Fault positioning method and system

Abstract

The invention discloses a fault positioning method and system. The fault positioning system comprises an acquisition layer, a service layer and an application layer, the acquisition layer is used for acquiring log data, index data and environment monitoring data of equipment, and determining the log data, the index data and the environment monitoring data as original data; the service layer is used for performing data preprocessing on the original data, extracting the preprocessed original data to obtain a feature vector, analyzing the feature vector by using a classification algorithm and a regression algorithm to obtain a fault result of the equipment, and monitoring behavior data of the equipment in real time; and the application layer is used for analyzing the behavior data of the equipment to obtain a fault positioning result when the fault result of the equipment indicates that the equipment has a fault. Whether the equipment fails or not can be analyzed through the service layer, if the equipment fails, the behavior data of the equipment is analyzed through the application layer to obtain the fault positioning result, the fault position can be quickly positioned through the application layer, and then the fault repairing efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a fault location method and system. Background Art

[0002] Bank branches manage tens of thousands of machines and operating systems, involving multiple development centers of the head office and thousands of external units, which makes management extremely difficult. Because multiple devices and operating systems are involved, failures may occur at any link.

[0003] At present, when a fault occurs, the operation and maintenance personnel mainly rely on their own experience to analyze and judge to find the cause of the fault and solve it. However, in the process of fault location, the operation and maintenance personnel usually need to spend more than 40% of their time to locate the fault, and the speed of this process directly affects the efficiency of the entire fault repair.

[0004] Therefore, how to improve the efficiency of fault location and thus improve the efficiency of fault repair has become an urgent problem to be solved in this field. Summary of the invention

[0005] The present application provides a fault location method and system, the purpose of which is to improve the efficiency of fault location and thus improve the efficiency of fault repair.

[0006] In order to achieve the above objectives, this application provides the following technical solutions:

[0007] A fault location system, the fault location system comprising: a collection layer, a service layer and an application layer;

[0008] The collection layer is used to collect device log data, device indicator data and environmental monitoring data, and determine them as raw data;

[0009] The service layer is used to perform data preprocessing on the raw data to obtain preprocessed raw data, extract the preprocessed raw data, obtain feature vectors, analyze the feature vectors using classification algorithms and regression algorithms, obtain device failure results, and monitor device behavior data in real time, and send the device behavior data to the application layer;

[0010] The application layer is used to analyze the behavior data of the device to obtain a fault location result when the fault result of the device indicates that the device has a fault.

[0011] Optionally, the collection layer includes: a log collection module, an indicator collection module and a monitoring data collection module;

[0012] The log collection module is used to collect log data of the device;

[0013] The indicator collection module is used to collect indicator data of the device; the indicator data at least includes CPU usage, memory usage, file system usage, and network load;

[0014] The monitoring data acquisition module is used to collect environmental monitoring data using sensors; the environmental monitoring data at least includes room temperature, humidity, voltage, and current.

[0015] Optionally, the service layer includes: a data processing module, a fault diagnosis module, and an abnormality monitoring module;

[0016] The data processing module is used to perform data preprocessing on the raw data to obtain preprocessed raw data, and extract the preprocessed raw data using a feature extraction method to obtain a feature vector;

[0017] The fault diagnosis module is used to obtain a historical feature vector of the device, and compare the historical feature vector with the feature vector to obtain a fault result of the device;

[0018] The abnormality monitoring module is used to collect the behavior data of the monitoring device in real time and send the behavior data of the device to the application layer.

[0019] Optional,

[0020] The anomaly monitoring module is also used to analyze the behavior data of the device using an anomaly detection algorithm to obtain an anomaly detection result.

[0021] Optionally, the application layer includes: a root cause analysis module;

[0022] The root cause analysis module is used to obtain the performance indicators of all components in the behavior data of the device when the fault result of the device indicates that the device has a fault, and for each performance indicator of the component, determine whether the performance indicator of the component exceeds a preset threshold value; if the performance indicator of the component exceeds the preset threshold value, determine the component as a fault location result.

[0023] Optionally, the application layer further includes: an anomaly detection module;

[0024] The abnormality detection module is used to perform abnormality detection on the fault location result to obtain a component abnormality result; the component abnormality result includes an abnormal condition of the component.

[0025] Optionally, the application layer further includes: an association detection module;

[0026] The association detection module is used to obtain one or more historical abnormal results within a historical time period, and for each of the historical abnormal results, compare the component abnormal result with the historical abnormal result to obtain an abnormal association result; the abnormal association result indicates the existence of associated abnormal results.

[0027] Optionally, the fault location system further includes: a presentation layer;

[0028] The display layer is used to display the log data of the device, the indicator data of the device, the behavior data of the device, the environmental monitoring data and the fault location result.

[0029] Optionally, the display layer includes: a health visualization module, a security situation awareness module and a data visualization module;

[0030] The health visualization module is used to obtain the log data of the device, the indicator data of the device and the environmental monitoring data;

[0031] The security situation awareness module is used to obtain the behavior data of the device and the fault location result;

[0032] The data visualization module is used to generate a data visualization file based on the log data of the device, the indicator data of the device, the behavior data of the device, the environmental monitoring data and the fault location result, and display the visualization file.

[0033] A fault location method, applied to any of the above-mentioned fault location systems, comprising:

[0034] Use the collection layer to collect device log data, device indicator data, and environmental monitoring data, and determine them as raw data;

[0035] Using the service layer to perform data preprocessing on the raw data to obtain preprocessed raw data, extracting the preprocessed raw data to obtain feature vectors, analyzing the feature vectors using classification algorithms and regression algorithms to obtain device failure results and behavior data for real-time monitoring of the device, and sending the device behavior data to the application layer;

[0036] When the fault result of the device indicates that a fault occurs to the device, the behavior data of the device is analyzed using the application layer to obtain a fault location result.

[0037] The technical solution provided by the present application is that the collection layer is used to collect the log data, index data and environmental monitoring data of the equipment, and determine them as raw data; the service layer is used to preprocess the raw data, and extract the preprocessed raw data. After obtaining the feature vector, the feature vector is analyzed using the classification algorithm and regression algorithm to obtain the fault result of the equipment, as well as the behavior data for real-time monitoring of the equipment; the application layer is used to analyze the behavior data of the equipment when the fault result of the equipment indicates that the equipment has a fault, and obtain the fault location result. The service layer can analyze whether the equipment is faulty. If the equipment fails, the behavior data of the equipment is analyzed through the application layer to obtain the fault location result. The fault location can be quickly located through the application layer, thereby improving the efficiency of fault repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A first schematic diagram of the architecture of a fault location system provided in an embodiment of the present application;

[0040] Figure 2 A second schematic diagram of the architecture of a fault location system provided in an embodiment of the present application;

[0041] Figure 3 A third schematic diagram of the architecture of a fault location system provided in an embodiment of the present application;

[0042] Figure 4 A fourth schematic diagram of the architecture of a fault location system provided in an embodiment of the present application;

[0043] Figure 5 A fifth architecture diagram of a fault location system provided in an embodiment of the present application;

[0044] Figure 6 A sixth architecture diagram of a fault location system provided in an embodiment of the present application;

[0045] Figure 7 A seventh architecture diagram of a fault location system provided in an embodiment of the present application;

[0046] Figure 8 An eighth architecture diagram of a fault location system provided in an embodiment of the present application;

[0047] Fig. 9A flowchart of a fault location method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0050] like Figure 1 As shown, a first architecture schematic diagram of a fault location system is provided in an embodiment of the present application. The fault location system includes a collection layer 11, a service layer 12 and an application layer 13.

[0051] The collection layer 11 is used to collect the log data of the equipment, the indicator data of the equipment and the environmental monitoring data, and determine them as the original data.

[0052] The device refers to a hardware device, and the hardware device includes but is not limited to: a server, a storage device, and a switch.

[0053] It is understandable that by combining log data, indicator data and environmental monitoring data for analysis, a more comprehensive understanding of the operating status of the device can be achieved. For example, a device is more likely to fail under certain environmental conditions, or is more likely to fail when a certain indicator is out of range.

[0054] Combination Figure 1 For the contents shown, see Figure 2 A second architecture diagram of a fault location system is shown. Specifically, the collection layer 11 includes: a log collection module 21, an indicator collection module 22 and a monitoring data collection module 23.

[0055] The log collection module 21 is used to collect log data of the device.

[0056] Among them, the log data of the device records the events and status during the operation of the device.

[0057] Optionally, the log data of the device includes but is not limited to server logs (such as system events, error messages, performance indicators), storage logs (such as read and write operations, error codes, usage rates), and switch logs (such as network traffic, port status, error packets).

[0058] The indicator collection module 22 is used to collect indicator data of the device.

[0059] The indicator data includes at least CPU usage, memory usage, file system usage, and network load.

[0060] The monitoring data acquisition module 23 is used to collect environmental monitoring data using sensors.

[0061] Among them, the environmental monitoring data includes at least the temperature, humidity, voltage and current of the computer room.

[0062] The service layer 12 is used to preprocess the raw data to obtain the preprocessed raw data, extract the preprocessed raw data, and after obtaining the feature vector, analyze the feature vector using the classification algorithm and the regression algorithm to obtain the failure result of the equipment, as well as the behavior data for real-time monitoring of the equipment, and send the behavior data of the equipment to the application layer.

[0063] It can be understood that data preprocessing is performed on the original data. Specifically, the original data is filtered according to preset standards (such as format and range) to obtain filtered original data; data filling is performed on the filtered original data to obtain filled original data; and it is detected whether there is abnormal data in the filled original data. If so, the abnormal data is replaced with preset data (i.e., data with a format and range consistent with the filled original data) to obtain preprocessed data.

[0064] Combination Figure 1 For the contents shown, see Figure 3 A third architecture diagram of a fault location system is shown. Specifically, the service layer 12 includes: a data processing module 31 , a fault diagnosis module 32 , and an abnormality monitoring module 33 .

[0065] The data processing module 31 is used to perform data preprocessing on the original data to obtain preprocessed original data, and to extract the preprocessed original data using a feature extraction method to obtain a feature vector.

[0066] The feature vector indicates a feature vector used to describe aspects such as device status, performance, and behavior.

[0067] Optionally, feature extraction methods include but are not limited to: filtering method, wrapping method, and embedding method.

[0068] The fault diagnosis module 32 is used to obtain the historical feature vector of the device and compare the historical feature vector with the feature vector to obtain the fault result of the device.

[0069] Among them, the failure results of the equipment include two aspects. The first aspect is the equipment failure and the failure type. The second aspect is the probability of failure in the future if the equipment has not failed at present.

[0070] It can be understood that the historical characteristic vector is compared with the characteristic vector, specifically, the difference between the historical characteristic vector and the characteristic vector is calculated; it is determined whether the difference is within a preset range, if the difference is not within the preset range, it is determined that the equipment has failed; if the difference is within the preset range, the characteristic vector is input into the prediction model to obtain the probability of equipment failure.

[0071] It should be noted that the prediction model includes but is not limited to a random forest model, which is pre-trained based on a sample feature vector as input and a failure probability manually labeled on the sample feature vector as a training target.

[0072] The abnormality monitoring module 33 is used to collect the behavior data of the monitoring device in real time and send the behavior data of the device to the application layer.

[0073] Among them, the behavior data of the device refers to various real-time and historical data generated by the device during operation.

[0074] The anomaly monitoring module 33 is also used to analyze the behavior data of the device using an anomaly detection algorithm to obtain an anomaly detection result.

[0075] The anomaly detection result includes the abnormal data point and the degree of abnormality of the data point.

[0076] For example, after monitoring temperature data, the anomaly detection results may include: abnormal data point: 2024-10-01 14:00 Temperature: 105°C (normal range 20-80°C), abnormality degree: anomaly score 0.95 (highly abnormal).

[0077] It is understandable that the anomaly detection algorithm includes but is not limited to a random forest algorithm.

[0078] In addition, after obtaining the abnormal detection results, that is, after the existence of abnormal behavior, the service layer 12 can also provide corresponding alarms and suggestions according to preset rules and algorithms. For example, the device records the temperature once a minute, for example: 20°C, 21°C, 19°C, 22°C, 105°C (abnormal value), 20°C. Preset rules: Normal temperature range: 15°C-85°C. If the temperature exceeds 85°C, an alarm is triggered. Use anomaly detection algorithms (such as Z-Score, LOF, etc.) to analyze temperature data. When it is identified that the data point "105°C" is significantly higher than the normal range. Generate an alarm: "Alarm: The device temperature exceeds the safe range (105°C)!", and suggest that the operator check whether the cooling system is working properly or cool the equipment.

[0079] The application layer 13 is used to analyze the behavior data of the device to obtain a fault location result when the fault result of the device indicates that the device has a fault.

[0080] It is understandable that when the fault result of the device indicates that the device has a fault, the application layer 13 analyzes the behavior data of the device and determines the root cause of the fault or abnormality, that is, the fault location result, by analyzing various monitoring data.

[0081] In addition, after receiving the abnormal detection result sent by the service layer 12, a warning signal can be generated according to the abnormal detection result, and the warning signal can be sent to the operator. The warning signal can be sent via SMS, email, or mobile phone application.

[0082] Combination Figure 1 For the contents shown, see Figure 4 A fourth architecture diagram of a fault location system is shown. Specifically, the application layer 13 includes: a root cause analysis module 41.

[0083] The root cause analysis module 41 is used to obtain the performance indicators of all components in the behavior data of the device when the fault result of the device indicates that the device has a fault, and for each component's performance indicator, determine whether the performance indicator of the component exceeds a preset threshold. If the performance indicator of the component exceeds the preset threshold, the component is determined as a fault location result.

[0084] The fault location result indicates one or more component failures, insufficient resources, or configuration errors.

[0085] It should be noted that when a component is located as a fault location result, the component is analyzed using fault tree mining and knowledge graphs. Specifically, a fault tree model is built based on the faulty component. The top event of the fault tree is the fault of the component, and the sub-events represent the possible causes of the fault. The sub-events are connected using logical gates such as AND gates and OR gates to clarify the relationship between the various fault causes. By analyzing the tree structure, the underlying basic events are found; the knowledge graph is used to query the relevant information of the faulty component and identify potential related events.

[0086] Combination Figure 4 For the contents shown, see Figure 5 A fifth architecture diagram of a fault location system is shown, where the application layer 13 further includes: an anomaly detection module 51 .

[0087] The abnormality detection module 51 is used to perform abnormality detection on the fault location result to obtain a component abnormality result.

[0088] The component abnormality result includes the abnormal condition of the component.

[0089] It is understandable that when a component is detected to be faulty, it is necessary to perform an abnormality detection on the faulty component to obtain the cause of the fault.

[0090] Combination Figure 5 For the contents shown, see Figure 6 A sixth architecture diagram of a fault location system is shown, where the application layer 13 further includes: an association detection module 61 .

[0091] The association detection module 61 is used to obtain one or more historical abnormal results within a historical time period, and for each historical abnormal result, compare the component abnormal result with the historical abnormal result to obtain an abnormal association result.

[0092] The abnormal correlation result indicates that there is an abnormal result with correlation.

[0093] It is understandable that the component abnormal result is compared with the historical abnormal result. Specifically, it is determined whether the component abnormal result and the historical abnormal result have the same or similar features. If so, it is determined that there is a correlation between the component abnormal result and the historical abnormal result.

[0094] In addition, after detecting that there is a correlation between the component abnormal result and the historical abnormal result, the monitoring data corresponding to the component abnormal result and the historical monitoring data corresponding to the historical abnormal result are obtained, and the monitoring data and the historical monitoring data are correlated and analyzed to obtain the data correlation relationship.

[0095] It should be noted that by analyzing the correlation between different components and monitoring data, more accurate information support can be provided to operators, and maintenance strategies and resource allocation can be optimized.

[0096] Combination Figure 6 For the contents shown, see Figure 7 A seventh architecture diagram of a fault location system is shown, and the fault location system further includes: a presentation layer 71.

[0097] The display layer 71 is used to display the device's log data, device indicator data, device behavior data, environmental monitoring data, and fault location results.

[0098] It is understandable that the device log data, device indicator data, device behavior data, environmental monitoring data and fault location results are presented to the user in a visual manner to facilitate intuitive monitoring and understanding of the system's operating status.

[0099] Combination Figure 7 For the contents shown, see Figure 8 An eighth architecture diagram of a fault location system is shown. Specifically, the display layer 71 includes: a health visualization module 81, a security situation awareness module 82 and a data visualization module 83.

[0100] The health visualization module 81 is used to obtain the log data of the device, the indicator data of the device and the environmental monitoring data.

[0101] Optionally, the health visualization module 81 is also used to display the health status of each component, service or node (ie, the log data of the device, the indicator data of the device and the environmental monitoring data), as well as possible faults or abnormal conditions.

[0102] It can be understood that, through the health visualization module 81, the user can intuitively understand the health status of each part of the system, and promptly discover and handle possible faults or abnormal situations.

[0103] The security situation awareness module 82 is used to obtain the behavior data and fault location results of the device.

[0104] It is understandable that the security situation awareness module 82 can also display security status and risk conditions. This includes real-time monitoring and analysis of network traffic, intrusion detection, abnormal behavior and other information to determine whether there is a potential security threat. Through the security situation awareness module 82, users can promptly discover and respond to security incidents to ensure the security of the system.

[0105] It should be noted that the security situation awareness module 82 focuses on detecting and analyzing security threats and risks in the system. The health visualization module 81 can provide basic data (for example, by visualizing changes in network traffic to help users discover abnormal situations or potential attack behaviors) to help the security situation awareness module 82 determine whether a security incident is related to the health status of a component or service, so as to more accurately locate and handle security issues.

[0106] The data visualization module 83 is used to generate a data visualization file based on the device's log data, device indicator data, device behavior data, environmental monitoring data, and fault location results, and display the visualization file.

[0107] The visualization files include but are not limited to: charts and curves.

[0108] It can be understood that the data visualization module 83 generates data during the operation of the fault location system (i.e., equipment log data, equipment indicator data, equipment behavior data, environmental monitoring data, and fault location results) for visualization in the form of charts, curves, and other information, including performance indicators, response time, request volume, data traffic, etc.

[0109] It can be seen that through the data visualization module 83, users can clearly understand the real-time operating status, trend changes and abnormal conditions of the system, which helps them monitor the operation of the system.

[0110] It should be noted that the data visualization module 83 and the security situation awareness module 82 are interrelated, because the operating status of the fault location system will affect its health. For example, performance degradation may cause the risk of decreased health. The data visualization module 83 can help users understand the real-time operating status of the system, and provide a basis for discovering abnormal behavior or attack events. The security situation awareness module 82 focuses on determining whether the system has potential security threats by monitoring and analyzing network traffic, intrusion detection, abnormal behavior and other information.

[0111] To summarize, the service layer can analyze whether the device is faulty. If the device fails, the application layer analyzes the device's behavior data to obtain the fault location result. The application layer can quickly locate the fault location, thereby improving the efficiency of fault location and further improving the efficiency of fault repair.

[0112] like Fig. 9 FIG. 1 is a flowchart of a fault location method provided in an embodiment of the present application, comprising the following steps:

[0113] S901: Use the collection layer to collect device log data, device indicator data, and environmental monitoring data, and determine them as raw data.

[0114] It is understandable that using the collection layer to collect equipment log data, indicator data, and environmental monitoring data can provide comprehensive information support for fault analysis, help quickly locate problems, optimize maintenance strategies, and improve overall equipment reliability and operating efficiency.

[0115] S902: Use the service layer to preprocess the raw data to obtain the preprocessed raw data, extract the preprocessed raw data, and after obtaining the feature vector, use the classification algorithm and regression algorithm to analyze the feature vector to obtain the device failure result and the behavior data for real-time monitoring of the device, and send the device behavior data to the application layer.

[0116] It can be understood that the feature vector is analyzed using classification algorithm and regression algorithm to analyze whether the data of the equipment is within the normal range. If it is within the normal range, the equipment has not failed, and the prediction model continues to be used to predict the probability of equipment failure; if it is not within the normal range, the equipment has failed.

[0117] S903: When the fault result of the device indicates that the device has a fault, the behavior data of the device is analyzed using the application layer to obtain a fault location result.

[0118] It is understandable that if a device fails, the application layer is used to analyze the operating data of the device to determine the failed component or the cause of the failure so that the failure can be repaired later.

[0119] To summarize, by analyzing the original data, we can determine whether the device is faulty. If the device fails, we analyze the device's behavior data to obtain the fault location result. The fault location can be quickly located through the application layer, thereby improving the efficiency of fault location and further improving the efficiency of fault repair.

[0120] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0121] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0122] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A fault location system, characterized in that: The fault location system includes: a collection layer, a service layer and an application layer; The collection layer is used to collect device log data, device indicator data and environmental monitoring data, and determine them as raw data; The service layer is used to perform data preprocessing on the raw data to obtain preprocessed raw data, extract the preprocessed raw data, obtain feature vectors, analyze the feature vectors using classification algorithms and regression algorithms, obtain device failure results, and monitor device behavior data in real time, and send the device behavior data to the application layer; The application layer is used to analyze the behavior data of the device to obtain a fault location result when the fault result of the device indicates that the device has a fault.

2. The system according to claim 1, characterized in that The collection layer includes: a log collection module, an indicator collection module and a monitoring data collection module; The log collection module is used to collect log data of the device; The indicator collection module is used to collect indicator data of the device; the indicator data at least includes CPU usage, memory usage, file system usage, and network load; The monitoring data acquisition module is used to collect environmental monitoring data using sensors; the environmental monitoring data at least includes room temperature, humidity, voltage, and current.

3. The system according to claim 1, characterized in that The service layer includes: a data processing module, a fault diagnosis module, and an abnormality monitoring module; The data processing module is used to perform data preprocessing on the raw data to obtain preprocessed raw data, and extract the preprocessed raw data using a feature extraction method to obtain a feature vector; The fault diagnosis module is used to obtain a historical feature vector of the device, and compare the historical feature vector with the feature vector to obtain a fault result of the device; The abnormality monitoring module is used to collect the behavior data of the monitoring device in real time and send the behavior data of the device to the application layer.

4. The system according to claim 3, characterized in that The anomaly monitoring module is also used to analyze the behavior data of the device using an anomaly detection algorithm to obtain an anomaly detection result.

5. The system according to claim 1, characterized in that The application layer includes: a root cause analysis module; The root cause analysis module is used to obtain the performance indicators of all components in the behavior data of the device when the fault result of the device indicates that the device has a fault, and for each performance indicator of the component, determine whether the performance indicator of the component exceeds a preset threshold value; if the performance indicator of the component exceeds the preset threshold value, determine the component as a fault location result.

6. The system according to claim 5, characterized in that The application layer also includes: an anomaly detection module; The abnormality detection module is used to perform abnormality detection on the fault location result to obtain a component abnormality result; the component abnormality result includes an abnormal condition of the component.

7. The system according to claim 6, characterized in that The application layer also includes: an association detection module; The association detection module is used to obtain one or more historical abnormal results within a historical time period, and for each of the historical abnormal results, compare the component abnormal result with the historical abnormal result to obtain an abnormal association result; the abnormal association result indicates the existence of associated abnormal results.

8. The system according to claim 1, characterized in that The fault location system further includes: a display layer; The display layer is used to display the log data of the device, the indicator data of the device, the behavior data of the device, the environmental monitoring data and the fault location result.

9. The system according to claim 8, characterized in that The display layer includes: a health visualization module, a security situation awareness module and a data visualization module; The health visualization module is used to obtain the log data of the device, the indicator data of the device and the environmental monitoring data; The security situation awareness module is used to obtain the behavior data of the device and the fault location result; The data visualization module is used to generate a data visualization file based on the log data of the device, the indicator data of the device, the behavior data of the device, the environmental monitoring data and the fault location result, and display the visualization file.

10. A fault location method, characterized in that: The fault location system applied to any one of claims 1 to 9 above comprises: Use the collection layer to collect device log data, device indicator data, and environmental monitoring data, and determine them as raw data; Using the service layer to perform data preprocessing on the raw data to obtain preprocessed raw data, extracting the preprocessed raw data to obtain feature vectors, analyzing the feature vectors using classification algorithms and regression algorithms to obtain device failure results and behavior data for real-time monitoring of the device, and sending the device behavior data to the application layer; When the fault result of the device indicates that a fault occurs to the device, the behavior data of the device is analyzed using the application layer to obtain a fault location result.

Images