Root cause positioning method and device based on Graph-Transform framework and medium

Abstract

The invention provides a root cause positioning method and device based on a Graph-Transform framework and a medium, specifically, the method comprises the steps that Trace calling data of Pod nodes are utilized to construct a calling topological graph, resource index historical time sequence data are fused into the topological graph to form a Pod node fault topological graph rich in information, and the Pod node fault topological graph is used for locating the Pod node fault. And inputting the finally constructed topological graph into a Graph-Transform model for training, gradually increasing label information of each fault in the model training process, and meanwhile, performing mask operation of a certain rule on the topological graph to train a graph attention mechanism. And finally, obtaining a root cause type of Top-K and a root cause Pod node through an output result of the PageRank processing model. According to the method, the defects of a traditional root cause analysis method are overcome, and the accuracy of root cause positioning is improved.

Description

Technical Field

[0001] The present application relates to a root cause location of faults in the field of AIOps intelligent operation and maintenance, and in particular to a root cause location method, device and medium based on the Graph-Transformer framework. Background Art

[0002] Fault root cause location algorithm solutions are mainly divided into the following categories: 1) Root cause detection and search methods based on call topology graphs; 2) Association rule mining / clustering methods based on root cause call topology graphs; 3) Heuristic search methods that design objective functions for root cause determination; 4) Root cause classification and prediction methods based on deep learning.

[0003] Root cause detection and search methods based on call topology graphs primarily perform step-by-step troubleshooting of the call relationship topology between pods, searching each call link to locate the root cause. These methods often incorporate the root cause troubleshooting experience of operations and maintenance experts. A common approach is to build a fault decision tree for common faults in a single microservice and use it to troubleshoot each fault. These methods rely heavily on expert experience. Without this knowledge, the search volume is enormous, efficiency is low, and the microservice architecture is not universally applicable to different fault types.

[0004] Association rule mining / clustering methods based on the root cause call topology graph avoid reliance on expert experience. These methods require code-dependent tracking to collect call relationships between pods and analyze the collected trace data. Common methods include TraceRCA and PageRank. TraceRCA uses the fpgrowth algorithm to mine frequent itemsets and then calculates node fault scores based on these itemsets to locate the root cause. PageRank, first proposed in Google's webpage ranking, assesses the importance of a webpage based on both quantity and quality. Quantity is based on the number of links between other webpages and the current webpage, while quality is determined by the number of important webpages linked to the current webpage. Similarly, the PageRank algorithm can be used to identify important nodes in the pod node call topology graph, effectively pinpointing the root cause node. While these methods partially eliminate reliance on expert experience and lack versatility, they suffer from low accuracy, limited versatility, and a high requirement for topological density of call relationships in production applications. Furthermore, these solutions only consider trace information from the call topology graph.

[0005] A heuristic search method is often used to design an objective function for root cause determination. This method typically uses a root cause score to calculate the objective function, then uses a heuristic optimization algorithm to search for different root cause nodes to find the corresponding root cause Pod node (that is, the Pod node with the highest root cause score). This method has limitations: the objective function is always a root cause score metric, not a measure of the actual root cause node. Furthermore, the heuristic search algorithm is prone to falling into local optimality, while the actual root cause node is generally the global optimal solution.

[0006] Deep learning-based root cause classification prediction methods aim to construct a feature set strongly correlated with the root cause category using relevant indicator data. The dataset is trained using a subset of training data to ultimately predict the root cause category. However, these methods deviate from the concept of constructing a call graph and rely solely on feature construction to extract relevant features. They ignore the topological relationships between different Pod nodes, making the model's prediction accuracy and generalization highly dependent on the feature construction method and dataset quality. Consequently, these methods are unable to predict the root cause node.

[0007] To address the shortcomings of existing technical solutions, the present invention proposes a root cause location method, device, and medium based on the Graph-Transformer framework. This invention can not only predict the root cause node through the model, but also accurately predict the root cause category.

[0008] The present invention has the following advantages: 1. Unlike traditional data-based deep learning algorithms, the data in this invention is not a traditional feature set based on feature construction, but a call topology graph based on trace data. During the model training process, this invention considers the topological relationship between different nodes. As the model trains, it has a deeper understanding of different call links; 2. Different from traditional root cause location solutions based on topology relationships (TraceRCA, PageRank, etc.), this invention not only considers the topological relationships of nodes, but also integrates the time series indicator data of each node into the topological graph for training, enriching the node information and improving the prediction accuracy; 3. Different from the current root cause location solutions, the present invention can predict the root cause category and root cause node through a single model, eliminating the need to use two models for separate predictions, thereby improving the application efficiency of the model. Summary of the Invention

[0009] The present application provides a root cause location method, device, and medium based on a Graph-Transformer framework to address at least one of the problems in related technologies. The technical solution is as follows:

[0010] In a first aspect, embodiments of the present application provide a root cause location method based on a Graph-Transformer framework, including: Step 1: Computing power configuration: basic CPU configuration, consumer GPU selection and configuration, and a set of servers with appropriate cost and sufficient capacity to support daily data volume for model training; Step 2: Data acquisition: Obtain resource indicator time series data, Pod node trace data, and fault time data for each Pod node; the resource indicator time series data includes CPU, memory, and disk IO; the Pod node trace data refers to the call data between Pod nodes, which is used to build a call graph; the fault time data refers to the start and end time of the fault, the root cause type, and the root cause Pod node; Step 3: Data preprocessing: Clean the resource indicator time series data and the trace data, filter out invalid values, and fill in empty values. Step 4: Graph data construction: Select trace data and time series data within the fault time range, build a Pod node call graph, and use the GRU model to perform embedding operations on the time series data, incorporating the embedding information and initialization label information of the time series data. Step 5: Model training: Input the constructed graph data into the Graph-Transformer model, and perform Centrality Encoding, Edge Encoding, and Spatial Encoding on the graph data. Then, input the encoded graph data into the model for iterative training, and gradually increase the proportion of label fusion during the training process. Step 6: Model prediction: Enter the latest fault time, obtain trace data and indicator data to build a graph structure, input the trained model to predict the root cause Pod node and root cause type score, and obtain the top-k root cause types.

[0011] In one embodiment, the computing power configuration includes: Step 1.1: The computing power configuration requires a consumer-level graphics card such as RTX 3090Ti with 24GB of video memory or RTX4090 with 24GB of video memory, and a CPU configuration of 32 cores or more; Step 1.2: Configure the NIVIDA CUDA drivers on the server: GPU Driver and CUDA Toolkit.

[0012] In one embodiment, the data acquisition includes: Step 2.1: Deploy a monitoring platform in the system to be monitored and perform trace operations on each Pod node to record trace data. Step 2.2: Obtain resource indicator time series data for each Pod node, including CPU, memory, and disk IO; Step 2.3: Obtain the call trace data of each Pod node, as well as the corresponding operation data of each Pod node and its associated nodes at each time point; Step 2.4: Obtain fault time data, including the start time and end time of the fault.

[0013] In one embodiment, the data preprocessing includes: Perform data cleaning on the resource indicator time series data and the trace data, filter out invalid values, and fill in empty values.

[0014] In one embodiment, the graph data construction includes: Step 4.1: Input the cleaned data from step 3 into the graph data construction method; first, construct the troubleshooting time range for each fault in turn based on the start and end times provided by the fault data; Step 4.2: Obtain trace data within the troubleshooting time period to build a call graph, and convert call edges into call nodes to build a call graph with weakened edge information.

[0015] In one embodiment, the model training includes: Step 5.1: Use GRU to embed the resource indicator time series data of each calling Pod node in the constructed call graph, fuse it with some labels, and add it to the graph node. At the same time, perform a mask operation on the adjacency matrix. Step 5.2: Embed the call graph of the node resource indicator time series data information that has been label-fused in step 5.1 again and input it into the Graph-Transformer model. Then, perform mask attention calculation using the masked adjacency matrix. Step 5.3: Input the model prediction results into the PageRank model for sorting to obtain the Top-K root cause results; at the same time, the prediction results are judged by the threshold to obtain the predicted label, that is, the root cause node; Step 5.4: Repeat steps 5.1 to 5.4 until the model iteration converges to obtain the final prediction model.

[0016] In one embodiment, the model prediction includes: Step 6.1: Obtain resource indicator time series data, node trace data, and failure time data for each node; Step 6.2: Clean the resource indicator time series data and the trace data, filter out invalid values, and fill in empty values; Step 6.3: Calculate the time range using the start and end time of the fault data; Step 6.4: Select trace data and time series data within the time range, build a node call graph, and incorporate embedding information of the time series data and initialization label information; Step 6.5: Input the Graph-Transformer model; Step 6.6: Output the predicted root cause type score and root cause node; Step 6.7: Input the root cause type scores into the PageRank model to predict the top-k root cause type results; Step 6.8: Iterate 6.4 to 6.6 multiple times until the predicted root cause node result is output.

[0017] In one embodiment, the data source is the historical monitoring data of resource indicators of the Jiawei Blue Whale platform.

[0018] In a second aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement a method in any one of the above-mentioned embodiments.

[0019] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed, it implements the method in any one of the above-mentioned embodiments.

[0020] The beneficial effects of the above technical solution include at least: 1. The model proposed in this application uses trace data and node pod indicator data as input, fuses the data by building a call graph, and adopts the most advanced Transformer architecture to improve the accuracy of root cause location. 2. The root cause location model proposed in this application can simultaneously output the root cause type and root cause node prediction.

[0021] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present application will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. In the accompanying drawings, unless otherwise specified, the same reference numerals throughout multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that the following drawings only illustrate certain embodiments of the present application and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can also be obtained based on these drawings without paying creative work.

[0023] Figure 1 Flowchart for root cause location; Figure 2 This is the flowchart of the root cause location algorithm based on Graph-Transformer; Figure 3 Call edge construction for different nodes; Figure 4 It is the label-index data fusion and graph data mask operation; Figure 5 This is a flowchart of the root cause analysis model based on Graph-Transformer. DETAILED DESCRIPTION

[0024] Hereinafter, only certain exemplary embodiments are briefly described. As will be appreciated by those skilled in the art, the described embodiments may be modified in various ways without departing from the spirit or scope of the present application. Therefore, the drawings and description are to be regarded as illustrative in nature and not restrictive.

[0025] Figure 1 This is a flowchart for root cause location, which describes the overall algorithm flow for root cause location in this application. S100. Obtain fault data. According to step S100, the occurrence time and end time of the fault are obtained to determine the fault time period. S200. According to the fault time period, the Trace call data of the Pod node and the resource indicator history data of the Pod node within the time period are obtained. S300. Use the obtained data to build a call topology graph. S400. Input the Graph-Transformer model for training. S600. Use the trained Graph-Transformer model to predict the root cause node. S500. Use the PageRank algorithm to perform Top-K root cause type sorting.

[0026] Figure 2This is a flowchart of the root cause location algorithm based on the Graph-Transformer framework. The leftmost part of the figure shows the call relationship graph of the nodes constructed based on the acquired data. The middle part shows the input of the constructed call relationship graph and the data of each node into the model for model training. The right part shows the root cause analysis process, which relies on the prediction scores output by the model to sort the top-k root cause categories and outputs the fault map based on the label values output by the model.

[0027] The specific implementation steps are as follows: Step 1: Data processing - graph transformation Traditional call graph construction (encoding) is done by Figure 3 As shown on the left side, different Pod nodes are represented by letters ABCD, and different call relationships are represented by call edge numbers 123. In traditional encoding methods, only the features on the edge are propagated to adjacent nodes; subgraph association is used to describe node association in a partial and comprehensive manner. Figure 3 The encoding method on the right weakens the concept of edges, converting call edges into nodes while retaining instance nodes, forming a heterogeneous directed graph (the direction is determined by the call relationship). If an instance node does not have metric data, the instance node is not retained. If two call edges have a common endpoint, an edge is added to the new graph.

[0028] Step 2: Data processing-label fusion Traditional root cause analysis methods generally do not incorporate node indicator information (i.e., CPU, memory, disk IO, and other indicator data). In this application, the indicator information is embedded in time series data, and GRU is used as the embedding module. GRU is a classic time series model that excels at capturing the correlation in long-term dependency data in time series data. Figure 4 As shown, this application also incorporates the labels of known nodes into the feature data. This approach differs from previous algorithms in this field (which only input feature data and do not use label data as input). The specific method of label integration is to set the label ratio during training and then increase it epoch by epoch, and then restart after reaching the maximum set ratio. During each training process, the algorithm model can not only use the node's feature data, but also integrate the node's label data for gradual learning, thereby improving the accuracy of identifying different root cause types and root cause nodes.

[0029] Using the adjacency matrix as a mask, we limit our attention to specific nodes, extract key features and ignore the features of irrelevant nodes. We achieve exponential growth in the speed of information aggregation by raising the power of the mask matrix. The calculation formula is as follows:

[0030] M is the mask matrix, l is the call chain length, A is the adjacency matrix, and I is the identity matrix. In practice, the microservice call chain will not be too long, and l will not be too large.

[0031] Step 3: Model Training - GraphTransformer like Figure 5 As shown in the figure, the constructed node call graph is transformed into an edge graph to build a call graph containing edge relationships and node relationships. The resource indicator information of each node is integrated into the call node and input into the Graph-Transformer model. The architecture diagram of the Graph-Transformer model is shown in the figure. Figure 5 As shown on the right, we first need to perform three encodings on the input graph information: Centrality Encoding, Edge Encoding, and Spatial Encoding.

[0032] Centrality Encoding: Node centrality is an important signal in graph understanding. For example, in root cause analysis, different nodes often have different numbers of adjacent nodes (closest nodes) and different influences. Therefore, the model should pay different attention to the root cause node when predicting the root cause. Once a large-scale node failure occurs, the more influential the node, the greater the probability of being the root cause. Therefore, this information is valuable. The centrality of a node is represented by out-degree and in-degree. The calculation formula is as follows:

[0033] where z − ,z + ∈Rd is the in-degree deg − (vi) and out-degree deg + (vi) Learnable Embedding Vector. By introducing Centrality Encoding into the input, the softmax attention mechanism can capture both semantic relevance and node centrality.

[0034] Spatial Encoding: The traditional Transformer model uses Position Encoding to encode the spatial information of sequence data. However, for graph data, it cannot be encoded by traditional position encoding because the nodes of graph structure data are not organized into sequences. For a graph G, consider a function O(v i ,v j ) measures the node v in the graph G i and v j The spatial relationship between the two nodes is measured using the shortest distance O(v i,v j ), the Query-key similarity matrix in the attention mechanism is represented by row i and column j as A i，j

[0035] in, is O(v i ,v j ) is a learnable index vector.

[0036] Edge Encoding: For each ordered pair of nodes (v i ,v j ), find (v i ,v j ), the shortest path between ij = (e1, e2, ..., eN), calculate the average of the dot products along the edge feature and the learnable Embedding.

[0037] like Figure 5 As shown on the right, the prepared graph structure data and each node's features (resource indicator time series data) are first subjected to Centrality Encoding, Edge Encoding, and Spatial Encoding. The Centrality Encoding information and node features are added together to form Q, K, and V. The dot product of Q and K is calculated using the attention mechanism and normalized. The output information is then added to the Edge Encoding and Spatial Encoding information, fused into a softmax, and multiplied by V to produce the output.

[0038] The training steps of the Graph-Transformer-based root cause analysis model are summarized as follows: 1. Obtain resource indicator time series data (CPU, memory, disk IO, etc.) for each node, node trace data (call data between nodes, used to build call graphs), and fault time data (fault start and end time, root cause type, and root cause node). 2. Clean resource indicator time series data and trace data, filter invalid values, and fill in empty values; 3. Calculate the time range using the start and end time of the fault data; 4. Select trace data and time series data within the time range, build a node call graph, and incorporate embedding information from the time series data; 5. Label information integration: During training, the labeled annotation ratio is set and increased epoch by epoch, and it will restart after reaching the maximum set ratio; 6. Input the Graph-Transformer model; 7. Output the root cause type and root cause node of the predicted value; 8. Calculate the loss of a single training with the true value; 9. The loss is back-propagated within the model, and the gradient is back-propagated to update the network parameters.

[0039] Repeat steps 3 to 9 until the model loss converges.

[0040] The prediction steps of the Graph-Transformer-based root cause analysis model are summarized as follows: 1. Obtain resource indicator time series data (CPU, memory, disk IO, etc.) of each node, node trace data (call data between nodes, used to build call graphs), and fault time data (start and end time of the fault); 2. Clean resource indicator time series data and trace data, filter invalid values, and fill in empty values; 3. Calculate the time range using the start and end time of the fault data; 4. Select trace data and time series data within the time range, build a node call graph, and incorporate embedding information and initialization label information of the time series data; 5. Input the Graph-Transformer model; 6. Output the predicted root cause type score and root cause node; 7. The root cause type scores are input into the PageRank model to predict the top-k root cause type results; 8. Iterate 4 to 6 times until the predicted root cause node result is output.

[0041] In addition, an embodiment of the present application provides an electronic device, including: a processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method in any one of the above-mentioned embodiments.

[0042] The device may also preferably include a communication interface, which is used for communicating with external devices and transmitting data interactively.

[0043] It should be noted that the memory may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0044] Furthermore, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed, the method in any one of the above-mentioned embodiments is implemented.

[0045] It should be understood that the computer-readable storage medium is any data storage device that can store data or programs that can be subsequently read by a computer system. Examples of computer-readable storage media include read-only memory, random access memory, CD-ROMs, HDDs, DVDs, magnetic tapes, and optical data storage devices. Computer-readable storage media can also be distributed among network-coupled computer systems so that computer-readable code can be stored and executed in a distributed manner.

[0046] The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination thereof.

[0047] In some embodiments, the computer-readable storage medium may be non-transitory.

[0048] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0049] In the description of this specification, any process or method description in a flowchart or otherwise described herein can be understood to represent a module, segment or portion of code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiments of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including performing the functions in a substantially simultaneous manner or in the reverse order depending on the functions involved.

[0050] The logic and / or steps represented in the flowchart or otherwise described herein may be considered, for example, as a sequenced list of executable instructions for implementing the logical functions, and may be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device).

[0051] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application rather than to limit them. The scope of protection of the present application is not limited thereto. Although the present application has been described in detail with reference to the aforementioned embodiments, ordinary technicians in this field should understand that any technician familiar with this technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be covered by the scope of protection of the present application.

Claims

1. A root cause location method based on the Graph-Transformer framework, characterized by: include: Step 1: Computing power configuration: basic CPU configuration, consumer GPU selection and configuration, and a set of servers with appropriate cost and sufficient capacity to support daily data volume for model training; Step 2: Data acquisition: Obtain historical time series data of resource indicators, trace data of Pod nodes, and fault time data of each Pod node; the historical time series data of resource indicators includes CPU, memory, and disk IO; the trace data of the Pod node refers to the call data between Pod nodes, which is used to build the call graph; the fault time data refers to the start and end time of the fault, the root cause type, and the root cause Pod node; Step 3: Data preprocessing: Clean the resource indicator historical time series data and the trace data, filter out invalid values, and fill in empty values. Step 4: Graph data construction: Select trace data and time series data within the fault time range, build a Pod node call graph, and use the GRU model to perform embedding operations on the time series data, incorporating the embedding information and initialization label information of the time series data. Step 5: Model training: Input the constructed graph data into the Graph-Transformer model, and perform Centrality Encoding, Edge Encoding, and Spatial Encoding on the graph data. Then, input the encoded graph data for iterative model training, and gradually increase the proportion of label fusion during the training process. Step 6: Model prediction: Enter the latest fault time, obtain trace data and indicator data to build a graph structure, input the trained model to predict the root cause Pod node and root cause type score, and obtain the top-k root cause types.

2. The method according to claim 1, characterized in that The computing power configuration includes: Step 1.1: The computing power configuration requires a consumer-level graphics card such as RTX 3090Ti with 24GB of video memory or RTX4090 with 24GB of video memory, and a CPU configuration of 32 cores or more; Step 1.2: Configure the NIVIDA CUDA drivers on the server: GPU Driver and CUDA Toolkit.

3. The method according to claim 1, characterized in that The data acquisition includes: Step 2.1: Deploy a monitoring platform in the system to be monitored and perform trace operations on each Pod node to record trace data. Step 2.2: Obtain historical time series data of resource indicators for each Pod node, including CPU, memory, and disk IO; Step 2.3: Obtain the call trace data of each Pod node, as well as the operation data corresponding to each Pod node and its associated Pod nodes at each time point; Step 2.4: Obtain fault time data, including the start time and end time of the fault.

4. The method according to claim 1, wherein The data preprocessing includes: Perform data cleaning on the resource indicator historical time series data and the Trace data, filter out invalid values, and fill in empty values.

5. The method according to claim 1, wherein The graph data construction includes: Step 4.1: Input the cleaned data from step 3 into the graph data construction method; first, construct the troubleshooting time range for each fault in turn based on the start and end times provided by the fault data; Step 4.2: Obtain trace data within the troubleshooting time period to build a call graph, and convert call edges into call nodes to build a call graph with weakened edge information.

6. The method according to claim 1, characterized in that The model training includes: Step 5.1: Use GRU to embed the historical time series data of resource indicators of each calling Pod node in the constructed call graph, fuse it with some labels, and add it to the graph nodes. At the same time, perform a mask operation on the adjacency matrix. Step 5.2: Embed the call graph of the historical time series data of the node resource indicators that have been label-fused in step 5.1 again and input it into the Graph-Transformer model. Then, perform mask attention calculation using the masked adjacency matrix. Step 5.3: Input the model prediction results into the PageRank model for sorting to obtain the Top-K root cause results; at the same time, the prediction results are judged by the threshold to obtain the predicted label, that is, the root cause node; Step 5.4: Repeat steps 5.1 to 5.4 until the model iteration converges to obtain the final prediction model.

7. The method according to claim 1, characterized in that The model predictions include: Step 6.1: Obtain the historical time series data of resource indicators, node trace data, and failure time data of each node; Step 6.2: Clean the resource indicator historical time series data and the trace data, filter out invalid values, and fill in empty values; Step 6.3: Calculate the time range using the start and end time of the fault data; Step 6.4: Select trace data and time series data within the time range, build a node call graph, and incorporate embedding information of the time series data and initialization label information; Step 6.5: Input the Graph-Transformer model. Step 6.6: Output the predicted root cause type score and root cause node; Step 6.7: Input the root cause type scores into the PageRank model to predict the top-k root cause type results; Step 6.8: Iterate 6.4 to 6.6 multiple times until the predicted root cause node result is output.

8. The method according to claim 3, characterized in that The data source is the historical monitoring data of resource indicators of Jiawei Blue Whale platform.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images