Abnormal component tracing method and device, electronic equipment and computer storage medium

Abstract

The application relates to the technical field of artificial intelligence, and provides an abnormal component tracing method and device, electronic equipment and computer storage medium, the method comprises the following steps: generating a node vector according to description information of each graph node and description information of each node edge in a component structure diagram; generating a target node vector through a node vectorization algorithm; obtaining a first-order aggregation vector through a hierarchical aggregation algorithm; obtaining a multi-order aggregation vector through a multi-order aggregation algorithm; combining the final node vector obtained by weighting the first-order aggregation vector and the multi-order aggregation vector with a standard classification model to locate the highest frequency graph node, and determining the highest frequency graph node as an abnormal node. The abnormal component tracing method provided in the application embodiment enriches the semantic representation of the node through the node vectorization algorithm, expands the feature dimension of the node through the hierarchical aggregation algorithm, expands the node perception information through the multi-order aggregation algorithm, and finally quickly and accurately traces the abnormal node through the standard classification model.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, electronic device, and computer storage medium for tracing the source of abnormal components. Background Technology

[0002] When a computer application fails, the common methods for tracing the source of the error in current error handling components mainly include historical error information tracing and error log tracing. Historical error information tracing involves matching historical error information with logs to quickly locate the root cause of the error. Error log tracing involves using controlled variables to trace the error layer by layer, employing a process of elimination to ultimately pinpoint the root cause.

[0003] While historical error message tracing methods can quickly pinpoint the root cause of an error, they can lead to situations where logs are similar but the root causes are inconsistent, reducing the accuracy of error tracing. Furthermore, if new error logs appear, historical error message tracing methods cannot be used.

[0004] While error log tracing methods can ultimately pinpoint the problem accurately, they require business personnel to have extensive experience. Furthermore, these methods are time-consuming and slow, wasting a significant amount of time and energy for business personnel. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and computer storage medium for tracing abnormal components, aiming to achieve rapid and accurate tracing of abnormal components.

[0006] Firstly, this application provides a method for tracing the source of abnormal components, including:

[0007] Determine the component structure diagram, and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram;

[0008] The target node vector is generated by combining each graph node and the node vector using a node vectorization algorithm.

[0009] The graph nodes are aggregated hierarchically by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector.

[0010] The graph nodes are aggregated in multiple order by combining the target node vector with a multi-order aggregation algorithm to obtain a multi-order aggregation vector. The first-order aggregation vector and the multi-order aggregation vector are then weighted to obtain the final node vector.

[0011] The most frequent graph node is located by combining the standard classification model with the final node vector, and the most frequent graph node is identified as an abnormal node.

[0012] In one embodiment, locating the most frequent graph node by combining a standard classification model with the final node vector includes:

[0013] The final node vector is output as an anomaly log when an anomaly warning occurs through a preset learning model;

[0014] An initial binary classifier is constructed based on the initial abnormal nodes and nodes to be processed in the abnormal log, and a first probability value of the initial abnormal nodes and a second probability value of the nodes to be processed are calculated based on the initial binary classifier.

[0015] Based on the first probability value and the second probability value, determine the abnormal nodes to be processed in the nodes to be processed, and identify the abnormal nodes to be processed as abnormal sample data;

[0016] Based on the abnormal sample data and the initial abnormal node, the graph node with the highest frequency is located.

[0017] The step of locating the most frequent graph node based on the abnormal sample data and the initial abnormal node includes:

[0018] The abnormal sample data is sampled a preset number of times to obtain a first abnormal sample set and a second abnormal sample set;

[0019] A target binary classifier is constructed based on the first abnormal sample set and the initial abnormal nodes, and the target binary classifier is used to predict the second abnormal sample set to obtain each target abnormal node.

[0020] By performing a union operation on all the target abnormal nodes, the graph node with the highest frequency among all the target abnormal nodes is located.

[0021] The step of performing hierarchical aggregation on each graph node using a hierarchical aggregation algorithm combined with the target node vector to obtain a first-order aggregated vector includes:

[0022] Determine the node similarity threshold and use the target node vector as the original vector representation of each graph node;

[0023] Based on the target node vector and the node similarity threshold, determine the first node set and the second node set of the first-order nodes in each of the graph nodes;

[0024] The first node set and the second node set of each graph node are hierarchically aggregated using the hierarchical aggregation algorithm to determine the first-order aggregation vector.

[0025] The step of performing hierarchical aggregation on the first node set and the second node set of each graph node using the hierarchical aggregation algorithm to determine the first-order aggregation vector includes:

[0026] A first threshold counting matrix is ​​constructed based on the number of nodes in the first node set of each graph node, and a second threshold counting matrix is ​​constructed based on the number of nodes in the second node set of each graph node.

[0027] A first degree matrix is ​​constructed based on each of the graph nodes and the first threshold counting matrix, and a second degree matrix is ​​constructed based on each of the graph nodes and the second threshold counting matrix.

[0028] A first connection matrix is ​​constructed based on the connectivity between each graph node and each node in the first node set, and a second connection matrix is ​​constructed based on the connectivity between each graph node and each node in the second node set.

[0029] Based on the first threshold counting matrix, the first degree matrix, and the first connection matrix, a first node information fusion vector is determined, and based on the second threshold counting matrix, the second degree matrix, and the second connection matrix, a second node information fusion vector is determined.

[0030] The first node information fusion vector and the second node information fusion vector are fused to obtain the first-order aggregate vector.

[0031] The step of generating a target node vector by combining each graph node and the node vector using a node vectorization algorithm includes:

[0032] The node vectorization algorithm combines the edge weights and similarities between the graph nodes, as well as the node degree of each graph node, to generate various graph structure vectors.

[0033] The target node vector is generated by concatenating each of the graph structure vectors with the node vectors.

[0034] The step of generating node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure graph includes:

[0035] Based on the first description information of each graph node, a node sentence vector of each graph node is generated, and based on the second description information of each node edge, a connection sentence vector of each node edge is generated.

[0036] The average value of the connection vectors of each node edge is obtained by weighting and averaging the connection vectors of each node edge.

[0037] The node vector is generated by concatenating the node sentence vector of each graph node and the average edge vector of each node edge.

[0038] Constructing the component structure diagram includes:

[0039] Each software device and each hardware device of the terminal device is identified as a component, and each component is identified as a graph node;

[0040] The calling relationships between the graph nodes are defined as node edges, and the number of calls between the graph nodes is defined as edge weights.

[0041] The component structure graph is constructed based on each graph node, as well as the node edges and edge weights between the graph nodes.

[0042] Secondly, this application provides an abnormal component tracing device comprising:

[0043] A generation module is defined to determine the component structure diagram and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram.

[0044] The generation module is used to generate a target node vector by combining each graph node and the node vector through a node vectorization algorithm;

[0045] The hierarchical aggregation module is used to perform hierarchical aggregation on each graph node by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector.

[0046] The aggregation and weighting module is used to perform multi-level aggregation on each graph node by combining the target node vector with a multi-level aggregation algorithm to obtain a multi-level aggregation vector, and to weight the first-level aggregation vector and the multi-level aggregation vector to obtain the final node vector;

[0047] The source tracing module is used to locate the most frequent graph node by combining the final node vector with a standard classification model, and to identify the most frequent graph node as an abnormal node.

[0048] Thirdly, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the abnormal component tracing method described in the first aspect.

[0049] Fourthly, this application also provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium including a computer program, which, when executed by the processor, implements the abnormal component tracing method described in the first aspect.

[0050] Fifthly, this application also provides a computer program product, the computer program product including a computer program, which, when executed by the processor, implements the abnormal component tracing method described in the first aspect.

[0051] The abnormal component tracing method, apparatus, electronic device, and computer storage medium provided in this application, in the process of tracing abnormal components, enrich the semantic representation of nodes through node vectorization algorithm, expand the feature dimension of nodes through hierarchical aggregation algorithm, expand the perceptual information of nodes through multi-level aggregation algorithm, and finally trace the abnormal nodes quickly and accurately through standard classification model, that is, it can quickly and accurately trace the abnormal components in all components. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of this application, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is one of the flowcharts illustrating the abnormal component tracing method provided in this application;

[0054] Figure 2 This is a schematic diagram of the component structure provided in this application;

[0055] Figure 3 This is a schematic diagram of the node connections at each level provided in this application;

[0056] Figure 4 This is the second flowchart illustrating the abnormal component tracing method provided in this application;

[0057] Figure 5 This is the third flowchart illustrating the abnormal component tracing method provided in this application;

[0058] Figure 6 This is a schematic diagram of the abnormal component tracing device provided in this application;

[0059] Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] Combination Figures 1 to 7 This application describes the method, apparatus, electronic device, and computer storage medium for tracing abnormal components. Figure 1 This is one of the flowcharts illustrating the abnormal component tracing method provided in this application; Figure 2 This is a schematic diagram of the component structure provided in this application; Figure 3 This is a schematic diagram of the node connections at each level provided in this application; Figure 4 This is the second flowchart illustrating the abnormal component tracing method provided in this application; Figure 5 This is the third flowchart illustrating the abnormal component tracing method provided in this application; Figure 6 This is a schematic diagram of the abnormal component tracing device provided in this application; Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application.

[0062] This application provides an embodiment of an abnormal component tracing method. It should be noted that although the logical order is shown in the flowchart, under certain data, the steps shown or described may be completed in a different order than that shown here.

[0063] This application uses an electronic device as the execution subject for example, and the component traceability system is used as one of the manifestations of the electronic device, but it is not limited.

[0064] Reference Figure 1 , Figure 1 This is one of the flowcharts illustrating the abnormal component tracing method provided in this application. The abnormal component tracing method provided in this application includes:

[0065] Step S10: Determine the component structure diagram and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram.

[0066] It should be noted that, in the process of tracing the source of abnormal components, it is first necessary to abstract each component of the terminal device into graph nodes, and then construct the component structure diagram of the terminal device based on each graph node. Components include each software device and each hardware device of the terminal device. The terminal device includes, but is not limited to, mobile terminal devices, computer devices, and PC devices (Personal Computers). For ease of explanation of the embodiments of this application, a computer device is used as an example of the terminal device. The specific process of constructing the component structure diagram is as described in steps a to c:

[0067] Step a: Identify each software device and each hardware device of the terminal device as a component, and identify each component as a graph node;

[0068] Step b: Determine the calling relationship between each graph node as node edge, and determine the number of calls between each graph node as edge weight;

[0069] Step c: Construct the component structure graph based on each graph node and the node edges and edge weights between each graph node.

[0070] Specifically, a computer device is composed of multiple devices, mainly categorized into software and hardware. Therefore, the component sourcing system identifies each software and hardware device within the computer device and abstracts them into components. Next, the component sourcing system abstracts these components into graph nodes, simultaneously determining the call relationships and frequency between them. In other words, the component sourcing system determines the call relationships and frequency between hardware and hardware, hardware and software, and software components.

[0071] Furthermore, the component sourcing system abstracts the calling relationships between various components of a computer device into node edges, and the number of calls between various components of a computer device into the edge weights of node edges. Finally, the component sourcing system constructs a component structure graph based on each graph node, the node edges between graph nodes, and the edge weights of each node edge.

[0072] In one embodiment, the component sourcing system abstracts each software device and each hardware device into m components, namely component 1, component 2 to component m. Component 1 has a calling relationship with component 2, component 4 and component 5. Therefore, component 1 has node edges with component 2, component 4 and component 5 respectively. The number of calls of component 1 with component 2, component 4 and component 5 are 15 times, 2 times and 3 times respectively. Therefore, the edge weights of the node edges of component 1 with component 2, component 4 and component 5 are 15, 2 and 3 respectively.

[0073] Component 2 has a calling relationship with Component 3 and Component m. Therefore, there are node edges between Component 2, Component 3 and Component m. The number of calls between Component 2, Component 3 and Component m are 4 and 6 respectively. Therefore, the edge weights of the node edges between Component 2, Component 3 and Component m are 4 and 6 respectively.

[0074] Component 4 and component m have a calling relationship; therefore, components 4 and component m have a node edge. The number of calls to components 4 and m is 27; therefore, the edge weight of the node edge between components 4 and component m is 27. Based on the description in the above embodiment, the resulting component structure diagram is as follows: Figure 2 , Figure 2 This is a schematic diagram of the component structure provided in this application.

[0075] In this embodiment, the various software devices and hardware devices of the terminal device are abstracted into various components, and the usage relationships between various components and the number of calls between various components are abstracted into graph nodes, node edges and edge weights to construct the component structure graph of the terminal device, thereby enriching the semantics of the components through nodes.

[0076] Furthermore, after constructing the component structure diagram of the terminal device, the component tracing system first obtains the component structure diagram when tracing abnormal components is required. Next, the component tracing system determines the self-description information of each graph node in the component structure diagram, i.e., the component error information, and determines the relationship description information of the edges between each node in the component structure diagram. Furthermore, the component tracing system can define the self-description information of each graph node as the first description information and the relationship description information of the edges between each node as the second description information.

[0077] In one embodiment, component 1 in the component structure diagram is the CPU, and component 5 is the hard disk. Component 5 calls component 1 for data processing. The number of calls between component 1 and component 5 is 3, meaning the edge weight of the node edge between component 1 and component 5 is 3, indicating that the CPU accesses the hard disk data 3 times. Therefore, the second description information of the node edge between component 1 and component 5 is: CPU accesses the hard disk 3 times. If component 1 is called normally, no error information will be written to the log. If there is a problem with the call to component 1, the first description information of component 5 is that the hard disk data cannot be read by the CPU, and the first description information of the component 1 node is that the CPU encountered an error when calling the hard disk.

[0078] Next, the component tracing system converts the first and second description information of each graph node into sentence vectors using the Doc2Vector algorithm. Finally, the component tracing system weights and concatenates the sentence vectors of the first and second description information of each graph node to construct the node vector of each graph node, as described in steps S101 to S103.

[0079] Further, steps S101 to S103 are described as follows:

[0080] Step S101: Generate node sentence vectors for each graph node based on the first description information of each graph node, and generate edge sentence vectors for each node edge based on the second description information of each node edge.

[0081] Step S102: The weighted average of the connection vectors of each node edge is calculated to obtain the average vector of the connection vectors of each node edge.

[0082] Step S103: Concatenate the node sentence vector of each graph node and the average edge vector of each node edge to generate the node vector.

[0083] Specifically, the component tracing system uses the Doc2Vector algorithm to convert the first description information of each graph node into a node sentence vector for each graph node. The generated node sentence vector has a dimension of m1. Therefore, the node sentence vector can be represented as (x1, x2, ..., x...). m1 ).

[0084] Next, the component tracing system uses the Doc2Vector algorithm to convert the second description information of each node edge into a connection sentence vector for each node edge. The generated node sentence vector has a dimension of m2. Therefore, the connection sentence vector can be represented as (y1, y2, ..., y m2 ).

[0085] Next, the component tracing system will assign edge vectors (y1, y2, ..., y) to each node. m2We then perform a weighted average to obtain the edge mean vector for each node's edges. Further, the edge mean vector can be represented as...

[0086] Finally, the component tracing system will assign the node sentence vectors (x1, x2, ..., x) of each graph node to the node sentence vectors (x1, x2, ..., x). m1 and the mean vector of the edges connecting each node. Concatenate the nodes to generate a node vector (z1, z2, ..., z). m1+m ), where the node vectors (z1, z2, ..., z) m1+m2 ) can be represented as

[0087] This application embodiment uses the Doc2Vector algorithm to construct a node vector from the first and second description information, thereby fusing the node's own description information and the edge description information to construct a semantically strong node feature vector, enriching the semantic representation of the node.

[0088] Step S20: The target node vector is generated by combining each graph node and the node vector using a node vectorization algorithm.

[0089] It should be noted that when embedding graph nodes, the DeepWalk algorithm is used to capture the graph structure relationships between nodes. The original DeepWalk algorithm generates node sequences using random walks and based on the transition probabilities of node edge weights. This embodiment considers that the generation of node sequences requires not only consideration of edge weights but also the similarity between graph nodes and the importance of each node within the graph structure. Therefore, when calculating the transition probability of a random walk, this embodiment incorporates the degree of the node to be transferred and the similarity between the two transferred nodes into the numerator and denominator of the original formula. Thus, the calculation of the transition probability includes information on node degree and similarity, resulting in a richer semantic information in the calculation of the transition probability.

[0090] Therefore, this embodiment of the application modifies the transition matrix using the node vectorization algorithm of DS-DeepWalk, which stands for Degree Similarity DeepWalk. Further, the original formula for calculating the transition probability of the DeepWalk algorithm is as follows: The formula for calculating the transition probability of the DS-DeepWalk node vectorization algorithm in this embodiment is as follows: Among them, w(v) i ,v j ) represents graph node v i ,v j The edge weight of the node edge, i.e. Figure 2 The numerical values ​​between components in the component structure diagram. D j Represents graph node v j The node degree, which is represented by the graph node v j The number of connected nodes, that is, how many components a component in the component structure diagram is connected to. For example... Figure 2 In the component structure diagram, component 1 is connected to components 2, 4, and 5, meaning the node degree of component 1 is 3. S(v i ,v j ) represents graph node v i ,v j The similarity between them can be calculated using methods including, but not limited to, cosine similarity and absolute mean error.

[0091] Furthermore, the component traceability system uses the DS-DeepWalk node vectorization algorithm to combine each graph node and generate a graph structure vector (e1, e2, ..., e) for each graph node. m3 Next, the component tracing system will assign the graph structure vector (e1, e2, ..., e) to each graph node. m3 The node vectors (z1, z2, ..., z) incorporated into each graph node m1+m2 In the process, the target node vector is obtained, as described in steps S201 to S202.

[0092] Further, steps S201 to S202 are described as follows:

[0093] Step S201: By combining the edge weights and similarities between each graph node with the node vectorization algorithm, each graph node's node degree is used to generate a graph structure vector.

[0094] Step S202: Concatenate each of the graph structure vectors with the node vectors to generate the target node vector.

[0095] Specifically, according to the formula for calculating the transition probability of the DS-DeepWalk node vectorization algorithm. It is known that the component tracing system needs to determine the edge weights and similarities between each graph node, as well as the node degree of each graph node.

[0096] Next, the component tracing system uses the DS-DeepWalk node vectorization algorithm, combining the edge weights and similarities between graph nodes, as well as the node degree of each graph node, to calculate the graph structure vector (e1, e2, ..., e) of each graph node. m3 Finally, the component tracing system will use the graph structure vector (e1, e2, ..., e) m3 The node vector (z1, z2, ..., z) is included in step S10.m1+m2 In the graph structure vector (e1, e2, ..., e), m3 ) and node vectors (z1, z2, ..., z m1+m2 The nodes are concatenated to generate the target node vector. The target node vector can be represented as X.

[0097] X=(g1,g2,…,g m1+m2+m3 )=(z1,z2,…,z m1+m2 ,e1,e2,…,e m3 ).

[0098] Furthermore, the graph structure vector (e1, e2, ..., e m3 The generation process of ) is as follows:

[0099] In one embodiment, the edge weight between component 1 and component 2 is w(v1,v2), the node degree of component 2 is D2, and the similarity between component 1 and component 2 is S(v1,v2). The component tracing system multiplies the product of w(v1,v2), D2, and S(v1,v2) with the weights of the k components w(v1,v2) and D2. k D k and S(v1,v k By taking the ratio of the products of components 1 and 2, the transition probability p between component 1 and component 2 can be obtained. 1,2 transition probability p 1,2 It can be represented as Among them, v k Let represent the k-th component. Next, the component tracing system uses the transition probability p... 1,2 Determine whether to connect component 1 and component 2. If connected, continue using component 2 as the basis, according to the transition probability p. 1,2 The calculation method determines whether to connect component 2 and component 3. If they are connected, then continue based on component 3, according to the transition probability p. 1,2 The calculation method determines whether to connect component 3 and component 4, and so on, until they are not connected, which will result in a complete graph structure vector.

[0100] The embodiments of this application correct the transition probability through the DS-DeepWalk node vectorization algorithm, thereby capturing node graph structure information and enriching the semantic representation of nodes.

[0101] Step S30: The graph nodes are aggregated in a hierarchical manner by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector.

[0102] It should be noted that the hierarchical aggregation algorithm in this application embodiment is a modified GCN aggregation algorithm. The original GCN aggregation algorithm usually adopts the mean aggregation method. Therefore, in the original GCN aggregation algorithm, if the similarity between neighboring nodes and the target node is high, mean aggregation essentially strengthens the target node itself, generating little new information. Therefore, this application embodiment performs hierarchical aggregation and expands the feature dimension by modifying the GCN hierarchical aggregation algorithm.

[0103] The aggregation formula of the original GCN aggregation algorithm is: in D represents the degree matrix. This represents a degree matrix that contains itself. A represents the connection matrix. Let I represent the connection matrix containing itself, λ represent the identity matrix, and λ be a manually selected parameter. The original GCN aggregation algorithm simply performs mean aggregation on first-order neighbor nodes. The modified GCN hierarchical aggregation algorithm in this application embodiment needs to consider setting a threshold and information fusion, as follows:

[0104] The component sourcing system needs to set a node similarity threshold and use the target node vector as the original vector representation of the graph node. The node similarity threshold can be represented as t1, where t1 is a threshold set according to the actual scenario. Next, based on the target node vector and the node similarity threshold, the component sourcing system determines the first node set and the second node set for each graph node. First-order nodes are those directly connected to each graph node. The similarity between each node in the first node set and each graph node is greater than or equal to the node similarity threshold, while the similarity between each node in the second node set and each graph node is less than the node similarity threshold.

[0105] Furthermore, the component sourcing system constructs a first threshold counting matrix based on the number of nodes in the first node set of each graph node. This first threshold counting matrix is ​​the threshold counting matrix of nodes whose similarity to each graph node is greater than or equal to a node similarity threshold. Simultaneously, the component sourcing system constructs a second threshold counting matrix based on the number of nodes in the second node set of each graph node. This second threshold counting matrix is ​​the threshold counting matrix of nodes whose similarity to each graph node is less than a node similarity threshold. The first threshold counting matrix TH1 and the second threshold counting matrix TH2 are as follows:

[0106]

[0107]

[0108] Among them, thr1(v i = count({v k |s(v i,v k )≥t1,v k ∈N(v i )}), count is a counting function that returns the value corresponding to the number of elements in the array; s(v i ,v k ) represents graph node v i And graph node v k Similarity; thr1(v i ) = count({v k |s(v i ,v k )≥t1,v k ∈N(v i )}) represents the relationship between graph node v i In the set of connected nodes, if the node and graph node v i If the similarity between nodes is greater than the node similarity threshold t1, the node will be retained. The total number of nodes retained is calculated, resulting in thr1(v i ).

[0109] For thr2(v) i ) = count({v k |s(v i ,v k ) <t1,v k ∈N(v i )}),thr2(v i ) = count({v k |s(v i ,v k ) <t1,v k ∈N(v i )}) represents the graph node v i In the set of connected nodes, if the node and graph node v i If the similarity between nodes is less than the node similarity threshold t1, the node will be retained. The total number of nodes retained is calculated to obtain thr2(v). i ).

[0110] Next, the component tracing system determines the degree matrix based on the degree of each graph node. At the same time, the degree matrix The inverse matrix is ​​multiplied element-wise by the first threshold counting matrix TH1 to obtain the first degree matrix. At the same time, the degree matrix The reciprocal matrix is ​​multiplied element-wise by the second threshold counting matrix TH2 to obtain the second degree matrix. The first degree matrix and the second degree matrix are respectively a modification of the original degree matrix, so that similarity information can be obtained on the basis of the original. One is to obtain a matrix that is greater than or equal to the node similarity threshold t1, and the other is to obtain a matrix that is less than the node similarity threshold t1, thus providing two aggregation methods for subsequent mean aggregation.

[0111] Furthermore, the component tracing system constructs a first connection matrix based on the connectivity between each graph node and each node in the first node set. Specifically, the component tracing system degenerates the connections of nodes with similarity less than a node similarity threshold t1 to 0. Thus, the first connection matrix is... Next, the component tracing system constructs a second connection matrix based on the connectivity between each graph node and each node in the second node set.

[0112] The connections to nodes whose similarity to each graph node is greater than or equal to the node similarity threshold t1 are degraded to 0, and the second connection matrix is... in, and Consistent dimensions

[0113] Furthermore, the mean aggregation is performed in different cases: The first method involves aggregating the first threshold counting matrix, the first degree matrix, the first connection matrix, and the label node vector X to obtain the first node information fusion vector. The first node information fusion vector is... The second method involves aggregating the second threshold counting matrix, the second degree matrix, the second connection matrix, and the label node vector X to obtain the second node information fusion vector. The second node information fusion vector is... Finally, the component tracing system fuses the first node information fusion vector X1 and the second node information fusion vector X2 through neural network concatenation to obtain a first-order aggregate vector H1, which is H1 = [X1, X2]W1. Here, W1 is the new feature transformation coefficient matrix. Simply put, it uses two different methods to assign the average of the vectors of all nodes with a similarity threshold t1 to each graph node, and the average of the vectors of all nodes with a similarity threshold t1 to each graph node.

[0114] Step S40: Perform multi-level aggregation on each graph node using a multi-level aggregation algorithm combined with the target node vector to obtain a multi-level aggregation vector. Then, weight the first-level aggregation vector and the multi-level aggregation vector to obtain the final node vector.

[0115] It should be noted that the multi-order aggregation algorithm in this application embodiment is the Inception aggregation algorithm. The Inception aggregation algorithm in this application embodiment is consistent with the idea of ​​the modified GCN hierarchical aggregation algorithm. The modified GCN hierarchical aggregation algorithm performs hierarchical aggregation on the first-order nodes directly connected to each graph node, while the Inception aggregation algorithm performs hierarchical aggregation on the second-order and third-order nodes indirectly connected to each graph node. (Refer to...) Figure 3 , Figure 3 This is a schematic diagram of the node connections of various orders provided in this application, where ① represents a first-order node, ② represents a second-order node, and ③ represents a third-order node.

[0116] The processing of second-order and third-order nodes is the same as that of first-order nodes, and will not be elaborated further here. Therefore, the final second-order aggregate vector is: The third-order aggregation vector is

[0117] Further, the component tracing system performs a weighted linear summation of the first-order aggregation vector H1 obtained in step S30, along with the second-order aggregation vector H2 and the third-order aggregation vector H3, to obtain the final node vector H4. Specifically, the final node vector H4 = α1*H1 + α2*H2 + α3*H3, where the hyperparameters α1 + α2 + α3 = 1, α1 ≥ 0, α2 ≥ 0, and α3 ≥ 0. In one embodiment, for example, α1 = 0.6, α2 = 0.3, and α3 = 0.1.

[0118] In one embodiment, continue to refer to Figure 3 The essence of the first-order aggregation vector is: component k1 is directly connected to components k2 and k4. Therefore, components k2 and k4 are first-order nodes of component k1. The average of the node vectors of components k2 and k4 is added to the node vector of component k1 to achieve first-order information aggregation of components k1, k2 and k4, resulting in the first-order aggregation vector of component k1.

[0119] For the second-order aggregated vector: Component k1 cannot be directly connected to components k3 and k6. It takes two steps to connect to components k3 and k6. Therefore, components k3 and k6 are second-order nodes of component k1. By taking the average of the node vectors of components k3 and k6 and adding the node vector of component k1, the second-order information aggregation of components k1, k3, and k6 is achieved, resulting in the second-order aggregated vector of component k1.

[0120] For the third-order aggregated vector: Component k1 cannot be directly connected to components k5 and k7. It takes three steps to connect to components k5 and k7. Therefore, components k5 and k7 are third-order nodes of k1. By taking the average of the node vectors of components k5 and k7 and adding the node vector of component k1, the third-order information aggregation of components k1, k5 and k7 is achieved, resulting in the third-order aggregated vector of component k1.

[0121] Step S50: Locate the most frequent graph node by combining the standard classification model with the final node vector, and identify the most frequent graph node as an abnormal node.

[0122] It should be noted that the standard classification model in this embodiment is a standard classification model based on the PU-Learning framework, where PU in the PU-Learning framework is the binary classifier model_PU, and Learning is the learning model.

[0123] Further, after steps S10 to S40, the component tracing system obtains the final node vector with well-defined node features and uses this final node vector as the input to the preset learning model. Next, the component tracing system outputs an anomaly log of the final node vector when an anomaly warning occurs, using the preset learning model. This log contains anomaly labels for the anomaly nodes and unknown labels for nodes to be processed. Therefore, the initial anomaly nodes in the log can be determined based on the anomaly labels, and the nodes to be processed can be determined based on the unknown labels. Then, the component tracing system constructs an initial binary classifier, model_PU, based on the initial anomaly nodes and the nodes to be processed. The initial binary classifier model_PU uses XGBOOST as the baseline classifier. Further, the component tracing system calculates the first probability value of the initial anomaly nodes and the second probability value of the nodes to be processed using the initial binary classifier model_PU.

[0124] Next, the component tracing system uses a preset quantile of the first probability value as the abnormal sample threshold. A quantile, also known as a percentile point, refers to the numerical points at which the probability distribution range of a random variable is divided into several equal parts. In one embodiment, if the preset quantile is 20%, then this number is determined to rank in the top 20% of the entire data. For ease of explanation of the embodiments of this application, the 20% quantile of the probability value is used as the abnormal sample threshold. Further, the component tracing system filters the nodes to be processed based on the abnormal sample threshold and the second probability value. Specifically, the component tracing system compares the second probability value of the node to be processed with the abnormal sample threshold, determines the nodes to be processed corresponding to the second probability value whose value is less than the abnormal sample threshold, and identifies these nodes as abnormal nodes to be processed. Further, the component tracing system identifies these abnormal nodes as abnormal sample data.

[0125] Furthermore, the component traceability system records abnormal sample data as And abnormal sample data The sample in the system is sampled a preset number of times to obtain a first abnormal sample set and a second abnormal sample set. The preset number of times is set according to the actual situation. In this embodiment, the preset number of times is represented by m times, that is, the component traceability system samples abnormal sample data. The sample in the sample is sampled m times.

[0126] Furthermore, the component traceability system analyzes abnormal sample data. After m samplings, the first set of abnormal samples is: to The component traceability system analyzes abnormal sample data. After m samplings, the second set of abnormal samples is: to in, and correspond, and correspond, and correspond.

[0127] It should be noted that, and The intersection is empty, and the union contains outlier data.

[0128] Furthermore, the component tracing system will use the first set of abnormal samples. Included in the initial abnormal nodes, based on the first abnormal sample set A new classifier is reconstructed based on the initial abnormal nodes; this new classifier can be represented as `model_classify`. Then, the component tracing system uses the new classifier `model_classify` to analyze the second set of abnormal samples. Prediction is performed to obtain each target anomaly node, which is represented as follows:

[0129] Finally, the component tracing system targets abnormal nodes. to Perform a union operation to locate the most frequent graph node among all target anomaly nodes, and then identify the most frequent graph node as the anomaly node.

[0130] This embodiment provides a method for tracing the source of abnormal components. In the process of tracing the source of abnormal components, the semantic representation of nodes is enriched by a node vectorization algorithm, the feature dimension of nodes is expanded by a hierarchical aggregation algorithm, the perceptual information of nodes is expanded by a multi-level aggregation algorithm, and finally the abnormal nodes are traced out quickly and accurately by a standard classification model. That is, it is possible to quickly and accurately trace out the abnormal components in all components.

[0131] Reference Figure 4 , Figure 4 This is the second flowchart of the abnormal component tracing method provided in this application. The detailed process of step S30 is as follows:

[0132] Step S301: Determine the node similarity threshold and determine the target node vector as the original vector representation of each graph node;

[0133] Step S302: Based on the target node vector and the node similarity threshold, determine the first node set and the second node set of the first-order nodes in each of the graph nodes;

[0134] Step S303: The first node set and the second node set of each graph node are hierarchically aggregated using the hierarchical aggregation algorithm to determine the first-order aggregation vector.

[0135] The aggregation formula of the original GCN aggregation algorithm is: in D represents the degree matrix. This represents a degree matrix that contains itself. A represents the connection matrix. This represents the connection matrix containing itself. The original GCN aggregation algorithm simply performs mean aggregation on first-order neighbor nodes. The modified GCN hierarchical aggregation algorithm in this embodiment needs to consider setting a threshold and information fusion, as follows:

[0136] The component sourcing system needs to set a node similarity threshold and use the target node vector as the original vector representation of the graph node. The node similarity threshold can be represented as t1, where t1 is a threshold set according to the actual scenario. Next, based on the target node vector and the node similarity threshold, the component sourcing system determines the first node set and the second node set for each graph node. First-order nodes are those directly connected to each graph node. The similarity between each node in the first node set and each graph node is greater than or equal to the node similarity threshold, while the similarity between each node in the second node set and each graph node is less than the node similarity threshold. Finally, the component sourcing system modifies the GCN hierarchical aggregation algorithm, combining the first and second node sets to perform hierarchical aggregation on each graph node, obtaining a first-order aggregated vector, as described in steps S3031 to S3035.

[0137] Further, steps S3031 to S3035 are described as follows:

[0138] Step S3031: Construct a first threshold counting matrix based on the number of nodes in the first node set of each graph node, and construct a second threshold counting matrix based on the number of nodes in the second node set of each graph node.

[0139] Step S3032: Construct a first degree matrix based on each graph node and the first threshold counting matrix; construct a second degree matrix based on each graph node and the second threshold counting matrix.

[0140] Step S3033: Construct a first connection matrix based on the connectivity between each graph node and each node in the first node set, and construct a second connection matrix based on the connectivity between each graph node and each node in the second node set;

[0141] Step S3034: Based on the first threshold counting matrix, the first degree matrix, and the first connection matrix, determine the first node information fusion vector, and based on the second threshold counting matrix, the second degree matrix, and the second connection matrix, determine the second node information fusion vector;

[0142] Step S3035: The first node information fusion vector and the second node information fusion vector are fused to obtain the first-order aggregated vector.

[0143] Specifically, the component sourcing system constructs a first threshold counting matrix based on the number of nodes in the first node set of each graph node. This first threshold counting matrix represents the threshold counting matrix of nodes whose similarity to each graph node is greater than or equal to a node similarity threshold. Simultaneously, the component sourcing system constructs a second threshold counting matrix based on the number of nodes in the second node set of each graph node. This second threshold counting matrix represents the threshold counting matrix of nodes whose similarity to each graph node is less than a node similarity threshold. The first threshold counting matrix TH1 and the second threshold counting matrix TH2 are as follows:

[0144]

[0145]

[0146] Among them, thr1(v i ) = count({v k |s(v i ,v k )≥t1,v k ∈N(v i )}), count is a counting function that returns the value corresponding to the number of elements in the array; s(v i ,v k ) represents graph node v i And graph node v k Similarity; thr1(v i = count({v k |s(v i ,v k )≥t1,v k ∈N(v i )}) represents the relationship between graph node v i In the set of connected nodes, if the node and graph node v i If the similarity between nodes is greater than the node similarity threshold t1, the node will be retained. The total number of nodes retained is calculated, resulting in thr1(v i ).

[0147] For thr2(v) i = count({v k |s(v i ,v k ) <t1,v k ∈N(v i )}),thr2(v i ) = count({v k |s(v i ,v k ) <t1,v k ∈N(v i)}) represents the graph node v i In the set of connected nodes, if the node and graph node v i If the similarity between nodes is less than the node similarity threshold t1, the node will be retained. The total number of nodes retained is calculated to obtain thr2(v). i ).

[0148] Next, the component tracing system determines the degree matrix based on the degree of each graph node. At the same time, the degree matrix The inverse matrix is ​​multiplied element-wise by the first threshold counting matrix TH1 to obtain the first degree matrix. At the same time, the degree matrix The reciprocal matrix is ​​multiplied element-wise by the second threshold counting matrix TH2 to obtain the second degree matrix. The first degree matrix and the second degree matrix are respectively a modification of the original degree matrix, so that similarity information can be obtained on the basis of the original. One is to obtain a matrix that is greater than or equal to the node similarity threshold t1, and the other is to obtain a matrix that is less than the node similarity threshold t1, thus providing two aggregation methods for subsequent mean aggregation.

[0149] Furthermore, the component tracing system constructs a first connection matrix based on the connectivity between each graph node and each node in the first node set. Specifically, the component tracing system degenerates the connections of nodes with similarity less than a node similarity threshold t1 to 0. Thus, the first connection matrix is... Next, the component tracing system constructs a second connection matrix based on the connectivity between each graph node and each node in the second node set. Specifically, it degenerates the connections between nodes whose similarity to each graph node is greater than or equal to the node similarity threshold t1 to 0. The second connection matrix is ​​then defined as follows: in, and Consistent dimensions

[0150] Furthermore, the mean aggregation is performed in different cases: The first method involves aggregating the first threshold counting matrix, the first degree matrix, the first connection matrix, and the label node vector X to obtain the first node information fusion vector. The first node information fusion vector is... The second method involves aggregating the second threshold counting matrix, the second degree matrix, the second connection matrix, and the label node vector X to obtain the second node information fusion vector. The second node information fusion vector is... Finally, the component tracing system fuses the first node information fusion vector X1 and the second node information fusion vector X2 through neural network concatenation to obtain a first-order aggregate vector H1, which is H1 = [X1, X2]W1. Here, W1 is the new feature transformation coefficient matrix. Simply put, it uses two different methods to assign the average of the vectors of all nodes with a similarity threshold t1 to each graph node, and the average of the vectors of all nodes with a similarity threshold t1 to each graph node.

[0151] The embodiments of this application expand the feature dimension of nodes through a hierarchical aggregation algorithm.

[0152] Reference Figure 5 , Figure 5 This is the third flowchart of the abnormal component tracing method provided in this application. The detailed process of step S50 is as follows:

[0153] Step S501: Output the abnormal log of the final node vector when an abnormal warning occurs through the preset learning model;

[0154] Step S502: Construct an initial binary classifier based on the initial abnormal nodes and nodes to be processed in the abnormal log, and calculate the first probability value of the initial abnormal nodes and the second probability value of the nodes to be processed based on the initial binary classifier.

[0155] Step S503: Determine the abnormal nodes to be processed among the nodes to be processed based on the first probability value and the second probability value, and determine the abnormal nodes to be processed as abnormal sample data;

[0156] Step S504: Based on the abnormal sample data and the initial abnormal node, locate the graph node with the highest frequency.

[0157] Further, after steps S10 to S40, the component tracing system obtains the final node vector with well-defined node features and uses this final node vector as the input to the preset learning model. Next, the component tracing system outputs an anomaly log of the final node vector when an anomaly warning occurs, using the preset learning model. This log contains anomaly labels for the anomaly nodes and unknown labels for nodes to be processed. Therefore, the initial anomaly nodes in the log can be determined based on the anomaly labels, and the nodes to be processed can be determined based on the unknown labels. Then, the component tracing system constructs an initial binary classifier, model_PU, based on the initial anomaly nodes and the nodes to be processed. The initial binary classifier model_PU uses XGBOOST as the baseline classifier. Further, the component tracing system calculates the first probability value of the initial anomaly nodes and the second probability value of the nodes to be processed using the initial binary classifier model_PU.

[0158] Next, the component tracing system uses a preset quantile of the first probability value as the abnormal sample threshold. A quantile, also known as a percentile point, refers to the numerical points at which the probability distribution range of a random variable is divided into several equal parts. In one embodiment, if the preset quantile is 20%, then this number is determined to rank in the top 20% of the entire data. For ease of explanation of the embodiments of this application, the 20% quantile of the probability value is used as the abnormal sample threshold. Further, the component tracing system filters the nodes to be processed based on the abnormal sample threshold and the second probability value. Specifically, the component tracing system compares the second probability value of the node to be processed with the abnormal sample threshold, determines the nodes to be processed corresponding to the second probability value whose value is less than the abnormal sample threshold, and identifies the nodes to be processed corresponding to the second probability value whose value is less than the abnormal sample threshold as abnormal nodes to be processed.

[0159] Finally, the component tracing system identifies the abnormal nodes to be processed as abnormal sample data. Through the abnormal sample data and the initial abnormal nodes, it locates the graph node with the highest frequency. The specific process is as described in steps S5041 to S5043.

[0160] Further, steps S5041 to S5043 are described as follows:

[0161] Step S5041: Sample the abnormal sample data a preset number of times to obtain a first abnormal sample set and a second abnormal sample set;

[0162] Step S5042: Construct a target binary classifier based on the first abnormal sample set and the initial abnormal nodes, and use the target binary classifier to predict the second abnormal sample set to obtain each target abnormal node;

[0163] Step S5043: Perform a union operation on each of the target abnormal nodes to locate the graph node with the highest frequency among the target abnormal nodes.

[0164] Specifically, the component traceability system records abnormal sample data as And abnormal sample data The sample in the system is sampled a preset number of times to obtain a first abnormal sample set and a second abnormal sample set. The preset number of times is set according to the actual situation. In this embodiment, the preset number of times is represented by m times, that is, the component traceability system samples abnormal sample data. The sample in the sample is sampled m times.

[0165] Furthermore, the component traceability system analyzes abnormal sample data. After m samplings, the first set of abnormal samples is: to The component traceability system analyzes abnormal sample data. After m samplings, the second set of abnormal samples is: to in, and correspond, and correspond, and correspond.

[0166] It should be noted that, and The intersection is empty, and the union contains outlier data.

[0167] Furthermore, the component tracing system will use the first set of abnormal samples. Included in the initial abnormal nodes, based on the first abnormal sample set A new classifier is reconstructed based on the initial abnormal nodes; this new classifier can be represented as `model_classify`. Then, the component tracing system uses the new classifier `model_classify` to analyze the second set of abnormal samples. Prediction is performed to obtain each target anomaly node, which is represented as follows:

[0168] Finally, the component tracing system targets abnormal nodes. to Perform a union operation to locate the graph node with the highest frequency among all target abnormal nodes, and identify the graph node with the highest frequency as the abnormal node.

[0169] The embodiments of this application use a standard classification model to quickly and accurately trace abnormal nodes, that is, to quickly and accurately trace abnormal components among all components.

[0170] Furthermore, the abnormal component tracing device provided in this application will be described below. The abnormal component tracing device and the abnormal component tracing method can be referred to each other accordingly.

[0171] like Figure 6 As shown, Figure 6 This is a schematic diagram of the abnormal component tracing device provided in this application. The abnormal component tracing device includes:

[0172] The generation module 601 is used to determine the component structure diagram and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram.

[0173] The generation module 602 is used to generate a target node vector by combining each graph node and the node vector through a node vectorization algorithm;

[0174] The hierarchical aggregation module 603 is used to perform hierarchical aggregation on each graph node by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregation vector.

[0175] The aggregation weighting module 604 is used to perform multi-level aggregation on each of the graph nodes by combining the target node vector with a multi-level aggregation algorithm to obtain a multi-level aggregation vector, and to weight the first-level aggregation vector and the multi-level aggregation vector to obtain the final node vector;

[0176] The source tracing module 605 is used to locate the most frequent graph node by combining the final node vector with the standard classification model, and to identify the most frequent graph node as an abnormal node.

[0177] Furthermore, the generation module 601 is also used for:

[0178] Based on the first description information of each graph node, a node sentence vector of each graph node is generated, and based on the second description information of each node edge, a connection sentence vector of each node edge is generated.

[0179] The average value of the connection vectors of each node edge is obtained by weighting and averaging the connection vectors of each node edge.

[0180] The node vector is generated by concatenating the node sentence vector of each graph node and the average edge vector of each node edge.

[0181] Furthermore, the generation module 601 is also used for:

[0182] Each software device and each hardware device of the terminal device is identified as a component, and each component is identified as a graph node;

[0183] The calling relationships between the graph nodes are defined as node edges, and the number of calls between the graph nodes is defined as edge weights.

[0184] The component structure graph is constructed based on each graph node, as well as the node edges and edge weights between the graph nodes.

[0185] Furthermore, the generation module 602 is also used for:

[0186] The node vectorization algorithm combines the edge weights and similarities between the graph nodes, as well as the node degree of each graph node, to generate various graph structure vectors.

[0187] The target node vector is generated by concatenating each of the graph structure vectors with the node vectors.

[0188] Furthermore, the hierarchical aggregation module 603 is also used for:

[0189] Determine the node similarity threshold and use the target node vector as the original vector representation of each graph node;

[0190] Based on the target node vector and the node similarity threshold, determine the first node set and the second node set of the first-order nodes in each of the graph nodes;

[0191] The first node set and the second node set of each graph node are hierarchically aggregated using the hierarchical aggregation algorithm to determine the first-order aggregation vector.

[0192] Furthermore, the hierarchical aggregation module 603 is also used for:

[0193] A first threshold counting matrix is ​​constructed based on the number of nodes in the first node set of each graph node, and a second threshold counting matrix is ​​constructed based on the number of nodes in the second node set of each graph node.

[0194] A first degree matrix is ​​constructed based on each of the graph nodes and the first threshold counting matrix, and a second degree matrix is ​​constructed based on each of the graph nodes and the second threshold counting matrix.

[0195] A first connection matrix is ​​constructed based on the connectivity between each graph node and each node in the first node set, and a second connection matrix is ​​constructed based on the connectivity between each graph node and each node in the second node set.

[0196] Based on the first threshold counting matrix, the first degree matrix, and the first connection matrix, a first node information fusion vector is determined, and based on the second threshold counting matrix, the second degree matrix, and the second connection matrix, a second node information fusion vector is determined.

[0197] The first node information fusion vector and the second node information fusion vector are fused to obtain the first-order aggregate vector.

[0198] Furthermore, the traceability module 605 is also used for:

[0199] The final node vector is output as an anomaly log when an anomaly warning occurs through a preset learning model;

[0200] An initial binary classifier is constructed based on the initial abnormal nodes and nodes to be processed in the abnormal log, and a first probability value of the initial abnormal nodes and a second probability value of the nodes to be processed are calculated based on the initial binary classifier.

[0201] Based on the first probability value and the second probability value, determine the abnormal nodes to be processed in the nodes to be processed, and identify the abnormal nodes to be processed as abnormal sample data;

[0202] Based on the abnormal sample data and the initial abnormal node, the graph node with the highest frequency is located.

[0203] Furthermore, the traceability module 605 is also used for:

[0204] The abnormal sample data is sampled a preset number of times to obtain a first abnormal sample set and a second abnormal sample set;

[0205] A target binary classifier is constructed based on the first abnormal sample set and the initial abnormal nodes, and the target binary classifier is used to predict the second abnormal sample set to obtain each target abnormal node.

[0206] By performing a union operation on all the target abnormal nodes, the graph node with the highest frequency among all the target abnormal nodes is located.

[0207] The specific embodiments of the abnormal component tracing device provided in this application are basically the same as the embodiments of the abnormal component tracing method described above, and will not be repeated here.

[0208] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute an abnormal component tracing method, which includes:

[0209] Determine the component structure diagram, and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram;

[0210] The target node vector is generated by combining each graph node and the node vector using a node vectorization algorithm.

[0211] The graph nodes are aggregated hierarchically by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector.

[0212] The graph nodes are aggregated in multiple order by combining the target node vector with a multi-order aggregation algorithm to obtain a multi-order aggregation vector. The first-order aggregation vector and the multi-order aggregation vector are then weighted to obtain the final node vector.

[0213] The most frequent graph node is located by combining the standard classification model with the final node vector, and the most frequent graph node is identified as an abnormal node.

[0214] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0215] On the other hand, this application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer is able to execute the abnormal component tracing method provided by the above methods. This method includes:

[0216] Determine the component structure diagram, and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram;

[0217] The target node vector is generated by combining each graph node and the node vector using a node vectorization algorithm.

[0218] The graph nodes are aggregated hierarchically by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector.

[0219] The graph nodes are aggregated in multiple order by combining the target node vector with a multi-order aggregation algorithm to obtain a multi-order aggregation vector. The first-order aggregation vector and the multi-order aggregation vector are then weighted to obtain the final node vector.

[0220] The most frequent graph node is located by combining the standard classification model with the final node vector, and the most frequent graph node is identified as an abnormal node.

[0221] Furthermore, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the aforementioned methods for tracing the source of abnormal components, the method comprising:

[0222] Determine the component structure diagram, and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram;

[0223] The target node vector is generated by combining each graph node and the node vector using a node vectorization algorithm.

[0224] The graph nodes are aggregated hierarchically by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector.

[0225] The graph nodes are aggregated in multiple order by combining the target node vector with a multi-order aggregation algorithm to obtain a multi-order aggregation vector. The first-order aggregation vector and the multi-order aggregation vector are then weighted to obtain the final node vector.

[0226] The most frequent graph node is located by combining the standard classification model with the final node vector, and the most frequent graph node is identified as an abnormal node.

[0227] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0228] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0229] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for tracing the source of abnormal components, characterized in that, include: Determine the component structure diagram, and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram; The target node vector is generated by combining each graph node and the node vector using a node vectorization algorithm. The graph nodes are aggregated hierarchically by combining the target node vector with the hierarchical aggregation algorithm to obtain a first-order aggregated vector. The graph nodes are aggregated in multiple order by combining the target node vector with a multi-order aggregation algorithm to obtain a multi-order aggregation vector. The first-order aggregation vector and the multi-order aggregation vector are then weighted to obtain the final node vector. The most frequent graph node is located by combining the standard classification model with the final node vector, and the most frequent graph node is identified as an abnormal node. The step of generating a target node vector by combining each graph node and the node vector using a node vectorization algorithm includes: The transition probabilities are determined by combining the edge weights and similarities between the graph nodes and the node degree of each graph node using the node vectorization algorithm. A random walk is performed based on each of the aforementioned transition probabilities to generate each graph structure vector; The target node vector is generated by concatenating each of the graph structure vectors with the node vectors.

2. The abnormal component tracing method according to claim 1, characterized in that, The process of locating the most frequent graph node by combining the standard classification model with the final node vector includes: The final node vector is output as an anomaly log when an anomaly warning occurs through a preset learning model; An initial binary classifier is constructed based on the initial abnormal nodes and nodes to be processed in the abnormal log, and a first probability value of the initial abnormal nodes and a second probability value of the nodes to be processed are calculated based on the initial binary classifier. Based on the first probability value and the second probability value, determine the abnormal nodes to be processed in the nodes to be processed, and identify the abnormal nodes to be processed as abnormal sample data; Based on the abnormal sample data and the initial abnormal node, the graph node with the highest frequency is located.

3. The abnormal component tracing method according to claim 2, characterized in that, The step of locating the most frequent graph node based on the abnormal sample data and the initial abnormal node includes: The abnormal sample data is sampled a preset number of times to obtain a first abnormal sample set and a second abnormal sample set; A target binary classifier is constructed based on the first abnormal sample set and the initial abnormal nodes, and the target binary classifier is used to predict the second abnormal sample set to obtain each target abnormal node. By performing a union operation on all the target abnormal nodes, the graph node with the highest frequency among all the target abnormal nodes is located.

4. The abnormal component tracing method according to claim 1, characterized in that, The step of performing hierarchical aggregation on each graph node using a hierarchical aggregation algorithm combined with the target node vector to obtain a first-order aggregated vector includes: Determine the node similarity threshold and use the target node vector as the original vector representation of each graph node; Based on the target node vector and the node similarity threshold, determine the first node set and the second node set of the first-order nodes in each of the graph nodes; The first-order aggregation vector is determined by performing hierarchical aggregation on the first node set and the second node set of each graph node using the hierarchical aggregation algorithm.

5. The abnormal component tracing method according to claim 4, characterized in that, The step of performing hierarchical aggregation on the first node set and the second node set of each graph node using the hierarchical aggregation algorithm to determine the first-order aggregation vector includes: A first threshold counting matrix is ​​constructed based on the number of nodes in the first node set of each graph node, and a second threshold counting matrix is ​​constructed based on the number of nodes in the second node set of each graph node. A first degree matrix is ​​constructed based on each of the graph nodes and the first threshold counting matrix, and a second degree matrix is ​​constructed based on each of the graph nodes and the second threshold counting matrix. A first connection matrix is ​​constructed based on the connectivity between each graph node and each node in the first node set, and a second connection matrix is ​​constructed based on the connectivity between each graph node and each node in the second node set. Based on the first threshold counting matrix, the first degree matrix, and the first connection matrix, a first node information fusion vector is determined, and based on the second threshold counting matrix, the second degree matrix, and the second connection matrix, a second node information fusion vector is determined. The first node information fusion vector and the second node information fusion vector are fused to obtain the first-order aggregate vector.

6. The abnormal component tracing method according to claim 1, characterized in that, The step of generating node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram includes: Based on the first description information of each graph node, a node sentence vector of each graph node is generated, and based on the second description information of each node edge, a connection sentence vector of each node edge is generated. The weighted average of the connection vectors of each node edge is calculated to obtain the average connection vector of each node edge. The node vector is generated by concatenating the node sentence vector of each graph node and the average edge vector of each node edge.

7. The abnormal component tracing method according to any one of claims 1 to 6, characterized in that, Constructing the component structure diagram includes: Each software device and each hardware device of the terminal device is identified as a component, and each component is identified as a graph node; The calling relationships between the graph nodes are defined as node edges, and the number of calls between the graph nodes is defined as edge weights. The component structure graph is constructed based on each graph node, as well as the node edges and edge weights between the graph nodes.

8. An abnormal component tracing device, characterized in that, include: The generation module is used to determine the component structure diagram and generate node vectors based on the first description information of each graph node and the second description information of each node edge in the component structure diagram. The generation module is used to generate a target node vector by combining each graph node and the node vector through a node vectorization algorithm; The aggregation module is used to perform hierarchical aggregation on each graph node by combining the target node vector with a hierarchical aggregation algorithm to obtain a first-order aggregated vector; The aggregation and weighting module is used to perform multi-level aggregation on each graph node by combining the target node vector with a multi-level aggregation algorithm to obtain a multi-level aggregation vector, and to weight the first-level aggregation vector and the multi-level aggregation vector to obtain the final node vector; The source tracing module is used to locate the most frequent graph node by combining the final node vector with the standard classification model, and to identify the most frequent graph node as an abnormal node. The generation module is also used for: The transition probabilities are determined by combining the edge weights and similarities between the graph nodes and the node degree of each graph node using the node vectorization algorithm. A random walk is performed based on each of the aforementioned transition probabilities to generate each graph structure vector; The target node vector is generated by concatenating each of the graph structure vectors with the node vectors.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the abnormal component tracing method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the abnormal component tracing method according to any one of claims 1 to 7.

Images