An enterprise intelligent operation and maintenance KPI data anomaly detection and root cause positioning method

Abstract

This invention provides a method for anomaly detection and root cause localization of enterprise intelligent operation and maintenance KPI data. The method comprises the following steps: acquiring a KPI training dataset; classifying the KPI training data in the KPI training dataset using a hierarchical agglomerative clustering method; training a CE model using the classified KPI training data, and inputting the data to be detected into the trained CE model for clustering; training a LightGBM model based on outlier scores extracted from various unsupervised models and the KPI training dataset, and using the LightGBM model to detect anomalies in the dataset to be detected; and localizing the root cause of any anomalous data in the dataset to be detected based on an improved generalized latent score. The CE model is an improved model based on a CNN model with an added embedding layer. This invention significantly improves the efficiency and accuracy of KPI data anomaly detection and root cause localization.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and in particular relates to a method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data. Background Technology

[0002] The concept of Artificial Intelligence for IT Operations (AIOps) was proposed by Gartner in 2016. It aims to improve operational capabilities using big data, machine learning, and other methods, with the goal of further reducing human intervention in automated operations and ultimately achieving unmanned and fully automated operations. In enterprise intelligent operations, to ensure reliable and efficient service to tens or even hundreds of millions of users, operations personnel typically use Key Performance Indicators (KPIs) to monitor the service performance of various applications. KPI data anomaly detection and root cause analysis refers to analyzing the characteristics of KPI data to identify abnormal KPI data and quickly pinpoint the location of the anomaly.

[0003] Improving the efficiency and accuracy of KPI data anomaly detection and root cause localization has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method for KPI data anomaly detection and root cause localization to solve the technical problems existing in the prior art.

[0005] To achieve the above-mentioned technical objectives, the present invention provides the following technical solution:

[0006] A method for detecting and locating root causes of KPI data anomalies in enterprise intelligent operation and maintenance includes the following steps:

[0007] Obtain the KPI training dataset;

[0008] Hierarchical agglomerative clustering method is used to classify the KPI training data in the KPI training dataset.

[0009] The CE model is trained using the labeled KPI training data, and the data to be detected is input into the trained CE model for clustering.

[0010] The LightGBM model is trained based on outlier scores extracted by various unsupervised models and the KPI training dataset, and then the LightGBM model is used to detect outliers on the dataset to be detected.

[0011] Anomaly root cause localization is performed on any anomalous data in the dataset to be detected based on the improved generalized latent score;

[0012] The CE model is an improved model based on the CNN model with the addition of an embedding layer.

[0013] Preferably, the specific steps for classifying the KPI training data in the KPI training dataset using the hierarchical agglomerative clustering method include:

[0014] Read the KPI data and the number of clusters n1 from the KPI training dataset;

[0015] Each row of X in the KPI data i The samples are treated as a cluster;

[0016] Calculate the distance between any two clusters and merge the two closest clusters;

[0017] Continue calculating the distance between every two remaining clusters and merging the remaining clusters until the number of clusters reaches n1;

[0018] Clustering categories y for each row of sample data i (i = 1, 2, 3, ..., N) are stored in the KPI training dataset.

[0019] Preferably, the CE network model network structure includes upper and lower layers;

[0020] Upper layer: Convolutional layer - Pooling layer - Fully connected layer;

[0021] Lower layer: Parallel Embedding layer.

[0022] Preferably, training the CE model specifically includes the following steps:

[0023] Obtain the first cluster centroid of each KPI data group after clustering the KPI training dataset;

[0024] The KPI training dataset is clustered, and each KPI data category and the corresponding first cluster centroid of each category are input into the CE model for training.

[0025] Update the weights of the centroids of the first cluster of class f and the bias of class f until the number of training iterations reaches m1, at which point the CE model completes training.

[0026] Wherein, the centroid of the first cluster in each class is the average value of the KPI training data of each class; in the CE model, the upper layer of the CE model extracts features from the KPI training data; the lower layer of the CE model iteratively trains the centroid of the first cluster.

[0027] Preferably, a LightGBM model is trained based on outlier scores extracted by various unsupervised models and the KPI training dataset, and the LightGBM model is used to perform anomaly detection on the dataset to be detected. Specifically, this includes the following steps:

[0028] Multiple unsupervised models are used to learn representations of each class of data in the KPI training dataset to obtain outlier scores.

[0029] The outlier scores are optimized.

[0030] The LightGBM model is trained based on the optimal results of each data type and the outlier scores;

[0031] The dataset to be detected is input into the trained LightGBM model to obtain anomaly detection results.

[0032] Preferably, the root cause localization of any anomalous data in the dataset to be detected is performed based on the improved generalized latent score, specifically including the following steps:

[0033] Obtain any abnormal KPI data in the dataset to be detected that is abnormal;

[0034] Obtain the attribute value combination corresponding to the abnormal KPI data, as well as the set of actual values, predicted values, and expected values;

[0035] The attribute value combinations are filtered based on the anomaly probability.

[0036] The filtered attribute values ​​are then grouped and clustered.

[0037] The improved generalized latent score is used as an evaluation criterion to filter the clustered attribute value combinations to obtain the final abnormal root cause.

[0038] Preferably, the optimization of the outlier score specifically includes the following steps:

[0039] S1. Read the training data for each type of KPI and its outlier scores, and select the number of outlier scores w1;

[0040] S2. Calculate the centroid volatility α f Read the first cluster centroid U from the KPI training dataset. f Calculate the centroid volatility α of the training data for each type of KPI. f ;

[0041] S3. Optimize outlier scores;

[0042] S4. Calculate the ROC score for each class of KPI training data, and store the optimization outlier score corresponding to the highest ROC score in S. f In the set f = 1, 2, ..., n1, use #(S f ) represents the set S to be selected. f The number of optimized outlier scores, initially #(S f ) is 1;

[0043] S5. Judgment #(S f Is S greater than or equal to w1? If yes: Set S to w1. f The set is saved as the optimized result, and the optimization of outlier scores ends; if not, proceed to step S6.

[0044] S6. Calculate the S values ​​for each category that were not selected. f Optimization outlier score of the set Evaluation value

[0045] S7. Select the highest optimization outlier score for each category into S. f Set, #(S f )=#(S f )+1, execute step S5 in the specific steps of the final abnormal root cause.

[0046] Preferably, the specific steps for filtering the attribute value combination using anomaly probability as the filtering condition include:

[0047] Calculate the deviation score for each row of attribute combinations;

[0048] Obtain a judgment threshold and compare the judgment threshold with the deviation score;

[0049] Delete the attribute value combinations whose deviation scores are less than or equal to the judgment threshold.

[0050] Preferably, the filtered attribute values ​​are clustered, specifically including the following steps:

[0051] S1. Calculate the deviation score d(ε) for each row of attribute value combinations. e' The expression is:

[0052]

[0053] Where, ε e ' represents the combination of attribute values ​​in the e'th row of the filtered KPI; F(ε) e' V(ε) represents the predicted value of the attribute value combination in row e'; e' () represents the actual value of the attribute value combination in row e';

[0054] S2. with d(ε) e' Using this as a benchmark, calculate the number of combinations of anomalous attribute values ​​under each of the aforementioned deviation scores;

[0055] S3. Select the relative maximum value of the number of combinations of n2 attribute values, and use its deviation score as the second cluster centroid;

[0056] S4. Use the relative minimum values ​​near the centroid of the second cluster as the cluster boundary for clustering;

[0057] S5. Divide the KPI outlier attribute values ​​into n² clusters, using Bij. v Let v represent the cluster category of each cluster, where v = 1, 2, 3...n².

[0058] Preferably, the specific steps for using the improved generalized latent score as an evaluation criterion to filter the clustered attribute value combinations to obtain the final anomaly root cause include:

[0059] S1. Obtain the discrimination threshold;

[0060] S2. Read the combination of KPI attribute values ​​for the vth class;

[0061] S3. Based on the number of iterations m in step S3, select the attribute combination of the m-th node in the first level of the tree corresponding to the v-th CD set;

[0062] S4. Determine whether the m-th node mentioned in step S3 has been selected. If it has been selected, execute step i of step S5 in the specific steps of the final abnormal root cause. If it has not been selected, select the m-th node as the selected node and execute step S6.

[0063] S5.i. Determine whether the m-th node or the selected node has any unselected sibling nodes. If there are unselected sibling nodes, select the (m+1)-th sibling node as the selected node or select one of the unselected sibling nodes as the selected node, and proceed to step S6; if there are no sibling nodes, proceed to step S9.

[0064] ii. Determine whether the selected node has child nodes. If it has child nodes, select the child nodes and proceed to step S6. If it has no child nodes, proceed to step S3 to select the attribute combination of the selected node at the first level of the tree corresponding to the v-th CD set.

[0065] S6. Calculate the proportion of the number of attribute value combinations of the selected node corresponding to the attribute combination in the v-th cluster to the total number of corresponding attribute value combinations, and sort them in descending order;

[0066] S7. Calculate the IGPS of each attribute value combination in the selected nodes according to the IGPS expression in sorted order, and select the node with the largest IGPS as the selected node's IGPS. max ;

[0067] S8. If the selected node IGPS max If the value is greater than or equal to the discrimination threshold, the IGPS will be... max The attribute value combination of the corresponding node is marked as a candidate root cause, and step i of step S5 in the specific steps of the final abnormal root cause is executed; if the IGPS of the selected node... max If the value is less than the discrimination threshold, step S5ii of the specific steps for determining the final abnormal root cause is executed;

[0068] S9. Calculate the composite score DS for all combinations of candidate root cause attribute values;

[0069] S10. Take the attribute value combination with the highest comprehensive score DS as the root cause of the anomaly in this class and store it in the KPI root cause output dataset.

[0070] Compared with the prior art, the present invention has the following beneficial effects:

[0071] This invention can significantly improve the efficiency and accuracy of KPI data anomaly detection and root cause localization. Attached Figure Description

[0072] Figure 1 This is a flowchart of the KPI data clustering process of this invention.

[0073] Figure 2 This is a flowchart of the KPI root cause search process of the present invention. Detailed Implementation

[0074] The technical solutions provided by the present invention will be described in detail below with reference to the embodiments, but they should not be construed as limiting the scope of protection of the present invention.

[0075] Example 1:

[0076] This embodiment discloses a method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data, including the following steps:

[0077] Obtain the KPI training dataset;

[0078] Hierarchical agglomerative clustering method is used to classify the KPI training data in the KPI training dataset.

[0079] The CE model is trained using the labeled KPI training data, and the data to be detected is input into the trained CE model for clustering.

[0080] The LightGBM model is trained based on outlier scores and KPI training datasets extracted by various unsupervised models, and the LightGBM model is used to detect anomalies on the dataset to be detected.

[0081] Anomaly root cause localization is performed on any anomalous data in the dataset to be detected based on the improved generalized latent score;

[0082] The CE model is an improved model based on the CNN model with the addition of an embedding layer.

[0083] Specifically:

[0084] In this embodiment, for accurate and specific explanation, the above technical steps are specifically divided into three technical modules: KPI data clustering, KPI data anomaly detection, and KPI anomaly root cause localization. In addition to these three technical modules, it also includes defining the system initial values. The method flow is as follows: 1. Define the system initial values; 2. KPI data clustering; 3. KPI data anomaly detection; 4. KPI anomaly root cause localization.

[0085] 1) Define the initial values ​​of the system: In order to reflect the intelligence of the system, the initial values ​​can be given based on historical data experience values, or they can be adjusted by the staff themselves.

[0086] Define n1 as the number of KPI data clusters, n2 as the number of attribute value combination clusters in root cause localization; a as the proportion of outliers in the unsupervised model; g p For unsupervised model complexity, p = 1, 2, 3, ..., 6; m1 is the number of training iterations for the CE model, and m2 is the number of training iterations for the LightGBM model; w1 is the number of outlier scores selected; η1 is the threshold for filtering attribute value combinations in root cause localization, and η2 is the threshold for candidate root causes in root cause localization; β1 is the KPI training dataset, β2 is the KPI test dataset, and β3 is the set of attribute value combinations corresponding to the KPI test dataset and their true values, predicted values, and expected values.

[0087] 2) KPI data clustering

[0088] Clustering KPI data can improve the time efficiency of subsequent KPI anomaly detection. The clustering process is as follows: First, hierarchical agglomerative clustering (HAC) is used to classify the KPI training data. Then, the CE model is trained using the classified KPI data. Finally, the data to be detected is input into the CE model for clustering.

[0089] (a) Category Identification

[0090] The β1 dataset contains N rows of KPI training samples with values ​​at M time points and labels indicating whether the KPI is an anomaly, Xi Let represent the i-th row of KPI data, where i = 1, 2, 3, ..., N. The following are the specific steps for performing HAC clustering on the β1 dataset:

[0091] S1. Read the KPI data and the number of clusters n1 from the β1 dataset.

[0092] S2. Extract X from each row of the KPI data. i The samples are treated as a cluster.

[0093] S3. Use Euclidean distance as the distance metric to calculate the distance between each pair of clusters.

[0094] S4. Merge the two closest clusters.

[0095] S5. Repeat steps S3 and S4 to continue calculating and merging the remaining clusters until the number of clusters reaches n1.

[0096] S6. Cluster the data into categories y for each row of sample data. i (i = 1, 2, 3, ..., N) are stored in the β1 dataset.

[0097] (b) Training the CE model

[0098] The CE model structure is an improvement on the CNN model by adding an embedding layer. It consists of two layers: the upper layer includes a convolutional layer, a pooling layer, and a fully connected layer; the lower layer includes a parallel embedding layer. The specific steps for training the CE model are as follows:

[0099] S1. Calculate the cluster centroids. The first cluster centroid U is obtained by averaging the KPI training data of each clustered subset of the β1 dataset. f f = 1, 2, 3, ..., n1 Representative sample X i Corresponding category y i The first cluster centroid is determined, and the obtained centroid data is stored in the β1 dataset.

[0100] S2. Input the KPI training data of each cluster after clustering the β1 dataset and the corresponding first cluster centroid data into the CE model for training.

[0101] The upper layer of the CE model performs feature extraction on the KPI training data. The KPI training data is first processed through inner product multiplication in convolutional layers, with the number of filter maps set to 50, the stride set to 1, and the kernel size set to 10. Then, temporal feature processing is performed through pooling layers with a pooling size of 8. Finally, temporal feature extraction is performed through fully connected layers, with the activation function set to ReLU. The processed KPI training data is then fed into a Softmax layer, using SoftmaxLoss as the loss function for network training. The lower layer of the CE model primarily implements the iterative training task of the first cluster centroids. The centroid data is used for network training through embedding. Then, the temporal feature data obtained from the upper layer and the first cluster centroids trained by the embedding layer are simultaneously fed into Center Loss for error training.

[0102] The combination of Softmax Loss and Center Loss is used as the loss function for the entire CE model, as shown in Equation (1):

[0103]

[0104] Where: X i Let n1 be the number of KPI training data in the i-th row (i = 1, 2, 3, ..., N), and n1 be the number of KPI training data clusters. For category y i The weight of time, W f Let T represent the weights for class f (f = 1, 2, ..., n1), and let T denote the transpose. For category y i The bias, b f For a bias of class f (f = 1, 2, ..., n1), y i For X i The corresponding category, where N is the number of rows of KPI training data. Representative sample X i Corresponding category y i The centroid; λ1 is a set parameter, set to 1.

[0105] S3. Train the model, updating the weights and biases until the iteration count reaches m1, completing the training of the CE model. In this embodiment, the weights of the centroids of the first cluster of class f and the biases of the clusters in class f are updated to train the CE model; where f represents y. i The category.

[0106] (c) Input the data to be detected from the β2 dataset into the CE model for clustering, obtain the corresponding categories, and store them in the β2 dataset.

[0107] 3) KPI data anomaly detection

[0108] To address the issue of insufficient data learning leading to low generalization ability in existing single models, this embodiment employs multiple unsupervised models for representation learning, enabling different clusters of KPI data to fully learn features appropriate to them, thereby improving the model's generalization ability.

[0109] The KPI anomaly detection steps are as follows: First, six unsupervised models are used to learn representations of each class of data in the β1 dataset to obtain anomaly scores. Second, the anomaly scores are optimized to improve the efficiency of subsequent model training. Then, each class of data and its optimized anomaly scores are combined as input to train a high-performance LightGBM model. Finally, the β2 dataset to be detected is input into the LightGBM model for anomaly detection.

[0110] (a) Obtaining outlier scores

[0111] Six unsupervised models—LODA, HBOS, OCSVM, AE, VAE, and IFOreest—were used as basic anomaly detectors. Each KPI class in the β1 dataset was input into each model for representation learning, and the model's output was used as the outlier score for that KPI class. Since these six unsupervised models are existing technologies, only parameter descriptions are provided here. The key parameter settings for each model are as follows:

[0112] S1. Set the LODA model parameters: set the outlier percentage to 'a', the number of bins to 10, and the number of random cuts to 100. Input the training data for each KPI class into the LODA model for representation learning, and output the representation learning result as the outlier score, denoted as . f represents the corresponding category.

[0113] S2. Set the HBOS model parameters: set the number of bins to 10, the regularization term to prevent edge overflow to 0.1, the tolerance for data points falling outside the bins to 0.5, and the proportion of outliers to 'a'. Input the training data for each class of KPIs into the HBOS model for representation learning, and output the representation learning results as outlier scores, denoted as 'a'. f represents the corresponding category.

[0114] S3. Configure the OCSVM model parameters: kernel type is set to 'rbf', kernel function usage is set to 3, kernel coefficients are set to auto, tolerance for data points falling outside the box is set to 1e-3, upper bound for training error score and lower bound for support vector score are set to 0.5, heuristic search is used, maximum number of iterations is set to unlimited, and outlier proportion is set to 'a'. Input the training data for each class of KPIs into the OCSVM model for representation learning, and output the representation learning result as the outlier score, denoted as . f represents the corresponding category.

[0115] S4. Set the AE model parameters: hidden layer neurons are set to [38,16,2,2,16,38], hidden layer activation type is set to 'ReLU', output layer activation type is set to 'Sigmoid', loss function is set to mean squared error, optimizer is set to 'adam', number of iterations is set to 100, batch size is set to 512, decay rate is set to 0.2, L2 regularization coefficient is set to 1, validation ratio is set to 0.1, preprocessing is used, and the proportion of outliers is set to 'a'. Input each class of KPI data into the AE model for representation learning, and output the representation learning result as the outlier score, denoted as 'a'. f represents the corresponding category.

[0116] S5. Set the VAE model parameters: encoding neurons are set to [38, 16, 4], decoding neurons are set to [4, 16, 38], hidden layer activation type is set to 'ReLU', output layer activation type is set to 'sigmoid', loss function is set to mean squared error, optimizer is set to 'adam', number of iterations is set to 100, batch size is set to 512, decay rate is set to 0.2, L2 regularization coefficient is set to 0.1, validation ratio is set to 0.1, outlier percentage is set to 'a', kernel coefficient is set to 1.0, and maximum loss capacity is set to 0.0. Input the training data for each class of KPIs into the VAE model for representation learning, and output the representation learning result as the outlier score, denoted as . f represents the corresponding category.

[0117] S6. Set the IFOrest model parameters: set the number of random forest trees to 100, the maximum number of samples to 'auto', the outlier percentage to 'a', the number of attributes to be extracted from the total samples for training each tree to 1.0, the sampling method to sampling without replacement, and the number of parallel jobs to 1. Input the training data for each KPI class into the IFOrest model for representation learning, and output the representation learning result as the outlier score, denoted as . f represents the corresponding category.

[0118] (b) Preferred outlier scores

[0119] Selecting high-quality outlier scores can improve the accuracy of KPI anomaly detection while reducing space complexity. The specific steps are as follows:

[0120] S1. Read the KPI data for each category and its outlier scores, and select the number of outlier scores w1.

[0121] S2. Calculate the centroid volatility α f Read the centroid U of the first cluster in the β1 dataset. f Calculate the centroid volatility α for each type of KPI data. f Formula (2) is given by:

[0122]

[0123] Where: u f,t and u f,t+1 Indicates the center of mass U f The values ​​at time nodes t and t+1, where t = 1, 2, 3, ..., M-1, and M is the number of time nodes in the β1 dataset; max(U f ), min(U f ) represent the centroid U f The maximum and minimum values ​​of α; f Let f be the centroid volatility of the f-th class of KPI data in the first cluster, where f = 1, 2, 3, ..., n1. The numerator in the formula represents the overall variation amplitude of the centroid time series.

[0124] S3. Optimize outlier scores. Optimize the outlier scores obtained from each class of training data using the p-th unsupervised model. Optimization is performed to obtain the optimized outlier score. f represents the cluster category, p represents the index of the unsupervised model, and p = 1, ..., 6.

[0125]

[0126] In the formula: Let α be the outlier score of the p-th unsupervised model corresponding to the f-th class KPI data of the first cluster centroid. f Let g be the centroid volatility corresponding to the f-th class of KPI data in the first cluster, where f = 1, 2, 3, ..., n1. p λ represents the complexity of the p-th unsupervised model; λ2 is the adjustment factor, which is set to 2 in this invention.

[0127] S4. Calculate the ROC score for each type of KPI data as the area under the ROC curve, and store the highest ROC score for the optimized outlier in S. fIn the set f = 1, 2, ..., n1, use #(S f ) represents the set S to be selected. f The number of outlier scores is optimized, initially #(S) f The value is 1.

[0128] S5. If #(S f If S is greater than or equal to w1, then S f The set is saved as the optimized result, ending the optimization of outlier scores. Otherwise, proceed to step S6.

[0129] S6. Calculate the S values ​​for each category that were not selected. f Optimization outlier score of the set Evaluation value For formula (3):

[0130]

[0131] In the formula: the numerator uses the ROC score to measure the accuracy of selecting the p-th unsupervised model for the f-th class of KPI data in the first cluster centroid, s f The labels indicating whether the KPI data of the f-th class of the first cluster centroid are abnormal are from the initial β1 dataset; The outlier score of the p-th unsupervised model corresponding to the f-th class of KPI data in the first cluster centroid; The first cluster centroid and the f-th class KPI data are entered into S. f The q-th optimized outlier score in the set; q = 1, 2...#(S f ), #(S f ) represents the set S to be selected. f Optimize the number of outlier scores. for and set S f The sum of the Pearson correlation coefficients among all optimized outlier scores.

[0132] S7. Select the highest optimization outlier score for each category into S. f Set, #(S f )=#(S f )+1, execute step S5.

[0133] (c) Training the LightGBM model

[0134] Each type of KPI data and its corresponding S f The optimized outlier scores are input into the LightGBM model for training.

[0135] The LightGBM model parameters are set as follows: boost type is set to traditional gradient decision tree, objective function is set to 'regression', evaluation function is set to mean squared error and AUC, number of leaf nodes is set to 31, learning rate is set to 0.05, feature selection ratio for tree construction is set to 0.9, sample sampling ratio for tree construction is set to 0.8, and bagging_fraction is executed every 5 iterations.

[0136] The model is trained continuously until the number of iterations reaches m2, thus completing the training of the LightGBM model.

[0137] (d) Anomaly detection

[0138] The data to be detected in the β2 dataset is input into the trained LightGBM model to identify the KPI data to be detected that are abnormal.

[0139] 4) Root cause analysis of KPI anomalies

[0140] A KPI detected as an anomaly is selected from the β2 dataset. From the β3 dataset, the corresponding attribute value combinations (K rows, L columns) and their sets of true, predicted, and expected values ​​are selected and stored in the β4 dataset. The β4 dataset contains the set of attribute value combinations corresponding to the selected KPI, along with their true, predicted, and expected values. Anomaly root cause localization for this KPI is performed as follows: First, attribute value combinations with low anomaly impact are filtered. Then, the filtered attribute value combinations are clustered. Finally, an improved generalized latent score is used for anomaly root cause localization.

[0141] (a) Filtering attribute value combinations with low probability of anomalies

[0142] The specific steps for filtering attribute value combinations with low probability of anomalies are as follows:

[0143] S1. Calculate the deviation score ω corresponding to each row of attribute value combinations. e Formula (4) is given:

[0144]

[0145] Where, ε e This represents the attribute value combination in the e-th row of the KPI, where e = 1, ..., K, and K is the row number of the KPI attribute value combination; F(ε) e V(ε) represents the predicted value of the attribute value combination in the e-th row; e ) represents the true value of the attribute value combination in the e-th row; |(V(ε) e )-F(ε e))| represents the absolute value of the deviation of the attribute value combination in the e-th row; λ3 is the rationality coefficient, set to 0.6.

[0146] S2. Read the threshold η1 and compare the threshold η1 with the deviation score ω. e , will ω e Attribute value combinations ≤η1 are filtered out and removed to obtain attribute value combinations with a high probability of KPI anomalies, ε e' Let e' be the combination of attribute values ​​in the e'th row after filtering the KPI, where e' = 1, ..., K', and K' is the row number of the filtered KPI attribute value combinations.

[0147] (b) Clustering residual attribute value combination

[0148] To improve the efficiency of subsequent root cause analysis, the bias score d(ε) is used. e' Cluster the KPI attribute value combinations filtered in step (a), grouping attribute value combinations with high similarity in deviation scores into one class. The specific steps are as follows:

[0149] S1. Calculate the deviation score d(ε) for each row of attribute value combinations. e' ), which is formula (5):

[0150]

[0151] Where, ε e' This represents the combination of attribute values ​​in the e'-th row of the filtered KPI; F(ε) e' V(ε) represents the predicted value of the attribute value combination in row e'; e' ) represents the actual value of the attribute value combination in row e'.

[0152] S2. with d(ε) e' Using this as a benchmark, the number of combinations of abnormal attribute values ​​under each deviation score is calculated.

[0153] S3. Select the maximum relative value of the number of combinations of n2 attribute values, and use its deviation score as the second cluster centroid.

[0154] S4. Use the relative minimum values ​​near the centroid of the second cluster as the cluster boundary for clustering.

[0155] S5. Divide the KPI outlier attribute values ​​into n² clusters. Use B... v Let v represent the cluster category of each cluster, where v = 1, 2, 3...n².

[0156] (c) Root cause search

[0157] Different combinations of KPI attributes are defined as CD sets, and each attribute combination is called a Cd. The CD set is viewed as a tree, and each Cd is a node in the tree, to cluster category B. v Let v = 1, 2, 3...n², where the root is the 0th level of the tree. Each node in the first level of the tree consists of a single attribute, denoted as Cd(1,R1). Let R be the number of free combinations corresponding to the L attributes in the first level; each node in the second level of the tree consists of two attributes, denoted as Cd(2,R2). The second level has L attributes, which represent the number of free combinations. Each node in the H-th level of the tree consists of H attributes, denoted as Cd(H,R). H ), Let L be the number of free combinations corresponding to the L attributes in the Hth level; the last level is the L-1th level, and each node in the L-1th level of the tree consists of L-1 attributes, denoted as Cd(L-1, R). L-1 ), This represents the number of free combinations corresponding to the (L-1)th layer.

[0158] Using the improved Generalized Potential Score (IGPS) as the evaluation criterion, the combination of abnormal root cause attributes with high IGPS scores is selected as the candidate root cause for this KPI. The Composite Score (DS) is then used to filter the candidate root causes, yielding the final abnormal root causes. The specific KPI root cause search steps are as follows:

[0159] S1. Read the threshold η2 and set v = 1.

[0160] S2. Read the combination of KPI attribute values ​​of type v in step S5 of step (b).

[0161] S3. Based on the iteration number m in step S3, select the attribute combination of the m-th node in the first level of the tree corresponding to the CD set of this type.

[0162] S4. Determine whether the m-th node has been selected. If it has been selected, proceed to step i of S5. If it has not been selected, the m-th node is treated as the selected node and step S6 is executed.

[0163] S5.i. Determine whether the m-th node or the selected node has any unselected sibling nodes. If there are unselected sibling nodes, select the (m+1)-th sibling node as the selected node or select one of the unselected sibling nodes as the selected node, and proceed to step S6; if there are no sibling nodes, proceed to step S9.

[0164] ii. Determine if the selected node has child nodes. If it has child nodes, select the child node and proceed to step S6; if it has no child nodes, proceed to step S3.

[0165] S6. Attribute Combination Sort. Calculate the proportion of each attribute value combination corresponding to the selected node in this cluster to the total number of corresponding attribute value combinations, and sort them in descending order.

[0166] S7. Calculate the IGPS of each attribute value combination in the selected node according to formula (6) in sorting order, and select the IGPS of the selected node with the largest IGPS as the IGPS of the selected node. max .

[0167]

[0168] Where E1 is the attribute value combination obtained in this cluster; E2 is all remaining attribute value combinations in this cluster; V, F, and Z represent the true value, predicted value, and expected value of the attribute value combination, respectively; avg(·) represents the average value of the attribute value combination; P E1 This indicates the number of attributes in the desired attribute combination; λ4 is used as an adjustment coefficient and is set to 0.6.

[0169] Penalty term λ4P E1 It can remove some of the root causes of errors caused by noise to a certain extent, thereby limiting the number of root causes that may occur within a CD and improving the efficiency of model operation.

[0170] S8. If the selected node IGPS max If the value is greater than or equal to η2, then the IGPS will be... max The attribute value combination of the corresponding node is marked as a candidate root cause, and step i of S5 is executed; if the selected node selects IGPS max If it is less than η2, proceed to step ii of S5.

[0171] S9. Calculate the composite score. Calculate the composite score DS of all combinations of candidate root cause attribute values, as shown in formula (7):

[0172]

[0173] Where ele represents the number of rows of candidate root causes of the selected node in this class, decent represents the number of rows of all nodes in this class containing candidate anomalous root causes, lay represents the level of the tree corresponding to the node containing the candidate anomalous root cause in the cluster, and IGPS is the improved generalized latent score corresponding to the candidate root cause of the selected node.

[0174] S10. Store the root cause of the anomaly. The attribute value combination with the highest composite score DS is taken as the root cause of the anomaly for this class and stored in β5.

[0175] S11.v=v+1, if v≤n2, execute step S2, otherwise end the root cause localization of this KPI.

[0176] Continue selecting abnormal KPIs until the root cause of all abnormal KPIs is located, and use β5 as the output of the abnormal root cause of the KPI.

[0177] The tree corresponding to the v-th CD set has L levels. In this embodiment, the nodes in each level are arranged in the order of K, P, I, C attributes. In actual application, the arrangement shall be based on the actual attributes and the preset attribute arrangement rules, and the number of attribute categories contained in each node is consistent with the level number. The comprehensive attributes contained in each node are different from each other. If two nodes are located in adjacent levels and have an attribute inclusion relationship, the two nodes are called parent and child nodes, and the level number of the parent node + 1 = the level number of the child node. If two child nodes are in the same level and contain all the attributes of the parent node, the two nodes are called sibling nodes. In particular, in this embodiment, the nodes in the first level are defined as sibling nodes.

[0178] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data, characterized in that, Includes the following steps: Obtain the KPI training dataset; Hierarchical agglomerative clustering method is used to classify the KPI training data in the KPI training dataset. The CE model is trained using the labeled KPI training data, and the data to be detected is input into the trained CE model for clustering. The LightGBM model is trained based on outlier scores extracted by various unsupervised models and the KPI training dataset, and then the LightGBM model is used to detect outliers on the dataset to be detected. Anomaly root cause localization is performed on any anomalous data in the dataset to be detected based on the improved generalized latent score; The CE model is an improved model based on the CNN model with the addition of an embedding layer; The root cause of anomalies in any anomalous data in the dataset to be detected is located based on the improved generalized latent score, specifically including the following steps: Obtain any abnormal KPI data in the dataset to be detected that is abnormal; Obtain the attribute value combination corresponding to the abnormal KPI data, as well as the set of actual values, predicted values, and expected values; The attribute value combinations are filtered based on the anomaly probability. The filtered attribute values ​​are then grouped and clustered. The improved generalized latent score is used as an evaluation criterion to filter the clustered attribute value combinations to obtain the final abnormal root cause.

2. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 1, characterized in that, The specific steps for classifying the KPI training data in the KPI training dataset using the hierarchical agglomerative clustering method include: Read KPI data and cluster numbers from the KPI training dataset ; Each row of the KPI data The samples are treated as a cluster; Calculate the distance between any two clusters and merge the two closest clusters; Continue calculating the distance between every remaining two clusters and merging the remaining clusters until the number of clusters reaches a certain value. ; Clustering categories for each row of sample data ( =1,2,3...... N Store it in the KPI training dataset.

3. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 1, characterized in that, The CE network model network structure includes two layers: an upper layer and an lower layer. Upper layer: Convolutional layer - Pooling layer - Fully connected layer; Lower layer: Parallel Embedding layer.

4. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 1, characterized in that, Training a CE model specifically includes the following steps: Obtain the first cluster centroid of each KPI data group after clustering the KPI training dataset; The KPI training dataset is clustered, and each KPI data category and the corresponding first cluster centroid of each category are input into the CE model for training. renew The weights of the centroids of the first cluster are summed. The clustering bias is applied until the number of training iterations reaches m1, at which point the CE model completes training. Wherein, the centroid of the first cluster in each class is the average value of the KPI training data of each class; in the CE model, the upper layer of the CE model extracts features from the KPI training data; the lower layer of the CE model iteratively trains the centroid of the first cluster.

5. The method for detecting and locating root causes of enterprise intelligent operation and maintenance KPI data anomalies according to claim 4, characterized in that, The LightGBM model is trained based on outlier scores extracted by various unsupervised models and the KPI training dataset. The LightGBM model is then used to detect anomalies on the dataset to be detected. The specific steps include: Multiple unsupervised models are used to learn representations of each class of data in the KPI training dataset to obtain outlier scores. The outlier scores are optimized. The LightGBM model is trained based on the optimal results of each data type and the outlier scores; The dataset to be detected is input into the trained LightGBM model to obtain anomaly detection results.

6. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 5, characterized in that, The optimization of the outlier scores specifically includes the following steps: S1. Read the training data for each type of KPI and its outlier scores, and select the number of outlier scores w1; S2. Calculate the centroid volatility Read the first cluster centroid from the KPI training dataset. Calculate the centroid volatility of the training data for each type of KPI. ; S3. Optimize outlier scores; S4. Calculate the ROC score for each class of KPI training data, and store the optimization outlier score corresponding to the highest ROC score. In the set, =1,2...... ,use Indicates the selected set The number of optimized outlier scores, initially =1; S5. Judgment Is the condition greater than or equal to w1 true? If true: [The condition is missing here, likely indicating a missing element or value]. The set is saved as the optimized result, and the optimization of outlier scores ends; if not, proceed to step S6. S6. Calculate the number of unselected categories sequentially. Optimization outlier score of the set Evaluation value ; S7. Select the highest optimized outlier score for each evaluation category. gather, = +1, execute step S5 in the specific steps of the final abnormal root cause.

7. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 1, characterized in that, The specific steps for filtering the attribute value combinations based on the anomaly probability include: Calculate the deviation score for each row of attribute combinations; Obtain a judgment threshold and compare the judgment threshold with the deviation score; Delete the attribute value combinations whose deviation scores are less than or equal to the judgment threshold.

8. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 1, characterized in that, The filtered attribute values ​​are then grouped and clustered, specifically including the following steps: S1. Calculate the deviation score for each row of attribute value combinations. The expression is: in, This represents the combination of attribute values ​​in the e'-th row of the filtered KPI; This represents the predicted value of the attribute value combination in row e'; This represents the actual value of the attribute value combination in row e'; S2. with As a metric, the number of combinations of anomalous attribute values ​​under each of the aforementioned deviation scores is calculated; S3. Select The relative maximum value of the number of combinations of attribute values ​​is used as the deviation score of the second cluster centroid. S4. Use the relative minimum values ​​near the centroid of the second cluster as the cluster boundary for clustering; S5. Divide KPI abnormal attribute value combinations into In each cluster category, using This represents the cluster category for each class, v=1,2,3... .

9. The method for detecting and locating root causes of anomalies in enterprise intelligent operation and maintenance KPI data according to claim 8, characterized in that, The specific steps for using the improved generalized latent score as an evaluation criterion to filter the clustered attribute value combinations and obtain the final anomaly root cause include: S1. Obtain the discrimination threshold; S2. Read the combination of KPI attribute values ​​for the vth class; S3. Based on the number of iterations m in step S3, select the m-th node in the first level of the tree corresponding to the v-th CD set; S4. Determine whether the m-th node mentioned in step S3 has been selected. If it has been selected, execute step i of step S5 in the specific steps of the final abnormal root cause. If it has not been selected, select the m-th node as the selected node and execute step S6. S5.i. Determine whether the m-th node or the selected node has any unselected sibling nodes. If there are unselected sibling nodes, select the (m+1)-th sibling node as the selected node or select one of the unselected sibling nodes as the selected node, and proceed to step S6; if there are no sibling nodes, proceed to step S9. ii. Determine whether the selected node has child nodes. If it has child nodes, select the child nodes and proceed to step S6. If it has no child nodes, proceed to step S3 to select the selected node at the first level of the tree corresponding to the v-th CD set. S6. Calculate the proportion of the number of attribute value combinations of the selected node corresponding to the attribute combination in the v-th cluster to the total number of corresponding attribute value combinations, and sort them in descending order; S7. Calculate the IGPS of each attribute value combination in the selected nodes according to the IGPS expression in sorted order, and select the node with the largest IGPS as the selected node's IGPS. max ; S8. If the selected node IGPS max If the value is greater than or equal to the discrimination threshold, the IGPS will be... max The attribute value combination of the corresponding node is marked as a candidate root cause, and step i of step S5 in the specific steps of the final abnormal root cause is executed; if the IGPS of the selected node... max If the value is less than the discrimination threshold, step S5ii of the specific steps for determining the final abnormal root cause is executed; S9. Calculate the composite score DS for all combinations of candidate root cause attribute values; S10. Take the attribute value combination with the highest comprehensive score DS as the root cause of the anomaly in this class and store it in the KPI root cause output dataset.

Images