A root cause inference graph updating method and electronic device

Abstract

Embodiments of the present application provide a root cause reasoning graph updating method and electronic equipment. In the technical solution provided by the embodiments of the present application, the method comprises: obtaining a first root cause reasoning graph according to observation data; obtaining an incentive signal of a counterfactual sample according to the observation data, the first root cause reasoning graph and knowledge data; and updating the first root cause reasoning graph according to the incentive signal to obtain a second root cause reasoning graph. Through dynamic fusion of observation data and knowledge data to learn a root cause reasoning graph, and through dynamic expansion of counterfactual samples in the process of constructing a root cause reasoning graph, the root cause positioning accuracy and generalization ability in a small sample scene and a scene with insufficient domain knowledge can be effectively improved.

Description

[0001] The present application relates to the technical field of computer, and in particular to a root cause reasoning graph updating method and electronic equipment.

[0002] In the field of intelligent operation and maintenance, mainstream root cause analysis (RCA) techniques generally include two stages: 1) constructing a root cause reasoning graph; and 2) using the root cause reasoning graph for root cause reasoning. Among them, how to accurately construct the root cause reasoning graph is the key to the entire root cause analysis method. Most RCA techniques construct the root cause reasoning graph based on pure observation data or pure knowledge data, and it is difficult to guarantee the root cause positioning accuracy and generalization ability in small sample scenarios and scenarios with insufficient domain knowledge.

[0003] Therefore, the embodiments of the present application provide a root cause reasoning graph updating method and electronic equipment, which learn the root cause reasoning graph through dynamic fusion of observation data and knowledge data, and dynamically expand counterfactual samples in the root cause reasoning graph construction process, so as to effectively improve the root cause positioning accuracy and generalization ability in small sample scenarios and scenarios with insufficient domain knowledge.

[0004] In a first aspect, the embodiments of the present application provide a root cause reasoning graph updating method, which comprises:

[0005] obtaining a first root cause reasoning graph according to observation data;

[0006] obtaining an incentive signal of a counterfactual sample according to the observation data, the first root cause reasoning graph and knowledge data;

[0007] updating the first root cause reasoning graph according to the incentive signal to obtain a second root cause reasoning graph, which learns the root cause reasoning graph through dynamic fusion of observation data and knowledge data, and dynamically expands counterfactual samples in the root cause reasoning graph construction process, so as to effectively improve the root cause positioning accuracy and generalization ability in small sample scenarios and scenarios with insufficient domain knowledge.

[0008] In combination with the first aspect, in some implementation manners of the first aspect, the obtaining of the incentive signal of the counterfactual sample according to the observation data, the first root cause reasoning graph and the knowledge data comprises:

[0009] selecting a first number of observation samples from the observation data;

[0010] obtaining a second number of counterfactual samples according to the first root cause reasoning graph and the first number of observation samples;

[0011] ​​​According to the first root cause reasoning graph, the first number of observation samples, a second number of counterfactual samples is obtained.

[0012] According to the knowledge data and the second number of counterfactual samples, a second inferred root cause set corresponding to the second number of counterfactual samples is obtained.

[0013] According to the first inferred root cause set and the second inferred root cause set, the incentive signal is obtained.

[0014] In some implementations of the first aspect, according to the first root cause reasoning graph and the first number of observation samples, a second number of counterfactual samples is obtained, including:

[0015] Causal counterfactual reasoning is performed on the first number of observation samples through the first root cause reasoning graph to obtain the second number of counterfactual samples.

[0016] In some implementations of the first aspect, according to the knowledge data and the second number of counterfactual samples, a second inferred root cause set corresponding to the second number of counterfactual samples is obtained, including:

[0017] Root cause inference is performed on the second number of counterfactual samples through the first root cause reasoning graph to obtain the first inferred root cause set corresponding to the second number of counterfactual samples.

[0018] In some implementations of the first aspect, according to the knowledge data and the second number of counterfactual samples, a second inferred root cause set corresponding to the second number of counterfactual samples is obtained, including:

[0019] Root cause inference is performed on the second number of counterfactual samples through the knowledge data to obtain the second inferred root cause set.

[0020] Or

[0021] According to the knowledge data, a knowledge model is obtained.

[0022] Root cause inference is performed on the second number of counterfactual samples through the knowledge model to obtain the second inferred root cause set.

[0023] In some implementations of the first aspect, according to the first inferred root cause set and the second inferred root cause set, the incentive signal is obtained, including:

[0024] The cross-entropy of the first inferred root cause set and the second inferred root cause set is calculated.

[0025] The cross-entropy is taken as the excitation signal.

[0026] With reference to the first aspect, in some implementations of the first aspect, the first number and the second number are both integers greater than 0.

[0027] With reference to the first aspect, in some implementations of the first aspect, after the first root cause inference graph is updated according to the excitation signal to obtain a second root cause inference graph, the method further comprises:

[0028] determining whether the second root cause inference graph or the excitation signal meets a preset condition;

[0029] If it is determined that neither the second root cause inference graph nor the excitation signal meets the preset condition, the second root cause inference graph is taken as a first root cause inference graph, and the step of obtaining an excitation signal of a counterfactual sample according to the observation data and the first root cause inference graph is continued to be performed.

[0030] With reference to the first aspect, in some implementations of the first aspect, after the determination of whether the second root cause inference graph or the excitation signal meets a preset condition, the method further comprises:

[0031] If it is determined that both the second root cause inference graph and the excitation signal meet the preset condition, a root cause of a fault to be analyzed is inferred through the second root cause inference graph to obtain a root cause alarm.

[0032] In a second aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory is configured to store a computer program, the computer program comprising program instructions, when the processor runs the program instructions, the electronic device is caused to perform the steps of the method described above.

[0033] In a third aspect, an embodiment of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program comprises program instructions, when the program instructions are run by a computer, the computer is caused to perform the method described above.

[0034] In a fourth aspect, an embodiment of the present application provides a computer program product, the computer program product comprises instructions, when the computer program product is run on a computer or any at least one processor, the computer is caused to perform the functions / steps in the method described above.

[0035] The technical solution of the root cause inference graph updating method and electronic device provided in this invention includes: obtaining a first root cause inference graph based on observation data; obtaining an excitation signal for counterfactual samples based on the observation data, the first root cause inference graph, and knowledge data; updating the first root cause inference graph based on the excitation signal to obtain a second root cause inference graph. By dynamically fusing observation data and knowledge data to learn the root cause inference graph, and dynamically expanding counterfactual samples during the construction of the root cause inference graph, the accuracy and generalization ability of root cause localization can be effectively improved in scenarios with small sample sizes and limited domain knowledge. [Attached Image Description]

[0036] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention;

[0038] Figure 2 This is a software structure block diagram of the electronic device 100 according to an embodiment of the present invention;

[0039] Figure 3 An architecture diagram of a root cause reasoning graph update system provided in an embodiment of the present invention;

[0040] Figure 4 for Figure 3 A schematic diagram of the structure of the intermediate environment module;

[0041] Figure 5 This is a schematic diagram showing how the root cause inference module obtains the first inferred root cause set corresponding to the second numerical counterfactual sample based on the first root cause inference diagram and the second numerical counterfactual sample.

[0042] Figure 6 This is a schematic diagram of knowledge data in an embodiment of the present invention;

[0043] Figure 7 This is a schematic diagram illustrating an application scenario of the root cause reasoning graph update system according to an embodiment of the present invention;

[0044] Figure 8 A flowchart of a root cause reasoning graph update method provided in an embodiment of the present invention;

[0045] Figure 9 for Figure 8 The flowchart shows the specific process of obtaining the excitation signal of the counterfactual sample based on observation data, the first root cause inference graph, and knowledge data.

[0046] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

Detailed Implementation Methods

[0047] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0048] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0049] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0050] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0051] Figure 1 A schematic diagram of the structure of the electronic device 100 is shown.

[0052] The electronic device 100 can include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headset interface 170D, a sensor module 180, a key 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 can include a pressure sensor 180A, a gyro sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0053] It can be understood that the structure shown in the embodiments of the present application does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 can include more or fewer components than shown, or combine certain components, or split certain components, or different arrangement of components. The components shown can be implemented in hardware, software, or a combination of software and hardware.

[0054] The processor 110 can include one or more processing units, for example: the processor 110 can include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units can be independent devices, or can be integrated into one or more processors.

[0055] The controller can generate operation control signals according to instruction operation codes and timing signals, and complete the control of fetching and executing instructions.

[0056] The processor 110 can also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory can hold instructions or data that the processor 110 has just used or cycled through. If the processor 110 needs to use the instructions or data again, it can be called directly from the memory. This avoids repeated access and reduces the latency of the processor 110, thus improving the efficiency of the system.

[0057] In some embodiments, the processor 110 can include one or more interfaces. The interfaces can include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0058] The USB interface 130 is an interface that conforms to the USB standard specification, and can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transmit data between the electronic device 100 and a peripheral device. It can also be used to connect earphones to play audio through the earphones. The interface can also be used to connect other electronic devices, such as AR devices, etc.

[0059] It can be understood that the interface connection relationship between the modules shown in the embodiments of the present application is only illustrative and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 can also use different interface connection methods or combinations of multiple interface connection methods in the above embodiments.

[0060] The charging management module 140 is configured to receive charging input from a charger. The charger can be a wireless charger or a wired charger. In some embodiments with wired charging, the charging management module 140 can receive charging input from a wired charger through the USB interface 130. In some embodiments with wireless charging, the charging management module 140 can receive wireless charging input through a wireless charging coil of the electronic device 100. The charging management module 140 can supply power to the electronic device while charging the battery 142.

[0061] The power management module 141 is configured to connect the battery 142, the charging management module 140, and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140 to supply power to the processor 110, the internal memory 121, the display 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be configured to monitor parameters such as battery capacity, battery cycle count, battery health status (leakage, impedance), and the like. In some other embodiments, the power management module 141 can also be disposed in the processor 110. In some other embodiments, the power management module 141 and the charging management module 140 can also be disposed in the same device.

[0062] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, a modem processor, and a baseband processor, and the like.

[0063] The antenna 1 and the antenna 2 are configured to transmit and receive electromagnetic wave signals. Each antenna in the electronic device 100 can be configured to cover a single or multiple communication frequency bands. Different antennas can also be multiplexed to improve the utilization of the antennas. For example, the antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in combination with a tuning switch.

[0064] The mobile communication module 150 can provide a solution for wireless communication including 2G / 3G / 4G / 5G, etc. applied to the electronic device 100. The mobile communication module 150 can include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves by the antenna 1, and perform filtering, amplification, etc. on the received electromagnetic waves, and transfer to a modem processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modem processor, and radiate as electromagnetic waves through the antenna 1. In some embodiments, at least part of the functional modules of the mobile communication module 150 can be disposed in the processor 110. In some embodiments, at least part of the functional modules of the mobile communication module 150 can be disposed in the same device as at least part of the modules of the processor 110.

[0065] The modem processor can include a modulator and a demodulator. The modulator is configured to modulate a low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is configured to demodulate a received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. The low-frequency baseband signal processed by the baseband processor is transmitted to the application processor. The application processor outputs a sound signal through an audio device (not limited to the speaker 170A, the microphone 170B, etc.), or displays an image or a video through the display screen 194. In some embodiments, the modem processor can be a separate device. In other embodiments, the modem processor can be independent of the processor 110, and disposed in the same device as the mobile communication module 150 or other functional modules.

[0066] The wireless communication module 160 can provide a solution for wireless communication including wireless local area networks (WLAN) (e.g., wireless fidelity (Wi-Fi) network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR) technology, etc. applied to the electronic device 100. The wireless communication module 160 can be one or more devices that integrate at least one communication processing module. The wireless communication module 160 receives an electromagnetic wave via the antenna 2, frequency-modulates and filters the electromagnetic wave signal, and transmits the processed signal to the processor 110. The wireless communication module 160 can also receive a signal to be transmitted from the processor 110, frequency-modulate it, amplify it, and radiate it as an electromagnetic wave via the antenna 2.

[0067] In some embodiments, the antenna 1 and the mobile communication module 150 of the electronic device 100 are coupled, and the antenna 2 and the wireless communication module 160 are coupled, so that the electronic device 100 can communicate with a network and other devices through wireless communication technology. The wireless communication technology can include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology, etc. The GNSS can include a global positioning system (GPS), a global navigation satellite system (GLONASS), a beidu navigation satellite system (BDS), a quasi-zenith satellite system (QZSS), and / or a satellite based augmentation systems (SBAS).

[0068] The electronic device 100 implements a display function through a GPU, a display screen 194, and an application processor, etc. The GPU is a microprocessor for image processing, which is connected to the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 can include one or more GPUs, which execute program instructions to generate or change display information.

[0069] The display screen 194 is configured to display images, videos, and the like. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flex light-emitting diode (FLED), a Miniled, a MicroLed, a Micro-oLed, a quantum dot light emitting diodes (QLED), or the like. In some embodiments, the electronic device 100 can include one or N display screens 194, where N is a positive integer greater than 1.

[0070] The electronic device 100 can implement the photographing function through the ISP, the camera 193, the video codec, the GPU, the display screen 194, and the application processor.

[0071] The ISP is configured to process the data fed back by the camera 193. For example, when taking a photo, the shutter is opened, the light is transmitted to the camera photosensitive element through the lens, the light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing to convert it into an image visible to the naked eye. The ISP can also optimize the noise, brightness, and skin color of the image. The ISP can also optimize the exposure, color temperature, and other parameters of the shooting scene. In some embodiments, the ISP can be disposed in the camera 193.

[0072] The camera 193 is configured to capture still images or videos. An object generates an optical image through a lens and projects it onto a photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then transmitted to the ISP to convert it into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV, or the like format. In some embodiments, the electronic device 100 can include one or N cameras 193, where N is a positive integer greater than 1.

[0073] The digital signal processor is used to process digital signals, in addition to being able to process digital image signals, it can also process other digital signals. For example, when the electronic device 100 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy, etc.

[0074] The video codec is used to compress or decompress digital video. The electronic device 100 can support one or more video codecs. In this way, the electronic device 100 can play or record videos in multiple encoding formats, such as: moving picture experts group (MPEG) 1, MPEG 2, MPEG 3, MPEG 4, etc.

[0075] The NPU is a neural-network (NN) calculation processor, which can quickly process input information by drawing on the structure of a biological neural network, such as drawing on the transmission mode between human brain neurons, and can also constantly self-learn. Through the NPU, the electronic device 100 can realize intelligent cognition applications such as image recognition, face recognition, voice recognition, text understanding, etc.

[0076] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to realize data storage functions. For example, music, video, etc. Files are saved in the external memory card.

[0077] The internal memory 121 can be used to store computer executable program codes, which include instructions. The internal memory 121 can include a program storage area and a data storage area. The program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), etc. The data storage area can store data created during the use of the electronic device 100 (such as audio data, a phonebook, etc.), etc. In addition, the internal memory 121 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various function applications and data processing of the electronic device 100 by running instructions stored in the internal memory 121 and / or instructions stored in the memory disposed in the processor.

[0078] The electronic device 100 can realize audio functions through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the earphone interface 170D, and the application processor, etc. For example, music playing, recording, etc.

[0079] The audio module 170 is configured to convert digital audio information into an analog audio signal output, and to convert an analog audio input into a digital audio signal. The audio module 170 can also be configured to encode and decode audio signals. In some embodiments, the audio module 170 can be disposed in the processor 110, or some of the functions of the audio module 170 can be disposed in the processor 110.

[0080] The speaker 170A, also referred to as a "loudspeaker", is configured to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0081] The receiver 170B, also referred to as a "earpiece", is configured to convert an audio electrical signal into a sound signal. When the electronic device 100 receives a call or a voice message, the user can listen to the voice through the receiver 170B close to the ear.

[0082] The microphone 170C, also referred to as a "microphone", "sound collector", is configured to convert a sound signal into an electrical signal. When making a call or sending a voice message, the user can make a sound through the mouth close to the microphone 170C, and input the sound signal into the microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, in addition to collecting sound signals, noise reduction functions can also be realized. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C, in addition to collecting sound signals, noise reduction, and can also identify the source of the sound, realize the function of directional recording, etc.

[0083] The earphone interface 170D is configured to connect a wired earphone. The earphone interface 170D can be a USB interface 130, or a 3.5mm open mobile terminal platform (OMTP) standard interface, a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0084] The keys 190 include a power key, a volume key, etc. The keys 190 can be mechanical keys. They can also be touch keys. The electronic device 100 can receive key inputs, and generate key signal inputs related to user settings and function control of the electronic device 100.

[0085] The motor 191 can generate a vibration prompt. The motor 191 can be used for incoming call vibration prompt, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, playing audio, etc.) can correspond to different vibration feedback effects. The motor 191 can also correspond to different vibration feedback effects for touch operations acting on different regions of the display screen 194. Different application scenarios (such as time reminders, received messages, alarms, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also be customized.

[0086] The indicator 192 can be an indicator light, which can be used to indicate the charging state, the power change, and can also be used to indicate messages, missed calls, notifications, etc.

[0087] The SIM card interface 195 is used to connect the SIM card. The SIM card can be inserted into or pulled out of the SIM card interface 195 to realize contact and separation with the electronic device 100. The electronic device 100 can support one or N SIM card interfaces, and N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, etc. The same SIM card interface 195 can simultaneously insert multiple cards. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external storage cards. The electronic device 100 interacts with the network through the SIM card to realize functions such as calling and data communication. In some embodiments, the electronic device 100 uses an eSIM, that is, an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0088] The software system of the electronic device 100 can adopt a layered architecture, an event-driven architecture, a microkernel architecture, a microservice architecture, or a cloud architecture. Embodiments of the present application take an Android system with a layered architecture as an example to exemplarily illustrate the software structure of the electronic device 100.

[0089] Figure 2 is a software structure block diagram of the electronic device 100 of the embodiments of the present application.

[0090] The layered architecture divides the software into several layers, and each layer has a clear role and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom, the application layer, the application framework layer, the Android runtime and the system library, and the kernel layer.

[0091] The application layer can include a series of application packages.

[0092] AsFigure 2 As shown, the application package can include camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc. applications.

[0093] The application framework layer provides application programming interface (API) and programming framework for the applications of the application layer. The application framework layer includes some pre-defined functions.

[0094] As shown, the application framework layer can include window manager, content provider, view system, phone manager, resource manager, notification manager, etc. Figure 2

[0095] The window manager is used to manage window programs. The window manager can acquire the size of the display screen, determine whether there is a status bar, lock the screen, and intercept the screen, etc.

[0096] The content provider is used to store and acquire data, and make the data accessible by the applications. The data can include video, image, audio, dialed and received calls, browsing history and bookmarks, phonebook, etc.

[0097] The view system includes visual controls, such as controls for displaying text, controls for displaying pictures, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a short message notification icon can include a view for displaying text and a view for displaying pictures.

[0098] The phone manager is used to provide the communication function of the electronic device 100. For example, management of call status (including call connection, call hang-up, etc.).

[0099] The resource manager provides various resources for the applications, such as localized strings, icons, pictures, layout files, video files, etc.

[0100] The notification manager makes the applications able to display notification information in the status bar, which can be used to convey messages of the notification type, which can automatically disappear after a short stay without user interaction. For example, the notification manager is used to inform the completion of download, message reminder, etc. The notification manager can also be a notification in the form of a chart or a scroll bar text appearing in the top status bar of the system, such as a notification of an application running in the background, or a notification in the form of a dialogue window appearing on the screen. For example, prompting text information in the status bar, issuing a prompt sound, vibrating the electronic device, and flickering the indicator light, etc.

[0101] The Android runtime includes the core library and the virtual machine. The Android runtime is responsible for the scheduling and management of the Android system.​

[0102] The core library contains two parts: one part is the function function that the java language needs to call, and the other part is the core library of Android.

[0103] The application layer and the application framework layer run in the virtual machine. The virtual machine executes the java files of the application layer and the application framework layer into binary files. The virtual machine is used to perform the functions of object lifecycle management, stack management, thread management, security and exception management, and garbage collection.

[0104] The system library can include multiple functional modules. For example: surface manager, media library, three-dimensional graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0105] The surface manager is used to manage the display subsystem, and provides 2D and 3D layer fusion for multiple applications.

[0106] The media library supports multiple commonly used audio, video format playback and recording, and static image files. The media library can support multiple audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0107] The three-dimensional graphics processing library is used to realize three-dimensional graphics drawing, image rendering, synthesis, and layer processing, etc.

[0108] The 2D graphics engine is a drawing engine for 2D drawing.

[0109] The kernel layer is the layer between hardware and software. The kernel layer at least contains display driver, camera driver, audio driver, sensor driver.

[0110] The working flow of the software and hardware of the electronic device 100 will be described below in conjunction with the capture and photographing scene.

[0111] When the touch sensor 180K receives a touch operation, a corresponding hardware interrupt is sent to the kernel layer. The kernel layer processes the touch operation into a raw input event (including touch coordinates, timestamp of touch operation, etc. Information). The raw input event is stored in the kernel layer. The application framework layer obtains the raw input event from the kernel layer, identifies the control corresponding to the input event. Taking the touch operation as a touch single click operation, and the control corresponding to the single click operation as the control of the camera application icon as an example, the camera application calls the interface of the application framework layer, starts the camera application, and then starts the camera driver through the kernel layer, and captures the still image or video through the camera 193.

[0112] First, the related terms in the embodiments of the present application are introduced as follows:

[0113] (1) Root cause alarm: In one fault scenario or fault information, there are multiple alarms, and the root cause alarm can be considered as the root alarm causing other alarms. Once it is effectively processed, the derived alarms can be quickly eliminated. In the present application, faults and alarms are not equivalent, and a fault corresponds to a problem scenario, which contains the occurrence of multiple alarms in one problem scenario.

[0114] (2) Root cause reasoning graph: It is a directed graph or an undirected graph used to organize the influence relationship between data or variables, and is the basic data structure of most RCA methods, which is used for root cause reasoning. In a fault scenario, each node in the root cause reasoning graph represents an alarm type, and each edge represents the influence relationship between each two alarms. The influence relationship can be a correlation relationship or a causal relationship.

[0115] (3) Causal relationship and correlation relationship: Both causal relationship and correlation relationship represent a certain relationship between two variables; causal relationship is directional, while correlation relationship is generally undirectional; causal relationship is a more essential relationship than correlation relationship, representing the data generation mechanism. Causal relationship is a correlation relationship, but correlation relationship is not necessarily a causal relationship. It should be noted that in some scenarios, the correlation relationship can also be directional, but this direction generally only represents the order of occurrence of variables, which is different from the direction of the causal relationship representing the triggering relationship between variables, such as A->B representing that A causes B to occur, rather than just representing that A occurs before B.

[0116] (4) Causal graph: It is a directed graph, in which each node represents a variable (such as in an alarm scenario, one alarm type can be regarded as a variable); each directed edge in the graph represents the causal relationship between variables, such as A->B representing that variable A causes variable B to occur. Causal graph can be used to intuitively display the mutual triggering relationship between variables, and is also a representation of the data generation method between variables. Causal graph can be used for root cause inference. Causal graph is a high-efficiency root cause reasoning graph. Correspondingly, there is also an association graph, which can also be used as a root cause reasoning graph, but due to its inherent characteristics, the root cause reasoning accuracy is difficult to guarantee in theory compared with the causal graph.

[0117] (5) Knowledge data: It refers to the experience data with high correctness guarantee determined by domain experts or product manuals, including but not limited to RCA results labeled by experts, knowledge question and answer systems capable of giving correct RCA feedback for part of fault scenarios, etc.

[0118] (6)Observation data: Observation data refers to data collected directly from equipment (or data reported by equipment itself), including but not limited to alarm data, topology data, etc. Observation data is composed of a series of observation samples, such as the record of information of each alarm (including information such as alarm type, occurrence time, and equipment, etc.) in alarm data. In this application, the term "data" refers to observation data unless otherwise specified.

[0119] (7)Small sample scenario: In this application, a small sample scenario refers to a scenario in which there are relatively few observation samples available for building an AI model. Since most AI algorithms are observation data driven, in a small sample scenario, these algorithms usually cannot build a high-performance model. Here, "few" is not defined by a specific number, but depends on the complexity of the scenario.

[0120] (8)Causal counterfactual reasoning: A causal technology that can generate counterfactual samples based on observation data.

[0121] (9)Counterfactual sample: Corresponding to the observation sample contained in the observation data, the observation sample is a sample that has actually occurred, and the counterfactual sample is a sample that has not actually occurred but has a high probability of actually occurring, generated by a counterfactual reasoning technology (such as causal counterfactual reasoning).

[0122] (10)Generalization ability: The ability of a technical solution or AI model to handle unknown or new scenarios, for example, an RCA model or solution is trained using data (observation data or knowledge data) from network A. If it can achieve good RCA results on other different networks, such as network B, network C, etc., it can be considered that the RCA model or solution has strong generalization ability.

[0123] As the size of the telecommunications network increases, the number and types of alarms generated due to equipment failure or network communication anomalies continue to increase. When a large number of alarms occur in the network, it is of great research value to efficiently locate the root cause of these alarms using RCA technology to minimize the cost of eliminating these alarms and improve the efficiency of handling fault problem tickets.

[0124] Most RCA techniques have the following two defects in root cause reasoning graph construction:

[0125] (1) Pure observation data driven or pure knowledge data driven, which requires high completeness of knowledge data or observation data. In scenarios where knowledge data or observation data is missing, the accuracy of root cause localization is difficult to guarantee.

[0126] (2) No counterfactual samples were expanded during the construction process, and the generalization ability of the constructed root cause reasoning graph was limited, that is, it could only handle a limited number of scenarios and had limited ability to handle unknowns that did not appear in the training data.

[0127] In summary, most RCA techniques construct root cause reasoning graphs based on pure observational data or pure knowledge data, which makes it difficult to guarantee the accuracy and generalization ability of root cause localization in scenarios with small sample sizes and limited domain knowledge.

[0128] Based on the above-mentioned technical problems, this invention provides a root cause reasoning graph update system for wireless network failure scenarios. Figure 3 This is an architecture diagram of a root cause reasoning graph update system provided in an embodiment of the present invention.

[0129] like Figure 3 As shown, the root cause inference graph update system 200 includes an environment module 210, a root cause inference module 220, a knowledge feedback module 230, and a fault analysis module 240.

[0130] The environment module 210 takes observation data and excitation signals as inputs and outputs counterfactual samples as outputs. Figure 4 for Figure 3 A structural diagram of the environment module is shown below. Figure 4 As shown, the environment module 210 includes a search and identification submodule 211 and a controllable generation submodule (also known as a "causal counterfactual enhancement submodule") 212.

[0131] The environment module 210 is used to search and identify observation data, and construct an initial root cause inference graph, i.e., the first root cause inference graph, based on the observation data. In some possible embodiments, the search and identification submodule 211 is used to search and identify observation data, and construct an initial root cause inference graph, i.e., the first root cause inference graph, based on the observation data.

[0132] Specifically, the environment module 210 is used to construct a first root cause inference graph based on observation data and a preset strategy. In some possible embodiments, the search and identification submodule 211 is used to construct the first root cause inference graph based on observation data and a preset strategy.

[0133] For example, the preset strategies include, but are not limited to: randomly constructing the first root cause inference graph, using observational data to call a traditional causal discovery algorithm (such as the PC algorithm) to construct the first root cause inference graph, or using expert experience to construct the first root cause inference graph, etc. For example, the first root cause inference graph is a causal graph.

[0134] Table 1 Historical Alarm Data

[0135] ticket_id alarm_type device_name start_timestamp end_timestamp 1 A node-1 2023 / 02 / 12 10:10:12 2023 / 02 / 12 10:10:14 1 C node-1 2023 / 02 / 12 10:11:12 2023 / 02 / 12 10:12:04 1 A node-2 2023 / 02 / 12 10:15:10 2023 / 02 / 12 10:17:14 2 B node-1 2023 / 02 / 12 10:30:11 2023 / 02 / 12 10:30:19

[0136] For example, observation data includes historical alarm data, KPI logs, etc.

[0137] For example, as shown in Table 1, the historical alarm data contains fields including: ticket id (ticket id), alarm type (alarm type), alarm occurrence device name (device name), alarm occurrence time (start timestamp) and alarm end time (end timestamp). Each record in the alarm data is referred to as an alarm sample, and a series of alarm records with the same ticket id are combined into a failure sample.

[0138] For example, the environment module 210 learns an initialized causal graph G from the historical alarm data through a deep causal learning framework (Amortized inference model).

[0139] The environment module 210 is also configured to select a first number of observation samples (such as m observation samples) from the observation data, and obtain a second number of counterfactual samples (such as n counterfactual samples) according to the first root cause inference graph and the first number of observation samples. In some possible embodiments, the controllable generation submodule 212 is configured to select a first number of observation samples from the observation data, and obtain a second number of counterfactual samples according to the first root cause inference graph and the first number of observation samples.

[0140] Specifically, the environment module 210 is configured to perform causal counterfactual reasoning on the first number of observation samples through the first root cause inference graph to obtain the second number of counterfactual samples. In some possible embodiments, the controllable generation submodule 212 is configured to perform causal counterfactual reasoning on the first number of observation samples through the first root cause inference graph to obtain the second number of counterfactual samples. In addition to using causal counterfactual reasoning to obtain counterfactual samples, the environment module 210 can also use other techniques to obtain counterfactual samples, which are not limited in the present application.

[0141] For example, the environment module 210 uses a probability sampling method (Gumbel-softmax Sampling) to implement the generation of counterfactual samples.

[0142] For example, the first number and the second number are both integers greater than 0.

[0143] The root cause inference module 220 is configured to obtain a first set of inferred root causes corresponding to the second number of counterfactual samples according to the first root cause inference graph and the second number of counterfactual samples.

[0144] Specifically, the root cause inference module 220 is configured to perform root cause inference on the second number of counterfactual samples through the first root cause inference graph to obtain the first set of inferred root causes corresponding to the second number of counterfactual samples.

[0145] For example, the root cause inference module 220 can employ various strategies to implement root cause inference, such as static reasoning strategies (such as causal effect estimation).

[0146] For example, Figure 5 For example, the root cause inference module 220 can employ various strategies to implement root cause inference, such as static reasoning strategies (such as causal effect estimation). Figure 5 As shown in FIG. 5, five counterfactual samples, i.e., sample A, sample B, sample C, sample D, and sample E, are subjected to causal effect estimation according to the first root cause reasoning graph, and the root cause inference result is A > C > E and B > D, and the first inferred root cause set is obtained according to the root cause inference result.

[0147] The knowledge feedback module 230 is configured to obtain a second inferred root cause set corresponding to the second number of counterfactual samples according to the knowledge data and the second number of counterfactual samples.

[0148] In simple terms, the knowledge data is the RCA result for a certain fault scenario fed back by an expert or an operation and maintenance engineer, such as a fault snapshot. Figure 6 For example, the knowledge data in the embodiment of the present application is shown in FIG. 6. Figure 6 As shown in FIG. 6, when A, B, and C three types of alarms occur, the root cause alarm is A, i.e., the occurrence of the B type alarm and the C type alarm is caused by the A type alarm.

[0149] Specifically, the knowledge feedback module 230 is configured to perform root cause inference on the second number of counterfactual samples through the knowledge data to obtain the second inferred root cause set, or obtain a knowledge model according to the knowledge data, and perform root cause inference on the second number of counterfactual samples through the knowledge model to obtain the second inferred root cause set.

[0150] The knowledge feedback module 230 is further configured to obtain an incentive signal according to the first inferred root cause set and the second inferred root cause set.

[0151] Specifically, the knowledge feedback module 230 is configured to calculate the cross-entropy of the first inferred root cause set and the second inferred root cause set, and take the cross-entropy as the incentive signal.

[0152] For example, the calculation formula of the cross-entropy of the first inferred root cause set and the second inferred root cause set is as follows:

[0153]

[0154] In the formula, n is the second number, x i is a counterfactual sample, p is the first inferred root cause set, q is the second inferred root cause set, and H is the cross-entropy.

[0155] For example, for the second number of counterfactual samples (A, B, C, D), the first inferred root cause set p = (0.5, 0.3, 0.1, 0.1), where the probability of A being the root cause is 0.5, the probability of B being the root cause is 0.3, the probability of C being the root cause is 0.1, and the probability of D being the root cause is 0.1. The second inferred root cause set q = (0, 1, 0, 0), where the probability of A being the root cause is 0, the probability of B being the root cause is 0, the probability of C being the root cause is 0, and the probability of D being the root cause is 0. The difference between the first inferred root cause set and the second inferred root cause set can be calculated by the above-mentioned calculation formula of cross-entropy, and the difference can guide the update of the first root cause inference graph in the environment module 210.

[0156] In addition to obtaining the incentive signal by calculating the cross-entropy, the knowledge feedback module 230 can also obtain the incentive signal by other techniques, which are not specifically limited in the present application.

[0157] The environment module 210 is further configured to update the first root cause inference graph according to the incentive signal fed back by the knowledge feedback module 230 to obtain a second root cause inference graph. In some possible embodiments, the search and identification sub-module 211 is configured to update the first root cause inference graph according to the incentive signal fed back by the knowledge feedback module 230 to obtain the second root cause inference graph.

[0158] For example, the environment module 210 uses the incentive signal to update the first root cause inference graph according to the gradient backpropagation algorithm (a typical neural network parameter learning method).

[0159] The environment module 210 is further configured to determine whether the second root cause inference graph or the incentive signal meets a preset condition.

[0160] For example, the preset condition includes but is not limited to that the second root cause inference graph is the same as the second root cause inference graph of the last iteration, and the value of the incentive signal belongs to a threshold range set by the user.

[0161] The environment module 210 is further configured to, if it is determined that neither the second root cause inference graph nor the incentive signal meets the preset condition, take the second root cause inference graph as the first root cause inference graph, and continue to perform the operation of obtaining the incentive signal of the counterfactual sample according to the observation data and the first root cause inference graph.

[0162] The environment module 210 is further configured to, if it is determined that both the second root cause inference graph and the incentive signal meet the preset condition, output the second root cause inference graph to the fault analysis module 240.

[0163] The fault analysis module 240 is configured to perform root cause inference on the fault to be analyzed through the second root cause inference graph to obtain a root cause alarm.

[0164] The root cause reasoning graph update system 200 can be deployed in an electronic device. The hardware and software structures of the electronic device provided in this embodiment of the invention can be found in [reference needed]. Figure 1 and Figure 2 The relevant description of electronic device 100 in the text.

[0165] The root cause reasoning graph update system 200 provided in this embodiment of the invention can be applied to network fault scenarios. Figure 7 This is a schematic diagram illustrating an application scenario of the root cause reasoning graph update system according to an embodiment of the present invention, such as... Figure 7 As shown, alarms generated by telecommunications network equipment are uniformly reported to the alarm / fault monitoring system (which is a software deployed in the cloud or on a server cluster), and the alarm / fault monitoring system completes the database entry. The alarm / fault monitoring system is divided into two parts: an offline processing subsystem and a real-time processing subsystem. The offline processing subsystem reads historical alarm data from the database and combines it with external knowledge data or external knowledge systems to construct an RCA model using the root cause inference graph update system 200 provided in this embodiment of the invention. The real-time processing subsystem reads real-time alarm data from the database and creates fault work orders by matching corresponding alarm combinations from the real-time alarm stream through a series of pre-set alarm compression rules. Then, it uses the RCA model constructed by the root cause inference graph update system 200 to locate the root cause of the associated alarm combinations contained in each fault work order. Finally, the fault work order with added root cause information is dispatched to the maintenance engineer. The engineer checks the corresponding telecommunications equipment based on the information in the fault work order. Since the fault work order contains root cause alarm information, as long as the root cause alarm is processed, other related alarms will naturally be eliminated, which greatly improves the efficiency of fault handling.

[0166] The root cause inference graph update system 200 provided in this embodiment of the invention can also be applied to scenarios similar to network failure scenarios, such as the RCA scenario for disease diagnosis in the medical field.

[0167] The root cause reasoning graph update system 200 provided in this embodiment of the invention can also be extended into a large model fine-tuning paradigm, which uses the large model to perform RCA question answering on the current observation data, thereby reorganizing the existing knowledge contained in the large model in the form of a root cause reasoning graph, thereby enhancing the reasoning ability of the large model.

[0168] In summary, the root cause reasoning graph updating system 200 provided by the embodiment of the present application dynamically fuses observation data and knowledge data, uses knowledge data or a knowledge model to stimulate and correct the correctness of the root cause reasoning graph, uses the root cause reasoning graph to combine observation data to perform counterfactual sample enhancement (most RCA techniques do not consider counterfactual sample expansion in the modeling process), improves the ability of the RCA model to cope with unknown scenarios, and can effectively improve the root cause positioning accuracy and generalization ability in small sample scenarios and scenarios with insufficient domain knowledge.

[0169] Based on the root cause reasoning graph updating system 200 described above, the embodiment of the present application provides a root cause reasoning graph updating method and an electronic device. The root cause reasoning graph is learned through dynamic fusion of observation data and knowledge data, and counterfactual samples are dynamically expanded in the root cause reasoning graph construction process, which can effectively improve the root cause positioning accuracy and generalization ability in small sample scenarios and scenarios with insufficient domain knowledge.

[0170] Figure 8 A flowchart of a root cause reasoning graph updating method provided by the embodiment of the present application is shown in FIG. 3. Figure 8 As shown in FIG. 3, the method comprises the following steps.

[0171] Step 302: Obtain a first root cause reasoning graph according to observation data.

[0172] In this step, as shown in FIG. 2, the environment module 210 constructs the first root cause reasoning graph according to the observation data and a preset strategy. Figure 3

[0173] For example, the preset strategy includes but is not limited to randomly constructing the first root cause reasoning graph, using the observation data to call a traditional causal discovery algorithm (such as a PC algorithm) to construct the first root cause reasoning graph, or using expert experience to construct the first root cause reasoning graph, etc.

[0174] For example, the first root cause reasoning graph is a causal graph.

[0175] For example, the observation data includes historical alarm data, KPI logs, etc.

[0176] For example, as shown in Table 1, the historical alarm data contains fields including a ticket id (ticket_id), an alarm type (alarm_type), an alarm occurrence device name (device_name), an alarm occurrence time (start_timestamp), and an alarm end time (end_timestamp). Each record in the alarm data is referred to as an alarm sample, and a series of alarm records with the same ticket id are combined into one fault sample.

[0177] ​For example, the environment module 210 learns an initialized causal graph G from historical alarm data through a deep causal learning framework (Amortized inference model).

[0178] Step 304: obtaining an incentive signal of the counterfactual sample according to the observation data, the first root cause reasoning graph and the knowledge data.

[0179] In some possible embodiments, as shown in FIG. 4, step 304 specifically includes: Figure 9

[0180] Step 304a: selecting a first number of observation samples from the observation data.

[0181] In this step, as shown in FIG. 4, the environment module 210 selects a first number of observation samples (for example, m observation samples) from the observation data. Figure 3

[0182] Step 304b: obtaining a second number of counterfactual samples according to the first root cause reasoning graph and the first number of observation samples.

[0183] In this step, as shown in FIG. 4, the environment module 210 obtains a second number of counterfactual samples (for example, n counterfactual samples) according to the first root cause reasoning graph and the first number of observation samples. Figure 3 For example, the first number and the second number are both integers greater than 0.

[0184] In some possible embodiments, step 304b specifically includes: performing causal counterfactual reasoning on the first number of observation samples through the first root cause reasoning graph to obtain the second number of counterfactual samples.

[0185] In this step, as shown in FIG. 4, the environment module 210 performs causal counterfactual reasoning on the first number of observation samples through the first root cause reasoning graph to obtain the second number of counterfactual samples.

[0186] Figure 3 For example, the environment module 210 uses a probability sampling method (Gumbel-softmax Sampling) to implement generation of the counterfactual samples.

[0187] In addition to obtaining counterfactual samples through causal counterfactual reasoning, the embodiment of the present application can also obtain counterfactual samples through other technologies, which are not limited in the present application.

[0188] Step 304c: obtaining a first set of inferred root causes corresponding to the second number of counterfactual samples according to the first root cause reasoning graph and the second number of counterfactual samples.

[0189] In this step, as shown in FIG. 4, the environment module 210 obtains a first set of inferred root causes corresponding to the second number of counterfactual samples according to the first root cause reasoning graph and the second number of counterfactual samples. ​​​

[0190] In this step, as shown in Figure 3 The root cause inference module 220 obtains a first inferred root cause set corresponding to the second numerical number of counterfactual samples according to the first root cause reasoning graph and the second numerical number of counterfactual samples.

[0191] In some possible embodiments, step 304c specifically includes: performing root cause inference on the second numerical number of counterfactual samples through the first root cause reasoning graph to obtain a first inferred root cause set corresponding to the second numerical number of counterfactual samples.

[0192] In this step, as shown in Figure 3 The root cause inference module 220 performs root cause inference on the second numerical number of counterfactual samples through the first root cause reasoning graph to obtain a first inferred root cause set corresponding to the second numerical number of counterfactual samples.

[0193] For example, the root cause inference module 220 can use various strategies to implement root cause inference, such as a static reasoning strategy (causal effect estimation).

[0194] Step 304d: obtaining a second inferred root cause set corresponding to the second numerical number of counterfactual samples according to the knowledge data and the second numerical number of counterfactual samples;

[0195] In this step, as shown in Figure 3 The knowledge feedback module 230 obtains a second inferred root cause set corresponding to the second numerical number of counterfactual samples according to the knowledge data and the second numerical number of counterfactual samples.

[0196] In simple terms, the knowledge data is the RCA result for a certain fault scenario fed back by an expert or an operation and maintenance engineer, such as a fault snapshot. Figure 4 For the schematic diagram of the knowledge data in the embodiments of the present application, as shown in Figure 4 When A, B, and C three types of alarms occur, the root cause alarm is A, that is, the occurrence of the B type alarm and the C type alarm is caused by the A type alarm.

[0197] In some possible embodiments, step 304d specifically includes: performing root cause inference on the second numerical number of counterfactual samples through the knowledge data to obtain the second inferred root cause set; or obtaining a knowledge model according to the knowledge data, and performing root cause inference on the second numerical number of counterfactual samples through the knowledge model to obtain the second inferred root cause set.

[0198] In this step, as shown in Figure 3 The knowledge feedback module 230 performs root cause inference on the second numerical number of counterfactual samples through the knowledge data to obtain the second inferred root cause set; or obtains a knowledge model according to the knowledge data, and performs root cause inference on the second numerical number of counterfactual samples through the knowledge model to obtain the second inferred root cause set.

[0199] Step 304e: Obtain the excitation signal based on the first inferred root cause set and the second inferred root cause set.

[0200] In this step, such as Figure 3 As shown, the knowledge feedback module 230 obtains the excitation signal based on the first inferred root cause set and the second inferred root cause set.

[0201] In some possible embodiments, step 304e specifically includes: calculating the cross-entropy of the first inferred root cause set and the second inferred root cause set, and using the cross-entropy as an excitation signal.

[0202] In this step, such as Figure 3 As shown, the knowledge feedback module 230 calculates the cross-entropy of the first inferred root cause set and the second inferred root cause set; and uses the cross-entropy as an excitation signal.

[0203] For example, the formula for calculating the cross-entropy of the first inferred root cause set and the second inferred root cause set is as follows:

[0204]

[0205] In the formula, n is the second value, x i Let p be the counterfactual sample, q be the first set of inferred root causes, and H be the second set of inferred root causes.

[0206] For example, for the second numerical counterfactual sample (A, B, C, D), the first inferred root cause set p = (0.5, 0.3, 0.1, 0.1), where the probability that A is a root cause is 0.5, the probability that B is a root cause is 0.3, the probability that C is a root cause is 0.1, and the probability that D is a root cause is 0.1. The second inferred root cause set q = (0, 1, 0, 0), where the probability that A is a root cause is 0, the probability that B is a root cause is 0, the probability that C is a root cause is 0, and the probability that D is a root cause is 0. The difference between the first and second inferred root cause sets can be calculated using the cross-entropy formula described above, and this difference can guide the updating of the first root cause inference graph in environment module 210.

[0207] In addition to obtaining the excitation signal by calculating cross-entropy, other techniques can also be used in the embodiments of the present invention to obtain the excitation signal, and the present invention does not specifically limit these techniques.

[0208] Step 306: Update the first root cause inference graph according to the excitation signal to obtain the second root cause inference graph.

[0209] In this step, such as Figure 3 As shown, the environment module 210 updates the first root cause inference graph based on the stimulus signal fed back by the knowledge feedback module 230, and obtains the second root cause inference graph.

[0210] For example, the environment module 210 uses the incentive signal to update the first root cause reasoning graph according to a gradient backpropagation algorithm, a typical neural network parameter learning method.

[0211] Optionally, after step 306, the method further comprises:

[0212] Step 308: determining whether the second root cause reasoning graph or the incentive signal meets a preset condition, if not, executing step 310; if yes, executing step 312.

[0213] In this step, as shown in the figure, Figure 3 the environment module 210 determines whether the second root cause reasoning graph or the incentive signal meets a preset condition.

[0214] Illustratively, the preset condition includes but is not limited to: the second root cause reasoning graph is the same as the second root cause reasoning graph of the last round of iteration, and the value of the incentive signal belongs to the threshold range set by the user.

[0215] Step 310: taking the second root cause reasoning graph as the first root cause reasoning graph, and continuing to execute step 304.

[0216] In this step, as shown in the figure, Figure 3 if the environment module 210 determines that neither the second root cause reasoning graph nor the incentive signal meets the preset condition, the second root cause reasoning graph is taken as the first root cause reasoning graph, and the operation of obtaining the incentive signal of the counterfactual sample according to the observation data and the first root cause reasoning graph is continued.

[0217] Step 312: performing root cause inference on the fault to be analyzed through the second root cause reasoning graph to obtain a root cause alarm.

[0218] In this step, as shown in the figure, Figure 3 if the environment module 210 determines that both the second root cause reasoning graph and the incentive signal meet the preset condition, the second root cause reasoning graph is output to the fault analysis module 240. The fault analysis module 240 performs root cause inference on the fault to be analyzed through the second root cause reasoning graph to obtain a root cause alarm.

[0219] The technical scheme of the root cause reasoning graph updating method provided by the embodiment of the application comprises: obtaining a first root cause reasoning graph according to observation data; obtaining an incentive signal of a counterfactual sample according to the observation data, the first root cause reasoning graph and knowledge data; and updating the first root cause reasoning graph according to the incentive signal to obtain a second root cause reasoning graph. Through dynamic fusion of the observation data and the knowledge data, the root cause reasoning graph is learned, and the counterfactual sample is dynamically expanded in the root cause reasoning graph construction process, which can effectively improve the root cause positioning accuracy and generalization ability in small sample scenarios and scenarios with insufficient domain knowledge.

[0220] Figure 10A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 4. It should be understood that the electronic device 400 can perform each step in the root cause reasoning graph updating method described above, and thus the details are not repeated here. The electronic device 400 includes a processing unit 401.

[0221] The processing unit 401 is configured to obtain a first root cause reasoning graph according to observation data; obtain an incentive signal of counterfactual samples according to the observation data, the first root cause reasoning graph, and knowledge data; and update the first root cause reasoning graph according to the incentive signal to obtain a second root cause reasoning graph.

[0222] Optionally, the processing unit 401 is specifically configured to select a first number of observation samples from the observation data; obtain a second number of counterfactual samples according to the first root cause reasoning graph and the first number of observation samples; obtain a first inferred root cause set corresponding to the second number of counterfactual samples according to the first root cause reasoning graph and the second number of counterfactual samples; obtain a second inferred root cause set corresponding to the second number of counterfactual samples according to the knowledge data and the second number of counterfactual samples; and obtain the incentive signal according to the first inferred root cause set and the second inferred root cause set.

[0223] Optionally, the processing unit 401 is specifically configured to perform causal counterfactual reasoning on the first number of observation samples through the first root cause reasoning graph to obtain the second number of counterfactual samples.

[0224] Optionally, the processing unit 401 is specifically configured to perform root cause inference on the second number of counterfactual samples through the first root cause reasoning graph to obtain the first inferred root cause set corresponding to the second number of counterfactual samples.

[0225] Optionally, the processing unit 401 is specifically configured to perform root cause inference on the second number of counterfactual samples through the knowledge data to obtain the second inferred root cause set, or obtain a knowledge model according to the knowledge data, and perform root cause inference on the second number of counterfactual samples through the knowledge model to obtain the second inferred root cause set.

[0226] Optionally, the processing unit 401 is specifically configured to calculate a cross-entropy of the first inferred root cause set and the second inferred root cause set, and take the cross-entropy as the incentive signal.

[0227] Optionally, the first number and the second number are both integers greater than 0.

[0228] Optionally, after the processing unit 401 updates the first root cause inference graph according to the incentive signal to obtain a second root cause inference graph, the processing unit 401 is further configured to determine whether the second root cause inference graph or the incentive signal meets a preset condition; if it is determined that neither the second root cause inference graph nor the incentive signal meets the preset condition, the second root cause inference graph is taken as the first root cause inference graph, and the operation of obtaining the incentive signal of the counterfactual sample according to the observation data and the first root cause inference graph is continued.

[0229] Optionally, after the processing unit 401 determines whether the second root cause inference graph or the incentive signal meets a preset condition, the processing unit 401 is further configured to, if it is determined that both the second root cause inference graph and the incentive signal meet the preset condition, perform root cause inference on the fault to be analyzed through the second root cause inference graph to obtain a root cause alarm.

[0230] It should be understood that the electronic device 400 is embodied in the form of functional units. The term "unit" herein can be implemented in the form of software and / or hardware, and is not specifically limited. For example, the "unit" can be a software program, a hardware circuit, or a combination of both, which implements the above functions. The hardware circuit can include an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a dedicated processor, or a group processor) and a memory for executing one or more software or firmware programs, a combination logic circuit, and / or other suitable components that support the described functions.

[0231] Therefore, the units of each example described in the embodiments of the present application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0232] The embodiments of the present application provide an electronic device, which can be a terminal device or a circuit device built into the terminal device. The electronic device can be used to perform the functions / steps in the above method embodiments.

[0233] The embodiments of the present application provide a computer readable storage medium, which stores instructions, when the instructions run on a terminal device, cause the terminal device to perform the functions / steps in the above method embodiments.

[0234] The embodiment of the present application further provides a computer program product containing instructions, which, when the computer program product is executed on a computer or any one of the processors, causes the computer to perform the functions / steps in the method embodiments.

[0235] In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B can mean that A exists alone, A and B exist together, and B exists alone. Wherein A and B can be singular or plural. The character " / " generally represents that the associated objects before and after it are in an "or" relationship. "At least one of the following" and the like means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b and c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, and c can be single or multiple.

[0236] Those skilled in the art can realize that the units and algorithm steps described in the embodiments disclosed in the present application can be realized by electronic hardware, computer software and combination of electronic hardware and computer software. Whether the functions are realized by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0237] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0238] In several embodiments provided in the present application, any function realized in the form of a software function unit and sold or used as an independent product can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0239] The above description is only the specific implementation of the present application. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection range of the present application. The protection range of the present application should be subject to the protection range of the claims.

Claims

1. A root cause reasoning graph updating method, characterized by, The method comprises: obtaining a first root cause inference graph according to observation data of wireless network failure, wherein the observation data comprises historical alarm data; obtaining an incentive signal of counterfactual samples according to the observation data, the first root cause inference graph and knowledge data, wherein the knowledge data is root cause analysis results of a failure scenario fed back by an expert or an operation and maintenance engineer, and the root cause analysis results contain root cause alarms of the failure scenario; updating the first root cause inference graph according to the incentive signal to obtain a second root cause inference graph; the second root cause inference graph is used for root cause inference of a failure to be analyzed to obtain root cause alarms of the failure to be analyzed; the method comprises: selecting a first number of observation samples from the observation data; obtaining a second number of counterfactual samples according to the first root cause inference graph and the first number of observation samples; obtaining a first inferred root cause set corresponding to the second number of counterfactual samples according to the first root cause inference graph and the second number of counterfactual samples; obtaining a second inferred root cause set corresponding to the second number of counterfactual samples according to the knowledge data and the second number of counterfactual samples; obtaining the incentive signal according to the first inferred root cause set and the second inferred root cause set.

2. The method of claim 1, wherein, the method comprises: performing causal counterfactual inference on the first number of observation samples through the first root cause inference graph to obtain the second number of counterfactual samples.

3. The method according to claim 1 or 2, characterized in that, the method comprises: performing root cause inference on the second number of counterfactual samples through the first root cause inference graph to obtain the first inferred root cause set corresponding to the second number of counterfactual samples.

4. The method according to any one of claims 1 to 3, characterized in that, the method comprises: performing root cause inference on the second number of counterfactual samples through the knowledge data to obtain the second inferred root cause set; or obtaining a knowledge model according to the knowledge data; performing root cause inference on the second number of counterfactual samples through the knowledge model to obtain the second inferred root cause set. the method comprises:

5. The method according to any one of claims 1 to 4, characterized in that, calculating cross entropy of the first inferred root cause set and the second inferred root cause set, wherein elements in the first inferred root cause set and the second inferred root cause set represent probabilities that the counterfactual samples are root causes; taking the cross entropy as the incentive signal. The first number and the second number are both integers greater than 0.

6. The method according to any one of claims 1-5, characterized in that, after the first root cause inference graph is updated to obtain the second root cause inference graph according to the incentive signal, the method further comprises:

7. The method according to any one of claims 1 to 6, characterized in that, ​ determine whether the second root cause reasoning graph or the incentive signal meets a preset condition; if it is determined that neither the second root cause reasoning graph nor the incentive signal meets the preset condition, take the second root cause reasoning graph as a first root cause reasoning graph, and continue to perform the step of obtaining an incentive signal of a counterfactual sample according to the observation data, the first root cause reasoning graph and knowledge data.

8. The method of claim 7, wherein, After the step of determining whether the second root cause reasoning graph or the incentive signal meets a preset condition, the method further comprises: if it is determined that the second root cause reasoning graph or the incentive signal meets the preset condition, perform root cause inference on the fault to be analyzed through the second root cause reasoning graph to obtain a root cause alarm of the fault to be analyzed.

9. An electronic device, comprising: An electronic device comprising a processor and a memory, wherein the memory is configured to store a computer program comprising program instructions, and when the processor executes the program instructions, the electronic device is caused to perform the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program comprising program instructions, and when the program instructions are executed by a computer, the computer is caused to perform the method according to any one of claims 1-7.

Images