Attribute-based multi-dimensional abnormal root cause location method, system and storage medium

Abstract

This paper discloses a multi-dimensional anomaly root cause location method based on attributes, including: constructing a frequent pattern tree according to a multi-dimensional attribute record data set, using the frequent pattern tree to mine frequent items, and obtaining a coarse-grained attribute value combination that affects the anomaly; wherein any record in the multi-dimensional attribute record data set includes the attribute value of the multi-dimensional attribute and the measurement value of the key performance indicator KPI; constructing an attribute analysis graph using the superset-subset relationship between the coarse-grained attribute value combinations, and using the attribute analysis graph to perform heuristic search to obtain a finer-grained attribute value combination that affects the anomaly. The multi-dimensional anomaly root cause location method of this paper has strong interpretability, fast speed, and high accuracy.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of computer networks, and in particular, to a method, device, and storage medium for locating multi-dimensional anomaly root causes based on attributes. Background Art

[0002] In recent years, anomaly detection has been widely studied, and some of these technologies have been developed into commercial products and deployed in actual production environments, such as time series modeling, feature mining, etc. Generally speaking, these tools have the ability to alert the network operation center of important events, such as DoS (Denial of Service) attacks, link interruptions, misconfigurations and other network anomalies, but they often cannot provide further information for locating and resolving anomalies.

[0003] When most anomalies occur, the comprehensive indicators with a certain combination of attributes will change dramatically. For example, when a DoS attack occurs, the traffic of a specific destination IP address and destination port combination will increase dramatically, triggering an anomaly alarm. In most cases, network operators use their own expertise and auxiliary tools to analyze the causes of anomalies, but this manual analysis is not only time-consuming, but also prone to errors, especially in some large ISP (Internet Service Provider) networks, where the number of anomaly alarms is as high as tens of thousands per day, and manual operation and maintenance is almost impossible. Rapid root cause location of anomalies can not only shorten the duration of anomalies and help to recover from anomalies in a timely manner, but also greatly reduce the losses caused by anomalies. Therefore, fast and accurate root cause location technology has a very optimistic application prospect. Summary of the invention

[0004] The present application embodiment provides a multi-dimensional anomaly root cause location method based on attributes, including:

[0005] A frequent pattern tree is constructed according to a multidimensional attribute record data set, and frequent item mining is performed using the frequent pattern tree to obtain a coarse-grained attribute value combination that affects the anomaly; wherein any record in the multidimensional attribute record data set includes an attribute value of a multidimensional attribute and a measurement value of a key performance indicator KPI;

[0006] An attribute analysis graph is constructed using the superset-subset relationship between coarse-grained attribute value combinations, and the attribute analysis graph is used to perform a heuristic search to obtain a finer-grained attribute value combination that affects the anomaly.

[0007] An embodiment of the present application provides an attribute-based multi-dimensional anomaly root cause location system, including: a memory and a processor, the memory storing a computer program, and the computer program, when executed by the processor, implements the steps of the attribute-based multi-dimensional anomaly root cause location method.

[0008] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-mentioned attribute-based multi-dimensional anomaly root cause locating method.

[0009] The method for locating the root cause of anomalies based on attributes provided in the embodiment of the present application builds a frequent pattern tree according to a multidimensional attribute record data set, uses the frequent pattern tree to mine frequent items, and obtains a coarse-grained attribute value combination that affects the anomaly; wherein any record in the multidimensional attribute record data set includes the attribute value of the multidimensional attribute and the measurement value of the key performance indicator KPI; an attribute analysis diagram is constructed using the superset-subset relationship between the coarse-grained attribute value combinations, and the attribute analysis diagram is used to perform a heuristic search to obtain a finer-grained attribute value combination that affects the anomaly. The method for locating the root cause of anomalies based on the embodiment of the present application is highly interpretable, fast, and accurate.

[0010] Other aspects will be apparent upon reading and understanding the drawings and detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The accompanying drawings are used to provide an understanding of the technical solution of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solution of the present application and do not constitute a limitation on the technical solution of the present application.

[0012] Figure 1 A flowchart of a multi-dimensional anomaly root cause location method based on attributes according to an embodiment of the present application;

[0013] Figure 2 This is a schematic diagram of automatically selecting an inflection point θ using a Knee-Point algorithm according to an embodiment of the present application;

[0014] Figure 3 A schematic diagram of a two-stage root cause location method according to an embodiment of the present application;

[0015] Figure 4 A schematic diagram of a two-stage root cause location system according to an embodiment of the present application;

[0016] Figure 5 This is a structural diagram of an attribute-based multi-dimensional anomaly root cause location system according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those skilled in the art that there may be more embodiments and implementations within the scope of the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the specific embodiments, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with any other feature or element in any other embodiment, or may replace any other feature or element in any other embodiment.

[0018] The present application includes and contemplates combinations of features known to those of ordinary skill in the art. The embodiments and features disclosed in the present application may also be combined with any conventional features to form a unique invention scheme defined by the appended claims. Any feature of any embodiment may also be combined with features from other invention schemes to form another unique invention scheme defined by the appended claims. Therefore, it should be understood that any feature shown and / or discussed in the present application may be implemented individually or in any appropriate combination. Therefore, except for the limitations made according to the appended claims and their equivalents, the embodiments are not subject to other restrictions. In addition, various modifications and changes may be made within the scope of protection of the appended claims.

[0019] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not rely on the specific order of the steps described herein, the method or process should not be limited to the steps of the specific order described. As will be understood by those of ordinary skill in the art, other sequences of steps are also possible. Therefore, the specific sequence of the steps set forth in the specification should not be interpreted as a limitation to the appended claims. In addition, the claims for the method and / or process should not be limited to the steps of performing them in the order written, and those skilled in the art can easily understand that these sequences can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0020] The challenge of root cause location is how to locate the attribute combination related to the anomaly from the huge search space. Theoretically, the root cause of the anomaly can be a collection of any number of attribute combinations of any dimension. For a data set with multi-dimensional attributes, assuming that each dimension of the attribute has multiple values, the search space of the attribute combination will grow exponentially as the number of attributes and the attribute value space increase.

[0021] like Figure 1 As shown, the embodiment of the present application provides a multi-dimensional anomaly root cause location method based on attributes, including:

[0022] Step S10, constructing a frequent pattern tree according to the multidimensional attribute record data set, and using the frequent pattern tree to perform frequent item mining to obtain a coarse-grained attribute value combination that affects the anomaly; wherein any record in the multidimensional attribute record data set includes the attribute value of the multidimensional attribute and the measurement value of the key performance indicator KPI;

[0023] Step S20, constructing an attribute analysis graph using the superset-subset relationship between coarse-grained attribute value combinations, and performing a heuristic search using the attribute analysis graph to obtain a finer-grained attribute value combination that affects the anomaly.

[0024] The method for locating the root cause of anomalies based on attributes provided in the embodiment of the present application builds a frequent pattern tree according to a multidimensional attribute record data set, uses the frequent pattern tree to mine frequent items, and obtains a coarse-grained attribute value combination that affects the anomaly; wherein any record in the multidimensional attribute record data set includes the attribute value of the multidimensional attribute and the measurement value of the key performance indicator KPI; an attribute analysis diagram is constructed using the superset-subset relationship between the coarse-grained attribute value combinations, and the attribute analysis diagram is used to perform a heuristic search to obtain a finer-grained attribute value combination that affects the anomaly. The method for locating the root cause of anomalies based on the embodiment of the present application is highly interpretable, fast, and accurate.

[0025] Take the background log of an e-commerce platform as an example of a multidimensional attribute record data set. The log record includes multidimensional attributes and one-dimensional KPI. The multidimensional attributes include: "time", "province", "operator" and "request type". The KPI is "response time". "Beijing", "Shandong", "Jiangsu", etc. are the attribute values ​​of the attribute "province", "China Mobile", "China Unicom" and "China Telecom", etc. are the attribute values ​​of the attribute "operator". "Query" and "Consumption", etc. are the attribute values ​​of the attribute "request type". Table 1 below is an example of a record of a multidimensional attribute record data set.

[0026]

[0027]

[0028] Table 1

[0029] The measured values ​​of the root attribute combination often change greatly during the abnormal time period. Therefore, based on this observation, we can filter the records with smaller measured values ​​during the abnormal time period and find the attribute value combination with larger measured values, which is called frequent item mining. If the measured value of a combination exceeds the preset minimum support threshold (MIN_SUP), it is considered a frequent item.

[0030] The multidimensional attribute record data set can be written as: F = {f1: v1, f2: v2, ..., f N :v N}, where f i It represents the i-th record with M-dimensional attributes, denoted as Um represents the value space of the m-th dimension attribute, 1≤m≤M; v i Used to record i The corresponding measured value at the abnormal moment. N represents the total number of records in the multidimensional attribute record data set.

[0031] The output after frequent item mining is a combination of attribute values, recorded as Where * represents a wildcard, r i is a coarse-grained combination of attribute values ​​that satisfies

[0032] In some exemplary embodiments, the frequent pattern tree includes multiple nodes, each node includes three features: item_name, count and node_link; wherein item_name represents the value of the attribute, that is, the attribute value, count represents the support of the attribute value, that is, the cumulative KPI measurement value of the attribute value (the cumulative sum of the KPI measurement values ​​of multiple records containing the attribute value), and node_link is a pointer pointing to the next node with the same attribute value, and if there is no next node with the same attribute value, it points to null.

[0033] In some exemplary embodiments, constructing a frequent pattern tree according to a multidimensional attribute record data set includes performing the following steps:

[0034] Traversing each record in the multidimensional attribute record data set and counting the support of each attribute value;

[0035] Sort all attribute values ​​in descending order according to support to obtain the descending order of attribute values;

[0036] Sort the attribute values ​​in each record in descending order according to the descending order, and filter out attribute values ​​whose support is less than the minimum support threshold MIN_SUP;

[0037] Initialize the root node of the frequent pattern tree, then call the insert function to insert the records sorted in descending order into the frequent pattern tree, and generate the nodes and paths of the frequent pattern tree.

[0038] In some exemplary implementations, the frequent item mining using the frequent pattern tree includes performing the following steps:

[0039] For any attribute value Ti on the frequent pattern tree, check the prefix path set of the attribute value on the frequent pattern tree to form a conditional pattern base; use the conditional pattern base to construct a conditional frequent pattern tree FP-Tree; wherein the support of each prefix path is the minimum value of the support of all nodes on the path; calculate all possible combinations of nodes on each path on the conditional frequent pattern tree FP-Tree to obtain a set of all frequent items with the attribute value Ti as a suffix.

[0040] In some exemplary implementations, the minimum support threshold MIN_SUP may be determined in the following manner:

[0041] Obtain KPI measurement values ​​of all records in the multidimensional attribute record data set to form a measurement value sequence;

[0042] Determine whether the measured value sequence satisfies the normal distribution, if yes, do not perform preprocessing, otherwise, preprocess the measured value sequence so that the processed measured value sequence is close to the normal distribution;

[0043] Draw the cumulative distribution function (CDF) of the measurement sequence, and use the Knee-Point algorithm to automatically select the inflection point θ. If the measurement sequence is preprocessed as logarithmic processing y=log(x+1), the minimum support threshold is set to MIN_SUP=e θ -1, if the measurement value sequence has not been preprocessed, the minimum support threshold is set to MIN_SUP=θ; wherein x is the measurement value before preprocessing, and y is the measurement value after preprocessing.

[0044] In other implementations, the minimum support threshold MIN_SUP may also be set based on experience.

[0045] Figure 2 A schematic diagram of automatically obtaining the minimum support threshold is shown, the horizontal axis is the preprocessed measurement value, the original measurement value is v, the preprocessed measurement value is log(v+1), and the vertical axis is the CDF value of the preprocessed measurement value.

[0046] The attribute value combinations obtained after frequent item mining only indicate that they have large measurement values, but do not mean that these attribute value combinations are directly related to anomalies. Therefore, further analysis is needed to screen out the root cause combinations that directly cause anomalies. There is an obvious correlation between coarse-grained attribute value combinations, so a directed graph can be used to describe the subset-superset relationship between combinations, which is called an "attribute analysis graph."

[0047] In some exemplary embodiments, the property analysis graph includes at least one vertex;

[0048] Any vertex is a combination of attribute values ​​and has four features: feature_name, real_value, predicted_value and vertex_dic;

[0049] Among them, feature_name represents the rule of attribute value combination, real_value represents the cumulative sum of KPI measurement values ​​of the record set corresponding to the rule, and predicted_value represents the cumulative sum of KPI predicted values ​​of the record set corresponding to the rule; vertex_dic is a set of extended attribute values, which is a dictionary structure, including keys and values ​​corresponding to the keys. The keys are used to record extended attribute values, and the values ​​corresponding to the keys are a vertex list used to record the vertices extended on the specified extended attribute dimension.

[0050] The feature_name of a node is a rule for combining attribute values, for example: "A=a1, B=*, C=c3". "*" is a wildcard. The set of extended attribute values ​​is recorded in vertex_dic. Extended attribute values ​​refer to the extension of the feature_name of the current node. For example, the extension from "A=a1, B=*, C=c3" to "A=a1, B=b2, C=c3" is an extension on the B attribute.

[0051] In some exemplary embodiments, constructing an attribute analysis graph using a superset-subset relationship between coarse-grained attribute value combinations includes:

[0052] When vertex i is a superset of vertex j and vertex j is a subset of vertex i, an edge is generated between vertex i and vertex j.

[0053] In the root cause location solution of the related art, each attribute value combination is analyzed to evaluate whether it is an abnormal root cause combination. This process not only relies on the premise assumption of the attribute combination form, but is also very time-consuming. In order to break through this limitation, the embodiment of the present application adopts an attribute-based heuristic search solution, which does not restrict the form and number of attribute combinations and can adapt to abnormal root cause location in various application scenarios.

[0054] In some exemplary embodiments, the attribute analysis graph is used to perform a heuristic search to obtain a more fine-grained attribute value combination that affects the anomaly, including:

[0055] In the attribute analysis graph, the attribute values ​​related to vertex anomalies are expanded, and the attribute value combinations whose contribution rate to anomalies is less than the threshold are filtered out using a pruning algorithm based on contribution rate. The pruning algorithm based on ripple effect is used to control the granularity of the anomaly root cause rules.

[0056] Among them, in the attribute analysis diagram, the successor vertices of any vertex are divided into different child nodes according to different extended attributes, and any child node represents a combination of attribute values ​​under a specified extended dimension.

[0057] In some exemplary implementations, a pruning algorithm based on contribution rate is used to filter out attribute value combinations whose contribution rate to anomalies is less than a threshold, including:

[0058] From the vertex v i Start by expanding vertex v according to the rule i Each dimension of the extended attribute value of the child node, for any child node v j Perform the following processing: Calculate the child node v j To its parent node v i The abnormal contribution rate CP(v j ); when CP(v j ) is greater than or equal to the contribution rate threshold, continue to expand v j The child node of CP(v j ) is less than the contribution rate threshold, stop at the child node v j Continue to expand on

[0059] in,

[0060] p(v j ) is the vertex v j KPI prediction value, r(v j ) is the vertex v j KPI measurement value, p(v i ) is the vertex v i KPI prediction value, r(v i ) is the vertex v i KPI measurement value.

[0061] In some exemplary embodiments, the pruning algorithm based on the ripple effect is used to control the granularity of the abnormal root cause rule, including:

[0062] From the vertex v i Start by expanding vertex v according to the rule i For each dimension of the extended attribute value, calculate each child node v under the extended attribute value. j The relative abnormal value RA(v j ), if the variance between the relative outliers of all child nodes on the extended attribute value of this dimension is less than the variance threshold, then all child nodes on the extended attribute value of this dimension are determined to be related to vertex v i If the ripple effect is satisfied, the expansion on the extended attribute value of this dimension will stop;

[0063] in, p(v j ) is the child node v j KPI prediction value, r(v j ) is the child node v j KPI measurement value.

[0064] If the current node is the root cause node, then all its successor nodes will present similar abnormal conditions as the current node. This phenomenon can be described by the ripple effect.

[0065] In order to quantify the susceptibility of the successor node set to the ripple effect, the present embodiment introduces Shannon entropy for evaluation. First, the relative abnormality of each successor node is determined, that is, Shannon entropy E is then used to quantify the degree of disorder of the relative anomaly distribution:

[0066]

[0067] in,

[0068] The higher the Shannon entropy E, the stronger the compliance of the successor node set to the ripple effect. When the entropy E exceeds the threshold γ, it is considered that the most fine-grained root cause node has been found and the search is stopped at this node. It should be emphasized that the threshold γ has little effect on the accuracy of the algorithm, but can be used to adjust the fine-grainedness of the rules.

[0069] Figure 3A schematic diagram of a two-stage root cause location (Fast Two-Stage Multi-dimensional RootCause Analysis, RTM-RCA) method is provided. The efficiency of the root cause location algorithm is greatly improved by dividing the filtering of normal records and the location of abnormal attribute combinations into two stages. The FTM-RCA location scheme first traverses each record in the first stage, establishes an FP-Tree (Frequent Pattern-Tree), and extracts coarse-grained attribute combinations based on the FP-Tree data structure using frequent item set mining technology, and uses the coarse-grained attribute combinations as the input of the location algorithm in the second stage. In the second stage, the superset-subset relationship between the coarse-grained attribute combinations is first used to construct an attribute analysis graph, and then a pruning algorithm based on the ripple effect and contribution rate is used to design an attribute-based heuristic search algorithm to achieve accurate and interpretable root cause location results. The above-mentioned root cause location method is highly interpretable, fast, and accurate, and can be applied to large-scale data scenarios, including network traffic data analysis (Netflow), software problem report analysis, and key performance indicator (KPI) anomaly location.

[0070] Figure 4 A two-stage root cause location (Fast Two-Stage Multi-dimensional RootCause Analysis, RTM-RCA for short) system is provided, including: a frequent item mining module, a minimum support threshold acquisition module, an attribute analysis graph construction module and a heuristic search module. In the first stage, the frequent item mining module traverses each record, establishes an FP-Tree (Frequent Pattern-Tree), and extracts coarse-grained attribute combinations based on the FP-Tree data structure using the frequent item set mining technology, and uses the coarse-grained attribute combinations as the input of the location algorithm in the second stage, wherein the minimum support threshold acquisition module automatically obtains the minimum support threshold using the Knee-Point algorithm. In the second stage, the attribute analysis graph construction module constructs an attribute analysis graph using the superset-subset relationship between the coarse-grained attribute combinations, and then uses the pruning algorithm based on the ripple effect and contribution rate to design an attribute-based heuristic search algorithm to achieve accurate and interpretable root cause location results.

[0071] like Figure 5 As shown, an embodiment of the present disclosure provides an attribute-based multi-dimensional anomaly root cause location system, including: a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the steps of the above-mentioned attribute-based multi-dimensional anomaly root cause location method are implemented.

[0072] An embodiment of the present disclosure provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-mentioned attribute-based multi-dimensional anomaly root cause locating method.

[0073] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A multi-dimensional anomaly root cause location method based on attributes, comprising: A frequent pattern tree is constructed according to a multidimensional attribute record data set, and frequent item mining is performed using the frequent pattern tree to obtain a coarse-grained attribute value combination that affects the anomaly; wherein any record in the multidimensional attribute record data set includes an attribute value of a multidimensional attribute and a measurement value of a key performance indicator KPI; A directed graph is constructed using the superset-subset relationship between coarse-grained attribute value combinations, the directed graph is used as an attribute analysis graph, and the attribute analysis graph is used to perform a heuristic search to obtain a finer-grained attribute value combination that affects the anomaly; The method of constructing a directed graph using a superset-subset relationship between coarse-grained attribute value combinations includes: generating vertices of the directed graph using attribute value combinations, and when vertex i is a superset of vertex j and vertex j is a subset of vertex i, an edge is generated between vertex i and vertex j, from vertex i to vertex j; The directed graph includes at least one vertex; any vertex is an attribute value combination and has four features: feature_name, real_value, predicted_value and vertex_dic; feature_name represents the rule of attribute value combination, real_value represents the cumulative sum of KPI measurement values ​​of the record set corresponding to the rule, and predicted_value represents the cumulative sum of KPI prediction values ​​of the record set corresponding to the rule; vertex_dic is a set of extended attribute values, which is a dictionary structure, including keys and values ​​corresponding to the keys, the keys are used to record extended attribute values, and the values ​​corresponding to the keys are a vertex list, which is used to record the vertices extended on the specified extended attribute dimension.

2. The method according to claim 1, characterized in that: The method of constructing a frequent pattern tree according to a multidimensional attribute record data set includes: Traverse each record in the multidimensional attribute record data set and count the support of each attribute value; sort all attribute values ​​in descending order according to the support to obtain the descending order of the attribute values; sort the attribute values ​​in each record in descending order according to the descending order, and filter out the attribute values ​​whose support is less than the minimum support threshold MIN_SUP; initialize the root node of the frequent pattern tree, and then call the insertion function to insert the records sorted in descending order into the frequent pattern tree, and generate the nodes and paths of the frequent pattern tree; The frequent pattern tree includes multiple nodes, each of which has three characteristics: attribute value, support and node pointer; the attribute value is the value of the attribute, the support is the cumulative KPI measurement value of the attribute value, and the node pointer points to the next node with the same attribute value.

3. The method according to claim 2, characterized in that: The method of using the frequent pattern tree to mine frequent items includes: For any attribute value Ti on the frequent pattern tree, check the prefix path set of the attribute value on the frequent pattern tree to form a conditional pattern base, and use the conditional pattern base to construct a conditional frequent pattern tree; wherein the support of each prefix path on the conditional frequent pattern tree is the minimum value of the support of all nodes on the prefix path; calculate all possible combinations of nodes on each path on the conditional frequent pattern tree, and obtain a set of all frequent items with the attribute value Ti as a suffix.

4. The method according to claim 1, characterized in that: The attribute analysis graph is used to perform a heuristic search to obtain a more fine-grained attribute value combination that affects the anomaly, including: In the attribute analysis graph, the attribute values ​​related to the anomaly are expanded for the vertices, and the attribute value combinations whose contribution rate to the anomaly is less than the threshold are filtered out using the pruning algorithm based on the contribution rate. The pruning algorithm based on the ripple effect is used to control the granularity of the anomaly root cause rules. Among them, in the attribute analysis diagram, the successor vertices of any vertex are divided into different child nodes according to different extended attributes, and any child node represents a combination of attribute values ​​under a specified extended dimension.

5. The method according to claim 4, characterized in that: The method of using a contribution rate-based pruning algorithm to filter out attribute value combinations whose contribution rate to anomalies is less than a threshold value includes: From the vertex v i Start by expanding vertex v according to the rule i Each dimension of the extended attribute value of the child node, for any child node v j Perform the following processing: Calculate the child node v j To its parent node v i The abnormal contribution rate CP(v j ); when CP(v j ) is greater than or equal to the contribution rate threshold, continue to expand v j The child node of CP(v j ) is less than the contribution rate threshold, stop at the child node v j Continue to expand on in, p(v j ) is the child node v j KPI prediction value, r(v j ) is the child node v j KPI measurement value, p(v i ) is the vertex v i KPI prediction value, r(v i ) is the vertex v i KPI measurement value.

6. The method according to claim 4 or 5, characterized in that: The pruning algorithm based on the ripple effect is used to control the granularity of the abnormal root cause rule, including: From the vertex v i Start by expanding vertex v according to the rule i For each dimension of the extended attribute value, calculate each child node v under the extended attribute value. j The relative abnormal value RA(v j ), if the variance between the relative outliers of all child nodes on the extended attribute value of this dimension is less than the variance threshold, then all child nodes on the extended attribute value of this dimension are determined to be related to vertex v i If the ripple effect is satisfied, the expansion on the extended attribute value of this dimension will stop; in, p(v j ) is the child node v j KPI prediction value, r(v j ) is the child node v j KPI measurement value.

7. The method according to claim 2, characterized in that: The minimum support threshold MIN_SUP is determined in the following way: Obtain KPI measurement values ​​of all records in the multidimensional attribute record data set to form a measurement value sequence; Determine whether the measured value sequence satisfies the normal distribution, if yes, do not perform preprocessing, otherwise, preprocess the measured value sequence so that the processed measured value sequence is close to the normal distribution; Draw the cumulative distribution diagram CDF of the measurement value sequence, and apply the Knee-Point algorithm to automatically select the inflection point θ. If the measurement value sequence is preprocessed as logarithmic processing y=log(x+1), the minimum support threshold is set to MIN_SUP=e θ -1, if the measurement value sequence has not been preprocessed, the minimum support threshold is set to MIN_SUP=θ; wherein x is the measurement value before preprocessing, and y is the measurement value after preprocessing.

8. A multi-dimensional anomaly root cause location system based on attributes, comprising: A memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the attribute-based multi-dimensional anomaly root cause locating method described in any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the computer program implements the steps of the attribute-based multi-dimensional anomaly root cause location method according to any one of claims 1 to 7.

Images