Alarm root cause positioning method, device, equipment and storage medium

Abstract

The application relates to financial service intelligent decision technology, and discloses an alarm root cause positioning method, which comprises the following steps: identifying alarm nodes in an alarm information set, constructing a call graph between the alarm nodes, clustering the alarm nodes according to the call graph to obtain a clustering cluster set, extracting node self-owned features of each alarm node, performing alarm root cause positioning analysis on the clustering cluster by using a pre-trained alarm root cause positioning model according to the node self-owned features, obtaining a probability value of each alarm node in the clustering cluster as an alarm root cause, collecting alarm nodes with maximum probability values in each clustering cluster to form a candidate alarm root cause node set, and selecting an alarm node with the highest repetition rate from the candidate alarm root cause node set as an alarm root cause of the alarm information set. The application further provides an alarm root cause positioning device, an electronic device and a storage medium. The application can improve the accuracy of alarm root cause positioning in insurance, financial management and other financial services.

Description

Technical Field

[0001] This invention relates to the field of intelligent decision-making technology in financial business, and in particular to a method, apparatus, electronic device, and computer-readable storage medium for alarm root cause localization. Background Technology

[0002] As people's living standards continue to improve, financial services such as insurance and wealth management are becoming increasingly important. To meet these diverse financial needs, insurance and wealth management businesses have expanded rapidly, with increasingly complex and diverse service types. Consequently, the underlying IT architecture of these businesses has also expanded continuously. For example, the operations and maintenance system includes multiple layers and dimensions, such as application hosts, databases, clusters, and client-side components. Given the increasingly complex nature of insurance and wealth management businesses, the challenge of quickly and accurately analyzing and locating the root cause of alarms is becoming increasingly prominent.

[0003] Automated operation and maintenance methods based on script rules or static service network analysis are gradually proving inadequate and unable to meet the need for rapid and accurate responses. Current alarm root cause analysis processes require human intervention; that is, after an alarm occurs, operations personnel locate the root cause based on analytical methods or past experience, with algorithms providing only partial reference. However, modern operation and maintenance alarms often accompany numerous related alarms, involving multiple levels. Furthermore, due to the dynamic nature of insurance and wealth management business logic, it is difficult for humans to perform root cause analysis and location in a short time or simply based on past experience, thus delaying remediation efforts. Summary of the Invention

[0004] This invention provides an alarm root cause localization method, apparatus, and computer-readable storage medium, the main purpose of which is to improve the accuracy of alarm root cause localization in financial businesses such as insurance and wealth management.

[0005] To achieve the above objectives, the present invention provides an alarm root cause localization method, comprising:

[0006] Obtain the alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain the alarm node set;

[0007] Obtain the call relationship between each alarm node in the alarm node set, and construct the call graph between the alarm nodes based on the call relationship;

[0008] The call relationships between each alarm node are clustered according to the call graph to obtain a set of clusters, and the node-specific features of each alarm node in the set of clusters are extracted.

[0009] Based on the node's own characteristics, the alarm root cause localization model, which has been pre-trained, is used to perform alarm root cause localization analysis on each cluster in each cluster set, so as to obtain the probability value of each alarm node in each cluster as the alarm root cause.

[0010] The alarm nodes with the highest probability values ​​in each cluster are gathered to form a candidate alarm root cause node set. From the candidate alarm root cause node set, the alarm node with the highest repetition rate is selected as the alarm root cause of the alarm information set.

[0011] Optionally, identifying the alarm node corresponding to each alarm message in the alarm information set includes:

[0012] Obtain the key fields of each alarm message in the alarm information set;

[0013] The key field is matched with a preset alarm node field library, and the alarm node corresponding to the matched alarm node field is taken as the alarm node of the key field.

[0014] Optionally, obtaining the calling relationship between each alarm node in the alarm node set includes:

[0015] Obtain the execution data of each alarm node in the alarm node set;

[0016] The associated alarm nodes are determined from the execution data, and the calling relationship between each alarm node in the alarm node set is determined based on the associated alarm nodes.

[0017] Optionally, constructing the call graph between the alarm nodes based on the call relationship includes:

[0018] The alarm root node and child nodes are determined based on the aforementioned call relationship;

[0019] Based on the alarm root node and its child nodes, the alarm nodes are connected using the maximum connectivity algorithm to obtain the call graph between the alarm nodes.

[0020] Optionally, the step of clustering the call relationships between each alarm node according to the call graph to obtain a set of clusters includes:

[0021] Identify the alarm nodes that serve as the root nodes of the calls in the call graph to obtain the alarm root nodes;

[0022] Cluster the call relationships that are consistent with the alarm root nodes in the call graph to obtain a set of clusters.

[0023] Optionally, extracting the node-specific features of each alarm node in the cluster set includes:

[0024] Extract the attribute information of each alarm node in each cluster of the cluster set in a preset dimension;

[0025] The attribute information of the preset dimension is uniformly encoded to obtain the attribute vector of the preset dimension;

[0026] The attribute vectors of the preset dimensions are concatenated to obtain the node-specific features of each alarm node in the corresponding cluster set.

[0027] Optionally, the step of performing alarm root cause localization analysis on each cluster in each of the cluster sets using a pre-trained alarm root cause localization model based on the node's own characteristics, to obtain the probability value of each alarm node in each cluster as the alarm root cause, includes:

[0028] Generate a target matrix for each alarm node in each cluster based on the node's own characteristics;

[0029] The target matrix is ​​fully connected using the fully connected layer in the pre-trained alarm root cause model to obtain a fully connected matrix;

[0030] Activation operations are performed on the fully connected matrix to obtain the probability value of each alarm node in each cluster as the root cause of the alarm.

[0031] To address the above problems, the present invention also provides an alarm root cause localization device, the device comprising:

[0032] The alarm node identification module is used to acquire an alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain an alarm node set.

[0033] The graph construction module is invoked to obtain the call relationships between each alarm node in the alarm node set, and to construct the call graph between the alarm nodes based on the call relationships;

[0034] The feature extraction module is used to cluster the call relationships between each alarm node according to the call graph to obtain a cluster set, and extract the node-specific features of each alarm node in the cluster set.

[0035] The probability value calculation module is used to perform alarm root cause localization analysis on each cluster in each cluster set based on the node's own characteristics and a pre-trained alarm root cause localization model, and to obtain the probability value of each alarm node in each cluster as the alarm root cause.

[0036] The alarm root cause determination module is used to gather alarm nodes with the highest probability values ​​in each cluster to form a candidate alarm root cause node set, and select the alarm node with the highest repetition rate from the candidate alarm root cause node set as the alarm root cause of the alarm information set.

[0037] To address the above problems, the present invention also provides an electronic device, the electronic device comprising:

[0038] At least one processor; and,

[0039] A memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the alarm root cause localization method described above.

[0041] To address the aforementioned problems, the present invention also provides a computer-readable storage medium storing at least one computer program, which is executed by a processor in an electronic device to implement the alarm root cause localization method described above.

[0042] This invention, through obtaining the call relationships between alarm nodes and constructing a call graph based on these relationships, dynamically acquires the associations between alarm nodes, narrowing the scope of the link graph and improving efficiency. Furthermore, the call graph is clustered to obtain multiple clusters, further narrowing the scope of alarm location and improving the accuracy of alarm root cause analysis. A pre-trained alarm root cause location model is used to locate the root cause of each cluster, obtaining the root cause of the alarm in the call relationships of each alarm node. Machine learning methods enhance the flexibility and accuracy of alarm root cause analysis, enabling rapid and accurate location of alarm root causes and ensuring the stability of related services. Therefore, the alarm root cause location method, device, electronic device, and computer-readable storage medium proposed in this invention can improve the accuracy of alarm root cause location in financial businesses such as insurance and wealth management. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating an alarm root cause localization method according to an embodiment of the present invention.

[0044] Figure 2 This is a schematic diagram of a process for extracting node features according to an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the process for calculating probability values ​​according to an embodiment of the present invention;

[0046] Figure 4 This is a functional block diagram of an alarm root cause location device provided in an embodiment of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of an electronic device that implements the alarm root cause localization method according to an embodiment of the present invention.

[0048] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0049] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0050] This application provides an alarm root cause localization method. The execution subject of the alarm root cause localization method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application embodiment: a server, a terminal, etc. In other words, the alarm root cause localization method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0051] Reference Figure 1 The diagram shown is a flowchart illustrating an alarm root cause localization method according to an embodiment of the present invention. In this embodiment, the alarm root cause localization method includes the following steps S1-S5:

[0052] S1. Obtain the alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain the alarm node set;

[0053] In this embodiment of the invention, the alarm root cause localization method is illustrated using alarms generated by financial business platforms or systems such as insurance and wealth management as an example. It is understood that a typical financial insurance or wealth management platform, system, or app provides a wide range of wealth management or insurance products and diversified business services to a broad user base. At any given moment, business processing events such as user product purchases and sales, product price updates, and changes in user returns occur, along with data synchronization events. The architecture of the corresponding financial business platform or system involves transaction calls and data synchronization operations between multiple modules. If a problem occurs in a transaction call or a data synchronization error occurs, it may trigger a cascading reaction between business processes, thus triggering a business alarm.

[0054] In this embodiment of the invention, the preset time period can be 15 minutes or 30 minutes. The alarm information can refer to alarm information generated by financial businesses such as insurance and wealth management, which can be collected through the operation and maintenance system of financial businesses such as insurance and wealth management. The operation and maintenance system can include alarm information generated by business nodes at multiple levels and dimensions, such as alarm information issued by application hosts, databases, clusters, and user terminals. The alarm information includes, but is not limited to, the time of occurrence of the alarm and the node of the alarm. The alarm node is the node that generates the alarm among multiple operation and maintenance nodes in the operation and maintenance system.

[0055] Specifically, identifying the alarm node corresponding to each alarm message in the alarm information set includes:

[0056] Obtain the key fields of each alarm message in the alarm information set;

[0057] The key field is matched with a preset alarm node field library, and the alarm node corresponding to the matched alarm node field is taken as the alarm node of the key field.

[0058] In this embodiment of the invention, the key field can be the field that appears most frequently in each alarm message. The key field is matched with a preset alarm node field library to obtain the corresponding alarm node. The alarm node of each alarm message in the alarm message set is determined by the alarm node, which can quickly locate the source of the alarm message. At the same time, the root cause of the alarm message can be located in a timely manner according to the preset time period.

[0059] S2. Obtain the call relationship between each alarm node in the alarm node set, and construct the call graph between the alarm nodes based on the call relationship;

[0060] In this embodiment of the invention, since operation and maintenance alarms often involve multiple layers or multiple business logics, multiple associated alarm nodes will be formed. The calling relationship between each alarm node is determined through the associated alarm nodes, thereby constructing a calling graph between alarm nodes.

[0061] Specifically, obtaining the call relationship between each alarm node in the alarm node set includes:

[0062] Obtain the execution data of each alarm node in the alarm node set;

[0063] The associated alarm nodes are determined from the execution data, and the calling relationship between each alarm node in the alarm node set is determined based on the associated alarm nodes.

[0064] In this embodiment of the invention, the execution data may be the log data of each alarm node. The associated nodes that have a calling relationship during the execution process are obtained from the log data, thereby determining the calling relationship of each alarm node.

[0065] Further, constructing the call graph between the alarm nodes based on the call relationship includes:

[0066] The alarm root node and child nodes are determined based on the aforementioned call relationship;

[0067] Based on the alarm root node and its child nodes, the alarm nodes are connected using the maximum connectivity algorithm to obtain the call graph between the alarm nodes.

[0068] In this embodiment of the invention, the alarm node that serves as the root alarm node is used only to call other alarm nodes in the calling relationship between alarm nodes, and does not serve as the alarm node being called.

[0069] In this embodiment of the invention, the call graph is obtained by making directed connections between the call relationships between each alarm node, and the direction of the connection edges obtained by the directed connections is used to indicate the relationship between the caller and the called party between the alarm nodes.

[0070] In this embodiment of the invention, by constructing a call graph between alarm nodes, the call relationship between alarm nodes can be dynamically displayed, and the call relationship between all alarm nodes can be comprehensively displayed, thereby locating alarm nodes more accurately.

[0071] S3. Cluster the call relationships between each alarm node according to the call graph to obtain a cluster set, and extract the node-specific features of each alarm node in the cluster set.

[0072] In one embodiment of the invention, the clustering is to cluster the calling relationships between alarm nodes. In another embodiment of the invention, the node-specific features are the inherent feature information of the alarm node itself.

[0073] Specifically, the step of clustering the call relationships between each alarm node based on the call graph to obtain a set of clusters includes:

[0074] Identify the alarm nodes that serve as the root nodes of the calls in the call graph to obtain the alarm root nodes;

[0075] Cluster the call relationships that are consistent with the alarm root nodes in the call graph to obtain a set of clusters.

[0076] In this embodiment of the invention, the alarm node that serves as the root alarm node is one that is only used to call other alarm nodes in the call relationship between alarm nodes, and is not the alarm node being called. Clustering the call relationships of consistent alarm root nodes can cluster the call relationships between highly related alarm nodes, thereby narrowing the scope of alarm location and improving the accuracy of alarm root cause analysis.

[0077] Further, see Figure 2 As shown, the step of extracting the node-specific features of each alarm node in the cluster set includes:

[0078] S21. Extract the attribute information of a preset dimension of each alarm node in each cluster of the cluster set;

[0079] S22. The attribute information of the preset dimension is uniformly encoded to obtain the attribute vector of the preset dimension;

[0080] S23. Perform vector concatenation on the attribute vectors of the preset dimensions to obtain the node-specific features of each alarm node in the corresponding cluster.

[0081] In this embodiment of the invention, the attribute information of the preset dimension can be attribute information of the alarm node in dimensions such as business attributes and data attributes. The attribute information is uniformly one-hot encoded to obtain the attribute vector of the preset dimension.

[0082] In this embodiment of the invention, the essential differences between each alarm node can be reflected by the node-specific characteristics of each alarm node, thereby accurately locating the root cause of the alarm in the cluster to which the alarm node belongs.

[0083] S4. Based on the node's own characteristics, use the pre-trained alarm root cause localization model to perform alarm root cause localization analysis on each cluster in each cluster set, and obtain the probability value of each alarm node in each cluster as the alarm root cause.

[0084] In this embodiment of the invention, the pre-trained alarm root cause localization model is trained using a deep neural network model. Supervised learning training is performed on the deep neural network, and cross-entropy is used as the loss function. The parameters of the deep neural network model are adjusted through the loss function until the loss value reaches a preset threshold, thus obtaining the alarm root cause localization model. The pre-trained alarm root cause localization model can calculate the probability that each alarm node is the root cause of the alarm.

[0085] For details, please refer to Figure 3 As shown, the step of performing alarm root cause localization analysis on each cluster in each cluster set using a pre-trained alarm root cause localization model based on the node's own characteristics, and obtaining the probability value of each alarm node in each cluster as the alarm root cause, includes:

[0086] S31. Generate a target matrix for each alarm node in each cluster based on the node's own characteristics;

[0087] S32. The target matrix is ​​fully connected using the fully connected layer in the pre-trained alarm root cause model to obtain a fully connected matrix;

[0088] S33. Perform activation operation on the fully connected matrix to obtain the probability value of each alarm node in each cluster as the root cause of the alarm.

[0089] In this embodiment of the invention, the fully connected layer contains multiple sub-fully connected layers, and full connection is performed using multiple sub-fully connected layers. In this embodiment of the invention, the softmax activation function can be used to perform activation operation on the fully connected matrix to obtain the probability value of each alarm node.

[0090] In this embodiment of the invention, by analyzing the alarm node's own characteristics using a pre-trained alarm root cause localization model, the alarm node can be accurately analyzed and judged, thereby obtaining a more accurate probability value of the alarm node as the alarm root cause.

[0091] S5. Gather the alarm nodes with the highest probability values ​​in each cluster to form a candidate alarm root cause node set, and select the alarm node with the highest repetition rate from the candidate alarm root cause node set as the alarm root cause of the alarm information set.

[0092] In this embodiment of the invention, the alarm node with the highest probability value in each cluster is more likely to be the root cause alarm node of the corresponding cluster. Therefore, the alarm node with the highest probability value is used as the root cause alarm for each call relationship in the corresponding cluster. Furthermore, the alarm nodes with the highest probability value in each cluster are gathered to form a candidate root cause alarm node set. From the candidate root cause alarm node set, the alarm node with the highest repetition rate is selected as the root cause alarm of the alarm information set, thereby locating a series of related alarms and improving the accuracy of alarm root cause location.

[0093] This invention, through obtaining the call relationships between alarm nodes and constructing a call graph based on these relationships, dynamically acquires the associations between alarm nodes, narrowing the scope of the link graph and improving efficiency. Furthermore, the call graph is clustered to obtain multiple clusters, further narrowing the scope of alarm location and improving the accuracy of alarm root cause analysis. A pre-trained alarm root cause location model is used to locate the root cause of each cluster, obtaining the root cause of the alarm in the call relationships of each alarm node. Machine learning methods enhance the flexibility and accuracy of alarm root cause analysis, enabling rapid and accurate location of alarm root causes and ensuring the stability of related services. Therefore, the alarm root cause location method proposed in this invention can improve the accuracy of alarm root cause location in financial businesses such as insurance and wealth management.

[0094] like Figure 4 The diagram shown is a functional block diagram of an alarm root cause localization device provided in an embodiment of the present invention.

[0095] The alarm root cause localization device 100 of the present invention can be installed in an electronic device. Depending on the functions implemented, the alarm root cause localization device 100 may include an alarm node identification module 101, a call map construction module 102, a feature extraction module 103, a probability value calculation module 104, and an alarm root cause localization module 105. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0096] In this embodiment, the functions of each module / unit are as follows:

[0097] The alarm node identification module 101 is used to acquire an alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain an alarm node set.

[0098] The call graph construction module 102 is used to obtain the call relationship between each alarm node in the alarm node set, and construct the call graph between the alarm nodes according to the call relationship;

[0099] The feature extraction module 103 is used to cluster the call relationships between each alarm node according to the call graph to obtain a cluster set, and extract the node-specific features of each alarm node in the cluster set.

[0100] The probability value calculation module 104 is used to perform alarm root cause localization analysis on each cluster in each cluster set according to the node's own characteristics and using a pre-trained alarm root cause localization model, so as to obtain the probability value of each alarm node in each cluster as the alarm root cause.

[0101] The alarm root cause determination module 105 is used to gather alarm nodes with the highest probability values ​​in each cluster to form a candidate alarm root cause node set, and select the alarm node with the highest repetition rate from the candidate alarm root cause node set as the alarm root cause of the alarm information set.

[0102] In detail, each module in the alarm root cause localization device 100 described in this embodiment of the invention adopts the same characteristics as described above during use. Figures 1 to 3 The alarm root cause localization method described herein uses the same technical means and can produce the same technical effect, so it will not be repeated here.

[0103] like Figure 5 The diagram shown is a structural schematic of an electronic device that implements an alarm root cause localization method according to an embodiment of the present invention.

[0104] The electronic device 1 may include a processor 10, a memory 11, a communication bus 12 and a communication interface 13, and may also include a computer program, such as an alarm root cause localization program, stored in the memory 11 and capable of running on the processor 10.

[0105] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (e.g., executing alarm root cause location programs) and calls data stored in the memory 11 to perform various functions of the electronic device and process data.

[0106] The memory 11 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. Furthermore, the memory 11 can include both internal and external storage units of the electronic device. The memory 11 can be used not only to store application software and various types of data installed on the electronic device, such as alarm root cause location program code, but also to temporarily store data that has been output or will be output.

[0107] The communication bus 12 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0108] The communication interface 13 is used for communication between the aforementioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, Bluetooth interface, etc.), typically used to establish communication connections between the electronic device and other electronic devices. The user interface may be a display, an input unit (such as a keyboard), or, optionally, a standard wired or wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device and to display a visual user interface.

[0109] Figure 5 The image only shows electronic devices with components; it will be understood by those skilled in the art that... Figure 5 The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0110] For example, although not shown, the electronic device may also include a power supply (such as a battery) to power the various components. Preferably, the power supply can be logically connected to the at least one processor 10 through a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0111] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0112] The alarm root cause localization program stored in the memory 11 of the electronic device 1 is a combination of multiple instructions, which, when run in the processor 10, can achieve the following:

[0113] Obtain the alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain the alarm node set;

[0114] Obtain the call relationship between each alarm node in the alarm node set, and construct the call graph between the alarm nodes based on the call relationship;

[0115] The call relationships between each alarm node are clustered according to the call graph to obtain a set of clusters, and the node-specific features of each alarm node in the set of clusters are extracted.

[0116] Based on the node's own characteristics, the alarm root cause localization model, which has been pre-trained, is used to perform alarm root cause localization analysis on each cluster in each cluster set, so as to obtain the probability value of each alarm node in each cluster as the alarm root cause.

[0117] The alarm nodes with the highest probability values ​​in each cluster are gathered to form a candidate alarm root cause node set. From the candidate alarm root cause node set, the alarm node with the highest repetition rate is selected as the alarm root cause of the alarm information set.

[0118] Specifically, the specific implementation method of the processor 10 for the above instructions can be referred to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, and will not be repeated here.

[0119] Furthermore, if the modules / units integrated in the electronic device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0120] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor of an electronic device, can perform the following:

[0121] Obtain the alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain the alarm node set;

[0122] Obtain the call relationship between each alarm node in the alarm node set, and construct the call graph between the alarm nodes based on the call relationship;

[0123] The call relationships between each alarm node are clustered according to the call graph to obtain a set of clusters, and the node-specific features of each alarm node in the set of clusters are extracted.

[0124] Based on the node's own characteristics, the alarm root cause localization model, which has been pre-trained, is used to perform alarm root cause localization analysis on each cluster in each cluster set, so as to obtain the probability value of each alarm node in each cluster as the alarm root cause.

[0125] The alarm nodes with the highest probability values ​​in each cluster are gathered to form a candidate alarm root cause node set. From the candidate alarm root cause node set, the alarm node with the highest repetition rate is selected as the alarm root cause of the alarm information set.

[0126] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0127] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0128] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0129] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0130] Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within the invention. No appended diagram markings in the claims should be construed as limiting the scope of the claims.

[0131] The blockchain referred to in this invention is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0132] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0133] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a system claim may also be implemented by a single unit or device through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any specific order.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for locating the root cause of an alarm, characterized in that, The method includes: Obtain the alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain the alarm node set; Obtain the call relationship between each alarm node in the alarm node set, and construct the call graph between the alarm nodes based on the call relationship; Identify the alarm nodes that serve as the root nodes in the call graph to obtain the alarm root nodes. Cluster the call relationships that are consistent with the alarm root nodes in the call graph to obtain a set of clusters. Extract the attribute information containing business attributes and data attributes of each alarm node in the set of clusters. Perform unified encoding and vector concatenation on the attribute information to generate the node-specific features of each alarm node. Based on the node's own characteristics, the alarm root cause localization model, which has been pre-trained, is used to perform alarm root cause localization analysis on each cluster in the cluster set, so as to obtain the probability value of each alarm node in each cluster as the alarm root cause. The alarm nodes with the highest probability values ​​in each cluster are gathered to form a candidate alarm root cause node set. From the candidate alarm root cause node set, the alarm node with the highest repetition rate is selected as the alarm root cause of the alarm information set.

2. The alarm root cause localization method as described in claim 1, characterized in that, The process of identifying the alarm node corresponding to each alarm message in the alarm information set includes: Obtain the key fields of each alarm message in the alarm information set; The key field is matched with a preset alarm node field library, and the alarm node corresponding to the matched alarm node field is taken as the alarm node of the key field.

3. The alarm root cause localization method as described in claim 1, characterized in that, The step of obtaining the call relationship between each alarm node in the alarm node set includes: Obtain the execution data of each alarm node in the alarm node set; The associated alarm nodes are determined from the execution data, and the calling relationship between each alarm node in the alarm node set is determined based on the associated alarm nodes.

4. The alarm root cause localization method as described in claim 1, characterized in that, The step of constructing a call graph between the alarm nodes based on the call relationship includes: The alarm root node and child nodes are determined based on the aforementioned call relationship; Based on the alarm root node and its child nodes, the alarm nodes are connected using the maximum connectivity algorithm to obtain the call graph between the alarm nodes.

5. The alarm root cause localization method as described in claim 1, characterized in that, The step of performing alarm root cause localization analysis on each cluster in the cluster set using a pre-trained alarm root cause localization model based on the node's own characteristics, and obtaining the probability value of each alarm node in each cluster as the alarm root cause, includes: Generate a target matrix for each alarm node in each cluster based on the node's own characteristics; The target matrix is ​​fully connected using the fully connected layer in the pre-trained alarm root cause model to obtain a fully connected matrix; Activation operations are performed on the fully connected matrix to obtain the probability value of each alarm node in each cluster as the root cause of the alarm.

6. An alarm root cause location device, characterized in that, The device includes: The alarm node identification module is used to acquire an alarm information set within a preset time period, identify the alarm node corresponding to each alarm information in the alarm information set, and obtain an alarm node set. The graph construction module is invoked to obtain the call relationships between each alarm node in the alarm node set, and to construct the call graph between the alarm nodes based on the call relationships; The feature extraction module is used to identify alarm nodes that serve as root nodes in the call graph, obtain alarm root nodes, and cluster the call relationships with consistent alarm root nodes in the call graph to obtain a set of clusters. The feature extraction module is also used to extract attribute information containing business attributes and data attributes for each alarm node in the set of clusters, uniformly encode the attribute information and concatenate the vectors to generate node-specific features for each alarm node. The probability value calculation module is used to perform alarm root cause localization analysis on each cluster in each cluster set based on the node's own characteristics and a pre-trained alarm root cause localization model, and to obtain the probability value of each alarm node in each cluster as the alarm root cause. The alarm root cause determination module is used to gather alarm nodes with the highest probability values ​​in each cluster to form a candidate alarm root cause node set, and select the alarm node with the highest repetition rate from the candidate alarm root cause node set as the alarm root cause of the alarm information set.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the alarm root cause localization method as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the alarm root cause localization method as described in any one of claims 1 to 5.

Images