Atlas merging method and device, electronic equipment and storage medium

Abstract

The application provides a graph merging method and device, electronic equipment and a storage medium. The method comprises: obtaining two fault root cause graphs to be merged, including a first graph and a second graph; determining a plurality of target node pairs based on the first graph and the second graph; for each target node pair, performing the following operations: obtaining the aggregated feature vectors of the two target nodes in the target node pair; inputting the aggregated feature vectors of the two target nodes into a trained first model to obtain a probability value of connection between the two target nodes; in the case that the probability value of connection between the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes; after all the target node pairs are traversed, outputting a merged fault root cause graph. The application can accurately, comprehensively and balancedly predict the existing links and missing links in the network, and accurately merge the fault root cause graphs.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of fault root cause positioning, and in particular to a graph merging method and device, electronic equipment and a storage medium. BACKGROUND

[0002] Due to the complexity of fault causes in the current network, we need to find the root cause of the fault, and during this period, we need to predict the fault propagation confidence or probability between two different devices that have a direct or indirect relationship (belong to the same business system, and there is a calling relationship between business systems).

[0003] The current network node link prediction method mainly includes similarity-based method and maximum likelihood estimation method. In the similarity-based method, there is a similarity value between any two nodes, and the nodes are ranked according to the similarity value between them. The greater the similarity, the greater the possibility that the two nodes will establish a link relationship in the future. However, in this method, how to define the similarity of the nodes is a great challenge. Currently, the selection of similarity features needs to rely on manual feature extraction, which is inaccurate and difficult to screen. The maximum likelihood estimation method assumes that the organizational structure of the network conforms to a certain rule, and then establishes a model according to this rule. After the model with parameters is established, the network is evaluated according to the existing data. After the parameters are calculated by the maximum likelihood method, the future possible link is predicted. The disadvantage of the maximum likelihood estimation method is that it is time-consuming and cannot be applied to large-scale network link prediction.

[0004] The current network node link prediction method has the defects of inaccurate prediction, long time consumption, and cannot be applied to large-scale network link prediction. SUMMARY

[0005] The present application provides a graph merging method, device, electronic equipment and storage medium to solve the defects of the current network node link prediction method, such as inaccurate prediction, long time consumption, and cannot be applied to large-scale network link prediction.

[0006] The present application provides a graph merging method, comprising:

[0007] Obtain two fault root cause graphs to be merged, the two fault root cause graphs to be merged including a first graph and a second graph;

[0008] Based on the first graph and the second graph, a plurality of target node pairs are determined, the target node pair being composed of any target node of the second graph and any target node having a first adjacent relationship with the target node in the first graph, the first adjacent relationship being adjacent in the first knowledge graph;

[0009] For each of the target node pairs, the following operations are performed: obtaining aggregated feature vectors of two target nodes in the target node pair; inputting the aggregated feature vectors of the two target nodes into the trained first model to obtain a probability value of connection of the two target nodes; and in a case where the probability value of connection of the two target nodes is greater than a preset threshold, determining that the two target nodes exist a propagation probability, and then connecting the two target nodes.

[0010] After traversing all the target node pairs, a merged fault root cause graph is output.

[0011] The first model is a classification model for predicting a propagation confidence between nodes of a fault root cause graph, and is trained based on labeled aggregated feature vector samples.

[0012] According to the graph merging method provided by the application, the first model is trained based on the following steps:

[0013] Obtaining normal network nodes, fault network nodes and alarm nodes from the first knowledge graph to obtain a first data set;

[0014] Processing the first data set to obtain a first file, a second file and a third file, respectively, the first file being a node set, the second file being an edge set, and the third file being a neighboring node set;

[0015] Using a metapath2vec method to vectorize each node to obtain a multi-dimensional feature vector of each node;

[0016] Based on the multi-dimensional feature vector of each node, the multi-dimensional feature vectors of each neighboring node pair are aggregated to obtain an aggregated feature vector of each neighboring node pair, wherein each neighboring node pair consists of two adjacent nodes.

[0017] According to whether each neighboring node pair has an edge, the aggregated feature vector of each neighboring node pair is labeled to obtain a plurality of labeled aggregated feature vector samples.

[0018] The SVM model is trained through the plurality of labeled aggregated feature vector samples to obtain the first model.

[0019] According to the graph merging method provided by the application, the metapath2vec method is used to vectorize each node to obtain a multi-dimensional feature vector of each node, which includes:

[0020] biased walks according to a predefined meta-path schema starting from any node of the first knowledge graph, to generate sampled sequence data;

[0021] learning representations of the nodes by maximizing conditional probabilities over the fields of the nodes using a Skip-Gram model;

[0022] updating parameters according to the sampled sequence data using a gradient descent method until stable convergence, and outputting a multi-dimensional feature vector of each node.

[0023] According to the graph merging method provided by the application, the multi-dimensional feature vectors of each adjacent node pair are aggregated to obtain an aggregated feature vector of each adjacent node pair, which comprises:

[0024] averaging the multi-dimensional feature vectors of the two nodes in each adjacent node pair to obtain an aggregated feature vector of each adjacent node pair.

[0025] According to the graph merging method provided by the application, the aggregated feature vectors of each adjacent node are labeled according to whether there is an edge between each adjacent node pair to obtain a plurality of labeled aggregated feature vector samples, which comprises:

[0026] obtaining edge node data of a historical fault root cause graph;

[0027] determining whether there is a propagation relationship between the two nodes in each adjacent node pair based on the edge node data of the historical fault root cause graph;

[0028] If the two nodes have a propagation relationship, it is determined that the adjacent node pair composed of the two nodes has an edge, and the aggregated feature vector of the adjacent node pair composed of the two nodes is labeled as a first value; if the two nodes do not have a propagation relationship, it is determined that the adjacent node pair composed of the two nodes does not have an edge, and the aggregated feature vector of the adjacent node pair composed of the two nodes is labeled as a second value.

[0029] According to the graph merging method provided by the application, the SVM model is trained through the plurality of labeled aggregated feature vector samples to obtain the first model, which comprises:

[0030] dividing the plurality of labeled aggregated feature vector samples into a training set and a test set;

[0031] inputting the aggregated feature vector samples in the training set one by one into the SVM model as input vectors to obtain a prediction result;

[0032] The prediction result is subjected to loss function calculation with a label corresponding to the aggregated feature vector sample, parameters of the SVM model are iteratively updated by minimizing the loss function, and an optimal solution is obtained.

[0033] The SVM model adopting the optimal solution is subjected to generalization accuracy test using the test set, and the first model is obtained after the test is passed.

[0034] According to the atlas merging method provided by the application, the aggregated feature vector of the two target nodes in the target node pair is obtained, comprising:

[0035] The metapath2vec method is used for vectorization representation of the two target nodes respectively, and the multi-dimensional feature vectors of the two target nodes are obtained.

[0036] The multi-dimensional feature vectors of the two target nodes are aggregated to obtain the aggregated feature vectors of the two target nodes.

[0037] The application further provides an atlas merging device, comprising:

[0038] The acquisition unit is configured to acquire two fault root cause atlases to be merged, wherein the two fault root cause atlases to be merged comprise a first atlas and a second atlas.

[0039] The determination unit is configured to determine a plurality of target node pairs based on the first atlas and the second atlas, wherein each target node pair is composed of any target node of the second atlas and any target node having a first adjacent relationship with the target node in the first atlas, and the first adjacent relationship refers to an adjacent relationship in the first knowledge graph.

[0040] The execution unit is configured to perform the following operations for each target node pair: acquiring an aggregated feature vector of two target nodes in the target node pair; inputting the aggregated feature vectors of the two target nodes into a trained first model to obtain a probability value of connection between the two target nodes; and in a case where the probability value of connection between the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes.

[0041] The output unit is configured to output a merged fault root cause atlas after all the target node pairs are traversed.

[0042] The first model is trained based on a labeled aggregated feature vector sample, and is a classification model for predicting a propagation confidence between nodes of a fault root cause atlas.

[0043] The application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the atlas merging method according to any one of the above when executing the program.

[0044] The application further provides a non-transitory computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the atlas merging method according to any one of the above.

[0045] The application further provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the atlas merging method according to any one of the above.

[0046] In the embodiment of the application, two fault root cause atlases to be merged are acquired, a plurality of target node pairs are determined, an aggregated feature vector of two target nodes in each target node pair is acquired, the aggregated feature vector is input into a classification model for predicting the propagation confidence between nodes of the fault root cause atlas, a probability value of connection between the two target nodes is obtained, if the probability value is greater than a preset threshold, the two target nodes are connected, and thus a merged fault root cause atlas is obtained, the classification model is trained based on a labeled aggregated feature vector sample, and in the embodiment of the application, the target nodes are represented by vectors and aggregated, the heterogeneous information and semantic relationship information in the network can be retained, the aggregated feature vector is input into the classification model trained by using a machine learning classification method, the existing links and missing links in the network can be accurately, comprehensively and balancedly predicted, and thus the fault root cause atlases can be accurately merged. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0048] Figure 1 A flowchart of the atlas merging method provided by the embodiment of the application is shown in the figure.

[0049] Figure 2 A current existing fault sub-atlas provided by the application is shown in the figure.

[0050] Figure 3 A non-existing fault sub-atlas provided by the application is shown in the figure.

[0051] Figure 4 A flowchart of training the first model provided by the application is shown in the figure.

[0052] Figure 5 A schematic diagram of the meta-path mode provided by the present application is shown in the following figure;

[0053] Figure 6 A structural schematic diagram of the atlas merging device provided by the embodiment of the present application is shown in the following figure;

[0054] Figure 7 A structural schematic diagram of the electronic device provided by the present application is shown in the following figure. DETAILED DESCRIPTION

[0055] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the accompanying drawings in the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0056] Figure 1 A flowchart of the atlas merging method provided by the embodiment of the present application is shown in the following figure, as shown in the figure, the atlas merging method comprises: Figure 1

[0057] Step 100, obtaining two fault root cause atlases to be merged, the two fault root cause atlases to be merged comprising a first atlas and a second atlas;

[0058] Optionally, first, a first knowledge atlas containing all network entities and alarm entities is obtained, and the first knowledge atlas is marked with a fault network entity generating a fault event in a target network.

[0059] Then, n fault root cause atlases (or fault sub-atlases) are generated based on the first knowledge atlas, and each fault root cause atlas comprises one or more fault network entities.

[0060] When a fault root cause atlas comprises multiple fault network entities, any fault network entity in the fault root cause atlas satisfies a fault propagation condition with the other one or more fault network entities.

[0061] The present application focuses on predicting the fault propagation probability between two adjacent fault network entities in the first knowledge atlas, and then merging the fault sub-atlases.

[0062] Step 101, determining a plurality of target node pairs based on the first atlas and the second atlas, the target node pair being composed of any target node of the second atlas and any target node having a first adjacent relationship with the target node in the first atlas, the first adjacent relationship being adjacent in the first knowledge atlas.

[0063] ​It can be understood that one target node represents one fault network entity. Taking any target node in the second graph as a first target node and taking any target node in the first graph having a first adjacent relationship with the first target node as a second target node, one first target node and one second target node form a target node pair.

[0064] The first adjacent relationship refers to that the first target node and the second target node are adjacent in the first knowledge graph.

[0065] After step 102 of determining a plurality of target node pairs based on the first graph and the second graph, the following operations are performed for each target node pair:

[0066] Step 1021, obtaining an aggregated feature vector of two target nodes in the target node pair;

[0067] It should be noted that the aggregated feature vector in the present application is obtained by obtaining the vectorized representation of the target node and then aggregating, which retains the heterogeneous information and semantic relationship information of the target node in the network.

[0068] Step 1022, inputting the aggregated feature vectors of the two target nodes into the trained first model to obtain a probability value of connection of the two target nodes;

[0069] The first model is a classification model for predicting the propagation confidence between the fault root cause graph nodes, which is trained based on the labeled aggregated feature vector sample.

[0070] It can be understood that the input of the first model is the aggregated feature vector, and the output of the first model is the probability value of connection of the two target nodes, that is, the propagation confidence between the fault root cause graph nodes.

[0071] Step 1023, in the case that the probability value of connection of the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes;

[0072] The preset threshold can be set according to the historical fault propagation probability.

[0073] It can be understood that in the case that the probability value of connection of the two target nodes is greater than the preset threshold, it can be determined that the two target nodes have a propagation probability, and then the two target nodes are connected, thereby realizing the merging of the first graph and the second graph.

[0074] Step 103, after traversing all the target node pairs, outputting the merged fault root cause graph.

[0075] For example, fault submaps that did not exist before are merged into the currently existing fault submaps. Figure 2 The fault sub-map provided by this invention is an existing fault sub-map. Figure 3 This invention provides a non-existent fault sub-map. First, find... Figure 3 Node B in the middle is adjacent to it in the first knowledge graph, and there exists Figure 2 Let A be a node in the data. 11 Then, A can be obtained through the above steps 1022. 11 The propagation probability with B, if the probability of the maximum reasonable link is greater than the link threshold (0.8), that is, if A 11 If the propagation probability of B is greater than 0.8, then link B with A. 11 Connect until the calculation is complete. Figure 3 The propagation probability of node B with all its neighboring nodes in the first knowledge graph is calculated, and a connection is determined based on the magnitude of the propagation probability. Figure 3 and Figure 2 The graphs were merged.

[0076] In this embodiment of the invention, by acquiring two root cause maps to be merged, multiple target node pairs are determined, and the aggregated feature vectors of the two target nodes in each target node pair are obtained. The aggregated feature vectors are input into a classification model used to predict the propagation confidence between nodes in the root cause maps, and the probability value of the connection between the two target nodes is obtained. If the probability value is greater than a preset threshold, the two target nodes are connected, thereby obtaining the merged root cause map. The classification model is trained based on labeled aggregated feature vector samples. By vectorizing and aggregating the target nodes, this embodiment of the application can retain the heterogeneous information and semantic relationship information in the network. By inputting the aggregated feature vectors into the classification model trained by machine learning classification methods, it is possible to achieve accurate, comprehensive, and balanced prediction of existing and missing links in the network, thereby accurately merging the root cause maps.

[0077] Figure 4 This is a schematic diagram illustrating the process of training a first model according to the present invention. In some optional embodiments, such as... Figure 4 As shown, the first model is trained based on the following steps:

[0078] Step 400: Obtain normal network nodes, faulty network nodes, and alarm nodes from the first knowledge graph to obtain the first dataset;

[0079] Specifically, the first dataset is obtained through querying. This first dataset requires all data from the entire first knowledge graph, including normal network entities, faulty network entities, and alarm nodes.

[0080] Step 401, processing the first data set to obtain a first file, a second file and a third file respectively, the first file being a set of nodes, the second file being a set of edges, and the third file being a set of adjacent nodes;

[0081] The first data set is sorted into three files, for example, a first file Vertex.txt, a second file Egde.txt and a third file Relation.txt.

[0082] The data format of each file is as follows:

[0083] For example, the data format of Vertex.txt is wherein v i represents the number of a vertex, represents the type of the vertex v i .

[0084] The data format of Egde.txt is wherein e i represents the number of an edge, represents the type of the edge e i .

[0085] The data format of Relation.txt is (v i , v j , e i,j ), wherein v i , v j represent the numbers of two adjacent vertices, and e i,j represents the number of an edge between the two vertices.

[0086] Step 402, vectorizing each node by using a metapath2vec method of heterogeneous network representation to obtain a multi-dimensional feature vector of each node;

[0087] It should be noted that the metapath2vec algorithm follows the idea of the previous embedding algorithm based on random walk on a homogeneous network, and by introducing preset meta-paths on a heterogeneous network, the process of random walk is guided, and in addition, the field of meta-path is used to improve the traditional Skip-Gram model, so that the embedding method can not only retain the heterogeneous information and semantic relationship information in the network, but also has essential performance improvement for large-scale networks.

[0088] Step 403, based on the multi-dimensional feature vector of each node, aggregating the multi-dimensional feature vectors of each adjacent node pair to obtain an aggregated feature vector of each adjacent node pair, wherein one adjacent node pair consists of two adjacent nodes.

[0089] Step 404, according to whether there is an edge for each of the adjacent node pairs, the aggregated feature vector of each of the adjacent node pairs is labeled to obtain a plurality of labeled aggregated feature vector samples;

[0090] Specifically, based on whether there is a link relationship of the adjacent node pairs in the historical data, the aggregated feature vector of each of the adjacent node pairs is added with a corresponding label to obtain a plurality of labeled aggregated feature vector samples.

[0091] Step 405, training a support vector machine (SVM) model through the plurality of labeled aggregated feature vector samples to obtain the first model.

[0092] In the embodiment of the application, by using the metapath2vec method to vectorize and aggregate the nodes, the heterogeneous information and semantic relationship information in the network can be retained, and then the SVM model is trained by using the labeled aggregated feature vector in combination with the idea of machine learning classification. After the training is completed, the first model has accurate, comprehensive and balanced prediction ability for the existing links and missing links in the network, and can accurately merge the fault root cause graph.

[0093] Optionally, the step 402 uses the metapath2vec method to vectorize each of the nodes to obtain a multi-dimensional feature vector of each of the nodes, including:

[0094] Starting from any node of the first knowledge graph, a biased walk according to a predefined meta-path schema is performed to generate sampling sequence data;

[0095] A Skip-Gram model is used to learn the representation of the nodes by maximizing the conditional probability on the field of the nodes;

[0096] According to the sampling sequence data, the gradient descent method is used to update the parameters until stable convergence, and the multi-dimensional feature vector of each of the nodes is output.

[0097] Specifically, starting from any node of the first knowledge graph, a biased walk according to a predefined meta-path schema is performed to generate sampling sequence data.

[0098] Figure 5 The schematic diagram of the meta-path schema provided by the application is shown in FIG. 1. Figure 5As shown, for example, a predefined meta-path schema can be: network device — alarm — type — network device, then the sampling sequence is d1, p1, w1, p4, d3.

[0099] Using the Skip-Gram model, the neighborhood N of vertex v is... t (v),t∈T v The vertex representations on the heterogeneous network graph are learned by maximizing the conditional probability, as shown below:

[0100]

[0101] Where, N t (v) represents the set of vertices of type t in the neighborhood of vertex v, p(c t |v;θ) is usually defined as a softmax function, that is:

[0102]

[0103] Among them, X v Let be the v-th row matrix of matrix X, representing the embedding vector of vertex v. Let c be the vector representing the neighboring node c. X represents the vector dot product of neighboring node c and vertex v. u This represents the vector of all neighboring nodes. Using the sampled sequence data above, gradient descent is used to update the parameters until stable convergence. The output is the embedding multidimensional vector for each vertex v.

[0104] Optionally, in step 403, the multidimensional feature vectors of each pair of adjacent nodes are aggregated to obtain the aggregated feature vector of each pair of adjacent nodes, including:

[0105] The aggregated feature vector of each adjacent node pair is obtained by averaging the multidimensional feature vectors of the two nodes in each adjacent node pair.

[0106] For edge E in the original network ab Let V represent the edge between node a and node b. Let V be the eigenvector of node a. a =(a1,a2,...,a m The feature vector of node b is V. b =(b1,b2,...,b m Then the aggregation method for nodes a and b is:

[0107] Optionally, in step 404, based on whether each adjacent node pair has an edge, the aggregated feature vector of each adjacent node is labeled to obtain multiple labeled aggregated feature vector samples, including:

[0108] Obtain edge node data from the historical root cause graph of failures;

[0109] Based on the edge node data of the historical root cause graph, determine whether there is a propagation relationship between the two nodes in each pair of adjacent nodes.

[0110] If the two nodes have a propagation relationship, then it is determined that there is an edge between the adjacent nodes formed by the two nodes, and the aggregated feature vector of the adjacent nodes formed by the two nodes is labeled as the first value; if the two nodes do not have a propagation relationship, then it is determined that there is no edge between the adjacent nodes formed by the two nodes, and the aggregated feature vector of the adjacent nodes formed by the two nodes is labeled as the second value.

[0111] Specifically, label data is constructed by combining the existence of edges in the historical fault subgraph.

[0112]

[0113] Among them, E ab V represents a With V b Does a propagation relationship exist between them? Obtain historical fault subgraph edge vertex data, in the format (v i ,v j In other words, nodes with a propagation relationship are marked as 1. In the first knowledge graph, we search for adjacent faulty entity nodes that do not have a propagation relationship, also in the format (v i ,v j The annotation is set to 0. The final annotation data format is ( 1 or 0).

[0114] Optionally, step 405 trains the SVM model using the multiple labeled aggregated feature vector samples to obtain the first model, including:

[0115] The multiple labeled aggregated feature vector samples are divided into a training set and a test set;

[0116] The aggregated feature vector samples in the training set are input vectors one by one into the SVM model to obtain the prediction results;

[0117] The predicted results and the labels corresponding to the aggregated feature vector samples are used to calculate the loss function. The parameters of the SVM model are iteratively updated by minimizing the loss function to obtain the optimal solution.

[0118] The SVM model using the optimal solution is tested for generalization accuracy using the test set. After passing the test, the first model is obtained.

[0119] Specifically, SVM is used for model learning. The SVM classification algorithm is used for classification. For linearly separable data, the SVM classification algorithm uses a straight line to separate the data. For linearly inseparable data, a hyperplane in the original vector dimension space is used to separate the data into two classes. The separating hyperplane for the two classes is w. T x+b=0, lies in the hyperplane w T x+b=1 and w T The data on x+b=-1 are called support vectors. To achieve the best classification effect, we need to find the optimal hyperplane with the largest margin, which means maximizing the expression. To simplify the calculation, it is transformed into a minimization. For datasets where the vector dimensions are linearly inseparable, SVM introduces a kernel function to map the data to a higher-dimensional plane to make it separable. The optimization problem for this type of problem is expressed as follows:

[0120]

[0121] in, Denotes the interval of the optimal hyperplane. Represents the weights of vectors in a high-dimensional space. Let represent the transformed high-dimensional vector space, and b represent the bias, i.e., the offset of the hyperplane relative to the origin. y represents the weights of each vector. i This represents the category corresponding to each vector.

[0122] The input data for this invention is in sample format ( Sample data (1 or 0) is processed by inputting aggregated features (sample features). The predicted value y is obtained, and a loss function is calculated between y and the label. The loss function is minimized, and the model parameters are iteratively updated to obtain the optimal solution. To prevent overfitting, the generalization accuracy of the model is tested using a test set.

[0123] By dividing the labeled data constructed using a vectorized node dataset into training and test sets according to a preset ratio (e.g., 4:1), and using the training set for SVM parameter optimization learning, a better-fitting dataset is obtained. Save the model with the parameter values ​​for b.

[0124] Optionally, step 1011, obtaining the aggregated feature vectors of the two target nodes in the target node pair, includes:

[0125] The two target nodes are vectorized using the heterogeneous network representation metapath2vec method to obtain the multidimensional feature vectors of the two target nodes.

[0126] aggregate the multi-dimensional feature vectors of the two target nodes to obtain an aggregated feature vector of the two target nodes.

[0127] The specific steps of vectorizing the two target nodes by using the metapath2vec method to obtain the multi-dimensional feature vectors of the two target nodes can refer to the foregoing step 402, and details are not described herein.

[0128] Optionally, the aggregation of the multi-dimensional feature vectors of the two target nodes to obtain the aggregated feature vector of the two target nodes comprises:

[0129] averaging the multi-dimensional feature vectors of the two target nodes to obtain the aggregated feature vector of the two target nodes.

[0130] In the embodiment of the application, by obtaining two fault root cause graphs to be merged, a plurality of target node pairs are determined, the aggregated feature vector of the two target nodes in each target node pair is obtained, the aggregated feature vector is input into a classification model for predicting the propagation confidence between nodes of the fault root cause graph, a probability value of the connection of the two target nodes is obtained, if the probability value is greater than a preset threshold, the two target nodes are connected, thereby obtaining a merged fault root cause graph, the classification model is trained based on the labeled aggregated feature vector sample, and in the embodiment of the application, the target nodes are vectorized and aggregated by using the metapath2vec method, the heterogeneous information and semantic relationship information in the network can be retained, the aggregated feature vector is input into the classification model trained by using the machine learning classification method, the existing link and the missing link in the network can be accurately, comprehensively and balancedly predicted, and therefore the fault root cause graphs can be accurately merged.

[0131] In some optional embodiments, after obtaining the merged fault root cause graph, the merged fault root cause graph can be encapsulated according to an interface protocol, and the structure data of the merged fault root cause graph is returned to a business background.

[0132] Optionally, the interface is encapsulated based on a sanic framework. Sanic supports processing requests in an asynchronous request mode, and can use a new async / await syntax to write non-blocking and fast code.

[0133] The graph merging device provided by the application is described below, and the graph merging device described below can be correspondingly referred to the graph merging method described above.

[0134] Figure 6 The structure diagram of the graph merging device provided by the embodiment of the application is shown in FIG. 1. Figure 6 As shown in FIG. 1, the graph merging device comprises:

[0135] The acquisition unit 610 is configured to acquire two fault root cause graphs to be merged, the two fault root cause graphs to be merged including a first graph and a second graph;

[0136] The determination unit 620 is configured to determine a plurality of target node pairs based on the first graph and the second graph, the target node pair being composed of any target node of the second graph and any target node having a first adjacent relationship with the target node in the first graph, the first adjacent relationship being adjacent in the first knowledge graph.

[0137] The execution unit 630 is configured to, for each target node pair, perform the following operations: acquiring an aggregated feature vector of two target nodes in the target node pair; inputting the aggregated feature vector of the two target nodes into the trained first model to obtain a probability value of connection of the two target nodes; and in a case where the probability value of connection of the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes.

[0138] The output unit 640 is configured to output a merged fault root cause graph after traversing all the target node pairs.

[0139] The first model is a classification model trained based on a labeled aggregated feature vector sample and used for predicting a propagation confidence between nodes of a fault root cause graph.

[0140] Optionally, the first model is trained based on the following steps:

[0141] The normal network nodes, the fault network nodes and the alarm nodes are acquired from the first knowledge graph to obtain a first data set;

[0142] The first data set is processed to obtain a first file, a second file and a third file, the first file being a set of nodes, the second file being a set of edges, and the third file being a set of adjacent nodes.

[0143] Each node is vectorized by using a metapath2vec method to obtain a multi-dimensional feature vector of each node.

[0144] Based on the multi-dimensional feature vector of each node, the multi-dimensional feature vectors of each adjacent node pair are aggregated to obtain an aggregated feature vector of each adjacent node pair, wherein one adjacent node pair is composed of two adjacent nodes.

[0145] labeling the aggregated feature vector of each of the adjacent node pairs according to whether an edge exists between the two nodes in each of the adjacent node pairs, to obtain a plurality of labeled aggregated feature vector samples;

[0146] training an SVM model through the plurality of labeled aggregated feature vector samples, to obtain the first model.

[0147] Optionally, the metapath2vec method is used to vectorize each of the nodes to obtain a multi-dimensional feature vector of each of the nodes, including:

[0148] starting from any node of the first knowledge graph, generating sampling sequence data according to a pre-defined meta-path schema biased walk;

[0149] using a Skip-Gram model to learn the representation of the nodes by maximizing the conditional probability in the field of the nodes;

[0150] According to the sampling sequence data, the gradient descent method is used to update the parameters until stable convergence, and the multi-dimensional feature vector of each of the nodes is output.

[0151] Optionally, the multi-dimensional feature vector of each adjacent node pair is aggregated to obtain an aggregated feature vector of each of the adjacent node pairs, including:

[0152] averaging the multi-dimensional feature vectors of the two nodes in each adjacent node pair to obtain the aggregated feature vector of each of the adjacent node pairs.

[0153] Optionally, the aggregated feature vector of each of the adjacent node pairs is labeled according to whether an edge exists between the two nodes in each of the adjacent node pairs, to obtain a plurality of labeled aggregated feature vector samples, including:

[0154] obtaining edge node data of a historical fault root cause graph;

[0155] determining whether a propagation relationship exists between the two nodes in each of the adjacent node pairs based on the edge node data of the historical fault root cause graph;

[0156] If the two nodes have a propagation relationship, it is determined that an edge exists between the two nodes, and the aggregated feature vector of the adjacent node pair composed of the two nodes is labeled as a first value; if the two nodes do not have a propagation relationship, it is determined that an edge does not exist between the two nodes, and the aggregated feature vector of the adjacent node pair composed of the two nodes is labeled as a second value.

[0157] Optionally, the first model is obtained by training the SVM model through the plurality of labeled aggregated feature vector samples, and the training comprises:

[0158] The plurality of labeled aggregated feature vector samples are divided into a training set and a test set;

[0159] The aggregated feature vector samples in the training set are input into the SVM model one by one as input vectors to obtain a prediction result;

[0160] The prediction result is subjected to loss function calculation with a label corresponding to the aggregated feature vector sample, and parameters of the SVM model are iteratively updated by minimizing the loss function to obtain an optimal solution;

[0161] The SVM model adopting the optimal solution is subjected to generalization accuracy test using the test set, and the first model is obtained after the test is passed.

[0162] Optionally, the aggregated feature vector of the two target nodes in the target node pair is obtained by:

[0163] The two target nodes are subjected to vectorization representation using a metapath2vec method to obtain multi-dimensional feature vectors of the two target nodes;

[0164] The multi-dimensional feature vectors of the two target nodes are aggregated to obtain the aggregated feature vector of the two target nodes.

[0165] It should be noted that the atlas merging device provided by the embodiment of the present application can realize all the method steps realized by the atlas merging method embodiment and achieve the same technical effects, and the same parts and beneficial effects in the embodiment as the method embodiment will not be described in detail.

[0166] Figure 7 An entity structure schematic diagram of an electronic device is shown as Figure 7As shown, the electronic device can include a processor 710, a communications interface 720, a memory 730, and a communications bus 740, wherein the processor 710, the communications interface 720, and the memory 730 complete mutual communication through the communications bus 740. The processor 710 can invoke a logical instruction in the memory 730 to execute a graph merging method, which includes: obtaining two fault root cause graphs to be merged, the two fault root cause graphs to be merged including a first graph and a second graph; determining a plurality of target node pairs based on the first graph and the second graph, the target node pair consisting of any target node of the second graph and any target node having a first adjacency relationship with the target node in the first graph, the first adjacency relationship being adjacent in the first knowledge graph; for each target node pair, performing the following operations: obtaining the aggregated feature vectors of the two target nodes in the target node pair; inputting the aggregated feature vectors of the two target nodes into a trained first model to obtain a probability value of connection between the two target nodes; in the case where the probability value of connection between the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes; after traversing all the target node pairs, outputting a merged fault root cause graph; wherein the first model is a classification model for predicting the propagation confidence between fault root cause graph nodes, which is trained based on labeled aggregated feature vector samples.

[0167] In addition, the logical instructions in the memory 730 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0168] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program being stored in a non-transitory computer-readable storage medium, and the computer program being executable by a processor to enable a computer to perform the graph merging method provided by any of the above methods, the method comprising: obtaining two fault root cause graphs to be merged, the two fault root cause graphs to be merged comprising a first graph and a second graph; determining a plurality of target node pairs based on the first graph and the second graph, each target node pair being composed of any target node of the second graph and any target node of the first graph having a first adjacent relationship with the target node, the first adjacent relationship being adjacent in the first knowledge graph; for each target node pair, performing the following operations: obtaining an aggregated feature vector of the two target nodes in the target node pair; inputting the aggregated feature vectors of the two target nodes into a trained first model to obtain a probability value of connection between the two target nodes; in a case where the probability value of connection between the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes; after all the target node pairs are traversed, outputting a merged fault root cause graph; wherein the first model is a classification model trained based on labeled aggregated feature vector samples and used for predicting a propagation confidence between nodes of a fault root cause graph.

[0169] In yet another aspect, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement a graph merging method provided by any of the above methods, the method comprising: obtaining two fault root cause graphs to be merged, the two fault root cause graphs to be merged comprising a first graph and a second graph; determining a plurality of target node pairs based on the first graph and the second graph, each target node pair being composed of any target node of the second graph and any target node of the first graph having a first adjacent relationship with the target node, the first adjacent relationship being adjacent in the first knowledge graph; for each target node pair, performing the following operations: obtaining an aggregated feature vector of the two target nodes in the target node pair; inputting the aggregated feature vectors of the two target nodes into a trained first model to obtain a probability value of connection between the two target nodes; in a case where the probability value of connection between the two target nodes is greater than a preset threshold, determining that the two target nodes have a propagation probability, and then connecting the two target nodes; after all the target node pairs are traversed, outputting a merged fault root cause graph; wherein the first model is a classification model trained based on labeled aggregated feature vector samples and used for predicting a propagation confidence between nodes of a fault root cause graph.

[0170] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected to achieve the purposes of the embodiments according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0171] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0172] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for merging maps, characterized in that, include: Two root cause graphs to be merged are obtained, including a first graph and a second graph; wherein, n root cause graphs are generated based on a first knowledge graph, and each root cause graph includes one or more fault network entities; the first knowledge graph contains all network entities and alarm entities, and the first knowledge graph identifies the fault network entities in the target network that caused the fault event. Based on the first and second knowledge graphs, multiple target node pairs are determined. Each target node pair consists of any target node in the second knowledge graph and any target node in the first knowledge graph that has a first adjacency relationship with the target node. The first adjacency relationship is that they are adjacent in the first knowledge graph. For each target node pair, perform the following operations: obtain the aggregated feature vectors of the two target nodes in the target node pair; input the aggregated feature vectors of the two target nodes into the trained first model to obtain the probability value of the connection between the two target nodes; if the probability value of the connection between the two target nodes is greater than a preset threshold, determine that the two target nodes have a propagation probability, and then connect the two target nodes. After traversing all the target node pairs, output the merged root cause map of the fault; The first model is a classification model trained on labeled aggregated feature vector samples to predict the propagation confidence between nodes in the root cause graph of faults.

2. The map merging method according to claim 1, characterized in that, The first model was trained based on the following steps: The first dataset is obtained by extracting normal network nodes, faulty network nodes, and alarm nodes from the first knowledge graph. The first dataset is processed to obtain a first file, a second file, and a third file, respectively. The first file is a set of nodes, the second file is a set of edges, and the third file is a set of adjacent nodes. The metapath2vec method, a heterogeneous network representation, is used to vectorize each node, resulting in a multidimensional feature vector for each node. Based on the multidimensional feature vector of each node, the multidimensional feature vectors of each adjacent node pair are aggregated to obtain the aggregated feature vector of each adjacent node pair, wherein an adjacent node pair consists of two adjacent nodes. Based on whether each of the adjacent node pairs has an edge, the aggregated feature vector of each of the adjacent node pairs is labeled to obtain multiple labeled aggregated feature vector samples. The SVM model is trained using the multiple labeled aggregated feature vector samples to obtain the first model.

3. The map merging method according to claim 2, characterized in that, The aggregation of the multidimensional feature vectors of each pair of adjacent nodes to obtain the aggregated feature vector of each pair of adjacent nodes includes: The aggregated feature vector of each adjacent node pair is obtained by averaging the multidimensional feature vectors of the two nodes in each adjacent node pair.

4. The map merging method according to claim 2, characterized in that, The metapath2vec method, a heterogeneous network representation, is used to vectorize each node, resulting in a multi-dimensional feature vector for each node, including: Starting from any node in the first knowledge graph, a biased walk is performed according to the predefined meta-path schema to generate sampling sequence data; The Skip-Gram model is used to learn the representation of the node by maximizing the conditional probability over the node's neighborhood; Based on the sampled sequence data, the parameters are updated using the gradient descent method until stable convergence, at which point a multidimensional feature vector for each node is output.

5. The map merging method according to claim 2, characterized in that, The step involves labeling the aggregated feature vector of each neighboring node based on whether an edge exists between them, resulting in multiple labeled aggregated feature vector samples, including: Obtain edge node data from the historical root cause graph of failures; Based on the edge node data of the historical root cause graph, determine whether there is a propagation relationship between the two nodes in each pair of adjacent nodes. If the two nodes have a propagation relationship, then it is determined that there is an edge between the adjacent nodes formed by the two nodes, and the aggregated feature vector of the adjacent nodes formed by the two nodes is labeled as the first value; if the two nodes do not have a propagation relationship, then it is determined that there is no edge between the adjacent nodes formed by the two nodes, and the aggregated feature vector of the adjacent nodes formed by the two nodes is labeled as the second value.

6. The map merging method according to claim 2, characterized in that, The step of training the SVM model using the multiple labeled aggregated feature vector samples to obtain the first model includes: The multiple labeled aggregated feature vector samples are divided into a training set and a test set; The aggregated feature vector samples in the training set are input vectors one by one into the SVM model to obtain the prediction results; The predicted results and the labels corresponding to the aggregated feature vector samples are used to calculate the loss function. The parameters of the SVM model are iteratively updated by minimizing the loss function to obtain the optimal solution. The SVM model using the optimal solution is tested for generalization accuracy using the test set. After passing the test, the first model is obtained.

7. The map merging method according to claim 1, characterized in that, The step of obtaining the aggregated feature vector of the two target nodes in the target node pair includes: The two target nodes are vectorized using the heterogeneous network representation metapath2vec method to obtain the multidimensional feature vectors of the two target nodes. The multidimensional feature vectors of the two target nodes are aggregated to obtain the aggregated feature vector of the two target nodes.

8. A spectrum merging device, characterized in that, include: The acquisition unit is used to acquire two root cause graphs to be merged, the two root cause graphs to be merged include a first graph and a second graph; wherein, n root cause graphs are generated based on a first knowledge graph, and each root cause graph includes one or more fault network entities; the first knowledge graph contains all network entities and alarm entities, and the first knowledge graph is marked with fault network entities in the target network that have generated fault events. The determining unit is configured to determine multiple target node pairs based on the first graph and the second graph. The target node pair consists of any target node in the second graph and any target node in the first graph that has a first adjacent relationship with the target node. The first adjacent relationship is that they are adjacent in the first knowledge graph. An execution unit is configured to perform the following operations for each target node pair: obtain the aggregated feature vectors of the two target nodes in the target node pair; input the aggregated feature vectors of the two target nodes into the trained first model to obtain the probability value of the connection between the two target nodes; if the probability value of the connection between the two target nodes is greater than a preset threshold, determine that the two target nodes have a propagation probability, and then connect the two target nodes. The output unit is used to output the merged root cause map after traversing all the target node pairs. The first model is a classification model trained based on labeled aggregated feature vector samples, used to predict the propagation confidence between nodes in the root cause graph of faults.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the map merging method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the map merging method as described in any one of claims 1 to 7.

Images