Internet of Things time sequence root cause analysis method based on dynamic cause and effect diagram

Abstract

The invention relates to an Internet of Things time sequence root cause analysis method based on a dynamic causal diagram, and belongs to the technical field of Internet of Things. The method comprises the following steps: embedding a fine-tuning large language model by utilizing an Internet of Things knowledge graph, embedding, splicing and constructing a graph structure through entities and relationships, and combining text word embedding and mask prediction task optimization model; on the basis of knowledge graph subgraph construction, a triple is converted into a natural language to be input into a large model to generate a causal hypothesis; assumptions are converted into causal constraints, dynamic causal graph structure learning is carried out in combination with a Bayesian information criterion scoring function, and conditional probabilities of father nodes and historical values are modeled; performing parameter learning by adopting kernel density estimation, and quantifying time hysteresis among the features; feature probability distribution is predicted based on sliding window observation data, accumulative error contribution is calculated through asymmetric Shapley values, and causal ancestor features are preferentially sorted to determine root causes. Real-time and effective root cause analysis of the Internet of Things system is realized, and the system has the capability of intelligently solving faults.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things, and relates to an Internet of Things time series root cause analysis method based on a dynamic causal graph. Background Art

[0002] With the rapid development of IoT technology, IoT systems are widely used in smart industry, smart grids, smart healthcare, and smart cities. However, due to the complexity of IoT systems, locating the root cause of IoT failures is a challenging task. When an IoT system anomaly occurs, it may be caused by an IoT vulnerability or device failure. Currently, root cause analysis (RCA) of IoT failures relies primarily on manual experience, which is time-consuming, labor-intensive, and difficult to accurately locate. Existing data-driven root cause analysis methods, such as statistical causal relationship inference methods, have high time complexity and cannot meet real-time requirements. Machine learning-based methods lack interpretability and have difficulty revealing causal relationships between different factors. Therefore, finding appropriate mechanisms to accurately determine the root cause and improve the accuracy and timeliness of root cause analysis has become an important issue that needs to be addressed urgently.

[0003] With increasing attention being paid to model interpretability in root cause analysis, root cause analysis methods based on causal learning have attracted widespread attention. Causal learning can reveal causal relationships between different factors and enhance model interpretability, especially when dealing with complex systems and multivariate problems. Therefore, how to effectively apply causal learning to root cause analysis of IoT time series is a key issue that urgently needs to be addressed in this field.

[0004] Regarding solving the problem of accurately locating the root cause of the Internet of Things system, there are currently some invention patents. For example: Patent CN119358669A discloses a method and device for identifying unknown topological causal structures based on the THPs algorithm. This patent pre-processes time series events containing several warning data to obtain cleaned warning sequence data, constructs a post-pretraining dataset and a fine-tuning dataset based on the cleaned warning sequence data, trains and fine-tunes a large language model on the post-pretraining dataset and the fine-tuning dataset, uses the trained and fine-tuned large language model to construct a potential causal graph of the time series data to be tested, initializes the topological graph of the time series data to be tested, and optimizes the topological graph and potential causal graph of the time series data to be tested based on the THPs algorithm to obtain the topological structure and causal structure of the time series data to be tested. However, when pre-processing time series events, the quality of the cleaned warning sequence data still needs to be further optimized to improve the performance of subsequent algorithms. Patent CN117891640A discloses a microservice fault diagnosis method, device and electronic device based on a large language model. This patent constructs a fault knowledge graph for the target microservice, and uses the fault knowledge graph through a fault analysis agent to determine the abnormal call chain, abnormal log, and causal relationships between abnormal components in the target microservice. The fault analysis agent is constructed based on a large language model, and the large language model is used to diagnose the target microservice based on the abnormal call chain, abnormal log, causal relationships between abnormal components, and the fault knowledge graph of the target microservice. However, this patent still needs further optimization when constructing the fault analysis agent to improve the accuracy and efficiency of fault analysis.

[0005] The existing technology has the following disadvantages:

[0006] 1. Existing root cause analysis methods lack an effective causal hypothesis generation mechanism, making it difficult to accurately capture the potential causal relationship between different factors in complex systems, which affects the accuracy of root cause analysis.

[0007] 2. Existing root cause analysis methods are inefficient and need to improve their accuracy when learning causal relationships, and cannot meet the requirements of real-time and explainability.

[0008] 3. Existing root cause analysis methods are unable to dynamically capture the incremental impact of root cause characteristics on anomalies, resulting in insufficient timeliness and accuracy in root cause location.

[0009] 4. When processing time series data, existing root cause analysis methods do not adequately consider the time lag between features, which affects the accuracy of root cause analysis.

[0010] 5. Existing root cause analysis methods do not fully consider the order of causal relationships when calculating feature importance, resulting in the underestimation of the importance of causal ancestral features. Summary of the Invention

[0011] Existing technologies struggle to accurately capture the potential causal relationships between different factors in complex systems; causal relationship learning is inefficient and requires improved accuracy; it's difficult to dynamically capture the incremental impact of root-cause features on anomalies; time lags between features are insufficiently considered; and the order of causal relationships is not fully considered when calculating feature importance. To address these issues, the present invention provides a root cause analysis method for IoT time series based on a dynamic causal graph.

[0012] In order to achieve the above object, the present invention provides the following technical solutions:

[0013] A root cause analysis method for IoT time series based on a dynamic causal graph includes the following steps:

[0014] S1. In the IoT system, we use the IoT domain knowledge graph to embed and fine-tune the large language model.

[0015] S2. Use the IoT domain knowledge graph to search and construct relevant subgraphs. At the same time, the large language model receives the text and relevant subgraph information and generates relevant causal hypotheses.

[0016] S3. Convert the causal assumptions into causal constraints and perform structural learning of a dynamic causal graph;

[0017] S4. Based on structure learning, parameters of dynamic causal graph are learned;

[0018] S5. Based on the dynamic causal graph, the root cause analysis of the IoT time series is performed based on the asymmetric Shapley value.

[0019] Furthermore, the S1 specifically includes the following steps:

[0020] Extract relevant entities from the input text, search for triples related to each entity in the knowledge graph, and use the knowledge graph embedding model based on the translation concept to map the triples into a d-dimensional embedding space to obtain entity embedding and relationship embedding;

[0021] Concatenating the entity embedding and the relationship embedding to form a graph structure;

[0022] Embed the words in the input text to obtain the word embedding of the text, and fine-tune the large language model through the mask prediction task.

[0023] Furthermore, in said S1:

[0024] The input text is represented as:

[0025] S={t1,t2,...,t n}

[0026] where t i is a word in the text, and n is the number of words;

[0027] The related entities are represented as {e1,e2,...,e k}, e i is each entity in the related entities, k is the number of entities;

[0028] With the e i The relevant triples are (e i ,r k ,e j )

[0029] The entity embedding and relation embedding are expressed as:

[0030] e′ i =TrasneE(e i )

[0031] r′ k =TrasneE(r k )

[0032] e′ j =TrasneE(e j )

[0033] where e′ i and e′ j Represents entity e i and e j Embedding, r′ k It is the relationship k Embedding

[0034] The graph structure is:

[0035]

[0036] The word embedding representation of the text is:

[0037] S={t′1,t′2,...,t′ n}.

[0038] Furthermore, the method of fine-tuning the large language model through the mask prediction task is specifically as follows:

[0039] Randomly mask entities and relations in text or graphs, and use contextual information to let the large language model predict these masked parts;

[0040] The textual and atlas representations of the concatenated mask are concatenated to form the final mask input representation;

[0041] During fine-tuning, minimize the gap between the predicted entity or relation at the mask location and the target entity or relation;

[0042] Mask entity E mask Expressed as:

[0043] E mask =[e1,e2,...,e m ]

[0044] Where m represents the number of entities, e i Represents the mask entity in the sequence, e i ∈E mask ;

[0045] For each mask entity, its loss function L E for:

[0046]

[0047] Where S represents the text sequence;

[0048] Mask relation R mask for:

[0049] R mask =[r1,r2,...,r m ]

[0050] where r m Represents the mask relationship in the sequence, r k ∈R mask ;

[0051] For each mask relation, the loss function is:

[0052]

[0053] where r k Represents a relationship in a sequence.

[0054] Furthermore, the step S2 specifically includes the following steps:

[0055] When using the large language model to perform a causal hypothesis generation task, entities extracted from the text are used to search and construct relevant subgraphs in the knowledge graph;

[0056] Representing each triple in the subgraph as a natural language sentence;

[0057] Splicing the knowledge graph information with the original text in text form and transmitting it to the large language model;

[0058] The large language model uses the text and the knowledge graph information to generate relevant causal hypotheses.

[0059] Furthermore, the step S3 specifically includes the following steps:

[0060] The causal assumption is converted into the initial partial order causal graph G0 as follows:

[0061] G0=(V,E1,E2,E3)

[0062] Where V represents the node set of monitoring indicators, E1, E2, and E3 represent the constraint set;

[0063] The Bayesian Information Criterion is used as the scoring function of the causal graph at each time slice:

[0064] BIC(G t )=-2lnf(D i,t |G t )+klnn

[0065] Among them D i,t Represents sample D i The value at time t; lnf(D i,t |G t ) represents the static causal graph G t Next sample D i,t The log-likelihood estimate of ; k represents the number of features, and n represents the number of samples;

[0066] For sample D i The conditional probability density function of the data at time t contains its parent node and its own value at the previous moment, which is expressed as:

[0067]

[0068] Where Pa(X i,t-1 ) represents node X i The value of the parent node at the previous moment; X i,t-1 Represents node X i The value at time t-1.

[0069] Furthermore, the S4 specifically includes the following steps:

[0070] The goal of parameter learning is to estimate the conditional probability distribution of each feature node in the dynamic causal graph;

[0071] The kernel density estimation in the non-parametric learning method is introduced to estimate the probability density distribution of the feature at a certain moment, the time series feature X i The kernel density estimate at time point t in the dynamic causal graph is expressed as:

[0072]

[0073] Where n represents X i The number of observation samples in the data set, h represents the bandwidth, which determines the smoothness of the kernel function, and K represents the kernel function;

[0074] In the dynamic causal graph, the kernel function is adjusted according to the time interval, which is specifically expressed as:

[0075]

[0076] in is a time decay factor, t represents X i,t Timestamp, t i Indicates the reference point X i,j The timestamp of , σ represents the standard deviation of the data;

[0077] Feature X in the dynamic causal graph i The probability density distribution at time t in dynamic causality is expressed as:

[0078]

[0079] Where Pa(X i,t-1 ) represents node X i The set of values of the parent node at the last moment; X i,t-1 Represents node X i,t The value at the previous moment.

[0080] Furthermore, the S5 specifically includes the following steps:

[0081] The dynamic causal graph is represented as follows:

[0082] G d ={G1,G2,...,G τ}

[0083] Assuming that the time when the fault occurs is t, the observation data obtained by sliding window sampling with a window size of τ at time t is:

[0084] Y={X1,X2,...,X n}

[0085] where X i ={x1,x2,...,x τ} represents the feature with time step τ, and n represents the number of features;

[0086] Predict feature X with time steps τ i The probability density distribution at time t (1≤t≤τ) is expressed as:

[0087]

[0088] Where Pa(X i,t-1 ) represents X i In G d The value of the parent node at time t-1

[0089] The predicted value is selected so that the probability density function reaches the maximum value, which is expressed as:

[0090]

[0091] After τ time steps, the predicted values of all features are obtained:

[0092]

[0093] in Represents feature X i The predicted value at time step τ;

[0094] Asymmetric Shapley values are used to measure the marginal contribution of each variable to the system anomaly.

[0095] Furthermore, the asymmetric Shapley value is used to measure the marginal contribution of each variable to the system anomaly, which specifically includes the following steps:

[0096] For the feature subset at the time t when the anomaly occurs The profit function is defined as the cumulative error between the predicted value and the actual value of each feature:

[0097]

[0098] Calculate feature X i In and out of S t:t+τ The difference in overall contribution is used to measure X i Marginal contribution is specifically expressed as:

[0099]

[0100] If a variable X i It's X j Determine the causal ancestor, then X i The weight of marginal contribution is greater than X j ;

[0101] X i The asymmetric Shapley value of is specifically expressed as:

[0102]

[0103] in Xi is the permutation set of valid causal chains of the last node; X i is the permutation set of valid causal chains of the head node, N1 represents the number of causal chains in set S1, N2 represents the number of causal chains in set S2, and A represents system anomaly.

[0104] Furthermore, the asymmetric Shapley values of the n features are sorted, and the features corresponding to the top k largest values are the direct root causes of the IoT system anomalies.

[0105] The beneficial effects of the present invention are:

[0106] 1. By introducing knowledge graphs to assist large language models in generating causal hypotheses in the IoT field, this approach addresses the lack of an effective causal hypothesis generation mechanism in existing root cause analysis methods and improves the accuracy of root cause analysis.

[0107] 2. We propose a dynamic causal graph learning method that introduces causal constraints, which improves the efficiency and accuracy of causal relationship learning and meets the requirements of real-time and explainability.

[0108] 3. We propose a cumulative root cause location method based on a dynamic causal graph. This method analyzes the incremental contribution of features within a time window, dynamically capturing the incremental impact of root cause features on anomalies and improving the accuracy and timeliness of root cause location.

[0109] 4. In the parameter learning of dynamic causal graphs, the kernel density estimation method is introduced to effectively extract the time lag between features and improve the accuracy of root cause analysis;

[0110] 5. When using the asymmetric Shapley value to calculate feature importance, the order of causal relationships is fully considered, avoiding the problem of underestimation of the importance of causal ancestral features.

[0111] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0112] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:

[0113] Figure 1 This is a flow chart of an embodiment of the present invention;

[0114] Figure 2 This is a schematic diagram of a framework of a root cause analysis method for IoT time series according to an embodiment of the present invention;

[0115] Figure 3 This is an example diagram of a knowledge graph according to an embodiment of the present invention;

[0116] Figure 4 A schematic diagram of causal hypothesis generation in an Internet of Things system using a knowledge graph-assisted large language model according to an embodiment of the present invention;

[0117] Figure 5 A schematic diagram of a dynamic causal graph learning algorithm that introduces causal constraints according to an embodiment of the present invention;

[0118] Figure 6 FIG. 4 is a schematic diagram of a cumulative root cause location algorithm based on asymmetric Shapley values according to an embodiment of the present invention. DETAILED DESCRIPTION

[0119] The following describes the embodiments of the present invention by means of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0120] Among them, the accompanying drawings are only for illustrative purposes and represent only schematic diagrams rather than actual pictures, and should not be understood as limiting the present invention. In order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the dimensions of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions may be omitted in the accompanying drawings.

[0121] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "left", "right", "front", "back", etc. indicating directions or positional relationships, they are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0122] See also Figure 1, which is a flow chart of an embodiment of the present invention; please refer to Figure 2 , which is a schematic diagram of a framework of a root cause analysis method for an Internet of Things time series according to an embodiment of the present invention. The present invention provides a root cause analysis method for an Internet of Things time series based on a dynamic causal graph, comprising:

[0123] S1: In the IoT system, use the IoT domain knowledge graph to embed and fine-tune the large language model, specifically including: using the IoT domain knowledge graph to embed and fine-tune the large language model. Figure 3 , which is an example diagram of a knowledge graph according to an embodiment of the present invention; by combining the IoT text knowledge base and related knowledge graph information, the directional mask task is used to fine-tune the large language model s.

[0124] A knowledge graph is formally defined as:

[0125] KG=(E,R,T)

[0126] Where E={e1,e2,...,e n} represents all entities in the graph, R = {r1,r2,...,r m} represents all the relations in the graph, T={(e i ,r k ,e j )} represents the relationship between entities, (e i ,r k ,e j ) represents entity e i and entity e j Through the relationship k Connection. Assume that the input text is S={t1,t2,...,t n}, k is the number of entities, where each t i is a word in the text. Relevant entities are extracted from the text S through rules or dictionary matching, represented as {e1,e2,...,e k}, k is the number of entities. For each entity e i , find the triples related to the entity in the knowledge graph (e i ,r k ,e j ), using the knowledge graph embedding model based on the translation idea (TranslatingEmbeddingsforModelingMulti-relationalData, TransE) to embed the triples (e i ,r k ,e j ) is mapped to a d-dimensional embedding space to obtain entity embedding and relationship embedding:

[0127] ei ′=TrasneE(e i )

[0128] r k ′=TrasneE(r k )

[0129] e′ j =TrasneE(e j )

[0130] where e i ′ and e′ j Represents entity e i and e j Embedding, r k ′ is the relation r k The entity embedding and the relationship embedding are concatenated to form a graph structure representation:

[0131]

[0132] Embed the words in the input text S to get the word embedding S = {t1′, t2′, ..., t′ n Fine-tune the large language model s through the mask prediction task. Specifically, randomly mask the entities and relations in the text or graph, and use the context information to let the large language model s predict these masked parts. Suppose the i-th entity token in the text is masked i , the masked text is represented as:

[0133] S mask =[t1′,t2′,...,[MASK],...,t′ n ]

[0134] Similarly, some entities or relations in the knowledge graph can be masked. Assume that the relation r4 in the triple (e3, r4, e5) is masked, then the masked graph structure is represented as:

[0135] G mask =[e3′,[MASK],e5′]

[0136] Or mask entity e3:

[0137] G mask =[[MASK],r4′,e5′]

[0138] The masked text and graph representations are concatenated to form the final masked input representation. Assume that the text S contains multiple entities, and the knowledge graph triples associated with each entity are (e1, r1, e2)…(e i ,rk ,e j ), the final mask input can be spliced as follows:

[0139]

[0140] During fine-tuning, the training goal is to minimize the gap between the predicted entity or relation at the mask position and the target entity or relation. mask =[e1,e2,...,e m ], m represents the number of entities; for each mask entity e in the sequence i ∈E mask , the loss function is:

[0141]

[0142] Or the mask relation R mask =[r1,r2,...,r m ], similar to entities, the model outputs a probability distribution for each relationship, and the loss calculation method is also based on cross entropy loss. For each mask relationship r k ∈R mask , the loss function is:

[0143]

[0144] If both entities and relations are masked, the final loss function is the weighted sum of the two parts, specifically expressed as:

[0145] L=λL E +(1-λ)L R

[0146] Here, λ represents the weighting coefficient. By adjusting λ, the weights of entities and relationships in the loss function can be adjusted, and the model's attention to entities and relationships can be flexibly controlled.

[0147] S2: Use the IoT domain knowledge graph to find and build relevant subgraphs. The large language model receives both text and relevant subgraph information and generates relevant causal hypotheses. Figure 4, which is a schematic diagram of causal hypothesis generation for an IoT system using a knowledge graph to assist a large language model according to an embodiment of the present invention; this step specifically includes: when using a large language model s to perform a causal hypothesis generation task, by converting entities and relationships in the knowledge graph into natural language form, combining text information and structured knowledge, the performance of the large language model in the causal hypothesis generation task is improved. Utilizing entities extracted from the text, relevant subgraphs are searched and constructed in the knowledge graph. Each triple in the subgraph is represented as a natural language sentence, for example: increased CPU utilization will affect CPU load and thus affect IoT devices. These textual knowledge graph information will be spliced with the original text so as to be provided to the large language model s as a prompt. The large language model s infers possible causal relationships from the given text and knowledge graph information. In this way, the large language model s can simultaneously utilize semantic information in the text and structured relationships in the knowledge graph, thereby improving the effect of the causal hypothesis generation task.

[0148] S3: Convert causal assumptions into causal constraints and learn the structure of dynamic causal graphs. Figure 5 , which is a schematic diagram of a dynamic causal graph learning algorithm that introduces causal constraints in one embodiment of the present invention; this step specifically includes: converting the causal hypothesis generated by the large language model s into an initial partially ordered causal graph and defining it as G0 = (V, E1, E2, E3), where V represents the node set of monitoring indicators, and E1, E2, and E3 represent the constraint set. Causal constraints are divided into three types. For features with verified causal relationships in the field of the Internet of Things, they are defined as a set (V i →V j )∈E1, the edges in E1 must be preserved. For the significant features that cannot have causal relationships, it is defined as the set (V i →V j )∈E2, edges in E2 are not allowed to be created. For features that may have potential causal relationships, it is defined as the set (V i →V j )∈E3, edges in E3 can be created or deleted. In subsequent dynamic causal graph learning, only possible causal structures are searched in the edge set. The causal constraint can be expressed as:

[0149]

[0150] Where, φ(V i ,V j ) is connected to V i and V j trigger conditions.

[0151] Each sample D i ∈D′ is divided into τ time slices, and an initial causal graph G is generated in each time slicet =G0(t=1,...,τ), the causal graphs on each time slice are connected through time dependency to form a dynamic causal graph G d ={G1,G2,...,G τ The commonality of these causal graphs is that the causal structure is the same, and the difference is that the probability density distribution of the nodes is different. In DBN structure learning, the optimization goal of the algorithm is to find a causal structure that has the best fit on a given data set. First, the algorithm uses greedy search only in the edge set E3 to iteratively search for the optimal causal structure. Due to the unidirectional nature of the causal relationship, the greedy search algorithm only tries to add or delete edges under the condition of structural constraints, but does not reverse the edges. Whenever an edge is selected from the edge set to be added to G d When the dynamic causal graph at this time is defined as the candidate graph G d ′, by calculating the candidate graph G d The scoring function of ′ in the sample set D′ determines the causal structure. In order to balance the model fit and model complexity, the algorithm uses the Bayesian information criterion as the causal graph G on each time slice. t ∈G d The scoring function of ′ is specifically expressed as:

[0152] BIC(G t )=-2lnf(D i,t |G t )+k ln n

[0153] Where D i,t Represents sample D i The value at time t; lnf(D i,t |G t ) represents the static causal graph G t Next sample D i,t The log-likelihood estimate of ; k represents the number of features; n represents the number of samples. i At time t, the log-likelihood estimate ln f(D i,t |G t ) is defined as the sum of the conditional probability density functions of each feature. Since the feature has correlation in the time dimension, its conditional probability density function not only contains its parent node, but also its own value at the previous moment, which can be expressed as:

[0154]

[0155] Where Pa(X i,t-1 ) represents node X i The value of the parent node at the previous moment; X i,t-1 Represents node X i The value at time t-1. In a sample Di Above, dynamic causal graph G d The scoring function of ′ is defined as the average of the Bayesian Information Criterion (BIC) of τ causal graphs, which is specifically expressed as:

[0156]

[0157] On the entire sample set D′, the dynamic causal graph G d The scoring function of ′ is defined as the sum of the BIC scores of each sample, specifically expressed as:

[0158]

[0159] Where N is the number of samples. In the process of iteratively searching for the optimal causal structure using greedy search, if there is a candidate graph G d ′ is greater than the current graph G d ,Right now:

[0160] S(G d ′|D′)>S(G d |D′)

[0161] Then accept the candidate graph as the new current graph, and the update formula is:

[0162] G d ←G d '

[0163] If no candidate graph can improve the current score, the search is terminated.

[0164] S4: Based on the structure learning, the parameters of the dynamic causal graph are learned. Specifically, the goal of parameter learning is to estimate the conditional probability distribution of each feature node in the dynamic causal graph. The kernel density estimation in the non-parametric learning method is introduced to estimate the probability density distribution of the feature at a certain moment. The time series feature X i The kernel density estimate at time point t in the dynamic causal graph is expressed as:

[0165]

[0166] Where n represents X i The number of observation samples in the data set, h represents the bandwidth, which determines the smoothness of the kernel function, and K represents the kernel function. In the dynamic causal graph, the kernel function K is no longer a simple Gaussian kernel, but a kernel function that can be adjusted according to the time interval, specifically expressed as:

[0167]

[0168] in Is a time decay factor, which makes the data points with larger time intervals contribute less to the density estimation, t represents X i,t Timestamp, t i Indicates the reference point X i,j timestamp, σ represents the standard deviation of the data.

[0169] In the dynamic causal graph G d In the parameter learning of G, when using kernel density estimation to calculate the conditional probability distribution, in order to extract the time lag between features, it is necessary to consider the relationship between the value of the target feature at the current moment and the value of the parent node at the previous moment. d Feature X in i The probability density distribution at time t in dynamic causality is expressed as:

[0170]

[0171] Where Pa(X i,t-1 ) represents node X i The set of values of the parent node at the last moment; X i,t-1 Represents node X i,t The value at the previous moment.

[0172] S5: Based on the dynamic causal graph, root cause analysis of IoT time series based on asymmetric Shapley value is performed, see Figure 6 , which is a schematic diagram of a cumulative root cause location algorithm based on asymmetric Shapley value according to an embodiment of the present invention. The steps specifically include: a trained dynamic causal graph G d ={G1,G2,...,G τ}, assuming that the time of the fault occurrence is t, at time t, a sliding window sampling with a window size of τ is performed to obtain the observation data Y={X1,X2,...,X n}, where X i ={x1,x2,...,x τ} represents the feature with time step τ, and n represents the number of features. i The probability density distribution at time t (1≤t≤τ) is specifically expressed as:

[0173]

[0174] Where Pa(X i,t-1 ) represents X i In G d The value of the parent node at time t-1. The predicted value is selected so that the probability density function reaches the maximum value, that is:

[0175]

[0176] After τ time steps, the predicted values of all features are obtained in Represents feature X i The predicted value at time step τ.

[0177] In root cause location, system anomalies can often be indicated by multiple possible variables. Therefore, the asymmetric Shapley value is used to measure the marginal contribution of each variable to the system anomaly. For the feature subset at the time t when the anomaly occurs, The profit function is defined as the cumulative error between the predicted value and the actual value of each feature:

[0178]

[0179] Measure X i The marginal contribution method is to calculate the feature X i In S t:t+τ When it is not S t:t+τ The difference in the overall contribution difference is specifically expressed as:

[0180]

[0181] The core of calculating the symmetric Shapley value is to calculate X by all permutations of all features. i The average marginal contribution of is used to ensure the fairness of distribution, that is, to weigh the contribution of each feature evenly in all possible feature addition orders. However, this is not applicable to calculating the Shapley value of features in dynamic causal graphs. In dynamic causal graphs, there is a causal relationship between features and there are clear time and direction constraints. If X i →X j , then X i The effect precedes X j , Shapley value calculation must follow this causal order, that is, X i The impact of X j In the causal diagram, if a feature X i is another feature X j From the perspective of causal reasoning, we expect to attribute the importance to the causal ancestor X. i Rather than the successor X j However, the symmetric Shapley value ignores this causal relationship and calculates X i and X j The importance of X i and X j Placed in every possible position in all permutations, calculate its marginal contribution independently. This results in the causal ancestor X i The importance of X is diluted, and the successor jThe contribution of X may be overestimated. In order to solve the above problem, asymmetric Shapley value is used in the dynamic causal graph. Its characteristic is that asymmetric Shapley value only considers the permutations and combinations that conform to the causal order, ensuring that ancestral variables are added before successor variables. At the same time, if a variable X i It's X j Determine the causal ancestor, then X i The weight of marginal contribution is greater than X j .X i The calculation formula of the asymmetric Shapley value is specifically expressed as:

[0182]

[0183] Where, Indicates X i is the permutation set of valid causal chains of the last node; Indicates X i is the set of permutations of valid causal chains of the head node.

[0184] The asymmetric Shapley value of n features is φ=(φ1,φ2,...,φ n ), sort these asymmetric Shapley values, and the features corresponding to the largest top k Shapley values may be the direct root causes of the IoT system anomalies.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. A root cause analysis method for IoT time series based on dynamic causal graph, characterized by: The following steps are involved: S1. In the IoT system, we use the IoT domain knowledge graph to embed and fine-tune the large language model. S2. Use the IoT domain knowledge graph to search and construct relevant subgraphs. At the same time, the large language model receives the text and relevant subgraph information and generates relevant causal hypotheses. S3. Convert the causal assumptions into causal constraints and perform structural learning of a dynamic causal graph; S4. Based on structure learning, parameter learning of dynamic causal graph is performed; S5. Based on the dynamic causal graph, the root cause analysis of the IoT time series is performed based on the asymmetric Shapley value.

2. The root cause analysis method for IoT time series based on dynamic causal graph according to claim 1 is characterized by: The S1 specifically includes the following steps: Extract relevant entities from the input text, search for triples related to each entity in the knowledge graph, and use the knowledge graph embedding model based on the translation concept to map the triples into a d-dimensional embedding space to obtain entity embedding and relationship embedding; Concatenating the entity embedding and the relationship embedding to form a graph structure; Embed the words in the input text to obtain the word embedding of the text, and fine-tune the large language model through the mask prediction task.

3. The root cause analysis method for IoT time series based on dynamic causal graph according to claim 2, characterized in that: In S1: The input text is represented as: S={t1,t2,...,t n } where t i is a word in the text, and n is the number of words; The related entities are represented as {e1,e2,...,e k }, e i is each entity in the related entities, k is the number of entities; With the e i The relevant triples are (e i ,r k ,e j ) The entity embedding and relation embedding are expressed as: it is i ′=ThunderE(e i ) R k ′=ThunderE(r k ) e′ j =Thunderstorms j ) where e i ′ and e′ j Represents entity e i and e j Embedding, r k ′ is the relation r k Embedding The graph structure is: The word embedding representation of the text is: S={t1′,t2′,...,t′ n }。 4. The root cause analysis method for IoT time series based on dynamic causal graph according to claim 3 is characterized by: The method of fine-tuning the large language model through the mask prediction task is specifically as follows: Randomly mask entities and relations in text or graphs, and use contextual information to let the large language model predict these masked parts; The textual and atlas representations of the concatenated mask are concatenated to form the final mask input representation; During fine-tuning, minimize the gap between the predicted entity or relation at the mask location and the target entity or relation; Mask entity E mask Expressed as: THE mask =[e1,e2,...,e m ] Where m represents the number of entities, e i Represents the mask entity in the sequence, e i ∈E mask ; For each mask entity, its loss function L E for: Where S represents the text sequence; Mask relation R mask for: R mask ＝[r1,r2,...,r m ] where r m Represents the mask relationship in the sequence, r k ∈R mask ; For each mask relation, the loss function is: where r k Represents a relationship in a sequence.

5. The root cause analysis method for Internet of Things time series based on dynamic causal graph according to claim 1 is characterized by: The S2 specifically includes the following steps: When using the large language model to perform a causal hypothesis generation task, entities extracted from the text are used to search and construct relevant subgraphs in the knowledge graph; Representing each triple in the subgraph as a natural language sentence; Splicing the knowledge graph information with the original text in text form and transmitting it to the large language model; The large language model uses the text and the knowledge graph information to generate relevant causal hypotheses.

6. The root cause analysis method for Internet of Things time series based on dynamic causal graph according to claim 1 is characterized by: The S3 specifically includes the following steps: The causal assumption is converted into the initial partial order causal graph G0 as follows: G0=(V,E1,E2,E3) Where V represents the node set of monitoring indicators, E1, E2, and E3 represent the constraint set; The Bayesian Information Criterion is used as the scoring function of the causal graph at each time slice: BIC(G t )=-2lnf(D i,t |G t )+klnn Among them D i,t Represents sample D i The value at time t; lnf(D i,t |G t ) represents the static causal graph G t Next sample D i,t The log-likelihood estimate of ; k represents the number of features, and n represents the number of samples; For sample D i The conditional probability density function of the data at time t contains its parent node and its own value at the previous moment, which is expressed as: Where Pa(X i,t-1 ) represents node X i The value of the parent node at the previous moment; X i,t-1 Represents node X i The value at time t-1.

7. The root cause analysis method for Internet of Things time series based on dynamic causal graph according to claim 1 is characterized by: The S4 specifically includes the following steps: The goal of parameter learning is to estimate the conditional probability distribution of each feature node in the dynamic causal graph; The kernel density estimation in the non-parametric learning method is introduced to estimate the probability density distribution of the feature at a certain moment, the time series feature X i The kernel density estimate at time point t in the dynamic causal graph is expressed as: Where n represents X i The number of observation samples in the data set, h represents the bandwidth, which determines the smoothness of the kernel function, and K represents the kernel function; In the dynamic causal graph, the kernel function is adjusted according to the time interval, which is specifically expressed as: in is a time decay factor, t represents X i,t Timestamp, t i Indicates the reference point X i,j The timestamp of , σ represents the standard deviation of the data; Feature X in the dynamic causal graph i The probability density distribution at time t in dynamic causality is expressed as: Where Pa(X i,t-1 ) represents node X i The set of values of the parent node at the last moment; X i,t-1 Represents node X i,t The value at the previous moment.

8. The root cause analysis method for Internet of Things time series based on dynamic causal graph according to claim 1 is characterized by: The S5 specifically includes the following steps: The dynamic causal graph is represented as follows: G d ={G1,G2,...,G τ } Assuming that the time when the fault occurs is t, the observation data obtained by sliding window sampling with a window size of τ at time t is: Y={X1,X2,...,X n } where X i ={x1,x2,...,x τ } represents the feature with time step τ, and n represents the number of features; Predict feature X with time steps τ i The probability density distribution at time t (1≤t≤τ) is expressed as: Where Pa(X i,t-1 ) represents X i In G d The value of the parent node at time t-1 The predicted value is selected so that the probability density function reaches the maximum value, which is expressed as: After τ time steps, the predicted values of all features are obtained: in Represents feature X i The predicted value at time step τ; Asymmetric Shapley values are used to measure the marginal contribution of each variable to the system anomaly.

9. The method for root cause analysis of IoT time series based on dynamic causal graph according to claim 8, characterized in that: The asymmetric Shapley value is used to measure the marginal contribution of each variable to the system anomaly, which specifically includes the following steps: For the feature subset at the time t when the anomaly occurs The profit function is defined as the cumulative error between the predicted value and the actual value of each feature: Calculate feature X i In and out of S t:t+τ The difference in overall contribution is used to measure X i Marginal contribution is specifically expressed as: If a variable X i It's X j Determine the causal ancestor, then X i The weight of marginal contribution is greater than X j ; X i The asymmetric Shapley value of is specifically expressed as: in X i is the permutation set of valid causal chains of the last node; X i is the permutation set of valid causal chains of the head node, N1 represents the number of causal chains in set S1, N2 represents the number of causal chains in set S2, and A represents system anomaly.

10. The method for root cause analysis of Internet of Things time series based on dynamic causal graph according to claim 9, characterized in that: The asymmetric Shapley values of n features are sorted, and the features corresponding to the top k largest values are the direct root causes of the IoT system anomalies.

Images