Root cause positioning method and device

Abstract

The embodiment of the invention provides a root cause positioning method and device, which can be applied to the technical field of computers, and in the method, for each alarm dimension in an obtained alarm dimension set, the following operations are respectively executed: obtaining a plurality of influence factors under one alarm dimension, taking the plurality of influence factors as a whole set, and obtaining a plurality of alarm dimensions in the whole set; combining the plurality of influence factors to obtain a plurality of factor subsets; obtaining a first change degree between the predicted value and the actual value of the overall set, and a second change degree between the predicted value and the actual value of each factor subset; selecting a candidate root factor set of one alarm dimension from the plurality of factor subsets based on the similarity between the second change degrees of the plurality of factor subsets and the first change degrees; according to the method, search is performed in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions, so that the abnormal root causes are quickly positioned, and the accuracy and timeliness of root cause positioning are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and more particularly to a root cause location method and device. Background Art

[0002] At present, daily monitoring and emergency response after monitoring fault phenomena are both very critical issues for Internet companies. When encountering emergencies, rapid root cause analysis and fault recovery have become the core capabilities of current companies. In order to achieve this goal, relevant technologies conduct daily monitoring of business systems and services by formulating monitoring indicators. When an indicator is abnormal, the operation and maintenance monitoring personnel will locate the root cause of the abnormality based on experience and recover from the abnormality.

[0003] However, the above technical solutions often summarize and locate the root causes of the anomalies based on experience, which lacks universality and easily leads to inaccurate root cause location and low timeliness of root cause location. Summary of the invention

[0004] The embodiments of the present invention provide a root cause positioning method and device, which are used to improve the accuracy of root cause positioning and improve the timeliness of root cause positioning.

[0005] On the one hand, an embodiment of the present application provides a root cause location method, the method comprising:

[0006] Get the alarm dimension set;

[0007] For each alarm dimension in the alarm dimension set, the following operations are performed respectively:

[0008] Acquire multiple influencing factors under an alarm dimension, and take the multiple influencing factors as a whole set, combine the multiple influencing factors, and obtain multiple factor subsets;

[0009] Obtaining a first degree of variation between the predicted value and the actual value of the overall set, and a second degree of variation between the predicted value and the actual value of each factor subset;

[0010] Selecting a set of candidate root factors of the one alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees respectively;

[0011] Search is performed in a search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions.

[0012] Optionally, before obtaining the alarm dimension set, the method further includes:

[0013] Obtain multiple alarm dimensions from abnormal alarm information of multi-dimensional time series data;

[0014] Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

[0015] Optionally, the multi-dimensional time series data includes: single-dimensional time series data of each of the multiple alarm indicators; before obtaining multiple alarm dimensions from the abnormal alarm information of the multi-dimensional time series data, the method further includes:

[0016] For the single-dimensional time series data of each of the multiple alarm indicators, the following operations are performed respectively:

[0017] Inputting the single-dimensional time series data of an alarm indicator into the autoregressive difference moving average model for prediction, and obtaining the predicted value of the alarm indicator at the next time point;

[0018] When the predicted value of the one alarm indicator at the next time point and the actual value of the one alarm indicator at the next time point meet the alarm condition, generating abnormal alarm information of the one alarm indicator;

[0019] Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multi-dimensional time series data is obtained.

[0020] Optionally, the selecting the candidate root factor set of the one alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees respectively includes:

[0021] Obtaining the second degree of variation of the plurality of factor subsets, and the degree of similarity between the second degree of variation and the first degree of variation, and determining the maximum degree of similarity from the plurality of obtained degrees of similarity;

[0022] The factor subset corresponding to the maximum similarity among the multiple factor subsets is used as the candidate root factor set of the one alarm dimension.

[0023] Optionally, before obtaining the first degree of change between the predicted value and the actual value of the overall set and the second degree of change between the predicted value and the actual value of each factor subset, the method further includes:

[0024] For each factor subset, an actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0025] Optionally, before searching in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions, the method further includes:

[0026] Selecting a candidate root factor set from the candidate root factor sets of the multiple alarm dimensions as a first-level search range, wherein each node in the first-level search range corresponds to an influencing factor in the candidate root factor set;

[0027] On the basis of the first layer of search range, the remaining candidate root factor sets are included in turn to obtain the search space including multiple layers of search ranges; each layer of search range is obtained in the following manner:

[0028] On the basis of the search scope of the previous layer, each influencing factor in one of the remaining candidate root factor sets is incorporated in the form of a child node to obtain the search scope of the current layer.

[0029] Optionally, the method of incorporating each influencing factor in a candidate root factor set in the remaining candidate root factor sets in the form of a child node based on the previous layer search range to obtain the current layer search range further includes:

[0030] For any node in the current layer search range, if the predicted value and the actual value of the influencing factor combination corresponding to the node are the same, the node is deleted from the current layer search range.

[0031] Optionally, searching in a search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions includes:

[0032] A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions.

[0033] On the one hand, an embodiment of the present application provides a root cause positioning device, the device comprising:

[0034] The acquisition module is used to obtain the alarm dimension set;

[0035] A processing module, used for obtaining multiple influencing factors under an alarm dimension, and taking the multiple influencing factors as a whole set, combining the multiple influencing factors to obtain multiple factor subsets;

[0036] Obtaining a first degree of variation between the predicted value and the actual value of the overall set, and a second degree of variation between the predicted value and the actual value of each factor subset;

[0037] Selecting a set of candidate root factors of the one alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees respectively;

[0038] The search module is used to search in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

[0039] Optionally, the acquisition module is also used to:

[0040] Obtain multiple alarm dimensions from abnormal alarm information of multi-dimensional time series data;

[0041] Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

[0042] Optionally, the acquisition module is also used to:

[0043] For the single-dimensional time series data of each of the multiple alarm indicators, the following operations are performed respectively:

[0044] Inputting the single-dimensional time series data of an alarm indicator into the autoregressive difference moving average model for prediction, and obtaining the predicted value of the alarm indicator at the next time point;

[0045] When the predicted value of the one alarm indicator at the next time point and the actual value of the one alarm indicator at the next time point meet the alarm condition, generating abnormal alarm information of the one alarm indicator;

[0046] Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multi-dimensional time series data is obtained.

[0047] Optionally, the processing module is specifically used for:

[0048] Obtaining the second degree of variation of the plurality of factor subsets, and the degree of similarity between the second degree of variation and the first degree of variation, and determining the maximum degree of similarity from the plurality of obtained degrees of similarity;

[0049] The factor subset corresponding to the maximum similarity among the multiple factor subsets is used as the candidate root factor set of the one alarm dimension.

[0050] Optionally, the processing module is further configured to:

[0051] For each factor subset, an actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0052] Optionally, the search module is also used to:

[0053] Selecting a candidate root factor set from the candidate root factor sets of the multiple alarm dimensions as a first-level search range, wherein each node in the first-level search range corresponds to an influencing factor in the candidate root factor set;

[0054] On the basis of the first layer of search range, the remaining candidate root factor sets are included in turn to obtain the search space including multiple layers of search ranges; each layer of search range is obtained in the following manner:

[0055] On the basis of the search scope of the previous layer, each influencing factor in one of the remaining candidate root factor sets is incorporated in the form of a child node to obtain the search scope of the current layer.

[0056] Optionally, the search module is also used to:

[0057] For any node in the current layer search range, if the predicted value and the actual value of the influencing factor combination corresponding to the node are the same, the node is deleted from the current layer search range.

[0058] Optionally, the search module is specifically used for:

[0059] A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions.

[0060] In one aspect, an embodiment of the present application provides a computer device, including:

[0061] A memory for storing program instructions;

[0062] The processor is used to call the program instructions stored in the memory and execute the steps of the above-mentioned root cause locating method according to the obtained program.

[0063] On the one hand, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device, and when the program is run on the computer device, the computer executes the steps of the above-mentioned root cause locating method.

[0064] On the one hand, an embodiment of the present application provides a computer program product, including a computer program stored on a computer-readable storage medium, wherein the computer program includes program instructions, and when the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned root cause location method.

[0065] In an embodiment of the present application, for each alarm dimension in the alarm dimension set, multiple influencing factors under the alarm dimension are taken as an overall set, and each of the multiple influencing factors is combined to obtain multiple factor subsets. Based on the similarity between the degree of change of each factor subset and the degree of change of the overall set, a candidate root factor set of the alarm dimension is selected from each factor subset, which greatly reduces the scope of subsequent root cause searches and improves the timeliness of root cause location. Secondly, searching in the search space constructed by the candidate root factor sets of multiple alarm dimensions to obtain the target root cause combination of multiple alarm dimensions can achieve rapid induction and location of the root causes of the anomalies and improve the accuracy of root cause location. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0067] Figure 1 A schematic diagram of a system architecture provided in an embodiment of the present application;

[0068] Figure 2 A schematic diagram of a process flow of a root cause location method provided in an embodiment of the present application;

[0069] Figure 3 A schematic diagram of a process flow of a root cause location method provided in an embodiment of the present application;

[0070] Figure 4 A schematic diagram of a process flow of a root cause location method provided in an embodiment of the present application;

[0071] Figure 5 A schematic diagram of the structure of a root cause locating device provided in an embodiment of the present application;

[0072] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical scheme and beneficial effects of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0074] The following is a brief introduction to the system architecture diagram applicable to the technical solution of the embodiment of the present application. It should be noted that the process introduced below is only used to illustrate the embodiment of the present application and is not a limitation.

[0075] refer to Figure 1 , which is a system architecture diagram applicable to an embodiment of the present application. The system architecture includes at least a terminal device 101 and a server 102. The number of terminal devices 101 can be one or more, and the number of servers 102 can also be one or more. The present application does not specifically limit the number of terminal devices 101 and servers 102.

[0076] The terminal device 101 pre-installs the target application for root cause positioning, which is a client application, a web application, a small program application, etc. The terminal device 101 can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart home appliance, a smart voice interaction device, a smart car device, etc., but is not limited thereto.

[0077] Server 102 is the background server of the target application. Server 102 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It may also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms, but is not limited to these.

[0078] It should be noted that the method in the embodiment of the present application can be executed by the terminal device 101 or the server 102 alone, or can be executed by the terminal device 101 and the server 102 together.

[0079] In the embodiment of the present application, the terminal device 101 and the server 102 may be directly or indirectly connected to each other through one or more networks. The network may be a wired network or a wireless network, for example, a mobile cellular network, or a wireless fidelity (Wireless-Fidelity, WIFI) network, or other possible networks, which are not limited in the embodiment of the present application.

[0080] The following is based on Figure 1 The system architecture diagram shown in FIG. 1 shows a process of a root cause location method provided in an embodiment of the present application. The process of the method can be Figure 1 The terminal device 101 shown in the figure may also be executed by the server 102, or the terminal device 101 and the server 102 may interact to execute the Figure 2 As shown, the following steps are included:

[0081] Step 201, obtain an alarm dimension set.

[0082] In some embodiments, multiple alarm dimensions are obtained from abnormal alarm information of multi-dimensional time series data; based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets. The process of the root cause location method in this application is executed for each alarm dimension set.

[0083] Specifically, time series refers to the sequence of statistics of an indicator arranged in the order of occurrence. A single-dimensional time series refers to the time series of data of an indicator in one dimension changing over time; multidimensional time series data refers to the time series of data of indicators in multiple dimensions changing over time. Multidimensional time series data is composed of multiple single-dimensional time series.

[0084] Taking the monitoring and operation of all online commodity trading institutions as an example, a one-dimensional time series can be the transaction success rate of the trading institution over time; a one-dimensional time series can also be: the CPU usage rate on the server over time; a one-dimensional time series can also be: the connection rate of the center's external network link over time.

[0085] Multidimensional time series include: the transaction success rate of trading institutions over time, the connection rate of the center's external network links over time, and the success rate of transaction types over time.

[0086] In practical applications, multiple alarm dimensions may appear in a time period. Based on the association learning rule, multiple alarm dimensions appearing in at least one adjacent time point are divided into an alarm dimension combination. By dividing multiple adjacent time periods, multiple alarm dimension combinations are obtained.

[0087] Specifically, the purpose of association learning rules is to find the relationship or association between different items in the data set. The effectiveness is usually measured by some statistical indicators, such as support, confidence, and lift. Among them, support refers to the proportion of multiple item sets that contain a certain item set (or item set combination), that is, the ratio of the number of transactions containing the item set to the total number of transactions, which is used to measure the frequency of simultaneous occurrence of premises and conclusions; confidence refers to the ratio of the number of transactions with confidence that the premise and conclusion appear at the same time to the number of transactions where the premise appears; lift is the degree of association between the premise and the conclusion. The calculation formula for lift is shown in the following formula (1):

[0088]

[0089] Among them, Q represents the degree of lift; P represents the degree of support for the simultaneous appearance of premise and conclusion; M represents the degree of support for the premise; and N represents the degree of support for the conclusion.

[0090] For example, multiple alarm dimensions at three adjacent time points are shown in Table 1:

[0091] Table 1

[0092]

[0093]

[0094] From Table 1, a decrease in the external network link connection rate of an institution may lead to a decrease in the transaction success rate of the institution at similar time points, and a decrease in the success rate of certain transaction types. Therefore, multiple alarm dimensions appearing at similar time points are divided into an alarm dimension combination. Therefore, based on association rule learning, an alarm dimension combination is obtained from the multiple alarm dimensions appearing at three time points in Table 1: (institution, transaction type, transaction success rate, network connection rate).

[0095] In an embodiment of the present application, multiple alarm dimensions occurring at at least one adjacent time point are regarded as an alarm dimension set based on an association learning rule, which can improve the rate of root cause locating and improve the efficiency of root cause locating.

[0096] In some embodiments, before obtaining multiple alarm dimensions from abnormal alarm information of multi-dimensional time series data, the following operations are performed for the single-dimensional time series data of each of the multiple alarm indicators:

[0097] The single-dimensional time series data of an alarm indicator is input into the autoregressive difference moving average model for prediction to obtain the predicted value of the alarm indicator at the next time point; based on the predicted value of an alarm indicator at the next time point, when the actual value of an alarm indicator at the next time point meets the alarm condition, abnormal alarm information of an alarm indicator is generated; based on the abnormal alarm information of multiple alarm indicators, abnormal alarm information of multi-dimensional time series data is obtained.

[0098] Specifically, the autoregressive difference moving average model (ARIMA) is mainly composed of three parts, namely the autoregressive model (AR), the difference process (I) and the moving average model (MA). Among them, the AR part is used to process the autoregressive part of the time series, which takes into account the impact of the observations of several periods in the past on the current value; the I part is used to make the non-stationary time series stable, and eliminates the trend and seasonal factors in the time series through first-order or second-order difference processing; the MA part is used to process the moving average part of the time series, which takes into account the impact of past prediction errors on the current value.

[0099] The basic formula of the ARIMA model is shown in the following formula (2):

[0100]

[0101]

[0102] Among them, Y t represents the predicted value at the current time t; Y t-1 , Y t-2 , ..., Y t-p Represents the predicted value at multiple moments in the past; c represents a constant offset, which is used to adjust the average level of model prediction; is the autoregressive coefficient, which indicates the influence of the past p time points on the current time point; θ1, θ2, ..., θ q is the sliding average coefficient, which indicates the impact of the error term of the past q moments on the current moment; ε t-1 , ε t-2 , ..., ε t-q , ε t It is the error between the predicted value and the actual value at multiple moments in the past.

[0103] In the ARIMA model, p refers to the observation value at time t, which is a linear combination of the previous p time points. q refers to the observation value at time t being affected by the error terms of the previous q time points. d refers to the difference order, which indicates how many times the data will tend to be stable after difference.

[0104] When the difference between a predicted value at the next time point and the actual value of an alarm indicator at the next time point is greater than a preset threshold, the alarm indicator is considered abnormal, and abnormal alarm information of the alarm indicator is generated.

[0105] Taking the transaction success rate of online trading institutions as an example, Y t represents the predicted value of the transaction success rate at the current moment, Y t-1 , Y t-2 , ..., Y t-p Represents the predicted value of the transaction success rate at the past p moments; ε t-1 , ε t-2 , ..., ε t-q , ε t is the error between the predicted value and the actual value of the transaction success rate at the past q moments; is the autoregressive coefficient, which indicates the influence of the past p time points on the current time point; θ1, θ2, ..., θ q It is the sliding average coefficient, which indicates the impact of the error between the predicted value and the actual value of the transaction success rate at the past q moments on the current moment.

[0106] In the embodiment of the present application, the ARIMA model is used to detect anomalies in time series data. The prediction is made by considering the historical dependence (autoregressive part), stationarity (differential part), and error term (sliding average part) of the time series. The predicted value is compared with the actual value to determine the alarm dimension. It has high accuracy and strong interpretability, making the anomaly detection process more efficient and continuous.

[0107] Step 202: for each alarm dimension in the alarm dimension set, perform the following steps 2021 to 2023 respectively:

[0108] Step 2021, obtain multiple influencing factors under an alarm dimension, and take the multiple influencing factors as a whole set, combine the multiple influencing factors, and obtain multiple factor subsets.

[0109] Step 2022, obtaining a first degree of variation between the predicted value and the actual value of the overall set, and a second degree of variation between the predicted value and the actual value of each factor subset.

[0110] Specifically, the first degree of variation between the predicted value and the actual value of the overall set represents the difference between the predicted value and the actual value of the overall set; the second degree of variation between the predicted value and the actual value of each factor subset represents the difference between the predicted value and the actual value of the factor subset.

[0111] Step 2023: Select a candidate root factor set of an alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees.

[0112] In some embodiments, the second degree of change of multiple factor subsets is obtained, and the degree of similarity between them and the first degree of change is obtained, and the maximum degree of similarity is determined from the multiple similarities obtained; the factor subset corresponding to the maximum degree of similarity among the multiple factor subsets is used as a candidate root factor set of an alarm dimension.

[0113] Specifically, if the similarity between the second change degree of a factor subset and the first change degree of the entire set is less than or equal to a preset threshold, the factor subset is considered to be a candidate root factor set; otherwise, the factor subset is not a candidate root factor set, wherein the formula for calculating the similarity is shown in the following formula (3):

[0114]

[0115] Among them, potential_score is the possibility score, which is used to evaluate the similarity between two variables; It represents the difference between the actual value of the factor subset and the actual value of the entire set; Represents the difference between the actual value of a subset of factors and the predicted value of the entire set.

[0116] If there are two candidate root factor sets with the same likelihood score, the factor subset with a relatively simple factor subset is selected as the candidate root factor set according to the Occam's razor principle. The Occam's razor principle means that when faced with multiple possibilities, the simplest and most direct option should be given priority to avoid unnecessary complexity.

[0117] In some embodiments, before obtaining a first degree of variation between the predicted value and the actual value of the overall set and a second degree of variation between the predicted value and the actual value of each factor subset, for each factor subset, the actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0118] Specifically, the calculation formula for obtaining the actual value of a factor subset is shown in the following formula (4):

[0119]

[0120] Among them, f(x) represents the predicted value of the entire set, h(x) represents the difference between the actual value of the entire set and the predicted value; f(x i ′ ) represents the predicted value of the factor subset, v(x i ′ ) represents the actual value of the factor subset.

[0121] In some embodiments, a candidate root factor set is selected from the candidate root factor sets of each of the multiple alarm dimensions as the first-level search range, and each node in the first-level search range corresponds to an influencing factor in the candidate root factor set; on the basis of the first-level search range, the other remaining candidate root factor sets are included in turn to obtain a search space containing multiple layers of search ranges; each layer of search range is obtained in the following manner: on the basis of the previous layer of search range, each influencing factor in a candidate root factor set of the remaining candidate root factor sets is included in the form of child nodes to obtain the current layer of search range.

[0122] For example, refer to Figure 3 If a candidate root factor set is (institution A, institution B), then the first-level search range is (institution A, institution B); the second-level search range is to introduce another candidate root factor set on the first-level search range, such as introducing (transaction type T, transaction type S), and obtain the second-level search range (institution A, transaction type T), (institution A, transaction type S), (institution B, transaction type T), (institution B, transaction type S).

[0123] In some embodiments, for any node in the current layer search range, if the predicted value and the actual value of the influencing factor combination corresponding to the node are the same, the node is deleted from the current layer search range.

[0124] Specifically, if the actual value of the influencing factor combination corresponding to the node is equal to the predicted value, it means that the influencing factor combination corresponding to the node does not produce anomalies, so the node is eliminated in the search space.

[0125] For example, refer to Figure 3 , the candidate root factor set is (institution A, institution B), and the predicted value and actual value of the influencing factor combination corresponding to a node in the search space, such as (institution A, transaction type T), are the same, then it is considered that the influencing factor combination (institution A, transaction type T) has no impact on the candidate root factor set, and the node (institution A, transaction type T) is deleted from the search space.

[0126] In the embodiment of the present application, when searching the search space, the nodes corresponding to the influencing factor combinations with no gap between the predicted value and the actual value are deleted, and the idea of ​​hierarchical pruning is introduced to optimize the search space, thereby improving the efficiency and timeliness of the search.

[0127] Step 203: Search in the search space constructed by the candidate root factor sets of multiple alarm dimensions to obtain target root cause combinations of multiple alarm dimensions.

[0128] In some embodiments, a master-slave architecture system is used to perform Monte Carlo tree searches in parallel in a search space constructed by candidate root factor sets of multiple alarm dimensions to obtain target root cause combinations of multiple alarm dimensions.

[0129] Specifically, Monte Carlo Tree Search (MCTS) includes: selection, expansion, simulation and backpropagation. Among them, selection refers to starting from the root node of the current tree, selecting the child node with the highest potential, and expanding downward until encountering a node or leaf node that has not been fully expanded. The UCB1 (Upper Confidence Bound for Trees) strategy is usually used for selection, that is, selecting the balance between the expected benefit and uncertainty of the maximized node; expansion means that if the selected leaf node is a node that has not been fully expanded and the problem has not been solved, one or more new child nodes are expanded on the node. Each child node represents a possible subsequent action or state; simulation refers to starting from the expanded new node and performing a random simulation (that is, from this node, taking random actions until the end of the game); backpropagation refers to returning the results of the simulation to all ancestor nodes of the tree, thereby updating the state information of these nodes.

[0130] In order to avoid falling into the local optimal solution, the formula of the Monte Carlo tree search algorithm is shown in the following formula (5):

[0131]

[0132] Among them, Score_a represents the score of child node or leaf node a in Monte Carlo tree search; A(s) represents the set of all child nodes; Q(s,a) represents the probability score of the child node to the parent node s; C is a constant; N(s) represents the number of times the parent node s is visited; N(s,a) represents the number of times the child node a connected to the parent node s is visited.

[0133] To improve the efficiency of Monte Carlo tree search, refer to Figure 4 This application establishes a master-worker architecture and uses the master to coordinate the management of the Monte Carlo search tree. Due to the high time cost of expansion and evaluation, it is assigned to different workers to perform and issue instructions to different workers at the same time. The specific operations are as follows:

[0134] Step 401, the master establishes the initial node.

[0135] Step 402, the master writes the task of expanding the child node into the buffer and synchronizes the state of the current Monte Carlo tree to the buffer.

[0136] Step 403: The worker executes the task of expanding the child node in the buffer and reversely synchronizes the status from the buffer to the master.

[0137] Step 404, the master writes the evaluation task of the expanded child node into the buffer.

[0138] Step 405: The idle worker executes the evaluation task of the child node.

[0139] Specifically, the worker's evaluation formula for the expanded child node is shown in the following formula (6):

[0140]

[0141] Among them, Score_new represents the evaluation score of the expanded child node; C(s) represents the set of all child nodes; V s′ It refers to the change in the predicted value between the child node and the parent node; β is a constant; N s Indicates the number of times a child node is visited; s Refers to the number of visits to the selected node to be expanded; N s′ Refers to the number of times the edge between a child node and its extended node is visited; s′ Indicates the number of times a child node is visited after it is expandable.

[0142] When the evaluation score of a subnode is greater than a preset threshold, the influencing factor combination corresponding to the subnode is considered to be the target root cause combination. The preset threshold is specified according to the actual business situation and is not limited in this application.

[0143] In order to verify the accuracy of the root cause location method in the present application, the present application uses the two indicators of Precision and Recall, as well as a data set of about 400 data to test the performance of the root cause location method. The results show that compared with the IDice algorithm in the prior art, the root cause location method of the present application has effectively improved the precision and recall rates in single-dimensional and multi-dimensional data; and the Adtributor algorithm in the prior art is a root cause location method that focuses on single-dimensional data, but performs poorly in multi-dimensional data. Therefore, compared with the Adtributor algorithm, the root cause location method of the present application has improved the precision and recall rates by more than 94% in multi-dimensional data.

[0144] In an embodiment of the present application, for each alarm dimension in the alarm dimension set, multiple influencing factors under the alarm dimension are taken as an overall set, and each of the multiple influencing factors is combined to obtain multiple factor subsets. Based on the similarity between the degree of change of each factor subset and the degree of change of the overall set, a candidate root factor set of the alarm dimension is selected from each factor subset, which greatly reduces the scope of subsequent root cause searches and improves the timeliness of root cause location. Secondly, searching in the search space constructed by the candidate root factor sets of multiple alarm dimensions to obtain the target root cause combination of multiple alarm dimensions can achieve rapid induction and location of the abnormal root causes and improve the accuracy of root cause location.

[0145] Based on the same technical concept, the present application embodiment provides a structural schematic diagram of a root cause positioning device, such as Figure 5 As shown, the root cause device 500 includes:

[0146] Acquisition module 501, used to obtain an alarm dimension set;

[0147] The processing module 502 is used to obtain multiple influencing factors under an alarm dimension, and take the multiple influencing factors as a whole set, combine the multiple influencing factors, and obtain multiple factor subsets;

[0148] Obtaining a first degree of variation between the predicted value and the actual value of the overall set, and a second degree of variation between the predicted value and the actual value of each factor subset;

[0149] Selecting a set of candidate root factors of the one alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees respectively;

[0150] The search module 503 is used to search in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

[0151] Optionally, the acquisition module 501 is further used for:

[0152] Obtain multiple alarm dimensions from abnormal alarm information of multi-dimensional time series data;

[0153] Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

[0154] Optionally, the acquisition module 501 is further used for:

[0155] For the single-dimensional time series data of each of the multiple alarm indicators, the following operations are performed respectively:

[0156] Inputting the single-dimensional time series data of an alarm indicator into the autoregressive difference moving average model for prediction, and obtaining the predicted value of the alarm indicator at the next time point;

[0157] When the predicted value of the one alarm indicator at the next time point and the actual value of the one alarm indicator at the next time point meet the alarm condition, generating abnormal alarm information of the one alarm indicator;

[0158] Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multi-dimensional time series data is obtained.

[0159] Optionally, the processing module 502 is specifically configured to:

[0160] Obtaining the second degree of variation of the plurality of factor subsets, and the degree of similarity between the second degree of variation and the first degree of variation, and determining the maximum degree of similarity from the plurality of obtained degrees of similarity;

[0161] The factor subset corresponding to the maximum similarity among the multiple factor subsets is used as the candidate root factor set of the one alarm dimension.

[0162] Optionally, the processing module 502 is further configured to:

[0163] For each factor subset, an actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0164] Optionally, the search module 503 is further used for:

[0165] Selecting a candidate root factor set from the candidate root factor sets of the multiple alarm dimensions as a first-level search range, wherein each node in the first-level search range corresponds to an influencing factor in the candidate root factor set;

[0166] On the basis of the first layer of search range, the remaining candidate root factor sets are included in turn to obtain the search space including multiple layers of search ranges; each layer of search range is obtained in the following manner:

[0167] On the basis of the search scope of the previous layer, each influencing factor in one of the remaining candidate root factor sets is incorporated in the form of a child node to obtain the search scope of the current layer.

[0168] Optionally, the search module 503 is further used for:

[0169] For any node in the current layer search range, if the predicted value and the actual value of the influencing factor combination corresponding to the node are the same, the node is deleted from the current layer search range.

[0170] Optionally, the search module 503 is specifically used for:

[0171] A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions.

[0172] In an embodiment of the present application, for each alarm dimension in the alarm dimension set, multiple influencing factors under the alarm dimension are taken as an overall set, and each of the multiple influencing factors is combined to obtain multiple factor subsets. Based on the similarity between the degree of change of each factor subset and the degree of change of the overall set, a candidate root factor set of the alarm dimension is selected from each factor subset, which greatly reduces the scope of subsequent root cause searches and improves the timeliness of root cause location. Secondly, searching in the search space constructed by the candidate root factor sets of multiple alarm dimensions to obtain the target root cause combination of multiple alarm dimensions can achieve rapid induction and location of the root causes of the anomalies and improve the accuracy of root cause location.

[0173] Based on the same technical concept, the embodiment of the present application provides a computer device, which can be Figure 1 The server shown, such as Figure 6 As shown, it includes at least one processor 601 and a memory 602 connected to the at least one processor. The specific link medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 For example, the processor 601 and the memory 602 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0174] In the embodiment of the present application, the memory 602 stores instructions executed by at least one processor 601, and the at least one processor 601 can perform the steps of the above-mentioned root cause location method by executing the instructions stored in the memory 602.

[0175] Among them, the processor 601 is the control center of the computer device, and can use various interfaces and lines to connect various parts of the computer device, and realize root cause location by running or executing instructions stored in the memory 602 and calling data stored in the memory 602. Optionally, the processor 601 may include one or more processing modules, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0176] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0177] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0178] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned root cause locating method.

[0179] Based on the same inventive concept, an embodiment of the present application provides a computer program product, including a computer program stored on a computer-readable storage medium, wherein the computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the steps of the above-mentioned root cause location method.

[0180] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0181] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0182] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0183] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0184] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A root cause location method, characterized in that: include: Get the alarm dimension set; For each alarm dimension in the alarm dimension set, the following operations are performed respectively: Acquire multiple influencing factors under an alarm dimension, and take the multiple influencing factors as a whole set, combine the multiple influencing factors, and obtain multiple factor subsets; Obtaining a first degree of variation between the predicted value and the actual value of the overall set, and a second degree of variation between the predicted value and the actual value of each factor subset; Selecting a set of candidate root factors of the one alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees respectively; Search is performed in a search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions.

2. The method according to claim 1, characterized in that Before obtaining the alarm dimension set, it also includes: Obtain multiple alarm dimensions from abnormal alarm information of multi-dimensional time series data; Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

3. The method according to claim 2, characterized in that The multi-dimensional time series data includes: single-dimensional time series data of each of the multiple alarm indicators; before obtaining multiple alarm dimensions from the abnormal alarm information of the multi-dimensional time series data, the method further includes: For the single-dimensional time series data of each of the multiple alarm indicators, the following operations are performed respectively: Inputting the single-dimensional time series data of an alarm indicator into the autoregressive difference moving average model for prediction, and obtaining the predicted value of the alarm indicator at the next time point; When the predicted value of the one alarm indicator at the next time point and the actual value of the one alarm indicator at the next time point meet the alarm condition, generating abnormal alarm information of the one alarm indicator; Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multi-dimensional time series data is obtained.

4. The method according to claim 1, characterized in that The selecting the candidate root factor set of the one alarm dimension from the multiple factor subsets based on the second change degrees of the multiple factor subsets and the similarity between the first change degrees respectively includes: Obtaining the second degree of variation of the plurality of factor subsets, and the degree of similarity between the second degree of variation and the first degree of variation, and determining the maximum degree of similarity from the plurality of obtained degrees of similarity; The factor subset corresponding to the maximum similarity among the multiple factor subsets is used as the candidate root factor set of the one alarm dimension.

5. The method according to claim 1, characterized in that Before obtaining the first degree of change between the predicted value and the actual value of the overall set and the second degree of change between the predicted value and the actual value of each factor subset, the method further includes: For each factor subset, an actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

6. The method according to any one of claims 1 to 5, characterized in that: Before searching in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions, the method further includes: Selecting a candidate root factor set from the candidate root factor sets of the multiple alarm dimensions as a first-level search range, wherein each node in the first-level search range corresponds to an influencing factor in the candidate root factor set; On the basis of the first layer of search range, the remaining candidate root factor sets are included in turn to obtain the search space including multiple layers of search ranges; each layer of search range is obtained in the following manner: On the basis of the search scope of the previous layer, each influencing factor in one of the remaining candidate root factor sets is incorporated in the form of a child node to obtain the search scope of the current layer.

7. The method according to claim 6, characterized in that After obtaining the current layer search range, the influencing factors in one of the candidate root factor sets in the remaining candidate root factor sets are incorporated into the candidate root factor set in the form of child nodes on the basis of the previous layer search range, and the following is further included: For any node in the current layer search range, if the predicted value and the actual value of the influencing factor combination corresponding to the node are the same, the node is deleted from the current layer search range.

8. The method according to claim 7, characterized in that The searching in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions includes: A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain target root cause combinations of the multiple alarm dimensions.

9. A root cause location device, characterized in that: include: The acquisition module is used to obtain the alarm dimension set; A processing module, used for obtaining multiple influencing factors under an alarm dimension, and taking the multiple influencing factors as a whole set, combining the multiple influencing factors to obtain multiple factor subsets; Obtaining a first degree of variation between the predicted value and the actual value of the overall set, and a second degree of variation between the predicted value and the actual value of each factor subset; Selecting a set of candidate root factors of the one alarm dimension from the multiple factor subsets based on the similarity between the second change degrees of the multiple factor subsets and the first change degrees respectively; The search module is used to search in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of any one of the methods of claims 1 to 8 are implemented.

11. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device. When the program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 8.

Images