Network device alarm causality inference method and device based on graph neural network

Abstract

The application discloses a network equipment alarm causal relationship inference method and device based on a graph neural network. The method comprises the following steps: first, acquiring alarm event log data; the alarm event log data comprises an alarm event, an alarm occurrence time and alarm associated equipment; then, according to the alarm occurrence time, the alarm event is divided into a corresponding time slice; next, the alarm event is converted into alarm event graph structure data according to the time slice, wherein the alarm event graph structure data comprises an alarm topology graph and a causal relationship graph, the alarm topology graph comprises a first node and a first edge, and the causal relationship graph comprises a second node and a second edge; then, the alarm topology graph and the causal relationship graph are input into a graph neural network to obtain a probability value of a potential cause event leading to occurrence of the alarm event; finally, according to the probability value, it is judged whether the potential cause event is a real cause event. The method can improve the accuracy and comprehensiveness of network equipment alarm causal relationship inference.

Description

TECHNICAL FIELD

[0001] The present application relates to a network device alarm causal relationship inference method and device based on a graph neural network. BACKGROUND

[0002] Alarm processing of network devices is an important task in network operation. In order to effectively deal with various network failures, the operation team needs to timely and accurately process various device alarms. By collecting device logs, the operation team can obtain key information about device running status, abnormal events, etc. However, due to the large number of network devices and frequent occurrence of alarm events, how to efficiently process these alarms has become a major challenge for the operation team.

[0003] In most cases, a certain alarm will trigger a series of cascading alarms. These cascading alarms usually include alarms of other devices or applications related to the original alarm, making the problem more complex. Therefore, it is of great significance to use data analysis methods to find the most critical root alarms from a large number of alarms to analyze alarm propagation mechanisms and reduce alarm solving difficulty. In order to achieve this goal, the operation team needs to deeply analyze alarm data and dig out key information hidden behind a large number of alarms. By identifying the root cause of the alarm, the team can more targetedly solve the problem and improve the stability and reliability of network operation.

[0004] In the prior art, the causal mining method only considers the event itself or the event type, without considering the propagation of the event in the topology structure. On the one hand, the event itself is propagated in the topology structure, and on the other hand, not considering the propagation of the event in the topology structure will exist

[0005] The following problems:

[0006] (1) Missing critical information: ignoring the propagation path of events in the topology structure may lead to missing critical information. Alarms in the network are not just isolated events, their propagation paths and associations are crucial to understanding the development process of the entire security event.

[0007] (2) Misjudgment of causal relationship: not considering the propagation path of events may lead to misjudgment of causal relationship. The propagation path and the relationship between nodes in the topology structure may affect the causal relationship between events, and ignoring this may lead to deviation of the analysis conclusion.

[0008] (3) Impact on response strategy: not considering the propagation characteristics of events in the topology structure may lead to the development of security protection and response strategies that are not comprehensive and effective.

[0009] (4) Reduce analysis accuracy: ignoring the propagation characteristics of the topology structure may reduce the analysis accuracy of the causal mining method. SUMMARY

[0010] The technical problem to be solved by the present application is to address the above-mentioned deficiencies of the prior art, and to provide a network device alarm causal relationship inference method and device based on a graph neural network. The method can improve the accuracy and comprehensiveness of network device alarm causal relationship inference.

[0011] In a first aspect, the present application provides a network device alarm causal relationship inference method based on a graph neural network, comprising the following steps:

[0012] Step S1: obtaining alarm event log data; the alarm event log data includes alarm events, alarm occurrence times, and alarm associated devices;

[0013] Step S2: dividing the alarm events into corresponding time slices according to the alarm occurrence times;

[0014] Step S3: converting the alarm events into alarm event graph structure data according to the time slices;

[0015] The alarm event graph structure data includes an alarm topology graph and a causal relationship graph; the alarm topology graph includes first nodes and first edges, the first nodes are all alarm associated devices, and the first edges are bidirectional connection relationships between the alarm associated devices; the causal relationship graph includes second nodes and second edges, the second nodes are all alarm events, and the second edges are one-way connection relationships between potential cause events and alarm events;

[0016] The potential cause event is a fact, situation, or behavior that may cause an alarm event to occur;

[0017] Step S4: inputting the alarm topology graph and the causal relationship graph into a graph neural network to obtain a probability value of the potential cause event causing the alarm event to occur;

[0018] Step S5: determining whether the potential cause event is a true cause event according to the probability value.

[0019] Further, the step S2 specifically comprises the following steps:

[0020] Step S21: determining a time slice interval of the alarm events;

[0021] Step S22: calculating the time slice corresponding to the alarm events according to the alarm occurrence times and the determined time slice interval;

[0022]

[0023] wherein, is a floor function;

[0024] T represents the time slice corresponding to the alarm event;

[0025] D1 is the time slice interval;

[0026] t1 is the time the alarm occurred;

[0027] Step S23: Divide the alarm events into the corresponding time slices.

[0028] Furthermore, the alarm event includes: a single alarm event, and / or, a certain alarm event type;

[0029] The potential cause events in step S4 are: a single event that may cause a single alarm event to occur, and / or an event type that may cause a certain type of alarm event to occur;

[0030] Step S5 specifically includes:

[0031] The probability value of a potential cause event leading to an alarm event is compared with a preset threshold. If the probability value is greater than or equal to the preset threshold, the potential cause event is determined to be the true cause event leading to the alarm event.

[0032] Furthermore, after step S1 and before step S2, the method further includes step A1;

[0033] Step A1: Perform data preprocessing on the alarm event log data;

[0034] The data preprocessing includes cleaning or formatting.

[0035] Furthermore, step S4 specifically includes the following steps:

[0036] Step S41: Construct feature vectors for the alarm topology graph and the cause-effect graph; the feature vectors include:

[0037] t i Prior probabilities; and / or,

[0038] t j Prior probabilities; and / or,

[0039] Event pair (t) i , t j The probability of occurrence; and / or,

[0040] t i With t j Mean time difference; and / or,

[0041] Event pair (t) i , t j In ), t iwith t j The number of hops between corresponding nodes is counted.

[0042] wherein t i is a potential cause event, t j is an alarm event;

[0043] Step S42: Assemble the feature vectors of all event pairs into a feature matrix X.

[0044] Step S43: Input the feature matrix X into a graph neural network model to obtain a probability value of the potential cause event causing the alarm event to occur.

[0045] Further, the method further comprises a step B1 after the step S43 and before the step S5.

[0046] Step B1: Compress the probability value of the potential cause event causing the alarm event to occur to between 0 and 1 using a Sigmoid function, and the specific formula is as follows:

[0047]

[0048] wherein,

[0049] β represents the probability value of the potential cause event causing the alarm event to occur;

[0050] σ(β) represents the potential cause event causing the alarm event to occur probability value compressed to between 0 and 1.

[0051] Further, the method further comprises a step C0 before the step S43.

[0052] Step C0: Construct a graph neural network model.

[0053] The step C0 specifically comprises the following steps:

[0054] Step C1: Obtain an encoded graph; the encoded graph is an encoded training data set graph; the training data set graph includes a training topology graph and a training causal graph.

[0055] Step C2: Obtain an encoded hidden state vector according to the encoded graph.

[0056] h γ =f(γ,X γ );

[0057] wherein γ represents the encoded graph, X γ is a matrix composed of nodes in γ, f() is an encoding function, and h γ is an encoded hidden state vector.

[0058] Step C3: Node message propagation according to the encoding graph and the encoded hidden state vector;

[0059] Nth node message propagation The calculation formula is as follows:

[0060]

[0061] Wherein,

[0062] N represents the node of the training topology graph, and N is a natural number greater than 1;

[0063] O represents the node of the training causal graph, and O is a natural number greater than 1;

[0064] U() represents an update function;

[0065] M() represents a message propagation function;

[0066] C(N) is a set of adjacent nodes of node N;

[0067] P is the number of time slices;

[0068] represents the feature corresponding to node N,

[0069]

[0070] represents the feature corresponding to node O,

[0071]

[0072] Step C4: Summarize all node message propagation to obtain a network neural network model

[0073]

[0074] Wherein, N T is all time periods, and G T is a set including all encoding graphs;

[0075] R() function is a summary function.

[0076] In a second aspect, the present application provides a network device alarm causal relationship inference device based on a graph neural network, the device comprises:

[0077] An acquisition unit is configured to acquire alarm event log data; the alarm event log data comprises an alarm event, an alarm occurrence time, and an alarm associated device;

[0078] The first processing unit is connected with the acquisition unit, and is configured to divide the alarm events into corresponding time slices according to alarm occurrence times;

[0079] The conversion unit is connected with the first processing unit, and is configured to convert the alarm events into alarm event graph structure data according to the time slices;

[0080] The alarm event graph structure data comprises an alarm topology graph and a causal relationship graph; the alarm topology graph comprises first nodes and first edges, the first nodes are all alarm-related devices, and the first edges are bidirectional connection relationships between the alarm-related devices; the causal relationship graph comprises second nodes and second edges, the second nodes are all alarm events, and the second edges are one-way connection relationships between potential cause events and the alarm events;

[0081] The potential cause event is a fact, a situation or an action that may cause the alarm event to occur;

[0082] The second processing unit is connected with the conversion unit, and is configured to input the alarm topology graph and the causal relationship graph into a graph neural network to obtain a probability value of the potential cause event causing the alarm event to occur;

[0083] The determination unit is connected with the second processing unit, and is configured to determine whether the potential cause event is a real cause event according to the probability value.

[0084] Further, the first processing unit comprises:

[0085] The first processing module is configured to determine a time slice interval of the alarm events;

[0086] The calculation module is connected with the first processing module, and is configured to calculate the time slice corresponding to the alarm event according to the alarm occurrence time and the determined time slice interval;

[0087]

[0088] Wherein, is a floor function;

[0089] T is the time slice corresponding to the alarm event;

[0090] D1 is the time slice interval;

[0091] t1 is the alarm occurrence time;

[0092] The second processing module is connected with the calculation module, and is configured to divide the alarm event into the corresponding time slice.

[0093] Further, the second processing unit comprises:

[0094] The construction module is used to construct feature vectors for the alarm topology graph and the cause-effect graph; the feature vectors include:

[0095] t i Prior probabilities; and / or,

[0096] t j Prior probabilities; and / or,

[0097] Event pair (t) i , t j The probability of occurrence; and / or,

[0098] t i With t j Mean time difference; and / or,

[0099] Event pair (t) i , t j In ), t i With t j hop count between corresponding nodes;

[0100] Among them, t i For potential causal events, t j For alarm events;

[0101] A component module, connected to the construction module, is used to assemble the feature vectors of all event pairs into a feature matrix X;

[0102] The input module, connected to the component module, is used to input the feature matrix X into the graph neural network model to obtain the probability value of the alarm event caused by the potential cause event.

[0103] The beneficial effects of this invention are:

[0104] 1. This invention learns network topology and event propagation patterns through a graph neural network model, which can more accurately infer the causal relationship between network device alarms, thereby improving the accuracy and efficiency of causal relationship inference.

[0105] 2. This invention can comprehensively consider the correlation and topology information between events, which helps to accurately capture the causal relationship between network device alarms.

[0106] 3. This invention can integrate alarm event logs, topology information, and causal relationships to comprehensively analyze the relationships between events, thereby improving the accuracy and comprehensiveness of inferences.

[0107] 4. This invention can adapt to changes in the network environment and the uncertainty of alarm events, which helps to improve the efficiency of causal relationship inference.

[0108] 5. The application is based on a graph neural network, which analyzes from a global perspective, helps to mine the correlation and causality between events, has better interpretability, and helps to understand the process and results of network device alarm causality inference. BRIEF DESCRIPTION OF DRAWINGS

[0109] Figure 1 A network device alarm causality inference flowchart in an embodiment of the application is shown.

[0110] Figure 2 A network device alarm causality inference method in an embodiment of the application is shown.

[0111] Figure 3 A topology diagram in an embodiment of the application is shown.

[0112] Figure 4 A diagram showing the connection between a causal graph and a topology graph through an event list in an embodiment of the application is shown.

[0113] Figure 5 A network device alarm causality inference device in an embodiment of the application is shown.

[0114] Among them, the reference signs: 10, acquisition unit, 20, first processing unit, 30, conversion unit, 40, second processing unit, 50, determination unit. DETAILED DESCRIPTION

[0115] In order for those skilled in the art to better understand the technical solutions of the present application, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0116] It can be understood that the specific embodiments and drawings described herein are only used to explain the present application, but not to limit the present application.

[0117] It can be understood that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0118] It can be understood that, for the convenience of description, only the parts related to the present application are shown in the drawings of the present application, and the parts unrelated to the present application are not shown in the drawings.

[0119] It can be understood that each unit and module involved in the embodiments of the present application can correspond to only one entity structure, or can be composed of multiple entity structures, or multiple units and modules can be integrated into one entity structure.

[0120] It can be understood that the functions and steps marked in the flowcharts and block diagrams of the present application can occur in an order different from that marked in the drawings without conflict.

[0121] It can be understood that the flowcharts and block diagrams of the present application show the architecture, functions and operations of possible implementations of the systems, devices, apparatuses, methods according to the embodiments of the present application. Each block in the flowchart or block diagram can represent a unit, module, program segment, code, which contains executable instructions for implementing the specified functions. Moreover, each block or combination of blocks in the block diagram and flowchart can be implemented by a hardware-based system for implementing the specified functions, or by a combination of hardware and computer instructions.

[0122] It can be understood that the units and modules involved in the embodiments of the present application can be implemented by software or by hardware, for example, the units and modules can be located in a processor.

[0123] Embodiment 1:

[0124] As shown in the embodiment, a network device alarm causal relationship inference method based on a graph neural network is provided, and the method comprises the following steps: Figure 2

[0125] Step S1: acquiring alarm event log data; the alarm event log data comprises an alarm event, an alarm occurrence time and an alarm associated device.

[0126] Step S2: dividing the alarm event into a corresponding time slice according to the alarm occurrence time.

[0127] Step S2 specifically comprises the following steps:

[0128] Step S21: determining a time slice interval of the alarm event;

[0129] Step S22: calculating a time slice corresponding to the alarm event according to the alarm occurrence time and the determined time slice interval.

[0130]

[0131] wherein, is a floor function;

[0132] T is the time slice corresponding to the alarm event;

[0133] D1 is the time slice interval;

[0134] t1 is the alarm occurrence time;

[0135] Step S23: dividing the alarm event into a corresponding time slice.

[0136] As a specific implementation, the method further comprises step A1 after step S1 and before step S2.

[0137] ​Step A1: data preprocessing is performed on the alarm event log data;

[0138] The data preprocessing includes cleaning processing or formatting processing.

[0139] Step S3: converting the alarm events into alarm event graph structure data according to time slices.

[0140] The alarm event graph structure data includes an alarm topology graph and a causal relationship graph; the alarm topology graph includes first nodes and first edges, the first nodes are all alarm-related devices, and the first edges are bidirectional connection relationships between the alarm-related devices; the causal relationship graph includes second nodes and second edges, the second nodes are all alarm events, and the second edges are one-way connection relationships between potential cause events and alarm events.

[0141] The potential cause event is a fact, situation or behavior that may cause the alarm event to occur.

[0142] Step S4: inputting the alarm topology graph and the causal relationship graph into a graph neural network to obtain a probability value of the potential cause event causing the alarm event to occur

[0143] The step S4 specifically includes the following steps:

[0144] Step S41: constructing a feature vector of the alarm topology graph and the causal relationship graph; the feature vector includes:

[0145] t i prior probability; and / or,

[0146] t j prior probability; and / or,

[0147] Probability of occurrence of event pair (t i , t j ); and / or,

[0148] Mean of time difference between t i and t j ; and / or,

[0149] Statistics of hop count between corresponding nodes of t i and t j in event pair (t i , t j );

[0150] Wherein, t i is a potential cause event, and t j is an alarm event.

[0151] Step S42: all feature vectors are combined into a feature matrix X;

[0152] Step S43: input the feature matrix X into the graph neural network model to obtain a probability value of the potential cause event leading to the alarm event.

[0153] As a specific implementation, after the step S43 and before the step S5, the method further includes a step B1.

[0154] Step B1: compress the probability value of the potential cause event leading to the alarm event to between 0 and 1 by using a Sigmoid function, and the specific formula is as follows:

[0155]

[0156] wherein,

[0157] β represents the probability value of the potential cause event leading to the alarm event;

[0158] σ(β) represents the probability value of the potential cause event leading to the alarm event compressed to between 0 and 1.

[0159] As a specific implementation, before the step S43, the method further includes a step C0.

[0160] Step C0: constructing a graph neural network model;

[0161] The step C0 specifically includes the following steps:

[0162] Step C1: obtaining an encoded graph; the encoded graph is an encoded training data set graph; the training data set graph includes a training topology graph and a training causal graph;

[0163] Step C2: obtaining an encoded hidden state vector according to the encoded graph;

[0164] h γ = f(γ, X γ );

[0165] wherein, γ represents the encoded graph, X γ is a matrix composed of nodes in γ, f() is an encoding function, and h γ is the encoded hidden state vector;

[0166] Step C3: performing node message propagation according to the encoded graph and the encoded hidden state vector;

[0167] The calculation formula of the Nth node message propagation is as follows:

[0168]

[0169] wherein,

[0170] N represents the nodes of the training topological graph, N is a natural number greater than 1;

[0171] O represents the nodes of the training causal graph, O is a natural number greater than 1;

[0172] U() represents an update function;

[0173] M() represents a message propagation function;

[0174] C(N) is the set of adjacent nodes of node N;

[0175] P is the number of time slices;

[0176] represents the features corresponding to node N,

[0177]

[0178] represents the features corresponding to node O,

[0179]

[0180] Step C4: aggregate all node message propagation to obtain a network neural network model

[0181]

[0182] wherein, N T is all time periods, G T is a set including all encoding graphs;

[0183] R() function is an aggregation function.

[0184] Step S5: determine whether the potential cause event is the true cause of the alarm event:

[0185] If the probability value of the potential cause event leading to the occurrence of the alarm event is greater than or equal to the preset threshold value, it is determined that the potential cause event is the true cause of the alarm event, thereby obtaining a network device alarm causal relationship based on a graph neural network.

[0186] The implementation process of the embodiment is shown in Figure 1 , mainly including the following steps:

[0187] First, device alarm information collection and data preprocessing are performed. In this step, the system will collect relevant alarm information from network devices in real time, such as device failure, performance degradation, etc. The collected raw data may contain noise, repetition or irrelevant information, so it needs to be cleaned, formatted and other preprocessing operations to ensure the quality and consistency of the data.

[0188] Next, the topological structure and causal relationship involved in the problem are modeled according to the graph structure. In this step, we abstract the network devices and their connection relationships into a graph structure, where the nodes represent the devices and the edges represent the connection relationships. At the same time, we also represent the alarm events and their causal relationships as a graph structure for subsequent graph neural network processing.

[0189] Then, according to the modeling target, a feature vector is constructed for each event pair. The feature vector is an important tool for describing the attributes of the event pair, which can help the graph neural network better understand and learn the relationship between the event pairs. We will construct a suitable feature vector for each event pair according to actual needs, such as event type, occurrence time, device information, etc.

[0190] On this basis, a graph neural network model is constructed, and the model is trained using the training set. Graph neural network is a deep learning technology specially designed for processing graph structure data, which can effectively learn and mine complex patterns in graph structure. We will design a suitable graph neural network model and train it with labeled training data, so that it can accurately infer the causal relationship between alarm events.

[0191] Finally, the trained model is deployed for inference service. Once the model training is completed and the expected effect is achieved, we can deploy it to the actual environment to provide real-time alarm causal graph inference service. When new alarm events occur, the system can automatically use the trained model for inference to quickly and accurately find out the root cause of the problem, thereby speeding up the solution of the fault and the recovery of the network.

[0192] The implementation process of this embodiment includes data collection and preprocessing, graph structure modeling, feature vector construction, graph neural network modeling, and model inference service deployment. The detailed process of each specific step is described below.

[0193] (I) Data collection and preprocessing

[0194] The data involved in this embodiment includes the following:

[0195] (1) Topological structure relationship of network devices.

[0196] The topological structure data of network devices mainly includes the connection information between different devices. This kind of data can be organized into an adjacency list (Adjacency List), denoted as AL=[al (i,j) ] m×2 . Among them, AL contains m rows and 2 columns, and each row represents a connection relationship. The first column and the second column of each row are the IDs of the two connected devices.

[0197] (2) Event log data.

[0198] Event log data contains information such as the event ID, event type, event occurrence time, and the corresponding device number. This type of data can be organized into an event list (EL). The event types are enumerable, and the set of these types is denoted as T.

[0199] (II) Graph Structure Modeling

[0200] Graph structure modeling mainly involves the following two types of graphs:

[0201] (1) Network topology diagram.

[0202] A network topology graph is a graph representation of the topological relationships between network devices, denoted as G. T =(N T E T ), where N T G represents T A set of nodes, i.e., different network devices, E T G represents T The set of edges in the graph can be obtained through the algorithm (AL). Since the topological connections between network devices are not directional, this graph is undirected. Figure 3 This is an example of a network topology diagram.

[0203] (2) Cause-and-effect diagram between events

[0204] A cause-effect graph is a graph consisting of causal relationships between different types of events, denoted as G. C =(N C A C ), where N C G represents C The set of nodes in G, i.e., the distinct elements in event type T. C Using an adjacency matrix, i.e., A C Describe the edges within this context. Assume there are l types of events under consideration, i.e., T = {t1, t2, ..., t3}. l}, then A C Let A be an l×l square matrix, and A C (i,j) = 1 if and only if t i Cause t j If true, then A C (i,j)=0.

[0205] The problem of network alarm causality graph inference is actually to solve G C with known data (i.e., AL, EL)

[0206] In the solving process, G C needs to be estimated, so G is used to represent the model's estimate of G C .

[0207] (3) Relationship between topological graph and causal graph

[0208] The nodes of the topological graph are network devices, and the edges are the topological connection relationships between devices. For example, if there is an edge T in the topological graph G , it indicates that there is a physical connection between device A and device B. The connection between devices is bidirectional.

[0209] The nodes of the causal graph are different event types, and the edges are the causing relationships between event types. If there is an edge C in the causal graph G , it indicates that an event of type t1 can cause an event of type t2. That is, the potential cause event is t1, the alarm event is t2, and the connection between t1 and t2 is unidirectional, only from t1 to t2. The causal graph is connected to the topological graph through event occurrence.

[0210] For a certain event e, three dimensions are needed to describe it. That is, the type of the event, the time of the event occurrence, and the device corresponding to the event. Among them, the device corresponding to the event is a node in the topological graph G T , and the type of the event is a node in the causal graph G C .

[0211] When traversing the event list, each event corresponds to a node in the topological graph G T , and also corresponds to the causal graph G C . The event list is like a bridge that indirectly connects the topological graph G T and the causal graph G C . Figure 4 An example of the relationship between the causal graph and the topological graph is shown.

[0212] (4) Learning process of causal graph:

[0213] Learning the causal graph is the ultimate goal of the entire causal inference task. From the perspective of mathematical models, to determine a graph, there are mainly two steps, the first step is to determine which nodes this graph contains, and the second step is to determine which nodes have edges between them and which nodes do not have edges.

[0214] The process of learning the causal graph is similar:

[0215] Since the event list data is known, all the nodes in the causal graph can be determined by traversing the event types contained in the event list. For example, take the causal graph in Figure 3 as an example. If an event list contains 4 event types, the corresponding causal graph contains 4 nodes.

[0216] Then, traverse the possible edges between these nodes, such as: event type I→event type II, event type I→event type III, etc.

[0217] Since the causal graph is a directed graph, the total number of possible edges between them is the permutation number of 4 taken 2 at a time, that is, 4! / 2! = 12.

[0218] Now it is necessary to use the classification algorithm to judge the probability of each possible edge being true, and then to retain the probabilities greater than 0.5 to obtain the predicted edge set.

[0219] (Three) Feature vector construction

[0220] In order to estimate each element in A C , it is only necessary to judge whether “t i leads to t j ” is true for all event pairs (take <t i ,t j > as an example). Therefore, the corresponding feature vector needs to be extracted for the event pair, and the feature vector corresponding to <t i ,t j > is denoted as x i→j , and the matrix composed of all feature vectors is denoted as X. x i→j contains information including but not limited to:

[0221] The proportion of events of type t i in the total number of events. Basic statistics, prior probability of corresponding event type t i .

[0222] The proportion of events of type t j in the total number of events. Basic statistics, prior probability of corresponding event type t j .

[0223] The proportion of the total number of event pairs <t i ,t j > in the total number of all event pairs. Basic statistics, prior probability of corresponding event pair <t i ,t j .

[0224] The first three items are combined. If the number of times two types of events occur is small, but the number of times the combination of the two occurs is relatively large, the degree of association between the two is high, and the probability of the existence of an edge between the two is also higher.

[0225] In all <t i , t j > event pairs, the average time that t i occurs in advance of the time that t j occurs. If the events between the two events are very close, and event t i always occurs in advance of event t j , then there is a higher probability of an edge from t i to t j .

[0226] In all <t i , t j > event pairs, the number of times the hop count between t i and t j corresponding nodes is 0.

[0227] In all <t i , t j > event pairs, the number of times the hop count between t i and t j corresponding nodes is 1.

[0228] In all <t i , t j > event pairs, the number of times the hop count between t i and t j corresponding nodes is 2.

[0229] The last three items are combined: If the locations of the two events are closer in the topology graph, the degree of association between the two is higher, i.e. the possibility of the existence of an edge between the two is higher.

[0230] (Four) Graph neural network modeling

[0231] Relying only on feature vectors cannot use the topology structure of the entire network device topology graph as input to the prediction model, so it will have some impact on the accuracy of the model. In order to solve this problem, graph neural network technology needs to be used to process the topology structure of the network device, and extract the hidden state vector represented by the graph structure as a supplement to the feature vector.

[0232] Graph representation learning is an important means of graph neural networks. In graph representation learning, in addition to encoding each node of the graph, the entire graph structure can also be encoded through an aggregation function. This process can be represented as: h G=f(G,X) G ), where G is the encoded graph, X G Let f be the matrix composed of the features of the nodes in G, f be the encoding function, and h be the matrix composed of the features of the nodes in G. G This is the encoded hidden state.

[0233] Because the model is for each event pair (in terms of...) <t i ,t j For example, predictions are made using the network device topology graph G, therefore, for different event pairs, although the encoded graph is the network device topology graph G... T And their adjacency matrices are all the same, but However, they are different. Let node N be G. T For any node in the sequence, the sequence of events associated with node N can be recorded as follows:<e1,e2,...> To simplify processing, the timeline was divided into specific time slices, and the events falling within each time slice were statistically analyzed. Assuming the number of time slices is P, then the features corresponding to node N... Each time slice corresponds to It is represented as three 0-1 vectors. The first vector represents t. i Whether it occurs within that time slice, the second vector represents t. j Whether it occurs within that time slice, the third vector indicates whether it is excluding t. i t j Other events besides those occurring during this time slice. This is achieved by comparing different nodes... By piecing them together, we can obtain the corresponding image.

[0234] In the graph structure representation learning stage, it is necessary to... Mapping onto a vector, denoted as This process requires two steps: first, message propagation between nodes; and second, aggregation and output. The message propagation phase can be represented as:

[0235]

[0236] U and M represent the update function and the message passing function, respectively. A two-layer fully connected neural network is usually used as the specific implementation. C(N) represents the context of node N, which is the set of neighboring nodes of N, so as to know the position and association of node N in the network.

[0237] The summary output stage can be represented as:

[0238]

[0239] To complete the final classification, we need to build a model to estimate A C (i,j) and denote the estimate as A C (i,j). And use cross-entropy as the loss function to train the model.

[0240] When all A (i,j) are estimated, we can get the estimate of the entire G C , that is A

[0241] Assume that the topology of the device is as shown in Figure 3 , consider the following list of events:

[0242] Event ID Time of occurrence Associated device Event type 1 3 A Ⅰ 2 10 B Ⅲ 3 16 C Ⅰ 4 24 A Ⅱ 5 31 D Ⅲ ... ... ... ...

[0243] Assume that we now need to predict whether the edge between event type I and event type II exists.

[0244] First, in the data preprocessing stage, in terms of event occurrence time, in order to reduce dimensionality, the entire time axis needs to be divided into time slices. That is, [0,10), [10,20), [20,30),... correspond to event piece IDs 0, 1, 2,..., for example, the event with event ID 1 occurs at time 3, and the corresponding time slice ID is 0.

[0245] Since these events all occur on the topology, we need to build corresponding graph features based on the topology. In the training process of graph neural networks, if a graph is to be used as input to the graph neural network, not only the topology of the graph needs to be included, but also the features attached to each node of the graph.

[0246] When predicting whether an edge exists between event type I and event type II, we need to attach corresponding features to each node in the topology. That is, we need to build a feature for devices A, B, C, D, and E. For device A, the corresponding feature is:

[0247]

[0248] The number of rows of the feature is 3, and the number of columns is equal to the number of time slices. In matrix X (设备A,<事件类型Ⅰ,事件类型Ⅱ>) , the first row and the first column are 1, indicating that event type I occurred on device A at the 0th time slice. The second row and the first column are 0, indicating that event type II did not occur on device A at the 0th time slice. The third row and the first column are 0, indicating that any event other than event type I and event type II did not occur on device A at the 0th time slice. Similarly, we can obtain the value of any element in X (设备A,<事件类型Ⅰ,事件类型Ⅱ>) .

[0249] Again traverse 5 devices, can obtain X (设备A,<事件类型Ⅰ,事件类型Ⅱ>) , X (设备B,<事件类型Ⅰ,事件类型Ⅱ>) , X (设备C,<事件类型Ⅰ,事件类型Ⅱ>) , X (设备D,<事件类型Ⅰ,事件类型Ⅱ>) , X (设备E,<事件类型Ⅰ,事件类型Ⅱ>) Again these matrixes are spliced into a tensor, that is the attribute tensor X attached to each node in the figure G .

[0250] With the graph structure and the attribute tensor attached to each node, a graph can be mapped to a vector through a graph encoding function, and this vector is the representation of the graph. Again, connect a fully connected network and a Sigmoid function to this representation vector, which can be used to predict whether the edge between event type I and event type II exists: if the value of the Sigmoid function is greater than 0.5, the edge exists, otherwise, it does not exist. Connect a fully connected layer after the hidden layer, and use the Sigmoid function as the activation function of the output layer to map the output of the hidden layer to 0 to 1, representing the existence probability of the edge. Then, according to the output value of the Sigmoid function, the existence of the edge is predicted.

[0251] (Five) Model inference service deployment

[0252] When the model training is completed, the model file can be placed on the server in the production environment, and the inference function of the model can be provided as a service to the outside. In addition, combined with data visualization and other capabilities, the final result of model inference can be visualized to facilitate user understanding of the result. Through web applications or API interfaces, users can interact with the deployed model, submit data and obtain the predicted results of the model.

[0253] Finally, for the specific implementation process of the entire method, the following examples are given:

[0254] 1. For the device scene, the connection relationship between devices is constructed into a topological relationship graph.

[0255] 2. Collect the event list, which contains several rows and 4 columns.

[0256] Event ID Time of occurrence Associated device Event type 1 3 A Ⅰ 2 10 B Ⅲ 3 16 C Ⅰ 4 24 A Ⅱ 5 31 D Ⅲ ... ... ... ...

[0257] 3. Preprocess the data, and divide the time axis according to the time slice. Map each time point to the corresponding time slice ID.

[0258] 4. Obtain all event types through the event list. Arrange different event types two by two, for example, when the event type is 4, the corresponding is the number of permutations of 4 choose 2. We want to build a prediction model for each permutation.

[0259] 5. Extract feature vector for event type pair.

[0260] 6. Get graph structure data representation for event type pair. The representation is also a vector.

[0261] 7. Concatenate the two feature vectors (event type feature vector and graph structure data representation vector, obtained in the previous two steps), and use a fully connected layer and a Sigmoid layer to map all features to a probability value between 0 and 1.

[0262] 8. If the probability value is greater than 0.5, the corresponding edge exists, otherwise it does not exist.

[0263] 9. Combine the remaining edges and the corresponding nodes of the event type nodes to obtain the causal graph.

[0264] 10. Train the model, obtain the model file, deploy the model file, and provide inference services to the outside.

[0265] Embodiment 2:

[0266] As shown in Figure 5 The embodiment provides a network device alarm causal relationship inference device based on a graph neural network, which comprises:

[0267] An acquisition unit 10 is configured to acquire alarm event log data; the alarm event log data comprises alarm events, alarm occurrence times, and alarm associated devices;

[0268] A first processing unit 20 is connected with the acquisition unit 10 and is configured to divide the alarm events into corresponding time slices according to the alarm occurrence times;

[0269] A conversion unit 30 is connected with the first processing unit 20 and is configured to convert the alarm events into alarm event graph structure data according to the time slices;

[0270] The alarm event graph structure data comprises an alarm topology graph and a causal relationship graph; the alarm topology graph comprises first nodes and first edges, the first nodes are all alarm associated devices, and the first edges are bidirectional connection relationships between the alarm associated devices; the causal relationship graph comprises second nodes and second edges, the second nodes are all alarm events, and the second edges are unidirectional connection relationships between potential cause events and alarm events;

[0271] The potential cause event is a fact, situation, or behavior that may cause the alarm event to occur;

[0272] A second processing unit 40 is connected with the conversion unit 30 and is configured to input the alarm topology graph and the causal relationship graph into a graph neural network to obtain a probability value of the potential cause event causing the alarm event to occur.

[0273] The determination unit 50 is connected with the second processing unit 40, and is configured to determine whether the potential cause event is a real cause event according to the probability value.

[0274] If the probability value of the potential cause event causing the alarm event is greater than or equal to a preset threshold value, it is determined that the potential cause event is a real cause event of the alarm event, so as to obtain the network device alarm causal relationship based on the graph neural network.

[0275] As a specific implementation, the first processing unit 20 comprises:

[0276] The first processing module is configured to determine a time slice interval of the alarm event.

[0277] The calculation module is connected with the first processing module, and is configured to calculate a time slice corresponding to the alarm event according to the alarm occurrence time and the determined time slice interval.

[0278]

[0279] Wherein, is a floor function;

[0280] T is the time slice corresponding to the alarm event;

[0281] D1 is the time slice interval;

[0282] t1 is the alarm occurrence time;

[0283] The second processing module is connected with the calculation module, and is configured to divide the alarm event into the corresponding time slice.

[0284] As a specific implementation, the second processing unit 40 comprises:

[0285] The construction module is configured to construct a feature vector of the alarm topology graph and the causal relationship graph; the feature vector comprises:

[0286] Prior probability of t i ; and / or,

[0287] Prior probability of t j ; and / or,

[0288] Probability of occurrence of event pair (t i , t j ); and / or,

[0289] Mean of time difference between t i and t j ; and / or,

[0290] Probability of occurrence of event pair (t i , tj ) in which t i corresponds to t j the number of hops between corresponding nodes is counted;

[0291] wherein t i is a potential cause event, t j is an alarm event;

[0292] a component module, connected with the construction module, for composing feature vectors of all event pairs into a feature matrix X;

[0293] an input module, connected with the component module, for inputting the feature matrix X into a graph neural network model to obtain a probability value of a potential cause event causing an alarm event to occur.

[0294] It can be understood that the above embodiments are only exemplary embodiments adopted for illustrating the principles of the present application, and the present application is not limited thereto. Various modifications and improvements can be made by those of ordinary skill in the art without departing from the spirit and essence of the present application, and these modifications and improvements are also considered to be within the protection scope of the present application.

Claims

1. A network device alarm causal relationship inference method based on a graph neural network, characterized in that, The method comprises the following steps: Step S1: acquiring alarm event log data; the alarm event log data comprises alarm events, alarm occurrence times, and alarm associated devices; Step S2: dividing the alarm events into corresponding time slices according to the alarm occurrence times; Step S3: converting the alarm events into alarm event graph structure data according to the time slices; The alarm event graph structure data comprises an alarm topology graph and a causal relationship graph; the alarm topology graph comprises first nodes and first edges, the first nodes are all the alarm associated devices, and the first edges are bidirectional connection relationships between the alarm associated devices; the causal relationship graph comprises second nodes and second edges, the second nodes are all the alarm events, and the second edges are one-way connection relationships between potential cause events and the alarm events; The potential cause event is a fact, a situation, or an action that may cause the alarm event to occur; Step S4: inputting the alarm topology graph and the causal relationship graph into a graph neural network to obtain a probability value of the potential cause event causing the alarm event to occur; Step S5: determining whether the potential cause event is a real cause event according to the probability value.

2. The network device alarm causal relationship inference method based on a graph neural network according to claim 1, characterized in that: The step S2 specifically comprises the following steps: Step S21: determining a time slice interval of the alarm events; Step S22: calculating the time slice corresponding to the alarm events according to the alarm occurrence times and the determined time slice interval; wherein floor function; T is the time slice corresponding to the alarm events; D1 is the time slice interval; t1 is the alarm occurrence time; Step S23: dividing the alarm events into the corresponding time slices.

3. The network device alarm causal relationship inference method based on a graph neural network according to claim 1, characterized in that: The alarm events comprise a single alarm event and / or a certain alarm event type; The potential cause event in the step S4 is a single event that may cause the single alarm event to occur and / or a certain event type that may cause the certain alarm event type to occur; The step S5 specifically comprises: Comparing the probability value of the potential cause event causing the alarm event to occur with a preset threshold value: if the probability value is greater than or equal to the preset threshold value, it is determined that the potential cause event is a real cause event that causes the alarm event to occur.

4. The network device alarm causal relationship inference method based on a graph neural network according to claim 1, characterized in that: After the step S1 and before the step S2, the method further comprises a step A1; Step A1: performing data preprocessing on the alarm event log data; The data preprocessing comprises cleaning processing or formatting processing.

5. The network device alarm causal relationship inference method based on a graph neural network according to any one of claims 1 to 4, characterized in that: The step S4 specifically comprises the following steps: Step S41: constructing feature vectors of the alarm topology graph and the causal relationship graph; the feature vectors comprise: t i prior probabilities; and / or, t j prior probabilities; and / or, the probability of the occurrence of an event pair (t i , t j ); and / or, t i the time difference mean of t j the time difference mean of t Event pair (t i , t j ) in which t i and t j correspond to the number of hops between the nodes wherein t i is a potential cause event, t j is an alarm event; Step S42: grouping all the feature vectors into a feature matrix X; Step S43: input the feature matrix X into the graph neural network model to obtain a probability value of a potential cause event leading to an alarm event.

6. The network device alarm causal relationship inference method based on a graph neural network according to claim 5, wherein, after the step S43 and before the step S5, the method further comprises a step B1; Step B1: compress the probability value of a potential cause event leading to an alarm event to between 0 and 1 by using a Sigmoid function, and the specific formula is as follows: wherein, β represents the probability value of a potential cause event leading to an alarm event; σ(β) represents the probability value of a potential cause event leading to an alarm event compressed to between 0 and 1.

7. The network device alarm causal relationship inference method based on a graph neural network according to claim 5, wherein, before the step S43, the method further comprises a step C0: Step C0: constructing a graph neural network model; the step C0 specifically comprises the following steps: Step C1: obtaining an encoded graph; the encoded graph is an encoded training data set graph; the training data set graph comprises a training topology graph and a training causal graph; Step C2: obtaining an encoded hidden state vector according to the encoded graph; h γ = f(y, X γ ); where γ denotes the encoding graph, X γ is a matrix of nodes in γ, f() is an encoding function, h γ is the encoded hidden state vector; Step C3: performing node message propagation according to the encoded graph and the encoded hidden state vector; Nth node message propagation The formula for calculating this is as follows: wherein, N represents a node of the training topology graph, and N is a natural number greater than 1; O represents a node of the training causal graph, and O is a natural number greater than 1; U() represents an update function; M() represents a message propagation function; C(N) is a set of adjacent nodes of node N; P is the number of time slices; representing a feature corresponding to the node N, represents a feature corresponding to the node O, Step C4: aggregate all the node message propagations to get the net neural network model where N T is all time periods, G T is the set of all coded graphs; R() is an aggregation function.

8. A network device alarm causal relationship inference apparatus based on a graph neural network, comprising: an acquisition unit configured to acquire alarm event log data; the alarm event log data comprises alarm events, alarm occurrence times, and alarm associated devices; a first processing unit connected to the acquisition unit and configured to divide the alarm events into corresponding time slices according to the alarm occurrence times; a conversion unit connected to the first processing unit and configured to convert the alarm events into alarm event graph structure data according to the time slices; the alarm event graph structure data comprises an alarm topology graph and a causal relationship graph; the alarm topology graph comprises first nodes and first edges, the first nodes are all the alarm associated devices, and the first edges are bidirectional connection relationships between the alarm associated devices; the causal relationship graph comprises second nodes and second edges, the second nodes are all the alarm events, and the second edges are one-way connection relationships between potential cause events and the alarm events; wherein, the potential cause events are facts, situations, or behaviors that may lead to the alarm events; a second processing unit connected to the conversion unit and configured to input the alarm topology graph and the causal relationship graph into a graph neural network to obtain a probability value of the potential cause events leading to the alarm events; a determination unit connected to the second processing unit and configured to determine whether the potential cause events are real cause events according to the probability value. ​ 9. The graph neural network-based network device alarm causal relationship inference apparatus according to claim 8, characterized in that, the first processing unit comprises: a first processing module configured to determine a time slice interval of an alarm event; a calculation module connected to the first processing module and configured to calculate a time slice corresponding to the alarm event according to an alarm occurrence time and the determined time slice interval; wherein floor function; T is the time slice corresponding to the alarm event; D1 is the time slice interval; t1 is the alarm occurrence time; a second processing module connected to the calculation module and configured to divide the alarm event into the corresponding time slice.

10. The graph neural network-based network device alarm causal relationship inference apparatus according to claim 8 or 9, characterized in that, the second processing unit comprises: a construction module configured to construct feature vectors of an alarm topology graph and a causal relationship graph; the feature vectors comprise: t i prior probabilities; and / or, t j the prior probability of P(Y = y | X = x); and / or, the probability of the occurrence of an event pair (t i , t j ); and / or, t i the time difference mean of t j the time difference mean of t Event pair (t i , t j ) in which t i and t j correspond to the nodes between which the number of hops is counted; wherein t i is a potential cause event, t j is an alarm event; a component module connected to the construction module and configured to compose feature vectors of all event pairs into a feature matrix X; an input module connected to the component module and configured to input the feature matrix X into a graph neural network model to obtain a probability value of a potential cause event causing the alarm event to occur.

Images