A root cause localization method and apparatus

Abstract

This application provides a root cause localization method and apparatus, applicable to the field of computer technology. In this method, for each alarm dimension in the obtained alarm dimension set, the following operations are performed: multiple influencing factors under an alarm dimension are obtained; these multiple influencing factors are treated as a whole set; the multiple influencing factors are combined to obtain multiple factor subsets; a first degree of change between the predicted and actual values ​​of the whole set, and a second degree of change between the predicted and actual values ​​of each factor subset are obtained; based on the similarity between the second degree of change of the multiple factor subsets and the first degree of change, a candidate root factor set for an alarm dimension is selected from the multiple factor subsets; a search is performed in the search space constructed from the candidate root factor sets of the multiple alarm dimensions to obtain a combination of target root causes for the multiple alarm dimensions. This achieves rapid localization of abnormal root causes, improving the accuracy and timeliness of root cause localization.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a root cause localization method and apparatus. Background Technology

[0002] Currently, for internet companies, routine monitoring and emergency response to detected faults are critical issues. Rapid root cause analysis and fault recovery in the event of emergencies have become core competencies for these companies. To achieve this, relevant technologies utilize established monitoring metrics to conduct daily monitoring of business systems and services. When anomalies are detected, operations and maintenance personnel, based on their experience, pinpoint the root cause of the anomaly and restore order.

[0003] However, the above-mentioned technical solutions often rely on experience to summarize and locate the root cause of the anomaly, which lacks universality and is prone to problems such as inaccurate root cause location and low timeliness of root cause location. Summary of the Invention

[0004] This invention provides a root cause localization method and apparatus to improve the accuracy and timeliness of root cause localization.

[0005] On one hand, embodiments of this application provide a root cause localization method, the method comprising:

[0006] Obtain the set of alarm dimensions;

[0007] For each alarm dimension in the alarm dimension set, perform the following operations:

[0008] Obtain multiple influencing factors under one alarm dimension, and combine these multiple influencing factors as a whole set to obtain multiple factor subsets;

[0009] Obtain a first degree of variation between the predicted and actual values ​​of the overall set, and a second degree of variation between the predicted and actual values ​​of each factor subset;

[0010] Based on the second degree of change of the multiple factor subsets and the similarity between them and the first degree of change, a candidate root factor set for the alarm dimension is selected from the multiple factor subsets.

[0011] A search is conducted in the search space constructed from the candidate root factor sets of the multiple alarm dimensions to obtain the target root factor combination of the multiple alarm dimensions.

[0012] Optionally, before obtaining the alarm dimension set, the method further includes:

[0013] Multiple alarm dimensions are obtained from the abnormal alarm information of multidimensional time series data;

[0014] Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

[0015] Optionally, the multidimensional time-series data includes: single-dimensional time-series data of each of the multiple alarm indicators; before obtaining multiple alarm dimensions from the abnormal alarm information in the multidimensional time-series data, the method further includes:

[0016] For each of the multiple alarm indicators and their respective one-dimensional time-series data, perform the following operations:

[0017] One-dimensional time series data of an alarm indicator is input into an autoregressive differential moving average model for prediction, and the predicted value of the alarm indicator at the next time point is obtained.

[0018] When the predicted value of the alarm indicator at the next time point and the actual value of the alarm indicator at the next time point meet the alarm conditions, an abnormal alarm information for the alarm indicator is generated.

[0019] Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multidimensional time series data is obtained.

[0020] Optionally, selecting a candidate root factor set for the alarm dimension from the plurality of factor subsets based on the similarity between the second degree of change of the plurality of factor subsets and the first degree of change includes:

[0021] Obtain the second degree of change of the plurality of factor subsets, the similarity between each subset and the first degree of change, and determine the maximum similarity from the plurality of obtained similarities;

[0022] The subset of factors with the highest similarity among the multiple factor subsets is taken as the candidate root factor set for the alarm dimension.

[0023] Optionally, before obtaining the first degree of change between the predicted and actual values ​​of the overall set, and the second degree of change between the predicted and actual values ​​of each factor subset, the method further includes:

[0024] For each factor subset, the actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0025] Optionally, before searching the search space constructed from the candidate root factor sets of the multiple alarm dimensions to obtain the target root factor combination of the multiple alarm dimensions, the method further includes:

[0026] From the candidate root factor sets of each of the multiple alarm dimensions, one candidate root factor set is selected as the first-level search range, and each node in the first-level search range corresponds to an influencing factor in the candidate root factor set.

[0027] Based on the first search range, other remaining candidate root factor sets are sequentially included to obtain the search space containing multiple search ranges; each search range is obtained in the following way:

[0028] Based on the search scope of the previous layer, each influencing factor in the remaining candidate root factor set is incorporated as a child node to obtain the current search scope.

[0029] Optionally, after obtaining the current search scope by incorporating each influencing factor from a candidate root factor set in the remaining candidate root factor set as a child node, based on the search scope of the previous layer, the method further includes:

[0030] If the predicted value and the actual value of the combination of influencing factors corresponding to any node in the current layer search range are the same, then the node is deleted from the current layer search range.

[0031] Optionally, the step of searching in the search space constructed from the candidate root factor sets of the multiple alarm dimensions to obtain the target root factor combination of the multiple alarm dimensions includes:

[0032] A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

[0033] On one hand, embodiments of this application provide a root cause localization device, the device comprising:

[0034] The acquisition module is used to obtain the alarm dimension set;

[0035] The processing module is used to obtain multiple influencing factors under one alarm dimension, and to combine the multiple influencing factors as a whole set to obtain multiple factor subsets;

[0036] Obtain a first degree of variation between the predicted and actual values ​​of the overall set, and a second degree of variation between the predicted and actual values ​​of each factor subset;

[0037] Based on the second degree of change of the multiple factor subsets and the similarity between them and the first degree of change, a candidate root factor set for the alarm dimension is selected from the multiple factor subsets.

[0038] The search module is used to search in the search space constructed from the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

[0039] Optionally, the acquisition module is also used for:

[0040] Multiple alarm dimensions are obtained from the abnormal alarm information of multidimensional time series data;

[0041] Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

[0042] Optionally, the acquisition module is also used for:

[0043] For each of the multiple alarm indicators and their respective one-dimensional time-series data, perform the following operations:

[0044] One-dimensional time series data of an alarm indicator is input into an autoregressive differential moving average model for prediction, and the predicted value of the alarm indicator at the next time point is obtained.

[0045] When the predicted value of the alarm indicator at the next time point and the actual value of the alarm indicator at the next time point meet the alarm conditions, an abnormal alarm information for the alarm indicator is generated.

[0046] Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multidimensional time series data is obtained.

[0047] Optionally, the processing module is specifically used for:

[0048] Obtain the second degree of change of the plurality of factor subsets, the similarity between each subset and the first degree of change, and determine the maximum similarity from the plurality of obtained similarities;

[0049] The subset of factors with the highest similarity among the multiple factor subsets is taken as the candidate root factor set for the alarm dimension.

[0050] Optionally, the processing module is also used for:

[0051] For each factor subset, the actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0052] Optionally, the search module is also used for:

[0053] From the candidate root factor sets of each of the multiple alarm dimensions, one candidate root factor set is selected as the first-level search range, and each node in the first-level search range corresponds to an influencing factor in the candidate root factor set.

[0054] Based on the first search range, other remaining candidate root factor sets are sequentially included to obtain the search space containing multiple search ranges; each search range is obtained in the following way:

[0055] Based on the search scope of the previous layer, each influencing factor in the remaining candidate root factor set is incorporated as a child node to obtain the current search scope.

[0056] Optionally, the search module is also used for:

[0057] If the predicted value and the actual value of the combination of influencing factors corresponding to any node in the current layer search range are the same, then the node is deleted from the current layer search range.

[0058] Optionally, the search module is specifically used for:

[0059] A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

[0060] On one hand, embodiments of this application provide a computer device, including:

[0061] Memory, used to store program instructions;

[0062] The processor is used to call the program instructions stored in the memory and execute the steps of the root cause localization method described above according to the obtained program.

[0063] On one hand, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a computer device, which, when run on the computer device, causes the computer to perform the steps of the root cause localization method described above.

[0064] On one hand, embodiments of this application provide a computer program product, including a computer program stored on a computer-readable storage medium, the computer program including program instructions, which, when executed by a computer device, cause the computer device to perform the steps of the root cause localization method described above.

[0065] In this embodiment, for each alarm dimension in the alarm dimension set, multiple influencing factors under that alarm dimension are treated as a whole set, and each influencing factor is combined to obtain multiple factor subsets. Based on the similarity between the degree of change of each factor subset and the degree of change of the whole set, candidate root factor sets for that alarm dimension are selected from each factor subset. This greatly reduces the scope of subsequent root cause search and improves the timeliness of root cause localization. Secondly, searching within the search space constructed from the candidate root factor sets of multiple alarm dimensions yields a combination of target root causes for multiple alarm dimensions, enabling rapid summarization and localization of the root causes of anomalies and improving the accuracy of root cause localization. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 A schematic diagram of a system architecture provided in an embodiment of this application;

[0068] Figure 2 A flowchart illustrating a root cause localization method provided in an embodiment of this application;

[0069] Figure 3 A flowchart illustrating a root cause localization method provided in an embodiment of this application;

[0070] Figure 4 A flowchart illustrating a root cause localization method provided in an embodiment of this application;

[0071] Figure 5 This is a schematic diagram of the structure of a root cause localization device provided in an embodiment of this application;

[0072] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0073] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0074] The following is a brief introduction to the system architecture diagram applicable to the technical solutions of the embodiments of this application. It should be noted that the process described below is only for illustrating the embodiments of this application and is not intended to limit the scope of the application.

[0075] refer to Figure 1 This is a system architecture diagram applicable to the embodiments of this application. The system architecture includes at least terminal device 101 and server 102. The number of terminal devices 101 can be one or more, and the number of servers 102 can also be one or more. This application does not specifically limit the number of terminal devices 101 and servers 102.

[0076] The terminal device 101 has the target application for root cause localization pre-installed. This application can be a client application, a web application, a mini-program application, etc. The terminal device 101 can be a smartphone, tablet, laptop, desktop computer, smart home appliance, smart voice interaction device, smart in-vehicle device, etc., but is not limited to these.

[0077] Server 102 is the backend server of the target application. Server 102 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, but it is not limited to these.

[0078] It should be noted that the method in this embodiment can be executed by the terminal device 101 or the server 102 alone, or by the terminal device 101 and the server 102 together.

[0079] In this embodiment, the terminal device 101 and the server 102 can communicate directly or indirectly through one or more networks. The network can be a wired network or a wireless network; for example, the wireless network can be a mobile cellular network or a Wireless-Fidelity (WIFI) network, or other possible networks. This embodiment does not limit the types of networks used.

[0080] The following is based on Figure 1 The system architecture diagram shown illustrates the flowchart of a root cause localization method provided in this application embodiment. This method's flowchart can be... Figure 1 The execution can be performed by the terminal device 101 shown, or by the server 102, or by interaction between the terminal device 101 and the server 102, as shown. Figure 2 As shown, it includes the following steps:

[0081] Step 201: Obtain the alarm dimension set.

[0082] In some embodiments, multiple alarm dimensions are obtained from the abnormal alarm information of multidimensional time-series data; based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets. The root cause localization method of this application is executed for each alarm dimension set.

[0083] Specifically, a time series refers to a sequence of statistical values ​​of a certain indicator arranged in chronological order. A one-dimensional time series is a time series showing the change of data for a single-dimensional indicator over time; multi-dimensional time series refers to a time series showing the change of data for multiple dimensions of indicators over time. Multi-dimensional time series data is composed of multiple one-dimensional time series.

[0084] Taking the monitoring and maintenance of all online commodity trading institutions as an example, a single-dimensional time series can be the transaction success rate of the trading institution over time; a single-dimensional time series can also be the CPU utilization rate of the server over time; a single-dimensional time series can also be the connection rate of the central external network link over time.

[0085] The multidimensional time series includes: the transaction success rate of the trading institution over time, the connection rate of the central external network links over time, and the success rate of transaction types over time.

[0086] In practical applications, multiple alarm dimensions may occur within a time period. Based on association learning rules, multiple alarm dimensions occurring within at least one adjacent time point are divided into an alarm dimension combination. Dividing multiple adjacent time periods yields multiple alarm dimension combinations.

[0087] Specifically, the purpose of association learning rules is to find the relationships or associations between different items in a dataset. Effectiveness is usually measured using statistical indicators such as support, confidence, and lift. Support refers to the proportion of multiple itemsets that contain a particular itemset (or combination of itemsets), i.e., the ratio of transactions containing an itemset to the total number of transactions, used to measure the frequency of the premise and conclusion appearing together. Confidence refers to the ratio of the number of transactions where the premise and conclusion appear together to the number of transactions where the premise appears alone. Lift is the degree of association between the premise and conclusion, and the formula for calculating lift is shown in formula (1) below:

[0088]

[0089] Where Q represents lift; P represents support when both premise and conclusion appear; M represents support for premise; and N represents support for conclusion.

[0090] For example, multiple alarm dimensions at three adjacent time points are shown in Table 1:

[0091] Table 1

[0092]

[0093]

[0094] Table 1 shows that a decrease in the institution's external network link connectivity rate may lead to a decrease in the institution's transaction success rate and the success rate of certain transaction types at similar time points. Therefore, multiple alarm dimensions appearing at similar time points are divided into one alarm dimension combination. Thus, based on association rule learning, an alarm dimension combination is obtained from the multiple alarm dimensions appearing at the three time points in Table 1 (institution, transaction type, transaction success rate, network connectivity rate).

[0095] In this embodiment of the application, multiple alarm dimensions occurring at at least one adjacent time point are treated as an alarm dimension set based on association learning rules, which can improve the speed and efficiency of root cause localization.

[0096] In some embodiments, before obtaining multiple alarm dimensions from the abnormal alarm information of multidimensional time series data, the following operations are performed on the single-dimensional time series data of each of the multiple alarm indicators:

[0097] One-dimensional time-series data of an alarm indicator is input into an autoregressive differencing moving average model for prediction, obtaining the predicted value of the alarm indicator at the next time point; based on the predicted value of the alarm indicator at the next time point, when the actual value of the alarm indicator at the next time point meets the alarm condition, an abnormal alarm message for the alarm indicator is generated; based on the abnormal alarm messages of multiple alarm indicators, abnormal alarm messages of multi-dimensional time-series data are obtained.

[0098] Specifically, the Autoregressive Moving Average (ARIMA) model mainly consists of three parts: the autoregressive model (AR), the differencing process (I), and the moving average model (MA). The AR part handles the autoregressive component of the time series, considering the influence of past observations on the current value. The I part is used to bring a non-stationary time series to stationarity by eliminating trends and seasonality through first- or second-order equal differencing. The MA part handles the moving average component of the time series, considering the impact of past prediction errors on the current value.

[0099] The basic formula of the ARIMA model is shown in the following formula (2):

[0100]

[0101] Among them, Y t Y represents the predicted value at the current time t; t-1 Y t-2 , ..., Y t-p This represents the predicted values ​​over multiple past time points; c represents a constant offset used to adjust the average level of the model's predictions. These are autoregressive coefficients, representing the influence of p past time points on the current time point; θ1, θ2, ..., θ q It is the moving average coefficient, representing the influence of the error term from the past q times on the current time; ε t-1 , ε t-2 , ..., ε t-q , ε t It represents the error between predicted and actual values ​​at multiple points in the past.

[0102] In the ARIMA model, p means that the observation at time t is a linear combination of the previous p time points, q means that the observation at time t is affected by the error terms of the previous q time points, and d means the difference order, which indicates how many differences the data will undergo before it becomes stationary.

[0103] When the difference between a predicted value at the next time point and the actual value of an alarm indicator at the next time point is greater than a preset threshold, the alarm indicator is considered abnormal, and an abnormal alarm message for the alarm indicator is generated.

[0104] Taking the transaction success rate of online trading institutions as an example, Y t Y represents the predicted success rate of the transaction at the current moment. t-1 Y t-2 , ..., Y t-p ε represents the predicted success rate of transactions over the past p time points; t-1 , ε t-2 , ..., ε t-q , ε t It is the error between the predicted and actual values ​​of the transaction success rate over the past q time points; These are autoregressive coefficients, representing the influence of p past time points on the current time point; θ1, θ2, ..., θ q It is the moving average coefficient, representing the impact of the error between the predicted and actual transaction success rates over the past q time points on the current time point.

[0105] In this embodiment, the ARIMA model is used to detect anomalies in time series data. It makes predictions by considering the historical dependence (autoregressive part), stationarity (difference part), and error term (moving average part) of the time series. The predicted value is compared with the actual value to determine the alarm dimension. It has high accuracy and strong interpretability, making the anomaly detection process more efficient and continuous.

[0106] Step 202: For each alarm dimension in the alarm dimension set, execute the following steps 2021-2023 respectively:

[0107] Step 2021: Obtain multiple influencing factors under one alarm dimension, and combine the multiple influencing factors as a whole set to obtain multiple factor subsets.

[0108] Step 2022: Obtain the first degree of variation between the predicted and actual values ​​of the entire set, and the second degree of variation between the predicted and actual values ​​of each factor subset.

[0109] Specifically, the first degree of variation between the predicted and actual values ​​of the overall set represents the difference between the predicted and actual values ​​of the overall set; the second degree of variation between the predicted and actual values ​​of each factor subset represents the difference between the predicted and actual values ​​of the factor subset.

[0110] Step 2023: Based on the second degree of change of multiple factor subsets and the similarity between them and the first degree of change, select a candidate root factor set for an alarm dimension from the multiple factor subsets.

[0111] In some embodiments, a second degree of change of a plurality of factor subsets is obtained, and the similarity between each subset and a first degree of change is determined. The maximum similarity is determined from the plurality of similarities obtained. The factor subset corresponding to the maximum similarity in the plurality of factor subsets is used as a candidate root factor set for an alarm dimension.

[0112] Specifically, if the similarity between the second degree of change of a factor subset and the first degree of change of the whole set is less than or equal to a preset threshold, then the factor subset is considered to be a candidate root factor set; otherwise, the factor subset is not a candidate root factor set. The formula for calculating the similarity is shown in the following formula (3):

[0113]

[0114] Wherein, potential_score is the probability score, used to assess the similarity between two variables; This represents the difference between the actual value of the factor subset and the actual value of the entire set. This represents the difference between the actual value of a subset of factors and the predicted value of the entire set.

[0115] If two candidate root factor sets exist with the same probability score, then according to Occam's Razor, the subset with the simpler factor set is selected as the candidate root factor set. Occam's Razor states that when faced with multiple possibilities, the simplest and most direct choice should be prioritized to avoid unnecessary complexity.

[0116] In some embodiments, before obtaining a first degree of variation between the predicted and actual values ​​of the overall set, and a second degree of variation between the predicted and actual values ​​of each factor subset, the actual value of each factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0117] Specifically, the formula for calculating the actual value of a subset of factors is shown in the following formula (4):

[0118]

[0119] Where f(x) represents the predicted value of the entire set, and h(x) represents the difference between the actual value and the predicted value of the entire set; f(x) i ′ ) represents the predicted value of a subset of factors, v(x) i ′ ) represents the actual value of a subset of factors.

[0120] In some embodiments, from the candidate root factor sets of multiple alarm dimensions, one candidate root factor set is selected as the first-level search scope. Each node in the first-level search scope corresponds to an influencing factor in one candidate root factor set. Based on the first-level search scope, other remaining candidate root factor sets are sequentially included to obtain a search space containing multiple search scopes. Each search scope is obtained in the following way: based on the previous search scope, each influencing factor in one candidate root factor set of the remaining candidate root factor sets is included as a child node to obtain the current search scope.

[0121] For example, refer to Figure 3 If a candidate root factor set is (Institution A, Institution B), then the first search range is (Institution A, Institution B); the second search range is to introduce another candidate root factor set on the first search range, such as (Transaction Type T, Transaction Type S), to obtain the second search range (Institution A, Transaction Type T), (Institution A, Transaction Type S), (Institution B, Transaction Type T), (Institution B, Transaction Type S).

[0122] In some embodiments, for any node in the current layer search range, if the predicted value and the actual value of the combination of influencing factors corresponding to the node are the same, then the node is deleted from the current layer search range.

[0123] Specifically, if the actual value of the combination of influencing factors corresponding to a node is equal to the predicted value, it means that the combination of influencing factors corresponding to that node has not produced any anomalies, and therefore the node is removed from the search space.

[0124] For example, refer to Figure 3 If the candidate root factor set is (Institution A, Institution B), and the predicted value and actual value of the influencing factor combination corresponding to a node in its search space are the same, then it is considered that the influencing factor combination (Institution A, Transaction Type T) has no impact on the candidate root factor set, and the node (Institution A, Transaction Type T) is deleted from the search space.

[0125] In this embodiment of the application, when searching the search space, nodes corresponding to combinations of influencing factors whose predicted values ​​and actual values ​​are indistinguishable are deleted. The idea of ​​hierarchical pruning is introduced to optimize the search space, thereby improving the efficiency and timeliness of the search.

[0126] Step 203: Search in the search space constructed from the candidate root factor set of multiple alarm dimensions to obtain the target root factor combination of multiple alarm dimensions.

[0127] In some embodiments, a master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by candidate root factor sets of multiple alarm dimensions to obtain the target root cause combination of multiple alarm dimensions.

[0128] Specifically, Monte Carlo Tree Search (MCTS) includes selection, expansion, simulation, and backpropagation. Selection involves starting from the root node of the current tree and choosing the child node with the highest potential, expanding downwards until a node or leaf node that is not yet fully expanded is encountered. The UCB1 (Upper Confidence Bound for Trees) strategy is typically used for selection, which balances the expected reward of a node with its uncertainty. Expansion involves expanding one or more new child nodes on a selected leaf node if it is not yet fully expanded and the problem is unsolved. Each child node represents a possible subsequent action or state. Simulation involves performing a random simulation starting from the newly expanded node (i.e., taking random actions from this node until the game ends). Backpropagation involves posting the simulation results back to all ancestor nodes of the tree, thereby updating the state information of these nodes.

[0129] To avoid getting trapped in local optima, the Monte Carlo tree search algorithm is formulated as shown in equation (5) below:

[0130]

[0131] Where Score_a represents the score of child node or leaf node a in Monte Carlo tree search; A(s) represents the set of all child nodes; Q(s,a) represents the probability score of a child node to its parent node s; C is a constant; N(s) represents the number of times the parent node s is visited; N(s,a) represents the number of times the node connected to the parent node s is visited.

[0132] To improve the efficiency of Monte Carlo tree search, refer to Figure 4 This application establishes a master-worker architecture, using the master to manage the Monte Carlo search tree. Due to the high time cost of expansion and evaluation, these tasks are assigned to different workers, and instructions are issued to each worker. The specific operations are as follows:

[0133] Step 401: The master establishes the initial node.

[0134] In step 402, the master writes the task of expanding the child nodes into the buffer and synchronizes the current state of the Monte Carlo tree to the buffer.

[0135] Step 403: The worker executes the extended child node tasks in the buffer and reverse synchronizes the state from the buffer to the master.

[0136] In step 404, the master writes the evaluation tasks of the extended child nodes into the buffer.

[0137] Step 405: Idle workers perform the evaluation task of child nodes.

[0138] Specifically, the evaluation formula for the worker's extended child nodes is shown in the following formula (6):

[0139]

[0140] Where Score_new represents the evaluation score of the expanded child node; C(s) represents the set of all child nodes; V s′ This refers to the change in predicted values ​​between child and parent nodes; β is a constant; N s Indicates the number of times a child node has been visited; O s N refers to the number of visits to the selected node to be expanded; s′ The number of times the edge between a child node and its expanding node is visited; O s′ This indicates the number of times the child node has been accessed after it has been expanded.

[0141] If the evaluation score of a child node is greater than a preset threshold, the combination of influencing factors corresponding to that child node is considered the target root cause combination. The preset threshold is specified based on the actual business situation and is not limited in this application.

[0142] To verify the accuracy of the root cause localization method in this application, the performance of the method was tested using two metrics, Precision and Recall, and a dataset of approximately 400 data points. The results show that, compared to the IDice algorithm in the prior art, the root cause localization method of this application effectively improves both precision and recall on both unidimensional and multidimensional data. The Adtributor algorithm in the prior art is a root cause localization method focused on unidimensional data, but performs poorly on multidimensional data. Therefore, the root cause localization method of this application improves precision and recall by more than 94% compared to the Adtributor algorithm on multidimensional data.

[0143] In this embodiment, for each alarm dimension in the alarm dimension set, multiple influencing factors under that alarm dimension are treated as a whole set. Furthermore, each influencing factor is combined to obtain multiple factor subsets. Based on the similarity between the degree of change of each factor subset and the degree of change of the whole set, candidate root factor sets for that alarm dimension are selected from each factor subset. This significantly reduces the scope of subsequent root cause search and improves the timeliness of root cause localization. Secondly, searching within the search space constructed from the candidate root factor sets of multiple alarm dimensions yields a combination of target root causes for multiple alarm dimensions. This enables rapid summarization and localization of the root causes of anomalies, improving the accuracy of root cause localization.

[0144] Based on the same technical concept, this application provides a schematic diagram of the structure of a root cause localization device, as shown below. Figure 5 As shown, the root cause device 500 includes:

[0145] Module 501 is used to obtain the alarm dimension set;

[0146] Processing module 502 is used to obtain multiple influencing factors under an alarm dimension, and combine the multiple influencing factors as a whole set to obtain multiple factor subsets;

[0147] Obtain a first degree of variation between the predicted and actual values ​​of the overall set, and a second degree of variation between the predicted and actual values ​​of each factor subset;

[0148] Based on the second degree of change of the multiple factor subsets and the similarity between them and the first degree of change, a candidate root factor set for the alarm dimension is selected from the multiple factor subsets.

[0149] The search module 503 is used to search in the search space constructed from the candidate root factor sets of the multiple alarm dimensions to obtain the target root factor combination of the multiple alarm dimensions.

[0150] Optionally, the acquisition module 501 is also used for:

[0151] Multiple alarm dimensions are obtained from the abnormal alarm information of multidimensional time series data;

[0152] Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

[0153] Optionally, the acquisition module 501 is also used for:

[0154] For each of the multiple alarm indicators and their respective one-dimensional time-series data, perform the following operations:

[0155] One-dimensional time series data of an alarm indicator is input into an autoregressive differential moving average model for prediction, and the predicted value of the alarm indicator at the next time point is obtained.

[0156] When the predicted value of the alarm indicator at the next time point and the actual value of the alarm indicator at the next time point meet the alarm conditions, an abnormal alarm information for the alarm indicator is generated.

[0157] Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multidimensional time series data is obtained.

[0158] Optionally, the processing module 502 is specifically used for:

[0159] Obtain the second degree of change of the plurality of factor subsets, the similarity between each subset and the first degree of change, and determine the maximum similarity from the plurality of obtained similarities;

[0160] The subset of factors with the highest similarity among the multiple factor subsets is taken as the candidate root factor set for the alarm dimension.

[0161] Optionally, the processing module 502 is also used for:

[0162] For each factor subset, the actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

[0163] Optionally, the search module 503 is also used for:

[0164] From the candidate root factor sets of each of the multiple alarm dimensions, one candidate root factor set is selected as the first-level search range, and each node in the first-level search range corresponds to an influencing factor in the candidate root factor set.

[0165] Based on the first search range, other remaining candidate root factor sets are sequentially included to obtain the search space containing multiple search ranges; each search range is obtained in the following way:

[0166] Based on the search scope of the previous layer, each influencing factor in the remaining candidate root factor set is incorporated as a child node to obtain the current search scope.

[0167] Optionally, the search module 503 is also used for:

[0168] If the predicted value and the actual value of the combination of influencing factors corresponding to any node in the current layer search range are the same, then the node is deleted from the current layer search range.

[0169] Optionally, the search module 503 is specifically used for:

[0170] A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

[0171] In this embodiment, for each alarm dimension in the alarm dimension set, multiple influencing factors under that alarm dimension are treated as a whole set, and each influencing factor is combined to obtain multiple factor subsets. Based on the similarity between the degree of change of each factor subset and the degree of change of the whole set, candidate root factor sets for that alarm dimension are selected from each factor subset. This greatly reduces the scope of subsequent root cause search and improves the timeliness of root cause localization. Secondly, searching within the search space constructed from the candidate root factor sets of multiple alarm dimensions yields a combination of target root causes for multiple alarm dimensions, enabling rapid summarization and localization of the root causes of anomalies and improving the accuracy of root cause localization.

[0172] Based on the same technical concept, embodiments of this application provide a computer device, which can be... Figure 1 The server shown is as follows: Figure 6 As shown, it includes at least one processor 601 and a memory 602 connected to at least one processor. In this embodiment, the specific linking medium between the processor 601 and the memory 602 is not limited. Figure 6 Taking the connection between the processor 601 and the memory 602 via a bus as an example, the bus can be divided into address bus, data bus, control bus, etc.

[0173] In this embodiment of the application, the memory 602 stores instructions executed by at least one processor 601. By executing the instructions stored in the memory 602, at least one processor 601 can perform the steps of the root cause localization method described above.

[0174] The processor 601 is the control center of the computer device, capable of connecting various parts of the computer device via various interfaces and lines. It achieves root cause localization by running or executing instructions stored in the memory 602 and accessing data stored in the memory 602. Optionally, the processor 601 may include one or more processing modules. The processor 601 may integrate an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0175] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0176] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer device, but is not limited thereto. In the embodiments of this application, memory 602 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0177] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of the root cause localization method described above.

[0178] Based on the same inventive concept, embodiments of this application provide a computer program product, including a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer device, cause the computer device to perform the steps of the root cause localization method described above.

[0179] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0181] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0183] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A root cause localization method, characterized in that, include: Obtain the set of alarm dimensions; For each alarm dimension in the alarm dimension set, perform the following operations: Obtain multiple influencing factors under one alarm dimension, and combine these multiple influencing factors as a whole set to obtain multiple factor subsets; Obtain a first degree of variation between the predicted and actual values ​​of the overall set, and a second degree of variation between the predicted and actual values ​​of each factor subset; Based on the second degree of change of the multiple factor subsets and the similarity between them and the first degree of change, a candidate root factor set for the alarm dimension is selected from the multiple factor subsets. A search is performed in the search space constructed from candidate root factor sets of multiple alarm dimensions to obtain the target root factor combination of the multiple alarm dimensions.

2. The method as described in claim 1, characterized in that, Before obtaining the alarm dimension set, the following is also included: Multiple alarm dimensions are obtained from the abnormal alarm information of multidimensional time series data; Based on the correlation between the multiple alarm dimensions, the multiple alarm dimensions are divided to obtain multiple alarm dimension sets.

3. The method as described in claim 2, characterized in that, The multidimensional time-series data includes: single-dimensional time-series data of each of the multiple alarm indicators; before obtaining multiple alarm dimensions from the abnormal alarm information of the multidimensional time-series data, the process also includes: For each of the multiple alarm indicators and their respective one-dimensional time-series data, perform the following operations: One-dimensional time series data of an alarm indicator is input into an autoregressive differential moving average model for prediction, and the predicted value of the alarm indicator at the next time point is obtained. When the predicted value of the alarm indicator at the next time point and the actual value of the alarm indicator at the next time point meet the alarm conditions, an abnormal alarm information for the alarm indicator is generated. Based on the abnormal alarm information of the multiple alarm indicators, the abnormal alarm information of the multidimensional time series data is obtained.

4. The method as described in claim 1, characterized in that, The step of selecting a candidate root factor set for an alarm dimension from the plurality of factor subsets based on the similarity between the second degree of change of the plurality of factor subsets and the first degree of change includes: Obtain the second degree of change of the plurality of factor subsets, the similarity between each subset and the first degree of change, and determine the maximum similarity from the plurality of obtained similarities; The subset of factors with the highest similarity among the multiple factor subsets is taken as the candidate root factor set for the alarm dimension.

5. The method as described in claim 1, characterized in that, Before obtaining the first degree of change between the predicted and actual values ​​of the overall set, and the second degree of change between the predicted and actual values ​​of each factor subset, the method further includes: For each factor subset, the actual value of the factor subset is obtained based on the predicted value of the overall set, the actual value of the overall set, and the predicted value of the factor subset.

6. The method according to any one of claims 1 to 5, characterized in that, Before searching in the search space constructed from candidate root factor sets across multiple alarm dimensions to obtain the target root factor combination across the multiple alarm dimensions, the method further includes: From the candidate root factor sets of each of the multiple alarm dimensions, one candidate root factor set is selected as the first-level search range, and each node in the first-level search range corresponds to an influencing factor in the candidate root factor set. Based on the first search range, other remaining candidate root factor sets are sequentially included to obtain the search space containing multiple search ranges; each search range is obtained in the following way: Based on the search scope of the previous layer, each influencing factor in the remaining candidate root factor set is incorporated as a child node to obtain the current search scope.

7. The method as described in claim 6, characterized in that, Based on the previous search scope, after incorporating each influencing factor from a candidate root factor set in the remaining candidate root factor set as a child node to obtain the current search scope, the process further includes: If the predicted value and the actual value of the combination of influencing factors corresponding to any node in the current layer search range are the same, then the node is deleted from the current layer search range.

8. The method as described in claim 7, characterized in that, The step of searching within a search space constructed from candidate root factor sets across multiple alarm dimensions to obtain the target root factor combination across these multiple alarm dimensions includes: A master-slave architecture system is adopted to perform Monte Carlo tree search in parallel in the search space constructed by the candidate root factor sets of the multiple alarm dimensions to obtain the target root cause combination of the multiple alarm dimensions.

9. A root cause localization device, characterized in that, include: The acquisition module is used to obtain the alarm dimension set; The processing module is used to obtain multiple influencing factors under one alarm dimension, and to combine the multiple influencing factors as a whole set to obtain multiple factor subsets; Obtain a first degree of variation between the predicted and actual values ​​of the overall set, and a second degree of variation between the predicted and actual values ​​of each factor subset; Based on the second degree of change of the multiple factor subsets and the similarity between them and the first degree of change, a candidate root factor set for the alarm dimension is selected from the multiple factor subsets. The search module is used to search in a search space constructed from candidate root factor sets of multiple alarm dimensions to obtain the target root factor combination of the multiple alarm dimensions.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, It stores a computer program executable by a computer device, which, when run on the computer device, causes the computer device to perform the steps of the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that, The computer program product includes a computer program stored on a computer-readable storage medium, the computer program including program instructions that, when executed by a computer device, cause the computer device to perform the steps of the method as described in any one of claims 1 to 8.

Images