A method, apparatus, device, and medium for locating root cause alarms

Abstract

This invention discloses a method, apparatus, device, and medium for locating root cause alarms, relating to the field of computer technology. It includes: for candidate fault alarms among target faults, determining the target order score and target duration score of the candidate fault alarm within the target fault; extracting the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from a historical model; determining the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight; and determining the target root cause alarm of the target fault based on the target root cause scores of each candidate fault alarm within the target fault. This improves the efficiency of root cause alarm location.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and medium for locating the root cause of a fault. Background Technology

[0002] With the development of big data technology, the amount of data that service entities need to process is constantly increasing, and the ever-growing amount of data affects the efficiency of locating the root cause of fault alarms.

[0003] Existing methods for locating the root cause of a fault mainly rely on the expertise of technical personnel and the established professional knowledge base to locate the root cause alarm. However, these methods suffer from drawbacks such as long location time and low efficiency in locating the root cause alarm. Summary of the Invention

[0004] This invention provides a method, apparatus, device, and medium for locating root cause alarms, thereby improving the efficiency of root cause alarm location.

[0005] According to one aspect of the present invention, a method for locating root cause alarms is provided, the method comprising:

[0006] For each candidate fault alarm in the target fault, determine the target order score and target duration score of the candidate fault alarm in the target fault;

[0007] Extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model; wherein, the historical model is determined based on historical fault alarms in historical faults and labeled root cause alarms of historical faults.

[0008] The target root cause score of the candidate fault alarm is determined based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight.

[0009] Based on the target root cause scores of each candidate fault alarm in the target fault, the target root cause alarm of the target fault is determined.

[0010] According to another aspect of the present invention, a root cause alarm positioning device is provided, comprising:

[0011] The order score determination module is used to determine the target order score and target duration score of each candidate fault alarm in the target fault for each candidate fault alarm in the target fault.

[0012] The correlation index determination module is used to extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model; wherein, the historical model is determined based on historical fault alarms in historical faults and labeled root cause alarms of historical faults.

[0013] The root cause score determination module is used to determine the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight.

[0014] The root cause alarm determination module is used to determine the root cause alarm of the target fault based on the root cause score of each candidate fault alarm in the target fault.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the root cause alarm location method according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the root cause alarm location method according to any embodiment of the present invention.

[0020] The technical solution of this invention involves determining the target order score and target duration score of each candidate fault alarm in the target fault; extracting the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from a historical model; wherein the historical model is determined based on historical fault alarms in historical faults and labeled root cause alarms of historical faults; determining the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight; and determining the target root cause alarm of the target fault based on the target root cause scores of each candidate fault alarm in the target fault. By adopting the above technical solution, the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight are obtained from the historical model, reducing labor costs. Based on the target order score, target order weight, target duration weight, target correlation index, target correlation weight, duration change score, and target duration change weight, the target root cause score of each candidate fault alarm is determined, thereby determining the root cause alarm of the target fault alarm, improving the efficiency and reliability of root cause alarm location.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a root cause alarm location method provided in Embodiment 1 of the present invention;

[0024] Figure 2 This is a flowchart of a root cause alarm location method provided in Embodiment 2 of the present invention;

[0025] Figure 3 This is a flowchart of a root cause alarm location method provided in Embodiment 3 of the present invention;

[0026] Figure 4 This is a flowchart of a root cause alarm location method provided in Embodiment 4 of the present invention;

[0027] Figure 5 This is a schematic diagram of a root cause alarm positioning device provided according to Embodiment 5 of the present invention;

[0028] Figure 6 This is a schematic diagram of the structure of an electronic device that implements a root cause alarm location method according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] Example 1

[0032] Figure 1 The flowchart below shows a root cause alarm location method provided in Embodiment 1 of the present invention. This embodiment is applicable to the location of root cause alarms of faults. The method can be executed by a root cause alarm location device, which can be implemented in hardware and / or software and can be configured in electronic devices, such as servers.

[0033] like Figure 1 As shown, the method includes:

[0034] S101. For each candidate fault alarm in the target fault, determine the target order score and target duration score of the candidate fault alarm in the target fault.

[0035] In this embodiment, the target fault can be the fault currently being located by root cause alarm, such as processor fault, memory fault, and disk fault; the candidate fault alarm can be at least two fault alarms among the target faults; the target order score can be used to characterize the occurrence order of the corresponding candidate fault alarms in the target fault; and the target duration score can be used to characterize the duration of the corresponding candidate fault alarms in the target fault.

[0036] In one specific embodiment, candidate fault alarms can be converged to the target fault based on a knowledge graph of software and hardware topology relationships, thereby preventing fault alarms that do not belong to the target fault from being identified as root cause alarms.

[0037] S102. Extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model.

[0038] The historical model is determined based on historical fault alarms and labeled root cause alarms of historical faults; the target correlation index can be used to characterize the degree of correlation between the corresponding fault alarm and historical faults; the duration change score can characterize the change in the duration of candidate fault alarms in historical faults; historical faults can be faults that have undergone historical fault alarm convergence; historical fault alarms are fault alarms that have occurred, including but not limited to candidate fault alarms that have occurred; labeled root cause alarms can be manually labeled root cause alarms; root cause alarms can be fault alarms that are the root cause of the fault to which they belong.

[0039] In this embodiment, the target order weight can be the weight of the order score, used to characterize the importance of the order score; the target duration weight can be the weight of the duration score, used to characterize the importance of the duration score; the target correlation weight can be the weight of the correlation index, used to characterize the importance of the correlation index; and the target duration change weight can be the weight of the duration change score, used to characterize the importance of the duration change score.

[0040] Specifically, the historical model includes the target correlation index and duration change score of each historical fault alarm; the target correlation index of the candidate fault alarm is selected from the target correlation indices of each historical fault alarm in the historical model; and the duration change score of the candidate fault alarm is selected from the duration change scores of each historical fault alarm in the historical model.

[0041] Optionally, the duration change score is determined as follows: for each historical fault alarm in the historical fault, the duration change score of the historical fault is determined based on the historical duration of the historical fault alarm in the historical fault.

[0042] The duration of the historical fault can be the duration of the corresponding historical fault alarm within the historical fault.

[0043] Specifically, based on the historical duration of the historical fault alarm within each historical fault, the variance of each historical duration is determined. This variance is then normalized using a normalization function, and the normalized result is used as the duration variation score for the historical fault alarm. This invention does not limit the normalization function; for example, it can be a sigmoid function (activation function) or a softmax function (normalization exponential function), etc.

[0044] Understandably, by adopting the above technical solution, the duration change score is determined based on the duration of each historical event. Through the normalization function, the duration change scores of each candidate fault alarm can be unified within the range of [0,1], thereby improving the accuracy of the target root cause score determined based on the duration change score.

[0045] S103. Determine the root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight.

[0046] In this embodiment, the target root cause score is used to characterize the degree to which the corresponding candidate fault alarm is the root cause alarm of the target fault.

[0047] Specifically, the order score of the candidate fault alarm is multiplied by the target order weight to obtain a weighted order score; the duration score of the candidate fault alarm is multiplied by the target duration weight to obtain a weighted order score; the correlation index of the candidate fault alarm is multiplied by the target correlation weight to obtain a weighted order score; the duration change score of the candidate fault alarm is multiplied by the target duration change weight to obtain a weighted order score; the weighted order scores, weighted order scores, weighted order scores, and weighted order scores are accumulated, and the accumulated result is used as the root cause score for determining the candidate fault alarm.

[0048] S104. Based on the target root cause scores of each candidate fault alarm in the target fault, determine the target root cause alarm of the target fault.

[0049] In this embodiment, the target root cause alarm can be a candidate fault alarm that is the root cause of the target fault.

[0050] Specifically, the root cause scores of each candidate fault alarm in the target fault are compared, and the candidate fault alarm corresponding to the maximum root cause score is taken as the target root cause alarm of the target fault.

[0051] This invention, in its embodiments, determines the target order score and target duration score of each candidate fault alarm in the target fault; extracts the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from a historical model; wherein the historical model is determined based on historical fault alarms in historical faults and labeled root cause alarms of historical faults; the target root cause score of the candidate fault alarm is determined based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight of the candidate fault alarm; and the target root cause alarm of the target fault is determined based on the target root cause scores of each candidate fault alarm in the target fault. By adopting the above technical solution, the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight are obtained from the historical model, reducing labor costs. Based on the target order score, target order weight, target duration weight, target correlation index, target correlation weight, duration change score, and target duration change weight, the target root cause score of each candidate fault alarm is determined, thereby determining the root cause alarm of the target fault alarm, improving the efficiency and reliability of root cause alarm location.

[0052] Example 2

[0053] Figure 2 This is a flowchart of a root cause alarm location method provided in Embodiment 2 of the present invention. Based on the above embodiments, this embodiment optimizes and improves the determination operations of order score and duration score.

[0054] Furthermore, the process of "determining the target order score and target duration score of each candidate fault alarm in the target fault" is further refined into "determining the target occurrence order and target duration of each candidate fault alarm in the target fault; determining the target order score of each candidate fault alarm in the target fault based on the target occurrence order; and determining the target duration score of each candidate fault alarm in the target fault based on the target duration", in order to improve the determination of the target order score and target duration score.

[0055] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0056] like Figure 2 As shown, the method includes:

[0057] S201. For each candidate fault alarm in the target fault, determine the target occurrence order of the candidate fault alarm in the target fault and the target duration of the candidate fault alarm in the target fault.

[0058] In this embodiment, the target occurrence order can be the order in which the corresponding candidate fault alarms occur in the target fault; the target duration can be the duration of the corresponding candidate fault alarm in the target fault.

[0059] S202. Based on the order of occurrence of the candidate fault in the target fault, determine the target order score of the candidate fault alarm in the target fault, and based on the target duration of the candidate fault in the target fault, determine the target duration score of the candidate fault alarm in the target fault.

[0060] Specifically, based on the order of occurrence of the candidate fault within the target fault, a ranking function is used to determine the target order score of the candidate fault alarm within the target fault; based on the target duration of the candidate fault within the target fault, a normalization function is used to determine the target duration score of the candidate fault alarm within the target fault. It should be noted that this invention does not limit the ranking function and the normalization function; for example, the ranking function can be a rank function or a sort function, and the normalization function can be a sigmoid function or a softmax function, etc.

[0061] For example, the target fault includes four candidate fault alarms. The four candidate fault alarms are sorted in descending order of their occurrence using the rank function. That is, the first candidate fault alarm has a ranking score of 4, the second candidate fault alarm has a ranking score of 3, the third candidate fault alarm has a ranking score of 2, and the fourth candidate fault alarm has a ranking score of 1.

[0062] S203. Extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model.

[0063] The historical model is determined based on historical fault alarms and labeled root cause alarms of historical faults.

[0064] S204. Based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight of the candidate fault alarm, determine the target root cause score of the candidate fault alarm.

[0065] S205. Based on the target root cause scores of each candidate fault alarm in the target fault, determine the target root cause alarm of the target fault.

[0066] This invention, in its embodiments, determines the target occurrence order and target duration of each candidate fault alarm within the target fault. Based on the target occurrence order, it determines the target order score of the candidate fault alarm within the target fault, and based on the target duration, it determines the target duration score. By employing this technical solution, the corresponding target order score and target duration score can be determined based on the target occurrence order and target duration score of the candidate fault within the target fault, thus improving the accuracy of the target order score and target duration score, improving the accuracy of the target root cause score, and consequently improving the accuracy of locating the target root cause alarm.

[0067] Example 3

[0068] Figure 3 This is a flowchart of a root cause alarm location method provided in Embodiment 3 of the present invention. This embodiment is an optimization and improvement based on the above embodiments.

[0069] Furthermore, before "for each candidate fault alarm in the target fault, determine the target order score and target duration score of the candidate fault alarm in the target fault", add the following step: "Based on the support, first confidence level and second confidence level between each historical fault alarm and other historical fault alarms, perform cross-validation to obtain the optimal support threshold. For each historical fault alarm in the historical fault, if the support between the historical fault alarm and other historical fault alarms is equal to or greater than the optimal support threshold, then the difference between the first confidence level and the second confidence level is used as the target correlation coefficient between the historical fault alarm and other historical fault alarms; based on the target correlation coefficient between the historical fault alarm and other historical fault alarms, determine the target correlation index of the historical fault alarm", to improve the operation of determining the target correlation coefficient.

[0070] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0071] like Figure 3 As shown, the method includes:

[0072] S301. Based on the first support, first confidence and second confidence of each historical fault alarm in the historical faults and other historical fault alarms, cross-validation is performed to obtain the optimal support threshold.

[0073] The first support is the probability that each historical fault alarm occurs simultaneously with other historical alarms; the first confidence is the probability that other historical fault alarms occur given the existence of each historical fault alarm; and the second confidence is the probability that each historical fault alarm occurs given the existence of other historical fault alarms.

[0074] The optimal support threshold can be the support threshold that makes the correlation index of the labeled root cause alarms in the historical faults the largest correlation index. During the cross-validation process, if any candidate support threshold makes the historical fault alarm with the largest correlation index in each historical fault the same as the labeled root cause alarm of the historical fault, then the candidate support threshold can be determined to meet the cross-validation condition, and the candidate support threshold can be taken as the optimal support threshold.

[0075] Specifically, a preset number of candidate support thresholds are obtained, with each candidate support threshold being different. During cross-validation, historical faults are divided into two parts according to a fixed ratio: one part serves as the sample set for this cross-validation process, and the other part serves as the validation set for this cross-validation process. The division method is different for each cross-validation process.

[0076] For each cross-validation process: In the sample set, if the first support between each historical fault alarm and other historical fault alarms is greater than or equal to the candidate support threshold, then the difference between the first confidence level and the second confidence level is used as the correlation coefficient between the historical fault alarm and other historical fault alarms; if the support between the historical fault alarm and other historical fault alarms is less than the candidate support threshold, then the difference between the second confidence level and the first confidence level is used as the correlation coefficient between the historical fault alarm and other historical fault alarms; the correlation coefficients between the historical fault alarm and other historical fault alarms are summed to obtain the correlation index of the historical fault alarm; the historical fault alarm with the largest correlation index is selected. The fault alarm serves as the reference root cause alarm for historical faults. The consistency between the reference root cause alarm and the labeled root cause alarm is verified. If all historical faults are consistent, the candidate support threshold is deemed valid. Each valid candidate support threshold is used as the sample set support threshold. Based on the sample set support threshold, the sample set support threshold that makes the historical fault alarm with the largest correlation index among all historical faults the same as the labeled root cause alarm is determined in the validation set. This validation set support threshold is then used as the process support threshold for this cross-validation process. The method for determining the validation set support threshold is similar to that for determining the sample set support threshold, and will not be elaborated here. The average of the process support thresholds across all cross-validation processes is taken as the optimal support threshold.

[0077] S302. For each historical fault alarm in the historical faults, if the support between the historical fault alarm and other historical fault alarms is equal to or greater than the optimal support threshold, then the difference between the first confidence level and the second confidence level shall be used as the target correlation coefficient between the historical fault alarm and other historical fault alarms.

[0078] The target correlation coefficient can characterize the degree of correlation between the historical fault alarm and other historical fault alarms.

[0079] For example, the target correlation coefficient can be determined using the following formula:

[0080]

[0081] Where A represents the historical fault alarm A; B represents other historical fault alarms B; F(A,B) represents the target correlation coefficient between the historical fault alarm A and other historical fault alarms B; C(A,B) represents the first confidence level between historical fault alarm A and other historical fault alarms B; C(B,A) represents the second confidence level between historical fault alarm A and other historical fault alarms B; S(A,B) represents the support level between historical fault alarm A and other historical fault alarms B; S t This represents the optimal support threshold.

[0082] S303. Determine the target correlation index of the historical fault alarm based on the target correlation coefficient between the historical fault alarm and other historical fault alarms.

[0083] Specifically, the correlation coefficients between this historical fault alarm and all other historical fault alarms are added together, and the sum is used as the target correlation index for this historical fault alarm.

[0084] It should be noted that S301, S302 and S303 are executed only once. They are used to predetermine the optimal support threshold and determine the correlation index of historical fault alarms based on the optimal support threshold. This allows for the direct extraction of the target correlation index of candidate fault alarms in the target fault from the historical model, thereby improving the efficiency of locating the root cause alarm of the target fault.

[0085] S304. For each candidate fault alarm in the target fault, determine the target order score and target duration score of the candidate fault alarm in the target fault.

[0086] S305. Extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model.

[0087] The historical model is determined based on historical fault alarms and labeled root cause alarms of historical faults.

[0088] S306. Determine the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight.

[0089] S307. Based on the target root cause scores of each candidate fault alarm in the target fault, determine the target root cause alarm of the target fault.

[0090] This invention employs cross-validation to obtain an optimal support threshold based on the first support, first confidence, and second confidence of each historical fault alarm in the historical fault data compared to other historical fault alarms. If the support of a historical fault alarm is equal to or greater than the optimal support threshold, the difference between the first and second confidence levels is used as the target correlation coefficient between the historical fault alarm and other historical fault alarms. Based on the correlation coefficient, a target correlation index for the historical fault alarm is determined. Target correlation indices for candidate fault alarms are selected from the target correlation indices of historical fault alarms in the historical model. By adopting the above technical solution, determining the optimal support threshold, and determining the target correlation index for each historical fault alarm based on the optimal support threshold, and selecting the target correlation index for candidate fault alarms from the target correlation indices of historical fault alarms in the historical model, the accuracy of the target correlation index is improved, thereby improving the accuracy of the target root cause score.

[0091] Example 4

[0092] Figure 4 This is a flowchart of a root cause alarm location method provided in Embodiment 4 of the present invention. This embodiment is an optimization and improvement based on the above embodiments.

[0093] Furthermore, before "for each candidate fault alarm in the target fault, determine the order score and duration score of the candidate fault alarm in the target fault", add the following steps: "obtain candidate weight value combinations; use candidate weight value combinations to determine the reference root cause score of each historical fault alarm in the historical fault; verify the candidate weight value combinations based on the labeled root cause alarms of the historical faults and the reference root cause scores of the historical fault alarms; obtain the target weight value combinations based on the verification results of the candidate weight value combinations, which serve as the target order weight, target duration weight, target association weight, and target duration change weight", to improve the determination operations of target order weight, target duration weight, target association weight, and target duration change weight.

[0094] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.

[0095] like Figure 4 As shown, the method includes:

[0096] S401, Obtain candidate weight value combinations.

[0097] Each candidate weight value combination includes candidate values ​​for target order weight, target duration weight, target association weight, and duration change weight; at least one weight in different candidate weight value combinations has a different candidate value.

[0098] S402. Using candidate weight value combinations, determine the reference root cause score for each historical fault alarm in the historical fault.

[0099] In this embodiment, the reference root cause score can be the root cause score obtained by combining candidate weight values.

[0100] Specifically, for each historical fault alarm in the historical fault list, the historical order score of the alarm is determined based on its occurrence order within the historical fault; the historical duration score is determined based on the duration of the alarm within the historical fault; the historical order score is multiplied by a candidate value of the target order weight to obtain the first multiplication result; the historical duration score is multiplied by a candidate value of the target duration weight to obtain the second multiplication result; the correlation index of the alarm is multiplied by a candidate value of the target correlation weight to obtain the third multiplication result; the duration change score is multiplied by a candidate value of the target duration change weight to obtain the fourth multiplication result; the first, second, third, and fourth multiplication results are added together to obtain the reference root cause score of the historical fault alarm. By using the above method to determine the reference root cause score of a historical fault alarm, the reference root cause scores of each historical fault alarm in the historical fault list are determined.

[0101] S403. Verify the candidate weight value combinations based on the labeled root cause alarms of historical faults and the reference root cause scores of historical fault alarms.

[0102] Optionally, the candidate weight value combination is validated based on the labeled root cause alarms of historical faults and the reference root cause scores of candidate fault alarms. This includes: selecting reference root cause alarms of historical faults from the historical fault alarms of historical faults based on the labeled root cause alarms of historical faults and the reference root cause scores of historical fault alarms; comparing whether the reference root cause alarms of historical faults and the labeled root cause alarms of historical faults are consistent. If all historical faults are consistent, the candidate weight value combination is determined to have passed the validation.

[0103] Among them, the reference root cause alarm can be the historical fault alarm with the highest reference root cause score among all historical faults.

[0104] Specifically, for each historical fault, the reference root cause scores of each historical fault alarm in that historical fault are compared, and the historical fault alarm corresponding to the maximum reference root cause score is taken as the reference root cause alarm of that historical fault. If the reference root cause alarms of each historical fault alarm are consistent with the labeled root cause alarms, the candidate weight value combination verification passes; otherwise, the verification fails.

[0105] In one optional embodiment, candidate weight value combinations can be validated by cross-validation based on the labeled root cause alarms of historical faults and the reference root cause scores of historical fault alarms.

[0106] Specifically, during the cross-validation process, historical faults are divided into two parts according to a fixed ratio. One part serves as the sample set for this cross-validation process, and the other part serves as the validation set for this cross-validation process. The division method is different for each cross-validation process.

[0107] For each cross-validation process: In the sample set, the candidate weight value combination is obtained by verifying the candidate weight value combination as described above. That is, in the sample set, the reference root cause alarm of the historical fault is selected from the historical fault alarms based on the labeled root cause alarms and the reference root cause alarms of the historical faults. The reference root cause alarms and the labeled root cause alarms of the historical faults are compared to see if they are consistent. If all historical faults are consistent, the candidate weight value combination is determined to have passed the verification in the sample set. In the validation set, candidate weight combinations that have passed validation in the sample set are used to determine the reference root cause score for each historical fault alarm. The reference root cause score is the root cause score obtained based on the candidate weight combinations that have passed validation in the sample set. The candidate weight combinations that have passed validation in the sample set are validated based on the reference root cause score. The method for validating the candidate weight combinations that have passed validation in the sample set is similar to the method for validating the candidate weight combinations in the sample set described above, and will not be repeated here. The validation results of candidate weight combinations that have passed validation in both the sample set and the validation set are considered valid.

[0108] It is understandable that by adopting the above technical solution and verifying the candidate weight value combination based on the labeled root cause alarm and the reference root cause alarm, the accuracy of the target weight value combination can be improved, thereby improving the accuracy of locating the target root cause alarm.

[0109] S404. Based on the verification results of the candidate weight value combinations, obtain the target weight value combinations, which serve as the target order weight, target duration weight, target association weight, and target duration change weight.

[0110] In this embodiment, the target weight value combination can be a candidate weight value combination in which all verification results pass the verification.

[0111] Specifically, the candidate weight value combinations that pass the verification are used as the target weight value combinations. If there is only one target weight value combination, then the candidate value of the target order weight in that target weight value combination is used as the target order weight, the candidate value of the target duration weight in that target weight value combination is used as the target duration weight, the candidate value of the target association weight in that target weight value combination is used as the target association weight, and the candidate value of the target duration change weight in that target weight value combination is used as the target duration change weight. If there are multiple target weight value combinations, then the average of the candidate values ​​of the target order weight in all target weight value combinations is used as the target order weight; the average of the candidate values ​​of the target duration weight in all target weight value combinations is used as the target duration weight; the average of the candidate values ​​of the target association weight in all target weight value combinations is used as the target association weight; and the average of the candidate values ​​of the target duration change weight in all target weight value combinations is used as the target duration change weight.

[0112] It should be noted that S401, S402, S403 and S404 are each executed only once. They are used to pre-determine the target weight combination based on the candidate weight combination, which serves as the target order weight, target duration weight, target association weight and target duration change weight. This allows for the direct extraction of the target order weight, target duration weight, target association weight and target duration change weight from the historical model, thereby improving the efficiency of locating the root cause alarm of the target fault.

[0113] S405. For each candidate fault alarm in the target fault, determine the order score of the candidate fault alarm in the target fault and the duration score of the candidate fault alarm in the target fault.

[0114] S406. Extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model.

[0115] The historical model is determined based on historical fault alarms and labeled root cause alarms of historical faults.

[0116] S407. Determine the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight.

[0117] S408. Based on the target root cause scores of each candidate fault alarm in the target fault, determine the target root cause alarm of the target fault.

[0118] This invention provides an embodiment of obtaining candidate weight value combinations; using these combinations, determining the reference root cause score for each historical fault alarm in the historical fault data; selecting reference root cause alarms from the historical fault alarms based on the labeled root cause alarms and the reference root cause scores; comparing the consistency between the reference root cause alarms and the labeled root cause alarms, and confirming that the candidate weight value combination passes verification if all historical faults are consistent; and obtaining the target weight value combination based on the verification results, which serves as the target order weight, target duration weight, target association weight, and target duration change weight. By obtaining and verifying candidate weight value combinations, the target weight value combination can be determined, improving the accuracy of the target order weight, target duration weight, target association weight, and target duration change weight, thereby increasing the accuracy of locating the target root cause alarm.

[0119] Example 5

[0120] Figure 5 This is a schematic diagram of a root cause alarm location method provided in Embodiment 5 of the present invention. This embodiment is applicable to the location of root cause alarms for faults. The root cause alarm location device can be implemented in hardware and / or software and can be configured in electronic devices, such as servers.

[0121] like Figure 5 As shown, the device includes: an order score determination module 501, an association index determination module 502, a root cause score determination module 503, and a root cause alarm determination module 504. Among them,

[0122] The order score determination module 501 is used to determine the target order score and target duration score of each candidate fault alarm in the target fault for each candidate fault alarm in the target fault.

[0123] The correlation index determination module 502 is used to extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model; wherein, the historical model is determined based on the historical fault alarms in the historical faults and the labeled root cause alarms of the historical faults.

[0124] The root cause score determination module 503 is used to determine the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight.

[0125] The root cause alarm determination module 504 is used to determine the root cause alarm of the target fault based on the root cause score of each candidate fault alarm in the target fault.

[0126] In this embodiment of the invention, the order score determination module determines the target order score and target duration score of each candidate fault alarm in the target fault. It then extracts the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model. The historical model is determined based on historical fault alarms and labeled root cause alarms from historical faults. The target root cause score of the candidate fault alarm is determined based on its target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight. Finally, the target root cause alarm of the target fault is determined based on the target root cause scores of each candidate fault alarm in the target fault. By adopting the above technical solution, the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight are obtained from the historical model, reducing labor costs. Based on the target order score, target order weight, target duration weight, target correlation index, target correlation weight, duration change score, and target duration change weight, the target root cause score of each candidate fault alarm is determined, thereby determining the root cause alarm of the target fault alarm, improving the efficiency and reliability of root cause alarm location.

[0127] Optionally, the order score determination module 501 includes:

[0128] The occurrence sequence determination unit is used to determine the occurrence sequence of each candidate fault alarm in the target fault and the duration of the candidate fault alarm in the target fault for each candidate fault alarm in the target fault.

[0129] The order score determination unit is used to determine the target order score of the candidate fault alarm in the target fault based on the target occurrence order of the candidate fault in the target fault, and to determine the target duration score of the candidate fault alarm in the target fault based on the target duration of the candidate fault in the target fault.

[0130] Optionally, the correlation index determination module 502 includes:

[0131] The support threshold determination unit is used to perform cross-validation to obtain the optimal support threshold based on the support, first confidence, and second confidence between each historical fault alarm and other historical fault alarms in the historical faults; wherein, the first support is the probability that each historical fault alarm and other historical alarms occur simultaneously; the first confidence is the probability that other historical fault alarms occur when each historical fault alarm exists; and the second confidence is the probability that each historical fault alarm occurs when other historical fault alarms exist.

[0132] The correlation coefficient determination unit is used to determine the target correlation coefficient between the historical fault alarm and other historical fault alarms for each historical fault alarm in the historical faults. If the support between the historical fault alarm and other historical fault alarms is equal to or greater than the optimal support threshold, the difference between the first confidence level and the second confidence level is used as the target correlation coefficient between the historical fault alarm and other historical fault alarms.

[0133] The correlation index determination unit is used to determine the target correlation index of the historical fault alarm based on the target correlation coefficient between the historical fault alarm and other historical fault alarms.

[0134] Optionally, the correlation index determination module 502 includes:

[0135] The candidate combination determination unit is used to obtain candidate weight value combinations; wherein, each candidate weight value combination includes candidate values ​​for candidate order weight, candidate values ​​for candidate duration weight, candidate values ​​for candidate association weight, and candidate values ​​for candidate duration change weight;

[0136] The reference score determination unit is used to determine the reference root cause score of each historical fault alarm by using the combination of candidate weight values.

[0137] The candidate combination verification unit is used to verify the candidate weight value combination based on the labeled root cause alarms of historical faults and the reference root cause scores of historical fault alarms.

[0138] The target combination determination unit is used to obtain the target weight value combination based on the test results of the candidate weight value combination, which serves as the target order weight, target duration weight, target association weight, and target duration change weight; wherein, the target weight value combination is the combination of all candidate weight values ​​that have passed the test results.

[0139] Optionally, the candidate combination verification unit includes:

[0140] The reference root cause alarm determination subunit is used to select the reference root cause alarm of the historical fault from the historical fault alarms based on the labeled root cause alarms of the historical fault and the reference root cause score of the historical fault alarms.

[0141] The candidate combination verification subunit is used to verify whether the reference root cause alarm of the historical fault and the labeled root cause alarm of the historical fault are consistent. If all historical faults are consistent, the candidate weight value combination verification is determined to be successful.

[0142] Optionally, the correlation index determination module 502 includes:

[0143] The duration change score determination unit is used to determine the duration change score of each historical fault alarm in the historical fault based on the historical duration of the historical fault alarm.

[0144] The root cause alarm location device provided in this embodiment of the invention can execute the root cause alarm location method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing each root cause alarm location method.

[0145] Example 6

[0146] Figure 6 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0147] like Figure 6As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0148] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0149] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as the root cause alarm localization method.

[0150] In some embodiments, the root cause alarm localization method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the root cause alarm localization method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the root cause alarm localization method by any other suitable means (e.g., by means of firmware).

[0151] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0152] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0153] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0154] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0155] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0156] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0157] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0158] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for locating root cause alarms, characterized in that, include: For each candidate fault alarm in the target fault, determine the target order score and target duration score of the candidate fault alarm in the target fault; Extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model; wherein, the historical model is determined based on historical fault alarms in historical faults and the labeled root cause alarms of the historical faults. The target root cause score of the candidate fault alarm is determined based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight. The target root cause alarm of the target fault is determined based on the target root cause score of each candidate fault alarm in the target fault. The target correlation index is determined in the following way: The optimal support threshold is obtained by cross-validation based on the support, first confidence level, and second confidence level between each historical fault alarm and other historical fault alarms in the historical fault data. Here, the support level is the probability that each historical fault alarm occurs simultaneously with other historical alarms; the first confidence level is the probability that other historical fault alarms occur given the existence of each historical fault alarm; and the second confidence level is the probability that each historical fault alarm occurs given the existence of the other historical fault alarms. For each historical fault alarm in the historical faults, if the support between the historical fault alarm and other historical fault alarms is equal to or greater than the optimal support threshold, then the difference between the first confidence and the second confidence is used as the target correlation coefficient between the historical fault alarm and other historical fault alarms. Based on the target correlation coefficient between this historical fault alarm and other historical fault alarms, determine the target correlation index of this historical fault alarm; The target order weight, target duration score weight, target association weight, and target duration change weight are determined as follows: Obtain candidate weight value combinations; wherein each candidate weight value combination includes candidate values ​​for candidate order weight, candidate values ​​for candidate duration weight, candidate values ​​for candidate association weight, and candidate values ​​for candidate duration change weight; The reference root cause score for each historical fault alarm is determined by using the candidate weight value combination. The candidate weight value combination is verified based on the labeled root cause alarms of historical faults and the reference root cause scores of each historical fault alarm. Based on the verification results of the candidate weight value combinations, the target weight value combinations are obtained, which serve as the target order weight, target duration weight, target association weight, and target duration change weight; wherein, the target weight value combinations are all candidate weight value combinations whose verification results have all passed.

2. The method according to claim 1, characterized in that, For each candidate fault alarm in the target fault, the target order score and target duration score of the candidate fault alarm in the target fault are determined, including: For each candidate fault alarm in the target fault, determine the target occurrence order of the candidate fault alarm in the target fault and the target duration of the candidate fault alarm in the target fault; Based on the order of occurrence of the candidate fault in the target fault, the target order score of the candidate fault alarm in the target fault is determined, and based on the target duration of the candidate fault in the target fault, the target duration score of the candidate fault alarm in the target fault is determined.

3. The method of claim 1, wherein, The step of validating the candidate weight value combination based on the labeled root cause alarms of historical faults and the reference root cause scores of each historical fault alarm includes: Based on the labeled root cause alarms of historical faults and the reference root cause scores of each historical fault alarm, select the reference root cause alarms of historical faults from the historical fault alarms of historical faults. Compare whether the reference root cause alarm of the historical fault and the labeled root cause alarm of the historical fault are consistent. If all historical faults are consistent, then the candidate weight value combination is determined to have passed the verification.

4. The method of claim 1, wherein, The duration change score is determined in the following way: For each historical fault alarm in the historical faults, a duration change score is determined based on the historical duration of the historical fault alarm in the historical fault.

5. A root cause alarm positioning device, characterized in that, include: The order score determination module is used to determine the target order score and target duration score of each candidate fault alarm in the target fault for each candidate fault alarm in the target fault. The correlation index determination module is used to extract the target correlation index, duration change score, target order weight, target duration weight, target correlation weight, and target duration change weight of the candidate fault alarm from the historical model; wherein, the historical model is determined based on historical fault alarms in historical faults and the labeled root cause alarms of the historical faults. The root cause score determination module is used to determine the target root cause score of the candidate fault alarm based on the target order score, target duration score, target correlation index, duration change score, target order weight, target duration weight, target correlation index weight, and target duration change weight of the candidate fault alarm. The root cause alarm determination module is used to determine the target root cause alarm of the target fault based on the target root cause score of each candidate fault alarm in the target fault. The correlation index determination module includes: The support threshold determination unit is used to perform cross-validation to obtain the optimal support threshold based on the support, first confidence, and second confidence between each historical fault alarm and other historical fault alarms in the historical faults; wherein, the support is the probability that each historical fault alarm and other historical alarms occur simultaneously; the first confidence is the probability that other historical fault alarms occur when each historical fault alarm exists; and the second confidence is the probability that each historical fault alarm occurs when the other historical fault alarms exist. The correlation coefficient determination unit is used to determine the target correlation coefficient between the historical fault alarm and other historical fault alarms for each historical fault alarm in the historical faults. If the support between the historical fault alarm and other historical fault alarms is equal to or greater than the optimal support threshold, the difference between the first confidence level and the second confidence level is used as the target correlation coefficient between the historical fault alarm and other historical fault alarms. The correlation index determination unit is used to determine the target correlation index of the historical fault alarm based on the target correlation coefficient between the historical fault alarm and other historical fault alarms. The correlation index determination module includes: A candidate combination determination unit is used to obtain candidate weight value combinations; wherein, each candidate weight value combination includes candidate values ​​for candidate order weight, candidate values ​​for candidate duration weight, candidate values ​​for candidate association weight, and candidate values ​​for candidate duration change weight; The reference score determination unit is used to determine the reference root cause score of each historical fault alarm in the historical fault by using the combination of the candidate weight values. The candidate combination verification unit is used to verify the candidate weight value combination based on the labeled root cause alarms of historical faults and the reference root cause scores of each historical fault alarm. The target combination determination unit is used to obtain the target weight value combination based on the verification result of the candidate weight value combination, and use it as the target order weight, target duration weight, target association weight and target duration change weight; wherein, the target weight value combination is the candidate weight value combination whose verification result is all passed.

6. The apparatus of claim 5, wherein, The order score determination module includes: The occurrence sequence determination unit is used to determine the target occurrence sequence of each candidate fault alarm in the target fault and the target duration of each candidate fault alarm in the target fault for each candidate fault alarm in the target fault. The order score determination unit is used to determine the target order score of the candidate fault alarm in the target fault according to the target occurrence order of the candidate fault in the target fault, and to determine the target duration score of the candidate fault alarm in the target fault according to the target duration of the candidate fault in the target fault.

7. An electronic device, comprising: The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the root cause alarm location method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the root cause alarm location method according to any one of claims 1-5.

Images