Root cause association method and device under multi-alarm condition among root cause analysis equipment

Abstract

The invention discloses a root cause association method and device under the condition of multiple alarms between root cause analysis devices, and the method comprises the steps: S01, obtaining historical alarm information and device topological information, obtaining the historical alarm information, carrying out the modeling through employing the alarm information, obtaining the topological relation data of a target region device, and carrying out the modeling through employing the topological relation data; the topological relation data describes the connection relation between the devices; s02, historical alarm information processing: processing the historical alarm information one by one and modeling; s03, modeling a causal relationship of historical alarm information; and S04, reasoning a root cause relationship in real time by using a causal relationship model. According to the invention, many-to-many root cause relationship mining between device alarms is solved, and many-to-many causal relationships between different device alarms are obtained through a neural network modeling mode, thereby helping to judge a root cause path.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a method and a device for correlating root causes in a multi-alarm situation between root cause analysis devices. Background Art

[0002] When performing root cause analysis of alarms between devices, it is common that multiple alarms of different types appear on a device within a short period of time. Common causal analysis algorithms, such as GES, which uses greedy search to learn Bayesian networks, and PC, which is a constraint-based causal discovery algorithm, all perform one-to-one causal judgments on different alarm types. We usually need to first select an alarm on each device, and then determine whether there is a connection between the alarms of adjacent devices. In this way, when multiple alarms of different types occur on the same device, the above method will lose a lot of effective information, resulting in inaccurate causal inference. Summary of the invention

[0003] In order to solve the problems existing in the prior art, the present invention provides a root cause correlation method and device for root cause analysis in the case of multiple alarms between devices, solves the many-to-many root cause relationship mining between device alarms, and obtains the many-to-many causal relationship between different device alarms through neural network modeling, thereby helping to determine the root cause path.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] In one embodiment of the present invention, a root cause correlation method for multiple alarms between root cause analysis devices is proposed, and the method includes:

[0006] S01. Obtain historical alarm information and device topology information. Obtain historical alarm information, use the alarm information to perform modeling, and obtain topological relationship data of devices in a target area. The topological relationship data describes the connection relationship between devices.

[0007] Furthermore, the historical alarm information is historical data of alarm information generated by the target area equipment, and the acquired historical alarm information includes three fields: the device ID where the alarm occurred, the type of alarm that occurred, and the time when the alarm occurred.

[0008] Furthermore, the historical alarm information includes no less than 6 months of historical data, totaling no less than 100,000 pieces of historical alarm data.

[0009] S02: Processing historical alarm information: processing and modeling historical alarm information one by one;

[0010] Further, the S02 includes:

[0011] S021. Count all alarm types that occurred in historical data and store them in a list format;

[0012] Furthermore, the alarm types in S021 include: alarm types that have not appeared in the training process, which are other types of alarms, and the alarm type list is saved, and the list will be used in subsequent processing and reasoning services;

[0013] S022, traversing all historical alarm data one by one, and calculating to obtain an alarm history vector relationship table formed by the historical data;

[0014] Furthermore, the calculation performed in S022 includes:

[0015] S0221. According to the occurrence time of the current alarm, all historical alarm data occurring within the time slice are intercepted. The default time slice is 5 minutes.

[0016] S0222. Group the data of different device IDs in the time slice. If the same device has multiple different types of features in the time slice, they are considered as multiple features.

[0017] S0223. Take the device where the alarm occurs as the starting node and query the devices within one hop of the node through the device topology relationship.

[0018] S0224. If the queried device generates an alarm within the time slice, both the starting device and the end device are removed. The end device is a device that is found to be one-hop associated with the starting node in the topology.

[0019] S0225. If the queried device generates multiple alarms within the time slice, they are considered as multiple pieces of data and processed one by one, and the alarms generated on the starting and ending devices are taken out;

[0020] S0226. According to the alarm type list, convert the alarm into a 0,1 vector form, for example, [0,1,0,0,0,1…];

[0021] S0227. The converted alarm vectors of the starting device and the end device are recorded as fromAlarm and toAlarm respectively, and recorded in the final summary data.

[0022] S023. In the previous step, we obtained the alarm history vector relationship table formed by all historical data, which is divided into two columns, denoted as fromAlarm and toAlarm. Currently, the data in these two columns are in vector form. Construct a convergence target for causal modeling.

[0023] S0231. Use the conditional probability formula p(A│B)=(P(AB)) / (p(B)) to calculate the probability of toAlarm occurring when the fromAlarm condition occurs;

[0024] S0232. Count the number of occurrences of different fromAlarm types, and count the number of occurrences of different fromAlarm and toAlarm combinations. After associating the two data through fromAlarm, we can get the conditional probability value by dividing them, which we record as ratio, that is, the predicted target value.

[0025] S03, causal relationship modeling of historical alarm information;

[0026] After the previous step, we have obtained data that can be used for modeling. The data is divided into three columns: fromAlarm multi-dimensional alarm features, toAlarm multi-dimensional alarm features, and ratio is the predicted target value.

[0027] Further, the S03 includes:

[0028] S031. Use the pytroch framework to build a multi-layer MLP neural network and train a regression model.

[0029] like Figure 2 As shown, further, the structure of the neural network regression model in S031 is:

[0030] The input of the model includes two multi-dimensional alarm feature vectors, fromAlarm and toAlarm. Three fully connected layers are connected in series under the feature vector of fromAlarm, and one fully connected layer is connected in series under the feature vector of toAlarm.

[0031] The fully connected layer is a network structure in deep learning that is used to process data. It connects each node to all nodes in the previous layer to integrate the features extracted previously and can be used to build a neural network.

[0032] The output results of the linear layer under the multi-dimensional alarm feature vector route of fromAlarm and toAlarm are passed through a bilinear transformation layer to obtain an output value, and the output value is the probability of generating a probability value, and the multi-dimensional vector of fromAlarm leads to the multi-dimensional vector of toAlarm.

[0033] The bilinear transformation layer is a network structure in deep learning that is used to process data. It can calculate the matching degree of two vectors and can be used to build neural networks.

[0034] S032. Use mse as the loss function during model training and fitting, fit the model output value with the calculated ratio, and then iterate the model training;

[0035] S033. After the model training is completed, the regression model constructed by the neural network will be saved for use in subsequent prediction services.

[0036] S04. Use the causal relationship model to infer the root cause relationship in real time.

[0037] Further, the S04 includes:

[0038] In the above steps, we have obtained a list of alarm types and a causal relationship model between multi-dimensional alarms. Then we need to use this information to reason about the alarm information that occurs in real time.

[0039] S041. Obtain all alarms that occurred in the target area devices within the time slice before the current alarm, and query the neighboring devices of all the alarm-generating devices through the device topology relationship based on the devices where these alarms occurred;

[0040] S042. Then, in the connection relationship, the devices that have not generated an alarm are filtered out from the adjacent devices, and only the devices that have generated an alarm are retained for processing;

[0041] S043. Construct an undirected graph, write all the acquired devices with alarms and connection relationships into the graph, and add the connection relationships of device nodes and edges;

[0042] S044. After constructing a complete undirected graph, the complete graph is divided into several connected subgraphs according to the connection relationship between the points. The basis for division is whether there is a connection relationship between the node groups. If there is no connection relationship, the nodes in each subgraph after division are directly connected to each other.

[0043] S045. Traverse all subgraphs once;

[0044] Further, the S045 includes:

[0045] S0451. Create a new directed graph space, traverse each edge in the subgraph, take out the nodes at both ends of the edge, and use the alarm type list generated during training to obtain the feature vectors of the alarm components corresponding to the nodes at both ends respectively;

[0046] S0452. Substitute the alarm feature vectors at both ends into the multi-dimensional alarm causal relationship model, and use them as the starting point and the end point to obtain two different weights. For example, devices A and B can be substituted into the model A->B and B->A to obtain different weight values;

[0047] S0453. Take the starting point and end point corresponding to the direction of the higher weight value calculated as the starting point of causal inference. At the same time, when the weight value is greater than the preset threshold, the threshold defaults to 0.2, and the starting point, end point and weight value of the directed edge are added to the directed graph space.

[0048] Furthermore, the two weight values ​​calculated in S0452 are the same, the earliest alarm time of the two nodes is compared, the node with the earlier time is taken as the starting point, and the starting point, end point and weight of the directed edge are added to the directed graph space.

[0049] S0454. After all the edges of each single subgraph are calculated in the previous step, a directed connection relationship of all the nodes in the subgraph is formed in a directed graph space. Through the concept of in-degree in graph theory, all nodes with in-degree of 0 are found and regarded as root nodes.

[0050] So far, we have completed the causal inference in the case of multiple alarms between devices, inferred the causal relationship between different devices in the case of multiple alarms, obtained the direction of causality between devices, and obtained the root node by combining the in-degree concept of graph theory.

[0051] In one embodiment of the present invention, a root cause correlation device for multiple alarms between root cause analysis devices is also proposed, the device comprising:

[0052] The alarm and topology information acquisition module obtains historical alarm information and device topology information, obtains historical alarm information, and uses the alarm information to build models to obtain the topological relationship data of the target area devices. The topological relationship data describes the connection relationship between the devices.

[0053] Alarm information processing module, historical alarm information processing, process and model the historical alarm information one by one;

[0054] Causal relationship modeling module, historical alarm information causal relationship modeling;

[0055] The reasoning module,uses the causal relationship model to infer the root cause relationship in real time.

[0056] Furthermore, the historical alarm information in the alarm and topology information acquisition module is: historical data of alarm information generated by the target area equipment; the historical alarm information obtained in the alarm and topology information acquisition module includes 3 fields: the device ID where the alarm occurred, the type of alarm that occurred, and the time when the alarm occurred.

[0057] Furthermore, the historical alarm information in the alarm and topology information acquisition module includes: no less than 6 months of historical data, totaling no less than 100,000 historical alarm data.

[0058] Furthermore, the alarm information processing module includes:

[0059] All alarm type data occurring in the statistical module and statistical historical data are stored in the form of a list;

[0060] The alarm history vector relationship table module traverses all historical alarm data one by one and calculates the alarm history vector relationship table formed by the historical data;

[0061] Model building module,constructs convergence objectives for causal modeling.

[0062] Furthermore, the alarm types in the statistical module include: alarm types that have not appeared in the training process and other types of alarms.

[0063] Furthermore, the calculation performed by the alarm history vector relationship table module includes:

[0064] The historical alarm data interception module intercepts all historical alarm data occurring within the time slice according to the occurrence time of the current alarm;

[0065] The grouping module groups the data of different device IDs in the time slice. If the same device has multiple different types of features in the time slice, they are considered as multiple features.

[0066] The topology query module uses the device where the alarm occurs as the starting node and queries the devices within one hop of the node through the device topology relationship;

[0067] If the device removal module and the queried device generate an alarm within the time slice, both the starting device and the end device are removed. The end device is a device that is found to be associated with the starting node by one hop in the topology.

[0068] If multiple alarm modules and the queried devices generate multiple alarms within the time slice, they are considered as multiple pieces of data and processed one by one, and the alarms generated on the starting and ending devices are taken out;

[0069] The alarm conversion module converts the alarm into a 0,1 vector according to the alarm type list;

[0070] The alarm vectors converted by the alarm vector recording module, the starting device and the end device are recorded as fromAlarm and toAlarm respectively, and recorded in the final summary data.

[0071] Furthermore, the model building module includes:

[0072] The probability calculation module uses the conditional probability formula p(A│B)=(P(AB)) / (p(B)) to calculate the probability of toAlarm occurring when the fromAlarm condition occurs;

[0073] The predicted target value calculation module counts the number of occurrences of different fromAlarm types and the number of occurrences of different fromAlarm and toAlarm combinations. After associating the two data through fromAlarm, the conditional probability value can be obtained by division, which we record as ratio, that is, the predicted target value.

[0074] Furthermore, the causal relationship modeling module includes:

[0075] Regression model training module, using the pytroch framework to build a multi-layer MLP neural network and train a regression model;

[0076] Iteratively train the model module, use mse as the loss function during model training and fitting, fit the model output value with the calculated ratio, and then iteratively train the model;

[0077] After the model saving module and model training are completed, the regression model constructed by the neural network will be saved for use in subsequent prediction services.

[0078] Furthermore, the structure of the neural network regression model in the regression model training module includes:

[0079] The input of the model includes two multi-dimensional alarm feature vectors, fromAlarm and toAlarm. Three fully connected layers are connected in series under the feature vector of fromAlarm, and one fully connected layer is connected in series under the feature vector of toAlarm.

[0080] The output results of the linear layer under the multi-dimensional alarm feature vector route of fromAlarm and toAlarm are passed through a bilinear transformation layer to obtain an output value, and the output value is the probability of generating a probability value, and the multi-dimensional vector of fromAlarm leads to the multi-dimensional vector of toAlarm.

[0081] Furthermore, the reasoning module includes:

[0082] The alarm device query module obtains the current alarm and all the alarms that occurred in the target area devices in the previous time slice. According to the devices where these alarms occurred, the adjacent devices of all the alarm devices are queried through the device topology relationship;

[0083] The alarm device retention module then filters out the devices without alarms in the adjacent devices in the connection relationship, and only retains the devices with alarms for processing;

[0084] Undirected graph construction module, builds an undirected graph, writes all the acquired devices with alarms and connection relationships into the graph, and adds the connection relationships between device nodes and edges;

[0085] The connected subgraph segmentation module divides the complete undirected graph into several connected subgraphs according to the connection relationship between the points after constructing it. The basis for segmentation is whether there is a connection relationship between the node groups. If there is no connection relationship, the nodes in each subgraph after segmentation are directly connected to each other.

[0086] Subgraph traversal module, traverses all subgraphs once;

[0087] Furthermore, the subgraph traversal module includes:

[0088] The feature vector acquisition module creates a new directed graph space, traverses each edge in the subgraph, takes out the nodes at both ends of the edge, and uses the alarm type list generated during training to obtain the feature vectors of the alarm components corresponding to the nodes at both ends.

[0089] Two weight acquisition modules, substitute the alarm feature vectors at both ends into the multi-dimensional alarm causal relationship model, and use them as the starting point and the end point to obtain two different weights;

[0090] The high weight value module takes the starting point and end point corresponding to the direction of the higher weight value calculated as the starting point of causal inference. At the same time, when the weight value is greater than the preset threshold, the starting point, end point and weight value of the directed edge are added to the directed graph space.

[0091] The root node inference module forms a directed connection relationship between all nodes in the subgraph in a directed graph space, and through the concept of in-degree in graph theory, finds all nodes with in-degree 0 and regards them as root nodes.

[0092] Furthermore, the two weight values ​​calculated in the two weight acquisition modules are the same, the earliest alarm time of the two nodes is compared, the node with the earlier time is taken as the starting point, and the starting point, end point and weight of the directed edge are added to the directed graph space.

[0093] In one embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the root cause correlation method in the case of multiple alarms between the aforementioned root cause analysis devices is implemented.

[0094] In one embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program for executing a root cause correlation method in a case of multiple alarms between root cause analysis devices.

[0095] Beneficial effects:

[0096] The present invention provides a root cause correlation method and device for root cause analysis between multiple alarms between devices, which solves the problem that common causal inference algorithms can only analyze causal relationships one-to-one. When multiple alarms of different types occur between devices, the causal relationship between the devices can also be inferred through a model. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 It is a flow chart of a root cause correlation method under the condition of multiple alarms between root cause analysis devices of the present invention;

[0098] Figure 2 It is a diagram of the neural network structure;

[0099] Figure 3 is a cause-effect relationship diagram between the first group of devices in the method embodiment;

[0100] Figure 4 is a cause-effect relationship diagram between the second group of devices in the method embodiment;

[0101] Figure 5 It is a schematic diagram of the structure of the root cause correlation device in the case of multiple alarms between root cause analysis devices of the present invention;

[0102] Figure 6 It is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0103] The principles and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present invention, and are not intended to limit the scope of the present invention in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0104] Those skilled in the art will appreciate that the embodiments of the present invention may be implemented as a system, device, apparatus, method or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0105] According to an embodiment of the present invention, a root cause correlation method and apparatus for root cause analysis in the case of multiple alarms between devices are proposed to solve the many-to-many root cause relationship mining between device alarms, and obtain the many-to-many causal relationship between different device alarms through neural network modeling, thereby helping to determine the root cause path.

[0106] The principle and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0107] like Figure 1 As shown, the present invention relates to a root cause correlation method under the condition of multiple alarms between root cause analysis devices, the method comprising:

[0108] S01. Obtain historical alarm information and device topology information. Obtain historical alarm information, use the alarm information to perform modeling, and obtain topological relationship data of devices in a target area. The topological relationship data describes the connection relationship between devices.

[0109] The historical alarm information is the historical data of alarm information generated by the target area equipment. The acquired historical alarm information includes three fields: the device ID where the alarm occurred, the type of alarm that occurred, and the time when the alarm occurred.

[0110] The historical alarm information includes no less than 6 months of historical data, totaling no less than 100,000 pieces of historical alarm data.

[0111] S02: Processing historical alarm information: processing and modeling historical alarm information one by one;

[0112] The S02 includes:

[0113] S021. Count all alarm types that occurred in historical data and store them in a list format;

[0114] The alarm types in S021 include: alarm types that have not appeared in the training process, other types of alarms, and the alarm type list is saved, which will be used in subsequent processing and reasoning services;

[0115] S022, traversing all historical alarm data one by one, and calculating to obtain an alarm history vector relationship table formed by the historical data;

[0116] The calculations performed in S022 include:

[0117] S0221. According to the occurrence time of the current alarm, all historical alarm data occurring within the time slice are intercepted. The default time slice is 5 minutes.

[0118] S0222. Group the data of different device IDs in the time slice. If the same device has multiple different types of features in the time slice, they are considered as multiple features.

[0119] S0223. Take the device where the alarm occurs as the starting node and query the devices within one hop of the node through the device topology relationship.

[0120] S0224. If the queried device generates an alarm within the time slice, both the starting device and the end device are removed. The end device is a device that is found to be one-hop associated with the starting node in the topology.

[0121] S0225. If the queried device generates multiple alarms within the time slice, they are considered as multiple pieces of data and processed one by one, and the alarms generated on the starting and ending devices are taken out;

[0122] S0226. According to the alarm type list, convert the alarm into a 0,1 vector form, for example, [0,1,0,0,0,1…];

[0123] S0227. The converted alarm vectors of the starting device and the end device are recorded as fromAlarm and toAlarm respectively, and recorded in the final summary data.

[0124] S023. In the previous step, we obtained the alarm history vector relationship table formed by all historical data, which is divided into two columns, denoted as fromAlarm and toAlarm. Currently, the data in these two columns are in vector form. Construct a convergence target for causal modeling.

[0125] S0231. Use the conditional probability formula p(A│B)=(P(AB)) / (p(B)) to calculate the probability of toAlarm occurring when the fromAlarm condition occurs;

[0126] S0232. Count the number of occurrences of different fromAlarm types, and count the number of occurrences of different fromAlarm and toAlarm combinations. After associating the two data through fromAlarm, we can get the conditional probability value by dividing them, which we record as ratio, that is, the predicted target value.

[0127] S03, causal relationship modeling of historical alarm information;

[0128] After the previous step, we have obtained data that can be used for modeling. The data is divided into three columns: fromAlarm multi-dimensional alarm features, toAlarm multi-dimensional alarm features, and ratio is the predicted target value.

[0129] The S03 includes:

[0130] S031. Use the pytroch framework to build a multi-layer MLP neural network and train a regression model.

[0131] like Figure 2 As shown, the structure of the neural network regression model in S031 is:

[0132] The input of the model includes two multi-dimensional alarm feature vectors, fromAlarm and toAlarm. Three fully connected layers are connected in series under the feature vector of fromAlarm, and one fully connected layer is connected in series under the feature vector of toAlarm.

[0133] The fully connected layer is a network structure in deep learning that is used to process data. It connects each node to all nodes in the previous layer to integrate the features extracted previously and can be used to build a neural network.

[0134] The output results of the linear layer under the multi-dimensional alarm feature vector route of fromAlarm and toAlarm are passed through a bilinear transformation layer to obtain an output value, and the output value is the probability of generating a probability value, and the multi-dimensional vector of fromAlarm leads to the multi-dimensional vector of toAlarm.

[0135] The bilinear transformation layer is a network structure in deep learning that is used to process data. It can calculate the matching degree of two vectors and can be used to build neural networks.

[0136] S032. Use mse as the loss function when training and fitting the model, fit the model output value with the calculated ratio, and then iterate the training model

[0137] S033. After the model training is completed, the regression model constructed by the neural network will be saved for use in subsequent prediction services.

[0138] S04. Use the causal relationship model to infer the root cause relationship in real time.

[0139] The S04 includes:

[0140] In the above steps, we have obtained a list of alarm types and a causal relationship model between multi-dimensional alarms. Then we need to use this information to reason about the alarm information that occurs in real time.

[0141] S041. Obtain all alarms that occurred in the target area devices within the time slice before the current alarm, and query the neighboring devices of all the alarm-generating devices through the device topology relationship based on the devices where these alarms occurred;

[0142] S042. Then, in the connection relationship, the devices that have not generated an alarm are filtered out from the adjacent devices, and only the devices that have generated an alarm are retained for processing;

[0143] S043. Construct an undirected graph, write all the acquired devices with alarms and connection relationships into the graph, and add the connection relationships of device nodes and edges;

[0144] S044. After constructing a complete undirected graph, the complete graph is divided into several connected subgraphs according to the connection relationship between the points. The basis for division is whether there is a connection relationship between the node groups. If there is no connection relationship, the nodes in each subgraph after division are directly connected to each other.

[0145] S045. Traverse all subgraphs once;

[0146] The S045 includes:

[0147] S0451. Create a new directed graph space, traverse each edge in the subgraph, take out the nodes at both ends of the edge, and use the alarm type list generated during training to obtain the feature vectors of the alarm components corresponding to the nodes at both ends respectively;

[0148] S0452. Substitute the alarm feature vectors at both ends into the multi-dimensional alarm causal relationship model, and use them as the starting point and the end point to obtain two different weights. For example, devices A and B can be substituted into the model A->B and B->A to obtain different weight values;

[0149] S0453. Take the starting point and end point corresponding to the direction of the higher weight value calculated as the starting point of causal inference. At the same time, when the weight value is greater than the preset threshold, the threshold defaults to 0.2, and the starting point, end point and weight value of the directed edge are added to the directed graph space.

[0150] The two weight values ​​calculated in S0452 are the same, and the earliest alarm time of the two nodes is compared, the node with the earlier time is taken as the starting point, and the starting point, end point and weight of the directed edge are added to the directed graph space.

[0151] S0454. After all the edges of each single subgraph are calculated in the previous step, a directed connection relationship of all the nodes in the subgraph is formed in a directed graph space. Through the concept of in-degree in graph theory, all nodes with in-degree of 0 are found and regarded as root nodes.

[0152] So far, we have completed the causal inference in the case of multiple alarms between devices, inferred the causal relationship between different devices in the case of multiple alarms, obtained the direction of causality between devices, and obtained the root node by combining the in-degree concept of graph theory.

[0153] It should be noted that, although the operations of the method of the present invention are described in a specific order in the above embodiments and the accompanying drawings, this does not require or imply that the operations must be performed in the specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0154] In order to explain more clearly the root cause correlation method in the case of multiple alarms between the above-mentioned root cause analysis devices, a specific embodiment is used for illustration below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute an improper limitation to the present invention.

[0155] The historical alarm data of a province for 6 months is used for training, totaling 712,036 items. The training data sample is shown in Table 1 below:

[0156]

[0157]

[0158] Table 1

[0159] When we process all the data and complete the training according to the process, we will get the alarm type list alarmType.npy and the multi-dimensional feature causal model model.pth.

[0160] In the following reasoning process, we input the real-time 5-minute alarm data, and then we can infer whether the devices that have alarmed within these 5 minutes have a causal connection relationship and the direction of the relationship. Take the following 5-minute alarm data as an example. In these 5 minutes, the target area devices have a total of 18 alarms, involving 9 devices, as shown in Table 2 below:

[0161]

[0162]

[0163] Table 2

[0164] like Figure 3 , Figure 4 As shown in the figure, after reasoning analysis, we found that there was a causal relationship between two groups of devices in each of the four devices, and obtained the final analysis result;

[0165] Figure 3 The two points are the equipment:

[0166] bd9e8e77-8f87-11ec-8543-04a2f38b3dcd_GigabitEthernet2 / 0 / 0 and c10d576f-8f87-11ec-8543-04a2f38b3dcd_GigabitEthernet5 / 1 / 15.

[0167] Figure 4 The two points are the equipment:

[0168] bd9556ca-8f87-11ec-8543-04a2f38b3dcd_GigabitEthernet2 / 0 / 0 and c116c79f-8f87-11ec-8543-04a2f38b3dcd_GigabitEthernet5 / 1 / 18.

[0169] Based on the same inventive concept, the present invention also proposes a root cause association device in the case of multiple alarms between root cause analysis devices. The implementation of the device can refer to the implementation of the above method, and the repeated parts will not be repeated. The term "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0170] Figure 5 The present invention provides a root cause correlation device for multiple alarms between root cause analysis devices, and the device comprises:

[0171] The alarm and topology information acquisition module 110 acquires historical alarm information and device topology information, acquires historical alarm information, and uses the alarm information to perform modeling to acquire topological relationship data of devices in the target area, where the topological relationship data describes the connection relationship between the devices;

[0172] The alarm information processing module 120 processes historical alarm information and processes and models historical alarm information one by one;

[0173] Causal relationship modeling module 130, historical alarm information causal relationship modeling;

[0174] The reasoning module 140 uses the causal relationship model to infer the root cause relationship in real time.

[0175] The historical alarm information in the alarm and topology information acquisition module 110 is: historical data of alarm information generated by the target area equipment; the historical alarm information obtained in the alarm and topology information acquisition module 110 includes three fields: the device ID where the alarm occurred, the type of alarm that occurred, and the time when the alarm occurred.

[0176] The historical alarm information in the alarm and topology information acquisition module 110 includes: historical data of no less than 6 months, and a total of no less than 100,000 historical alarm data.

[0177] The alarm information processing module 120 includes:

[0178] All alarm type data occurring in the statistical module and statistical historical data are stored in the form of a list;

[0179] The alarm history vector relationship table module traverses all historical alarm data one by one and calculates the alarm history vector relationship table formed by the historical data;

[0180] Model building module,constructs convergence objectives for causal modeling.

[0181] The alarm types in the statistical module include: alarm types that have not appeared in the training process and other types of alarms.

[0182] The calculations performed by the alarm history vector relationship table module include:

[0183] The historical alarm data interception module intercepts all historical alarm data occurring within the time slice according to the occurrence time of the current alarm;

[0184] The grouping module groups the data of different device IDs in the time slice. If the same device has multiple different types of features in the time slice, they are considered as multiple features.

[0185] The topology query module uses the device where the alarm occurs as the starting node and queries the devices within one hop of the node through the device topology relationship;

[0186] If the device removal module and the queried device generate an alarm within the time slice, both the starting device and the end device are removed. The end device is a device that is found to be associated with the starting node by one hop in the topology.

[0187] If multiple alarm modules and the queried devices generate multiple alarms within the time slice, they are considered as multiple pieces of data and processed one by one, and the alarms generated on the starting and ending devices are taken out;

[0188] The alarm conversion module converts the alarm into a 0,1 vector according to the alarm type list;

[0189] The alarm vectors converted by the alarm vector recording module, the starting device and the end device are recorded as fromAlarm and toAlarm respectively, and recorded in the final summary data.

[0190] The model building module includes:

[0191] The probability calculation module uses the conditional probability formula p(A│B)=(P(AB)) / (p(B)) to calculate the probability of toAlarm occurring when the fromAlarm condition occurs;

[0192] The predicted target value calculation module counts the number of occurrences of different fromAlarm types and the number of occurrences of different fromAlarm and toAlarm combinations. After associating the two data through fromAlarm, the conditional probability value can be obtained by division, which we record as ratio, that is, the predicted target value.

[0193] The causal relationship modeling module 130 includes:

[0194] Regression model training module, using the pytroch framework to build a multi-layer MLP neural network and train a regression model;

[0195] Iteratively train the model module, use mse as the loss function during model training and fitting, fit the model output value with the calculated ratio, and then iteratively train the model;

[0196] After the model saving module and model training are completed, the regression model constructed by the neural network will be saved for use in subsequent prediction services.

[0197] The structure of the neural network regression model in the regression model training module includes:

[0198] The input of the model includes two multi-dimensional alarm feature vectors, fromAlarm and toAlarm. Three fully connected layers are connected in series under the feature vector of fromAlarm, and one fully connected layer is connected in series under the feature vector of toAlarm.

[0199] The output results of the linear layer under the multi-dimensional alarm feature vector route of fromAlarm and toAlarm are passed through a bilinear transformation layer to obtain an output value, and the output value is the probability of generating a probability value, and the multi-dimensional vector of fromAlarm leads to the multi-dimensional vector of toAlarm.

[0200] The reasoning module 140 includes:

[0201] The alarm device query module obtains the current alarm and all the alarms that occurred in the target area devices in the previous time slice. According to the devices where these alarms occurred, the adjacent devices of all the alarm devices are queried through the device topology relationship;

[0202] The alarm device retention module then filters out the devices without alarms in the adjacent devices in the connection relationship, and only retains the devices with alarms for processing;

[0203] Undirected graph construction module, builds an undirected graph, writes all the acquired devices with alarms and connection relationships into the graph, and adds the connection relationships between device nodes and edges;

[0204] The connected subgraph segmentation module divides the complete undirected graph into several connected subgraphs according to the connection relationship between the points after constructing it. The basis for segmentation is whether there is a connection relationship between the node groups. If there is no connection relationship, the nodes in each subgraph after segmentation are directly connected to each other.

[0205] Subgraph traversal module, traverses all subgraphs once;

[0206] The subgraph traversal module includes:

[0207] The feature vector acquisition module creates a new directed graph space, traverses each edge in the subgraph, takes out the nodes at both ends of the edge, and uses the alarm type list generated during training to obtain the feature vectors of the alarm components corresponding to the nodes at both ends.

[0208] Two weight acquisition modules, substitute the alarm feature vectors at both ends into the multi-dimensional alarm causal relationship model, and use them as the starting point and the end point to obtain two different weights;

[0209] The high weight value module takes the starting point and end point corresponding to the direction of the higher weight value calculated as the starting point of causal inference. At the same time, when the weight value is greater than the preset threshold, the starting point, end point and weight value of the directed edge are added to the directed graph space.

[0210] The root node inference module forms a directed connection relationship between all nodes in the subgraph in a directed graph space, and through the concept of in-degree in graph theory, finds all nodes with in-degree 0 and regards them as root nodes.

[0211] The two weight values ​​calculated in the two weight acquisition modules are the same. The earliest alarm time of the two nodes is compared, the node with the earlier time is taken as the starting point, and the starting point, end point and weight of the directed edge are added to the directed graph space.

[0212] It should be noted that although several modules of the root cause association device in the case of multiple alarms between root cause analysis devices are mentioned in the above detailed description, this division is only exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules for embodiment.

[0213] Based on the above invention concept, Figure 6 As shown, the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the computer program 230, the root cause correlation method in the case of multiple alarms between the aforementioned root cause analysis devices is implemented.

[0214] Based on the aforementioned inventive concept, the present invention further proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned root cause correlation method under multiple alarm conditions between root cause analysis devices.

[0215] The present invention provides a root cause correlation method and device for root cause analysis between multiple alarms between devices, which solves the problem that common causal inference algorithms can only analyze causal relationships one-to-one. When multiple alarms of different types occur between devices, the causal relationship between the devices can also be inferred through a model.

[0216] Although the spirit and principle of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined to benefit, and such division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements contained in the spirit and scope of the attached claims.

[0217] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0218] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0219] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0220] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0221] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0222] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0223] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0224] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0225] Regarding the limitation of the protection scope of the present invention, those skilled in the art should understand that, based on the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A root cause correlation method for multiple alarms between root cause analysis devices, characterized in that: The method includes: S01. Obtain historical alarm information and device topology information. Obtain historical alarm information and use the alarm information to perform modeling to obtain topological relationship data of devices in the target area. The topological relationship data describes the connection relationship between the devices. S02: Processing historical alarm information: processing and modeling historical alarm information one by one; S03, causal relationship modeling of historical alarm information; S04. Use the causal relationship model to infer the root cause relationship in real time.

2. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 1, characterized in that: The historical alarm information in S01 is: historical data of alarm information generated by the target area equipment; the historical alarm information obtained in S01 includes three fields: the device ID where the alarm occurred, the type of alarm that occurred, and the time when the alarm occurred.

3. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 1, characterized in that: The S02 includes: S021. Count all alarm types that occurred in historical data and store them in a list format; S022, traversing all historical alarm data one by one, and calculating to obtain an alarm history vector relationship table formed by the historical data; S023. Construct convergence objectives for causal modeling.

4. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 4, characterized in that: The alarm types in S021 include: alarm types that have not appeared in the training process and other types of alarms.

5. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 4, characterized in that: The calculations performed in S022 include: S0221. According to the occurrence time of the current alarm, all historical alarm data occurring within the time slice are intercepted; S0222. Group the data of different device IDs in the time slice. If the same device has multiple different types of features in the time slice, they are considered as multiple features. S0223. Take the device where the alarm occurs as the starting node and query the devices within one hop of the node through the device topology relationship. S0224. If the queried device generates an alarm within the time slice, both the starting device and the end device are removed. The end device is a device that is found to be one-hop associated with the starting node in the topology. S0225. If the queried device generates multiple alarms within the time slice, they are considered as multiple pieces of data and processed one by one, and the alarms generated on the starting and ending devices are taken out; S0226. According to the alarm type list, convert the alarm into a 0,1 vector form; S0227. The converted alarm vectors of the starting device and the end device are recorded as fromAlarm and toAlarm respectively, and recorded in the final summary data.

6. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 4, characterized in that: The S023 includes: S0231. Use the conditional probability formula p(A│B)=(P(AB)) / (p(B)) to calculate the probability of toAlarm occurring when the fromAlarm condition occurs; S0232. Count the number of occurrences of different fromAlarm types, and count the number of occurrences of different fromAlarm and toAlarm combinations. After associating the two data through fromAlarm, we can get the conditional probability value by dividing them, which we record as ratio, that is, the predicted target value.

7. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 1, characterized in that: The S03 includes: S031. Use the pytroch framework to build a multi-layer MLP neural network and train a regression model. S032. Use mse as the loss function during model training and fitting, fit the model output value with the calculated ratio, and then iterate the model training; S033. After the model training is completed, the regression model constructed by the neural network will be saved for use in subsequent prediction services.

8. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 8, characterized in that: The structure of the neural network regression model in S031 includes: The input of the model includes two multi-dimensional alarm feature vectors, fromAlarm and toAlarm. Three fully connected layers are connected in series under the feature vector of fromAlarm, and one fully connected layer is connected in series under the feature vector of toAlarm. The output results of the linear layer under the multi-dimensional alarm feature vector route of fromAlarm and toAlarm are passed through a bilinear transformation layer to obtain an output value, and the output value is the probability of generating a probability value, and the multi-dimensional vector of fromAlarm leads to the multi-dimensional vector of toAlarm.

9. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 1, characterized in that: The S04 includes: S041. Obtain all alarms that occurred in the target area devices within the time slice before the current alarm, and query the neighboring devices of all the alarm-generating devices through the device topology relationship based on the devices where these alarms occurred; S042. Then, in the connection relationship, the devices that have not generated an alarm are filtered out from the adjacent devices, and only the devices that have generated an alarm are retained for processing; S043. Construct an undirected graph, write all the acquired devices with alarms and connection relationships into the graph, and add the connection relationships of device nodes and edges; S044. After constructing a complete undirected graph, the complete graph is divided into several connected subgraphs according to the connection relationship between the points. The basis for division is whether there is a connection relationship between the node groups. If there is no connection relationship, the nodes in each subgraph after division are directly connected to each other. S045. Traverse all subgraphs once.

10. The root cause correlation method for root cause analysis devices under multiple alarm conditions according to claim 10, characterized in that: The S045 includes: S0451. Create a new directed graph space, traverse each edge in the subgraph, take out the nodes at both ends of the edge, and use the alarm type list generated during training to obtain the feature vectors of the alarm components corresponding to the nodes at both ends respectively; S0452. Substitute the alarm feature vectors at both ends into the multi-dimensional alarm causal relationship model, and use them as the starting point and the end point to obtain two different weights; S0453. Take the starting point and end point corresponding to the direction of the higher weight value calculated as the starting point of causal inference. At the same time, when the weight value is greater than the preset threshold, the starting point, end point and weight value of the directed edge are added to the directed graph space. S0454. A directed connection relationship is formed among all nodes in the subgraph in a directed graph space. Through the concept of in-degree in graph theory, all nodes with in-degree 0 are found and regarded as root nodes.

11. The root cause correlation method for multiple alarms between root cause analysis devices according to claim 11, characterized in that: The two weight values ​​calculated in S0452 are the same, and the earliest alarm time of the two nodes is compared, the node with the earlier time is taken as the starting point, and the starting point, end point and weight of the directed edge are added to the directed graph space.

12. A root cause correlation device for multiple alarms between root cause analysis devices, characterized in that: The device includes: The alarm and topology information acquisition module obtains historical alarm information and device topology information, obtains historical alarm information, and uses the alarm information to build models to obtain the topological relationship data of the target area devices. The topological relationship data describes the connection relationship between the devices. Alarm information processing module, historical alarm information processing, process and model the historical alarm information one by one; Causal relationship modeling module, historical alarm information causal relationship modeling; The reasoning module,uses the causal relationship model to infer the root cause relationship in real time.

13. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 12, characterized in that: The historical alarm information in the alarm and topology information acquisition module is: historical data of alarm information generated by the target area equipment; the historical alarm information obtained in the alarm and topology information acquisition module includes 3 fields: the device ID where the alarm occurred, the type of alarm that occurred, and the time when the alarm occurred.

14. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 12, characterized in that: The alarm information processing module includes: All alarm type data occurring in the statistical module and statistical historical data are stored in the form of a list; The alarm history vector relationship table module traverses all historical alarm data one by one and calculates the alarm history vector relationship table formed by the historical data; Model building module,constructs convergence objectives for causal modeling.

15. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 14, characterized in that: The alarm types in the statistical module include: alarm types that have not appeared in the training process and other types of alarms.

16. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 14, characterized in that: The calculations performed by the alarm history vector relationship table module include: The historical alarm data interception module intercepts all historical alarm data occurring within the time slice according to the occurrence time of the current alarm; The grouping module groups the data of different device IDs in the time slice. If the same device has multiple different types of features in the time slice, they are considered as multiple features. The topology query module uses the device where the alarm occurs as the starting node and queries the devices within one hop of the node through the device topology relationship; If the device removal module and the queried device generate an alarm within the time slice, both the starting device and the end device are removed. The end device is a device that is found to be associated with the starting node by one hop in the topology. If multiple alarm modules and the queried devices generate multiple alarms within the time slice, they are considered as multiple pieces of data and processed one by one, and the alarms generated on the starting and ending devices are taken out; The alarm conversion module converts the alarm into a 0,1 vector according to the alarm type list; The alarm vectors converted by the alarm vector recording module, the starting device and the end device are recorded as fromAlarm and toAlarm respectively, and recorded in the final summary data.

17. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 14, characterized in that: The model building module includes: The probability calculation module uses the conditional probability formula p(A│B)=(P(AB)) / (p(B)) to calculate the probability of toAlarm occurring when the fromAlarm condition occurs; The predicted target value calculation module counts the number of occurrences of different fromAlarm types and the number of occurrences of different fromAlarm and toAlarm combinations. After associating the two data through fromAlarm, the conditional probability value can be obtained by division, which we record as ratio, that is, the predicted target value.

18. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 12, characterized in that: The causal relationship modeling module includes: Regression model training module, using the pytroch framework to build a multi-layer MLP neural network and train a regression model; Iteratively train the model module, use mse as the loss function during model training and fitting, fit the model output value with the calculated ratio, and then iteratively train the model; After the model saving module and model training are completed, the regression model constructed by the neural network will be saved for use in subsequent prediction services.

19. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 18, characterized in that: The structure of the neural network regression model in the regression model training module includes: The input of the model includes two multi-dimensional alarm feature vectors, fromAlarm and toAlarm. Three fully connected layers are connected in series under the feature vector of fromAlarm, and one fully connected layer is connected in series under the feature vector of toAlarm. The output results of the linear layer under the multi-dimensional alarm feature vector route of fromAlarm and toAlarm are passed through a bilinear transformation layer to obtain an output value, and the output value is the probability of generating a probability value, and the multi-dimensional vector of fromAlarm leads to the multi-dimensional vector of toAlarm.

20. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 12, characterized in that: The reasoning module comprises: The alarm device query module obtains the current alarm and all the alarms that occurred in the target area devices in the previous time slice. According to the devices where these alarms occurred, the adjacent devices of all the alarm devices are queried through the device topology relationship; The alarm device retention module then filters out the devices without alarms in the adjacent devices in the connection relationship, and only retains the devices with alarms for processing; Undirected graph construction module, builds an undirected graph, writes all the acquired devices with alarms and connection relationships into the graph, and adds the connection relationship between device nodes and edges; The connected subgraph segmentation module divides the complete undirected graph into several connected subgraphs according to the connection relationship between the points after constructing it. The basis for segmentation is whether there is a connection relationship between the node groups. If there is no connection relationship, the nodes in each subgraph after segmentation are directly connected to each other. The subgraph traversal module traverses all subgraphs once.

21. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 20, characterized in that: The subgraph traversal module includes: The feature vector acquisition module creates a new directed graph space, traverses each edge in the subgraph, takes out the nodes at both ends of the edge, and uses the alarm type list generated during training to obtain the feature vectors of the alarm components corresponding to the nodes at both ends. Two weight acquisition modules, substitute the alarm feature vectors at both ends into the multi-dimensional alarm causal relationship model, and use them as the starting point and the end point to obtain two different weights; The high weight value module takes the starting point and end point corresponding to the direction of the higher weight value calculated as the starting point of causal inference. At the same time, when the weight value is greater than the preset threshold, the starting point, end point and weight value of the directed edge are added to the directed graph space. The root node inference module forms a directed connection relationship between all nodes in the subgraph in a directed graph space, and through the concept of in-degree in graph theory, finds all nodes with in-degree 0 and regards them as root nodes.

22. The root cause correlation device for multiple alarms between root cause analysis devices according to claim 21, characterized in that: The two weight values ​​calculated in the two weight acquisition modules are the same. The earliest alarm time of the two nodes is compared, the node with the earlier time is taken as the starting point, and the starting point, end point and weight of the directed edge are added to the directed graph space.

23. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 11 is implemented.

24. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 11.

Images