Root cause positioning method and device, equipment and storage medium

Abstract

The invention provides a root cause positioning method and device, equipment and a storage medium, and belongs to the technical field of Internet. The method comprises the steps that during root cause positioning, a time sequence heterogeneous graph is obtained, attributes of nodes in the time sequence heterogeneous graph are used, normal nodes and edges connected with the normal nodes in the time sequence heterogeneous graph are deleted, the deleted time sequence heterogeneous graph is reconstructed, an abnormal sub-graph is obtained, reachable edges exist between fault nodes and other nodes in the abnormal sub-graph, and the abnormal sub-graph is subjected to root cause positioning. And determining the root cause of the fault node in the abnormal sub-graph. By adopting the scheme of the invention, the reconstructed abnormal sub-graph not only keeps the reachability of the fault node and other nodes, but also reduces the scale of the original node and the noise caused by the normal node, so that the efficiency and accuracy of root cause positioning can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and in particular to a root cause location method, device, equipment and storage medium. Background Art

[0002] With the development of computer technology and network technology, there are dependencies between nodes in many scenarios. If a node fails, the entire business may be interrupted. For example, Internet applications are divided into multiple microservices, and there are call relationships between microservices. If a microservice fails, the entire Internet application may be unusable. After a node fails, in order to quickly restore the business, it is crucial to efficiently locate the root cause of the failure.

[0003] In the related art, when determining the root cause, a causal chain of the fault is constructed through manual annotation and manual update, and then the causal chain and a customized algorithm are used to determine the root cause. Since the causal chain is manually labeled and manually updated, the efficiency of root cause determination is low. Summary of the invention

[0004] The present disclosure provides a method, apparatus, device and storage medium for root cause location, which can improve the efficiency of root cause determination.

[0005] In a first aspect, the present disclosure provides a method for root cause location, the method comprising:

[0006] A timing heterogeneous graph is obtained, which includes nodes, edges and attributes of the nodes, wherein the nodes include an initial fault node, and based on the attributes of the node, normal nodes in the timing heterogeneous graph and edges connected to the normal nodes are deleted, and the timing heterogeneous graph after the deletion is reconstructed to obtain an abnormal subgraph, wherein there are reachable edges between the current fault node and other nodes in the abnormal subgraph, and the current fault node is obtained based on the initial fault node, and the root cause of the initial fault node is determined in the abnormal subgraph.

[0007] In the scheme shown in the present disclosure, after obtaining the time series heterogeneous graph, the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph are deleted, and the time series heterogeneous graph is reconstructed, and there are reachable edges between the current faulty node and other nodes in the obtained abnormal subgraph. Then, the root cause of the initial faulty node is determined using the abnormal subgraph. Since the reconstructed abnormal subgraph not only retains the reachability of the faulty node with other nodes, but also reduces the scale of the original node and the noise caused by the normal nodes, the efficiency and accuracy of root cause location can be improved.

[0008] In one example, before deleting the normal nodes, a new faulty node is selected from the neighboring nodes of the initial faulty node, and the new faulty node is used for traversal to obtain the nodes and edges on which the new faulty node depends, and the timing heterogeneous graph is updated based on the obtained nodes and edges, so that the scale of the updated timing heterogeneous graph is relatively small, reducing the search space for the root cause.

[0009] In one example, before selecting a new fault node from the neighboring nodes of the initial fault node, if it is determined that the initial fault node is not an abnormal node, the new fault node is determined as the current fault node, and the current fault node is subsequently used to determine the root cause of the current fault node in the abnormal subgraph, and the root cause of the current fault node is determined as the root cause of the initial fault node. In this way, if the initial fault node is not an abnormal node, there is no alarm information for the initial fault node, so that the determined root cause may be inaccurate. By re-determining the fault node, the accuracy of the root cause is improved.

[0010] In one example, after determining the abnormal subgraph, the topological structure and node attributes of the abnormal subgraph are used to determine the probability transfer matrix of the node failure in the abnormal subgraph, and the probability transfer matrix is ​​used to determine the random walk probability of the current faulty node to other nodes in the abnormal subgraph, and the top X nodes in the abnormal subgraph that are ranked from large to small in terms of random walk probability are determined as the root cause of the current faulty node, where X is a positive integer. In this way, the probability transfer matrix is ​​used to determine the probability of abnormal propagation between nodes, and the random walk probability is used to reflect the probability of the node being the root cause.

[0011] In one example, when determining the probability transfer matrix, based on the topological structure of the abnormal subgraph, the adjacency matrix of the abnormal subgraph is constructed, based on the attributes of the nodes in the abnormal subgraph, the characteristics of the edges in the abnormal subgraph are determined, based on the adjacency matrix, the characteristics are learned using a deep neural network algorithm to obtain the probability transfer matrix of the node failure in the abnormal subgraph. In this way, the probability of abnormal propagation between nodes is learned using a deep neural network algorithm.

[0012] In one example, since the root cause of a node may be itself, before determining the node failure probability transfer matrix, in the abnormal subgraph, a self-loop edge is added to each node so that it returns from the node to itself. In addition, in order to allow energy to flow back during the random walk, a reverse edge between nodes is added between nodes so that the energy between nodes can flow back.

[0013] In one example, when reconstructing the time series heterogeneous graph after the deletion process, the shortest path between the nodes in the time series heterogeneous graph after the deletion process is determined, and according to the shortest path, edges are added to the unconnected nodes in the time series heterogeneous graph after the deletion process to obtain the abnormal subgraph. Since the shortest path makes the nodes more compact, the amount of calculation is relatively small when the root cause is determined later.

[0014] In one example, the timing heterogeneous graph also includes the attributes of the edge. Considering that the node has time attributes, there is generally no root cause in the non-fault time window, so the timing heterogeneous graph is filtered based on the fault time window. Considering that only the nodes and edges on which the initial fault node depends will cause the fault of the fault node, the timing heterogeneous graph can also include only the nodes and edges on which the fault node depends, and the timing heterogeneous graph is further filtered, so that the scale of the timing heterogeneous graph is relatively small, the amount of calculation is reduced, and the efficiency of root cause location is improved.

[0015] In one example, based on the topological structure and the call chain between nodes, the nodes and edges of the temporal heterogeneous graph are generated, and based on the monitoring indicators, the attributes of the nodes are generated, and the monitoring indicators include one or more of alarms, performance indicators, or logs. In this way, the temporal heterogeneous graph can be automatically modeled.

[0016] In a second aspect, the present disclosure provides a root cause location device, the device comprising at least one module, the at least one module being used to implement the root cause location method provided by the first aspect or any one of the examples in the first aspect.

[0017] In some embodiments, the modules in the root cause location device are implemented by software, and the modules in the root cause location device are program modules. In other embodiments, the modules in the root cause location device are implemented by hardware or firmware.

[0018] In a third aspect, the present disclosure provides a computing device comprising a processor and a memory, wherein the processor is used to execute instructions stored in the memory so that the computing device performs the root cause locating method provided in the first aspect or any one of the examples in the first aspect.

[0019] In a fourth aspect, the present disclosure provides a computer-readable storage medium, which includes computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the root cause locating method provided in the first aspect or any one of the examples in the first aspect.

[0020] In a fifth aspect, the present disclosure provides a computer program product comprising instructions, which, when executed by a computing device, enables the computing device to execute the root cause locating method provided in the first aspect or any one of the examples in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a schematic diagram of a timing heterogeneous graph provided by an exemplary embodiment of the present disclosure;

[0022] Figure 2 is a schematic diagram of a subgraph of a time-series heterogeneous graph provided by an exemplary embodiment of the present disclosure;

[0023] Figure 3 is a schematic diagram of a system architecture provided by an exemplary embodiment of the present disclosure;

[0024] Figure 4 is a schematic diagram of the structure of a computing device provided by an exemplary embodiment of the present disclosure;

[0025] Figure 5 is a flowchart of root cause location provided by an exemplary embodiment of the present disclosure;

[0026] Figure 6 is a schematic diagram of a method flow for root cause location provided by an exemplary embodiment of the present disclosure;

[0027] Figure 7 is a schematic diagram of sub-graph reconstruction provided by an exemplary embodiment of the present disclosure;

[0028] Figure 8 It is a schematic diagram of the structure of a root cause location device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] In order to make the objectives, technical solutions and advantages of the present disclosure more clear, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0030] Some terminology concepts involved in the embodiments of the present disclosure are explained below.

[0031] 1. Temporal heterogeneous graph

[0032] Defined as G = (ν, ε, X, Y), ν represents the node set consisting of the nodes included in the temporal heterogeneous graph, ε represents the edge set consisting of the edges between the nodes, X represents the attribute matrix of the node containing the time attribute, and Y represents the attribute matrix of the edge.

[0033] A temporally heterogeneous graph is also associated with a node type mapping function φ and an edge type mapping function association, φ is expressed as ν→τ, It is represented as ε→ρ, where τ and ρ represent the predefined node and edge type sets respectively, and the sum of the number of elements in the two sets is greater than 2. For example, see Figure 1,The time sequence heterogeneous graph of the cloud platform includes 7 types of nodes, namely application, process, database, virtual machine, cloud disk, physical machine and switch. ,The time sequence heterogeneous graph also includes rich interactions between nodes, such as virtual machines deployed on physical machines.

[0034] 2. Subgraph extraction of temporal heterogeneous graphs

[0035] Given a temporally heterogeneous graph G = (ν, ε, X, Y), a subgraph extracted from the temporally heterogeneous graph is also a temporally heterogeneous graph. For example, see Figure 2 ,exist Figure 1 In the time series heterogeneous graph shown in the figure, the part marked by the dashed box can be regarded as a subgraph of the time series heterogeneous graph. Figure 2 In , the extracted subgraph only includes one virtual machine and two cloud disks.

[0036] 3. Root cause location in time series heterogeneous graph

[0037] Given a temporal heterogeneous graph G = (ν, ε, X, Y) and a faulty node u, the goal is to learn a root cause score function f(·) such that for any node A belonging to ν, S A =f(A), and S A It can reflect the probability that node A is the root cause of the faulty node. By sorting the probabilities corresponding to all nodes, at least one of the top-ranked nodes is considered to be the root cause of the faulty node.

[0038] 4. Random walk is used to represent irregular changes. After random walk, a series of random trajectories will be generated.

[0039] The background of the present disclosure is described below.

[0040] At present, the root cause location of cloud platform failures has attracted widespread attention. For different operation and maintenance scenarios, such as storage, cloud, and wireless networks, the business domain knowledge required is often different, the operation and maintenance data that can be obtained is not unified, and the available data is often not perfect. The current root cause location method needs to be closely integrated with the business and is difficult to migrate to other scenarios. Therefore, it is necessary to provide a general root cause location framework to model and handle root cause location problems in different scenarios.

[0041] In addition, the use of microservice architecture is becoming more and more widespread, and the scale of cloud platforms is also growing rapidly. This growth includes not only the number of microservices, but also the expansion of infrastructure architecture components, such as virtual machines, physical machines (such as servers), switches, and cloud disks. Existing operation and maintenance scenarios can often be abstracted as a large-scale time-series heterogeneous graph containing multiple nodes and relationships, and the frequency of changes between objects at different levels is different. However, the existing computing framework is often very time-consuming to process large-scale graph data. For users and operation and maintenance personnel, the timeliness of root cause location is very important. Therefore, the root cause location method needs to consider both time consumption and accuracy.

[0042] Based on this, the present disclosure provides a method for root cause location, which can be abstracted as root cause location in actual operation and maintenance scenarios of time-series heterogeneous graphs, such as cloud platform scenarios. The method can be executed by a root cause location device. The device can be a hardware device, such as a computing device such as a server or a terminal, and the server can be a cloud server or a local server. The device can also be a software device, such as a set of software programs running on a hardware device.

[0043] The following introduces the system architecture provided by the embodiments of the present disclosure.

[0044] Figure 3 A schematic diagram of a system architecture is provided, which includes a database and a root cause location device. In a cloud platform scenario, the database may include a graph database and a time series database. Alarms, call chains, topological structures, and logs may be stored in the graph database, and performance indicators may be stored in the time series database. For example, these data may be stored in the database in the form of data queues. The root cause location device obtains data for constructing a time series heterogeneous graph from the database to construct the time series heterogeneous graph. Then the root cause location device performs root cause location processing. In another example of a cloud platform scenario, a time series heterogeneous graph is stored in the database, and the root cause location device obtains the time series heterogeneous graph from the database to perform root cause location processing.

[0045] In one example, see Figure 3 The system architecture also includes a training device, which is used to train and update the model, which is a root cause prediction model for root cause location. In addition, the training device also provides a query interface and a user feedback interface. The query interface is used for users to query the model training progress, etc., and the user feedback interface is used for users to confirm whether the training is completed.

[0046] In one example, see Figure 3 The system architecture also includes a monitoring module, which determines whether the model performance of the root cause positioning processing meets the requirements based on the positioning results of the root cause positioning device. If it does not meet the requirements, it notifies the training device to retrain the model.

[0047] The hardware structure of the above computing device is introduced below.

[0048] like Figure 4 As shown, the computing device 400 may be implemented by a general bus architecture. The computing device 400 includes at least one processor 401 , a communication bus 402 , a memory 403 , and at least one network interface 404 . Figure 4 The computing device of the structure shown is attached Figure 3 A device for locating root causes.

[0049] The processor 401 is, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the disclosed solution. For example, the processor 401 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0050] The communication bus 402 is used to transmit information between the above components. The communication bus 402 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0051] The memory 403 is, for example, a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 403 is, for example, independent and connected to the processor 401 via the communication bus 402. The memory 403 can also be integrated with the processor 401.

[0052] Optionally, the memory 403 is used to store the topology structure and call chain mentioned below. When the computing device 400 needs to use the topology structure and call chain, the processor 401 accesses the memory 403 to obtain the topology structure and call chain stored in the memory 403 .

[0053] The network interface 404 uses any transceiver-like device for communicating with other devices or communication networks. The network interface 404 includes a wired network interface and may also include a wireless network interface. The wired network interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless network interface may be a wireless local area network (WLAN) interface, a cellular network network interface, or a combination thereof, etc.

[0054] In a specific implementation, as an example, the processor 401 may include one or more CPUs.

[0055] In a specific implementation, as an example, the computing device 400 may include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0056] In some embodiments, the memory 403 is used to store a program code 4031 for executing the root cause location in the present disclosure, and the processor 401 executes the program code 4031 stored in the memory 403. That is, the computing device 400 can implement the root cause location method provided by the method embodiment through the processor 401 and the program code 4031 in the memory 403.

[0057] In the embodiment of the present disclosure, before describing the method flow of root cause location, a flowchart of the present disclosure is briefly introduced, see Figure 5 In the present disclosure, the input is a time series heterogeneous graph and an initial fault node, or data and an initial fault node for generating a time series heterogeneous graph, and the output is the root cause of the initial fault node. It mainly includes three stages, namely, obtaining a time series heterogeneous graph by data processing, obtaining an abnormal subgraph by subgraph extraction, and locating the root cause based on the abnormal subgraph. The three stages correspond to steps 601 to 605 in the following text.

[0058] Data processing to obtain the time series heterogeneous graph stage: module selection processing, anomaly detection processing and graph modeling processing, etc. Module selection processing is based on different input data, and different modules are selected. Among them, module selection processing is optional processing. Module selection processing is based on different scenarios and input data, and different modules are selected. For example, when the input data only includes topology, alarms and call chains, the executed modules do not include anomaly detection modules and supervised prediction modules. When the time series heterogeneous graph can be obtained directly, anomaly detection processing and graph modeling processing are also optional processing.

[0059] The subgraph extraction obtains the abnormal subgraph stage: subgraph generation processing, entry node refresh processing and subgraph reconstruction processing. Among them, the subgraph generation processing is used to filter the time series heterogeneous graph, which is an optional processing, the entry node refresh processing is used to re-determine the new fault node of the time series heterogeneous graph, and perform breadth-first search based on the new fault node, which is also an optional processing, and the subgraph reconstruction is used to obtain the abnormal subgraph.

[0060] The stages of root cause location based on abnormal subgraphs include: node embedding processing, probability determination processing, and node sorting processing. Node embedding processing is used to embed the attributes of nodes in the abnormal subgraph into vectors, probability determination processing is used to determine the random walk probability of each node using the root cause prediction model, and node sorting processing is used to sort the random walk probability of each node from large to small, and determine the top X nodes, where X is a positive integer, and determine these X nodes as the root cause of the initial fault node.

[0061] In the microservice scenario, the data required for the above different processing is different, see Table 1. When the root cause prediction model is a supervised model, the root cause prediction model is trained using historical faults. When the root cause prediction model is an unsupervised model, the root cause is obtained using the topology structure and call chain summary.

[0062] Table 1

[0063]

[0064]

[0065] Combine the following Figure 6 For a description of the root cause location method flow, see Figure 6 In steps 601 to 605, the execution subject of the method flow may be Figure 4 The computing device 400 described in Figure 6 In this paper, the root cause location method in the cloud platform scenario is used as an example to illustrate.

[0066] Step 601, obtaining a time series heterogeneous graph, which includes nodes, edges and attributes of the nodes.

[0067] In this embodiment, when root cause location is performed, a time series heterogeneous graph is stored in the database, and the computing device obtains the time series heterogeneous graph from the database. For example, when the scale of the platform has not changed and it is not the first time to locate the root cause, the database stores the time series heterogeneous graph corresponding to the platform.

[0068] Alternatively, there is no constructed temporal heterogeneous graph at present, and the computing device obtains the topological structure and the call chain between nodes. The topological structure includes nodes and the connection relationship between nodes, and the call chain between nodes refers to the call relationship between nodes. The computing device determines the node from the topological structure, and uses the call chain between nodes to determine the pointing relationship between the edges of the nodes. For example, if node A calls node B, the edge between node A and node B is node A pointing to node B.

[0069] The time series heterogeneous graph obtained by the computing device includes an initial fault node, which is an input fault node with a fault. The purpose of root cause location is to determine the root cause of the initial fault node.

[0070] The computing device obtains monitoring indicators, which include one or more of alarms, performance indicators or logs. For example, in the cloud platform scenario, performance indicators include CPU utilization, memory occupancy, and number of call failures. Alarms include one or more of the number of call failures exceeding a threshold, the CPU exceeding a threshold, or the memory occupancy exceeding a threshold. Each alarm has multiple levels, including emergency, important, warning, and normal, and the urgency of different levels is different. In order to facilitate root cause location in the following text, the anomalies determined based on performance indicators and / or logs are unified as alarms. In this way, after the anomaly is determined, the anomaly is associated with the corresponding node or edge as an alarm. The attributes of the node are the alarms that exist for the node, and the attributes of the edge are the alarms that exist for the edge.

[0071] There are many types of anomalies. The following provides four possible anomalies: (1) peak increase, which refers to a sudden increase in the indicator; (2) peak decrease, which refers to a sudden drop in the indicator; (3) horizontal shift, which refers to a significant increase in the indicator over a period of time, such as an increase value exceeding the first threshold; (4) horizontal shift, which refers to a significant decrease in the indicator over a period of time, such as a decrease value exceeding the second threshold. Considering the large amount of data on the cloud platform, a detector may not be able to detect all types of anomalies. In order to detect all types of anomalies in performance indicators, the computing device can use an anomaly detection model to perform anomaly detection. The anomaly detection model integrates unsupervised detection models with low time complexity such as Prophet, robust seasonal-trend decomposition (Robust STL) and 3σ. In this anomaly detection model, as long as one of the detected anomalies is detected, it is considered an anomaly.

[0072] In the case where the monitoring indicators include logs, the computing device parses the logs and extracts log events from the logs. For example, the computing device can use the log parsing model to drain the streaming parsing logs. The computing device then embeds the log events to obtain the embedding vectors of the log events. For example, the computing device embeds the log events into the vectors, that is, the computing device uses pre-trained global vectors (glob) for word embedding and uses term frequency-inverse document frequency (TF-IDF) for sentence embedding. The computing device then inputs the embedding vectors of the log events into the prediction model to obtain the anomaly scores of the log events, and determines the log events whose anomaly scores exceed the threshold as anomalies. For example, the prediction model can be a deep support vector data description (SVDD) model based on a multi-layer perceptron.

[0073] Step 602: In the time series heterogeneous graph, the nodes and edges that the initial fault node depends on within the fault time window are obtained through breadth-first search traversal, and the time series heterogeneous graph is updated based on the obtained nodes and edges.

[0074] In this embodiment, in order to reduce the scale of the time series heterogeneous graph, the time series heterogeneous graph can be filtered using a fault time window. The fault time window refers to a period of time that may cause the initial fault node to fail. Events occurring in the non-fault time window cannot be the root cause of the initial fault node. The time series heterogeneous graph also includes the attributes of the edge, which includes time information. For example, if the node is a microservice, the time information in the edge attribute is the calling time period of the microservice. The node attribute also includes time information. The computing device deletes the nodes and edges that are not in the fault time window in the time series heterogeneous graph. Then, in the time series heterogeneous graph after the deletion process, the computing device performs a breadth-first search traversal from the initial fault node to obtain the nodes and edges that the initial fault node depends on. The computing device retains the nodes and edges that the initial fault node depends on in the time series heterogeneous graph, and deletes the nodes and edges that the initial fault node does not depend on from the time series heterogeneous graph. In this way, the time series heterogeneous graph can be filtered to reduce the amount of calculation for root cause location.

[0075] It should be noted that the time-series heterogeneous graph is a directed graph, so when performing a breadth-first search traversal from the initial fault node, some nodes will not be traversed, and are not the nodes that the initial fault node depends on.

[0076] It should also be noted that the present disclosure embodiment uses breadth-first search as an example for explanation, and other search methods may also be used for traversal, such as breadth-first search.

[0077] Step 603, select a new faulty node from the neighboring nodes of the initial faulty node, obtain the nodes and edges that the new faulty node depends on in the temporal heterogeneous graph through breadth-first search traversal, and update the temporal heterogeneous graph based on the obtained nodes and edges.

[0078] In this embodiment, the computing device determines that the node directly connected to the initial fault node is a neighbor node in the timing heterogeneous graph, and when the alarm in the attribute of the neighbor node is not normal, the neighbor node is determined to be an abnormal node. In the case where there is an abnormal node in the neighbor node, the node with the most abnormal alarms is selected from the neighbor nodes and determined as the new fault node. For example, in a microservice scenario, the neighbor node with the most failed calls is determined as the new fault node. Then, in the timing heterogeneous graph, a breadth-first search traversal is used to obtain the nodes and edges on which the new fault node depends. The nodes and edges on which the new fault node depends are retained in the timing heterogeneous graph, and the remaining nodes and edges are deleted from the timing heterogeneous graph to update the timing heterogeneous graph. In this way, the timing heterogeneous graph is updated using the new fault node, so that the scale of the timing heterogeneous graph is relatively small, saving processing resources for root cause location.

[0079] It should be noted that, when the alarm of the initial fault node is not normal, the initial fault node is an abnormal node, and step 603 may be performed or not. Executing step 603 can make the scale of the time series heterogeneous graph smaller.

[0080] When the alarm of the initial fault node is normal and there are abnormal nodes among the neighboring nodes of the initial fault node, the initial fault node is not an abnormal node, and step 603 can be executed, and the new fault node determined in step 603 is updated as the current fault node. In this way, when the root cause is located subsequently, the alarm in the vector of the current fault node is not a zero vector, which can make the determined root cause more accurate.

[0081] It should also be noted that step 602 and step 603 are optional steps, that is, step 602 and step 603 may not be performed.

[0082] Step 604, based on the attributes of the node, delete the normal node and the edge connected to the normal node in the time series heterogeneous graph, reconstruct the time series heterogeneous graph after the deletion process, and obtain an abnormal subgraph, in which there are reachable edges between the current faulty node and other nodes in the abnormal subgraph.

[0083] In this embodiment, after obtaining the time series heterogeneous graph, the computing device determines the node that is alarmed as normal as a normal node, and then determines the edges connected to the normal node, deletes the normal node and the edges connected to the normal node in the time series heterogeneous graph, and obtains the time series heterogeneous graph after deletion. In the time series heterogeneous graph after deletion, there are nodes without edges connected. The computing device adds edges to the nodes without edges connected according to certain rules, so that the current faulty node has a reachable edge with any other node, and obtains an abnormal subgraph. For example, in Figure 7In the figure, the left side is a time series heterogeneous graph, the white nodes are normal nodes, the black nodes are abnormal nodes, and the right side is an abnormal subgraph, which only includes abnormal nodes. In this way, the abnormal subgraph not only retains the reachability between the current faulty node and the abnormal node, but also reduces the scale of the time series abnormal graph and the noise caused by normal nodes due to the absence of normal nodes. Here, there is a reachable edge between the current faulty node and any other node, which can be a directly connected edge or an edge connected through the middle abnormal node, that is, the current faulty node can reach any other node.

[0084] In step 604, when the initial fault node is an abnormal node, the current fault node is the initial fault node; when the initial fault node is not an abnormal node, the current fault node is a neighbor node of the initial fault node.

[0085] In one example, in step 604, a minimum spanning tree-like algorithm may be used to reconstruct the abnormal subgraph, and the process is as follows:

[0086] The shortest path between nodes in the time series heterogeneous graph after the deletion process is determined, and edges are added to the unconnected nodes in the time series heterogeneous graph after the deletion process according to the shortest path to obtain the abnormal subgraph.

[0087] In this embodiment, the computing device calculates multiple paths between any two nodes in the time series heterogeneous graph after the deletion process, adds the paths between every two nodes, obtains the sum of multiple paths between abnormal nodes in the time series heterogeneous graph, sorts the sum of multiple paths in order from small to large or from large to small, and determines the shortest path. Then the computing device adds edges to the unconnected nodes in the time series heterogeneous graph according to the shortest path, so that there are reachable edges between the current faulty node and any other node, and obtains an abnormal subgraph.

[0088] In the embodiment of the present disclosure, in the microservice call scenario, an algorithm pseudo code for obtaining a pseudo code of an abnormal subgraph using a time series heterogeneous graph is also provided:

[0089] Input: graph G, source node u

[0090] Output: New graph New source node (Output: new graph new source node u)

[0091] Initialize

[0092] while true do

[0093] Map

[0094] For all v belonging to τ u Execute (for allv∈τ u do), where τ u Represents the neighbor nodes of u.

[0095] If v is abnormal then

[0096] Sabnormal[v] = number of failed calls

[0097] End if statement (end if)

[0098] End for statement (end for)

[0099] m = the maximum number of failed calls in Sabnormal (max v in Sabnormal)

[0100] If u is an abnormal node and there is only one execution in the Sabnormal set (if u is abnormal and length Sabnormal == 1 then)

[0101] u=m

[0102] If u is a normal node and the number of elements in the Sabnormal set is greater than 0, execute (else if u isabnormal and length Sabnormal>0then)

[0103] u=m

[0104] Else break

[0105] End if statement (end if)

[0106] End while statement (end while)

[0107]

[0108]

[0109] Among them, graph G is a time-series heterogeneous graph, the source node is the initial fault node, and the new source node is the new fault node.

[0110] Step 605: determine the root cause of the initial fault node in the abnormal subgraph.

[0111] In this embodiment, after obtaining the abnormal subgraph, the computing device embeds the nodes in the abnormal subgraph into a vector in order to support the subsequent root cause prediction model, which can also be understood as encoding the node into a vector. For example, the node type and the node attribute are embedded by one-hot encoding. When embedding, the dimensions of the vectors of each node are the same. For example, the attribute of the node is the alarm of the node. If the abnormal subgraph includes 6 types of nodes, each node has 20 types of alarms, and each alarm is divided into multiple levels (such as emergency, important, warning and normal 4 levels), the length of the vector of each node is 6+20*4=86. In the case where the current fault node is the initial fault node, the computing device uses the initial fault node and the random walk algorithm to calculate the probability that all nodes in the abnormal subgraph are the root cause of the initial fault node, and the top X nodes with the highest probability are determined as the root cause of the initial fault node. In the case where the current fault node is not the initial fault node, the computing device uses the current fault node and the random walk algorithm to calculate the probability that all nodes in the abnormal subgraph are the root cause of the current fault node, and determines the top X nodes with the highest probability as the root cause of the current fault node, and determines the root cause of the current fault node as the root cause of the initial fault node. The random walk algorithm may be a supervised random walk algorithm.

[0112] In one example, in step 605, when determining the random walk probability, a multi-layer neural network is used to learn the probability of abnormal propagation between nodes, and random walks are simulated with the support of energy vectors and probability transfer matrices to determine the probability of each node being the root cause. The exemplary process is:

[0113] Based on the topological structure and node attributes of the abnormal subgraph, a probability transfer matrix of node failure in the abnormal subgraph is determined. Based on the probability transfer matrix, the random walk probability of the current faulty node to other nodes in the abnormal subgraph is determined. The top X nodes in the abnormal subgraph with the highest random walk probability sorted from large to small are determined as the root causes of the current faulty node, where X is a positive integer.

[0114] In this embodiment, for nodes i and j in the abnormal subgraph, i and j are both less than or equal to the number of nodes in the abnormal subgraph, and the computing device uses the topological structure and node attributes of the abnormal subgraph to determine the probability that the failure of node i is caused by node j, and obtains the value of the element in the i-th row and j-th column in the probability transfer matrix. Based on this method, the computing device determines the probability transfer matrix of the node failure in the abnormal subgraph and normalizes the probability transfer matrix. The computing device initializes the energy vector of the current faulty node, which can be set to 1, and initializes the energy vectors of other nodes, which can be set to 0. The computing device starts from the current faulty node and passes through a random walk of length k, and determines the random walk probability from the current faulty node to other nodes. The random walk probability is equal to the product of the energy vector of the current faulty node and k times p. The random walk probability is used to simulate a random walk of length k. k can be set according to actual needs. For example, k is 10, and p is an element in the probability transfer matrix. The computing device sorts the random walk probabilities in the abnormal subgraph from large to small, and determines the top X nodes as the root causes of the current faulty nodes. X can be set according to an empirical value, for example, X is set to 1.

[0115] In addition, in order to make the root cause of the current faulty node more accurate, the node whose random walk probability is higher than a certain threshold among the X nodes is determined as the root cause of the current faulty node.

[0116] It should be noted that the current fault node here is the initial fault node, or the new fault node mentioned above.

[0117] In one example, a computing device may use an adjacency matrix of an abnormal subgraph to determine a probability transfer matrix, construct an adjacency matrix of the abnormal subgraph based on the topological structure of the abnormal subgraph, determine features of edges in the abnormal subgraph based on attributes of nodes in the abnormal subgraph, learn the features using a deep neural network algorithm based on the adjacency matrix, and obtain a probability transfer matrix of node failures in the abnormal subgraph.

[0118] In this embodiment, the adjacency matrix of the abnormal subgraph is represented by A. Assume that the abnormal subgraph includes N nodes, N is greater than or equal to 2, A is an N×N matrix, and assume that there is no edge between the i-th node and the j-th node. The element A in the i-th row and j-th column is i,j The value is 0. Assuming that there is an edge from the i-th node to the j-th node between the i-th node and the j-th node, the value of the element in the i-th row and j-th column is 1. Assuming that there is no edge from the i-th node to the j-th node between the i-th node and the j-th node, but there is an edge from the j-th node to the i-th node, then the value of the element in the i-th row and j-th column is 0. The computing device constructs the adjacency matrix of the abnormal subgraph based on this method.

[0119] Then, the computing device inputs the attributes of the nodes into the graph convolutional network (GCN) to obtain the features of the nodes, and concatenates the features of the nodes at the two endpoints of each edge to obtain the features of each edge. For example, the features of the i-th node are represented as G(i), the features of the j-th node are represented as G(j), and the features of the i-th node and the features of the edge between the j-th node are represented as the matrix [G(i), G(j)]. For example, assuming that the features of the i-th node are a×b matrices, and the features of the j-th node are a×b matrices, the features of the i-th node and the features of the j-th node are concatenated to obtain an a×2b matrix. The computing device multiplies the features of each edge by the adjacency matrix to obtain a product matrix, and the product matrix is ​​input into the deep neural network algorithm, and the output obtained is the probability transfer matrix of node failure in the abnormal subgraph.

[0120] In addition, the disclosed embodiment also provides a process for training a deep neural network algorithm, given an abnormal subgraph, and specifying the faulty nodes in the abnormal subgraph and the root causes of the faulty nodes. Also, given an initial GCN and an initial deep neural network algorithm, the energy vectors δ and The δ of the faulty node is 1, and the δ of other nodes is 0. =1 / RC, RC represents the number of root causes. For a faulty node, there may be multiple root causes. is 0. The computing device uses the initial GCN to extract the features of each node, and concatenates the features of the nodes to obtain the features of the edges between the nodes. The computing device uses the initial deep neural network algorithm to learn the features of each edge, and then simulates a random walk of length k by multiplying δ by k times p to obtain the predicted result, that is, the predicted random walk probability. The cosine function is used to calculate the difference between the predicted result and the actual result. Based on the difference, the initial GCN and initial deep neural network algorithms are updated until the predicted results are consistent with the actual results. If the difference between them is less than a certain value, or the number of updates reaches a certain threshold, it is determined that the training of CGN and deep neural network algorithms is completed, and GCN and deep neural network algorithms form a root cause prediction model.

[0121] In addition, GCN and deep neural network algorithms can also be trained separately.

[0122] In one example, since the root cause of a node may be the node itself, before determining the node failure probability transfer matrix, a self-loop edge is added to each node in the abnormal subgraph so that the edge starts from the node and returns to itself.

[0123] In addition, to allow energy to flow back during the random walk, reverse edges between nodes are added between nodes so that energy between nodes can flow back.

[0124] In one example, after the root cause of the initial fault node is determined, the root cause prediction model may be iteratively updated using the root cause of the initial fault node.

[0125] In the embodiment of the present disclosure, a pseudo code of an algorithm for determining the root cause of a faulty node using an abnormal subgraph is also provided:

[0126] Input: graph G1 with N nodes, source node u, root causes setRC corresponding to node u (only training), random walk length k

[0127] Output: score for each node (that is, the random walk probability of each node)

[0128] Preform first-order GCN convolution on G1, G[u] represents the embedded feature of node u

[0129] Adding self-loops and reverse edges to G1

[0130] Initialize the energy vector δ, Adjacency matrix A(Initialize energy vectorδ, adjacentmatrix A)

[0131] δ[u]=1

[0132] For all i∈RC do

[0133]

[0134] End for loop (end for)

[0135] Probability transfer matrix (transfer matrix) P ij =DNN([G(i),G(j)]*A ij )

[0136] P ij =softmax(sigmoid(P ij )), P ij =softmax(sigmoid(P ij )) indicates that the probability transfer matrix is ​​normalized.

[0137] δ=δ·p k

[0138] If training then

[0139] Denotes δ and The loss is equal to 1 minus δ and The cosine distance.

[0140] End if loop (end if)

[0141] Return

[0142] Among them, graph G1 is the abnormal subgraph, and the source node is the current fault node.

[0143] In the disclosed embodiment, the reachability of the faulty nodes and the abnormal nodes is retained when the abnormal subgraph is extracted, and the scale of the temporal heterogeneous graph and the noise caused by the normal nodes when the root cause location algorithm is executed are greatly reduced. In addition, a supervised random walk algorithm combined with a graph neural network is also provided, which only requires a small amount of data containing the faulty nodes and the root causes for training, and can learn the probability of abnormal propagation between nodes, and then determine the random walk probability of each node being the root cause through random walk.

[0144] In addition, since most operation and maintenance scenarios can be modeled using time-series heterogeneous graphs, the embodiments of the present disclosure can be applied to a variety of operation and maintenance scenarios, have a certain degree of universality, and have strong generalization capabilities. For example, it can be applied to operation and maintenance platforms such as storage, cloud, and wireless networks.

[0145] In the embodiments of the present disclosure, in order to better reflect the advantages of the embodiments of the present disclosure, experiments were conducted on a cloud platform and artificial intelligence for operations 2000 (AIOps2020) data sets to verify the corresponding beneficial effects of the present disclosure, which are specifically described from the following aspects:

[0146] 1. Baseline model: AutoMap dynamically generates fault correlations using multiple types of time series metrics and designs heuristic models using forward, self-directed, and reverse random walk algorithms to diagnose the root cause. It also supports the introduction of historical faults to calculate the global weight of indicators. Groot builds a temporal causal relationship graph by event based on the dependency graph, summarizing various types of indicators, logs, and the expertise of site reliability engineers (SREs). The root cause of the fault is located based on personalized page ranking (PageRank).

[0147] 2. Dataset: Create artificial abnormal events. Artificial abnormal events are generated as follows: for each event, select c (consider c = 1, 2, 3 in the following experiments) entities in the event, and for each target entity, select other s entities, s is a positive integer, and calculate the Euclidean distance between their attribute vectors x_i and the target attribute vector x of the target entity. Then, select the node with the largest Euclidean distance to replace the target entity.

[0148] Effect description: In most cloud platforms, some faults may correspond to multiple root causes. When there are multiple root causes, traditional precision, recall rate and F1 score cannot accurately measure the prediction accuracy. This disclosure uses root cause precision S to evaluate the accuracy of all models.

[0149] Among them, I is the set of all abnormal events, R i is the set of real root causes, P i is a set of predicted root causes (length equal to R i ), the overall performance of the disclosed embodiment and the baseline model on the hybrid cloud platform is shown in Table 2 and Table 3, and the overall performance on the AIOps2020 dataset is shown in Table 4. Figure 6 The complete process shown in FIG. 1 and the baseline model also executes step 604. The embodiment of the present disclosure in Table 3 does not execute step 604. Figure 6 Step 604 in Table 4. The embodiment of the present disclosure does not perform Figure 6 Step 604 in .

[0150] Table 2

[0151]

[0152] Table 3

[0153]

[0154] Table 4

[0155]

[0156] From Tables 2 to 4, it can be seen that the performance of the root cause accuracy S is much better than all baseline models, which proves the effectiveness of the scheme in the disclosed embodiment. For all methods, it is assumed that the length of the random walk (number of PageRank iterations) is set to 10, and 10 samples are randomly selected as historical faults for each fault type (less than 2% of the total sample size). Table 2 summarizes the experimental results on the hybrid cloud dataset. It can be seen that the scheme in the disclosed embodiment achieves the best results in all categories of faults.

[0157] Comparing Table 2 and Table 3, we can also see that deleting normal nodes and the edges connected to normal nodes, as well as reconstructing the subgraph can significantly improve the accuracy of root cause location.

[0158] It can also be seen from Table 4 that the root cause accuracy of the solution in the embodiment of the present disclosure far exceeds that of AutoMap and Groot. This also shows that the solution in the embodiment of the present disclosure can adapt to different operation and maintenance scenarios and accurately diagnose the root cause of the fault.

[0159] The following describes a device for locating the root cause provided by the embodiments of the present disclosure.

[0160] Figure 8 : is a structural diagram of the root cause location device provided by the embodiment of the present disclosure. The device can be implemented as part or all of the device through software, hardware or a combination of both. The device provided by the embodiment of the present disclosure can implement the embodiment of the present disclosure Figure 5 and Figure 6 According to the process shown in the figure, the apparatus comprises: a graph modeling module 810, a subgraph extraction module 820 and a root cause location module 830, wherein:

[0161] A graph modeling module 810 is used to obtain a time series heterogeneous graph, wherein the time series heterogeneous graph includes nodes, edges, and attributes of the nodes, wherein the nodes include initial fault nodes, and can be specifically used to implement the graph modeling function of step 601 and execute the implicit steps included in step 601;

[0162] The subgraph extraction module 820 is used to delete the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, reconstruct the time series heterogeneous graph after the deletion process, and obtain an abnormal subgraph, in which there are reachable edges between the current faulty node and other nodes in the abnormal subgraph, and the current faulty node is obtained based on the initial faulty node, which can be specifically used to implement the subgraph extraction of step 604 and execute the implicit steps included in step 604;

[0163] The root cause location module 830 is used to determine the root cause of the initial fault node in the abnormal subgraph, and can be specifically used to implement the root cause location function of step 605 and execute the implicit steps included in step 605.

[0164] In one example, the sub-graph extraction module 820 is further used for:

[0165] Before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph based on the attribute of the node, selecting a new faulty node from the neighboring nodes of the initial faulty node, wherein the new faulty node is an abnormal node;

[0166] In the time series heterogeneous graph, obtaining nodes and edges on which the new fault node depends by traversing through breadth-first search;

[0167] The temporal heterogeneous graph is updated based on the obtained nodes and edges.

[0168] In one example, the subgraph extraction module 820 is further used to: before selecting a new fault node from the neighboring nodes of the initial fault node, determine that the initial fault node is not an abnormal node;

[0169] The root cause location module 830 is used to:

[0170] Based on the current fault node, determining the root cause of the current fault node in the abnormal subgraph, the current fault node being the new fault node;

[0171] The root cause of the current faulty node is determined as the root cause of the initial faulty node.

[0172] In one example, the root cause location module 830 is used to:

[0173] Determine a probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph;

[0174] Based on the probability transfer matrix, determining the random walk probability from the current faulty node to other nodes in the abnormal subgraph;

[0175] X nodes with the highest random walk probability in the abnormal subgraph are sorted from largest to smallest and are determined as the root causes of the current fault node, where X is a positive integer.

[0176] In one example, the root cause location module 830 is used to:

[0177] Based on the topological structure of the abnormal subgraph, construct an adjacency matrix of the abnormal subgraph;

[0178] Determine the characteristics of the edges in the abnormal subgraph based on the attributes of the nodes in the abnormal subgraph;

[0179] Based on the adjacency matrix, a deep neural network algorithm is used to learn the features to obtain a probability transfer matrix of node failures in the abnormal subgraph.

[0180] In one example, the root cause location module 830 is further configured to:

[0181] Before determining the probability transfer matrix of node failure in the abnormal subgraph, in the abnormal subgraph, self-loop edges and reverse edges between nodes are added to each node.

[0182] In one example, the sub-graph extraction module 820 is used to:

[0183] Determine the shortest path between nodes in the time series heterogeneous graph after the deletion process;

[0184] Add edges to the unconnected nodes in the deleted time series heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

[0185] In an example, the temporal heterogeneous graph further includes the attributes of the edge; and the subgraph extraction module 820 is further used to:

[0186] Based on the attributes of the node, before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph, in the time series heterogeneous graph, obtaining the nodes and edges that the faulty node depends on within the fault time window by traversing through a breadth-first search;

[0187] Based on the obtained nodes and edges, the temporal heterogeneous graph is updated.

[0188] In one example, the graph modeling module 810 is used to:

[0189] Based on the topological structure and the call chains between the nodes, the nodes and edges of the temporal heterogeneous graph are generated;

[0190] Based on monitoring indicators, attributes of the node are generated, and the monitoring indicators include one or more of alarms, performance indicators or logs.

[0191] The embodiment of the present disclosure also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the method for root cause location.

[0192] The embodiment of the present disclosure also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital versatile disk (DVD)), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the method for root cause location.

[0193] Those of ordinary skill in the art will appreciate that the various method steps and units described in the embodiments disclosed in this disclosure can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0194] In the several embodiments provided in the present disclosure, it should be understood that the disclosed system architecture, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0195] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present disclosure.

[0196] In addition, each module in each embodiment of the present disclosure may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above integrated modules may be implemented in the form of hardware or software modules.

[0197] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks or optical disks.

[0198] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present disclosure.

Claims

1. A method for locating a root cause, characterized in that: The method comprises: Acquire a time series heterogeneous graph, wherein the time series heterogeneous graph includes nodes, edges, and attributes of the nodes, and the nodes include initial fault nodes; Based on the attributes of the node, the normal node and the edge connected to the normal node in the time series heterogeneous graph are deleted, and the time series heterogeneous graph after the deletion is reconstructed to obtain an abnormal subgraph, in which there are reachable edges between the current faulty node and other nodes in the abnormal subgraph, and the current faulty node is obtained based on the initial faulty node; A root cause of the initial fault node is determined in the abnormal subgraph.

2. The method according to claim 1, characterized in that Before deleting the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, the method further includes: Selecting a new fault node from neighboring nodes of the initial fault node, wherein the new fault node is an abnormal node; In the time series heterogeneous graph, obtaining nodes and edges on which the new fault node depends by traversing through breadth-first search; The temporal heterogeneous graph is updated based on the obtained nodes and edges.

3. The method according to claim 2, characterized in that Before selecting a new faulty node from the neighboring nodes of the initial faulty node, the method further includes: Determining that the initial fault node is not an abnormal node; Determining the root cause of the initial fault node in the abnormal subgraph includes: Based on the current fault node, determining the root cause of the current fault node in the abnormal subgraph, the current fault node being the new fault node; The root cause of the current faulty node is determined as the root cause of the initial faulty node.

4. The method according to claim 3, characterized in that The determining, based on the current faulty node, in the abnormal subgraph, a root cause of the current faulty node includes: Determine a probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph; Based on the probability transfer matrix, determining the random walk probability from the current faulty node to other nodes in the abnormal subgraph; X nodes with the highest random walk probability in the abnormal subgraph are sorted from largest to smallest and are determined as the root causes of the current fault node, where X is a positive integer.

5. The method according to claim 4, characterized in that The determining of the probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph includes: Based on the topological structure of the abnormal subgraph, construct an adjacency matrix of the abnormal subgraph; Determine the characteristics of the edges in the abnormal subgraph based on the attributes of the nodes in the abnormal subgraph; Based on the adjacency matrix, a deep neural network algorithm is used to learn the features to obtain a probability transfer matrix of node failures in the abnormal subgraph.

6. The method according to claim 4 or 5, characterized in that: Before determining the probability transfer matrix of node failures in the abnormal subgraph, the method further includes: In the abnormal subgraph, self-loop edges and reverse edges between nodes are added to each node.

7. The method according to any one of claims 1 to 6, characterized in that: The step of reconstructing the deleted time series heterogeneous graph to obtain an abnormal subgraph includes: Determine the shortest path between nodes in the time series heterogeneous graph after the deletion process; Add edges to the unconnected nodes in the deleted time series heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

8. The method according to any one of claims 1 to 7, characterized in that: The time series heterogeneous graph further includes the attributes of the edge; before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph based on the attributes of the node, the method further includes: In the time series heterogeneous graph, obtaining nodes and edges that the initial fault node depends on within the fault time window by traversing through breadth-first search; Based on the obtained nodes and edges, the temporal heterogeneous graph is updated.

9. The method according to any one of claims 1 to 8, characterized in that: The obtaining of the time series heterogeneous graph includes: Based on the topological structure and the call chains between the nodes, the nodes and edges of the temporal heterogeneous graph are generated; Based on monitoring indicators, attributes of the node are generated, and the monitoring indicators include one or more of alarms, performance indicators or logs.

10. A root cause location device, characterized in that: The device comprises: A graph modeling module, used to obtain a time series heterogeneous graph, wherein the time series heterogeneous graph includes nodes, edges and attributes of the nodes, and the nodes include initial fault nodes; A subgraph extraction module is used to delete the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, reconstruct the time series heterogeneous graph after the deletion process, and obtain an abnormal subgraph, in which there are reachable edges between the current faulty node and other nodes in the abnormal subgraph, and the current faulty node is obtained based on the initial faulty node; A root cause location module is used to determine the root cause of the initial fault node in the abnormal subgraph.

11. The device according to claim 10, characterized in that The sub-graph extraction module is further used for: Before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph based on the attribute of the node, selecting a new faulty node from the neighboring nodes of the initial faulty node, wherein the new faulty node is an abnormal node; In the time series heterogeneous graph, obtaining nodes and edges on which the new fault node depends by traversing through breadth-first search; The temporal heterogeneous graph is updated based on the obtained nodes and edges.

12. The device according to claim 11, characterized in that The subgraph extraction module is further used to: before selecting a new fault node from the neighboring nodes of the initial fault node, determine that the initial fault node is not an abnormal node; The root cause location module is used to: Based on the current fault node, determining the root cause of the current fault node in the abnormal subgraph, the current fault node being the new fault node; The root cause of the current faulty node is determined as the root cause of the initial faulty node.

13. The device according to claim 12, characterized in that The root cause location module is used to: Determine a probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph; Based on the probability transfer matrix, determining the random walk probability from the current faulty node to other nodes in the abnormal subgraph; X nodes with the highest random walk probability in the abnormal subgraph are sorted from largest to smallest and are determined as the root causes of the current fault node, where X is a positive integer.

14. The device according to claim 13, characterized in that The root cause location module is used to: Based on the topological structure of the abnormal subgraph, construct an adjacency matrix of the abnormal subgraph; Determine the characteristics of the edges in the abnormal subgraph based on the attributes of the nodes in the abnormal subgraph; Based on the adjacency matrix, a deep neural network algorithm is used to learn the features to obtain a probability transfer matrix of node failures in the abnormal subgraph.

15. The device according to claim 13 or 14, characterized in that The root cause location module is also used for: Before determining the probability transfer matrix of node failure in the abnormal subgraph, in the abnormal subgraph, self-loop edges and reverse edges between nodes are added to each node.

16. The device according to any one of claims 10 to 15, characterized in that The sub-graph extraction module is used for: Determine the shortest path between nodes in the time series heterogeneous graph after the deletion process; Add edges to the unconnected nodes in the deleted time series heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

17. The device according to any one of claims 10 to 16, characterized in that The temporal heterogeneous graph also includes the attributes of the edge; the subgraph extraction module is further used for: Based on the attributes of the node, before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph, in the time series heterogeneous graph, obtaining the nodes and edges that the initial fault node depends on within the fault time window by traversing through a breadth-first search; Based on the obtained nodes and edges, the temporal heterogeneous graph is updated.

18. The device according to any one of claims 10 to 17, characterized in that The graph modeling module is used to: Based on the topological structure and the call chains between the nodes, the nodes and edges of the temporal heterogeneous graph are generated; Based on monitoring indicators, attributes of the node are generated, and the monitoring indicators include one or more of alarms, performance indicators or logs.

19. A computing device, characterized in that The computing device includes a processor and a memory; The processor is configured to execute instructions stored in the memory so that the computing device performs the method according to any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that: The storage medium comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 9.

Images