Fault root cause positioning method and device and related product

Abstract

The embodiment of the invention provides a fault root cause positioning method, a fault root cause positioning device and a related product. The fault root cause positioning method comprises the following steps: acquiring network alarm data and corresponding network topology resource data; performing slicing processing on the network alarm data and the corresponding network topology resource data in a time dimension and a space dimension through a fault causal reasoning model to obtain an initial alarm associated data set; and carrying out screening and reasoning processing on the initial alarm associated data set through the fault causal reasoning model to obtain a fault root cause node and corresponding fault causal relationship data. According to the embodiment of the invention, the fault root cause can be quickly and accurately positioned, so that the fault processing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a fault root cause locating method, device and related products. Background Art

[0002] With the increase of network communication services, the pressure on operators' network element equipment is increasing, the number of network failures is growing rapidly, and the root cause location of network failures has become an indispensable link. At present, the existing technology usually uses expert experience-based fault location methods to locate the root cause of network failures. However, the expert experience-based fault location method cannot be applied to complex fault scenarios, resulting in very inaccurate and time-consuming fault root cause location, and low efficiency. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a method, device and related products for locating the root cause of a fault, so as to solve the problem in the related art that the root cause of a fault cannot be located quickly and accurately.

[0004] In order to solve the above technical problems, the embodiment of the present invention is implemented as follows: In a first aspect, an embodiment of the present invention provides a method for locating a root cause of a fault, including: Obtain network alarm data and corresponding network topology resource data; Through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in time dimension and space dimension to obtain an initial alarm associated data group; The initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0005] In a second aspect, an embodiment of the present invention provides a fault root cause location device, including: An acquisition module is used to acquire network alarm data and corresponding network topology resource data; A processing module, used to perform slicing processing on the network alarm data and the corresponding network topology resource data in time dimension and space dimension through a fault causal reasoning model to obtain an initial alarm associated data group; The reasoning module is used to screen and reason the initial alarm associated data group through the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0006] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through a bus; the memory is used to store computer programs; and the processor is used to execute the programs stored in the memory to implement the steps of the fault root cause locating method as described in the first aspect.

[0007] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method for locating the root cause of a fault as described in the first aspect are implemented.

[0008] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the fault root cause locating method as described in the first aspect.

[0009] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention first obtains network alarm data and corresponding network topology resource data; then, through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension to obtain the initial alarm association data group; then, through the fault causal reasoning model, the initial alarm association data group is screened and reasoned to obtain the fault root cause node and the corresponding fault causal relationship data. It can be seen that through the embodiment of the present invention, the acquired network alarm data and the corresponding network topology resource data can be sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain the initial alarm association data group with time information and space information. By screening and reasoning the initial alarm association data group with time information and space information, the corresponding alarm propagation path can be obtained, thereby determining the corresponding fault causal relationship and locating the fault root cause node, realizing the rapid and accurate location of the fault root cause, thereby improving the efficiency of fault handling. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0011] Figure 1 A schematic diagram of a flow chart of a method for locating the root cause of a fault provided by an embodiment of the present invention; Figure 2A schematic diagram of a time-space correlation relationship of alarms provided in an embodiment of the present invention; Figure 3 A schematic diagram of the module composition of a fault root cause locating device provided by an embodiment of the present invention; Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0012] The embodiment of the present invention provides a method and device for monitoring abnormal requests.

[0013] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0014] Figure 1 A flowchart of a method for locating the root cause of a fault provided by an embodiment of the present invention, wherein the execution subject of the method may be a server, wherein the server may be an independent server, or a server cluster composed of multiple servers, or a cloud server for cloud computing processing, and the server may be a server capable of performing network operation processing. Figure 1 As shown, the method may specifically include the following steps: Step S102, obtaining network alarm data and corresponding network topology resource data; Step S104, using the fault causal reasoning model, slicing the network alarm data and the corresponding network topology resource data in the time dimension and the space dimension to obtain an initial alarm associated data group; Step S106, screening and reasoning the initial alarm associated data group through the fault causal reasoning model to obtain the fault root cause node and corresponding fault causal relationship data.

[0015] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention first obtains network alarm data and corresponding network topology resource data; then, through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension to obtain the initial alarm association data group; then, through the fault causal reasoning model, the initial alarm association data group is screened and reasoned to obtain the fault root cause node and the corresponding fault causal relationship data. It can be seen that through the embodiment of the present invention, the acquired network alarm data and the corresponding network topology resource data can be sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain the initial alarm association data group with time information and space information. By screening and reasoning the initial alarm association data group with time information and space information, the corresponding alarm propagation path can be obtained, thereby determining the corresponding fault causal relationship and locating the fault root cause node, realizing the rapid and accurate location of the fault root cause, thereby improving the efficiency of fault handling.

[0016] In the above step S102, network alarm data and corresponding network topology resource data are obtained.

[0017] Network alarm data refers to data generated by various devices and systems in the network management system to indicate abnormalities or potential problems in the network. This data is crucial for network administrators because it can help quickly locate problems, assess the scope of impact, and take appropriate measures to restore the normal operation of the network. Alarm data includes, for example, basic information of the alarm, alarm type and description information, and related system and device information. Among them, basic information includes: alarm ID, alarm time, and source address / destination address. The alarm ID is a unique identifier for each alarm, which is used to distinguish different alarm events. The alarm time is the timestamp when the alarm occurs, usually accurate to seconds or milliseconds, which helps to quickly locate the time when the problem occurs. The source address / destination address is the source IP address and destination IP address that trigger the alarm, which helps to identify the source of the attack or the affected system.

[0018] In an embodiment of the present application, the network alarm data may be alarm data in a 5G (5th Generation Mobile Communication Technology) core network, and the network topology resource data may be network topology resource data corresponding to a cross-domain 5G core network. Network topology is an abstract representation method that describes the physical or logical connection mode and layout between various devices (such as computers, routers, switches, etc.) in a network. It is an application of graph theory, in which different network devices are modeled as nodes, and the connections between devices are modeled as links or lines between nodes. Network topology describes the physical or logical connection relationship between various nodes (such as computers, routers, switches, etc.) in a network, as well as how data flows in the network.

[0019] In an embodiment of the present application, network alarm data can be obtained through security monitoring systems and tools, through a threat intelligence sharing platform, through an API (Application Programming Interface) interface, or through data sharing and collaboration.

[0020] In the above step S104, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain an initial alarm associated data group.

[0021] In this embodiment, by setting a preset time step, the network data and related network topology resources are sliced ​​according to the preset time step to obtain a data group associated with time information, space information and initial alarm.

[0022] The specific training method of the fault causal reasoning model in the embodiment of the present application can be found in the relevant steps or embodiments below and will not be repeated here.

[0023] In one embodiment, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain an initial alarm correlation data group, including: Through the fault causal reasoning model, according to the preset time step, the sub-topology alarm set within each preset time step is obtained; the sub-topology is the area formed by the network nodes where the alarm exists; the sub-topology alarm set is the set formed by all the alarms existing in the sub-topology within the preset time step; An initial alarm correlation data group is generated based on each sub-topology alarm set through a fault causal reasoning model.

[0024] In the embodiment of the present application, first, the acquired network alarm data and the corresponding network topology resource data are input into the trained fault causal reasoning model, and the fault causal reasoning model is used to obtain the maximum correlation area formed by the network nodes with alarms according to the preset time step, and all alarms existing in the maximum correlation area are obtained, and the sub-topology alarm set within each preset time step is obtained based on the set formed by all alarms in the maximum correlation area. Then, the initial alarm association data group is generated based on each sub-topology alarm set through the fault causal reasoning model.

[0025] This application sets a preset time step and slices the network alarm data and related network topology resource data in the time dimension and space dimension, so as to determine the maximum relevant area formed by the network node with alarm within the preset time step, and determine all alarms existing in the maximum relevant area. The preset time step can be the time length from the arrival of the first alarm in the sub-topology.

[0026] In the network topology, when an alarm occurs on a network node, the network node is said to be activated or lit up. The largest related area formed by the lit nodes is the sub-topology. It is understandable that the sub-topology will continue to expand or remain unchanged in the spatial dimension over time. An alarm occurring on a network node may affect all other network nodes related to the network node. Within the preset time step, the related network nodes may or may not be affected by the alarm. If the related network nodes are affected by the alarm and generate an alarm, then the sub-topology will be expanded in the spatial dimension.

[0027] In one example, assuming that the preset time step is 15 minutes, an alarm is detected in node 1 at time 0, and an alarm is detected in node 2 10 minutes after time 0. Node 2 is closely related to node 1 in performance, and no other alarm is found 15 minutes after time 0. Then, within the 15 minutes, the sub-topology formed by node 1 is expanded in the spatial dimension to include node 2, and the set formed by the above two alarms is the sub-topology alarm set.

[0028] The expansion of the sub-topology in the time dimension and the space dimension can also form an alarm time-space correlation diagram. In the alarm time-space correlation diagram, each alarm data is marked with time and location (i.e., network device or node), forming a multi-dimensional alarm data set. Based on this, the initial alarm correlation data group can be generated based on each sub-topology alarm set through the fault causal reasoning model. The initial alarm correlation data group can be expressed as an alarm time-space correlation diagram. The initial alarm relationship data group can include the alarm time, alarm location, cause of the alarm, and the impact of the alarm.

[0029] In one example, Figure 2 A schematic diagram of a time-space correlation relationship of alarms provided in an embodiment of the present application is shown. Figure 2 As shown, the sub-topology includes the network element layer, the network cloud and the data communication layer, and there are nodes 1 to 13 that are interrelated between the network element layer, the network cloud and the data communication layer. An alarm of degradation of the success rate of PDU session establishment and unreachability of UPF node is generated in node 2 of the network element layer, and then an alarm of excessively high inbound packet error rate of the host port is generated in the relevant node 9 in the network cloud. Then, an interface terminal alarm is generated in the relevant node 12 of the data communication layer, and an alarm of abnormal message forwarding and interface interruption is generated in node 13. The above-mentioned multiple nodes of the network cloud and data communication layer are closely related to the nodes in the network element layer. When a node in the network element layer generates an alarm, the relevant nodes in the network cloud and data communication layer will also generate an alarm. There is a certain causal relationship between the alarms generated between the network element layer, the network cloud and the data communication layer, forming alarm causal relationship data, and within a certain time range, the alarm causal relationship data has temporal and spatial correlation.

[0030] In the above step S106, the initial alarm related data group is screened and reasoned through the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0031] After the initial alarm correlation data group is obtained, the initial alarm correlation data group can be screened and reasoned through the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0032] In one embodiment, the initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data, including: Through the fault causal reasoning model, the initial alarm related data group is screened and processed to obtain the alarm propagation directed graph; Through the fault causal reasoning model, based on the alarm propagation directed graph, the alarm root cause node and the corresponding alarm causal relationship data are determined; Through the fault causal reasoning model, based on the alarm root cause node and the corresponding alarm causal relationship data, the fault root cause node and the corresponding fault causal relationship data are determined using the knowledge document; the knowledge document includes at least one of the following: equipment alarm description document, historical fault case document and event discovery rules defined based on expert experience.

[0033] In an embodiment of the present application, the initial alarm causal relationship data is screened and processed through a fault causal reasoning model to obtain an alarm propagation directed graph. Thereafter, the alarm root cause node and the corresponding alarm causal relationship data can be determined in the alarm propagation directed graph. Then, knowledge documents such as equipment alarm description documents, historical fault case documents, and event discovery rules defined based on expert experience are used to determine the fault caused by the alarm to the equipment or system, and to determine the fault root cause node and the corresponding fault causal relationship data.

[0034] In one implementation, first, the initial alarm association data group can be screened and processed through the fault causal reasoning model, and redundant or repeated alarm data and untrue alarm data in the initial alarm association data group can be filtered out based on the time correlation and spatial correlation between the alarm data, so as to obtain an alarm propagation directed graph. Then, the alarm root cause node and alarm causal relationship data are determined in the alarm propagation directed graph through the fault causal reasoning model. The alarm root cause node can be a network node with an in-degree of 0 in the alarm causal relationship graph, and the alarm causal relationship data includes the cause of the alarm, the impact of the alarm, etc. Then, the system or equipment fault corresponding to the alarm can be determined by using knowledge documents such as equipment alarm description documents, historical fault case documents, and event discovery rules defined based on expert experience, and the fault root cause node and the corresponding fault causal relationship data can be determined.

[0035] In another implementation mode, after the alarm spatiotemporal association graph formed by the sub-topology expansion continues to expand to the boundary, that is, when the alarm data has been fully expanded in time and space and has reached a certain stable state, the initial alarm association data group is screened and inferred through the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data. It is also possible to solidify the fault spatiotemporal candidate association group based on the initial alarm causal relationship data, and screen the fault spatiotemporal candidate association group to obtain a fault propagation directed graph, and determine the fault root cause node and fault causal relationship data based on the fault propagation directed graph.

[0036] The solidification process of fault spatiotemporal candidate association groups mainly includes the following steps: Association rule extraction: Extract valid association rules from the alarm spatiotemporal association relationship diagram. These rules describe the temporal and spatial correlations between alarm data. Candidate association group generation: According to the extracted association rules, alarm data with similar characteristics are divided into different candidate association groups. Each candidate association group represents a possible fault mode or scenario. Verification and confirmation: Verify and confirm the candidate association groups to eliminate false alarms and missed alarms. This is usually achieved by comparing and analyzing the actual fault records. Solidification storage: The verified and confirmed candidate association groups are solidified as fault spatiotemporal candidate association groups and stored in the fault management system for subsequent use.

[0037] In one embodiment, the fault causal reasoning model is used to determine the alarm root cause node and the corresponding alarm causal relationship data based on the alarm propagation directed graph, including: By using the fault causal reasoning model, at least one initial alarm root cause node is determined in the alarm propagation directed graph; the initial alarm root cause node is a network node with an in-degree of 0 in the alarm propagation directed graph; For each initial alarm root cause node, the influence range of the initial alarm root cause node is determined by using the fault causal reasoning model and the breadth-first search algorithm; Through the fault causal reasoning model, the alarm root cause node and the corresponding alarm causal relationship data are determined according to the influence range of each initial alarm root cause node.

[0038] In one implementation, first, through the fault causal reasoning model, each network node with an in-degree of 0 in the alarm propagation directed graph is used as the initial alarm root cause node, and the in-degree of a node is the number of edges pointing to the node. If the in-degree of a node is 0, it means that there is no edge directly pointing to the node from other nodes in the graph. Therefore, the network node with an in-degree of 0 in the alarm propagation directed graph can be used as the initial alarm root cause node. Then, for each initial alarm root cause node, through the fault causal reasoning model, the breadth-first search algorithm is used to traverse and evaluate the influence range of the initial alarm root cause node. Next, through the fault causal reasoning model, the initial alarm node with the largest influence range is determined as the alarm root cause node, and the alarm causal relationship data is determined based on the alarm propagation directed graph.

[0039] In another implementation, the fault spatiotemporal candidate association groups are screened to obtain a fault propagation directed graph, and the fault root cause node and fault causal relationship data are determined based on the fault propagation directed graph. First, multiple groups of possible candidate faults are determined based on system monitoring data, fault alarm information, and preliminary diagnostic analysis. These candidate faults may involve multiple system components or subsystems. For each candidate fault, information about the system components or subsystems related thereto is collected, and these components or subsystems will be regarded as nodes in the fault propagation directed graph. Based on this, each system component or subsystem is taken as a node in the directed graph, and the related nodes are connected with directed edges according to the fault propagation relationship between the components or subsystems to form a fault propagation directed graph. The directed edge indicates the direction in which the fault propagates from one node (component or subsystem) to another node. In the fault propagation directed graph, each node with an in-degree of 0 is taken as the initial fault root cause node, and the initial fault root cause node is traversed and evaluated using a breadth-first search algorithm to evaluate the influence range of each initial fault root cause node, and the initial fault root cause node with the largest influence range is selected as the fault root cause node, and the fault causal relationship data is determined based on the fault propagation directed graph.

[0040] In one embodiment, the fault causal reasoning model is used to determine the alarm root cause node according to the influence range of each initial alarm root cause node, including: For each initial alarm root cause node, the fault causal reasoning model is used to determine the number of descendant nodes affected by the initial alarm root cause node according to the alarm propagation path; According to the preset sorting rules, the number of descendant nodes affected by each initial alarm node is sorted, and the alarm root cause node is determined according to the sorting result.

[0041] In one implementation, for each initial alarm root cause node, a fault causal inference model is used to traverse using a breadth-first search algorithm to evaluate the impact range of the initial alarm root cause node, and the number of descendant nodes (including child nodes or grandchild nodes) affected by the initial alarm root cause node is calculated according to the alarm propagation path. Then, the number of descendant nodes affected by each initial alarm node is sorted through the fault causal inference model, and the initial alarm root cause node with the largest impact range, that is, the largest number of affected descendant nodes, is determined as the alarm root cause node. After the alarm root cause node is determined, the alarm causal relationship data is determined based on the alarm causal relationship graph.

[0042] In another implementation, for the initial fault root cause nodes in the fault propagation directed graph, the initial fault root cause nodes are traversed and evaluated using a breadth-first search algorithm to evaluate the influence range of each initial fault root cause node, and the number of affected descendant nodes (including child nodes or grandchild nodes) is calculated according to the alarm propagation path. The number of descendant nodes is sorted from most to least, and the initial fault root cause node with the largest influence range, that is, the initial fault root cause node with the largest number of affected descendant nodes is selected as the fault root cause node. After the fault root cause node is determined, the fault causal relationship data is determined based on the fault propagation directed graph.

[0043] In one embodiment, it further includes: Obtain network alarm sample data and corresponding network topology resource sample data; Using the causal strength function, determine the alarm causal relationship sample data corresponding to the network alarm sample data, and determine the fault causal relationship label data based on the alarm causal relationship sample data; Through the pre-built neural network, the fault causal relationship prediction data is determined based on the network alarm sample data and the corresponding network topology resource sample data, as well as the fault causal relationship label data; According to the fault causality label data, the fault causality prediction data and the target loss function, the neural network is iteratively trained, and the trained neural network is determined as a fault causality inference model.

[0044] In one implementation, the training process of the fault causal reasoning model is: obtaining network alarm sample data and corresponding network topology resource sample data, where the network alarm sample data includes multiple alarm data that have occurred in the system. The network topology resource sample data is the network topology resource corresponding to the network alarm sample data. The network sample alarm data can be obtained through security monitoring systems and tools, through threat intelligence sharing platforms, through API interfaces, or through data sharing and collaboration.

[0045] After obtaining the network alarm sample data and the corresponding network topology resource sample data, the causal trigger strength between the network alarm sample data can be mined based on the Hawkes process algorithm. When a network failure occurs, a series of alarms or anomalies will be generated over time. The alarms that occur can be arranged in chronological order on the time axis, and the alarms can be regarded as a process of a series of discrete events. The occurrence of each event will increase or stimulate the possibility of the next event, and the effect of this incentive will decay over time. Based on this, the above incentive process can be modeled based on the Hawkes process algorithm. On the basis of a one-dimensional / multi-dimensional Hawkes process intensity function, it is assumed that the causal trigger intensity between sub-topology nodes depends on the topological distance and is exponentially inversely proportional to the topological distance. Based on this, the Hawkes process causal intensity function of multiple types of alarms combined with topology can be obtained. In this way, the causal strength between different alarms can be calculated based on the causal intensity function, thereby obtaining the alarm causal relationship sample data corresponding to the network alarm sample data. Then, the alarm causal relationship sample data can be labeled through knowledge documents, etc., to obtain accurate fault causal relationship label data.

[0046] After obtaining the alarm causal relationship sample data and the fault causal relationship label data, the alarm causal relationship sample data and the fault causal relationship label data, as well as the corresponding network topology resource samples, can be input into the pre-built neural network, and the alarm causal relationship prediction data can be obtained through the pre-built neural network. The alarm causal relationship prediction data is then screened and reasoned through the pre-built neural network to output the predicted fault root cause node and the fault causal relationship prediction data. Then, according to the fault causal relationship label data, the fault causal relationship prediction data and the target loss function, the neural network is iteratively trained, and the trained neural network is determined as the fault causal reasoning model.

[0047] In another implementation, when obtaining alarm causal relationship sample data, the obtained network alarm sample data and the corresponding network topology resource sample data can be sliced ​​in the time dimension and the space dimension through a pre-built neural network to obtain an initial alarm associated sample data group. Then, the initial alarm associated sample data group is screened through the pre-built neural network to obtain an alarm sample propagation directed graph, and based on the alarm sample propagation directed graph, the alarm sample root cause node and the corresponding alarm causal relationship sample data are determined.

[0048] In one implementation, when labeling alarm causal relationship sample data, the alarm causal relationship sample data can be labeled using knowledge documents. The knowledge documents include equipment alarm description documents, historical fault case documents, and event discovery rules defined by expert experience. For equipment alarm description documents, since there are a large number of documents and the information in the documents is relatively scattered, it is very inconvenient to directly label the alarm causal relationship sample data using the equipment alarm description documents. Therefore, when labeling the alarm causal relationship sample data directly using the equipment alarm description documents, the following steps a and b can be performed on the equipment alarm description documents first, and then the alarm causal relationship sample data can be labeled. Among them, step a: extracting fault causal relationship groups between sentences or in sentences from the equipment alarm description document, the step a specifically includes: 1) extracting relevant information such as "possible causes", "alarms" and "impact on the system" in different sentences in the equipment alarm description document, and combining "possible causes" -> "alarms" and "alarms" -> "impact on the system" to form fault causal relationship pairs. 2) For the possible fault causal relationships between the same sentences in the equipment alarm document, fine-grained extraction of fault causal relationship pairs is performed using causal conjunctions such as cause, cause, and trigger. Since the fault causal relationship pairs cannot be directly applied to production, step b: match the fault causal relationship pairs obtained above with the alarm causal relationship data description consistency, and further extract hidden alarm causal relationship pairs from the fault causal relationship pairs.

[0049] When training the fault causal reasoning model, the above fault causal relationship prediction data can also be compared with the fault causal relationship label data to confirm whether the fault causal relationship prediction data is accurate and whether it conforms to the actual business logic. The parameters of the fault causal reasoning model can be adjusted according to the fault causal relationship label data and the actual business logic.

[0050] In addition, the embodiment of the present application also provides a fault root cause location system, which supports taking alarm causal relationship data with time and space correlation as input, executing the fault causal reasoning process, checking whether the generated fault causal relationship data conforms to the actual business logic, and tuning the fault root cause reasoning model according to whether the generated fault causal relationship data conforms to the actual business logic. It also supports offline verification of the tuning results, supports offline import of network topology resource data, network alarm data and fault root cause reasoning model to ensure that the tuning can achieve the expected effect, and updates the parameters of the fault root cause reasoning model after successful verification to better support business scenarios.

[0051] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention first obtains network alarm data and corresponding network topology resource data; then, through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension to obtain the initial alarm association data group; then, through the fault causal reasoning model, the initial alarm association data group is screened and reasoned to obtain the fault root cause node and the corresponding fault causal relationship data. It can be seen that through the embodiment of the present invention, the acquired network alarm data and the corresponding network topology resource data can be sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain the initial alarm association data group with time information and space information. By screening and reasoning the initial alarm association data group with time information and space information, the corresponding alarm propagation path can be obtained, thereby determining the corresponding fault causal relationship and locating the fault root cause node, realizing the rapid and accurate location of the fault root cause, thereby improving the efficiency of fault handling.

[0052] Corresponding to the fault root cause location method provided in the above embodiment, based on the same technical concept, the embodiment of the present invention also provides a fault root cause location device, Figure 3 A schematic diagram of the module composition of a fault root cause location device provided by an embodiment of the present invention, wherein the fault root cause location device is used to perform Figure 1 to Figure 2 The fault root cause location method described in the Figure 3 As shown, the fault root cause locating device comprises: An acquisition module 31 is used to acquire network alarm data and corresponding network topology resource data; The processing module 32 is used to perform slicing processing on the network alarm data and the corresponding network topology resource data in the time dimension and the space dimension through the fault causal reasoning model to obtain an initial alarm associated data group; The reasoning module 33 is used to screen and reason the initial alarm related data group through the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0053] Optionally, the processing module 32 is specifically configured to: Through the fault causal reasoning model, according to the preset time step, the sub-topology alarm set within each preset time step is obtained; the sub-topology is the area formed by the network nodes where the alarm exists; the sub-topology alarm set is the set formed by all the alarms existing in the sub-topology within the preset time step; An initial alarm correlation data group is generated based on each sub-topology alarm set through a fault causal reasoning model.

[0054] Optionally, the above-mentioned reasoning module 33 is specifically used for Through the fault causal reasoning model, the initial alarm related data group is screened and processed to obtain the alarm causal relationship diagram; Through the fault causal reasoning model, based on the alarm causal relationship graph, the alarm root cause node and the corresponding alarm causal relationship data are determined; Through the fault causal reasoning model, based on the alarm root cause node and the corresponding alarm causal relationship data, the fault root cause node and the corresponding fault causal relationship data are determined using the knowledge document; the knowledge document includes at least one of the following: equipment alarm description document, historical fault case document and event discovery rules defined based on expert experience.

[0055] Optionally, the above-mentioned reasoning module 33 is also specifically used for By using the fault causal reasoning model, at least one initial alarm root cause node is determined in the alarm causal relationship graph; the initial alarm root cause node is a network node with an in-degree of 0 in the alarm causal relationship graph; For each initial alarm root cause node, the influence range of the initial alarm root cause node is determined by using the fault causal reasoning model and the breadth-first search algorithm; Through the fault causal reasoning model, the alarm root cause node and the corresponding alarm causal relationship data are determined according to the influence range of each initial alarm root cause node.

[0056] Optionally, the above-mentioned reasoning module 33 is also specifically used for For each initial alarm root cause node, the fault causal reasoning model is used to determine the number of descendant nodes affected by the initial alarm root cause node according to the alarm propagation path; According to the preset sorting rules, the number of descendant nodes affected by each initial alarm node is sorted, and the alarm root cause node is determined according to the sorting result.

[0057] Optionally, the above device further comprises: a training module, used to obtain network alarm sample data and corresponding network topology resource sample data; Using the causal strength function, determine the alarm causal relationship sample data corresponding to the network alarm sample data, and determine the fault causal relationship label data based on the alarm causal relationship sample data; Through the pre-built neural network, the fault causal relationship prediction data is determined based on the network alarm sample data and the corresponding network topology resource sample data, as well as the fault causal relationship label data; According to the fault causality label data, the fault causality prediction data and the target loss function, the neural network is iteratively trained, and the trained neural network is determined as a fault causality inference model.

[0058] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention first obtains network alarm data and corresponding network topology resource data; then, through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension to obtain the initial alarm association data group; then, through the fault causal reasoning model, the initial alarm association data group is screened and reasoned to obtain the fault root cause node and the corresponding fault causal relationship data. It can be seen that through the embodiment of the present invention, the acquired network alarm data and the corresponding network topology resource data can be sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain the initial alarm association data group with time information and space information. By screening and reasoning the initial alarm association data group with time information and space information, the corresponding alarm propagation path can be obtained, thereby determining the corresponding fault causal relationship and locating the fault root cause node, realizing the rapid and accurate location of the fault root cause, thereby improving the efficiency of fault handling.

[0059] The fault root cause locating device provided in the embodiment of the present invention can implement each process in the embodiment corresponding to the above-mentioned fault root cause locating method, and will not be described again here to avoid repetition.

[0060] It should be noted that the fault root cause locating device provided in the embodiment of the present invention and the fault root cause locating method provided in the embodiment of the present invention are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the aforementioned fault root cause locating method, and the repeated parts will not be repeated.

[0061] Corresponding to the fault root cause location method provided in the above embodiment, based on the same technical concept, an embodiment of the present invention further provides an electronic device, which is used to execute the above fault root cause location method. Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Figure 4As shown, the electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors 401 and memory 402, and the memory 402 may store one or more storage applications or data. Among them, the memory 402 may be a temporary storage or a permanent storage. The application stored in the memory 402 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device. Furthermore, the processor 401 may be configured to communicate with the memory 402 to execute a series of computer executable instructions in the memory 402 on the electronic device. The electronic device may also include one or more power supplies 403, one or more wired or wireless network interfaces 404, one or more input and output interfaces 405, and one or more keyboards 406.

[0062] Specifically in this embodiment, the electronic device includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store a computer program; the processor is used to execute the program stored in the memory to implement the following method steps: Obtain network alarm data and corresponding network topology resource data; Through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in time dimension and space dimension to obtain an initial alarm associated data group; The initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0063] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention first obtains network alarm data and corresponding network topology resource data; then, through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension to obtain the initial alarm association data group; then, through the fault causal reasoning model, the initial alarm association data group is screened and reasoned to obtain the fault root cause node and the corresponding fault causal relationship data. It can be seen that through the embodiment of the present invention, the acquired network alarm data and the corresponding network topology resource data can be sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain the initial alarm association data group with time information and space information. By screening and reasoning the initial alarm association data group with time information and space information, the corresponding alarm propagation path can be obtained, thereby determining the corresponding fault causal relationship and locating the fault root cause node, realizing the rapid and accurate location of the fault root cause, thereby improving the efficiency of fault handling.

[0064] The embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the following method steps are implemented: Obtain network alarm data and corresponding network topology resource data; Through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in time dimension and space dimension to obtain an initial alarm associated data group; The initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

[0065] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention first obtains network alarm data and corresponding network topology resource data; then, through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in the time dimension and the space dimension to obtain the initial alarm association data group; then, through the fault causal reasoning model, the initial alarm association data group is screened and reasoned to obtain the fault root cause node and the corresponding fault causal relationship data. It can be seen that through the embodiment of the present invention, the acquired network alarm data and the corresponding network topology resource data can be sliced ​​in the time dimension and the space dimension through the fault causal reasoning model to obtain the initial alarm association data group with time information and space information. By screening and reasoning the initial alarm association data group with time information and space information, the corresponding alarm propagation path can be obtained, thereby determining the corresponding fault causal relationship and locating the fault root cause node, realizing the rapid and accurate location of the fault root cause, thereby improving the efficiency of fault handling.

[0066] An embodiment of the present invention further provides a computer program product. When the computer program is executed by a processor, each process of the above-mentioned fault root cause location method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0067] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0069] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0070] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0071] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0072] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0073] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0074] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0075] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, devices or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for locating the root cause of a fault, characterized in that: The method comprises: Obtain network alarm data and corresponding network topology resource data; Through the fault causal reasoning model, the network alarm data and the corresponding network topology resource data are sliced ​​in time dimension and space dimension to obtain an initial alarm associated data group; The initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

2. The method according to claim 1, characterized in that: The network alarm data and the corresponding network topology resource data are sliced ​​in time and space dimensions by using the fault causal reasoning model to obtain an initial alarm associated data group, including: By using the fault causal reasoning model, according to the preset time step, a sub-topology alarm set within each preset time step is obtained; the sub-topology is an area formed by network nodes where alarms exist; the sub-topology alarm set is a set formed by all alarms existing in the sub-topology within the preset time step; The initial alarm association data group is generated based on each of the sub-topology alarm sets through the fault causal reasoning model.

3. The method according to claim 1, characterized in that The initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data, including: The initial alarm associated data group is screened and processed by the fault causal reasoning model to obtain an alarm propagation directed graph; Determine the alarm root cause node and the corresponding alarm causal relationship data based on the alarm propagation directed graph through the fault causal reasoning model; Through the fault causal reasoning model, based on the alarm root cause node and the corresponding alarm causal relationship data, the fault root cause node and the corresponding fault causal relationship data are determined using knowledge documents; the knowledge documents include at least one of the following: equipment alarm description documents, historical fault case documents and event discovery rules defined based on expert experience.

4. The method according to claim 3, characterized in that The determining of the alarm root cause node and the corresponding alarm causal relationship data through the fault causal reasoning model based on the alarm propagation directed graph includes: Determine at least one initial alarm root cause node in the alarm propagation directed graph by using the fault causal reasoning model; the initial alarm root cause node is a network node with an in-degree of 0 in the alarm propagation directed graph; For each of the initial alarm root cause nodes, determine the influence range of the initial alarm root cause node by using the fault causal reasoning model and a breadth-first search algorithm; By means of the fault causal reasoning model, the alarm root cause node and the corresponding alarm causal relationship data are determined according to the influence range of each of the initial alarm root cause nodes.

5. The method according to claim 4, characterized in that The step of determining the alarm root cause node according to the influence range of each of the initial alarm root cause nodes by using the fault causal reasoning model includes: For each of the initial alarm root cause nodes, determine the number of descendant nodes affected by the initial alarm root cause node according to the alarm propagation path through the fault causal reasoning model; According to a preset sorting rule, the number of descendant nodes affected by each of the initial alarm nodes is sorted, and the alarm root cause node is determined according to the sorting result.

6. The method according to claim 1, characterized in that Also includes: Obtain network alarm sample data and corresponding network topology resource sample data; Determine the alarm causal relationship sample data corresponding to the network alarm sample data by using the causal strength function, and determine the fault causal relationship label data based on the alarm causal relationship sample data; Determine fault causal relationship prediction data through a pre-built neural network according to the network alarm sample data and the corresponding network topology resource sample data, and the fault causal relationship label data; The neural network is iteratively trained according to the fault causal relationship label data, the fault causal relationship prediction data and the target loss function, and the trained neural network is determined as the fault causal reasoning model.

7. A fault root cause location device, characterized in that: The device comprises: An acquisition module is used to acquire network alarm data and corresponding network topology resource data; A processing module, used to perform slicing processing on the network alarm data and the corresponding network topology resource data in time dimension and space dimension through a fault causal reasoning model to obtain an initial alarm associated data group; The reasoning module is used to screen and reason the initial alarm associated data group through the fault causal reasoning model to obtain the fault root cause node and the corresponding fault causal relationship data.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus; wherein the processor, the communication interface and the memory communicate with each other through the bus; the memory is used to store computer programs; the processor is used to execute the programs stored in the memory to implement the steps of the fault root cause locating method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the fault root cause locating method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that It comprises a computer program, which, when executed by a processor, implements the steps of the fault root cause locating method according to any one of claims 1 to 6.

Images