Unknown topological causal structure identification method and device based on THPs algorithm

Abstract

The invention relates to an unknown topological causal structure identification method and device based on a THPs algorithm, and belongs to the technical field of intelligent operation and maintenance. The method comprises the following steps: preprocessing a time sequence event containing a plurality of pieces of warning data to obtain cleaned warning sequence data; constructing a post pre-training data set and a fine tuning data set based on the cleaned warning sequence data; performing training and fine tuning on a large language model on the post-pre-training data set and the fine tuning data set; utilizing the trained and fine-tuned large language model to construct a potential causal graph of the to-be-tested time sequence data; and initializing the topological graph of the to-be-measured time series data, and optimizing the topological graph of the to-be-measured time series data and the potential causal graph at the same time based on a THPs algorithm to obtain a topological structure and a causal structure of the to-be-measured time series data. According to the method, the topology and causal structure of the time sequence event can be identified under the condition that the network topology structure is not completely known.

Description

Technical Field

[0001] The present invention belongs to the technical field of intelligent operation and maintenance, and proposes a method and a device for identifying an unknown topological causal structure based on a THPs algorithm. Background Art

[0002] In the intelligent operation and maintenance of telecommunications networks, a large amount of warning data is generated every day. In order to prevent more serious consequences, it is necessary to find the root cause of the warning in time, so it is necessary to write an algorithm to identify the root cause of the warning. The THPs algorithm is usually used to solve the problem of causal structure learning in warning data.

[0003] The principle of the THPs algorithm is to consider the Hawkes process from the perspective of temporal convolution, and propose a topological Hawkes process (THP) that links graph convolution in the topological domain with temporal convolution in the time domain. A causal structure learning method for THP in the likelihood framework is proposed. The method is characterized by THP with a likelihood function based on graph convolution and a sparse optimization plan with an expectation-maximizing likelihood function. The disadvantage is that in actual scenarios, some warnings are triggered by warnings in other nodes, and if the topological structure is unknown or incompletely known, only the causal relationship of warnings in the same node can be calculated, but the causal relationship between warnings between different nodes cannot be given. Summary of the invention

[0004] The present invention discloses a method and device for identifying unknown topological causal structure based on THPs algorithm (hereinafter referred to as BITHPs algorithm), which can identify the topology and causal structure of time series events without fully knowing the network topology.

[0005] According to a first aspect of an embodiment of the present disclosure, a method for identifying an unknown topological causal structure based on a THPs algorithm is provided, the method comprising:

[0006] Preprocessing the time series events containing several warning data to obtain cleaned warning series data;

[0007] Based on the cleaned warning sequence data, construct the pre-training dataset and fine-tuning dataset;

[0008] Training and fine-tuning the large language model on the post-pretraining dataset and the fine-tuning dataset;

[0009] Use the trained and fine-tuned large language model to construct a potential causal graph for the time series data to be tested;

[0010] Initialize the topological graph of the time series data to be tested, and optimize the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested.

[0011] Optionally, the time series events are preprocessed to obtain a number of warning sequence data, including:

[0012] According to the set warning data field, the time series event is converted into warning sequence data; wherein the warning data field includes: warning ID, device ID, warning occurrence timestamp and warning end timestamp;

[0013] Deleting warning sequence data whose warning end timestamp is earlier than the warning occurrence timestamp and whose warning duration is lower than a set threshold, to obtain preprocessed warning sequence data; wherein the warning duration is obtained according to the warning occurrence timestamp and the warning end timestamp;

[0014] The preprocessed warning sequence data is divided into fixed window lengths W, and the warning ID and device ID in each warning data are uniquely encoded. The warning occurrence timestamp and the warning end timestamp are standardized to obtain the corresponding window sequence data.

[0015] Encode the window sequence data using an encoder to obtain features of the window sequence data;

[0016] The similarity is calculated according to the characteristics of the window sequence data, and the window sequence data with similarity higher than the set value is removed to obtain the cleaned warning sequence data.

[0017] Optionally, the process of training the encoder comprises:

[0018] Constructing a training data set, wherein the training data set includes a plurality of warning data and snapshot data corresponding to the warning data;

[0019] Encode the snapshot data, and perform feature embedding on the encoding result to obtain the embedding result;

[0020] The long-term dependency in the window sequence data is extracted through LSTM Layers to obtain LSTM Layers output;

[0021] Concatenate the embedding results with the LSTM Layers output and perform position encoding on the concatenated results;

[0022] After the position encoding result passes through Transformer Encoder Layers, the output of Transformer Encoder Layers is feature embedded, and the feature embedding result is decoded through Transformer Decoder Layers to obtain the restored window sequence data;

[0023] Based on the window sequence data and the restored window sequence data, the parameters of the encoder are adjusted.

[0024] Optionally, constructing a pre-training data set based on the cleaned warning sequence data includes:

[0025] For the cleaned warning sequence data X W ={x1,x2,...,x t ,...,x W}, take the first half of the warning data to form the warning sequence data X front ={x1,x2,x3,…,x W / 2}, take the second half of the warning data to form the warning sequence data Where W is the time window length used in the preprocessing process, x t For warning sequence data X W The tth warning data contained in;

[0026] For warning sequence data X front ={x1,x2,x3,…,x W / 2} and warning sequence data Each warning data x t Perform formatting to form the first warning data text, and convert the warning sequence data X front and warning sequence data X end The corresponding first warning data texts are concatenated respectively to obtain input data and output data of a piece of training data in the post-pre-training data set.

[0027] Optionally, based on the cleaned warning sequence data, a fine-tuning dataset is constructed, including:

[0028] Obtain a set of all causal pairs (i, j) CausalPairSet from the determined causal relationship; wherein (i, j) = 0 indicates that warning i is not the cause of warning j, and (i, j) = 1 indicates that warning i is the cause of warning j;

[0029] According to each causal pair (i, j), in the cleaned warning sequence data X W ={x1,x2,...,x t,...,x W} to find L corresponding warning data to form the pth group of warning data sequence corresponding to the causal pair (i, j) Where W is the time window length used in the preprocessing process, x t For warning sequence data X W The tth warning data contained in;

[0030] For warning data sequence Each warning data in is formatted to form a second warning data text, and the second warning data text is spliced ​​to obtain the input data of a training data in the fine-tuning data set; wherein the output data of the training data is: determine the causal relationship between warning i and warning j according to the sequence warning data, if warning i is the cause of warning j, the answer is yes, otherwise the answer is no.

[0031] Optionally, the large language model is an extended large language model; and the process of constructing the extended large language model includes:

[0032] Get a large language model with M layers;

[0033] Determine the number of blocks N, N that need to be expanded <M;

[0034] After every M / N layers, copy the parameters of the previous layer and insert it as a new layer.

[0035] Optionally, use the trained and fine-tuned large language model to construct a potential causal graph of the time series data to be tested, including:

[0036] Generate a set of unknown causal pairs of time series data to be tested and a test set corresponding to each unknown causal pair;

[0037] Select several pieces of data from the test set corresponding to each unknown causal pair as input to the large language model;

[0038] If the number of causal relationships of warning i output by the large language model is greater than the number of causal relationships of warning i not being warning j, then add a directed edge from warning i to warning j in the directed graph;

[0039] After all unknown causal pairs are tested, a potential causal graph consisting of multiple directed edges is obtained.

[0040] Optionally, the topological graph and the potential causal graph of the time series data to be tested are optimized simultaneously based on the THPs algorithm to obtain the topological structure and the causal structure of the time series data to be tested, including:

[0041] Input the warning data sequence X corresponding to the time series data to be tested, as well as the initial topology diagram and potential causal diagram

[0042] In the optimization process of the rth round, the topology graphs of the r-1th round are obtained based on the THPs algorithm. and causal diagram Perform optimization and update to obtain the topology map and cause-effect diagram

[0043] In the topology diagram With topology diagram Not the same, or cause and effect diagram Cause and effect diagram If they are not the same, the optimization process of the r+1th round will be started;

[0044] In the topology diagram With topology diagram Same, and the cause-effect diagram Cause and effect diagram In the same situation, based on the topology diagram and causal diagram The topological structure and causal structure of the time series data to be tested are obtained.

[0045] According to a second aspect of an embodiment of the present disclosure, a device for identifying an unknown topological causal structure based on a THPs algorithm is provided, the device comprising:

[0046] A preprocessing module is used to preprocess the time series events containing a number of warning data to obtain cleaned warning series data;

[0047] A dataset construction module is used to construct a pre-training dataset and a fine-tuning dataset based on the cleaned warning sequence data;

[0048] A training and fine-tuning module, used for training and fine-tuning the large language model on the post-pre-training dataset and the fine-tuning dataset;

[0049] The causal graph generation module is used to construct the potential causal graph of the time series data to be tested using the trained and fine-tuned large language model;

[0050] The structure recognition module is used to initialize the topological graph of the time series data to be tested, and optimize the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested.

[0051] According to the third aspect of an embodiment of the present disclosure, an electronic device is provided, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the unknown topological causal structure identification method based on the THPs algorithm provided in the first aspect of the present disclosure is implemented.

[0052] According to the fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the unknown topological causal structure identification method based on the THPs algorithm provided in the first aspect of the present disclosure is implemented.

[0053] The technical solution provided by the embodiments of the present disclosure includes at least the following beneficial effects:

[0054] 1. Since THPs can only play its maximum performance when the network topology is fully known, the present invention proposes a BITHPs algorithm based on THPs when the network topology is not fully known, which effectively solves the problem of causal structure identification under unknown topology.

[0055] 2. The present invention proposes a data cleaning method based on LSTM and Transformer, which effectively removes duplicate data in the original warning data and solves the redundancy problem of warning data.

[0056] 3. The present invention proposes a potential causal discovery method based on a large language model, which can discover potential causal relationships before executing the BITHPs algorithm, so that the BITHPs algorithm converges in advance. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a principle framework diagram of an unknown topological causal structure identification method based on the THPs algorithm according to an exemplary embodiment.

[0058] Figure 2 It is a flowchart of a method for identifying an unknown topological causal structure based on a THPs algorithm according to an exemplary embodiment.

[0059] Figure 3 is a diagram of a data deduplication framework according to an exemplary embodiment.

[0060] Figure 4 The diagram is a diagram showing an optimization process of a topology structure diagram according to an exemplary embodiment.

[0061] Figure 5 It is a block diagram of an unknown topological causal structure identification device based on THPs algorithm according to an exemplary embodiment.

[0062] Figure 6is a block diagram of an electronic device 600 according to an exemplary embodiment. DETAILED DESCRIPTION

[0063] The present invention is further described in detail below in conjunction with specific embodiments. The given examples are only for illustrating the present invention, rather than for limiting the scope of the present invention.

[0064] like Figure 1 and Figure 2 As shown, the present invention proposes a method for identifying unknown topological causal structures based on the THPs algorithm, which includes the following steps (step 1-step 5).

[0065] Step 1: Preprocess the time series events containing several warning data to obtain the cleaned warning series data.

[0066] Before the present invention recognizes the causal structure of time series events, it is necessary to preprocess the data. The warning data has four fields: alarm_id (warning ID), device_id (device ID), start_timestamp (warning occurrence timestamp), end_timestamp (warning end timestamp). The data example is as follows:

[0067]

[0068] Data preprocessing includes the following sub-steps (steps 1.1-1.3)

[0069] Step 1.1: Remove erroneous data.

[0070] Delete the records whose end timestamp is earlier than the start timestamp, that is, delete the records whose start_timestamp field value is greater than the end_timestamp field value. In the above example, delete the third record of the sample data.

[0071] Step 1.2: Discard data with duration below the set threshold.

[0072] Delete data with duration lower than the set threshold. In the above example, the set event duration threshold DurationTime = end_timestamp - start_timestamp = 2, then the data with duration less than 2 will be deleted, such as deleting the fourth item of the sample data.

[0073] Step 1.3: Remove similar data.

[0074] The data deduplication framework of the present invention is as follows Figure 3 As shown in the figure, the three steps are windowed data, unsupervised training and data deduplication.

[0075] Step 1.3.1: Window the data.

[0076] The preprocessed time series data is divided into fixed window lengths W, and the alarm_id and device_id information in each warning data is uniquely encoded, and the start_timestamp and end_timestamp information is standardized.

[0077] Step 1.3.2: Unsupervised training.

[0078] The sequence data of a window is used as an input. First, the feature embedding (implemented by a fully connected neural network) is used to embed the features of each sequence in the window into a fixed dimension d. The long-term dependencies in the sequence are extracted through LSTM Layers to obtain the output of LSTM Layers.

[0079] The present invention also constructs a training data set including warning data and snapshot data corresponding to the warning data. Among them, the snapshot data only includes warnings, and does not include the start timestamp, the end timestamp, and the device ID. The warning data is data containing 4 fields. Assuming that the snapshot data is (1,2,3,4,5,6),4, then warning 4 is the root cause of this scenario; assuming that the snapshot data is (2,3,4,5,6),3, then warning 3 is the root cause in this scenario. Afterwards, the snapshot data needs to be encoded: the encoding method is an index encoding method based on the number of occurrences of sequence elements, and the method encodes the number of occurrences of each element in the sequence. Suppose there is a snapshot data (0,1,2,3,4,5,6),4, and there are 10 warnings in total, then the encoding result is [1,1,1,1,2,1,1,0,0,0]. Finally, the encoded result is feature embedded and embedded into dimension d.

[0080] Next, the present invention concatenates the embedding result with the LSTM Layers output. Position encoding is performed on the concatenated result, and the position encoding result is passed through the Transformer Encoder Layers to achieve full attention to each position in the sequence. The result is feature-embedded again to reduce the dimension.

[0081] The result of feature embedding is decoded through Transformer Decoder Layers to restore the sequence, so that an encoder can be trained.

[0082] Step 1.3.3: Data deduplication.

[0083] The sequence data of each window is encoded by the above encoder to obtain the features of the window. The similarity is calculated based on different window features. Finally, the data with similarity higher than the threshold is removed. Finally, the sequence data after deduplication is obtained for subsequent causal result identification.

[0084] Step 2: Based on the cleaned warning sequence data, construct the pre-training dataset and fine-tuning dataset.

[0085] Step 2.1: Post-pre-training dataset construction

[0086] For the post-pre-training stage, self-supervision is used for training. The data set comes from the warning data. The format of each data contains input and output parts. The input is used as the input of the model, and the output is used to calculate the model loss and optimize the model capability. For the cleaned warning data X W ={x1,x2,x3,...,x W} represents the warning data corresponding to the window length W. Take the first half of the warning data X front ={x1,x2,x3,…,x W / 2} as input, warning data for the second half of the window As output. In order to align the representation of warning data with natural language, each warning data x is formatted to form a warning data text. Its format and specific examples are as follows:

[0087] Format: Alarm {alarm_id} occurs on device {device_id}, with a start timestamp of

[0088] {start_timestamp} and the end timestamp is {end_timestamp}.

[0089] Example: Warning 1 occurred on device 3 with a start timestamp of 15 and an end timestamp of 25.

[0090] If there are N warning data, the warning data is divided into N / W windows, and a training data is formed based on the sequence data of each window, thereby forming a post-pre-training data set.

[0091] Step 2.2: Fine-tuning dataset construction

[0092] For the data format in the fine-tuning stage, it contains three parts, namely the prompt, the input, and the output. Define a causal pair (i, j), indicating that warning i is the cause of warning j. Use TG to represent the true causal graph corresponding to the warning data, and TG contains multiple causal relationship pairs. The input comes from the determined causal relationships and specific warning data. First, obtain all causal pairs from the determined causal relationships: CausalPairSet = {(i, j) | (i, j) = 0 or (i, j) = 1 and (i, j) ∈ TG}, where (i, j) = 0 means warning i is not the cause of warning j; (i, j) = 1 means warning i is the cause of warning j. According to each causal pair (i, j), find the matching warning data x until a certain number of events L is satisfied. Finally, form which represents the p-th group of warning data corresponding to the causal pair (i, j). And form warning data texts for each warning data. Concatenate the warning data texts corresponding to L warning data as the input. For the output part, only use the Chinese characters "yes" or "no". Its expression is output = {"yes" | (i, j) = 1} or output = {"no" | (i, j) = 0}. The prompt is the natural language of the task description. The overall format and example of a single fine-tuning data are as follows:

[0093] Format: Prompt\nInput\nOutput

[0094] Example: You are a causal analysis expert and can determine the causal relationships between warnings from a sequence of warning data. The following is the sequence of warning data\n

[0095] Warning 1 occurred on device 3, with a start timestamp of 15 and an end timestamp of 25.\n

[0096] Warning 2 occurred on device 3, with a start timestamp of 16 and an end timestamp of 26.\n

[0097] …

[0098] Based on the above sequence of warning data, determine the causal relationship between warning i and warning j. If warning i is the cause of warning j, answer "yes", otherwise answer "no".

[0099] Step 3: Train and fine-tune the large language model on the post-pre-training dataset and the fine-tuning dataset.

[0100] The large language model used in this embodiment expands the original model by adding layers on the basis of an existing large model. Assume that the original model has M layers and the number of blocks to be expanded is N, where N < M. Then, after every M / N layers, copy the parameters of the previous layer as a new layer and insert it.

[0101] The expanded model is pre-trained and fine-tuned in sequence, so that the model can predict potential causal relationships based on sequence data.

[0102] Step 4: Use the trained and fine-tuned large language model to construct a potential causal graph for the time series data to be tested.

[0103] Using the trained and fine-tuned large language model, determine the unknown causal pairs one by one. The process of constructing the fine-tuning dataset is similar to that of the fine-tuning dataset, with the only difference being that there is no output. Construct a test set using the unknown causal pair set UnCausalPairSet = {(i,j)|(i,j) = -1 and (i,j)∈TG}. Select three pieces of data from the test set corresponding to each unknown causal relationship as the input of the model. If the number of times the model answers "yes" is higher than the number of times it answers "no", then warning i is the cause of warning j, otherwise it is not. If warning i is the cause of warning j, then in the directed graph, warning i has a directed edge pointing to warning j, otherwise there is no directed edge. Finally, multiple directed edges constitute a potential causal graph, allowing for rapid convergence in the subsequent steps.

[0104] Step 5: Initialize the topological graph of the time series data to be tested, and optimize the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested.

[0105] THPs describes that the topological dependencies between warning sequences may lead to the false detection of causal structures. It proposes a topological Hawkes process (THP) by considering the Hawkes process from the perspective of temporal convolution to establish a connection between graph convolution in the topological domain and temporal convolution in the time domain. And further proposes a causal structure learning method for THPs in the likelihood framework. The method has a THP likelihood function based on graph convolution and a sparse optimization scheme with expected maximization of the likelihood function. Theoretical analysis and experiments on synthetic data and real data prove the effectiveness of the proposed method. However, in practical applications, the topological structure between nodes cannot be fully obtained, which will limit the performance of THPs. Therefore, based on THPs, the present invention proposes a BITHPs algorithm that can simultaneously obtain the optimal topological graph and causal graph.

[0106] This method only adds the optimization process of the topology graph on the basis of the original algorithm. The optimization process of the topology graph adopts the same method as the optimization of the causal graph. Traverse all possible topology graphs, and then calculate the likelihood value under this topology graph. If the new likelihood value is less than the optimal likelihood value, save the topology graph as the current optimal topology graph, otherwise do not save it, and perform the same calculation on the next topology graph. Each traversal will find the optimal topology graph under the current causal graph structure. When the topology graph changes, the causal graph is optimized in the same way. And so on, the optimal topology graph and causal graph are finally obtained.

[0107] like Figure 4 As shown, the main steps of the BITHPs embodiment are as follows:

[0108] 1. Input warning data X and initial topology map and causal diagram Among them, an all-zero graph can be generated for unknown topological structures.

[0109] 2. Record the results before optimization as set up As the current optimal causal diagram, set the optimal likelihood value is negative infinity, setting the likelihood value

[0110] 3. Randomly initialize parameter Θ * , Θ is the parameter of THPs algorithm.

[0111] 4. Enter the loop and perform the following operations in each loop:

[0112] a. The current optimal solution Assign to

[0113] b.Yes Each of Do the following:

[0114] i. Randomly initialize parameters Θ ′ .

[0115] ii. Repeatedly update Θ ′ and L ′ B Until convergence.

[0116] c. From all updated Select L ′ B The largest one is the new optimal solution

[0117] 5. Update

[0118] 6. Yes Perform a similar optimization process and update

[0119] 7. Determine the current optimal solution and Is it the optimal solution of the previous iteration? and Are they unchanged? If so, exit the loop; otherwise, continue to the next iteration.

[0120] 8. Output the final optimal topology map and the optimal causal graph

[0121] Through this embodiment, the present invention can effectively search for the optimal topology graph and the optimal causal graph.

[0122] In summary, the present invention obtains an encoder by training on existing data, encodes multiple groups of warning data and calculates the similarity of each group of warning data, and finally removes the warning data with a similarity higher than a threshold. This method removes redundant data and has less impact on the final result, and effectively improves data cleaning efficiency.

[0123] The present invention constructs a pre-training data set, a fine-tuning data set, and a test set in the warning data, and then injects the warning data into the model through model expansion and fine-tuning. Finally, the causal relationship of multiple unknown causal relationship pairs is confirmed by large model reasoning and represented by directed edges, and finally multiple directed edges are combined into a potential causal relationship graph. The method realizes the extraction of the potential causal relationship graph, so that BITHPs can converge in advance.

[0124] The present invention adds a topology graph optimization process on the basis of THPs, so that the algorithm can finally obtain the optimal causal graph and topology graph at the same time. This method makes up for the shortcomings of THPs and can bring out the performance of THPs even in the case of unknown topology graph.

[0125] Exemplary Devices

[0126] Figure 5 is a device for identifying unknown topological causal structures based on THPs algorithm according to an exemplary embodiment, referring to Figure 5 The device includes: a preprocessing module 510, a data set construction module 520, a training and fine-tuning module 530, a causal graph generation module 540 and a structure recognition module 550.

[0127] A preprocessing module 510 is used to preprocess the time series events containing a plurality of warning data to obtain cleaned warning series data;

[0128] A data set construction module 520 is used to construct a pre-training data set and a fine-tuning data set based on the cleaned warning sequence data;

[0129] A training and fine-tuning module 530, configured to train and fine-tune the large language model on the post-pre-training dataset and the fine-tuning dataset;

[0130] A causal graph generation module 540 is used to construct a potential causal graph of the time series data to be tested using the trained and fine-tuned large language model;

[0131] The structure recognition module 550 is used to initialize the topological graph of the time series data to be tested, and optimize the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested.

[0132] The preprocessing module 510 is also used to: convert the time series event into warning sequence data according to the set warning data field; wherein the warning data field includes: warning ID, device ID, warning occurrence timestamp and warning end timestamp; delete the warning sequence data whose warning end timestamp is earlier than the warning occurrence timestamp and whose warning duration is lower than the set threshold, to obtain the preprocessed warning sequence data; wherein the warning duration is obtained according to the warning occurrence timestamp and the warning end timestamp; divide the preprocessed warning sequence data into a fixed window length W, and perform unique hot encoding on the warning ID and device ID in each warning data, and obtain the corresponding window sequence data after standardizing the warning occurrence timestamp and the warning end timestamp; encode the window sequence data using an encoder to obtain the characteristics of the window sequence data; perform similarity calculation based on the characteristics of the window sequence data, and remove the window sequence data with a similarity higher than the set value to obtain the cleaned warning sequence data.

[0133] The preprocessing module 510 is also used to: construct a training data set, which includes a number of warning data and snapshot data corresponding to the warning data; encode the snapshot data, and perform feature embedding on the encoding result to obtain an embedding result; extract the long-term dependency in the window sequence data through LSTM Layers to obtain the LSTM Layers output; splice the embedding result with the LSTM Layers output, and perform position encoding on the spliced ​​result; after passing the position encoding result through Transformer Encoder Layers, perform feature embedding on the Transformer Encoder Layers output, and decode the feature embedding result through Transformer Decoder Layers to obtain the restored window sequence data; adjust the parameters of the encoder based on the window sequence data and the restored window sequence data.

[0134] The data set construction module 520 is further used to: for the cleaned warning sequence data X W ={x1,x2,...,x t ,...,x W}, take the first half of the warning data to form the warning sequence data X front ={x1,x2,x3,…,x W / 2}, take the second half of the warning data to form the warning sequence data Where W is the time window length used in the preprocessing process, x t For warning sequence data X W The t-th warning data contained in the warning sequence data X front ={x1,x2,x3,…,x W / 2} and warning sequence data Each warning data x t Perform formatting to form the first warning data text, and convert the warning sequence data X front and warning sequence data X end The corresponding first warning data texts are concatenated respectively to obtain input data and output data of a piece of training data in the post-pre-training data set.

[0135] The data set construction module 520 is further used to: obtain a set of all causal pairs (i, j) CausalPairSet from the determined causal relationship; wherein (i, j) = 0 indicates that warning i is not the cause of warning j, and (i, j) = 1 indicates that warning i is the cause of warning j; according to each causal pair (i, j), in the cleaned warning sequence data X W ={x1,x2,...,x t ,...,x WFind L corresponding warning data in} to form the p - th warning data sequence corresponding to the causal pair (i, j). where W is the length of the time window used in the pre - processing, and x t is the t - th warning data included in the warning sequence data X W ; Format each warning data in the warning data sequence to form a second warning data text, and splice the second warning data texts to obtain the input data of a training data in the fine - tuning dataset; where, the output data of the training data is: Determine the causal relationship between warning i and warning j according to the sequence warning data. If warning i is the cause of warning j, answer yes, otherwise answer no.

[0136] The large - language model is the extended large - language model; the training and fine - tuning module 530 is further configured to: Obtain a large - language model with M layers; Determine the number of blocks N to be extended, N < N; After every M / N layers, copy the parameters of the previous layer as a new layer and insert it.

[0137] The causal graph generation module 540 is further configured to: Generate an unknown causal pair set of the time - series data to be measured and the test set corresponding to each unknown causal pair; Select several data from the test set corresponding to each unknown causal pair as the input of the large - language model; If the number of the causal relationship that warning i is the cause of warning j output by the large - language model is greater than the number of the causal relationship that warning i is not the cause of warning j, add a directed edge from warning i to warning j in the directed graph; After all unknown causal pairs are tested, obtain a potential causal graph composed of multiple directed edges.

[0138] The structure recognition module 550 is further configured to: Input the warning data sequence X corresponding to the time - series data to be measured, as well as the initial topological graph and the potential causal graph In the r - th round of optimization process, based on the THPs algorithm, optimize and update the topological graph and the causal graph obtained in the (r - 1) - th round respectively, to obtain the topological graph and the causal graph In the case that the topological graph is not the same as the topological graph , or the causal graph is not the same as the causal graph , enter the (r + 1) - th round of optimization process; In the case that the topological graph is the same as the topological graph , and the causal graph is the same as the causal graph , based on the topological graph and the causal graph The topological structure and causal structure of the time series data to be tested are obtained.

[0139] The exemplary device is an embodiment of the device corresponding to the above exemplary method. The specific operations of each module can be understood by referring to the description of the method embodiment, which will not be repeated here.

[0140] Exemplary Electronic Devices

[0141] Figure 6 1 is a block diagram of an electronic device 600 according to an exemplary embodiment. The electronic device 600 may be a terminal, a notebook computer, a desktop computer, a server, a computer cluster or other types of electronic devices.

[0142] Reference Figure 6 , the electronic device 600 may include at least one processor 610 and a memory 620. The processor 610 may execute instructions stored in the memory 620. The processor 610 is communicatively connected to the memory 620 via a data bus. In addition to the memory 620, the processor 610 may also be communicatively connected to an input device 630, an output device 640, and a communication device 650 via a data bus.

[0143] The processor 610 may be any conventional processor, such as a central processing unit (CPU), a graphic processing unit (GPU), a field programmable gate array (FPGA), a system on chip (SOC), an application specific integrated circuit (ASIC), or a combination thereof.

[0144] The memory 620 may be implemented by any type of volatile or nonvolatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0145] In the embodiment of the present disclosure, executable instructions are stored in the memory 620, and the processor 610 can read the executable instructions from the memory 620 and execute the instructions to implement all or part of the steps of the unknown topological causal structure identification method based on the THPs algorithm in the above exemplary embodiment.

[0146] Exemplary computer-readable storage media

[0147] In addition to the above methods and devices, the exemplary embodiments of the present disclosure also include a computer program product or a computer-readable storage medium storing the computer program product. The computer product includes computer program instructions that can be executed by a processor to implement all or part of the steps described in the above exemplary embodiments.

[0148] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and also conventional procedural programming languages, such as "C" language or similar programming languages ​​and scripting languages ​​(e.g., Python). The program code may be executed entirely on the user computing device, partially on the user computing device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0149] Computer readable storage media can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of readable storage media include: static random access memory (SRAM) with one or more wires electrically connected, electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk, or any suitable combination of the above.

[0150] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof.

Claims

1. A method for identifying unknown topological causal structures based on THPs algorithm, characterized in that: The method comprises: Preprocessing the time series events containing several warning data to obtain cleaned warning series data; Based on the cleaned warning sequence data, construct the pre-training dataset and fine-tuning dataset; Training and fine-tuning the large language model on the post-pretraining dataset and the fine-tuning dataset; Use the trained and fine-tuned large language model to construct a potential causal graph for the time series data to be tested; Initialize the topological graph of the time series data to be tested, and optimize the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested.

2. The method according to claim 1, characterized in that The time series events are preprocessed to obtain a number of warning sequence data, including: According to the set warning data field, the time series event is converted into warning sequence data; wherein the warning data field includes: warning ID, device ID, warning occurrence timestamp and warning end timestamp; Deleting warning sequence data whose warning end timestamp is earlier than the warning occurrence timestamp and whose warning duration is lower than a set threshold, to obtain preprocessed warning sequence data; wherein the warning duration is obtained according to the warning occurrence timestamp and the warning end timestamp; The preprocessed warning sequence data is divided into fixed window lengths W, and the warning ID and device ID in each warning data are uniquely encoded. The warning occurrence timestamp and the warning end timestamp are standardized to obtain the corresponding window sequence data. Encode the window sequence data using an encoder to obtain features of the window sequence data; The similarity is calculated according to the characteristics of the window sequence data, and the window sequence data with similarity higher than the set value is removed to obtain the cleaned warning sequence data.

3. The method according to claim 2, characterized in that The process of training the encoder includes: Constructing a training data set, wherein the training data set includes a plurality of warning data and snapshot data corresponding to the warning data; Encode the snapshot data, and perform feature embedding on the encoding result to obtain the embedding result; The long-term dependency in the window sequence data is extracted through LSTM Layers to obtain LSTM Layers output; Concatenate the embedding results with the LSTM Layers output and perform position encoding on the concatenated results; After the position encoding result passes through Transformer Encoder Layers, the output of Transformer Encoder Layers is feature embedded, and the feature embedding result is decoded through Transformer Decoder Layers to obtain the restored window sequence data; Based on the window sequence data and the restored window sequence data, the parameters of the encoder are adjusted.

4. The method according to claim 1, characterized in that: The post-pre-training data set is constructed based on the cleaned warning sequence data, including: For the cleaned warning sequence data X W ={x1,x2,...,x t ,...,x W }, take the first half of the warning data to form the warning sequence data X front ={x1,x2,x3,…,x W / 2 }, take the second half of the warning data to form the warning sequence data Where W is the time window length used in the preprocessing process, x t For warning sequence data X W The tth warning data contained in; For warning sequence data X front ={x1,x2,x3,…,x W / 2 } and warning sequence data Each warning data x t Perform formatting to form the first warning data text, and convert the warning sequence data X front and warning sequence data X end The corresponding first warning data texts are concatenated respectively to obtain input data and output data of a piece of training data in the post-pre-training data set.

5. The method according to claim 1, characterized in that Based on the cleaned warning sequence data, a fine-tuning dataset is constructed, including: Obtain a set of all causal pairs (i, j) CausalPairSet from the determined causal relationship; wherein (i, j) = 0 indicates that warning i is not the cause of warning j, and (i, j) = 1 indicates that warning i is the cause of warning j; According to each causal pair (i, j), in the cleaned warning sequence data X W ={x1,x2,...,x t ,...,x W } to find L corresponding warning data to form the pth group of warning data sequence corresponding to the causal pair (i, j) Where W is the time window length used in the preprocessing process, x t For warning sequence data X W The tth warning data contained in; For warning data sequence Each warning data in is formatted to form a second warning data text, and the second warning data text is spliced ​​to obtain the input data of a training data in the fine-tuning data set; wherein the output data of the training data is: determine the causal relationship between warning i and warning j according to the sequence warning data, if warning i is the cause of warning j, the answer is yes, otherwise the answer is no.

6. The method according to claim 1, characterized in that The large language model is an expanded large language model; and the process of constructing the expanded large language model includes: Get a large language model with M layers; Determine the number of blocks N, N that need to be expanded <M; After every M / N layers, copy the parameters of the previous layer and insert it as a new layer.

7. The method according to claim 1, characterized in that Using the trained and fine-tuned large language model, we construct a potential causal graph of the time series data to be tested, including: Generate a set of unknown causal pairs of time series data to be tested and a test set corresponding to each unknown causal pair; Select several pieces of data from the test set corresponding to each unknown causal pair as input to the large language model; If the number of causal relationships of warning i output by the large language model is greater than the number of causal relationships of warning i not being warning j, then add a directed edge from warning i to warning j in the directed graph; After all unknown causal pairs are tested, a potential causal graph consisting of multiple directed edges is obtained.

8. The method according to claim 1, characterized in that Based on the THPs algorithm, the topological graph and potential causal graph of the time series data to be tested are optimized simultaneously to obtain the topological structure and causal structure of the time series data to be tested, including: Input the warning data sequence X corresponding to the time series data to be tested, as well as the initial topology diagram and potential causal diagram In the optimization process of the rth round, the topology graphs of the r-1th round are obtained based on the THPs algorithm. and causal diagram Perform optimization and update to obtain the topology map and causal diagram In the topology diagram With topology diagram Not the same, or cause and effect diagram Cause and effect diagram If they are not the same, the optimization process of the r+1th round will be started; In the topology diagram With topology diagram Same, and the cause-effect diagram Cause and effect diagram In the same situation, based on the topology diagram and causal diagram The topological structure and causal structure of the time series data to be tested are obtained.

9. A device for identifying unknown topological causal structures based on THPs algorithm, characterized in that: The device comprises: A preprocessing module is used to preprocess the time series events containing a number of warning data to obtain cleaned warning series data; A dataset construction module is used to construct a pre-training dataset and a fine-tuning dataset based on the cleaned warning sequence data; A training and fine-tuning module, used for training and fine-tuning the large language model on the post-pre-training dataset and the fine-tuning dataset; The causal graph generation module is used to construct the potential causal graph of the time series data to be tested using the trained and fine-tuned large language model; The structure recognition module is used to initialize the topological graph of the time series data to be tested, and optimize the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the unknown topological causal structure identification method based on the THPs algorithm as described in any one of claims 1 to 8 is implemented.

Images