A root cause analysis method, device and equipment for alarm clustering and a storage medium

Abstract

The application discloses a kind of root cause analysis method, device and equipment of warning clustering and storage medium.It is determined that the method includes: according to key alarm, abnormal node and abnormal edge are determined, and candidate abnormal propagation graph is generated according to the abnormal node and abnormal edge;Abnormal deviation filtering is carried out on abnormal node in the candidate abnormal propagation graph, and valid abnormal propagation graph is obtained;Abnormal node in the valid abnormal propagation graph is clustered and root cause analysis is carried out, and candidate root cause node and the root cause possibility probability of each candidate root cause node are obtained.The accuracy and stability of root cause positioning can be improved in the embodiment of the application.

Description

Technical Field

[0001] This invention relates to the field of fault analysis technology, and in particular to a root cause analysis method, apparatus, device and storage medium for alarm clustering. Background Technology

[0002] Large enterprises have very complex business processes, and their network service systems contain a large number of different types of business activities. These different business activities form multiple business flows, each of which depends on different services, components, and infrastructure.

[0003] When a service fails, it can affect other downstream services. Therefore, accurately and efficiently locating anomalies and finding their root causes is crucial. The complexity and diversity of the service flow itself further increase the difficulty of analyzing its alerts. Summary of the Invention

[0004] This invention provides a root cause analysis method, apparatus, device, and storage medium for alarm clustering to improve the accuracy and stability of root cause localization.

[0005] According to one aspect of the present invention, a root cause analysis method for alarm clustering is provided, comprising:

[0006] Based on key alarms, identify abnormal nodes and abnormal edges, and generate a candidate anomaly propagation graph based on the abnormal nodes and abnormal edges;

[0007] The abnormal nodes in the candidate anomaly propagation graph are filtered by anomaly deviation to obtain an effective anomaly propagation graph.

[0008] Clustering and root cause analysis are performed on the abnormal nodes in the effective anomaly propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node.

[0009] According to another aspect of the present invention, a root cause analysis apparatus for alarm clustering is provided, comprising:

[0010] An anomaly information determination module is used to determine anomaly nodes and anomaly edges based on key alarms, and to generate a candidate anomaly propagation graph based on the anomaly nodes and anomaly edges.

[0011] An anomaly information filtering module is used to filter the anomaly nodes in the candidate anomaly propagation graph by anomaly deviation to obtain an effective anomaly propagation graph.

[0012] The anomaly root cause determination module is used to cluster and perform root cause analysis on the anomaly nodes in the effective anomaly propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the root cause analysis method for alarm clustering according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the root cause analysis method for alarm clustering as described in any embodiment of the present invention.

[0018] This invention constructs an anomaly propagation graph and then uses alarm clustering analysis technology to cluster and filter nodes in the anomaly propagation graph, ultimately obtaining the possible root causes of key alarms and the probability of each possible root cause, thereby improving the accuracy and stability of root cause localization.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1A This is a flowchart of a root cause analysis method for alarm clustering according to an embodiment of the present invention;

[0022] Figure 1B This is a schematic diagram of an anomaly propagation graph provided according to an embodiment of the present invention;

[0023] Figure 2A This is a flowchart of a root cause analysis method for alarm clustering according to another embodiment of the present invention;

[0024] Figure 2B This is a flowchart of a root cause analysis of alarm clustering according to another embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of a root cause analysis device for alarm clustering according to another embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of an electronic device that implements an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] Figure 1A This is a flowchart illustrating a root cause analysis method for alarm clustering according to an embodiment of the present invention. This embodiment is applicable to methods that use business flow dependency graphs and key alarm-related indicator data as input. It constructs an alarm correlation graph through the relationship between business flows and the system, and then proceeds through three steps: candidate anomaly propagation graph construction, anomaly node filtering, and root cause ranking. Finally, it outputs a set of candidate root cause nodes ranked by probability. This method can be executed by an alarm clustering root cause analysis device, which can be implemented in hardware and / or software and can be configured in an electronic device with corresponding computing capabilities. Figure 1A As shown, the method includes:

[0030] S110. Determine abnormal nodes and abnormal edges based on key alarms, and generate a candidate abnormal propagation graph based on the abnormal nodes and abnormal edges.

[0031] Each exception node (element) in the exception propagation graph includes three fields: <service, entity object, exception>. The construction of the exception propagation graph is triggered by configured critical alarms (e.g., the graph construction begins upon receiving a critical alarm). In addition to the alarm content, critical alarms should include the following fields: trigger time, business service, and entity object. For example... Figure 1B The diagram illustrates an anomaly propagation graph. Each node in the graph represents a combination of <anomaly location, anomaly type>. If a directed edge exists between node A and node B, it indicates that an anomaly in node A may be caused by an anomaly in node B. For example, if service X of business 2 is deployed on container 4, there might be an edge in the anomaly propagation graph that reads <Business 2 - Service X, metric A suddenly increases> - <Container 4, insufficient memory>.

[0032] Specifically, this invention accesses alarm signals and other anomaly detection results (including metric monitoring, logs, etc.) through various methods. The alarm signals may originate from third-party automated anomaly detection tools, fault alarm signals issued by operations and maintenance personnel, etc. Based on various fields of the fault alarm, preliminary screening is performed, selecting key alarms (such as alarms related to critical business failures) as trigger conditions to execute the process of this invention. After triggering, the anomaly nodes and anomaly edges corresponding to the key alarm are determined based on business service dependency and deployment relationship data, resulting in a temporary alarm association graph. This temporary alarm association graph is then adjusted according to manual rules to obtain the final alarm association graph. Using associated alarms and other anomaly events related to the key alarm, anomalies are added to the alarm association graph to obtain a candidate anomaly propagation graph.

[0033] S120. Filter the abnormal nodes in the candidate abnormal propagation graph by abnormal deviation to obtain an effective abnormal propagation graph.

[0034] Anomalies can be categorized into two types: numerical and non-numerical. Anomaly deviation is a numerical value that characterizes the degree of anomaly in a node; the higher the degree of anomaly, the larger the absolute value of this value, and the lower the degree of anomaly, the closer the deviation is to 0.

[0035] Specifically, for a specific critical alarm that is triggered, the anomalies of nodes in the candidate anomaly propagation graph may be unrelated to the initially triggered critical alarm, thus requiring further processing of the anomaly nodes. The processing of anomaly nodes includes three steps: anomaly degree calculation, anomaly filtering, and clustering screening. The main flow of the first two steps involved in step S120 is as follows: For each node <service, entity object, anomaly> in the anomaly propagation graph, the anomaly in its anomaly field is calculated. For non-numerical anomalies, since they cannot be calculated and occur infrequently in practice, they are only used as nodes in the connected graph and do not participate in deviation calculation or final sorting. For numerical anomalies, the anomaly deviation of their indicators can be calculated to characterize the specific anomaly degree. A predetermined threshold for the anomaly deviation is pre-set. All anomaly nodes in the candidate anomaly propagation graph whose anomaly deviation does not meet the threshold requirement are filtered out, and the anomaly edges corresponding to these nodes are deleted, resulting in an effective anomaly propagation graph.

[0036] S130. Cluster and root cause analysis are performed on the abnormal nodes in the effective anomaly propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node.

[0037] Specifically, the main process of the last step involved in step S130 is as follows: According to the ripple effect, the deviation of abnormal nodes caused by the same root cause will be very similar. A clustering algorithm is used to group abnormal nodes caused by the same root cause in the effective anomaly propagation graph into one class, resulting in multiple clusters. A candidate root cause graph is generated based on the clusters most likely to contain the root cause, and each abnormal node in the candidate root cause graph is used as a candidate root cause node. The root cause probability of each candidate root cause node is calculated, and finally, a set of root cause probability values ​​for the candidate root cause nodes is output. This allows operations and maintenance personnel to quickly determine the root cause of the fault propagation when they receive the root cause probability values ​​of each candidate root cause node in a critical alarm.

[0038] This invention constructs an anomaly propagation graph and then uses alarm clustering analysis technology to cluster and filter nodes in the anomaly propagation graph, ultimately obtaining the possible root causes of key alarms and the probability of each possible root cause, thereby improving the accuracy and stability of root cause localization.

[0039] Figure 2A This is a flowchart illustrating a root cause analysis method for alarm clustering, provided as another embodiment of the present invention. This embodiment is an optimization and improvement upon the above embodiment. Figure 2A As shown, the method includes:

[0040] S210. Based on the business service dependencies of key alarms, deployment relationship data, and manual rules, determine the abnormal nodes and the abnormal edges between each abnormal node.

[0041] S220. Generate an alarm association graph based on the abnormal nodes and abnormal edges, and add and complete the alarm association graph based on the relevant faults and related abnormal events of the key alarms to obtain an abnormal propagation graph.

[0042] Specifically, upon receiving a triggered critical alarm, the process of constructing an anomaly propagation graph begins. First, for the business service corresponding to the input critical alarm, each business flow and its corresponding entity object are examined, forming an initial set of services and entity objects. For each <service, entity object> element in the set, CMDB, knowledge graph, or manual rules are used to detect all services, systems, and other forms of entity objects (e.g., deployment units, servers, virtual machines, etc.) associated with the aforementioned business, service, and entity object. Nodes associated with these services, systems, other forms of entity objects, and elements in the previous set are designated as nodes. Nodes with association relationships are linked to each other, resulting in a temporary alarm association graph. Based on defined manual rules, additional additions, deletions, and modifications are made to the temporary alarm association graph to generate the final alarm association graph. For each <service, entity object> node in the alarm association graph, related alarms and other anomalies before and after the critical alarm triggering time period are queried. The query conditions are as follows: i) the time is before or after the critical alarm time period (specified by configuration); ii) they belong to the same entity object.

[0043] Continue to refer to Figure 1B The system will query for anomalies in the following entity objects: Business 1, Business 2 - Service X, Business 3, and Container 4. The final anomalies found will be added to nodes in the alarm association graph, serving as the output of the candidate anomaly propagation graph. The node format of the anomaly propagation graph is <Service, Entity Object, Anomaly>.

[0044] It should be noted that a node may have multiple anomalies. In this case, the node is split into multiple nodes, each of which inherits the edges of the original node, and fully connected edges are established between the split nodes.

[0045] Optionally, the deployment relationship data includes configuration management database data and knowledge graph; the manual rules include deletion rules and supplementary rules for relationships.

[0046] Specifically, the Configuration Management Database (CMDB) or Knowledge Graph contains the following information: business service-metrics, business service-deployment unit / server / container, deployment unit-server, server-server, server-container, and other relationships. Manual rules are expert rules pre-configured by operations personnel to supplement dependencies. When data is missing from the business flow, CMDB, or Knowledge Graph, manual rules can be used to determine the relationships between services and entity objects in the business flow. The main function of manual rules is to delete or supplement relationships in the generated alarm relationship graph: 1) Deletion: Expert rules can specify relationships to be deleted to avoid unnecessary additional detection (such as test environment nodes, inactive machine nodes, etc.); 2) Supplementation: Expert rules can specify relationships between entities to establish an accurate propagation graph when the system's own relationship data is missing.

[0047] S230. Calculate the abnormal deviation degree of each abnormal node in the candidate abnormal propagation graph; filter out invalid abnormal nodes and corresponding abnormal edges in the candidate abnormal propagation graph whose abnormal deviation degree does not meet the abnormal deviation degree requirements, and obtain an effective abnormal propagation graph.

[0048] Among them, invalid abnormal nodes are those whose abnormality level can be determined based on the degree of abnormality deviation, and whose probability of being the root cause of key alarms is low, so they do not need to participate in subsequent root cause analysis.

[0049] Specifically, machine learning is used to analyze correlated alarms based on historical data. A dynamic threshold algorithm is used to calculate the deviation threshold t for each abnormal node. For any abnormal node, if the calculated abnormal deviation d(e) falls within the theoretical normal range [-t, t] of that node, then that node is determined not to participate in subsequent root cause analysis, and the abnormal node and its corresponding edge are removed from the candidate abnormal propagation graph. The above process is repeated for all abnormal nodes to obtain the effective abnormal propagation graph.

[0050] Optionally, calculating the anomaly deviation of each anomaly node in the candidate anomaly propagation graph includes:

[0051] Obtain the true value and baseline value of the indicator for the current abnormal node in the candidate anomaly propagation graph, and determine the anomaly deviation degree of the current abnormal node based on the true value and baseline value. Alternatively, obtain the true value and predicted value of the indicator for the current abnormal node in the candidate anomaly propagation graph, and determine the anomaly deviation degree of the current abnormal node based on the true value and predicted value.

[0052] Specifically, the degree of anomaly of a node can be determined by the deviation between its outlier values ​​and the baseline value. The formula is as follows:

[0053]

[0054] Where d(e) represents the abnormal deviation of the indicator, v(e) represents the true value of the indicator (included in the alarm information), and b(e) represents the benchmark value of the indicator. If b(e) = 0, then the reference benchmark value obtained through expert rule configuration is used to replace the denominator in the above formula.

[0055] If the alarm message does not contain a baseline value, the deviation can be calculated using the following formula:

[0056]

[0057] Where d(e) represents the abnormal deviation of the indicator, and f(e) and v(e) represent the predicted value and the actual value of the indicator (included in the alarm information), respectively. This invention uses an autoregressive moving average model (ARMA) to calculate the predicted value f(e) based on the historical data of the indicator.

[0058] S240. Cluster the abnormal nodes in the effective abnormal propagation graph using a clustering algorithm to obtain a cluster that includes the key alarm.

[0059] S250. Generate a candidate root cause graph based on the clusters, and identify the abnormal nodes in the candidate root cause graph as candidate root cause nodes; determine the root cause probability of each candidate root cause node through a sorting algorithm.

[0060] The sorting algorithm can be an existing, well-established algorithm, such as the PageRank algorithm.

[0061] Specifically, fixed-parameter clustering methods are highly sensitive to parameters, which can affect the accuracy and stability of subsequent root cause localization. This invention uses non-parameterized clustering algorithms, such as kernel density estimation (KDE), K-minimum Nearest Neighbors (KNN), and DBSCAN. Based on the anomaly deviation, anomalous nodes with similar anomalous behavior are grouped into multiple clusters. The clusters containing key alarms are the set of possible root cause nodes after filtering out anomalous nodes, which is the main object of root cause analysis. A candidate root cause graph is determined based on the connections between anomalous nodes in the cluster. The anomalous nodes in the candidate root cause graph are the possible root cause nodes of key alarms. For all root cause nodes in the candidate root cause graph, a ranking algorithm is used to obtain the root cause probability of each root cause node, outputting a set of candidate root cause nodes ranked by root cause probability.

[0062] Optionally, generating a candidate root cause map based on the clusters includes:

[0063] Multiple subgraphs of the effective anomaly propagation graph are generated based on the connection relationships between the abnormal nodes in the cluster, wherein the connection relationships include whether there is an abnormal edge between two abnormal nodes; the largest subgraph including the key alarm is determined as the candidate root cause graph.

[0064] Specifically, for all nodes in a cluster, query whether any two nodes have an anomalous edge connecting them in the anomaly propagation graph. If so, record the anomalous edge. After traversing the cluster, all nodes in the cluster and the anomalous edges recorded in the above process constitute a subgraph G of the original anomaly propagation graph.

[0065] Optionally, the clustering algorithm includes the KNN algorithm, the DBSCAN algorithm, and the KDE algorithm.

[0066] The KDE algorithm takes the anomaly deviation of all anomalous nodes as input and uses a Gaussian kernel to obtain the deviation distribution density function. The bandwidth parameter of KDE can be adaptively calculated based on the data, using Silverman's rule, i.e.

[0067]

[0068] Where n is the number of outlier nodes, d is the data dimension (1 in this invention), and σ is the standard deviation of the deviation sequence. Then, the density function values ​​of different outlier nodes are calculated to obtain some maxima and minima. Different maxima are used as cluster centers, and nearby minima are used as cluster boundaries, thus obtaining multiple clusters.

[0069] The KNN algorithm calculates the k nearest neighbors of a sample in the feature space, and then calculates the cluster of the sample itself based on the clustering results of its nearest neighbors.

[0070] The DBSCAN algorithm heuristically computes values ​​using the neighborhood radius ∈, the neighborhood density threshold M, and a parameter k. The distance between the k-th neighbor of a data point x and itself is called dist. k When all points are sorted, the dist... k After the image, you can add dist k The point of sudden change is taken as the threshold. All points below the threshold are the core points. The threshold is the required ∈, and k+1 is M.

[0071] The three algorithms perform differently on different types of data. You can choose one as the clustering method according to the actual use scenario, or determine the final classification result by weighted voting based on the calculation results of the three algorithms according to manually configured parameters.

[0072] For example, Figure 1BThis is a flowchart of root cause analysis for alarm clustering according to an embodiment of the present invention. For each critical alarm triggered by a critical fault, the present invention generates a candidate anomaly propagation graph based on business service dependencies, deployment relationship data, and established manual rules. The deviation degree of each anomaly node in the anomaly propagation graph is calculated using a deviation degree algorithm based on the ripple effect. Impossible anomaly nodes are filtered out using a predetermined threshold based on the deviation degree. Clustering is then performed using a clustering algorithm to classify related alarms and anomaly events, filtering out possible anomaly nodes. For the anomaly nodes filtered out in the previous step, a corresponding candidate root cause graph is generated, and the probability of the anomaly node is obtained through a ranking algorithm. Finally, a set of candidate root cause nodes ranked by probability is output.

[0073] This invention, through its embodiments, summarizes, aggregates, filters, and classifies alarms within a certain time period based on the call relationships and business process relationships between system services, and sorts all suspected root cause alarms, thereby achieving in-depth mining and precise location of alarm root causes.

[0074] Figure 3 This is a schematic diagram of a root cause analysis device for alarm clustering, provided as another embodiment of the present invention. Figure 3 As shown, the device includes:

[0075] The anomaly information determination module 310 is used to determine anomaly nodes and anomaly edges based on key alarms, and to generate a candidate anomaly propagation graph based on the anomaly nodes and anomaly edges.

[0076] The anomaly information filtering module 320 is used to filter the anomaly nodes in the candidate anomaly propagation graph by anomaly deviation to obtain an effective anomaly propagation graph.

[0077] The anomaly root cause determination module 330 is used to cluster and perform root cause analysis on the anomaly nodes in the effective anomaly propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node.

[0078] The alarm clustering root cause analysis device provided in this embodiment of the invention can execute the alarm clustering root cause analysis method provided in any embodiment of the invention, and has the corresponding functional modules for executing the method.

[0079] Beneficial effects

[0080] Optionally, the anomaly information filtering module 320 includes:

[0081] The deviation calculation unit is used to calculate the deviation of each abnormal node in the candidate abnormality propagation graph.

[0082] An anomaly information filtering unit is used to filter out invalid anomaly nodes and corresponding anomaly edges in the candidate anomaly propagation graph whose anomaly deviation does not meet the anomaly deviation requirement, so as to obtain an effective anomaly propagation graph.

[0083] Optionally, the deviation calculation unit is used to obtain the true value and benchmark value of the indicator of the current abnormal node in the candidate abnormality propagation graph, and determine the abnormal deviation of the current abnormal node based on the true value and benchmark value; or, to obtain the true value and predicted value of the indicator of the current abnormal node in the candidate abnormality propagation graph, and determine the abnormal deviation of the current abnormal node based on the true value and predicted value.

[0084] Optionally, the root cause determination module 330 includes:

[0085] An abnormal node clustering unit is used to cluster abnormal nodes in the effective abnormal propagation graph using a clustering algorithm to obtain clusters including the key alarms.

[0086] The abnormal root cause determination unit is equivalent to generating a candidate root cause map based on the cluster and determining the abnormal nodes in the candidate root cause map as candidate root cause nodes.

[0087] The abnormal root cause sorting unit is equivalent to determining the root cause probability of each candidate root cause node through a sorting algorithm.

[0088] Optionally, the anomaly root cause determination unit is specifically used to generate multiple subgraphs of the effective anomaly propagation graph based on the connection relationships between each anomaly node in the cluster, wherein the connection relationships include whether there is an anomaly edge between two anomaly nodes; and to determine the largest subgraph including the key alarm as the candidate root cause graph.

[0089] Optional clustering algorithms include KNN, DBSCAN, and KDE.

[0090] Optionally, the anomaly information determination module 310 includes:

[0091] The association information determination unit is used to determine abnormal nodes and abnormal edges between each abnormal node based on the business service dependencies, deployment relationship data and manual rules of key alarms.

[0092] An anomaly information determination unit is used to generate an alarm association graph based on the anomaly nodes and anomaly edges, and to add and complete the alarm association graph to obtain an anomaly propagation graph based on the related faults and related anomaly events of the key alarms.

[0093] The alarm clustering root cause analysis device further explained can also execute the alarm clustering root cause analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0094] Figure 4 A schematic diagram of an electronic device 40 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0095] like Figure 4 As shown, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded into the RAM 43 from storage unit 48. The RAM 43 may also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0096] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0097] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as the root cause analysis method for alarm clustering.

[0098] In some embodiments, the root cause analysis method for alarm clustering may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the root cause analysis method for alarm clustering described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to perform the root cause analysis method for alarm clustering by any other suitable means (e.g., by means of firmware).

[0099] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0101] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0102] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0103] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0104] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0105] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0106] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A root cause analysis method for alarm clustering, characterized in that, The method includes: Based on key alarms, identify abnormal nodes and abnormal edges, and generate a candidate anomaly propagation graph based on the abnormal nodes and abnormal edges; The abnormal nodes in the candidate anomaly propagation graph are filtered by anomaly deviation to obtain an effective anomaly propagation graph. Clustering and root cause analysis are performed on the abnormal nodes in the effective anomaly propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node. The step of filtering abnormal nodes in the candidate anomaly propagation graph by anomaly deviation to obtain an effective anomaly propagation graph includes: Calculate the anomaly deviation of each anomaly node in the candidate anomaly propagation graph; the anomaly deviation is a value that characterizes the degree of anomaly of the node. The higher the degree of anomaly, the larger the absolute value of this value. The lower the degree of anomaly, the closer the deviation is to 0. Filter out invalid abnormal nodes and corresponding abnormal edges in the candidate abnormal propagation graph that do not meet the abnormal deviation requirements to obtain an effective abnormal propagation graph; invalid abnormal nodes are those with low abnormality based on the abnormal deviation and low probability of being the root cause of critical alarms. The calculation of the anomaly deviation of each anomaly node in the candidate anomaly propagation graph includes: Obtain the true value and benchmark value of the indicator of the current abnormal node in the candidate abnormality propagation graph, and determine the abnormality deviation of the current abnormal node based on the true value and benchmark value. Alternatively, obtain the actual value and predicted value of the indicator of the current abnormal node in the candidate abnormality propagation graph, and determine the abnormality deviation of the current abnormal node based on the actual value and predicted value of the indicator.

2. The method according to claim 1, characterized in that, The clustering and root cause analysis of the abnormal nodes in the effective anomaly propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node includes: The abnormal nodes in the effective anomaly propagation graph are clustered using a clustering algorithm to obtain clusters that include the key alarms; A candidate root cause graph is generated based on the clusters, and the abnormal nodes in the candidate root cause graph are identified as candidate root cause nodes. The root cause probability of each candidate root cause node is determined by a sorting algorithm.

3. The method according to claim 2, characterized in that, The step of generating candidate root cause maps based on the clusters includes: Multiple subgraphs of the effective anomaly propagation graph are generated based on the connection relationships between each anomaly node in the cluster, wherein the connection relationships include whether there is an anomaly edge between two anomaly nodes; The largest subgraph containing the critical alarm is identified as a candidate root cause graph.

4. The method according to claim 2, characterized in that, The clustering algorithms include the KNN algorithm, the DBSCAN algorithm, and the KDE algorithm.

5. The method according to claim 1, characterized in that, The step of determining abnormal nodes and abnormal edges based on key alarms, and generating a candidate anomaly propagation graph based on the abnormal nodes and abnormal edges, includes: Based on the business service dependencies, deployment relationship data, and manual rules of key alarms, identify abnormal nodes and abnormal edges between each abnormal node; An alarm association graph is generated based on the abnormal nodes and abnormal edges, and an anomaly propagation graph is obtained by adding and completing the alarm association graph based on the related faults and abnormal events of the key alarms.

6. The method according to claim 5, characterized in that, The deployment relationship data includes configuration management database data and knowledge graph; the manual rules include deletion rules and addition rules for relationships.

7. A root cause analysis device for alarm clustering, characterized in that, The device includes: An anomaly information determination module is used to determine anomaly nodes and anomaly edges based on key alarms, and to generate a candidate anomaly propagation graph based on the anomaly nodes and anomaly edges. An anomaly information filtering module is used to filter the anomaly nodes in the candidate anomaly propagation graph by anomaly deviation to obtain an effective anomaly propagation graph. The abnormal root cause determination module is used to cluster and perform root cause analysis on the abnormal nodes in the effective abnormal propagation graph to obtain candidate root cause nodes and the root cause probability of each candidate root cause node. The abnormal information filtering module includes: The deviation calculation unit is used to calculate the deviation of each abnormal node in the candidate abnormality propagation graph. The deviation is a value that characterizes the degree of abnormality of the node. The higher the degree of abnormality, the larger the absolute value of the value. The lower the degree of abnormality, the closer the deviation is to 0. An anomaly information filtering unit is used to filter out invalid anomaly nodes and corresponding anomaly edges in the candidate anomaly propagation graph whose anomaly deviation does not meet the anomaly deviation requirement, so as to obtain an effective anomaly propagation graph; invalid anomaly nodes are those with low anomaly degree based on the anomaly deviation and low probability of being the root cause of critical alarms. The deviation calculation unit is used to obtain the true value and benchmark value of the indicator of the current abnormal node in the candidate abnormality propagation graph, and determine the abnormal deviation of the current abnormal node based on the true value and benchmark value; or, to obtain the true value and predicted value of the indicator of the current abnormal node in the candidate abnormality propagation graph, and determine the abnormal deviation of the current abnormal node based on the true value and predicted value.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the root cause analysis method for alarm clustering according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the root cause analysis method for alarm clustering as described in any one of claims 1-6.

Images