Some of these T resource objects are associated with abnormal events, and some are not. T is greater than or equal to N. For example, if M abnormal events occur, these M abnormal events are related to N resource objects out of the T resource objects, but not to (TN) resource objects out of the T resource objects. The N resource objects out of the aforementioned T resource objects are the N target resource objects defined in this embodiment. Each of the T resource objects has a resource tag, and the N target resource objects belong to these T resource objects; therefore, each of the N target resource objects also has a resource tag.

[0120] 202. Based on N target resource objects, M abnormal events, and the resource tags of each resource object in T resource objects, determine the target fault root cause probability of each target resource object in the N target resource objects.

[0121] In this embodiment, the determining device identifies M abnormal events associated with N target resource objects. Each of the N target resource objects has a resource tag. The determining device can perform fault analysis based on N, M, and T to determine the target fault root cause probability of each of the N target resource objects. In this embodiment, the fault root cause probability that can be obtained for each resource object is related to the resource tag configured for that resource object, thereby enabling a more accurate acquisition of the fault root cause probability of the resource object.

[0122] In one possible implementation, the N target resource objects include Nm target resource objects, and the resource tags of the Nm target resource objects are all the same, where Nm is a positive integer.

[0123] The T resource objects include Tn resource objects, all of which have the same resource tags. Furthermore, the resource tags of the Nm target resource objects are the same as those of the Tn resource objects, where Tn is a positive integer.

[0124] In this implementation scenario, step 202 determines the target fault root cause probability of each of the N target resource objects based on the N target resource objects, M abnormal events, and the resource tags of each of the T resource objects, including:

[0125] Based on Nm target resource objects and Tn resource objects, determine the target fault root cause probability for each of the Nm target resource objects.

[0126] For example, N target resource objects can be divided into two categories: Nm target resource objects and Nt target resource objects. The resource tags of the Nm target resource objects are all first resource tags, and the resource tags of the Nt target resource objects are all second resource tags. The first resource tag and the second resource tag are different resource tags. The first resource tag and the second resource tag are both one of the resource tags of T resource objects. Nm and Nt are positive integers.

[0127] For example, T resource objects can be divided into two categories: Tn resource objects and Tt resource objects. The resource tags of the Tn resource objects are all the first resource tag, and the resource tags of the Tt resource objects are all the second resource tag. Then, the resource tags of the Tn resource objects are the same as the resource tags of the Nm target resources, and the resource tags of the Tt resource objects are the same as the resource tags of the Nt resource objects. Tn and Tt are positive integers. The following explanation uses the determination method for the root cause probability of a fault for resource objects corresponding to the first resource tag as an example. The determination method for the root cause probability of a fault for resource objects corresponding to the second resource tag can refer to the explanation for the first resource tag.

[0128] Optionally, the first resource tag is one of the resource tags among the N target resource objects. This first resource tag specifically refers to a particular resource tag; for example, the first resource tag could be resource tag A. Based on this first resource tag, Nm target resource objects are obtained from the N target resource objects, and Tn resource objects are obtained from the T resource objects. Then, the resource tags of the Nm target resource objects and the Tn resource objects are both the first resource tag, and the values ​​of Nm and Tn are not limited.

[0129] Nm represents the number of target resource objects with the same resource tag associated with the abnormal event, and Tn represents the total number of resource objects with the same resource tag. The determining device can use Nm and Tn to determine the percentage of the number of target resource objects with the same resource tag to the total number of resource objects with the same resource tag. Finally, based on Nm target resource objects and Tn resource objects, it determines the target root cause probability of each of the Nm target resource objects. For example, in this embodiment, the target root cause probability of each of the Nm target resource objects can be obtained through incremental inference rules. Based on the aforementioned description of enhanced inference rules, for example, an inference rule can be added as follows: If resource objects of the same type are abnormal simultaneously, the probability that these resource objects are the root cause will be reduced. For example, if resource objects in multiple regions are abnormal, the root cause is likely not the resource objects in these regions; conversely, if only one APN is abnormal, the root cause is likely that APN.

[0130] In one possible implementation, based on Nm target resource objects and Tn resource objects, the target failure root cause probability of each of the Nm target resource objects is determined, including:

[0131] A1. Determine the initial root cause probability of each target resource object among the Nm target resource objects based on the abnormal events associated with each target resource object among the Nm target resource objects;

[0132] A2. Based on Nm target resource objects and Tn resource objects, adjust the initial root cause probability of each target resource object among the Nm target resource objects to obtain the target root cause probability of each target resource object among the Nm target resource objects.

[0133] In step A1, the initial root cause probability of failure for each of the N target resource objects can be calculated first. The initial root cause probability refers to the probability of failure obtained during abnormal event collection. For example, this initial root cause probability can be obtained by the determining device through fault analysis using N and M. The initial root cause probability can be the severity of the alarm event, the deviation range of the abnormal indicator, etc. See the subsequent embodiments for a detailed explanation of the calculation of the initial root cause probability.

[0134] In step A2, after determining the initial root cause probability of each target resource object, the initial root cause probability is adjusted based on the Nm target resource objects and Tn resource objects to obtain the final target root cause probability. For example, the initial root cause probability can be adjusted based on the aforementioned addition of inference rules.

[0135] Furthermore, in some embodiments of this application, step A2 above adjusts the initial root cause probability of each of the Nm target resource objects based on Nm target resource objects and Tn resource objects to obtain the target root cause probability of each of the Nm target resource objects, including:

[0136] The root cause probability of a target failure among Nm target resource objects is obtained as follows:

[0137] P = Po – (Nm / Tn);

[0138] Where P represents the target root cause probability of any one of the Nm target resource objects, Po represents the initial root cause probability of any one of the Nm target resource objects, Nm represents the number of target resource objects with the same resource label among the N target resource objects, and Tn represents the number of resource objects with the same resource label as the Nm target resource objects among the T resource objects.

[0139] Here, ' / ' represents a division operation. For example, Nm / Tn represents the result of dividing Nm by Tn, where Nm / Tn represents the proportion of target resource objects that have failed among the Tn resource objects. Nm / Tn can be used to adjust Po, and the result after adjusting Po serves as the target root cause probability P of any one of the aforementioned Nm target resource objects. For example, if resource objects of the same type fail simultaneously, the probability that these resource objects are the root cause will be reduced. For instance, if resource objects in multiple regions fail, the root cause is likely not the resource objects in those regions; conversely, if only one APN fails, the root cause is likely that APN.

[0140] It should be noted that Po and P satisfy the following relationship: P = Po – (Nm / Tn), where Po and P refer to the initial root cause probability and the target root cause probability of the same target resource object. After obtaining the Po of a target resource object, P of that target resource object can be calculated using the above formula.

[0141] Not limited to this, the above calculation method is only one implementation of this application. Based on the above adjustment method of Po, other adjustment methods can also be used in the embodiments of this application, such as P = (1 – (Nm / Tn)) * Po. Based on the above formula, Po can also be adjusted, and the result obtained after adjustment can be used as the target failure root cause probability of the first target resource object.

[0142] 203. Based on the target failure root cause probability of each target resource object, determine the failure root cause that generates M abnormal events.

[0143] In this embodiment, after determining the target fault root cause probability of each of the N target resource objects, the determining device analyzes the target fault root cause probability of each target resource object and determines the fault root cause that generates M abnormal events based on the target fault root cause probabilities of the N target resource objects. The fault root cause that generates M abnormal events can be that one of the N target resource objects is faulty; for example, the target resource object belonging to the fault root cause can be selected from the N target resource objects. In this embodiment, the target fault root cause probability of each of the N target resource objects can be used to select the target resource object belonging to the fault root cause, thereby accurately finding the target resource object belonging to the true fault root cause.

[0144] like Figure 3 As shown in the embodiments of this application, a method for determining the root cause of a fault is also provided, which can be achieved by... Figure 1 The determination device shown is used to complete the task. Figure 2 Step 202 shown includes Figure 3 Steps 302 and 303 are shown. Figure 3 Steps 302 and 303 shown further illustrate the method for determining the target failure root cause probability of the target resource object. Figure 3 The method for determining the root cause of a fault, as shown, includes the following steps:

[0145] 301. Receive M abnormal event messages sent by the target network element.

[0146] Step 301 and the aforementioned Figure 2 The implementation method of step 201 shown is the same, and will not be repeated here.

[0147] 302. Determine the initial root cause probability of each of the N target resource objects based on N target resource objects and M abnormal events.

[0148] The determining device identifies M abnormal events associated with N target resource objects, each of which has a resource tag. Since the determining device identifies M abnormal events, it can perform fault analysis based on N and M to determine the initial root cause probability of each of the N target resource objects.

[0149] The initial root cause probability refers to the root cause probability of a fault obtained when an abnormal event is collected. For example, the initial root cause probability can be obtained by the determining device through fault analysis using N and M. For example, the initial root cause probability can be the severity of the alarm event, the deviation of the abnormal indicator, etc.

[0150] In some embodiments of this application, N target resource objects can be classified according to whether the resource object is associated with one or more abnormal events. For example, a resource object associated with one abnormal event (which may be the first abnormal event) among the N target resource objects is defined as target resource object A, and a resource object associated with multiple abnormal events (which may be the second and third abnormal events) among the N target resource objects is defined as target resource object B.

[0151] Step 302 above determines the initial root cause probability of each of the N target resource objects based on the abnormal events associated with the N target resource objects, including:

[0152] When target resource object A among N target resource objects is associated with the first abnormal event among M abnormal events, obtain the abnormal root cause probability of the first abnormal event, and determine the initial fault root cause probability of target resource object A as the abnormal root cause probability of the first abnormal event.

[0153] When target resource object B among N target resource objects is associated with the second and third abnormal events among M abnormal events, the root cause probability of the second abnormal event and the root cause probability of the third abnormal event are obtained, and the initial fault root cause probability of target resource object B is determined based on the root cause probability of the second and third abnormal events.

[0154] For each abnormal event, an abnormal root cause probability can be calculated. This probability indicates the root cause probability corresponding to the abnormal event itself. If the target resource object A is associated with only one abnormal event (e.g., the first abnormal event), the initial fault root cause probability of the target resource object A is determined to be the abnormal root cause probability of the first abnormal event. The calculation of the abnormal root cause probability can be obtained from the abnormal event, which will not be explained in detail here.

[0155] For each anomalous event, an anomalous root cause probability can be calculated, indicating the root cause probability corresponding to that anomalous event itself. If target resource object B is associated with multiple anomalous events (e.g., a second anomalous event and a third anomalous event), the anomalous root cause probabilities of the second and third anomalous events are used to determine the initial fault root cause probability of target resource object B. The calculation of the anomalous root cause probability can be obtained from the anomalous events, and will not be described in detail here.

[0156] In one possible design, the initial root cause probability of the target resource object B is determined based on the root cause probabilities of the second and third abnormal events, including:

[0157] The maximum root cause probability is determined from the root cause probabilities of the second and third abnormal events, where the maximum root cause probability is the initial root cause probability of the target resource object B.

[0158] If a target resource object B is associated with multiple abnormal events (e.g., a second abnormal event and a third abnormal event), the maximum abnormal root cause probability among the abnormal root cause probabilities corresponding to these multiple abnormal events can be selected as the initial failure root cause probability of the target resource object B. Because the maximum abnormal root cause probability better represents the true root cause of the failure of the target resource object B, using the maximum abnormal root cause probability between the second and third abnormal events as the initial failure root cause probability of the target resource object B can more accurately determine the initial failure root cause probability of the target resource object B.

[0159] In one possible design, abnormal event information includes: event type information, event description information, and the network element name information to which the abnormal event was reported. For a detailed explanation of abnormal event information, please refer to the aforementioned terminology description; it will not be repeated here.

[0160] 303. Based on N target resource objects, M abnormal events, and the resource tags of each resource object in T resource objects, adjust the initial root cause probability of each target resource object in the N target resource objects to obtain the target root cause probability of each target resource object in the N target resource objects.

[0161] In this embodiment, after the determining device obtains the initial root cause probability of each target resource object, it can further adjust the initial root cause probability according to the aforementioned enhanced inference rule. For example, the enhanced inference rule involves analyzing the role of each resource object in the occurrence of an abnormal event by analyzing the resource tags of N target resource objects and the resource tags of each resource object in T resource objects. Based on this, the initial root cause probability of each target resource object in N target resource objects is adjusted to obtain the target root cause probability of each target resource object in N target resource objects. In this embodiment, by adjusting the initial root cause probability, the target root cause probability of the target resource object can be obtained, so that the target root cause probability can more accurately represent the probability that the target resource object is the root cause of the failure. The root cause probability that can be obtained for each resource object is related to the resource tags configured for that resource object, and the root cause probability of the resource object can be obtained more accurately.

[0162] In some embodiments of this application, the N target resource objects include multiple target resource objects. For example, one of these multiple target resource objects is defined as the first target resource object, and another target resource object is defined as the second target resource object. The occurrence times of abnormal events for the first target resource object and the second target resource object are different. The calculation of the root cause probability of failure for target resource objects with different occurrence times of abnormal events among the multiple target resource objects will be explained below.

[0163] The connection relationships among N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object.

[0164] Among the N target resource objects, there are a first target resource object and a second target resource object that have a parent-child resource relationship. The target network element is connected to the first target resource object, and the first target resource object is connected to the second target resource object. At this time, the second target resource object is a child object of the first target resource object, and the second target resource object is not connected to the target network element.

[0165] In this implementation scenario, step 303 adjusts the initial root cause probability of each of the N target resource objects based on the N target resource objects, M abnormal events, and the resource tags of each resource object in the T resource objects, to obtain the target root cause probability of each of the N target resource objects, including:

[0166] B1. Determine the time of the abnormal event occurrence for the first target resource object and the time of the abnormal event occurrence for the second target resource object;

[0167] B2. When the abnormal event of the first target resource object occurs earlier than the abnormal event of the second target resource object, the initial root cause probability of the first target resource object is increased by a preset probability amount according to the connection relationship of N target resource objects to obtain the target root cause probability of the first target resource object.

[0168] B3. Based on the connection relationship of N target resource objects, reduce the initial root cause probability of the second target resource object by a preset probability amount to obtain the target root cause probability of the second target resource object.

[0169] The preset probability value can be an absolute value (e.g., a probability value) used to adjust the initial root cause probability of a fault, or a relative value used to adjust the initial root cause probability of a fault; this is not limited here. In this embodiment, the initial root cause probability of a fault is adjusted according to the occurrence time of the abnormal event of the target resource object, thereby obtaining the target root cause probability of a fault. The occurrence time of the abnormal event can be used to determine whether the target resource object is the true root cause of a fault. For example, a certain step or several steps in a business process are referred to as sub-businesses. The sub-business that occurs earlier will affect the sub-business that occurs later, so the probability that the sub-business that occurs earlier is the root cause of a fault is higher than that of the sub-business that occurs later. For example, in a phone call service: PCC completes the package policy (data traffic, bandwidth), CG completes billing, etc. A failure of the PCC sub-business will affect the subsequent billing sub-business; when the PCC sub-business and the CG sub-business fail at the same time, the PCC sub-business is likely to be the root cause of the fault.

[0170] In some embodiments of this application, the determining device, in addition to performing the aforementioned... Figure 2 and Figure 3 In addition to the steps shown, the following steps may also be performed before step 201 or step 301:

[0171] The resource label of each of the T resource objects is determined based on the mapping relationship between resource objects and resource labels.

[0172] The determining device can acquire the mapping relationship between resource objects and resource tags. This mapping relationship represents the resource tag corresponding to a resource object, and each resource object can be assigned a corresponding resource tag through this mapping relationship. For example, the determining device pre-determines the mapping relationship between resource objects and resource tags. After acquiring a resource object, it queries the mapping relationship to obtain the resource tag of the resource object, configures the corresponding resource tag for the resource object, and thus classifies all target resource objects associated with abnormal events through resource tags, so as to determine the target fault root cause probability of each target resource object according to the resource objects corresponding to the same resource tag.

[0173] like Figure 4 As shown in the embodiments of this application, a method for determining the root cause of a fault is also provided, which can be achieved by... Figure 1 The determination device shown is used to complete the task. Figure 4 Steps 401 to 403 shown can be performed in... Figure 2 The step 201 shown is completed before execution, or Figure 4 Steps 401 to 403 shown can be performed in... Figure 3 The step 301 shown is completed before execution. Figure 4 Steps 401 to 403 illustrate the method for determining the resource label of the target resource object. Figure 4 The method for determining the root cause of a fault, as shown, includes the following steps:

[0174] 401. Obtain the resource adaptation information and resource object information of the target network element.

[0175] The resource adaptation information includes: resource tag information of resource objects in the target network element, and resource object information includes: T resource objects obtained by dividing business resources in the target network element according to business type, and the connection relationship between the T resource objects and the target network element.

[0176] Before connecting the target network element and the determining device, the determining device can pre-acquire the resource adaptation information and resource object information of the target network element. Additionally, the determining device can also pre-acquire the resource adaptation information, and when connecting with the target network element, the determining device receives the resource object information sent by the target network element.

[0177] Resource adaptation information includes resource tag information for resource objects in the target network element. This resource adaptation information can also be referred to as an "adaptation package." Resource adaptation information may include resource tag information for all resource objects in the target network element. See the subsequent embodiments for a detailed description of resource tag information.

[0178] Resource tag information includes: resource object type information, resource object name information, and resource object resource tags. The resource object type information describes the type of the resource object, and the resource object name information includes the name or identifier of the resource object. Additionally, the resource object's resource tags describe the tag content, tag category, etc.

[0179] Optionally, in some embodiments of this application, each of the T resource objects is connected to the target network element. In this case, the connection relationship between the T resource objects and the target network element includes the connection relationship between the target network element and each of the T resource objects. For example, if each of the T resource objects is connected to the target network element, and the T resource objects include resource object A and resource object B, then resource object A is connected to the target network element, and resource object B is connected to the target network element.

[0180] In some embodiments of this application, some of the T resource objects are connected to the target network element, while some of the T resource objects are not connected to the target network element. The T resource objects include multiple resource objects. For example, one of these multiple resource objects is defined as the first resource object, and another of these multiple resource objects is defined as the second resource object. The connection methods of the first resource object and the second resource object are different, and the connection methods of the multiple resource objects will be described below.

[0181] The connection relationships between T resource objects and the target network element include: the connection relationship between the target network element and the first resource object, and the connection relationship between the first resource object and the second resource object.

[0182] Among the T resource objects, there are a first resource object and a second resource object that have a parent-child resource relationship. The target network element is connected to the first resource object, and the first resource object is connected to the second resource object. In this case, the second resource object is a child object of the first resource object and is not connected to the target network element. For example, if the T resource objects include resource object C and resource object D, then resource object C is connected to resource object D, resource object D is connected to the target network element, and resource object C is not connected to the target network element.

[0183] 402. Determine the mapping relationship between resource objects and resource tags based on resource adaptation information and resource object information.

[0184] After the determining device obtains the above-mentioned resource adaptation information and resource object information, it extracts the resource tag information of the resource object from the resource adaptation information, extracts the connection relationship between the resource object and the target network element through the resource object information, and generates a mapping relationship between the resource object and the resource tag through the analysis of the above information.

[0185] 403. Determine the resource label of each of the T resource objects based on the mapping relationship between resource objects and resource labels.

[0186] The determining device can acquire the mapping relationship between resource objects and resource tags. This mapping relationship represents the resource tag corresponding to a resource object. Through this mapping relationship, each resource object can be assigned a corresponding resource tag. For example, the determining device pre-determines the mapping relationship between resource objects and resource tags. After acquiring a resource object, it queries the mapping relationship to obtain the resource tag of that resource object, configures the corresponding resource tag for that resource object, and thus classifies all target resource objects associated with abnormal events through resource tags. This facilitates the determination of the target fault root cause probability for each target resource object according to the resource objects corresponding to the same resource tag.

[0187] like Figure 5 As shown in the embodiments of this application, a method for determining the root cause of a fault is also provided, which can be achieved by... Figure 1 The determination device shown is used to complete the task. Figure 2 Steps 201 and 202 shown are consistent with... Figure 5 Steps 501 and 502 are similar. Figure 2 Step 203 shown includes Figure 5 Step 503 is shown. Figure 5 Step 503 shown further illustrates the method for identifying the target resource object that belongs to the root cause of the failure. Figure 5 The method for determining the root cause of a fault, as shown, includes the following steps:

[0188] 501. Receive M abnormal event messages sent by the target network element.

[0189] The description of step 501 is consistent with that of step 201, and will not be described in detail here in the embodiments of this application.

[0190] 502. Based on N target resource objects, M abnormal events, and the resource tags of each resource object in T resource objects, determine the target fault root cause probability of each target resource object in the N target resource objects.

[0191] The explanation of step 502 is as follows: Figure 2 Step 202 shown will not be repeated here.

[0192] Furthermore, in some embodiments of this application, step 203, which involves determining the root cause of the M abnormal events based on the target failure root cause probability of each target resource object, may specifically include:

[0193] 503. Based on the root cause probability of each of the N target resource objects, determine the target resource object with the highest root cause probability as the target resource object belonging to the root cause of the fault.

[0194] In this embodiment, after determining the target fault root cause probability of each of the N target resource objects, the determining device can select the target resource object belonging to the fault root cause from the N target resource objects based on the target fault root cause probability of each target resource object. For example, it can select the target fault root cause probability with the highest probability from the target fault root cause probability of each target resource object in the N target resource objects; the target resource object corresponding to the target fault root cause probability with the highest probability is the target resource object belonging to the fault root cause. In this embodiment, the target fault root cause probability of each of the N target resource objects can be used to select the target resource object belonging to the fault root cause, thereby accurately finding the target resource object belonging to the true fault root cause.

[0195] like Figure 6 As shown in the embodiments of this application, a method for determining the root cause of a fault is also provided, which can be achieved by... Figure 1 The determination device shown is used to complete the task. Figure 2 Steps 201 and 202 shown are consistent with... Figure 6 Steps 601 and 602 are similar. Figure 6 Steps 603 and 604 shown further illustrate the method for determining the failure probability of a fault propagation chain. Figure 6 The method for determining the root cause of a fault, as shown, includes the following steps:

[0196] Steps 601 and 602.

[0197] Steps 601 and 602 are described in the same way as steps 201 and 202, and will not be repeated here.

[0198] Furthermore, in some embodiments of this application, the N target resource objects include multiple target resource objects. For example, one of these multiple target resource objects is defined as a first target resource object, and another target resource object is defined as a second target resource object. The occurrence times of abnormal events for the first target resource object and the second target resource object are different. The calculation of the root cause probability of failure for target resource objects with different occurrence times of abnormal events among the multiple target resource objects will be explained below.

[0199] The connection relationships among N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object.

[0200] Among the N target resource objects, there are a first target resource object and a second target resource object that have a parent-child resource relationship. The target network element is connected to the first target resource object, and the first target resource object is connected to the second target resource object. At this time, the second target resource object is a child object of the first target resource object, and the second target resource object is not connected to the target network element.

[0201] 603. Generate at least one fault propagation chain based on the connection relationships of N target resource objects.

[0202] The fault propagation chain includes: the connection relationship between the target network element and the first target resource object, and the connection relationship between the first target resource object and the second target resource object.

[0203] The determining device can acquire the connection relationships of N target resource objects and generate at least one fault propagation chain based on these connection relationships. For example, one fault propagation chain includes: the connection relationship between a target network element and a first target resource object, and the connection relationship between the first target resource object and a second target resource object. For a detailed explanation of fault propagation chains, please refer to the aforementioned terminology explanation. For example, if two fault propagation chains are generated based on the connection relationships of N target resource objects, then each fault propagation chain can include a target resource object connected to the target network element, and another target resource object connected to that target resource object.

[0204] 604. Obtain the failure probability of the failure propagation chain based on the target failure root cause probability of the first target resource object and the target failure root cause probability of the second target resource object.

[0205] In this embodiment, the determining device can obtain the target failure root cause probability of each target resource object through the aforementioned step 602. Therefore, for a fault propagation chain, the failure probability of the fault propagation chain can be obtained from the target failure root cause probabilities of all target resource objects in the fault propagation chain. The calculation method for the failure probability of a fault propagation chain is not limited in this application. The failure probability of the fault propagation chain can be used to determine the probability that the fault propagation chain is the true root cause of the fault; therefore, the target resource object of the true root cause can be determined using the failure probability of the fault propagation chain.

[0206] Furthermore, in some embodiments of this application, step 604, which obtains the failure probability of the failure propagation chain based on the target failure root cause probability of the first target resource object and the target failure root cause probability of the second target resource object, includes:

[0207] The average value of the root cause probability of the first target resource object and the root cause probability of the second target resource object is calculated, and the average value is used as the failure probability of the failure propagation chain.

[0208] For a fault propagation chain, the probability of failure in the chain can be derived from the root cause probabilities of all target resource objects within the chain. For example, if the chain includes two target resource objects, a first target resource object and a second target resource object, then the root cause probabilities of both can be used to calculate the chain's probability of failure. There are several calculation methods. One approach is to average the root cause probabilities of the first and second target resource objects and use this average as the chain's probability of failure. Another approach is to calculate the weights of the first and second target resource objects based on their respective resource tags, then perform a weighted average based on their root cause probabilities, and finally use the result as the chain's probability of failure.

[0209] Furthermore, in some embodiments of this application, in addition to performing the foregoing steps, the method provided by the embodiments of this application further includes the following steps:

[0210] When multiple fault propagation chains are generated, the fault propagation chain with the highest fault probability among the multiple fault propagation chains is identified as the fault propagation chain belonging to the root cause of the fault.

[0211] In scenarios where multiple fault propagation chains are generated, the fault propagation chains are sorted according to their fault probability, and the fault propagation chain with the highest fault probability is selected as the fault propagation chain belonging to the root cause of the fault. This allows us to obtain the fault propagation chain belonging to the true root cause of the fault. Further analysis of this chain reveals the target resource object that generated the true root cause of the fault.

[0212] To facilitate a better understanding and implementation of the above-described solutions in the embodiments of this application, specific examples of corresponding application scenarios are provided below.

[0213] Next, we will use a network management system as an example. Figure 7 The diagram shown is a schematic representation of a network management system performing root cause recommendation according to an embodiment of this application.

[0214] For example, a network element is an entity within a network that possesses certain network capabilities. Hereafter, we will use the network element as an example of an Unknown Network Controller (UGW). The UGW enables terminal devices to access the internet. When the UGW's network capabilities fail, it reports alarms and other abnormal events to the network management system. In subsequent embodiments, "abnormal events" will be referred to simply as "events." The network management system can centrally manage network elements, providing various management capabilities for them. After a network element fails, the network management system collects the event, thereby achieving monitoring and fault analysis of network services on the network element.

[0215] In one application scenario of this application, after a network element is connected to the network management system, when a network element fails, it will report an abnormal event to the network management system. After receiving the event, the network management system will analyze it and provide the root cause of the failure, assisting the operation and maintenance personnel in quickly locating the failure and quickly restoring the failure, thus ensuring the normal operation of the network.

[0216] For example, if a large number of 4G users are unable to make phone calls in the network, after receiving the event, the network management system will execute the root cause recommendation process provided in this application embodiment, which mainly includes the following steps S01 to S06.

[0217] S01. Before a network element is connected to the network management system, the resource adaptation package (hereinafter referred to as the adaptation package) for that type of network element is first installed on the network management system. The adaptation package for each type of network element contains information about the resource object tag. After the adaptation package is installed, the network management system can connect to the network element.

[0218] Table 2 below shows the resource object tag information in the adapter package (taking XML as an example).

[0219]

[0220] Based on Table 2 above, the network administrator can obtain all resource object tags of the UGW resource objects.

[0221] S02. Network elements access the network management system. The network element reports resource object information to the network management system, which can then obtain a relationship diagram between the resource objects and the network elements, such as... Figure 8a As shown.

[0222] The target network element is UGW, and its resource objects include: Billing Related, Shenzhen Area, Dongguan Area, Guangzhou Area, Ims (APN), APNX, IP Segment 1, 4G Calling IP Segment, and IP Segment 3. The target network element connects to the following resource objects: Billing Related, Shenzhen Area, Dongguan Area, Guangzhou Area, Ims (APN), and APNX. The resource object Ims (APN) is the parent resource object of the following three resource objects: IP Segment 1, 4G Calling IP Segment, and IP Segment 3.

[0223] As shown in Tables 3 and 4 below, this illustrates the resource objects reported by the network element to the network element and the relationships between these resource objects.

[0224] Table 3 shows the resource objects (JSON format) reported by network elements to the network management system.

[0225] models All resource object instance definitions name Resource object name, customized according to network element service. type Resource object types are customized based on network element services.

[0226] Based on Table 3 above, the network administrator obtains the name and type of the resource object. The name of the resource object can be as follows: Figure 8a As shown.

[0227] Table 4 shows the resource object relationships (JSON format) reported by network elements to the network management system.

[0228]

[0229] The network administrator obtains the resource object relationships based on Table 4 above. For example... Figure 8a As shown, the resource object Ims(APN) is the parent resource object of the following three resource objects: IP segment 1, 4G calling IP segment, and IP segment 3.

[0230] S03. Based on the type of each resource object in the adapter package, configure resource tags for resource object instances, such as... Figure 8b As shown. Resource objects include: billing-related, Shenzhen area, Dongguan area, Guangzhou area, Ims (APN), APNX, IP segment 1, 4G call IP segment, and IP segment 3. The resource tag for billing-related is service-type billing; the resource tag for Shenzhen area is pipeline-type area; the resource tag for Dongguan area is pipeline-type area; the resource tag for Guangzhou area is pipeline-type area; the resource tag for Ims (APN) is pipeline-type APN; the resource tag for APNX is pipeline-type APN; the resource tag for IP segment 1 is pipeline-type IP segment; the resource tag for 4G call IP segment is pipeline-type IP segment; and the resource tag for IP segment 3 is pipeline-type IP segment.

[0231] As shown in Table 5 below, based on the definition of resource object type tags in the adapter package, configure tags (JSON format) for resource objects.

[0232]

[0233] Based on Table 5 above, the network administrator can obtain the resource tag corresponding to the resource object instance.

[0234] S04. When a fault occurs, the network management system receives an abnormal event (hereinafter referred to as an event) reported by the network element.

[0235] As shown in Tables 6 and 7 below, Table 6 illustrates the types of abnormal events, and Table 7 illustrates the parameters of abnormal events.

[0236] Table 6 provides examples of abnormal events.

[0237]

[0238] Table 7 below shows the parameter descriptions for abnormal events (JSON format).

[0239]

[0240] The network administrator can obtain the abnormal events reported by the network elements based on Tables 6 and 7 above.

[0241] S05. Obtain the resource objects associated with each of the multiple exception events, i.e. Figure 7 The "Event Filling Resource" shown. Figure 8c As shown, the gray modules represent resource objects associated with abnormal events. For example, resource objects such as Shenzhen area, Dongguan area, Guangzhou area, Ims (APN) and 4G call IP range are all resource objects associated with abnormal events.

[0242] S06. The network management system obtains the initial root cause probability of the abnormal event. According to the enhanced inference rule: if resource objects of the same type fail simultaneously, the probability of it being the root cause decreases. The gray boxes below represent objects of the same type (resource object labels). If all regions fail simultaneously, the probability of it being the root cause decreases.

[0243] like Figure 8d As shown, resource objects with the same resource tag are grouped into the same type of resource object. For example, billing-related resource tags are labeled as "service-type billing," and resource objects in this service-type billing category are of the same type. Resource tags for Shenzhen, Dongguan, and Guangzhou are labeled as "pipeline-type regions," and resource objects in these pipeline-type regions are of the same type. IMS (APN) resource tags are labeled as "pipeline-type APN," and APNX resource tags are labeled as "pipeline-type APN," and resource objects in these pipeline-type APNs are of the same type. IP segment 1 resource tags are labeled as "pipeline-type IP segment," 4G calling IP segment resource tags are labeled as "pipeline-type IP segment," and IP segment 3 resource tags are labeled as "pipeline-type IP segment," and resource objects in these pipeline-type IP segments are of the same type.

[0244] Add resource tags to models (resource object instances) and use the highest probability among events as the initial root cause probability of the resource object.

[0245] Specifically, multiple resource objects with the same resource tag can be represented by the following formula, and the target root cause probability of a resource object can be obtained using the following formula:

[0246] P = Po – (Nm / Tn).

[0247] Where P is the target root cause probability of a resource object, which is valid when comparing resource objects with the same resource label, for example... Figure 8d In this context, all are resource objects belonging to the pipeline IP segment. Comparisons between pipeline classes are valid, but they cannot be compared with resource objects of the "billing-related" class. That is, the above calculation formula is not used when crossing resource tags.

[0248] Po is the initial failure probability of a certain resource object, which is obtained by the event acquisition module of the network element when collecting data.

[0249] Nm represents the number of resource objects associated with the exception event under the same type of resource object.

[0250] Tn represents the total number of resource objects of the same type.

[0251] As shown in Table 8 below, the network management system calculates the target root cause probability of each resource object.

[0252]

[0253] like Figure 8d As shown, the target root cause probability of failure for each resource object is calculated.

[0254] It should be noted that the embodiments of this application may also include the calculation of the probability of some false alarms. When calculating the probability, the deviation of the original data will be compared, thereby adjusting the probability and achieving a more accurate probability calculation.

[0255] Optionally, in addition to the aforementioned steps S01 to S06, the method provided in this application embodiment also includes the following steps:

[0256] The failure probability of the failure propagation chain is obtained based on the connection relationship between resource objects, and then the failure propagation chain is drawn.

[0257] The failure probability of the fault propagation chain is obtained by calculating the P value in step S06 above.

[0258] If a fault propagation chain includes one resource object, then the root cause probability of the target fault of that resource object is taken as the fault probability of the fault propagation chain.

[0259] If the fault propagation chain includes two or more resource objects, the probability of the target fault root cause with the highest probability is selected from the parent and child resource objects as the fault probability of the fault propagation chain.

[0260] It should be noted that the probability of a resource object without any abnormal events is -1.

[0261] The path traversal algorithm obtains all paths from child resource objects to parent resource objects, and the average probability of each resource object in the path is the probability value of this fault propagation chain.

[0262] As shown in Table 9 below, the failure probability of each failure propagation chain can be obtained:

[0263] links All transmission chains modelLinks All resource objects in the propagation chain p Fault probability in a fault propagation chain

[0264] From the fault propagation chain, we can obtain a line with the highest probability, such as... Figure 8d As shown by the middle arrow, this line is the fault propagation chain with the highest probability. The resource object ultimately identified as the root cause of the fault is the 4G call IP segment fault.

[0265] As illustrated by the foregoing examples, this embodiment first identifies multiple resource objects of a network element and labels these objects according to their service classification. Furthermore, this embodiment employs enhanced inference rules; if resource objects of the same type simultaneously fail, the probability that this type of resource object belongs to the root cause of the fault decreases. Finally, this embodiment determines the target root cause probability of each resource object based on the enhanced inference rules, thereby identifying resource objects that can be considered root causes of the fault.

[0266] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in a different order or simultaneously according to this application. Furthermore, those skilled in the art should understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0267] To facilitate better implementation of the above-described solutions in the embodiments of this application, a related system for implementing the above solutions is also provided below.

[0268] Please see Figure 9 An apparatus provided in this application embodiment includes a receiving module 901 and a processing module 902.

[0269] The receiving module is used to receive M abnormal event information sent by the target network element, wherein the M abnormal event information is used to indicate M abnormal events, the M abnormal events are associated with N target resource objects, the N target resource objects are N resource objects among T resource objects associated with the target network element, each of the T resource objects is associated with a resource tag, the resource tag is used to indicate the resource type of the resource object, and M, T, and N are all positive integers;

[0270] The processing module is configured to determine the target fault root cause probability of each target resource object among the N target resource objects, the M abnormal events, and the resource tags of each resource object among the T resource objects; and to determine the fault root cause that generated the M abnormal events based on the target fault root cause probability of each target resource object.

[0271] As another optional approach, the processing module is further configured to determine the initial root cause probability of each of the N target resource objects based on the N target resource objects and the M abnormal events; and to adjust the initial root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each resource object in the T resource objects, so as to obtain the target root cause probability of each of the N target resource objects.

[0272] As another optional method, the N target resource objects include Nm target resource objects, and the resource tags of the Nm target resource objects are all the same, where Nm is a positive integer;

[0273] The T resource objects include Tn resource objects, all of which have the same resource tags, and the resource tags of the Nm target resource objects are the same as those of the Tn resource objects, where Tn is a positive integer;

[0274] The processing module is further configured to determine the target fault root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects.

[0275] As another optional approach, the processing module is further configured to determine the initial root cause probability of each of the Nm target resource objects based on the abnormal events associated with each of the Nm target resource objects; and to adjust the initial root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects, so as to obtain the target root cause probability of each of the Nm target resource objects.

[0276] Alternatively, the processing module is further configured to obtain the target fault root cause probability of any one of the Nm target resource objects in the following manner:

[0277] P = Po – (Nm / Tn);

[0278] Wherein, P represents the target root cause probability of any one of the Nm target resource objects, Po represents the initial root cause probability of any one of the Nm target resource objects, Nm represents the number of target resource objects with the same resource label among the N target resource objects, and Tn represents the number of resource objects with the same resource label as the Nm target resource objects among the T resource objects.

[0279] Alternatively, the processing module is further configured to determine the resource label of each of the T resource objects based on the mapping relationship between resource objects and resource labels.

[0280] As an alternative approach, the processing module is further configured to determine the target resource object with the highest target fault root cause probability as the target resource object belonging to the fault root cause based on the target fault root cause probability of each target resource object among the N target resource objects.

[0281] Alternatively, the N target resource objects include: a first target resource object and a second target resource object;

[0282] The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object;

[0283] The processing module is further configured to, after obtaining the target fault root cause probability of each of the N target resource objects, determine at least one fault propagation chain based on the connection relationship of the N target resource objects, wherein the fault propagation chain includes: the connection relationship between the target network element and the first target resource object, and the connection relationship between the first target resource object and the second target resource object; and determine the fault probability of the fault propagation chain based on the target fault root cause probability of the first target resource object and the target fault root cause probability of the second target resource object.

[0284] Alternatively, the N target resource objects include: a first target resource object and a second target resource object;

[0285] The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object;

[0286] The processing module is further configured to determine the occurrence time of the abnormal event of the first target resource object and the occurrence time of the abnormal event of the second target resource object; when the occurrence time of the abnormal event of the first target resource object is earlier than the occurrence time of the abnormal event of the second target resource object, the initial root cause probability of the first target resource object is increased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the first target resource object; the initial root cause probability of the second target resource object is decreased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the second target resource object.

[0287] As another alternative, the Figure 9 The modules in the device can also be used to execute Figures 2 to 6 Any step of any device in the method flow. The embodiments of this application will not be described in detail here.

[0288] Alternatively, the device can be a chip.

[0289] like Figure 10 The diagram shown is a hardware structure schematic of the device provided in an embodiment of this application. This device can be... Figure 1 The determining device in the process.

[0290] Figure 10 The device shown may include: a processor 1001, a memory 202, a communication interface 1004, an output device 1005, an input device 1006, and a bus 1003. The processor 1001, the memory 1002, the communication interface 1004, the output device 1005, and the input device 1006 can be connected to each other via the bus 1003.

[0291] The processor 1001 is the control center of the computer device. It can be a general-purpose central processing unit (CPU) or other general-purpose processors. The general-purpose processor can be a microprocessor or any conventional processor.

[0292] As an example, processor 1001 may include one or more CPUs.

[0293] The memory 1002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0294] In one possible implementation, the memory 1002 may exist independently of the processor 1001. The memory 1002 can be connected to the processor 1001 via a bus 1003, and is used to store data, instructions, or program code. When the processor 1001 calls and executes the instructions or program code stored in the memory 1002, it can implement the fault root cause determination method provided in this application embodiment, for example, Figures 2 to 6 Methods for determining the root cause of any of the faults shown.

[0295] In another possible implementation, the memory 1002 can also be integrated with the processor 1001.

[0296] The communication interface 1004 is used for connecting the device to other devices via a communication network, which may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 1004 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

[0297] Bus 1003 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0298] It should be pointed out that, Figure 10The structure shown does not constitute a limitation on computer equipment, except Figure 10 In addition to the components shown, a computer device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0299] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0300] This application embodiment can divide the machine learning model management device (such as a machine learning model management center or federated learning server) into functional modules according to the above method examples. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated modules can be implemented in hardware or as software functional modules. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0301] In some embodiments, the disclosed method may be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0302] It should be understood that the arrangements described herein are for illustrative purposes only. Therefore, those skilled in the art will understand that other arrangements and other elements (e.g., machines, interfaces, functions, sequences, and functional groups, etc.) can be used instead, and some elements can be omitted depending on the desired result.

[0303] Furthermore, many of the elements described can be implemented as discrete or distributed components, or as functional entities implemented in any suitable combination and location in conjunction with other components.

[0304] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0305] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for determining the root cause of a fault, characterized in that, include: Receive M abnormal event information sent by the target network element. The M abnormal event information is used to indicate M abnormal events. The M abnormal events are associated with N target resource objects. The N target resource objects are N resource objects out of T resource objects associated with the target network element. Each of the T resource objects is associated with a resource tag. The resource tag is used to indicate the resource type of the resource object. M, T, and N are all positive integers. Based on the N target resource objects, the M abnormal events, and the resource tags of each resource object in the T resource objects, determine the target fault root cause probability of each target resource object in the N target resource objects; Based on the target failure root cause probability of each target resource object, determine the failure root cause that generated the M abnormal events.

2. The method according to claim 1, characterized in that, The step of determining the target fault root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects includes: The initial root cause probability of each of the N target resource objects is determined based on the N target resource objects and the M abnormal events; Based on the N target resource objects, the M abnormal events, and the resource tags of each resource object in the T resource objects, the initial root cause probability of each target resource object in the N target resource objects is adjusted to obtain the target root cause probability of each target resource object in the N target resource objects.

3. The method according to claim 1, characterized in that, The N target resource objects include Nm target resource objects, and the resource tags of the Nm target resource objects are all the same, where Nm is a positive integer; The T resource objects include Tn resource objects, all of which have the same resource tags, and the resource tags of the Nm target resource objects are the same as those of the Tn resource objects, where Tn is a positive integer; The step of determining the target fault root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects includes: Based on the Nm target resource objects and the Tn resource objects, determine the target fault root cause probability of each of the Nm target resource objects.

4. The method according to claim 3, characterized in that, The step of determining the target fault root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects includes: The initial root cause probability of each of the Nm target resource objects is determined based on the abnormal events associated with each of the target resource objects. Based on the Nm target resource objects and the Tn resource objects, the initial root cause probability of each target resource object in the Nm target resource objects is adjusted to obtain the target root cause probability of each target resource object in the Nm target resource objects.

5. The method according to claim 4, characterized in that, The step of adjusting the initial root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects to obtain the target root cause probability of each of the Nm target resource objects includes: The root cause probability of any one of the Nm target resource objects is obtained as follows: P = Po–(Nm / Tn); Wherein, P represents the target root cause probability of any one of the Nm target resource objects, Po represents the initial root cause probability of any one of the Nm target resource objects, Nm represents the number of target resource objects with the same resource label among the N target resource objects, and Tn represents the number of resource objects with the same resource label as the Nm target resource objects among the T resource objects.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: The resource label of each of the T resource objects is determined based on the mapping relationship between resource objects and resource labels.

7. The method according to claim 6, characterized in that, The method further includes: Obtain the resource adaptation information and resource object information of the target network element, wherein the resource adaptation information includes: resource tag information of resource objects in the target network element, and the resource object information includes: T resource objects obtained by dividing service resources in the target network element according to service type, and the connection relationship between the T resource objects and the target network element; The mapping relationship between the resource object and the resource tag is determined based on the resource adaptation information and the resource object information.

8. The method according to claim 7, characterized in that, The resource tag information includes: the type information of the resource object, the name information of the resource object, and the resource tag of the resource object.

9. The method according to claim 7 or 8, characterized in that, The connection relationship between the T resource objects and the target network element includes: the connection relationship between the target network element and each of the T resource objects; or, The T resource objects include: a first resource object and a second resource object, wherein the first resource object is a resource object connected to the target network element, and the second resource object is an object connected to the first resource object; the connection relationship between the T resource objects and the target network element includes: the connection relationship between the target network element and the first resource object, and the connection relationship between the first resource object and the second resource object.

10. The method according to any one of claims 1 to 9, characterized in that, The step of determining the root cause of the M abnormal events based on the target failure root cause probability of each target resource object includes: Based on the target fault root cause probability of each of the N target resource objects, the target resource object with the highest target fault root cause probability is determined as the target resource object belonging to the fault root cause.

11. The method according to claim 2, characterized in that, The N target resource objects include: a first target resource object and a second target resource object; The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object; After obtaining the target fault root cause probability of each of the N target resource objects, the method further includes: At least one fault propagation chain is determined based on the connection relationships of the N target resource objects, wherein the fault propagation chain includes: the connection relationship between the target network element and the first target resource object, and the connection relationship between the first target resource object and the second target resource object; The failure probability of the failure propagation chain is determined based on the target failure root cause probability of the first target resource object and the target failure root cause probability of the second target resource object.

12. The method according to claim 11, characterized in that, The method further includes: When multiple fault propagation chains are generated, the fault propagation chain with the highest fault probability among the multiple fault propagation chains is determined to be the fault propagation chain belonging to the root cause of the fault.

13. The method according to claim 11 or 12, characterized in that, Determining the failure probability of the fault propagation chain based on the target failure root cause probability of the first target resource object and the target failure root cause probability of the second target resource object includes: The average value of the root cause probability of the first target resource object and the root cause probability of the second target resource object is calculated, and the average value is used as the failure probability of the failure propagation chain.

14. The method according to claim 2, characterized in that, The N target resource objects include: a first target resource object and a second target resource object; The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object; The step of adjusting the initial root cause probability of each target resource object among the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each resource object among the T resource objects, to obtain the target root cause probability of each target resource object among the N target resource objects, includes: Determine the time of occurrence of the abnormal event of the first target resource object and the time of occurrence of the abnormal event of the second target resource object; When the abnormal event of the first target resource object occurs earlier than the abnormal event of the second target resource object, the initial root cause probability of the first target resource object is increased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the first target resource object. Based on the connection relationship of the N target resource objects, the initial root cause probability of the second target resource object is reduced by a preset probability amount to obtain the target root cause probability of the second target resource object.

15. A determining device, characterized in that, The device includes: a receiving module and a processing module, wherein... The receiving module is used to receive M abnormal event information sent by the target network element. The M abnormal event information is used to indicate M abnormal events. The M abnormal events are associated with N target resource objects. The N target resource objects are N resource objects out of T resource objects associated with the target network element. Each of the T resource objects is associated with a resource tag. The resource tag is used to indicate the resource type of the resource object. M, T, and N are all positive integers. The processing module is configured to determine the target fault root cause probability of each target resource object among the N target resource objects, the M abnormal events, and the resource tags of each resource object among the T resource objects; and to determine the fault root cause that generated the M abnormal events based on the target fault root cause probability of each target resource object.

16. The apparatus according to claim 15, characterized in that, The processing module is further configured to determine the initial root cause probability of each of the N target resource objects based on the N target resource objects and the M abnormal events; and to adjust the initial root cause probability of each of the N target resource objects based on the N target resource objects, the M abnormal events, and the resource tags of each of the T resource objects, so as to obtain the target root cause probability of each of the N target resource objects.

17. The apparatus according to claim 15, characterized in that, The N target resource objects include Nm target resource objects, and the resource tags of the Nm target resource objects are all the same, where Nm is a positive integer; The T resource objects include Tn resource objects, all of which have the same resource tags, and the resource tags of the Nm target resource objects are the same as those of the Tn resource objects, where Tn is a positive integer; The processing module is further configured to determine the target fault root cause probability of each of the Nm target resource objects based on the Nm target resource objects and the Tn resource objects.

18. The apparatus according to claim 17, characterized in that, The processing module is further configured to determine the initial root cause probability of each target resource object among the Nm target resource objects based on the abnormal events associated with each target resource object among the Nm target resource objects; and to adjust the initial root cause probability of each target resource object among the Nm target resource objects based on the Nm target resource objects and the Tn resource objects, so as to obtain the target root cause probability of each target resource object among the Nm target resource objects.

19. The apparatus according to claim 18, characterized in that, The processing module is further configured to obtain the target fault root cause probability of any one of the Nm target resource objects in the following manner: P = Po–(Nm / Tn); Wherein, P represents the target root cause probability of any one of the Nm target resource objects, Po represents the initial root cause probability of any one of the Nm target resource objects, Nm represents the number of target resource objects with the same resource label among the N target resource objects, and Tn represents the number of resource objects with the same resource label as the Nm target resource objects among the T resource objects.

20. The apparatus according to any one of claims 15 to 19, characterized in that, The processing module is further configured to determine the resource tag of each of the T resource objects based on the mapping relationship between resource objects and resource tags.

21. The apparatus according to any one of claims 15 to 20, characterized in that, The processing module is further configured to determine the target resource object with the highest target fault root cause probability as the target resource object belonging to the fault root cause based on the target fault root cause probability of each target resource object among the N target resource objects.

22. The apparatus according to claim 16, characterized in that, The N target resource objects include: a first target resource object and a second target resource object; The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object; The processing module is further configured to, after obtaining the target fault root cause probability of each of the N target resource objects, determine at least one fault propagation chain based on the connection relationship of the N target resource objects, wherein the fault propagation chain includes: the connection relationship between the target network element and the first target resource object, and the connection relationship between the first target resource object and the second target resource object; and determine the fault probability of the fault propagation chain based on the target fault root cause probability of the first target resource object and the target fault root cause probability of the second target resource object.

23. The apparatus according to claim 16, characterized in that, The N target resource objects include: a first target resource object and a second target resource object; The connection relationships of the N target resource objects include: the first target resource object is connected to the target network element, and the second target resource object is connected to the first target resource object; The processing module is further configured to determine the occurrence time of the abnormal event of the first target resource object and the occurrence time of the abnormal event of the second target resource object; when the occurrence time of the abnormal event of the first target resource object is earlier than the occurrence time of the abnormal event of the second target resource object, the initial root cause probability of the first target resource object is increased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the first target resource object; the initial root cause probability of the second target resource object is decreased by a preset probability amount according to the connection relationship of the N target resource objects to obtain the target root cause probability of the second target resource object.

24. A communication device, characterized in that, include: Memory, which stores executable program instructions; and, A processor, the processor being coupled to the memory, reads and executes instructions in the memory to enable the communication device to implement the method as described in any one of claims 1-15.

25. The apparatus according to claim 24, characterized in that, The device is a terminal device, a chip in a terminal device, a network device, or a chip in a network device.

26. A computer-readable storage medium comprising instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-15.

27. A computer program product comprising instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1-15.

Images