Abnormal root cause analysis method and device, storage medium and electronic equipment

Abstract

This disclosure provides an anomaly root cause analysis method, apparatus, storage medium, and electronic device, relating to the field of wireless communication technology. The anomaly root cause analysis method includes: obtaining target time-series data to be analyzed from a time-series database, and determining anomaly points in the target time-series data and a first set of root causes corresponding to the anomaly points; searching for associated data corresponding to the anomaly points in a process link library, and determining a second set of root causes for the anomaly data in the associated data; determining the intersection of the first and second root cause sets to obtain an intersection set; and determining the analysis result of the anomaly root cause analysis based on the intersection set. This disclosure can improve the accuracy and efficiency of root cause analysis of network anomaly alarms.

Description

Technical Field

[0001] This disclosure relates to the field of wireless communication technology, and more specifically, to an anomaly root cause analysis method, an anomaly root cause analysis device, a storage medium, and an electronic device. Background Technology

[0002] With the rapid development of 5G (Financial Generation Communication Technology), network elements are being split up to allow them to access the system via interfaces. This enables the 5G core network (5GC) to operate with finer granularity and looser coupling than traditional network elements, allowing for flexible deployment of network functions. However, this also increases the difficulty of root cause analysis of network anomalies and alarms. For example, to maintain the stability of the 5G core network, the speed requirements for handling and responding to anomalies and alarms are becoming increasingly stringent.

[0003] Currently, network operation and maintenance engineers perform root cause analysis of anomaly alarms manually based on experience. However, this approach has limitations. First, it cannot avoid potential biases inherent in human experience, and it struggles to accurately determine the root cause of alarms when there are numerous interfering factors, resulting in low accuracy. Second, with the application of technologies such as microservices, the networking of 5GC services has become more complex, and the data volume is enormous, leading to lower efficiency in manual analysis and decision-making.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide an anomaly root cause analysis method, an anomaly root cause analysis device, a storage medium, and an electronic device, thereby overcoming, to at least a certain extent, the technical problem of low accuracy and efficiency in root cause analysis of network anomaly alarms due to limitations and defects in related technologies.

[0006] According to a first aspect of this disclosure, an anomaly root cause analysis method is provided, comprising: obtaining target time series data to be analyzed from a time series database, and determining anomaly points in the target time series data and a first root cause set corresponding to the anomaly points; searching for associated data corresponding to the anomaly points in a process link library, and determining a second root cause set of the anomaly data in the associated data; determining the intersection of the first root cause set and the second root cause set to obtain an intersection set; and generating an analysis result of the anomaly root cause analysis based on the intersection set.

[0007] Optionally, the step of determining the first root cause set corresponding to the outlier location includes: generating multiple search spaces based on multiple thresholds required by the pre-configured root cause analysis algorithm and multiple preset values ​​for each threshold; performing algorithmic analysis on the data of the outlier location in the multiple search spaces to obtain the first root cause set corresponding to the outlier location.

[0008] Optionally, the step of searching for the associated data corresponding to the abnormal points in the process link library and determining the second root cause set of the abnormal data in the associated data includes: searching for the second root cause set corresponding to the abnormal data in the process link library; wherein, the root cause set stored in the process link library is each historical abnormal point in the target time series data at a historical time and the historical root cause set corresponding to each historical abnormal point.

[0009] Optionally, the step of determining the analysis result of the abnormal root cause analysis based on the intersection set includes: if the intersection set of the first root cause set and the second root cause set is not empty, then the frequency of each root cause in the first root cause set is updated based on the intersection root causes in the second root cause set that intersect with the first root cause set; and the root causes in the first root cause set whose frequency is greater than a first preset value after the frequency update are determined as the analysis result of the abnormal root cause analysis.

[0010] Optionally, the step of determining the first root cause set corresponding to the anomaly location includes: determining the initial root cause set corresponding to the anomaly location; and determining the root causes in the initial root cause set whose frequency is greater than a first preset value as the first root cause set.

[0011] Optionally, the step of determining the analysis result of the abnormal root cause analysis based on the intersection set includes: if the intersection set of the first root cause set and the second root cause set is empty, then the root cause in the second root cause set whose frequency is greater than the second preset value is determined as the first target root cause; and the first root cause set and the first target root cause are determined as the analysis result of the abnormal root cause analysis.

[0012] Optionally, the step of determining the analysis results of the abnormal root cause analysis based on the intersection set includes: if the intersection set of the first root cause set and the second root cause set is not empty, then the frequency of each root cause in the first root cause set is updated based on the second target root cause in the second root cause set that intersects with the first root cause set; and each root cause in the first root cause set after the frequency update is determined as the analysis results of the abnormal root cause analysis.

[0013] According to a second aspect of this disclosure, an anomaly root cause analysis apparatus is provided, comprising: an information acquisition module configured to acquire target time-series data to be analyzed from a time-series database, and determine anomaly points in the target time-series data and a first set of root causes corresponding to the anomaly points; a data search module configured to search for associated data corresponding to the anomaly points in a process link library, and determine a second set of root causes of the anomaly data in the associated data; an intersection determination module configured to determine the intersection of the first set of root causes and the second set of root causes, thereby obtaining an intersection set; and an analysis result generation module configured to generate analysis results of the anomaly root cause analysis based on the intersection set.

[0014] Optionally, the information acquisition module is configured to generate multiple search spaces based on multiple thresholds required by the pre-configured root cause analysis algorithm and multiple preset values ​​of each threshold; and to perform algorithmic analysis on the data of outlier locations in the multiple search spaces to obtain the first root cause set corresponding to the outlier locations.

[0015] Optionally, the data lookup module is configured to look up the second root cause set corresponding to the abnormal data from the process link library; wherein, the root cause set stored in the process link library is each historical abnormal point in the target time series data at a historical time and the historical root cause set corresponding to each historical abnormal point.

[0016] Optionally, the analysis result generation module is configured to update the frequency of each root cause in the first root cause set based on the intersection root causes in the second root cause set that intersect with the first root cause set if the intersection set of the first root cause set is not empty; and to determine the root causes in the first root cause set whose frequency is greater than a first preset value after the frequency update as the analysis result of the abnormal root cause analysis.

[0017] Optionally, the information acquisition module is configured to determine the initial root cause set corresponding to the abnormal location; and to determine the root causes in the initial root cause set whose frequency is greater than a first preset value as the first root cause set.

[0018] Optionally, the analysis result generation module is configured to, if the intersection of the first root cause set and the second root cause set is empty, determine the root cause in the second root cause set whose frequency is greater than the second preset value as the first target root cause; and determine the first root cause set and the first target root cause as the analysis result of the abnormal root cause analysis.

[0019] Optionally, the analysis result generation module is configured to update the frequency of each root cause in the first root cause set based on the second target root cause in the second root cause set that intersects with the first root cause set if the intersection set of the first root cause set and the second root cause set is not empty; and to determine each root cause in the first root cause set after the frequency update as the analysis result of the abnormal root cause analysis.

[0020] According to a third aspect of this disclosure, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements any of the above-described methods for analyzing the root causes of anomalies.

[0021] According to a fourth aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above-described root cause analysis methods by executing the executable instructions.

[0022] In some embodiments of this disclosure, the technical solutions involve obtaining target time-series data to be analyzed from a time-series database, determining anomalies in the target time-series data and a first root cause set corresponding to the anomalies; searching for associated data corresponding to the anomalies in a process link library, and determining a second root cause set of the anomalies in the associated data; determining the intersection of the first root cause set and the second root cause set to obtain the intersection set; and determining the analysis results of the anomaly root cause analysis based on the intersection set.

[0023] This method, based on the traditional approach of determining the first root cause set corresponding to outliers using time series data, mines all indicator data associated with outliers from a known process link library, and obtains the second root cause set corresponding to the outliers among the associated indicators. The final analysis result is obtained based on the intersection of the first and second root cause sets. This method not only overcomes the technical problems of low efficiency and accuracy of manual methods, but also overcomes the technical problem of low accuracy in root cause analysis based solely on determining the root cause set corresponding to outliers using time series data, thereby improving the accuracy and efficiency of anomaly root cause analysis.

[0024] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0025] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0026] Figure 1 A schematic flowchart illustrating an anomaly root cause analysis method according to an exemplary embodiment of the present disclosure is shown.

[0027] Figure 2 The diagram schematically illustrates a system architecture diagram of an anomaly root cause analysis method according to an exemplary embodiment of the present disclosure;

[0028] Figure 3 The illustration schematically shows a flowchart of an anomaly root cause analysis method according to an exemplary embodiment of the present disclosure;

[0029] Figure 4 A schematic flowchart illustrating another anomaly root cause analysis method according to an exemplary embodiment of the present disclosure is shown.

[0030] Figure 5 The illustration shows a schematic diagram of the entire anomaly root cause analysis process according to an exemplary embodiment of the present disclosure;

[0031] Figure 6 A block diagram of an anomaly root cause analysis apparatus according to an exemplary embodiment of the present disclosure is schematically shown; and

[0032] Figure 7 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown schematically. Detailed Implementation

[0033] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0034] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0035] The flowchart shown in the attached diagram is merely an illustrative example and does not necessarily include all steps. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0036] To help those skilled in the art better understand the technical solutions of this disclosure, the relevant content involved in the technical solutions of this disclosure will be introduced below.

[0037] (1) Time series data: also known as time sequence data, is a sequence of data points arranged in chronological order. Data points in time series data whose values ​​do not conform to common sense and expectations are called outliers.

[0038] (2) Root cause analysis: The purpose is to determine the root cause of network anomalies. Root cause analysis is a method for analyzing and solving problems. It is a structured problem-solving method used to gradually find the root cause of the problem and solve it, rather than just focusing on the surface phenomenon of the problem.

[0039] The anomaly root cause analysis method provided in this exemplary embodiment can be applied to any network communication application scenario. For example, 5GC adopts a service-based architecture (SBA), introduces virtualization to separate the control plane and user plane, and compute and storage, fully supports network slicing, and can open interfaces to third parties, thus providing great convenience for network upgrades and expansions. However, with the rapid growth of 5G private network services, the increase in users, and the rapid growth of new technologies and services, in order to ensure that network services are in a long-term stable and available state, the requirements for the stability of 5GC, especially the response speed of anomaly alarm handling, are becoming increasingly higher, so that network operation and maintenance personnel can solve problems based on the root cause analysis results, thereby improving the overall security and quality of services.

[0040] In relevant technical solutions, the root causes of network anomaly alarms are typically analyzed manually based on the experience of network operations and maintenance personnel. However, the aforementioned technical solutions have the following technical problems:

[0041] 1) Limited by the limitations of human understanding. Relying solely on the experience of network operations personnel for root cause analysis of network anomaly alarms cannot avoid the biases inherent in human experience. Furthermore, in scenarios with numerous interfering factors, the cause determined by human experience may not be the root cause of the network anomaly alarm problem. Additionally, when some anomalies occur for the first time, there is no human experience to draw upon. Therefore, the aforementioned technical solutions result in low accuracy in root cause analysis of network anomaly alarms.

[0042] 2) Limited by human physiological limitations, it is impossible to continuously provide high-quality operation and maintenance services for large-scale, highly complex systems, and it is impossible to detect anomalies in performance indicators in a timely manner. In other words, with the rapid development and application of technologies such as microservices, the networking of 5GC services has become more complex, and the large number of data sources results in a massive data volume, ultimately making it more difficult to delineate and locate network faults. Therefore, the efficiency of manual analysis and decision-making is low, making it difficult to meet actual needs.

[0043] Furthermore, manually analyzing and determining the root causes of network anomaly alarms consumes a significant amount of human resources and increases network operation and maintenance costs.

[0044] In addition to the root cause analysis of manually implemented network anomaly alarms mentioned above, the root cause analysis of 5GC index anomalies in related technical solutions may also include, for example: Figure 1 The proposed solution is shown below. Figure 1 As shown:

[0045] Step 1: Obtain the data to be analyzed from the time series database and preprocess the data.

[0046] The second step is to perform artificial intelligence (AI) algorithm analysis on the data to be analyzed based on different threshold settings for each indicator parameter to obtain the root cause set corresponding to the anomaly points.

[0047] Step 3: Identify the root causes in the root cause set whose frequency is greater than the preset value as target root causes, and output the target root causes as the analysis results.

[0048] Figure 1 The technical solutions shown can overcome the technical problems of low efficiency, high human resource consumption, and high network operation and maintenance costs of the above-mentioned manual methods. However, the accuracy of the technical solutions in practical applications needs to be improved.

[0049] This exemplary embodiment addresses the aforementioned problems and proposes an anomaly root cause analysis method. This method, based on existing technical solutions that obtain target time-series data from a time-series database and determine a first set of root causes for anomaly points within that data, then searches a process link library for a second set of root causes for anomalous indicators in the associated data corresponding to the anomaly points. The final analysis result is output by finding the intersection of the first and second set of root causes. In other words, this method supplements the first set of root causes determined by traditional technical solutions by using a second set of root causes from the process link library for anomalous indicators in the associated data of the anomaly points. This overcomes the low efficiency and accuracy issues of existing technical solutions, thereby shortening the root cause analysis time for anomaly alarms and improving the efficiency and accuracy of anomaly response.

[0050] Figure 2 A schematic diagram illustrates a system architecture of an anomaly root cause analysis method according to an exemplary embodiment of the present disclosure, such as... Figure 2 As shown, the system includes a terminal device 201, a server 202, a time-series database 203, and a process link database 204. The terminal device 201 includes a display device (e.g., a monitor). The display device can be integrated on the terminal device 201 or it can be independent of the terminal device 201. This embodiment of the disclosure does not impose any special restrictions on this.

[0051] Among them, the time series database 203 stores the indicator parameters of the 5G core network at different time points in the workflow, while the process link database 204 stores the historical anomaly points and the root cause set corresponding to the historical anomaly points at historical moments in the workflow of the 5G core network.

[0052] It should be noted that server 202 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0053] It should be understood that, Figure 2 In the system architecture shown, the number of terminal devices 201, servers 202, time-series databases 203, and process link databases 204 is merely exemplary; more or fewer of these numbers are within the scope of this disclosure. Furthermore, in the above example operating scenario, the mobile terminal 11 can be, for example, a personal computer, server, mobile phone, PDA, point-of-sale (POS) system, smartwatch, laptop, or any other computing device with network connectivity. The network for communication between terminal devices 201, servers 202, time-series databases 203, and process link databases 204 can include various types of wired and wireless networks, such as, but not limited to: the Internet, local area networks (LANs), Wireless Fidelity (WIFI), Wireless Local Area Networks (WLANs), cellular communication networks (General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), 2G / 3G / 4G / 5G cellular networks), satellite communication networks, etc.

[0054] The anomaly root cause analysis method provided in this disclosure can be executed in server 202, and correspondingly, the anomaly root cause analysis device is generally located in server 202. The anomaly root cause analysis method provided in this disclosure can also be executed in terminal device 201, and correspondingly, the anomaly root cause analysis device can also be located in terminal device 201. The anomaly root cause analysis method provided in this disclosure can also be partially executed in server 202 and partially executed in terminal device 201; correspondingly, some modules of the anomaly root cause analysis device can be located in server 202 and some modules can be located in terminal device 201.

[0055] For example, in one exemplary embodiment, server 202 obtains the target time-series data to be analyzed from time-series database 203, and determines the outliers in the target time-series data and the first root cause set corresponding to the outliers; server 202 also searches for the associated data corresponding to the outliers in process link library 204, and determines the second root cause set of the outliers in the associated data. Then, server 202 determines the intersection of the first root cause set and the second root cause set, obtaining the intersection set. Finally, server 202 determines the analysis result of the anomaly root cause analysis based on the intersection set, and outputs the analysis result to terminal device 201 for user viewing.

[0056] However, those skilled in the art will readily understand that the above application scenarios are merely examples and are not limited to these in this exemplary embodiment.

[0057] After understanding the system architecture of this disclosure, it will be combined with Figure 3 The scheme of the abnormal root cause analysis method disclosed herein is described in detail.

[0058] Figure 3 This is a schematic flowchart illustrating an anomaly root cause analysis method according to an exemplary embodiment of the present disclosure. The exemplary embodiment of the present disclosure provides an anomaly root cause analysis method, which can be executed by any device for performing anomaly root cause analysis, and this device can be implemented by software and / or hardware. In this embodiment, the device can be integrated into, for example, Figure 2 In server 202 shown. For example... Figure 3 As shown, the anomaly root cause analysis method provided by the exemplary embodiments of this disclosure may include the following steps S301-S304:

[0059] S301. Obtain the target time series data to be analyzed from the time series database, and determine the outlier points in the target time series data and the first root cause set corresponding to the outlier points.

[0060] S302. Locate the associated data corresponding to the abnormal point in the process link library, and determine the second root cause set of the abnormal data in the associated data.

[0061] S303. Determine the intersection of the first root factor set and the second root factor set to obtain the intersection set.

[0062] S304. Determine the results of the root cause analysis based on the intersection set.

[0063] In some embodiments of this disclosure, the technical solutions involve obtaining target time-series data to be analyzed from a time-series database, identifying outliers and corresponding first root cause sets from the target time-series data, searching for associated data corresponding to the outliers in a process link library, and identifying second root cause sets of outliers in the associated data, determining the intersection of the first and second root cause sets, and determining the intersection set based on the intersection set. This method, based on the traditional approach of determining the first root cause set corresponding to outliers from time-series data, mines all indicator data associated with outliers from a known process link library, obtains the second root cause set corresponding to outliers in the associated indicators, and obtains the final analysis result based on the intersection set between the first and second root cause sets. This not only overcomes the technical problems of low efficiency and accuracy of manual methods but also overcomes the limitations of traditional methods. Figure 1 The technical problem of low accuracy of the related technical solutions shown is addressed, thereby achieving the technical effect of improving the accuracy and efficiency of abnormal root cause analysis.

[0064] Next, we will discuss specific embodiments. Figure 3 The steps shown in the examples are described in detail.

[0065] In S301, the target time series data to be analyzed is obtained from the time series database, and the outlier points and the first root cause set corresponding to the outlier points are determined in the target time series data.

[0066] The target time-series data, also known as time series data, refers to a time series formed by arranging data at different points in time within a certain period. The indicator parameters corresponding to different time points can be determined based on the analyzed business scenario. Taking the 5G core network as an example, the indicator parameters corresponding to different time points can be transmission rate, bandwidth, stream bit rate, maximum packet loss rate, uplink / downlink peak data rate, cell average data rate, and other indicator parameters.

[0067] For example, the server can obtain the time-series data to be analyzed from the time-series database of the 5G core network. During network operation, the interaction between various network elements in the 5G core network generates data in real time. The server stores the data generated by each network element into the 5GC time-series database according to different time standards, such as storing the data according to daily, weekly, and monthly time standards and generating corresponding time-series data.

[0068] It should be noted that when the servers above store the data generated by each network element to the 5GC time-series database according to different time standards, the storage can be based on different business scenarios. For example, business scenarios such as video playback stuttering, first frame abnormality, and loading failure. This is because the amount of data generated during the 5GC interaction process is huge, and storing data according to business scenarios facilitates the rapid location of the root cause of data anomalies.

[0069] Based on the above embodiments, when retrieving time-series data to be analyzed, the user can input the time information to be queried. The server can then retrieve the target time-series data to be analyzed from the time-series database based on the user-input time information. This target time-series data includes data at different points in time within that time period. For example, when a user needs to perform root cause analysis on network anomalies on June 12, 2023, they can input the date "June 12, 2023" through the interactive interface provided by the terminal device. After receiving "June 12, 2023", the server will search the time-series database for the time period within the day of June 12, 2023.

[0070] Understandably, users can also input a time period of any length greater than one day, such as June 1, 2023 to June 10, 2023, so that the server can search for data within that time period from the time series database and generate the corresponding time series data.

[0071] After obtaining the target time series data to be analyzed from the time series database, the outlier points in the target time series data and the first root cause set corresponding to the outlier points can be determined.

[0072] In some example embodiments of this disclosure, when determining outliers in target time series data and the first root cause set corresponding to the outliers, it is possible to combine Figure 4 An example is provided. Figure 4 This schematically illustrates a flowchart for determining the first root cause set corresponding to outliers in target time series data according to an exemplary embodiment of the present disclosure. Figure 4 Steps S401-S403 of the illustrated embodiment are implemented as follows:

[0073] S401. Preprocess the target time series data to be analyzed.

[0074] In this embodiment, the preprocessing described above may include, but is not limited to, data filtering and prediction. Data filtering primarily refers to filtering time-series data obtained from the time-series database based on the weights of Key Performance Indicators (KPIs, in this embodiment referring to the key indicators for root cause analysis, which are numerical) and the completeness of the time series data, removing interfering data. Prediction primarily refers to obtaining corresponding predicted values ​​based on the actual values ​​of the time-series data using prediction algorithms.

[0075] The data filtering and prediction methods mentioned above may include, but are not limited to, the HotSpot algorithm and the Squeeze algorithm, where the Squeeze algorithm is an improvement on the HotSpot algorithm.

[0076] The HotSpot algorithm, published by Tsinghua NetMan Lab at IEEE in 2018, is a root cause analysis algorithm. It proposes a Ripple Effect hypothesis: if a dimension combination (A = a, *, *) is anomalous, then dimension combinations (A = a, B = b, C = c) will all exhibit anomalous changes in the same proportion. Based on this Ripple Effect, it proposes a Potential Score metric to evaluate whether a set of dimension combinations is a root cause. Because the search space is generally extremely large and cannot be completely searched, the HotSpot algorithm uses Monte Carlo Tree Search (MCTS) for a more efficient search, searching for the set of dimension combinations with the largest Potential Score. The Squeeze algorithm, also published by Tsinghua NetMan Lab at ISSRE 2019, is another root cause analysis algorithm. While retaining the basic ideas of the Ripple Effect and Potential Score, it improves upon them, creating the Generalized Ripple Effect and Generalized Potential Score, making them more general and adaptable to more real-world scenarios. Its search is a heuristic method that can yield sufficiently good and stable results within a guaranteed timeframe.

[0077] Taking the Squeeze algorithm for forecasting as an example, it requires both the actual value and the predicted value of the current point in the time series data. The actual value is obtained and generated from the time series database, while the predicted value needs to be obtained through a time series forecasting algorithm. Time series forecasting algorithms can be, but are not limited to, MA (Moving Average), EWMA (Exponentially Weighted Moving Average), and ARIMA (Autoregressive Integrated Moving Average), etc.

[0078] S402. Perform AI algorithm analysis on the processed data in multiple search spaces set according to different thresholds to obtain the initial root cause set of anomaly points.

[0079] Outliers are data points / time points in the target time series data where the indicator parameters are abnormal. Once the target time series data to be analyzed is obtained, outliers can be directly located. Intelligent algorithms can be, but are not limited to, the Hotspot algorithm, the Squeeze algorithm, and the Adtributor algorithm. The Squeeze algorithm is an improvement on the Hotspot algorithm.

[0080] This embodiment incorporates parameter grids and root cause frequency considerations when performing root cause analysis. A grid search is performed on the parameters used in root cause analysis using the Squeeze algorithm (e.g., the threshold thre for filtering out anomalous root causes and the threshold theta for selecting probability scores during clustering), yielding root cause analysis results for different parameter combinations. For example, if the threshold thre and the threshold theta are set to three possible values, the grid search will perform 3*3=9 calculations, with the Squeeze algorithm applied once in each calculation.

[0081] It should be noted that the above Squeeze algorithm is merely an illustrative example, and can be modified accordingly to use the Hotspot algorithm, the Adtributor algorithm, etc. This disclosure does not impose any special limitations on this.

[0082] The following embodiments will detail the process of using AI algorithms to analyze processed data in multiple search spaces with different thresholds to obtain an initial root cause set of outliers. Step S301, which determines the first root cause set corresponding to the outliers, includes at least steps A to E:

[0083] Step A: Convert the preprocessed time series data into the data format required by the root cause analysis algorithm.

[0084] Taking the Squeeze algorithm as an example, the preprocessed predicted and actual values ​​are converted into the data format required by the Squeeze algorithm. For example, the preprocessed predicted and actual values ​​may include multiple field names (such as province, operator, third-party CDN provider) and specific content under each field. According to the requirements of the Squeeze algorithm, the above data needs to be converted into a data format of type A field (A1, A2, ...) and B field (B1, B2, ...).

[0085] Step B: Pre-set multiple thresholds required by the root cause analysis algorithm and multiple preset values ​​for each threshold.

[0086] For example, the multiple thresholds required by the root cause analysis algorithm may include, but are not limited to, the threshold `thre` used to filter out anomalous root causes and the threshold `theta` used to select probability scores during clustering, and each threshold can be set with multiple preset values ​​(e.g., threshold `thre` and threshold `theta` can each be set with three preset values). Here, threshold `thre` is the predicted value threshold in the aforementioned time series integrity condition, and threshold `theta` is the threshold provided by the Squeeze algorithm. The different possible values ​​of each threshold determine the tightness of the judgment conditions during root cause analysis. Generally, the smaller the possible value of the threshold, the looser the condition; conversely, the larger the probability of the threshold, the stricter the condition. By setting multiple possible values ​​for multiple thresholds and combining them, analysis results under different judgment conditions can be obtained.

[0087] It should be understood that the above-mentioned thresholds need to be calculated based on the actual amount of data and the calculation ratio, and this disclosure does not impose any special restrictions on them.

[0088] Step C: Set multiple search spaces based on multiple thresholds and multiple preset values ​​for each threshold.

[0089] For example, multiple thresholds and their corresponding preset values ​​can be combined to obtain multiple search spaces. For instance, if the threshold thre has 3 preset values ​​and the threshold theta has 3 preset values, then combining the possible values ​​of the threshold thre and the threshold theta can create 3*3=9 different search spaces.

[0090] Step D: Perform a root cause analysis on the preprocessed time series data in each search space using the root cause analysis algorithm to obtain a root cause analysis result.

[0091] For example, in the multiple search spaces defined in step C, each search space is subjected to a root cause analysis using the Squeeze algorithm based on the final predicted value and the actual value, resulting in one root cause analysis result. For instance, if the Squeeze algorithm is used to perform a root cause analysis in each of the nine search spaces, a total of nine root cause analysis results are obtained.

[0092] Step E: Combine the root cause analysis results from multiple search spaces to obtain the initial root cause set of anomaly locations.

[0093] For example, combining the root cause analysis results from multiple search spaces yields an initial root cause set corresponding to the anomaly location. For instance, the final root cause set obtained from the above nine search spaces is a combination of nine root cause analysis results. S403, the root causes in the initial root cause set whose frequency is greater than or equal to a first preset value are determined as the first root cause set.

[0094] For example, for the same batch of data, frequency statistics are performed on the different root cause analysis results in the initial root cause set obtained by grid search to determine the frequency of each root cause and sort them. Root causes with a frequency greater than or equal to a first preset value are determined as the first root cause set, and root causes with a frequency less than the first preset value in the initial root cause set are removed. For example, in the root cause set obtained from the above 9 search spaces, the frequency of each root cause is counted and then compared with the preset value (e.g., 9 times). Root causes with a frequency greater than or equal to the first preset value in each search space are returned as the final analysis result and added to the first root cause set, while root causes with a frequency less than the first preset value are excluded.

[0095] This method identifies the root causes whose frequency is greater than or equal to a first preset value as the first root cause set, which can simplify the data and thus improve the efficiency of the process.

[0096] In S302, the associated data corresponding to the abnormal point is searched from the process link library, and the second root cause set of the abnormal data in the associated data is determined.

[0097] After searching for the associated data corresponding to the abnormal points in the process link library, in some example embodiments of this disclosure, abnormal data and the second root cause set corresponding to the abnormal data are searched in the associated data in the process link library.

[0098] The root cause set stored in the process link library consists of each historical anomaly point in the target time series data at a historical moment, and the corresponding historical root cause set.

[0099] Among them, the process link library is a database that matches the time points of the 5GC running process and adds the abnormal points determined in the historical time points and the root cause set corresponding to the abnormal points to the corresponding time points. That is, the process nodes in the process link are consistent with the time series library.

[0100] Accordingly, when executing step S301 to determine the outlier points in the target time series data and the first root cause set corresponding to the outlier points, the outlier points and the corresponding first root cause set are simultaneously added to the process link library so as to serve as reference data for root cause analysis when performing anomaly root cause analysis in the next time period.

[0101] For example, once an anomaly point is identified, the associated data corresponding to the anomaly point is searched in the process link library, and the anomaly data and the second root cause set corresponding to the anomaly data are determined from the associated data.

[0102] During the operation of the 5GC network, the abnormal problems are not only related to the current node in the process, but may also be related to the previous node (e.g., the previous node) or the next node (e.g., the next node) in the process. Therefore, the association data consisting of the previous node and / or the next node corresponding to the abnormal point can be found in the process link library in order to determine the abnormal data and the corresponding second root cause set from the association data.

[0103] In this embodiment, by determining the associated data corresponding to the abnormal points from the process link library, the abnormal data in the associated data and the second root cause set corresponding to the abnormal data can be determined, which can find the root cause of the abnormal problem on a larger scale, thereby improving the accuracy of abnormal root cause analysis.

[0104] In S303, the intersection of the first root factor set and the second root factor set is determined to obtain the intersection set.

[0105] For example, the relevant technical solutions only determine the first root cause set of the abnormal points in the target time series from the time series library and output the first root cause set as the analysis result, ignoring the correlation and delay of the occurrence of abnormal problems, resulting in inaccurate results of abnormal root cause analysis, which in turn affects the efficiency of network operation and maintenance work and the user experience in the communication process.

[0106] Based on the first root cause set of outliers in the target time series determined from the time series library, this disclosure obtains the second root cause set corresponding to the outliers in the associated data of the outliers from the process link library. This allows for the synchronous analysis of the associated data of the outliers, using the second root cause set corresponding to the outliers in the associated data as a supplement. Combined with the first root cause set, the final result of the outlier root cause analysis is determined and output. This process can improve the accuracy of the outlier root cause analysis results, thereby improving the efficiency of network operation and maintenance and maintaining the stable operation of the network.

[0107] Suppose the first root cause set contains root cause analysis results A, B, and C, and the second root cause set contains root cause analysis results B, D, and E. Then, performing an intersection operation on the first and second root cause sets yields the intersection set. The result of the intersection operation is either an empty set (containing no elements) or a non-empty set (containing elements, i.e., root cause analysis results).

[0108] In S304, the results of the root cause analysis are determined based on the intersection set.

[0109] (1) When the first root cause set is a root cause set consisting of all root causes corresponding to the outlier locations:

[0110] In an optional embodiment of this disclosure, if the intersection set of the first root cause set and the second root cause set is not empty, the frequency of each root cause in the first root cause set is updated based on the intersection root causes in the second root cause set that intersect with the first root cause set; the root causes in the first root cause set whose frequency is greater than a first preset value after the frequency update are determined as the analysis results of abnormal root cause analysis.

[0111] Among them, the intersection root cause is the root cause that is in the intersection set, that is, the root cause that is contained in both the first root cause set and the second root cause set.

[0112] For example, when all root causes of anomalies are taken as the first root cause set, it is first determined whether the intersection set of the first root cause set and the second root cause set is empty. If it is not empty, the intersection root causes in the second root cause set that are in the intersection set are used as a supplement to the first root cause set. The frequency of each root cause in the first root cause set is updated and re-sorted based on frequency. Then, the root causes in the first root cause set whose frequency is greater than a first preset value are determined as the analysis results of the anomaly root cause analysis.

[0113] This embodiment uses the root causes that intersect with the first root cause set in the second root cause set to reorder the root causes in the first root cause intersection set, and then selects the root causes with a frequency greater than a first preset value for output, which can further improve the accuracy of root cause analysis results.

[0114] In another optional embodiment of this disclosure, if the intersection of the first root cause set and the second root cause set is empty, then the root cause in the second root cause set whose frequency is greater than the second preset value is determined as the first target root cause; the first root cause set and the first target root cause are determined as the analysis result of the abnormal root cause analysis.

[0115] (2) When the first root cause set is a root cause set consisting of root causes whose frequency is greater than the first preset value among all root causes corresponding to the anomaly point:

[0116] In some example embodiments of this disclosure, an initial root cause set corresponding to the abnormal location is determined; and the root causes in the initial root cause set whose frequency is greater than a first preset value are determined as the first root cause set.

[0117] In the above situation, in an optional embodiment of this disclosure, if the intersection of the first root cause set and the second root cause set is empty, then the root cause in the second root cause set whose frequency is greater than the second preset value is determined as the first target root cause; the first root cause set and the first target root cause are determined as the analysis result of the abnormal root cause analysis.

[0118] The first target root cause can be one or a set of multiple root causes.

[0119] For example, when the intersection of the first root cause set and the second root cause set is empty, the root causes in the second root cause set whose frequency is greater than the first preset value are taken as supplementary root causes, and combined with each root cause in the first root cause set as the analysis result for output.

[0120] In this embodiment, using root causes with a frequency greater than a second preset value in the second root cause set as supplementary root causes in the first root cause set to form the analysis results can improve the accuracy of the abnormal root cause analysis results.

[0121] In another optional embodiment of this disclosure, if the intersection of the first root cause set and the second root cause set is not empty, the frequency of each root cause in the first root cause set is updated based on the second target root cause in the intersection set; and each root cause in the first root cause set after the frequency update is determined as the analysis result of the abnormal root cause analysis.

[0122] At this point, the frequency of each root cause in the first root cause set is greater than or equal to the first preset value.

[0123] For example, when the intersection of the first root cause set and the second root cause set is not empty, the intersection root cause in the intersection set is determined, and the second target root cause in the intersection root cause and each root cause in the first root cause set are determined as the analysis results of the abnormal root cause analysis and output.

[0124] Since the second target root cause in the intersection root cause exists in the first root cause set, the frequency of the second target root cause in the first root cause set is directly updated so that the first root cause set after frequency update can be reordered according to the frequency size, and each root cause in the reordered first root cause set is used as the analysis result of the abnormal root cause analysis.

[0125] In this embodiment, the root causes that intersect with the first root cause set in the second root cause set are added to the first root cause set as supplementary root causes, thereby updating the frequency of each root cause in the first root cause set. The analysis results of the abnormal root cause analysis are determined based on the first target root cause set after the frequency update, thereby improving the accuracy of the analysis results of the abnormal root cause analysis.

[0126] The following will refer to Figure 5 The entire anomaly root cause analysis process of the exemplary embodiments of the present disclosure will be described in detail.

[0127] According to some embodiments of this disclosure, target time series data is obtained from the time series database of the 5G core network, and the target time series data is preprocessed.

[0128] In some example embodiments of this disclosure, AI algorithms are used to analyze the data of abnormal locations based on the thresholds corresponding to each pre-configured indicator parameter to obtain an initial root cause set of abnormal locations, and the root causes in the initial root cause set whose frequency is greater than a first preset value are determined as the first root cause set.

[0129] At the same time, based on the anomaly point, all indicators associated with the anomaly point are found in the process link library, thereby obtaining the abnormal indicators (abnormal data) in the associated indicators (associated data), and thus determining the second root cause set corresponding to the associated indicators.

[0130] Then, the intersection of the first root cause set and the second root cause set is obtained.

[0131] If the intersection set is empty, the root causes in the second root cause set whose frequency is greater than the second preset value will be determined as the first target root cause, and the union of the first root cause set and the first target root cause will be determined as the analysis result of the abnormal root cause analysis.

[0132] If the intersection set is not empty, the frequencies of each root cause in the first root cause set are updated based on the second target root cause that intersects with the first root cause set in the second root cause set. The root causes in the first root cause set after the frequency update are determined as the analysis results of the abnormal root cause analysis. At this time, the frequency of each root cause in the first root cause set is greater than the first preset value.

[0133] It should be noted that although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0134] Furthermore, this example embodiment also provides an anomaly root cause analysis device.

[0135] Figure 6 A block diagram of an anomaly root cause analysis apparatus according to an exemplary embodiment of the present disclosure is illustrated schematically. Reference Figure 6 An anomaly root cause analysis apparatus 600 according to an exemplary embodiment of the present disclosure may include an information acquisition module 601, a data search module 602, an intersection determination module 603, and an analysis result generation module 604.

[0136] Specifically, the information acquisition module 601 is configured to acquire the target time series data to be analyzed from the time series database, and determine the outlier points in the target time series data and the first root cause set corresponding to the outlier points; the data search module 602 is configured to search for the associated data corresponding to the outlier points from the process link library, and determine the second root cause set of the outlier data in the associated data; the intersection determination module 603 is configured to determine the intersection of the first root cause set and the second root cause set, and obtain the intersection set; the analysis result generation module 604 is configured to generate the analysis result of the anomaly root cause analysis based on the intersection set.

[0137] In an exemplary embodiment of this disclosure, the information acquisition module 601 is configured to generate multiple search spaces based on multiple thresholds required by a pre-configured root cause analysis algorithm and multiple preset values ​​of each threshold; and to perform algorithmic analysis on the data of outlier locations in the multiple search spaces to obtain a first root cause set corresponding to the outlier locations.

[0138] In an exemplary embodiment of this disclosure, the data lookup module 602 is configured to look up the second root cause set corresponding to the abnormal data from the process link library; wherein, the root cause set stored in the process link library is each historical abnormal point in the target time series data at a historical time and the historical root cause set corresponding to each historical abnormal point.

[0139] In an exemplary embodiment of this disclosure, the analysis result generation module 604 is configured to update the frequency of each root cause in the first root cause set based on the intersection root causes in the second root cause set that intersect with the first root cause set if the intersection set of the first root cause set and the second root cause set is not empty; and to determine the root causes in the first root cause set whose frequency is greater than a first preset value as the analysis result of the abnormal root cause analysis.

[0140] In an exemplary embodiment of this disclosure, the information acquisition module 601 is configured to determine the initial root cause set corresponding to the abnormal location; and to determine the root causes in the initial root cause set whose frequency is greater than a first preset value as the first root cause set.

[0141] In an exemplary embodiment of this disclosure, the analysis result generation module 604 is configured to, if the intersection of the first root cause set and the second root cause set is empty, determine the root cause in the second root cause set whose frequency is greater than a second preset value as the first target root cause; and determine the first root cause set and the first target root cause as the analysis result of the abnormal root cause analysis.

[0142] In an exemplary embodiment of this disclosure, the analysis result generation module 604 is configured to update the frequency of each root cause in the first root cause set based on the second target root cause in the second root cause set that intersects with the first root cause set if the intersection set of the first root cause set and the second root cause set is not empty; and to determine each root cause in the first root cause set after the frequency update as the analysis result of the abnormal root cause analysis.

[0143] Since the functional modules of the program performance analysis device in this invention are the same as those in the above-described method invention, they will not be described again here.

[0144] The abnormal root cause analysis device 600 provided in this embodiment can execute the technical solution of the abnormal root cause analysis method in any of the above embodiments. Its implementation principle and beneficial effects are similar to those of the abnormal root cause analysis method. Please refer to the implementation principle and beneficial effects of the abnormal root cause analysis method. It will not be repeated here.

[0145] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the present invention may also be implemented as a program product comprising program code that, when the program product is run on a mobile terminal, causes the mobile terminal to perform the steps of the various exemplary embodiments of the present invention described in the "Exemplary Methods" section above.

[0146] A program product for implementing the above-described method according to embodiments of the present invention is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a mobile terminal, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0147] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0148] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0149] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0150] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0151] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0152] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0153] The following reference Figure 7 To describe an electronic device 700 according to this embodiment of the present invention. Figure 7 The electronic device 700 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0154] like Figure 7 As shown, the electronic device 700 is manifested in the form of a general-purpose computing device. The components of the electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one storage unit 720, a bus 730 connecting different system components (including storage unit 720 and processing unit 710), and a display unit 740.

[0155] The storage unit stores program code, which can be executed by the processing unit 710, causing the processing unit 710 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 710 can perform actions such as... Figure 3 Steps S301 to S304 are shown in the diagram.

[0156] Storage unit 720 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 7201 and / or cache memory 7202, and may further include a read-only memory (ROM) 7203.

[0157] The storage unit 720 may also include a program / utility 7204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0158] Bus 730 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0159] Electronic device 700 can also communicate with one or more external devices 1000 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with the electronic device 700, and / or with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 750. Furthermore, electronic device 700 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 760. As shown, network adapter 760 communicates with other modules of electronic device 700 via bus 730. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0160] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0161] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0162] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0163] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0164] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for analyzing the root causes of anomalies, characterized in that, include: The target time series data to be analyzed is obtained from the time series database, and the outliers in the target time series data and the first root cause set corresponding to the outliers are determined; wherein, the data in the time series database is obtained by the server storing the data generated by each network element according to different time standards; The process link library searches for the associated data corresponding to the abnormal point and determines the second root cause set of the abnormal data in the associated data. The root cause set stored in the process link library is each historical abnormal point in the target time series data at a historical time and the historical root cause set corresponding to each historical abnormal point. Determine the intersection of the first root factor set and the second root factor set to obtain the intersection set; The results of the root cause analysis of the anomaly are determined based on the intersection set; Determining the first root cause set includes: The target time series data is preprocessed to obtain preprocessed time series data, and the preprocessed time series data is converted into the data format required by the root cause analysis algorithm. Multiple search spaces are set based on multiple thresholds and multiple preset values ​​of each threshold. In each search space, the root cause analysis algorithm is used to perform a root cause analysis on the preprocessed time series data to obtain a root cause analysis result. The root cause analysis results of the multiple search spaces are combined to obtain an initial root cause set of anomaly points, and the root causes in the initial root cause set whose frequency is greater than or equal to a first preset value are determined as the first root cause set.

2. The abnormal root cause analysis method according to claim 1, characterized in that, The step of searching for the associated data corresponding to the abnormal point in the process link library and determining the second root cause set of the abnormal data in the associated data includes: Search the process link library for the second root cause set corresponding to the abnormal data.

3. The abnormal root cause analysis method according to claim 1, characterized in that, The step of determining the analysis results of the abnormal root cause analysis based on the intersection set includes: If the intersection of the first root cause set and the second root cause set is not empty, then the frequency of each root cause in the first root cause set is updated based on the intersection root causes in the second root cause set that intersect with the first root cause set. The root causes with a frequency greater than a first preset value in the first root cause set after frequency updates are identified as the analysis results of the abnormal root cause analysis.

4. The abnormal root cause analysis method according to claim 1, wherein determining the first root cause set corresponding to the abnormal point includes: Determine the initial root cause set corresponding to the anomaly points; The root causes in the initial root cause set whose frequency is greater than a first preset value are determined as the first root cause set.

5. The abnormal root cause analysis method according to claim 4, characterized in that, The step of determining the analysis results of the abnormal root cause analysis based on the intersection set includes: If the intersection of the first root cause set and the second root cause set is empty, then the root cause in the second root cause set whose frequency is greater than the second preset value is determined as the first target root cause. The first root cause set and the first target root cause are determined as the analysis results of the abnormal root cause analysis.

6. The abnormal root cause analysis method according to claim 4, characterized in that, The step of determining the analysis results of the abnormal root cause analysis based on the intersection set includes: If the intersection of the first root cause set and the second root cause set is not empty, then the frequency of each root cause in the first root cause set is updated based on the second target root cause in the second root cause set that intersects with the first root cause set. Each root cause in the first root cause set after frequency updates is determined as the analysis result of the abnormal root cause analysis.

7. An abnormal root cause analysis device, characterized in that, include: The information acquisition module is configured to acquire target time-series data to be analyzed from a time-series database, and determine the outliers in the target time-series data and the first root cause set corresponding to the outliers; wherein, the data in the time-series database is obtained by the server storing the data generated by each network element according to different time standards; The data lookup module is configured to look up the associated data corresponding to the abnormal point in the process link library, and determine the second root cause set of the abnormal data in the associated data. The root cause set stored in the process link library is each historical abnormal point in the target time series data at a historical time and the historical root cause set corresponding to each historical abnormal point. The intersection determination module is configured to determine the intersection of the first root factor set and the second root factor set, thereby obtaining the intersection set; The analysis result generation module is configured to generate the analysis results of the anomaly root cause analysis based on the intersection set; The information acquisition module is configured to execute: The target time series data is preprocessed to obtain preprocessed time series data, and the preprocessed time series data is converted into the data format required by the root cause analysis algorithm. Multiple search spaces are set based on multiple thresholds and multiple preset values ​​of each threshold. In each search space, the root cause analysis algorithm is used to perform a root cause analysis on the preprocessed time series data to obtain a root cause analysis result. The root cause analysis results of the multiple search spaces are combined to obtain an initial root cause set of anomaly points, and the root causes in the initial root cause set whose frequency is greater than or equal to a first preset value are determined as the first root cause set.

8. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the abnormal root cause analysis method according to any one of claims 1 to 6.

9. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the anomaly root cause analysis method according to any one of claims 1 to 6 by executing the executable instructions.

Images