A method and device for locating abnormal root causes based on device topology and causal relationship

Abstract

The present invention discloses a method and device for locating the root cause of anomalies based on device topology and causal relationships, wherein the method includes: saving the topological relationship of network devices through a graph database; collecting historical alarm information for processing, generating data to be analyzed, calculating the alarm causal relationship using the LiNGAM algorithm, and then calculating the alarm causal relationship weight using the conditional probability formula; based on the network device topological relationship and the alarm causal relationship and their weights, analyzing the alarm information generated in real time, and obtaining the root cause link, root alarm, and root device. The method and device utilize the topological structure sequence of network devices, combined with the causal relationship of alarms and the time sequence of alarm occurrence, to give the root cause link of the alarm, and find the root device and root alarm based on the root cause link.

Description

Technical Field

[0001] The present invention relates to the technical field of alarm root cause positioning, and in particular to a method and a device for positioning an abnormality root cause based on device topology and causal relationship. Background Art

[0002] When a large number of alarms occur in the entire network in a short period of time, it is necessary to compress the repeated alarms and provide a link to the root cause alarm to find the root cause alarm, thereby reducing the workload of operation and maintenance personnel when dealing with alarms. In the existing technical solutions, there is an alarm root cause location method based on the GRANO algorithm (root cause analysis algorithm based on interactive graphs). Although this method can effectively compress alarms and determine the root cause alarm by calculating the score ranking of each alarm node, it cannot provide a complete root cause link, and the root cause is not very explainable. Summary of the invention

[0003] In order to solve the above-mentioned problems existing in the existing technical solutions, the present invention provides a method and device for locating the root cause of anomalies based on device topology and causal relationship. By utilizing the topological structure order of network devices, combined with the causal relationship of alarms and the time sequence of alarm occurrence, the root cause link of the alarm can be given, and the root device and root alarm can be found according to the root cause link.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a method for locating the root cause of anomalies based on device topology and causal relationships is proposed. The method includes:

[0006] The topological relationship of network devices is saved through a graph database;

[0007] Collect historical alarm information for processing, generate data to be analyzed, use the LiNGAM algorithm to calculate the alarm causal relationship, and then use the conditional probability formula to calculate the alarm causal relationship weight;

[0008] Based on the topological relationship of network devices, the causal relationship of alarms and their weights, the alarm information generated in real time is analyzed to obtain the root cause link, root alarm and root device.

[0009] Furthermore, the topological relationship of network devices is saved through a graph database, including:

[0010] Each network device is defined as a vertex of the graph database, and the connection relationship between network devices is defined as the edge of the graph database, so that the connection relationship between network devices is recorded and written into the graph database.

[0011] Furthermore, historical alarm information is collected and processed to generate data to be analyzed, including:

[0012] Collect historical alarm information. For each piece of historical alarm information, select the historical alarm information within a time slice after the historical alarm information occurs, and then use the connection relationship between network devices to filter out the historical alarm information that occurs on network devices within two hops.

[0013] The filtered historical alarm information is processed in a one-hot manner to generate a piece of data to be analyzed.

[0014] Furthermore, based on the network device topology relationship and alarm causal relationship and its weight, the real-time alarm information is analyzed to obtain the root cause link, root alarm and root device, including:

[0015] For each piece of alarm information generated in real time, select the alarm information within a time slice after the occurrence of the alarm information generated in real time;

[0016] All network devices in these alarm messages are obtained through the graph database, and then the connection relationship between network devices is used to filter out network devices within two hops, and the connection relationship between network devices within two hops is recorded through a separate graph space;

[0017] Analyze the network devices in the graph space one by one. If multiple alarms occur on a network device, it is necessary to determine the root alarm that occurs on the network device.

[0018] If the graph space is not fully connected, it is necessary to perform root cause location analysis based on a connected subgraph to obtain and summarize the root cause link, root alarm, and root device.

[0019] Furthermore, when multiple alarms occur on a network device, a directed graph is first constructed, and then the starting point alarm of the longest path calculated according to the causal weight in the directed graph is selected as the root alarm; if there is no path in the directed graph, the alarm with the earliest time is selected as the root alarm.

[0020] Furthermore, if the graph space is not fully connected, it is necessary to perform root cause location analysis on a connected subgraph basis, including:

[0021] For each connected subgraph, first construct a new directed graph, traverse the edges of the new directed graph, merge and associate the alarm types corresponding to the starting and ending network devices of each edge with the alarm causal relationship results, if the combination of alarm types corresponding to the starting and ending network devices can be associated in the alarm causal relationship results, then determine whether the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship exist, if so, take the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship, and then select the weight value with the higher weight value in the positive and reverse directions of the alarm causal relationship as the actual direction of the edge, and record it in the constructed new directed graph, if not, the alarm causal relationship weight value is recorded as 0;

[0022] After the current new directed graph is constructed, all paths therein are calculated, and the path with the highest sum of alarm causal weight values ​​is taken as the root cause link. The starting device of the root cause link is the root device, and the alarm occurring on the root device is the root alarm.

[0023] In one embodiment of the present invention, a device for locating the root cause of anomalies based on device topology and causal relationship is also proposed, and the device includes:

[0024] The device topology information building module is used to save the topological relationship of network devices through a graph database;

[0025] The alarm causal relationship calculation module is used to collect historical alarm information for processing, generate data to be analyzed, calculate the alarm causal relationship using the LiNGAM algorithm, and then calculate the alarm causal relationship weight using the conditional probability formula;

[0026] The alarm root cause convergence module is used to analyze the alarm information generated in real time based on the network device topology relationship and the alarm causal relationship and its weight, and obtain the root cause link, root alarm and root device.

[0027] Furthermore, the device topology information building module is specifically used to:

[0028] Each network device is defined as a vertex of the graph database, and the connection relationship between network devices is defined as the edge of the graph database, so that the connection relationship between network devices is recorded and written into the graph database.

[0029] Furthermore, historical alarm information is collected and processed to generate data to be analyzed, including:

[0030] Collect historical alarm information. For each piece of historical alarm information, select the historical alarm information within a time slice after the historical alarm information occurs, and then use the connection relationship between network devices to filter out the historical alarm information that occurs on network devices within two hops.

[0031] The filtered historical alarm information is processed in a one-hot manner to generate a piece of data to be analyzed.

[0032] Furthermore, the alarm root cause convergence module is specifically used to:

[0033] For each piece of alarm information generated in real time, select the alarm information within a time slice after the occurrence of the alarm information generated in real time;

[0034] All network devices in these alarm messages are obtained through the graph database, and then the connection relationship between network devices is used to filter out network devices within two hops, and the connection relationship between network devices within two hops is recorded through a separate graph space;

[0035] Analyze the network devices in the graph space one by one. If multiple alarms occur on a network device, it is necessary to determine the root alarm that occurs on the network device.

[0036] If the graph space is not fully connected, it is necessary to perform root cause location analysis based on a connected subgraph to obtain and summarize the root cause link, root alarm, and root device.

[0037] Furthermore, when multiple alarm messages occur on a network device, a directed graph is first constructed, and then the starting point alarm of the longest path calculated according to the causal weight in the directed graph is selected as the root alarm; if there is no path in the directed graph, the alarm with the earliest time is selected as the root alarm.

[0038] Furthermore, if the graph space is not fully connected, it is necessary to perform root cause location analysis on a connected subgraph basis, including:

[0039] For each connected subgraph, first construct a new directed graph, traverse the edges of the new directed graph, merge and associate the alarm types corresponding to the starting and ending network devices of each edge with the alarm causal relationship results, if the combination of alarm types corresponding to the starting and ending network devices can be associated in the alarm causal relationship results, then determine whether the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship exist, if so, take the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship, and then select the weight value with the higher weight value in the positive and reverse directions of the alarm causal relationship as the actual direction of the edge, and record it in the constructed new directed graph, if not, the alarm causal relationship weight value is recorded as 0;

[0040] After the current new directed graph is constructed, all paths therein are calculated, and the path with the highest sum of alarm causal weight values ​​is taken as the root cause link. The starting device of the root cause link is the root device, and the alarm occurring on the root device is the root alarm.

[0041] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the aforementioned method for locating the root cause of anomalies based on device topology and causal relationships is implemented.

[0042] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing a method for locating a root cause of anomaly based on device topology and causal relationship.

[0043] Beneficial effects:

[0044] 1. The present invention records the device topology relationship and alarm causal relationship through a graph database, which can achieve efficient query and use.

[0045] 2. The calculation method for alarm root cause convergence in the present invention can accurately locate the alarm root cause link, obtain the root device and root alarm that cause the alarm, and effectively improve the alarm processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flow chart of the abnormal root cause location method based on device topology and causal relationship of the present invention;

[0047] Figure 2 It is a root cause link diagram with only two endpoints obtained from alarm information occurring within 2 hours in a certain topology network in one embodiment of the present invention;

[0048] Figure 3 It is a root cause link diagram with four endpoints obtained from alarm information occurring within 2 hours in a certain topology network in one embodiment of the present invention;

[0049] Figure 4 It is a schematic diagram of the structure of the abnormal root cause location device based on device topology and causal relationship of the present invention;

[0050] Figure 5 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0052] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a device, apparatus, equipment, method or computer program product. Therefore, the present disclosure may be implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0053] According to an embodiment of the present invention, a method and device for locating the root cause of anomalies based on device topology and causal relationships are proposed. By utilizing the topological structure order of network devices, combined with the causal relationship of alarms and the time sequence of alarm occurrence, the root cause link of the alarm can be given, and the root device and root alarm can be found based on the root cause link.

[0054] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0055] Figure 1 FIG. 1 is a flow chart of the abnormal root cause location method based on device topology and causal relationship of the present invention. Figure 1 As shown, the method is as follows:

[0056] 1. Build device topology information

[0057] The connection relationship between network devices is saved through a graph database. The data structure of a graph database is vertices and edges. Vertices are connected by edges and are used to describe the connection relationship between network devices. Each network device is defined as a vertex, and the connection relationship between network devices is defined as an edge. The connection relationship between network devices is recorded and written into the graph database in this way, so that it can be accessed at any time for subsequent analysis.

[0058] 2. Calculate the causal relationship of alarms

[0059] Collect historical alarm information, which includes the alarm type and the corresponding alarm device data. After collection, process it: traverse each piece of historical alarm information one by one. For each piece of historical alarm information, select all historical alarm information within a time slice after the occurrence of this historical alarm. Here, the time slice value is 10 minutes. From the historical alarm information within this time slice, use the connection relationship between network devices constructed in step 1 to filter out historical alarm information that occurs on network devices within two hops. Process the filtered historical alarm information through the one-hot method (existing technology) and process it into a piece of data to be analyzed. After traversing all historical alarm information, you can get all the data used to calculate the causal relationship of the alarm.

[0060] Here, the LiNGAM algorithm is used to calculate the alarm causal relationship. The algorithm is a linear non-Gaussian acyclic model, which is mainly used to analyze the causal direction and causal connection weight between variables. It is an existing technology. After the calculation is completed, several alarm causal relationships such as A→B, B→C will be obtained. Here A, B, and C represent different alarm types.

[0061] After obtaining the alarm causal relationship, the alarm causal relationship weight must be calculated to be used for the next step of alarm root cause convergence and determine the direction of the root cause link. Here, the conditional probability formula in mathematics is used (Prior art), where P(B) represents the probability of B occurring, P(AB) represents the probability of A and B occurring simultaneously, and p(A|B) here refers to the probability of alarm type A and alarm type B occurring simultaneously when alarm type B occurs. In this way, the causal relationship between alarms and their weights can be obtained.

[0062] 3. Alarm root cause convergence

[0063] The first two steps have obtained the alarm causal relationship and network device topology relationship. This step needs to analyze the alarm information generated in real time to obtain the root cause link, root alarm and root device. The alarm information analyzed here is the alarm information generated in real time within a time slice.

[0064] 3.1 First, through the graph database, all relevant network devices in this batch of alarm information and the network devices that are connected to them within two hops are obtained, and a separate graph space (with the same data structure as the graph database) is constructed as the device graph space to record their connection relationships and analyze them.

[0065] 3.2 Here we analyze the network devices in the space in 3.1 one by one. At this time, a network device may contain multiple alarms, and it is necessary to determine the root alarm on a single network device. If there is only one alarm on a network device, then this alarm is the root alarm on the network device. In the case where a network device contains multiple alarms, a directed graph is constructed (all alarms generated on this single network device are put into the graph, each alarm is used as an endpoint, and the alarm causal relationship table obtained in step 2 is referred to. If these alarms can be associated with alarm causal relationships in the alarm causal relationship table, an edge is connected in the graph, and this edge can obtain an alarm causal relationship weight value in the alarm causal relationship table. These points and edges can construct a directed graph) to analyze the root alarm on a single network device, and the starting point alarm of the longest path calculated according to the alarm causal relationship weight in the directed graph is selected as the root alarm (traverse and find all the single acyclic paths in the directed graph, and the path with the most edges is the longest path. If there are multiple longest paths of equal length, the alarm causal relationship weights of each edge on each path are added, and the path with the highest weight is selected. The starting point alarm of the path is taken as the root alarm of this device). If there is no path in the directed graph, the alarm with the earliest time is selected as the root alarm.

[0066] 3.3 At this time, the graph space obtained in 3.1 is not fully connected, and may be divided into multiple connected subgraphs. It is necessary to perform root cause location analysis on a subgraph basis. For each subgraph, a new directed graph needs to be constructed for analysis. Here, this new directed graph is called a connected subgraph. First, traverse the edges of the connected subgraph (the connected subgraph is a subgraph formed by connecting several network devices that meet the physical connection conditions and the alarm root cause conditions. The subgraph is independent in the complete graph space and has no edge connections with other endpoints. The subgraph also consists of endpoints and edges. An endpoint refers to a network device. Through the calculation in 3.2, there is only one root alarm at each endpoint at this time, and the edge here refers to the relationship formed by the root alarm connection on each endpoint). The alarm type corresponding to the starting and ending network devices of each edge is brought into the alarm causal relationship table (i.e. The result of the alarm causal relationship calculated in step 2 is stored in the form of a table), the alarm types corresponding to the starting point and end point network devices of each edge are merged and associated with the alarm causal relationship table. If the combination of the alarm types corresponding to the starting point and end point network devices can be associated in the alarm causal relationship result, it is determined whether the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship exist. If they exist, the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship are taken, and then the weight values ​​of the positive and reverse directions of the alarm causal relationship with the higher weight value are selected as the actual direction of the edge, and recorded in the constructed new directed graph. If they do not exist, the weight value of the alarm causal relationship is recorded as 0. After the current directed graph is constructed, all paths in the new directed graph are calculated by traversal, and the path with the highest sum of the alarm causal relationship weight values ​​is taken as the root cause link, and the starting device of the root cause link is the root device. At this time, the alarm corresponding to the root device is the root alarm.

[0067] 3.4 By summarizing the root cause links, root alarms and root devices obtained from each connected subgraph, we can obtain all the root cause links existing in the time slice and their corresponding root alarms and root devices.

[0068] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0069] In order to explain the above-mentioned abnormality root cause location method based on device topology and causal relationship more clearly, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0070] After using the above method, we modeled and predicted the alarm information that occurred within 2 hours in a certain topology network, and obtained 10 root cause link diagrams. Here are two representative results. Figure 2 As shown in the figure, there are only two endpoints. The characters above are network device IDs. It can be seen that the two endpoints are connected by a directed arrow, and the starting point of the arrow is the root device where the root alarm occurs. Figure 3 As shown, the figure contains four endpoints. It can also be seen from the arrow relationship in the figure that the middle point is the root device where the root alarm occurs, because the fault alarm of the root device causes abnormal alarms of other three network devices.

[0071] Based on the same inventive concept, the present invention also proposes a device for locating the root cause of anomalies based on device topology and causal relationships. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0072] Figure 4 FIG. 1 is a schematic diagram of the structure of an abnormal root cause location device based on device topology and causal relationship according to an embodiment of the present invention. Figure 4 As shown, the device comprises:

[0073] The device topology information building module 101 is used to save the network device topology relationship through a graph database; the details are as follows:

[0074] Each network device is defined as a vertex of the graph database, and the connection relationship between network devices is defined as the edge of the graph database, so that the connection relationship between network devices is recorded and written into the graph database.

[0075] The alarm causal relationship calculation module 102 is used to collect historical alarm information for processing, generate data to be analyzed, calculate the alarm causal relationship using the LiNGAM algorithm, and then calculate the alarm causal relationship weight using the conditional probability formula;

[0076] Collect historical alarm information for processing and generate data to be analyzed, including:

[0077] Collect historical alarm information. For each piece of historical alarm information, select the historical alarm information within a time slice after the historical alarm information occurs, and then use the connection relationship between network devices to filter out the historical alarm information that occurs on network devices within two hops.

[0078] The filtered historical alarm information is processed in a one-hot manner to generate a piece of data to be analyzed.

[0079] The alarm root cause convergence module 103 is used to analyze the alarm information generated in real time based on the network device topology relationship and the alarm causal relationship and its weight, and obtain the root cause link, root alarm and root device; the details are as follows:

[0080] For each piece of alarm information generated in real time, select the alarm information within a time slice after the occurrence of the alarm information generated in real time;

[0081] All network devices in these alarm messages are obtained through the graph database, and then the connection relationship between network devices is used to filter out network devices within two hops, and the connection relationship between network devices within two hops is recorded through a separate graph space;

[0082] Analyze the network devices in the graph space one by one. If multiple alarms occur on a network device, it is necessary to determine the root alarm that occurs on the network device. First, build a directed graph, and then select the starting point alarm of the longest path calculated according to the causal weight in the directed graph as the root alarm. If there is no path in the directed graph, select the alarm with the earliest time as the root alarm.

[0083] If the graph space is not fully connected, it is necessary to perform root cause location analysis on a connected subgraph unit. For each connected subgraph, first construct a new directed graph, traverse the edges of the new directed graph, and merge and associate the alarm types corresponding to the starting and ending network devices of each edge with the alarm causal relationship results. If the combination of alarm types corresponding to the starting and ending network devices can be associated in the alarm causal relationship results, then determine whether the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship exist. If so, take the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship, and then select the weight value with the higher weight value in the positive and reverse directions of the alarm causal relationship as the actual direction of the edge, and record it in the constructed new directed graph. If it does not exist, the alarm causal relationship weight value is recorded as 0.

[0084] After the current new directed graph is constructed, all paths in it are calculated, and the path with the highest sum of alarm causal relationship weight values ​​is taken as the root cause link. The starting device of the root cause link is the root device, and the alarm occurring on the root device is the root alarm.

[0085] Finally, the root cause link, root alarm, and root device are obtained and summarized.

[0086] It should be noted that although several modules of the abnormal root cause location device based on device topology and causal relationship are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for concretization.

[0087] Based on the above invention concept, Figure 5 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the aforementioned abnormality root cause locating method based on device topology and causal relationship is implemented.

[0088] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned abnormality root cause locating method based on device topology and causal relationship.

[0089] The present invention proposes an abnormality root cause positioning method and device based on device topology and causal relationship, which uses a graph database to query the network device topology relationship and alarm causal relationship, and combines the device topology relationship and alarm causal relationship to perform abnormality root cause positioning and alarm root cause convergence calculation.

[0090] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0091] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for locating the root cause of anomalies based on device topology and causal relationships, characterized in that: The method includes: The topological relationship of network devices is saved through a graph database; Collect historical alarm information for processing, generate data to be analyzed, use the LiNGAM algorithm to calculate the alarm causal relationship, and then use the conditional probability formula to calculate the alarm causal relationship weight; Based on the network device topology, alarm causal relationship and its weight, the real-time alarm information is analyzed to obtain the root cause link, root alarm and root device, including: For each piece of alarm information generated in real time, select the alarm information within a time slice after the occurrence of the alarm information generated in real time; All network devices in these alarm messages are obtained through the graph database, and then the connection relationship between network devices is used to filter out network devices within two hops, and the connection relationship between network devices within two hops is recorded through a separate graph space; Analyze the network devices in the graph space one by one. If multiple alarms occur on a network device, first build a directed graph, and then select the starting alarm of the longest path calculated according to the causal weight in the directed graph as the root alarm; if there is no path in the directed graph, select the alarm with the earliest time as the root alarm; If the graph space is not fully connected, then for each connected subgraph, first construct a new directed graph, traverse the edges of the new directed graph, merge and associate the alarm types corresponding to the starting and ending network devices of each edge with the alarm causal relationship results, if the combination of alarm types corresponding to the starting and ending network devices can be associated in the alarm causal relationship results, then determine whether the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship exist, if so, take the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship, and then select the weight value with the higher weight value in the positive and reverse directions of the alarm causal relationship as the actual direction of the edge, and record it in the constructed new directed graph, if not, the alarm causal relationship weight value is recorded as 0; After the current new directed graph is constructed, all paths therein are calculated, and the path with the highest sum of alarm causal weight values ​​is taken as the root cause link. The starting device of the root cause link is the root device, and the alarm occurring on the root device is the root alarm.

2. The method for locating the root cause of anomalies based on device topology and causal relationships according to claim 1, characterized in that: The network device topology relationship is saved through a graph database, including: Each network device is defined as a vertex of the graph database, and the connection relationship between network devices is defined as the edge of the graph database, so that the connection relationship between network devices is recorded and written into the graph database.

3. The method for locating the root cause of anomalies based on device topology and causal relationships according to claim 1, characterized in that: Collect historical alarm information for processing and generate data to be analyzed, including: Collect historical alarm information. For each piece of historical alarm information, select the historical alarm information within a time slice after the historical alarm information occurs, and then use the connection relationship between network devices to filter out the historical alarm information that occurs on network devices within two hops. The filtered historical alarm information is processed in a one-hot manner to generate a piece of data to be analyzed.

4. A device for locating the root cause of anomalies based on device topology and causal relationships, characterized in that: The device includes: The device topology information building module is used to save the topological relationship of network devices through a graph database; The alarm causal relationship calculation module is used to collect historical alarm information for processing, generate data to be analyzed, calculate the alarm causal relationship using the LiNGAM algorithm, and then calculate the alarm causal relationship weight using the conditional probability formula; The alarm root cause convergence module is used to analyze the real-time alarm information based on the network device topology relationship and the alarm causal relationship and its weight, and obtain the root cause link, root alarm and root device, including: For each piece of alarm information generated in real time, select the alarm information within a time slice after the occurrence of the alarm information generated in real time; All network devices in these alarm messages are obtained through the graph database, and then the connection relationship between network devices is used to filter out network devices within two hops, and the connection relationship between network devices within two hops is recorded through a separate graph space; Analyze the network devices in the graph space one by one. If multiple alarms occur on a network device, first build a directed graph, and then select the starting alarm of the longest path calculated according to the causal weight in the directed graph as the root alarm; if there is no path in the directed graph, select the alarm with the earliest time as the root alarm; If the graph space is not fully connected, then for each connected subgraph, first construct a new directed graph, traverse the edges of the new directed graph, merge and associate the alarm types corresponding to the starting and ending network devices of each edge with the alarm causal relationship results, if the combination of alarm types corresponding to the starting and ending network devices can be associated in the alarm causal relationship results, then determine whether the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship exist, if so, take the weight values ​​of the positive and reverse directions of the corresponding alarm causal relationship, and then select the weight value with the higher weight value in the positive and reverse directions of the alarm causal relationship as the actual direction of the edge, and record it in the constructed new directed graph, if not, the alarm causal relationship weight value is recorded as 0; After the current new directed graph is constructed, all paths therein are calculated, and the path with the highest sum of alarm causal weight values ​​is taken as the root cause link. The starting device of the root cause link is the root device, and the alarm occurring on the root device is the root alarm.

5. The abnormal root cause location device based on device topology and causal relationship according to claim 4, characterized in that: The device topology information building module is specifically used for: Each network device is defined as a vertex of the graph database, and the connection relationship between network devices is defined as the edge of the graph database, so that the connection relationship between network devices is recorded and written into the graph database.

6. The abnormality root cause location device based on device topology and causal relationship according to claim 4, characterized in that: Collect historical alarm information for processing and generate data to be analyzed, including: Collect historical alarm information. For each piece of historical alarm information, select the historical alarm information within a time slice after the historical alarm information occurs, and then use the connection relationship between network devices to filter out the historical alarm information that occurs on network devices within two hops. The filtered historical alarm information is processed in a one-hot manner to generate a piece of data to be analyzed.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 3.

Images