Root cause determination method and apparatus, electronic device, and computer-readable storage medium

Abstract

The disclosure provides a root cause determination method and device, electronic equipment and computer readable storage medium, and relates to the technical field of intelligent operation and maintenance. The method comprises: obtaining an abnormal index to be processed; obtaining a corresponding relationship between the abnormal index and the root cause, the corresponding relationship being obtained based on a root cause propagation graph and a corresponding state transition probability matrix, each node in the root cause propagation graph corresponding to an index; and determining at least one root cause of the abnormal index to be processed according to the corresponding relationship. The way of obtaining the corresponding relationship between the abnormal index and the root cause through the root cause propagation graph and the state transition probability matrix considers the coupling relationship between multiple dimensions causing the abnormal index and the fact that upstream index abnormalities will inevitably lead to downstream index abnormalities, so that the obtained corresponding relationship between the abnormal index and the root cause is more accurate, and the accuracy of the root cause determined according to the corresponding relationship is high.

Description

Technical Field

[0001] This disclosure relates to the field of intelligent operation and maintenance technology, and in particular to a root cause determination method, apparatus, electronic device and computer-readable storage medium. Background Technology

[0002] In the field of intelligent operation and maintenance technology, as the systems being maintained become more complex, it becomes increasingly difficult to determine the root cause of abnormal indicators (poor quality).

[0003] In related technologies, manual investigation is relied upon to determine the root cause of abnormal indicators. After identifying the abnormal indicators, maintenance personnel then analyze the root cause based on relevant professional knowledge and system operation data.

[0004] However, relying on manual investigation to determine the root cause of abnormal indicators has a low accuracy rate.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] This disclosure provides a root cause determination method, apparatus, electronic device, and computer-readable storage medium, which at least to some extent overcomes the problem of low accuracy in determining root causes in related technologies.

[0007] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0008] According to one aspect of this disclosure, a root cause determination method is provided, comprising: acquiring an abnormal indicator to be processed; acquiring a correspondence between the abnormal indicator and a root cause, the correspondence being obtained based on a root cause propagation graph and a corresponding state transition probability matrix, wherein each node in the root cause propagation graph corresponds to an indicator; and determining at least one root cause of the abnormal indicator to be processed based on the correspondence.

[0009] In one embodiment of this disclosure, obtaining the correspondence between abnormal indicators and root causes includes: obtaining a root cause propagation graph, the root cause propagation graph including multiple directed edges; determining the correlation between the nodes at both ends of each directed edge; determining the state transition probability matrix corresponding to the root cause propagation graph based on the correlation; determining one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix; and determining the correspondence based on each node and its corresponding one or more root causes.

[0010] In one embodiment of this disclosure, determining the correlation between the nodes at both ends of each directed edge includes: acquiring multiple data points for each node in the root cause propagation graph; normalizing the multiple data points for each node to obtain multiple normalized data points for each node; and determining the quotient of the product of the covariance and standard deviation of the nodes at both ends of each directed edge based on the multiple normalized data points for each node to obtain the correlation.

[0011] In one embodiment of this disclosure, determining the state transition probability matrix corresponding to the root cause propagation graph based on the correlation includes: determining the probability that a walker will walk from one node to other nodes in the root cause propagation graph based on the correlation and random walk, obtaining multiple walk values ​​for each node; determining the probability that a walker will stay at each node based on the correlation and random walk, obtaining a stay value for each node; and constructing a state transition probability matrix based on the multiple walk values ​​and stay values ​​for each node.

[0012] In one embodiment of this disclosure, the other nodes include a first node and / or a second node with directed edges to the first node, and a third node without directed edges; the directed edges between the first node and the first node have a direction pointing to the first node; the directed edges between the second node and the first node do not have a direction pointing to the second node; determining the probability of a walker moving from one node to other nodes in the root cause graph based on the correlation and random walk, and obtaining multiple walk values ​​for each node, includes: determining that the probability of a walker moving from the first node to the first node is the correlation between the first node and the first node; determining that the probability of a walker moving from the first node to the second node is the product of the correlation between the first node and the second node and a predetermined value; and determining that the probability of a walker moving from the first node to the third node is 0.

[0013] In one embodiment of this disclosure, the other nodes include at least one fourth node and / or at least one fifth node, wherein there is a directed edge between the fourth node and the first node pointing towards the first node, and there is a directed edge between the fifth node and the first node pointing towards the fifth node; the step of determining the probability of the walker staying at each node based on the relevance and random walk, and obtaining the dwell value of each node, includes: when the other nodes include at least one fourth node and at least one fifth node, determining that the dwell value of the first node is the maximum value between a first value and 0, wherein the first value is obtained by subtracting a third value from a second value, the second value is the maximum value of the relevance between the first node and the at least one fourth node, and the third value is the maximum value of the relevance between the first node and the at least one fifth node; when the other nodes include at least one fourth node but do not include a fifth node, determining that the dwell value of the first node is the second value; when the other nodes include at least one fifth node but do not include a fourth node, determining that the dwell value of the first node is 0.

[0014] In one embodiment of this disclosure, determining one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix includes: determining multiple walkers corresponding to each node based on random walks; determining the dwell nodes of the multiple walkers corresponding to each node according to the state transition probability matrix; and determining that one or more root causes corresponding to each node are indicators corresponding to one or more dwell nodes.

[0015] According to another aspect of this disclosure, a root cause determination apparatus is provided, comprising: an acquisition module for acquiring an abnormal indicator to be processed; the acquisition module is further configured to acquire a correspondence between the abnormal indicator and a root cause, the correspondence being obtained based on a root cause propagation graph and a corresponding state transition probability matrix, wherein each node in the root cause propagation graph corresponds to an indicator; and a determination module for determining at least one root cause of the abnormal indicator to be processed based on the correspondence.

[0016] In one embodiment of this disclosure, the acquisition module is configured to acquire a root cause propagation graph, the root cause propagation graph including multiple directed edges; determine the correlation between the nodes at both ends of each directed edge; determine the state transition probability matrix corresponding to the root cause propagation graph based on the correlation; determine one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix; and determine the correspondence based on each node and its corresponding one or more root causes.

[0017] In one embodiment of this disclosure, the acquisition module is used to acquire multiple data points of each node in the root cause propagation graph; normalize the multiple data points of each node to obtain multiple normalized data points of each node; and determine the quotient of the product of the covariance and standard deviation of the nodes at both ends of each directed edge based on the multiple normalized data points of each node to obtain the correlation degree.

[0018] In one embodiment of this disclosure, the acquisition module is configured to determine the probability that a walker will walk from one node to other nodes in the root cause propagation graph based on the correlation and random walk, thereby obtaining multiple walk values ​​for each node; determine the probability that a walker will stay at each node based on the correlation and random walk, thereby obtaining a stay value for each node; and construct a state transition probability matrix based on the multiple walk values ​​and stay values ​​for each node.

[0019] In one embodiment of this disclosure, the other nodes include a first node and / or a second node with directed edges to the first node, and a third node without directed edges; the directed edges between the first node and the first node have a direction pointing to the first node; the directed edges between the second node and the first node do not have a direction pointing to the second node; the acquisition module is configured to determine that the probability of a walker walking from the first node to the first node is the correlation between the first node and the first node; determine that the probability of a walker walking from the first node to the second node is the product of the correlation between the first node and the second node and a predetermined value; and determine that the probability of a walker walking from the first node to the third node is 0.

[0020] In one embodiment of this disclosure, the other nodes include at least one fourth node and / or at least one fifth node, wherein there is a directed edge between the fourth node and the first node pointing towards the first node, and there is a directed edge between the fifth node and the first node pointing towards the fifth node; the acquisition module is configured to, when the other nodes include at least one fourth node and at least one fifth node, determine that the dwell value of the first node is the maximum value between a first value and 0, wherein the first value is obtained by subtracting a third value from a second value, the second value is the maximum value of the relevance between the first node and the at least one fourth node, and the third value is the maximum value of the relevance between the first node and the at least one fifth node; determine that the dwell value of the first node is the second value when the other nodes include at least one fourth node but do not include a fifth node; and determine that the dwell value of the first node is 0 when the other nodes include at least one fifth node but do not include a fourth node.

[0021] In one embodiment of this disclosure, the acquisition module is configured to determine multiple walkers corresponding to each node based on random walks; determine the dwell nodes of the multiple walkers corresponding to each node according to the state transition probability matrix; and determine one or more root causes corresponding to each node as indicators corresponding to one or more dwell nodes.

[0022] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the root cause determination methods described above by executing the executable instructions.

[0023] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the root cause determination methods described above.

[0024] According to another aspect of this disclosure, a computer program product is provided, the computer program product comprising a computer program or computer instructions, the computer program or computer instructions being loaded and executed by a processor to enable a computer to implement any of the root cause determination methods described above.

[0025] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects:

[0026] The technical solution provided by the embodiments of this disclosure obtains the abnormal indicators to be processed and the correspondence between the abnormal indicators and their root causes, and then determines at least one root cause of the abnormal indicator to be processed based on the correspondence. The correspondence between the abnormal indicators and their root causes is obtained based on a root cause propagation graph and the corresponding state transition probability matrix. This method of obtaining the correspondence between abnormal indicators and their root causes through the root cause propagation graph and state transition probability matrix considers the coupling relationship between multiple dimensions causing the abnormal indicators and the inevitable consequence of upstream indicator anomalies leading to downstream indicator anomalies, making the obtained correspondence between abnormal indicators and their root causes more accurate, and thus increasing the accuracy of the root causes determined based on this correspondence.

[0027] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0028] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0029] Figure 1 This diagram illustrates a root cause determination system according to one embodiment of the present disclosure;

[0030] Figure 2 This diagram illustrates a process for constructing a root cause propagation graph in one embodiment of the present disclosure.

[0031] Figure 3 This diagram illustrates a root cause determination method flowchart in one embodiment of the present disclosure;

[0032] Figure 4 This diagram illustrates a table showing the correspondence between abnormal indicators and root causes in one embodiment of the present disclosure.

[0033] Figure 5 This diagram illustrates a one-way edge and a two-way edge connecting two nodes in one embodiment of the present disclosure.

[0034] Figure 6 A schematic diagram of a root cause propagation graph is shown in one embodiment of this disclosure;

[0035] Figure 7 This diagram illustrates a node having a fourth node and / or a fifth node in one embodiment of the present disclosure.

[0036] Figure 8 A schematic diagram of a root cause determination apparatus according to one embodiment of the present disclosure is shown;

[0037] Figure 9 A structural block diagram of an electronic device according to one embodiment of the present disclosure is shown. Detailed Implementation

[0038] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0039] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0040] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0041] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0042] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0043] With the development and advancement of technology, the functions of various systems have also increased, and the complexity of these systems has also increased accordingly. Highly complex systems present greater challenges for operation and maintenance. Manually determining the root cause of abnormal indicators (poor quality) in a system requires maintenance personnel to have extensive experience and relevant professional knowledge. Determining the root cause of abnormal indicators involves many steps, requiring layer-by-layer investigation, which is time-consuming and labor-intensive, and makes it difficult to accurately pinpoint the root cause, easily leading to misjudgment.

[0044] To address this, this disclosure provides a root cause determination method. This method obtains a root cause propagation graph among various indicators in the system, calculates the correlation between indicators with root cause propagation relationships based on the graph, determines a state transition probability matrix based on the correlation, and then determines at least one root cause for each indicator in the system based on the state transition probability matrix. By using each indicator and its corresponding at least one root cause to determine the correspondence between abnormal indicators and root causes, the root cause of the abnormal indicator can be quickly and accurately determined automatically or manually based on this correspondence when the abnormal indicator reappears.

[0045] Figure 1 The diagram illustrates a root cause determination system according to an embodiment of the present disclosure, which can apply the root cause determination methods or root cause determination devices in various embodiments of the present disclosure.

[0046] like Figure 1 As shown, the root cause determination system may include a storage device 101 and an execution device 102.

[0047] The storage device 101 can store operational data of the functional system (the system corresponding to the root cause diagram). Based on this operational data and relevant professional knowledge, operational personnel can establish a root cause diagram for the functional system. For example... Figure 2As shown in (1), maintenance personnel can treat each indicator in the functional system as a node in the root cause propagation graph, and connect these nodes to obtain the following: Figure 2 The structure diagram shown in (2) is then used by maintenance personnel to delete irrelevant connections based on maintenance data and professional knowledge, resulting in the following structure diagram. Figure 2 The structure diagram shown in (3) is then used by the operations and maintenance personnel to determine the root cause propagation direction between two interconnected nodes, resulting in the following: Figure 2 The root cause propagation diagram shown in (4) is shown in the diagram.

[0048] It should be noted that, Figure 2 The nodes and root cause diagrams shown are merely examples and are only used to help understand the root cause diagrams in the embodiments of this disclosure.

[0049] After the operations and maintenance personnel construct the root cause propagation graph, they can store it in storage device 101. Execution device 102 can retrieve the root cause propagation graph from storage device 101, as well as multiple data points corresponding to each node in the graph. Both execution device 102 and storage device 101 can normalize these multiple data points for each node, obtaining normalized data points for each node. Then, execution device 102 can calculate the correlation between two nodes with directed edges in the root cause propagation graph based on the normalized data for each node. Execution device 102 can store this correlation in storage device 101. Both execution device 102 and storage device 101 can determine the corresponding state transition probability matrix based on this correlation, and determine the root cause corresponding to each node based on this matrix and a random walk. Both the execution device 102 and the storage device 101 can determine the correspondence between the abnormal indicators and the root cause based on the root cause of each node. This correspondence can be represented by a table or other forms that represent the correspondence. This disclosure embodiment does not limit this.

[0050] The execution device 102 can store the correspondence between abnormal indicators and root causes in the storage device 101. When determining the root cause of an abnormal indicator to be processed, the correspondence can be retrieved from the storage device 102, and at least one root cause of the abnormal indicator to be processed can be determined based on the correspondence.

[0051] The storage device 101 and the execution device 102 communicate with each other via a network, which can be a wired network or a wireless network.

[0052] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0053] Storage device 101 and execution device 102 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, wearable devices, etc.

[0054] Storage device 101 and execution device 102 can also be servers that provide various services. Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0055] In one embodiment, the storage device 101 and the execution device 102 may be different modules or storage / processing units of the same electronic device.

[0056] Those skilled in the art will know that Figure 1 The number of execution devices 102 shown is merely illustrative; any number of execution devices may be used depending on actual needs. This disclosure does not limit the number of execution devices.

[0057] The following detailed description of this exemplary implementation method is provided in conjunction with the accompanying drawings and embodiments.

[0058] This disclosure provides a root cause determination method, which can be executed by any electronic device with computing power.

[0059] Figure 3 A flowchart of a root cause determination method according to one embodiment of this disclosure is shown, as follows: Figure 3 As shown, the root cause determination method provided in this embodiment includes the following steps S301 to S303.

[0060] S301, Obtain the indicators of the anomalies to be processed.

[0061] Among them, the anomaly indicators to be processed are indicators of anomalies occurring in the functional system whose root causes need to be determined. This disclosure does not limit the specific type of the functional system. For example, in an IoT system, the anomaly indicators to be processed could be terminal service reporting success rate, platform control success rate, terminal inactivity rate, network transmission latency, etc.

[0062] S302, obtain the correspondence between abnormal indicators and root causes. This correspondence is obtained based on the root cause propagation graph and the corresponding state transition probability matrix. Each node in the root cause propagation graph corresponds to an indicator.

[0063] Among them, the correspondence between abnormal indicators and root causes is the correspondence between abnormal indicators and root causes in the functional system corresponding to the abnormal indicators to be processed in S301.

[0064] In one embodiment, the correspondence between abnormal indicators and root causes is stored in a storage device. Obtaining this correspondence may include directly retrieving it from the storage device. This disclosure does not limit the form in which the correspondence is represented. For example, it may be represented in tabular form. As another example, the correspondence between abnormal indicators and root causes represented in tabular form may be as follows: Figure 4 As shown. Figure 4 In the diagram, 401 indicates an abnormal indicator 1, and the root cause of this abnormal indicator 1 is indicator A, indicator B, and indicator C, which are indicated by 402.

[0065] In another embodiment, obtaining the correspondence between abnormal indicators and root causes may include: obtaining a root cause propagation graph, which includes multiple directed edges; determining the correlation between the nodes at both ends of each directed edge; determining the state transition probability matrix corresponding to the root cause propagation graph based on the correlation; determining one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix; and determining the correspondence based on each node and its corresponding one or more root causes.

[0066] The root cause graph is manually constructed and stored in a storage device. The execution device can directly retrieve the root cause graph from the storage device. The root cause graph can be represented as G(V, E), where V represents the set of nodes in the root cause graph, and E represents the set of directed edges in the root cause graph. The specific representation of the directed edges is not limited in this embodiment. It should be noted that all edges in the root cause graph are directed edges; edges with one pointing direction are unidirectional edges, and edges without pointing direction are bidirectional edges. Figure 5 As shown in (1), there is a one-way edge between node 501 and node 502, pointing from node 501 to node 502. This one-way edge represents the index corresponding to node 501, which is affected by the index corresponding to node 502. Therefore, when the index corresponding to node 501 becomes abnormal, the direction for finding the root cause is from node 501 to node 502. Figure 5 As shown in (2), there is a bidirectional edge between nodes 503 and 504 without a direct direction. This bidirectional edge indicates that the indicators corresponding to nodes 503 and 504 will influence each other. When the indicator corresponding to node 503 becomes abnormal, the direction for finding the root cause is from node 503 to node 504; when the indicator corresponding to node 504 becomes abnormal, the direction for finding the root cause is from node 504 to node 503.

[0067] The correlation between the nodes at both ends of each directed edge represents the magnitude of the influence of the index corresponding to one of the two nodes on the index corresponding to the other node pointed to by the directed edge. In one embodiment, determining the correlation between the nodes at both ends of each directed edge includes: acquiring multiple data points for each node in the root cause graph; normalizing the multiple data points for each node to obtain multiple normalized data points for each node; and determining the quotient of the product of the covariance and standard deviation of the nodes at both ends of each directed edge based on the multiple normalized data points for each node to obtain the correlation.

[0068] In this process, multiple data points for each node are stored in a storage device. The method for obtaining these multiple data points from each node in the root cause propagation graph can be to directly retrieve them from the storage device. These multiple data points for each node represent the metrics corresponding to that node. For example, if the metric for a certain node is terminal latency, then the corresponding data for that metric consists of multiple latency data points for the terminal.

[0069] The multiple data points of each node can be normalized according to Formula 1 below.

[0070]

[0071] Where a is the data before normalization, a maxThe maximum value among multiple data points corresponding to a node, a min It is the minimum value among the multiple data corresponding to a node, and A is the normalized data obtained after a is normalized.

[0072] After normalizing the multiple data points corresponding to each node, we obtain multiple normalized data points for each node. Then, based on the multiple normalized data points for each node, we determine the quotient of the product of the covariance and standard deviation of the nodes at both ends of each directed edge, and obtain the correlation.

[0073] The quotient of the product of the covariance and standard deviation of the nodes at both ends of each directed edge can be determined as shown in Formula 2 below.

[0074]

[0075] Among them, A i A represents multiple normalized data points from the i-th node. j These are multiple normalized data points from the j-th node, cov(A) i A j ) is the covariance between the i-th node and the j-th node, σ Ai σ is the standard deviation corresponding to the i-th node. Aj S is the standard deviation corresponding to the j-th node. i,j S represents the correlation between the i-th node and the j-th node. i,j It also indicates the magnitude of the influence of the index corresponding to the i-th node on the index corresponding to the j-th node pointed to by the directed edge. i,j The value range is [0, 1].

[0076] In one embodiment, determining the state transition probability matrix corresponding to the root cause propagation graph based on relevance may include: determining the probability that a walker will walk from one node to other nodes in the root cause propagation graph based on relevance and random walk, obtaining multiple walk values ​​for each node; determining the probability that a walker will stay at each node based on relevance and random walk, obtaining a stay value for each node; and constructing a state transition probability matrix based on the multiple walk values ​​and stay values ​​for each node.

[0077] In one embodiment, the nodes in the root cause graph can be divided into one node and other nodes besides that one node. These other nodes include a first node and / or a second node with directed edges to the one node, and a third node without directed edges. The directed edges between the first node and the one node have a direction pointing to the first node; the directed edges between the second node and the one node do not have a direction pointing to the second node. Based on relevance and random walk, the probability of a walker moving from one node to other nodes in the root cause graph is determined, resulting in multiple walk values ​​for each node. These values ​​may include: determining the probability of a walker moving from the one node to the first node as the relevance between the one node and the first node; determining the probability of a walker moving from the one node to the second node as the product of the relevance between the one node and the second node and a predetermined value; and determining the probability of a walker moving from the one node to the third node as 0.

[0078] The predetermined value is a value that takes the value in the range [0, 1).

[0079] like Figure 6 The root cause graph shown includes nodes 602, 603, and 604 that have directed edges with node 601. The directed edge between nodes 601 and 602 is a one-way edge from node 601 to node 602, the directed edge between nodes 601 and 603 is a one-way edge from node 603 to node 601, and the edge between nodes 601 and 604 is a two-way edge. Nodes 605 and 606 do not have directed edges with node 601. For node 601, nodes 602 and 604 are both the first node of node 601, node 603 is the second node of node 601, and nodes 605 and 606 are both the third node of node 601. According to the random walk algorithm, the probability of a walker moving from node 601 to nodes 602 and 604 is equal to the correlation between nodes 601 and 602, and 604, respectively. The probability that a wanderer will move from node 601 to node 603 is the product of the correlation between nodes 601 and 603 and a predetermined value. The probability that a wanderer will move from node 601 to nodes 605 or 606 is 0.

[0080] In one embodiment, the nodes in the root cause graph can be divided into one node and other nodes besides that one node. These other nodes include at least one fourth node and / or at least one fifth node. A directed edge pointing to the one node exists between the fourth node and the one node, and a directed edge pointing to the fifth node exists between the fifth node and the one node. Based on relevance and random walk, the probability of a walker staying at each node is determined, resulting in a dwell value for each node. This can include: if other nodes include at least one fourth node and at least one fifth node, determining that the dwell value of the one node is the maximum of a first value and 0, where the first value is obtained by subtracting a third value from a second value, the second value being the maximum relevance between the one node and at least one fourth node, and the third value being the maximum relevance between the one node and at least one fifth node; if other nodes include at least one fourth node but not a fifth node, determining that the dwell value of the one node is the second value; and if other nodes include at least one fifth node but not a fourth node, determining that the dwell value of the one node is 0.

[0081] like Figure 7 As shown in (1), the fourth nodes corresponding to node 711 include nodes 712, 713, and 714, and the fifth nodes corresponding to node 711 include nodes 712 and 715. The correlations between node 711 and nodes 712-715 are A2-A5, respectively, and A5>A2>A3>A4. Therefore, for node 711, A2 is the second value, and A5 is the third value. Since A5>A2, the second value minus the third value is negative, and correspondingly, the first value is negative. Therefore, the dwell value of node 711 is the maximum value between the first value and 0, which is 0.

[0082] like Figure 7 As shown in (2), the fourth node corresponding to node 721 includes node 722, node 723 and node 724, and node 721 does not have a fifth node. The correlation between node 721 and nodes 722-724 is B2-B4 respectively, and B2>B3>B4. Therefore, for node 721, B2 is the second value, that is, the dwell value of node 721 is B2.

[0083] like Figure 7 As shown in (3), the fifth nodes corresponding to node 731 are node 732 and node 733, and node 731 does not have a fourth node, so the dwell value of node 731 is 0.

[0084] After determining the multiple walk values ​​and dwell values ​​of each node in the root cause propagation graph, a state transition probability matrix can be constructed based on these values. In one embodiment, constructing the state transition probability matrix based on the multiple walk values ​​and dwell values ​​of each node may include: preprocessing the multiple walk values ​​and dwell values ​​of each node to obtain multiple walk probabilities and dwell probabilities corresponding to each node, where the sum of the multiple walk probabilities and dwell probabilities of each node is 1; and constructing the state transition probability matrix based on the multiple walk probabilities and dwell probabilities of each node. Here, the multiple walk probabilities and dwell probabilities of each node correspond to one row in the state transition probability matrix.

[0085] After constructing the state transition probability matrix, one or more root causes corresponding to each node in the root cause propagation graph can be determined based on this matrix. In one embodiment, determining one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix may include: determining multiple walkers corresponding to each node based on random walks; determining the dwell nodes of the multiple walkers corresponding to each node according to the state transition probability matrix; and determining that the one or more root causes corresponding to each node are indicators corresponding to one or more dwell nodes.

[0086] After multiple travelers depart from each node, they will either travel or remain based on the state transition probability matrix. The nodes where these travelers remain are counted, resulting in one or more remaining nodes for each node. When a node has multiple remaining nodes, the number of travelers corresponding to these nodes can vary. For example, if there are 10 travelers and a node has 3 remaining nodes (nodes 1-3), then node 1 corresponds to 7 travelers, node 2 to 2 travelers, and node 3 to 1 traveler. If an indicator corresponding to this node becomes abnormal, the indicator corresponding to nodes 1-3 is likely the root cause of the abnormal indicator. If only one root cause exists, then the indicator corresponding to node 1 is more likely to be the root cause of the abnormal indicator.

[0087] S303, determine at least one root cause of the abnormal indicator to be processed based on the correspondence.

[0088] Once the correspondence between abnormal indicators and root causes is obtained, at least one root cause corresponding to the abnormal indicator to be processed can be queried from the correspondence.

[0089] The technical solution provided by the embodiments of this disclosure obtains the abnormal indicators to be processed and the correspondence between the abnormal indicators and their root causes, and then determines at least one root cause of the abnormal indicator to be processed based on the correspondence. The correspondence between the abnormal indicators and their root causes is obtained based on a root cause propagation graph and the corresponding state transition probability matrix. This method of obtaining the correspondence between abnormal indicators and their root causes through the root cause propagation graph and state transition probability matrix considers the coupling relationship between multiple dimensions causing the abnormal indicators and the inevitable consequence of upstream indicator anomalies leading to downstream indicator anomalies, making the obtained correspondence between abnormal indicators and their root causes more accurate, and thus increasing the accuracy of the root causes determined based on this correspondence.

[0090] Based on the same inventive concept, this disclosure also provides a root cause determination device, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the method embodiments described above, the implementation of this device embodiment can refer to the implementation of the method embodiments described above, and repeated details will not be repeated.

[0091] Figure 8 A schematic diagram of a root cause determination apparatus according to one embodiment of the present disclosure is shown, such as... Figure 8 As shown, the device includes: an acquisition module 801, used to acquire an abnormal indicator to be processed; the acquisition module 801 is also used to acquire the correspondence between the abnormal indicator and the root cause, the correspondence being obtained based on the root cause propagation graph and the corresponding state transition probability matrix, each node in the root cause propagation graph corresponding to an indicator; and a determination module 802, used to determine at least one root cause of the abnormal indicator to be processed based on the correspondence.

[0092] In one embodiment of this disclosure, the acquisition module 801 is used to acquire a root cause propagation graph, which includes multiple directed edges; determine the correlation between the nodes at both ends of each directed edge; determine the state transition probability matrix corresponding to the root cause propagation graph based on the correlation; determine one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix; and determine the correspondence relationship based on each node and its corresponding one or more root causes.

[0093] In one embodiment of this disclosure, the acquisition module 801 is used to acquire multiple data points of each node in the root cause propagation graph; normalize the multiple data points of each node to obtain multiple normalized data points of each node; and determine the quotient of the product of the covariance and standard deviation of the nodes at both ends of each directed edge based on the multiple normalized data points of each node to obtain the correlation.

[0094] In one embodiment of this disclosure, the acquisition module 801 is used to determine the probability that a walker will walk from one node in the root cause propagation graph to other nodes based on the relevance and random walk, and obtain multiple walk values ​​for each node; determine the probability that a walker will stay at each node based on the relevance and random walk, and obtain a stay value for each node; and construct a state transition probability matrix based on the multiple walk values ​​and stay values ​​for each node.

[0095] In one embodiment of this disclosure, other nodes include a first node and / or a second node with a directed edge to a node, and a third node without a directed edge; the directed edge between the first node and a node has a direction pointing to the first node; the directed edge between the second node and a node does not have a direction pointing to the second node; the acquisition module 801 is used to determine the probability that a wanderer will walk from one node to the first node is the correlation between the first node and the first node; to determine the probability that a wanderer will walk from one node to the second node is the product of the correlation between the second node and a predetermined value; and to determine that the probability that a wanderer will walk from one node to the third node is 0.

[0096] In one embodiment of this disclosure, the other nodes include at least one fourth node and / or at least one fifth node, with a directed edge pointing to the first node between the fourth node and a second node, and a directed edge pointing to the fifth node between the fifth node and a third node; the acquisition module 801 is configured to, when the other nodes include at least one fourth node and at least one fifth node, determine that the dwell value of a node is the maximum value between a first value and 0, wherein the first value is obtained by subtracting a third value from a second value, the second value is the maximum value of the relevance between a node and at least one fourth node, and the third value is the maximum value of the relevance between a node and at least one fifth node; determine that the dwell value of a node is the second value when the other nodes include at least one fourth node but do not include a fifth node; and determine that the dwell value of a node is 0 when the other nodes include at least one fifth node but do not include a fourth node.

[0097] In one embodiment of this disclosure, the acquisition module 801 is used to determine multiple walkers corresponding to each node based on random walks; determine the dwell nodes of the multiple walkers corresponding to each node according to the state transition probability matrix; and determine one or more root causes corresponding to each node as indicators corresponding to one or more dwell nodes.

[0098] The technical solution provided by the embodiments of this disclosure obtains the abnormal indicators to be processed and the correspondence between the abnormal indicators and their root causes, and then determines at least one root cause of the abnormal indicator to be processed based on the correspondence. The correspondence between the abnormal indicators and their root causes is obtained based on a root cause propagation graph and the corresponding state transition probability matrix. This method of obtaining the correspondence between abnormal indicators and their root causes through the root cause propagation graph and state transition probability matrix considers the coupling relationship between multiple dimensions causing the abnormal indicators and the inevitable consequence of upstream indicator anomalies leading to downstream indicator anomalies, making the obtained correspondence between abnormal indicators and their root causes more accurate, and thus increasing the accuracy of the root causes determined based on this correspondence.

[0099] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0100] The following reference Figure 9 To describe an electronic device 900 according to such an embodiment of the present disclosure. Figure 9 The electronic device 900 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0101] like Figure 9 As shown, the electronic device 900 is manifested in the form of a general-purpose computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0102] The storage unit stores program code that can be executed by the processing unit 910, causing the processing unit 910 to perform the steps described in the "Detailed Description" section of this specification according to various exemplary embodiments of this disclosure.

[0103] Storage unit 920 may include readable media in the form of volatile storage units, such as random access memory (RAM) 9201 and / or cache memory 9202, and may further include read-only memory (ROM) 9203.

[0104] Storage unit 920 may also include a program / utility 9204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0105] Bus 930 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0106] Electronic device 900 can also communicate with one or more external devices 940 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with the electronic device 900, and / or with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 950. Furthermore, electronic device 900 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 960. Figure 9 As shown, network adapter 960 communicates with other modules of electronic device 900 via bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0107] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0108] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the methods described above is stored thereon. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this disclosure described in the "Detailed Description" section above.

[0109] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0110] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0111] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0112] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0113] In exemplary embodiments of this disclosure, a computer program product is also provided, comprising a computer program or computer instructions, which are loaded and executed by a processor to enable a computer to perform the steps of the various exemplary embodiments of this disclosure described in the foregoing “Detailed Description” section of this specification.

[0114] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0115] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0116] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0117] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope of this disclosure is indicated by the appended claims.

Claims

1. A method for determining root causes, characterized in that, Applications in Internet of Things (IoT) systems include: Obtain the anomaly indicators to be processed, which include at least one of the following: terminal service reporting success rate, platform control success rate, terminal inactivation rate, and network transmission latency. Obtain the correspondence between abnormal indicators and root causes. The correspondence is obtained based on the root cause propagation graph and the corresponding state transition probability matrix. Each node in the root cause propagation graph corresponds to an indicator. Based on the correspondence, at least one root cause of the abnormal indicator to be processed is determined; The step of obtaining the correspondence between abnormal indicators and root causes includes: obtaining a root cause propagation graph, which includes multiple directed edges; determining the correlation between the nodes at both ends of each directed edge; determining the state transition probability matrix corresponding to the root cause propagation graph based on the correlation; determining one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix; determining the correspondence based on each node and its corresponding one or more root causes; the step of determining the state transition probability matrix corresponding to the root cause propagation graph based on the correlation includes: determining the probability that a walker will walk from one node in the root cause propagation graph to other nodes based on the correlation and random walk, obtaining multiple walk values ​​for each node; the other nodes include at least one fourth node and / or at least one fifth node, and there is a point between the fourth node and the first node pointing to the root cause. There are directed edges in the direction of each node, and there is a directed edge pointing to the direction of the fifth node between the fifth node and the first node; when the other nodes include at least one fourth node and at least one fifth node, the dwell value of the first node is determined to be the maximum value between a first value and 0, the first value is obtained by subtracting a third value from a second value, the second value is the maximum value of the correlation between the first node and the at least one fourth node, and the third value is the maximum value of the correlation between the first node and the at least one fifth node; when the other nodes include at least one fourth node but do not include a fifth node, the dwell value of the first node is determined to be the second value; when the other nodes include at least one fifth node but do not include a fourth node, the dwell value of the first node is determined to be 0; a state transition probability matrix is ​​constructed based on the multiple walk values ​​and dwell values ​​of each node.

2. The method according to claim 1, characterized in that, Determining the correlation between the nodes at both ends of each directed edge includes: Obtain multiple data points for each node in the root cause propagation graph; Normalize the multiple data points of each node to obtain multiple normalized data points for each node; Based on multiple normalized data for each node, the quotient of the product of covariance and standard deviation of the nodes at both ends of each directed edge is determined to obtain the correlation degree.

3. The method according to claim 1, characterized in that, The other nodes include a first node and / or a second node that have a directed edge with the first node, and a third node that has no directed edge; the directed edge between the first node and the first node has a direction pointing to the first node; The directed edge between the second node and the first node does not have a direction pointing to the second node; The step involves determining the probability that a walker will move from one node in the root cause propagation graph to other nodes based on the correlation and random walk, resulting in multiple walk values ​​for each node, including: The probability that a wanderer will walk from one node to the first node is determined by the correlation between the one node and the first node; The probability of a walker moving from the first node to the second node is determined by the product of the correlation between the first node and the second node and a predetermined value, where the predetermined value is a value in the range [0, 1). The probability that the wanderer will move from the first node to the third node is 0.

4. The method according to claim 1, characterized in that, The step of determining one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix includes: Based on the random walk, determine the multiple walkers corresponding to each node; Determine the dwell nodes of multiple walkers corresponding to each node according to the state transition probability matrix; Identify one or more root causes corresponding to each node as indicators corresponding to one or more dwell nodes.

5. A root cause determination device, characterized in that, Applications in Internet of Things (IoT) systems include: The acquisition module is used to acquire the anomaly indicators to be processed, which include at least one of the following: terminal service reporting success rate, platform control success rate, terminal inactivation rate, and network transmission latency. The acquisition module is also used to acquire the correspondence between abnormal indicators and root causes. The correspondence is obtained based on the root cause propagation graph and the corresponding state transition probability matrix. Each node in the root cause propagation graph corresponds to an indicator. The determination module is used to determine at least one root cause of the abnormal indicator to be processed based on the correspondence; The acquisition module is further configured to: acquire a root cause propagation graph, which includes multiple directed edges; determine the correlation between the nodes at both ends of each directed edge; determine the state transition probability matrix corresponding to the root cause propagation graph based on the correlation; determine one or more root causes corresponding to each node in the root cause propagation graph based on the state transition probability matrix; and determine the correspondence based on each node and its corresponding one or more root causes. The acquisition module is also configured to: determine the probability that a walker will move from one node to other nodes in the root cause propagation graph based on the correlation and random walk, obtaining multiple walk values ​​for each node; the other nodes include at least one fourth node and / or at least one fifth node, wherein there is a directed edge between the fourth node and the first node pointing towards the first node, and the fifth node and... There are directed edges pointing to the fifth node between the nodes; when the other nodes include at least one fourth node and at least one fifth node, the dwell value of the node is determined to be the maximum value between a first value and 0, where the first value is obtained by subtracting a third value from a second value, the second value is the maximum value of the correlation between the node and the at least one fourth node, and the third value is the maximum value of the correlation between the node and the at least one fifth node; when the other nodes include at least one fourth node but do not include a fifth node, the dwell value of the node is determined to be the second value; when the other nodes include at least one fifth node but do not include a fourth node, the dwell value of the node is determined to be 0; a state transition probability matrix is ​​constructed based on the multiple walk values ​​and dwell values ​​of each node.

6. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the root cause determination method according to any one of claims 1 to 4 by executing the executable instructions.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the root cause determination method according to any one of claims 1 to 4.

Images