Multi-source network equipment fault mode identification and location method and system

Abstract

The present invention provides a multi-source network equipment fault pattern identification and location method and system, which relates to the field of computer fault diagnosis technology, including: collecting equipment hardware data and software data, generating fault feature vectors, collecting adjacent equipment information to build a communication relationship diagram and a link anomaly probability distribution diagram, and determining the root cause device and probability of the fault through correlation analysis; generating processing instructions and updating baseline data, which can realize the accurate identification and rapid location of computer network faults, improve fault processing efficiency, and reduce network maintenance costs.

Description

Technical Field

[0001] The present invention relates to the technical field of computer fault diagnosis, and in particular to a method and system for identifying and locating fault patterns of multi-source network equipment. Background Art

[0002] As networks continue to expand and become more complex, identifying and locating network device faults has become a key step in ensuring stable network operation. In today's network environment, there are many types of network devices, and the interconnectedness of different devices forms a complex network topology.

[0003] During daily operations, network equipment may experience various faults due to hardware aging, software errors, network attacks, or improper configuration. These faults may include CPU overload, memory exhaustion, network interface anomalies, and system service interruptions. These can lead to network performance degradation, service interruptions, or even complete network paralysis, severely impacting the normal operations of enterprises. Therefore, quickly and accurately identifying and locating network equipment faults is of great significance to network management and maintenance.

[0004] However, existing network equipment fault identification and location technologies still lack the ability to comprehensively analyze multi-source data at the hardware and software layers, resulting in one-sided fault judgments and an inability to fully grasp the equipment's operating status. In particular, the recognition accuracy is low under complex fault modes, and fault correlation analysis between multiple devices cannot be effectively processed. This leads to low accuracy in identifying network-level faults, especially when the fault link involves multiple devices. It is difficult to accurately locate the root cause of the fault, and the technology lacks the ability to adapt to dynamic changes in the network environment. It is unable to automatically update the judgment baseline based on historical fault handling experience, resulting in a large number of false positives or missed positives when the network load fluctuates or the business model changes, reducing the reliability of fault identification and location.

[0005] Therefore, a solution is urgently needed to solve the problems existing in the prior art. Summary of the Invention

[0006] The embodiments of the present invention provide a method and system for identifying and locating fault modes of multi-source network equipment, which can at least solve some of the problems existing in the prior art.

[0007] A first aspect of an embodiment of the present invention provides a method for identifying and locating a multi-source network device failure mode, comprising:

[0008] Collect CPU usage, memory usage, network interface traffic data, system log data, and network protocol data of target network devices;

[0009] The deviation values ​​of the CPU usage, memory usage, and network interface traffic data from a preset baseline are calculated respectively to generate a hardware-layer fault feature matrix. The system log data is semantically segmented to extract log event sequences and process call chain information. The software-layer fault feature matrix is ​​generated by combining the protocol interaction records of the network protocol data. The hardware-layer fault feature matrix and the software-layer fault feature matrix are fused and calculated to obtain a fault feature vector of the target network device.

[0010] Collect identification information and link performance indicator data of adjacent devices that directly communicate with the target network device;

[0011] A device communication relationship graph is constructed based on the adjacent device identification information, an abnormality level of the link performance indicator data is calculated, the abnormality level is mapped to the device communication relationship graph to obtain a link abnormality probability distribution graph, the fault feature vector is correlated with the link abnormality probability distribution graph, and the impact range of the faulty device is determined through recursive calculation, and the identification information of the device causing the fault and the probability of the fault occurring are output;

[0012] Generate and execute fault handling instructions based on the fault root device identification information and fault probability, record fault recovery process data and update baseline data.

[0013] In an optional embodiment,

[0014] Calculating the deviations of the CPU usage, memory usage, and network interface traffic data from the preset baselines to generate a hardware layer fault feature matrix, performing semantic segmentation on the system log data, extracting log event sequences and process call chain information, and combining the protocol interaction records of the network protocol data to generate a software layer fault feature matrix includes:

[0015] The CPU usage, memory usage, and network interface traffic data of the target network device are segmented into time series. The baseline values ​​of the CPU usage, memory usage, and network interface traffic data are calculated using exponentially weighted moving averages. The standardized deviation values ​​are calculated using Z-score standardization.

[0016] The normalized deviation value and the time decay factor are weighted to obtain the cumulative anomaly score. A three-dimensional feature vector is constructed based on the cumulative anomaly score, and a hardware layer fault feature matrix is ​​constructed using a sliding time window.

[0017] Hierarchical clustering is used to classify log templates in system log data. A dynamic programming algorithm is used to perform semantic segmentation on system log data and calculate the event sequence entropy. Process identifiers, process creation time, process end time, and parent-child process identifiers are extracted from system log data to construct process call chain information. The delay weighted value of the critical path in the process call chain information is calculated. The protocol interaction records of network protocol data are analyzed, and the protocol interaction anomaly score is calculated by combining the violation weight and violation frequency.

[0018] The event sequence entropy value, delay weighted value, and protocol interaction anomaly score are aligned according to the time window and then concatenated to construct a software layer feature vector. The software layer feature vector is accumulated in time series to obtain a software layer fault feature matrix.

[0019] In an optional embodiment,

[0020] The hardware layer fault feature matrix and the software layer fault feature matrix are fused and calculated to obtain the fault feature vector of the target network device, including:

[0021] Determine features in the hardware layer fault feature matrix that are greater than a preset hardware bottleneck threshold as hardware bottleneck features, calculate the influence weight of the hardware bottleneck features on features in the software layer fault feature matrix, and calculate the adjacent time change rate of features in the software layer fault feature matrix based on the influence weight to obtain the degree of hardware bottleneck impact;

[0022] Determine features in the software layer fault feature matrix that deviate from the feature mean by more than a preset abnormality determination coefficient and a feature standard deviation as software abnormality features, calculate the influence coefficient of the software abnormality feature on the features in the hardware layer fault feature matrix, and calculate the rate of change of the features in the hardware layer fault feature matrix relative to the maximum value at a future time based on the influence coefficient to obtain the degree of hardware resource exhaustion;

[0023] The performance bottleneck propagation strength is calculated by taking the weighted sum of the hardware bottleneck impact degree and the hardware resource exhaustion degree, the node importance is obtained by accumulating the performance bottleneck propagation strength within a preset time window, the propagation path importance is obtained by multiplying the propagation strengths between nodes on the propagation path, and the feature dynamic importance is calculated by taking the weighted sum of the node importance and the propagation path importance;

[0024] The dynamic importance of the features is exponentially normalized to obtain the propagation perception weight. The fusion feature is obtained based on the product of the propagation perception weight and the corresponding features in the hardware layer fault feature matrix and the software layer fault feature matrix. The fusion feature is input into the preset activation function to obtain the fault feature vector of the target network device.

[0025] In an optional embodiment,

[0026] The collection of identification information and link performance indicator data of adjacent devices that directly communicate with the target network device includes:

[0027] Obtaining a list of neighboring devices of the target network device, and extracting corresponding neighboring device identification information of each neighboring device in the list of neighboring devices;

[0028] Establishing a communication connection with each adjacent device in the adjacent device list, and collecting link performance indicator data between the target network device and each adjacent device;

[0029] The adjacent device identification information is associated with the link performance indicator data to construct a link communication feature matrix of the target network device.

[0030] In an optional embodiment,

[0031] Building a device communication relationship graph based on the adjacent device identification information, calculating the abnormality level of the link performance indicator data, mapping the abnormality level with the device communication relationship graph to obtain a link abnormality probability distribution graph, performing correlation analysis between the fault feature vector and the link abnormality probability distribution graph, determining the impact range of the faulty device through recursive calculation, and outputting the fault root device identification information and the fault occurrence probability, including:

[0032] Based on the identification information of adjacent devices, a device communication relationship diagram is constructed, link weights of different communication types between devices are calculated, and segmented sliding analysis of link performance indicator data is performed. The product of the sudden change amplitude and duration of the performance indicator is calculated, and the degree of deviation between the product and the historical baseline corresponding to the current device is used as the link anomaly level. The link anomaly probability is calculated based on the link anomaly level, and the link anomaly probability is mapped to the corresponding link in the device communication relationship diagram to obtain a link anomaly probability distribution diagram;

[0033] The frequency and time domain features of the fault feature vector are extracted through multi-scale decomposition. The extracted features are weightedly combined with the link anomaly probability to obtain the node local correlation. The node importance is calculated based on the shortest path between nodes and the link weight. The product of the node local correlation and node importance is nonlinearly mapped to obtain the global correlation. The propagation intensity matrix is ​​obtained by calculating the product of the cumulative attenuation effect of the link anomaly probability in the time dimension and the node local correlation.

[0034] The node influence propagation chain is constructed according to the propagation intensity matrix. The node state transition probability is calculated hierarchically and recursively until convergence to obtain the final node state. The final node state is probabilistically fused with the global correlation to obtain the fault root device identification information and the fault occurrence probability.

[0035] In an optional embodiment,

[0036] The node influence propagation chain is constructed based on the propagation intensity matrix. The node state transition probability is calculated hierarchically and recursively until convergence to obtain the final node state. The final node state is probabilistically fused with the global correlation to obtain the fault root device identification information and the fault occurrence probability, including:

[0037] A node influence propagation chain is constructed based on a propagation intensity matrix. The node influence propagation chain includes a node set, an edge set, and a propagation intensity weight matrix. The historical state sequence of each node is sampled within a preset time window to obtain a node state sequence. The time sequence dependency between the node state sequences is calculated based on the mutual information metric to obtain a time sequence dependency matrix. The node state sequence is subjected to a Granger causality test to obtain direct causal strength. All paths between nodes are obtained and the cumulative product of the direct causal strength on each path is calculated to obtain indirect causal strength.

[0038] The state persistence feature is obtained by calculating the weighted sum of the abnormal state duration and the attenuation coefficient of the node state sequence. The change trend feature is obtained by calculating the average value of the state difference between adjacent moments. The periodic feature is obtained based on the autocorrelation coefficient of the state sequence. The state persistence feature, change trend feature and periodic feature are combined to construct a time series feature vector.

[0039] The state transition probability matrix is ​​constructed based on the propagation intensity weight matrix, indirect causal strength and temporal feature vector. The state transition probability matrix is ​​fused with the temporal dependency matrix through hierarchical recursive calculation to update the node state until convergence to obtain the final node state.

[0040] The final node status and global correlation are probabilistically fused to obtain the fault root device identification information and the fault occurrence probability.

[0041] In an optional embodiment,

[0042] Generate and execute fault handling instructions based on the fault root device identification information and fault probability, record fault recovery process data, and update baseline data, including:

[0043] According to the fault root device identification information and the fault occurrence probability, matching the fault handling strategies corresponding to the fault root device identification information based on a preset fault type library, and prioritizing the fault handling strategies according to the fault occurrence probability to generate a fault handling instruction;

[0044] Executing the fault handling instructions, collecting fault recovery process data, and recording the execution effect of the fault handling instructions;

[0045] The baseline data is updated based on the fault recovery process data, and the execution effect of the fault handling instruction is fed back to the fault type library to complete the dynamic optimization of the fault handling strategy.

[0046] A second aspect of an embodiment of the present invention provides a multi-source network device fault mode identification and location system, including:

[0047] The first unit is used to collect the CPU usage, memory usage, network interface traffic data, system log data, and network protocol data of the target network device;

[0048] The second unit is used to respectively calculate the deviation values ​​of the central processing unit utilization rate, memory utilization rate and network interface traffic data from a preset baseline, generate a hardware layer fault feature matrix, perform semantic segmentation on the system log data, extract log event sequences and process call chain information, combine the protocol interaction records of the network protocol data, generate a software layer fault feature matrix, and fuse the hardware layer fault feature matrix with the software layer fault feature matrix to obtain a fault feature vector of the target network device;

[0049] The third unit is used to collect identification information and link performance indicator data of adjacent devices that directly communicate with the target network device;

[0050] A fourth unit is configured to construct a device communication relationship graph based on the adjacent device identification information, calculate an anomaly level of the link performance indicator data, map the anomaly level with the device communication relationship graph to obtain a link anomaly probability distribution graph, perform correlation analysis between the fault feature vector and the link anomaly probability distribution graph, determine the impact range of the faulty device through recursive calculation, and output the identification information of the fault root device and the probability of the fault occurring;

[0051] The fifth unit is used to generate and execute fault handling instructions based on the fault root device identification information and the fault occurrence probability, record the fault recovery process data and update the baseline data.

[0052] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including:

[0053] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0054] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0055] In the present invention, by collecting multi-source network equipment data and combining it with the fusion analysis of the hardware layer and software layer fault feature matrices, accurate identification and positioning of network equipment faults are achieved, effectively improving the accuracy and efficiency of fault detection. By determining the fault impact range through recursive calculation, the root cause of the fault can be effectively traced, the complexity of network maintenance is reduced, the fault diagnosis time is shortened, the fault recovery process is recorded and the baseline data is dynamically updated, the stability and reliability of the network system are improved, and an intelligent solution for network operation and maintenance is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 Schematic diagram of the process of a method for identifying and locating a multi-source network device failure mode according to an embodiment of the present invention;

[0057] Figure 2 Schematic diagram of segmented sliding analysis of link delay;

[0058] Figure 3 Schematic diagram of the node influence propagation chain. DETAILED DESCRIPTION

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0060] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0061] Figure 1 FIG. 1 is a flow chart of a method for identifying and locating a multi-source network device failure mode according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0062] Collect CPU usage, memory usage, network interface traffic data, system log data, and network protocol data of target network devices;

[0063] The deviation values ​​of the CPU usage, memory usage, and network interface traffic data from a preset baseline are calculated respectively to generate a hardware-layer fault feature matrix. The system log data is semantically segmented to extract log event sequences and process call chain information. The software-layer fault feature matrix is ​​generated by combining the protocol interaction records of the network protocol data. The hardware-layer fault feature matrix and the software-layer fault feature matrix are fused and calculated to obtain a fault feature vector of the target network device.

[0064] Collect identification information and link performance indicator data of adjacent devices that directly communicate with the target network device;

[0065] A device communication relationship graph is constructed based on the adjacent device identification information, an abnormality level of the link performance indicator data is calculated, the abnormality level is mapped to the device communication relationship graph to obtain a link abnormality probability distribution graph, the fault feature vector is correlated with the link abnormality probability distribution graph, and the impact range of the faulty device is determined through recursive calculation, and the identification information of the device causing the fault and the probability of the fault occurring are output;

[0066] Generate and execute fault handling instructions based on the fault root device identification information and fault probability, record fault recovery process data and update baseline data.

[0067] In an optional embodiment,

[0068] Calculating the deviations of the CPU usage, memory usage, and network interface traffic data from the preset baselines to generate a hardware layer fault feature matrix, performing semantic segmentation on the system log data, extracting log event sequences and process call chain information, and combining the protocol interaction records of the network protocol data to generate a software layer fault feature matrix includes:

[0069] The CPU usage, memory usage, and network interface traffic data of the target network device are segmented into time series. The baseline values ​​of the CPU usage, memory usage, and network interface traffic data are calculated using exponentially weighted moving averages. The standardized deviation values ​​are calculated using Z-score standardization.

[0070] The normalized deviation value and the time decay factor are weighted to obtain the cumulative anomaly score. A three-dimensional feature vector is constructed based on the cumulative anomaly score, and a hardware layer fault feature matrix is ​​constructed using a sliding time window.

[0071] Hierarchical clustering is used to classify log templates in system log data. A dynamic programming algorithm is used to perform semantic segmentation on system log data and calculate the event sequence entropy. Process identifiers, process creation time, process end time, and parent-child process identifiers are extracted from system log data to construct process call chain information. The delay weighted value of the critical path in the process call chain information is calculated. The protocol interaction records of network protocol data are analyzed, and the protocol interaction anomaly score is calculated by combining the violation weight and violation frequency.

[0072] The event sequence entropy value, delay weighted value, and protocol interaction anomaly score are aligned according to the time window and then concatenated to construct a software layer feature vector. The software layer feature vector is accumulated in time series to obtain a software layer fault feature matrix.

[0073] To construct the hardware fault signature matrix, the target network device's CPU utilization, memory utilization, and network interface traffic data are segmented into time series. For a network routing device, for example, performance data is collected every 5 minutes for 24 consecutive hours, including CPU utilization, memory utilization, and interface traffic data. For CPU utilization, a baseline value is calculated using an exponentially weighted moving average algorithm with a smoothing factor of 0.2, and the calculation is performed on the last 12 hours of historical data. For example, if the current CPU utilization is 85% and the calculated baseline value is 45%, using the Z-score normalization method, considering the standard deviation of the historical data is 10%, the standardized deviation value is (85% - 45%) / 10% = 4. Similarly, the standardized deviation values ​​for memory utilization and network traffic data are calculated. For example, the standardized deviation value for memory utilization is 2.5, and the standardized deviation value for network traffic is 3.2.

[0074] The standardized deviation value is weighted by the time decay factor to obtain the cumulative anomaly score. The time decay factor is set to 0.9. For the current time t and the previous time t-1, if the cumulative anomaly score at time t-1 is 3.8, the cumulative anomaly score at time t is 0.9 × 3.8 + 4 = 7.42. The cumulative anomaly scores for CPU usage, memory usage, and network traffic data are calculated separately to construct a three-dimensional feature vector (7.42, 5.35, 6.88). A sliding window size of 30 minutes is selected, with each sliding window lasting 5 minutes. Each sliding window contains three-dimensional feature vectors for six time points, forming a 6 × 3 hardware layer fault feature matrix.

[0075] To construct the software-layer fault feature matrix, hierarchical clustering was used to classify log templates on system log data. Taking the system logs of a network switch as an example, a dataset containing 10,000 log records was collected. By calculating the edit distance of the log text and setting a threshold of 0.7, log entries with a similarity greater than 0.7 were grouped into the same category, ultimately forming 120 log template categories.

[0076] Using a dynamic programming algorithm, semantic segmentation is performed on system log data. Log sequences are grouped by timestamp, with a time interval threshold set at 5 seconds. A new segment is created when the time interval between adjacent logs exceeds the threshold. The event sequence entropy is calculated by counting the frequency of each log template within each segment. For example, if a segment contains 10 logs belonging to three different templates with frequencies of 50%, 30%, and 20%, respectively, the entropy of this segment is -(0.5×log20.5+0.3×log20.3+0.2×log20.2)=1.49.

[0077] Process information is extracted from system logs, including the process identifier (e.g., PID = 1234), process creation time (e.g., 2023-06-01 08:00:15), process termination time (e.g., 2023-06-01 08:10:22), and parent-child process identifiers (e.g., PPID = 1000). This process call chain information is constructed, a process call graph is drawn, and the latency weighted value of the critical path is calculated. For example, the longest path from the root process to the leaf process consists of five process nodes, with execution times of 10 seconds, 15 seconds, 5 seconds, 20 seconds, and 8 seconds, respectively. Given weight coefficients of (0.1, 0.2, 0.3, 0.3, 0.1), the latency weighted value of this path is 10 × 0.1 + 15 × 0.2 + 5 × 0.3 + 20 × 0.3 + 8 × 0.1 = 11.8.

[0078] Analyze network protocol data interaction records to identify protocol violations. For example, during TCP connection establishment, set the violation weight of a normal SYN, SYN-ACK, and ACK handshake sequence to 0, while the violation weight of a SYN-SYN or SYN-RST sequence is 0. Count the frequency of a specific violation sequence within a 30-minute window. For example, if SYN-RST occurs 12 times, the protocol interaction anomaly score for that window is 0.7 × 12 = 8.4.

[0079] Align the event sequence entropy, latency weight, and protocol interaction anomaly score by time window. For example, if the three indicators for a 30-minute window are 1.49, 11.8, and 8.4, respectively, they are concatenated to construct the software layer feature vector (1.49, 11.8, 8.4). Accumulate the software layer feature vectors over time, setting the accumulation coefficient to 0.8. If the software layer feature vector at the previous moment was (1.2, 10.5, 7.8), the current accumulation result is (0.8 × 1.2 + 1.49, 0.8 × 10.5 + 11.8, 0.8 × 7.8 + 8.4) = (2.45, 20.2, 14.64). Accumulate the software layer feature vectors for multiple consecutive time windows to form a software layer fault feature matrix.

[0080] In this embodiment, by performing time-series segmentation and baseline calculation on hardware metrics, and combining a time decay factor to construct a cumulative anomaly score, we can effectively capture abnormal performance fluctuations at the hardware level, avoiding the limitations of traditional fixed threshold methods. Dynamic programming is used to achieve semantic segmentation, effectively addressing the issues of diverse log formats and complex semantics. The introduction of event sequence entropy quantifies the uncertainty of system behavior, providing an important basis for anomaly detection. By constructing process call chains and extracting critical path delays, combined with protocol interaction anomaly analysis, we achieve a multi-dimensional characterization of software-level anomalies.

[0081] In an optional embodiment,

[0082] The hardware layer fault feature matrix and the software layer fault feature matrix are fused and calculated to obtain the fault feature vector of the target network device, including:

[0083] Determine features in the hardware layer fault feature matrix that are greater than a preset hardware bottleneck threshold as hardware bottleneck features, calculate the influence weight of the hardware bottleneck features on features in the software layer fault feature matrix, and calculate the adjacent time change rate of features in the software layer fault feature matrix based on the influence weight to obtain the degree of hardware bottleneck impact;

[0084] Determine features in the software layer fault feature matrix that deviate from the feature mean by more than a preset abnormality determination coefficient and a feature standard deviation as software abnormality features, calculate the influence coefficient of the software abnormality feature on the features in the hardware layer fault feature matrix, and calculate the rate of change of the features in the hardware layer fault feature matrix relative to the maximum value at a future time based on the influence coefficient to obtain the degree of hardware resource exhaustion;

[0085] The performance bottleneck propagation strength is calculated by taking the weighted sum of the hardware bottleneck impact degree and the hardware resource exhaustion degree, the node importance is obtained by accumulating the performance bottleneck propagation strength within a preset time window, the propagation path importance is obtained by multiplying the propagation strengths between nodes on the propagation path, and the feature dynamic importance is calculated by taking the weighted sum of the node importance and the propagation path importance;

[0086] The dynamic importance of the features is exponentially normalized to obtain the propagation perception weight. The fusion feature is obtained based on the product of the propagation perception weight and the corresponding features in the hardware layer fault feature matrix and the software layer fault feature matrix. The fusion feature is input into the preset activation function to obtain the fault feature vector of the target network device.

[0087] Determine the hardware bottleneck characteristics in the hardware-layer fault feature matrix. For each feature value in the hardware-layer fault feature matrix, compare it with the preset hardware bottleneck threshold. For example, if the CPU usage feature is 95% and the preset hardware bottleneck threshold is 90%, the CPU usage feature is determined to be a hardware bottleneck feature. If the memory usage is 88%, which is lower than the preset hardware bottleneck threshold of 90%, the memory usage feature is not determined to be a hardware bottleneck feature.

[0088] For the determined hardware bottleneck characteristics, calculate the impact weight of the characteristics in the software layer fault feature matrix. Assuming that the hardware bottleneck characteristic is a CPU utilization rate of 95%, the impact weight calculation of the service response time characteristic of the corresponding software layer can be obtained based on historical data analysis, for example, the impact weight is 0.7. Based on this impact weight, calculate the adjacent moment change rate of the characteristics in the software layer fault feature matrix. For example, if the service response time is 200ms at the current moment and 150ms at the previous moment, the adjacent moment change rate is (200-150) / 150=33.3%. Multiplying the change rate by the impact weight, the hardware bottleneck impact degree is 0.7×33.3%=23.31%.

[0089] Identify software anomaly features from the software layer fault feature matrix and calculate the mean and standard deviation of each software layer feature. For example, the mean of service response time is 100ms, the standard deviation is 20ms, and the preset anomaly determination coefficient is 2.5. The current service response time is 200ms, which deviates from the mean by 100ms, exceeding 2.5 × 20ms = 50ms. Therefore, it is determined to be a software anomaly feature.

[0090] For the identified software anomaly features, calculate the impact coefficient on the features in the hardware fault feature matrix. Assume that the impact coefficient of service response time anomalies on CPU utilization is 0.6. Based on this impact coefficient, calculate the rate of change of the features in the hardware fault feature matrix relative to their future maximum values. For example, if the current CPU utilization is 95% and the historical maximum is 98%, and the CPU utilization is predicted to increase to 97% in the future, the rate of change relative to the future maximum value is (97% - 95%) / (98% - 95%) = 66.7%. Multiplying the rate of change by the impact coefficient yields the degree of hardware resource depletion: 0.6 × 66.7% = 40.02%.

[0091] The performance bottleneck propagation intensity is calculated by taking the weighted sum of the hardware bottleneck impact and the hardware resource exhaustion level. Assuming the hardware bottleneck impact weight is 0.4 and the hardware resource exhaustion weight is 0.6, the performance bottleneck propagation intensity is 0.4 × 23.31% + 0.6 × 40.02% = 33.25%.

[0092] The node importance is calculated by accumulating the performance bottleneck propagation intensity within a preset time window (for example, the past hour). Assuming the average performance bottleneck propagation intensity of 10 sampling points within 1 hour is 30%, the node importance is 30%.

[0093] When calculating the importance of a propagation path, consider the multiplication of the propagation strengths between nodes along the propagation path. For example, if the propagation strength from the CPU to the memory and then to the service response time is 25% and the propagation strength from the memory to the service response time is 35%, the importance of this propagation path is 25% × 35% = 8.75%.

[0094] The feature dynamic importance is calculated by adding the weighted sum of the node importance and the propagation path importance. Assuming the node importance weight is 0.7 and the propagation path importance weight is 0.3, the feature dynamic importance is 0.7 × 30% + 0.3 × 8.75% = 23.63%.

[0095] The dynamic importance of the features is normalized by exponential normalization to obtain the propagation perception weight. For example, if the dynamic importance of three features is 23.63%, 15.42%, and 32.18%, the propagation perception weights after exponential normalization are 0.35, 0.25, and 0.4, respectively.

[0096] The fused features are generated by multiplying the propagation-aware weights with the corresponding features in the hardware-layer fault feature matrix and the software-layer fault feature matrix. For example, if the original value of the CPU usage feature is 95% and the propagation-aware weight is 0.35, the fused feature value is 95% × 0.35 = 33.25%.

[0097] All fused features are input into a preset activation function, such as the Sigmoid function, to obtain the fault feature vector of the target network device. For example, if the fused feature value is 33.25%, the Sigmoid function might process it to obtain 0.67, representing the value of that dimension in the fault feature vector.

[0098] In this embodiment, a mechanism for analyzing the impact of hardware bottleneck characteristics on software layer characteristics is established. By calculating the rate of change between adjacent moments, the impact of hardware resource limitations on software performance is accurately quantified. By introducing the concept of performance bottleneck propagation strength, the importance of nodes and propagation paths is analyzed within a preset time window, achieving a comprehensive characterization of fault propagation characteristics. A propagation-aware feature fusion strategy is used to adaptively fuse the characteristics of the hardware and software layers.

[0099] Existing technologies typically use single-dimensional threshold judgment methods to extract fault features, analyzing only the hardware or software layer. This method is unable to effectively identify complex faults caused by hardware-software interactions. Feature fusion often uses simple weighted superposition, failing to consider the propagation characteristics of performance bottlenecks in the system. This results in inaccurate feature expression and hinders fault location effectiveness.

[0100] The feature importance assessment method of this embodiment takes propagation effects into consideration, which makes up for the deficiency of the existing technology that only focuses on static features. Through the design of propagation perception weights, the fused features can better reflect the fault propagation laws in the system, improve the expressiveness and discrimination of the features, analyze the consumption trend of hardware resources by software abnormal features, and realize predictive assessment of the risk of hardware resource exhaustion. It breaks through the limitations of traditional one-way analysis, provides more reliable feature support for fault root cause location, and at the same time improves the timeliness of fault warning and enhances the accuracy of fault location.

[0101] In an optional embodiment,

[0102] The collection of identification information and link performance indicator data of adjacent devices that directly communicate with the target network device includes:

[0103] Obtaining a list of neighboring devices of the target network device, and extracting corresponding neighboring device identification information of each neighboring device in the list of neighboring devices;

[0104] Establishing a communication connection with each adjacent device in the adjacent device list, and collecting link performance indicator data between the target network device and each adjacent device;

[0105] The adjacent device identification information is associated with the link performance indicator data to construct a link communication feature matrix of the target network device.

[0106] Establish a communication connection with the target network device through the management interface. The management interface can be implemented based on a network management protocol such as SSH, SNMP, or NETCONF. Send a query command to the target network device to obtain a list of neighboring devices. For example, for network devices that support the SNMP protocol, send a GetRequest message to query the LLDP-MIB or CDP-MIB to obtain neighboring device information. For devices that support NETCONF, send a Get-Config request containing an XPath filter to obtain neighboring device information.

[0107] After receiving the query request, the target network device returns a response message containing neighboring device information. The response message is parsed to extract a neighboring device list, which includes all network devices directly physically connected to the target device. The obtained neighboring device list is then processed to extract identification information for each neighboring device. Neighboring device identification information includes, but is not limited to, device name, device type, MAC address, management IP address, model, vendor, operating system version, and interface identifier. For example, the neighboring device identification information obtained from device A might include the following data for device B: device name "CoreSwitch01," device type "Switch," MAC address "00:1A:2B:3C:4D:5E," management IP address "192.168.1.10," model "MS-7500," vendor "Network Device Manufacturer," operating system version "NOS12.2," and the interface identifier connected to device A, "GigabitEthernet1 / 0 / 24." The system stores the extracted neighbor device identification information in a temporary data structure, such as a hash table or an array, for subsequent processing.

[0108] After extracting the neighboring device identification information, establish a communication connection with each device in the neighboring device list. Based on the extracted management IP address, attempt to establish a management connection with each neighbor using protocols such as SSH, SNMP, or NETCONF. Verify the connection credentials, such as the user name, password, or key, to ensure a successful management session. For neighboring devices that fail to connect, log the error message and proceed to the next device.

[0109] After establishing a communication connection with the adjacent device, the link performance indicator data between the target network device and each adjacent device is collected. Link performance indicator data includes but is not limited to link utilization, link bandwidth, packet transmission delay, packet loss rate, packet error rate, packet retransmission rate, traffic throughput, and the number of interface status changes. Performance indicators are calculated by regularly querying the interface statistics of the target device and the adjacent device. For example, the interface counter data is collected every 30 seconds, the difference between the two collections is calculated, and the performance indicator value is calculated based on the time interval. Specifically, the link utilization is calculated by querying the ifInOctets and ifOutOctets counters through SNMP; the packet error rate is calculated by querying the ifInErrors and ifOutErrors counters, and the packet transmission delay data is obtained through active measurement or passive monitoring.

[0110] For example, to calculate link utilization, the system collects the ifInOctets and ifOutOctets counter values ​​of the target device interface at time points T1 and T2 (30 seconds apart). Assume that at T1, ifInOctets is 1,000,000 bytes and ifOutOctets is 2,000,000 bytes; at T2, ifInOctets is 1,500,000 bytes and ifOutOctets is 2,800,000 bytes. The interface bandwidth is 1 Gbps (125,000,000 bytes / second). The inbound link utilization is calculated as (1,500,000 - 1,000,000) / (125,000,000 × 30) × 100% = 0.4%. The outbound link utilization is calculated as (2,800,000 - 2,000,000) / (125,000,000 × 30) × 100% = 0.64%. All collected link performance indicator data is stored in a time series database for subsequent analysis and correlation.

[0111] After obtaining neighboring device identification information and link performance indicator data, the two are correlated to construct a link communication characteristic matrix for the target network device. During the correlation process, the link performance indicator data is mapped to the corresponding neighboring devices based on the physical connection relationship between the target device and the neighboring devices. A two-dimensional data structure is created, with rows representing each neighboring device connected to the target device and columns representing different link performance indicators and device identification information. For example, for the connection between the target device and three neighboring devices (device B, device C, and device D), the link communication characteristic matrix contains device identification information (such as device name, type, IP address, etc.) and link performance indicators (such as link utilization, latency, and error rate). Specific data might be as follows: Device B has a link utilization of 0.4%, a latency of 2.5 milliseconds, and an error rate of 0.001%; ​​Device C has a link utilization of 1.2%, a latency of 1.8 milliseconds, and an error rate of 0%; and Device D has a link utilization of 0.8%, a latency of 3.0 milliseconds, and an error rate of 0.002%.

[0112] In this embodiment, by obtaining the list of adjacent devices of the target network device, a complete device communication topology view is established, breaking through the limitations of traditional single link analysis and providing a global perspective for subsequent link performance analysis. The data collection method based on actual communication connections can more accurately reflect the real-time performance status of the link compared to traditional passive monitoring methods, improving the timeliness and reliability of the data. By correlating and analyzing the adjacent device identification information with the link performance indicator data, a link communication feature matrix of the target network device is constructed, so that the link performance analysis retains both the topology structure information and the performance status information, providing more complete feature support for subsequent fault location.

[0113] In an optional embodiment,

[0114] Building a device communication relationship graph based on the adjacent device identification information, calculating the abnormality level of the link performance indicator data, mapping the abnormality level with the device communication relationship graph to obtain a link abnormality probability distribution graph, performing correlation analysis between the fault feature vector and the link abnormality probability distribution graph, determining the impact range of the faulty device through recursive calculation, and outputting the fault root device identification information and the fault occurrence probability, including:

[0115] Based on the identification information of adjacent devices, a device communication relationship diagram is constructed, link weights of different communication types between devices are calculated, and segmented sliding analysis of link performance indicator data is performed. The product of the sudden change amplitude and duration of the performance indicator is calculated, and the degree of deviation between the product and the historical baseline corresponding to the current device is used as the link anomaly level. The link anomaly probability is calculated based on the link anomaly level, and the link anomaly probability is mapped to the corresponding link in the device communication relationship diagram to obtain a link anomaly probability distribution diagram;

[0116] The frequency and time domain features of the fault feature vector are extracted through multi-scale decomposition. The extracted features are weightedly combined with the link anomaly probability to obtain the node local correlation. The node importance is calculated based on the shortest path between nodes and the link weight. The product of the node local correlation and node importance is nonlinearly mapped to obtain the global correlation. The propagation intensity matrix is ​​obtained by calculating the product of the cumulative attenuation effect of the link anomaly probability in the time dimension and the node local correlation.

[0117] The node influence propagation chain is constructed according to the propagation intensity matrix. The node state transition probability is calculated hierarchically and recursively until convergence to obtain the final node state. The final node state is probabilistically fused with the global correlation to obtain the fault root device identification information and the fault occurrence probability.

[0118] Collect the identification information of all devices in the network and their interconnectedness. For example, in a network containing 100 devices, device A is connected to devices B, C, and D, and device B is connected to devices E and F. Represent the connection relationships as a graph structure, where nodes represent devices and edges represent communication links between devices. For each link, assign a different weight based on the communication type, such as a TCP connection weight of 0.8, a UDP connection weight of 0.6, and an ICMP connection weight of 0.4.

[0119] Link performance indicator data is analyzed in segments, using a 30-second window size and a 10-second sliding interval. Within each window, the system calculates changes in performance indicators such as latency, packet loss rate, and throughput. When a sudden change in an indicator is detected, the product of the magnitude of the change and its duration is calculated. For example, if the link latency between device A and device B suddenly increases from 5 milliseconds to 50 milliseconds and lasts for 20 seconds, the magnitude of the change is 9 times, and the product is 9×20=180. This product is compared with the historical baseline value of the link, which is calculated by averaging the data from the same period over the past 30 days. If the historical baseline value is 30, the current deviation is 180 / 30=6, and 6 is used as the abnormality level of the link.

[0120] The link anomaly probability is calculated based on the link anomaly level. Normalization is used to map the anomaly level to a probability value between 0 and 1. For example, if the highest anomaly level in the network is 10 and the lowest is 0, the anomaly probability for a link with an anomaly level of 6 is 6 / 10 = 0.6. The anomaly probabilities of all links are mapped onto the device communication relationship diagram to form a link anomaly probability distribution map, where anomaly probabilities are intuitively displayed using color depth or line thickness.

[0121] Extract frequency and time domain features from fault feature vectors and perform multi-scale decomposition on collected fault logs and alarm information. Time domain features include fault occurrence time, duration, and recurrence frequency. Frequency domain features are obtained by transforming time series data and reflect the periodicity of the data. For example, for a periodic increase in network latency, its primary frequency is determined to be 10:00 AM daily, lasting approximately 30 minutes.

[0122] The extracted features are weighted and combined with the link anomaly probability to obtain the node's local correlation. Weights are assigned to each dimension of the feature vector, such as 0.4 for time matching, 0.3 for fault type matching, and 0.3 for performance indicator correlation. Assuming device A has a time matching of 0.8, a type matching of 0.7, and a performance indicator correlation of 0.9, its local correlation is 0.8 × 0.4 + 0.7 × 0.3 + 0.9 × 0.3 = 0.8.

[0123] Node importance is calculated based on the shortest paths between nodes and link weights, taking into account node centrality. For each node, the shortest path length to all other nodes is calculated, taking into account the link weights along the path. A higher node importance value indicates a greater influence within the network. For example, the node importance of device A is calculated to be 0.75.

[0124] The global correlation is obtained by multiplying the local correlation of a node by its importance through nonlinear mapping. A logarithmic function is then used to map the correlation to ensure that the result is within a reasonable range. For example, the global correlation of device A is 0.62 after processing with the logarithmic function.

[0125] When calculating the propagation strength matrix by multiplying the cumulative decay effect of the link anomaly probability in the time dimension with the local node correlation, the decay of the anomaly state over time is taken into account. Assuming a decay factor of 0.9, the anomaly probability at time t+1 is 0.9 times that at time t. Multiplying the decayed anomaly probability by the local node correlation yields a matrix representing the propagation strength of the anomaly state.

[0126] Based on the propagation strength matrix, a node-affecting propagation chain is constructed to identify the propagation path of the abnormal state. Starting from each possible fault source node, the propagation direction and intensity of the abnormal state are determined based on the propagation strength, forming a tree-like propagation structure.

[0127] Node state transition probabilities are recursively calculated layer by layer until convergence, starting with the leaf nodes and calculating the state of each node upwards. Initially, the failure probability of all nodes is set to 0. In each iteration, the new state of a node is determined by its own state and the influence of all neighboring nodes transmitted through the propagation chain. The calculation is considered converged when the state change in two consecutive iterations is less than a threshold of 0.01.

[0128] The converged node states are probabilistically fused with the global correlation, using a Bayesian fusion method to calculate the posterior probability of each node being the root cause of the fault. The device with the highest probability of failure is output as the root cause, along with its identification information and probability of failure. For example, the system might output "Device A (ID: 10086) is the root cause of the fault, with a probability of 0.85."

[0129] In this embodiment, by constructing a device communication relationship diagram and calculating different types of link weights, the network topology is accurately expressed. The mutation characteristics of performance indicators are combined with the degree of deviation from the historical baseline to form a quantitative evaluation mechanism for the link anomaly level, making the identification of link anomaly status more accurate and objective. The node importance calculated based on the shortest path between nodes and link weights reflects the status and influence of the node in the entire network. The multi-scale decomposition method is used to extract the frequency domain and time domain characteristics of the fault feature vector respectively, fully capturing the manifestation of the fault phenomenon in different dimensions. By calculating the time-series cumulative attenuation effect of the link anomaly probability and combining it with the propagation intensity matrix constructed by the local correlation of nodes, the propagation law of the fault in the network is accurately characterized.

[0130] Figure 2This figure illustrates the results of a segmented sliding analysis of link latency between devices A and B. The blue curve represents the time-varying trend of link latency, while the red dashed line represents the historical baseline (normal latency). By employing a 30-second window with 10-second sliding intervals, the system successfully captured a significant latency jump starting around 120 seconds.

[0131] In the mutation interval (marked in light red), the link delay increased sharply from the normal approximately 5 milliseconds to nearly 50 milliseconds, with the mutation amplitude reaching 9 times and lasting for about 20 seconds. The ratio of the product of the mutation amplitude and the duration (180) to the historical baseline value (30) was calculated to obtain a link anomaly level of 6. This anomaly level can be converted into a link anomaly probability after normalization for subsequent fault root cause analysis. This performance indicator analysis method based on a segmented sliding window can effectively identify sudden changes in network performance and provide a key basis for fault location.

[0132] In an optional embodiment,

[0133] The node influence propagation chain is constructed based on the propagation intensity matrix. The node state transition probability is calculated hierarchically and recursively until convergence to obtain the final node state. The final node state is probabilistically fused with the global correlation to obtain the fault root device identification information and the fault occurrence probability, including:

[0134] A node influence propagation chain is constructed based on a propagation intensity matrix. The node influence propagation chain includes a node set, an edge set, and a propagation intensity weight matrix. The historical state sequence of each node is sampled within a preset time window to obtain a node state sequence. The time sequence dependency between the node state sequences is calculated based on the mutual information metric to obtain a time sequence dependency matrix. The node state sequence is subjected to a Granger causality test to obtain direct causal strength. All paths between nodes are obtained and the cumulative product of the direct causal strength on each path is calculated to obtain indirect causal strength.

[0135] The state persistence feature is obtained by calculating the weighted sum of the abnormal state duration and the attenuation coefficient of the node state sequence. The change trend feature is obtained by calculating the average value of the state difference between adjacent moments. The periodic feature is obtained based on the autocorrelation coefficient of the state sequence. The state persistence feature, change trend feature and periodic feature are combined to construct a time series feature vector.

[0136] The state transition probability matrix is ​​constructed based on the propagation intensity weight matrix, indirect causal strength and temporal feature vector. The state transition probability matrix is ​​fused with the temporal dependency matrix through hierarchical recursive calculation to update the node state until convergence to obtain the final node state.

[0137] The final node status and global correlation are probabilistically fused to obtain the fault root device identification information and the fault occurrence probability.

[0138] Collect historical status data from each device node in the network to form a state sequence set. For a telecommunications data center environment, status data for 100 network device nodes was collected. Each node included 10 status indicators such as CPU usage, memory usage, and network traffic. The sampling period was 5 minutes, and a total of 1440 time points of data were collected (covering 5 days).

[0139] Based on the collected data, a node influence propagation chain is constructed. The node set V = {v1, v2, ..., v100} represents all device nodes, and the edge set E represents the connections between nodes. Through preprocessing, the raw state data is normalized to the interval [0, 1], and the time series window size is set to 12 (i.e., 1 hour). The state sequence of the data within each time window is extracted. For example, the state sequence of node v1 at time t is represented as s1(t) = {s1(t-11), s1(t-10), ..., s1(t)}.

[0140] Calculate the temporal dependencies between nodes and select state sequences for mutual information metric analysis. For each node pair (vi, vj), calculate the joint probability distribution and marginal probability distribution of each node's corresponding state sequence under different value combinations and calculate the mutual information value. For example, the mutual information value between nodes v23 and v45 is 0.73, indicating a strong correlation between their state changes. After calculating the mutual information for all node pairs, a temporal dependency matrix D is formed, where D[i][j] represents the dependency strength from node vi to vj.

[0141] A Granger causality test is performed to determine the direct causal relationship. For each pair of nodes (vi, vj), the lag value is used to analyze whether the historical state of vi helps to predict the future state of vj. For example, the lag order is set to 3 and the significance level is set to 0.05 in the experiment. The test results form a direct causal strength matrix C. For example, C

[38]

[42] =0.81 indicates that node v38 has a strong direct causal influence on node v42.

[0142] Based on the network topology and direct causal strength, the indirect causal strength between nodes is calculated. A depth-first search algorithm is used to find all paths from node vi to vj. Assuming that the path p = (vi, vk, ..., vm, vj), the indirect causal strength of path p is calculated as the cumulative product of the direct causal strengths along the path. For example, the indirect causal strength of a path p = (v12, v25, v56, v87) from node v12 to v87 is C

[12]

[25] × C

[25]

[56] × C

[56]

[87] = 0.65 × 0.72 × 0.58 = 0.27. The largest indirect causal strength among all paths is taken as the indirect causal strength between nodes and recorded in the matrix IC.

[0143] Time series features are extracted from the node state sequence. When calculating the state persistence feature, the attenuation coefficient α is set to 0.9, and the duration of the abnormal state is weighted and summed. For example, a certain abnormal state of node v33 lasted for 4 time units, and its state persistence feature is calculated as 1+0.9+0.81+0.729=3.439. When calculating the change trend feature, the average of the difference between adjacent moments in the state sequence is taken. For example, the change trend feature of node v50 is 0.23, indicating that the state is on an upward trend. The periodic feature is determined by the peak position of the autocorrelation function at different lag values. For example, the autocorrelation coefficient of node v77 peaks at 0.85 at a lag value of 6, indicating that its state change has a periodicity of approximately 30 minutes. These three types of features are combined to form the time series feature vector F for each node.

[0144] Construct a state transition probability matrix P, where P[i][j] represents the probability that a state change at node vi will cause a state transition at node vj. Combining the propagation strength weight matrix W (determined based on the network topology), the indirect causal strength matrix IC, and the temporal eigenvector F, we calculate P[i][j] = W[i][j] × IC[i][j] × (F[j][1] + F[j][2] × F[j][3]). For example, P

[15]

[28] = 0.6 × 0.43 × (3.2 + 0.15 × 0.73) = 0.86, indicating that there is an 86% probability that a state change at node v15 will cause a state transition at node v28.

[0145] Node states are updated through hierarchical recursive calculations, with the initial node state S0 set based on abnormal alarm information. In each iteration, the node state is updated by fusing the state transition probability matrix P and the temporal dependency matrix D: S(t+1)=S(t)×(P⊗D), where ⊗ represents the normalization of the corresponding matrix elements after multiplication. The calculation continues until the state change is less than a threshold of 0.001 or the maximum number of iterations, 50, is reached, resulting in the final node state Sf.

[0146] The final node state Sf is probabilistically fused with the pre-calculated global correlation matrix G to determine the probability of each node being the root cause of the fault. The global correlation is calculated based on the network topology and historical fault patterns. The fusion formula is R = Sf × G, where R[i] represents the probability that node vi is the root cause of the fault. In one experiment, the final state of node v42 was 0.92, the global correlation was 0.85, and the fusion-based probability of the root cause was 0.78, successfully identifying it as the root cause.

[0147] In this embodiment, by sampling and analyzing the historical states of nodes within a preset timing window, combined with mutual information measurement and Granger causality test, not only the temporal dependency between nodes is captured, but also the direct and indirect causal influence intensity is quantified, providing a reliable data basis for the identification of fault propagation paths. By introducing the attenuation coefficient to calculate the state persistence characteristics, the continuous impact of the abnormal state is retained and the excessive accumulation of historical data is avoided. By analyzing the changing trend characteristics obtained by the state difference between adjacent moments, the fault development situation can be captured in time. By adopting a hierarchical recursive calculation method, the state transition probability and the temporal dependency are dynamically integrated, which realizes the accurate update of the node state and ensures the accuracy of the fault propagation process analysis.

[0148] Figure 3 This diagram shows the node impact propagation chain. Node v42, as the core root node (red), is located at the center, directly connected to four first-level related nodes (orange: v38, v45, v23, and v56). These first-level nodes are further connected to eight second-level related nodes (yellow). The dotted lines in the diagram indicate weak connections between nodes. While these connections do not constitute the primary propagation path, they may form alternative channels for fault propagation in complex network environments. Overall, the network diagram reveals the fault propagation structure centered on v42, providing a visual basis for fault root cause location and impact assessment, helping to quickly identify key impacting nodes and formulate precise fault response strategies.

[0149] In an optional embodiment,

[0150] Generate and execute fault handling instructions based on the fault root device identification information and fault probability, record fault recovery process data, and update baseline data, including:

[0151] According to the fault root device identification information and the fault occurrence probability, matching the fault handling strategies corresponding to the fault root device identification information based on a preset fault type library, and prioritizing the fault handling strategies according to the fault occurrence probability to generate a fault handling instruction;

[0152] Executing the fault handling instructions, collecting fault recovery process data, and recording the execution effect of the fault handling instructions;

[0153] The baseline data is updated based on the fault recovery process data, and the execution effect of the fault handling instruction is fed back to the fault type library to complete the dynamic optimization of the fault handling strategy.

[0154] After receiving a device monitoring alarm, the system obtains the root cause device identification information and the probability of the fault occurring. For example, in a server room environment, the device identification information might be "Storage Server - S001," the fault type might be "Disk Read / Write Error," and the fault probability might be 85%. This information is then matched against a pre-defined fault type library, which contains various device types, their possible failure modes, and corresponding handling strategies. For the "Storage Server - Disk Read / Write Error" fault type, the system might match three handling strategies: disk restart recovery, disk data migration, or disk replacement.

[0155] These handling strategies are prioritized based on the probability of failure. Since the probability of failure reached 85%, it was considered a high-probability failure, so the more reliable handling method was selected. A query of historical handling records revealed that in similar high-probability situations, the success rate of disk replacement was 95%, the success rate of disk data migration was 85%, and the success rate of disk restart and recovery was only 60%. Therefore, a handling instruction sequence was generated in the order of disk replacement, disk data migration, and disk restart and recovery.

[0156] The generated troubleshooting instructions contain detailed steps. For example, a disk replacement instruction involves stopping related services, confirming the current data backup status, removing the failed disk, inserting a new disk, starting the data recovery process, verifying data integrity, and restarting related services. These instructions are sent to on-site technicians via the operation and maintenance terminal or directly triggered in an automated environment.

[0157] During the execution of fault handling instructions, key data points are continuously collected to form fault recovery process data, and changes in performance indicators before and after the disk replacement are recorded, including the read and write speed increased from the original 50MB / s to 120MB / s, the error rate reduced from 10 times per hour to 0 times, and the service response time reduced from 200ms to 80ms, etc. The time node data in the processing process is recorded, such as the instruction issuance time of 10:15:30, the execution start time of 10:16:05, the completion time of execution of 10:25:40, and the service restoration time of 10:26:15.

[0158] The execution results of the fault handling instructions are recorded, including the execution result (success / failure), the degree of service recovery (complete recovery / partial recovery), and whether secondary faults occurred. After the disk was replaced, the system recorded the execution result as "success", the service recovery degree as "complete recovery", and no secondary faults occurred. The overall score was 95 points (out of 100).

[0159] Based on the collected data from the fault recovery process, the baseline data is updated. The baseline data includes a set of reference indicators for normal device operation, such as the normal read and write speed of the storage server should be no less than 100MB / s, the error rate should be no more than 1 per hour, and the service response time should be no more than 100ms. During the update process, the historical baseline data and the actual performance data after the fault recovery are comprehensively considered, and a new baseline value is derived through a weighted average. For example, the updated read and write speed baseline is adjusted from the original 90MB / s to 95MB / s, reflecting the improvement in overall system performance after replacing the new disk.

[0160] The execution results of the fault handling instructions are fed back to the fault type library to complete the dynamic optimization of the fault handling strategy. Since the disk replacement strategy performs well (scored 95 points), the weight of this strategy for this type of fault is increased from 0.75 to 0.80. The weights of other strategies are adjusted accordingly to ensure that the sum of all strategy weights is 1.

[0161] Update the correlation data between fault characteristics and fault types. For example, by analyzing the characteristic data of this fault (such as temperature anomalies and power consumption fluctuations that appear before disk read / write errors), it was found that when the temperature exceeds 65°C and persists for more than 30 minutes, the probability of disk read / write errors increases by 20%.

[0162] In this embodiment, by introducing the probability of fault occurrence as the basis for priority sorting, the execution order of the processing strategy is ensured to match the degree of fault risk, thereby improving the pertinence and efficiency of fault handling. By recording the execution effect of each fault handling instruction, a complete fault handling process tracking mechanism is established, making the fault handling process more controllable and visual. By feeding back the execution effect of the fault handling instruction to the fault type library, adaptive optimization of the fault handling strategy is achieved, so that the fault handling solution can be continuously improved and evolved.

[0163] A second aspect of an embodiment of the present invention provides a multi-source network device fault mode identification and location system, including:

[0164] The first unit is used to collect the CPU usage, memory usage, network interface traffic data, system log data, and network protocol data of the target network device;

[0165] The second unit is used to respectively calculate the deviation values ​​of the central processing unit utilization rate, memory utilization rate and network interface traffic data from a preset baseline, generate a hardware layer fault feature matrix, perform semantic segmentation on the system log data, extract log event sequences and process call chain information, combine the protocol interaction records of the network protocol data, generate a software layer fault feature matrix, and fuse the hardware layer fault feature matrix with the software layer fault feature matrix to obtain a fault feature vector of the target network device;

[0166] The third unit is used to collect identification information and link performance indicator data of adjacent devices that directly communicate with the target network device;

[0167] A fourth unit is configured to construct a device communication relationship graph based on the adjacent device identification information, calculate an anomaly level of the link performance indicator data, map the anomaly level with the device communication relationship graph to obtain a link anomaly probability distribution graph, perform correlation analysis between the fault feature vector and the link anomaly probability distribution graph, determine the impact range of the faulty device through recursive calculation, and output the identification information of the fault root device and the probability of the fault occurring;

[0168] The fifth unit is used to generate and execute fault handling instructions based on the fault root device identification information and the fault occurrence probability, record the fault recovery process data and update the baseline data.

[0169] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including:

[0170] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0171] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0172] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0173] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying and locating fault patterns of multi-source network equipment, characterized in that: include: Collect CPU usage, memory usage, network interface traffic data, system log data, and network protocol data of target network devices; The deviation values ​​of the CPU usage, memory usage, and network interface traffic data from a preset baseline are calculated respectively to generate a hardware-layer fault feature matrix. The system log data is semantically segmented to extract log event sequences and process call chain information. The software-layer fault feature matrix is ​​generated by combining the protocol interaction records of the network protocol data. The hardware-layer fault feature matrix and the software-layer fault feature matrix are fused and calculated to obtain a fault feature vector of the target network device. Collect identification information and link performance indicator data of adjacent devices that directly communicate with the target network device; A device communication relationship graph is constructed based on the adjacent device identification information, an abnormality level of the link performance indicator data is calculated, the abnormality level is mapped to the device communication relationship graph to obtain a link abnormality probability distribution graph, the fault feature vector is correlated with the link abnormality probability distribution graph, and the impact range of the faulty device is determined through recursive calculation, and the identification information of the device causing the fault and the probability of the fault occurring are output; Generate and execute fault handling instructions based on the fault root device identification information and fault probability, record fault recovery process data and update baseline data.

2. The method according to claim 1, characterized in that Calculating the deviations of the CPU usage, memory usage, and network interface traffic data from the preset baselines to generate a hardware layer fault feature matrix, performing semantic segmentation on the system log data, extracting log event sequences and process call chain information, and combining the protocol interaction records of the network protocol data to generate a software layer fault feature matrix includes: The CPU usage, memory usage, and network interface traffic data of the target network device are segmented into time series. The baseline values ​​of the CPU usage, memory usage, and network interface traffic data are calculated using exponentially weighted moving averages. The standardized deviation values ​​are calculated using Z-score standardization. The normalized deviation value and the time decay factor are weighted to obtain the cumulative anomaly score. A three-dimensional feature vector is constructed based on the cumulative anomaly score, and a hardware layer fault feature matrix is ​​constructed using a sliding time window. Hierarchical clustering is used to classify log templates in system log data. A dynamic programming algorithm is used to perform semantic segmentation on system log data and calculate the event sequence entropy. Process identifiers, process creation time, process end time, and parent-child process identifiers are extracted from system log data to construct process call chain information. The delay weighted value of the critical path in the process call chain information is calculated. The protocol interaction records of network protocol data are analyzed, and the protocol interaction anomaly score is calculated by combining the violation weight and violation frequency. The event sequence entropy value, delay weighted value, and protocol interaction anomaly score are aligned according to the time window and then concatenated to construct a software layer feature vector. The software layer feature vector is accumulated in time series to obtain a software layer fault feature matrix.

3. The method according to claim 1, characterized in that The hardware layer fault feature matrix and the software layer fault feature matrix are fused and calculated to obtain the fault feature vector of the target network device, including: Determine features in the hardware layer fault feature matrix that are greater than a preset hardware bottleneck threshold as hardware bottleneck features, calculate the influence weight of the hardware bottleneck features on features in the software layer fault feature matrix, and calculate the adjacent time change rate of features in the software layer fault feature matrix based on the influence weight to obtain the degree of hardware bottleneck impact; Determine features in the software layer fault feature matrix that deviate from the feature mean by more than the product of a preset abnormality determination coefficient and the feature standard deviation as software abnormality features, calculate the influence coefficient of the software abnormality feature on the features in the hardware layer fault feature matrix, and calculate the rate of change of the features in the hardware layer fault feature matrix relative to the maximum value at a future time based on the influence coefficient to obtain the degree of hardware resource exhaustion; The performance bottleneck propagation strength is calculated by taking the weighted sum of the hardware bottleneck impact degree and the hardware resource exhaustion degree, the node importance is obtained by accumulating the performance bottleneck propagation strength within a preset time window, the propagation path importance is obtained by multiplying the propagation strengths between nodes on the propagation path, and the feature dynamic importance is calculated by taking the weighted sum of the node importance and the propagation path importance; The dynamic importance of the features is exponentially normalized to obtain the propagation perception weight. The fusion feature is obtained based on the product of the propagation perception weight and the corresponding features in the hardware layer fault feature matrix and the software layer fault feature matrix. The fusion feature is input into the preset activation function to obtain the fault feature vector of the target network device.

4. The method according to claim 1, wherein The collection of identification information and link performance indicator data of adjacent devices that directly communicate with the target network device includes: Obtaining a list of neighboring devices of the target network device, and extracting corresponding neighboring device identification information of each neighboring device in the list of neighboring devices; Establishing a communication connection with each adjacent device in the adjacent device list, and collecting link performance indicator data between the target network device and each adjacent device; The adjacent device identification information is associated with the link performance indicator data to construct a link communication feature matrix of the target network device.

5. The method according to claim 1, characterized in that Building a device communication relationship graph based on the adjacent device identification information, calculating the abnormality level of the link performance indicator data, mapping the abnormality level with the device communication relationship graph to obtain a link abnormality probability distribution graph, performing correlation analysis between the fault feature vector and the link abnormality probability distribution graph, determining the impact range of the faulty device through recursive calculation, and outputting the fault root device identification information and the fault occurrence probability, including: Based on the identification information of adjacent devices, a device communication relationship diagram is constructed, link weights of different communication types between devices are calculated, and segmented sliding analysis of link performance indicator data is performed. The product of the sudden change amplitude and duration of the performance indicator is calculated, and the degree of deviation between the product and the historical baseline corresponding to the current device is used as the link anomaly level. The link anomaly probability is calculated based on the link anomaly level, and the link anomaly probability is mapped to the corresponding link in the device communication relationship diagram to obtain a link anomaly probability distribution diagram; The frequency and time domain features of the fault feature vector are extracted through multi-scale decomposition. The extracted features are weightedly combined with the link anomaly probability to obtain the node local correlation. The node importance is calculated based on the shortest path between nodes and the link weight. The product of the node local correlation and node importance is nonlinearly mapped to obtain the global correlation. The propagation intensity matrix is ​​obtained by calculating the product of the cumulative attenuation effect of the link anomaly probability in the time dimension and the node local correlation. The node influence propagation chain is constructed according to the propagation intensity matrix. The node state transition probability is calculated hierarchically and recursively until convergence to obtain the final node state. The final node state is probabilistically fused with the global correlation to obtain the fault root device identification information and the fault occurrence probability.

6. The method according to claim 1, wherein The node influence propagation chain is constructed based on the propagation intensity matrix. The node state transition probability is calculated hierarchically and recursively until convergence to obtain the final node state. The final node state is probabilistically fused with the global correlation to obtain the fault root device identification information and the fault occurrence probability, including: A node influence propagation chain is constructed based on a propagation intensity matrix. The node influence propagation chain includes a node set, an edge set, and a propagation intensity weight matrix. The historical state sequence of each node is sampled within a preset time window to obtain a node state sequence. The time sequence dependency between the node state sequences is calculated based on the mutual information metric to obtain a time sequence dependency matrix. The node state sequence is subjected to a Granger causality test to obtain direct causal strength. All paths between nodes are obtained and the cumulative product of the direct causal strength on each path is calculated to obtain indirect causal strength. The state persistence feature is obtained by calculating the weighted sum of the abnormal state duration and the attenuation coefficient of the node state sequence. The change trend feature is obtained by calculating the average value of the state difference between adjacent moments. The periodic feature is obtained based on the autocorrelation coefficient of the state sequence. The state persistence feature, change trend feature and periodic feature are combined to construct a time series feature vector. The state transition probability matrix is ​​constructed based on the propagation intensity weight matrix, indirect causal strength and temporal feature vector. The state transition probability matrix is ​​fused with the temporal dependency matrix through hierarchical recursive calculation to update the node state until convergence to obtain the final node state. The final node status and global correlation are probabilistically fused to obtain the fault root device identification information and the fault occurrence probability.

7. The method according to claim 1, characterized in that Generate and execute fault handling instructions based on the fault root device identification information and fault probability, record fault recovery process data, and update baseline data, including: According to the fault root device identification information and the fault occurrence probability, matching the fault handling strategies corresponding to the fault root device identification information based on a preset fault type library, and prioritizing the fault handling strategies according to the fault occurrence probability to generate a fault handling instruction; Executing the fault handling instructions, collecting fault recovery process data, and recording the execution effect of the fault handling instructions; The baseline data is updated based on the fault recovery process data, and the execution effect of the fault handling instruction is fed back to the fault type library to complete the dynamic optimization of the fault handling strategy.

8. A multi-source network equipment fault pattern identification and location system, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The first unit is used to collect the CPU usage, memory usage, network interface traffic data, system log data, and network protocol data of the target network device; The second unit is used to respectively calculate the deviation values ​​of the central processing unit utilization rate, memory utilization rate and network interface traffic data from a preset baseline, generate a hardware layer fault feature matrix, perform semantic segmentation on the system log data, extract log event sequences and process call chain information, combine the protocol interaction records of the network protocol data, generate a software layer fault feature matrix, and fuse the hardware layer fault feature matrix with the software layer fault feature matrix to obtain a fault feature vector of the target network device; The third unit is used to collect identification information and link performance indicator data of adjacent devices that directly communicate with the target network device; A fourth unit is configured to construct a device communication relationship graph based on the adjacent device identification information, calculate an anomaly level of the link performance indicator data, map the anomaly level with the device communication relationship graph to obtain a link anomaly probability distribution graph, perform correlation analysis between the fault feature vector and the link anomaly probability distribution graph, determine the impact range of the faulty device through recursive calculation, and output the identification information of the fault root device and the probability of the fault occurring; The fifth unit is used to generate and execute fault handling instructions based on the fault root device identification information and the fault occurrence probability, record the fault recovery process data and update the baseline data.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images