Computer network equipment fault positioning method and system and storage medium

Abstract

The invention discloses a computer network equipment fault positioning method and system and a storage medium, and relates to the technical field of fault positioning. The method comprises the following steps: performing multi-source operation acquisition on computer network equipment to generate an equipment state data set; according to the equipment state data set, abnormity judgment is carried out according to the dynamic baseline, monitoring extraction is carried out according to a judgment result, and an abnormal event sequence is constructed; performing association mapping based on a computer network equipment topological graph, constructing a network equipment dependency graph, traversing the network equipment dependency graph according to an abnormal event sequence to perform traceability positioning, and determining a fault source equipment identifier set; and performing fault root cause analysis according to the fault source equipment identification set, determining fault generation root cause data, and feeding back the fault generation root cause data to the network operation and maintenance unit to execute automatic fault handling. The technical problems of low network equipment fault positioning efficiency and poor positioning accuracy in the prior art are solved, and the technical effect of accurately and efficiently positioning the fault source is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of fault location, and in particular to a method, system and storage medium for locating a fault of a computer network device. Background Art

[0002] Computer network equipment, including routers, switches, and servers, is a key component of the network architecture. Its normal operation is crucial to ensuring network connectivity, accuracy, and real-time data transmission. Although existing computer network equipment fault location technology can detect and solve faults to a certain extent, it often has many limitations. On the one hand, fault location is not accurate and efficient enough, and it is difficult to quickly and accurately identify the source of the fault from the massive amount of network equipment data, resulting in a long troubleshooting time and affecting the network's recovery speed. On the other hand, the lack of comprehensive consideration of the complex dependencies between network devices makes it difficult to trace the source from the perspective of the overall network architecture, so that the fault location process is often limited to local devices and cannot fundamentally solve the problem. In addition, after a fault occurs, most existing technologies require manual intervention for root cause analysis and disposal, and the degree of automation is low. This not only increases the workload of operation and maintenance personnel, but may also lead to untimely or inaccurate processing due to human factors. Summary of the Invention

[0003] The present application provides a computer network device fault location method, system and storage medium, which solve the technical problems of low efficiency and poor positioning accuracy of network device fault location in the prior art.

[0004] A first aspect of the present application provides a method for locating a computer network device fault, the method comprising:

[0005] Perform multi-source operation collection on computer network equipment to generate an equipment status data set; set a dynamic baseline for equipment operation, perform abnormality judgment according to the dynamic baseline based on the equipment status data set, perform monitoring and extraction based on the judgment result, and construct an abnormal event sequence; retrieve the computer network equipment topology map, perform association mapping based on the computer network equipment topology map, construct a network equipment dependency map, traverse the network equipment dependency map according to the abnormal event sequence to trace the source and locate the fault source device identification set; perform fault root cause analysis according to the fault source device identification set, determine the fault root cause data, and feed the fault root cause data back to the network operation and maintenance unit to perform automated fault handling.

[0006] A second aspect of the present application provides a computer network device fault location system, the system comprising:

[0007] Data acquisition module: performs multi-source operation collection on computer network equipment to generate an equipment status data set; abnormality judgment module: sets a dynamic baseline for equipment operation, performs abnormality judgment according to the dynamic baseline based on the equipment status data set, performs monitoring and extraction based on the judgment results, and constructs an abnormal event sequence; positioning module: retrieves the computer network equipment topology map, performs association mapping based on the computer network equipment topology map, constructs a network equipment dependency map, traverses the network equipment dependency map according to the abnormal event sequence to trace the source and locate the fault source, and determines the fault source equipment identification set; analysis module: performs fault root cause analysis according to the fault source equipment identification set, determines the fault root cause data, and feeds the fault root cause data back to the network operation and maintenance unit for automated fault handling.

[0008] The third aspect of the present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements a computer network device fault locating method provided by the present application.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] First, multi-source operation data collection is performed on computer network devices to generate a device status data set. Next, a dynamic baseline for device operation is set, and abnormality judgments are made according to the dynamic baseline based on the device status data set. Monitoring and extraction are performed based on the judgment results to construct an abnormal event sequence. Then, the computer network device topology map is retrieved, and association mapping is performed based on the computer network device topology map to construct a network device dependency graph. The network device dependency graph is traversed according to the abnormal event sequence to trace the source and locate the fault source device identification set. Finally, the root cause of the fault is analyzed according to the fault source device identification set to determine the root cause data of the fault generation, and the root cause data of the fault generation is fed back to the network operation and maintenance unit for automated fault handling. This solves the technical problems of low efficiency and poor positioning accuracy of network equipment fault positioning in the existing technology, and achieves the technical effect of accurately and efficiently locating the fault source. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] Figure 1 A flowchart of a method for locating a computer network device fault provided in an embodiment of the present application;

[0013] Figure 2A schematic diagram of the structure of a computer network equipment fault location system provided in an embodiment of the present application.

[0014] Description of the accompanying drawings: data acquisition module 11, abnormality determination module 12, positioning module 13, analysis module 14. DETAILED DESCRIPTION

[0015] The present application solves the technical problems of low efficiency and poor positioning accuracy of network equipment fault positioning in the prior art by providing a computer network equipment fault positioning method, system and storage medium.

[0016] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0017] It should be noted that the terms "including" and "having" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or are inherent to these processes, methods, products or devices.

[0018] Example 1, as Figure 1 As shown, the present application provides a computer network device fault location method, wherein the method includes:

[0019] Collect multi-source operation data of computer network devices to generate device status data sets.

[0020] In the embodiment of the present application, determine the data types such as the performance indicators of the collection device (such as CPU usage, memory occupancy, etc.), configuration information (interface configuration, routing table, etc.), log information (system log, error log, etc.) and flow data (flow size, direction, etc.); select appropriate collection tools and technologies, such as using the SNMP protocol to collect performance indicators, the Syslog protocol to collect log information, and the NetFlow or sFlow technology to collect flow data. For device configuration information, log in to the device through SSH or Telnet protocol to obtain the output results of the configuration command; deploy collection nodes at key locations in the network, install or configure sensors on the target device, and ensure that the sensors can Perform data collection according to the predetermined collection strategy; formulate collection strategies and plans at the same time, set the collection frequency for different equipment types and data importance, and formulate the trigger collection conditions when faults or performance thresholds are exceeded; start the collection tools and technologies, and collect data from the target equipment according to the predetermined strategies and plans, ensuring that the collection is stable and reliable during the process, and adopting data retransmission mechanisms or local caching strategies to ensure data integrity; the collected raw data needs to be preprocessed, including data cleaning to remove duplicate, erroneous or invalid data, data formatting to unify the format and unit, data normalization to eliminate dimensional differences, and then integrating the preprocessed data according to key fields such as device identification and timestamp to generate a structured device status data set.

[0021] A dynamic baseline for equipment operation is set, abnormality determination is performed according to the dynamic baseline based on the equipment status data set, monitoring and extraction are performed based on the determination results, and an abnormal event sequence is constructed.

[0022] The dynamic baseline of device operation refers to the benchmark range of various performance indicators of the device under normal working conditions, determined by analyzing the historical operation data of computer network devices over different time periods. These performance indicators include but are not limited to the device's CPU usage, memory usage, network traffic, latency, error rate, etc.

[0023] After the dynamic baseline is set, anomaly determination is performed based on the device status data set and the dynamic baseline. Specifically, the real-time device status data is compared with the dynamic baseline to identify deviations outside the normal operating range and determine whether an anomaly exists. If an anomaly is detected, the system monitors and extracts the relevant abnormal data points based on the determination results, forming an abnormal event sequence.

[0024] Furthermore, the process of setting a dynamic baseline for device operation includes:

[0025] An equipment operation cycle is introduced, and historical equipment status data is extracted according to the equipment operation cycle; based on the historical equipment status data, the data is sliced ​​according to the operation time period to obtain multiple data slices; based on the multiple data slices, equipment operation is clustered to determine multiple operation mode data slices and multiple non-operation mode data slices; based on the multiple operation mode data slices, autoregression is performed to obtain an operation indicator baseline; based on the multiple non-operation mode data slices, autoregression is performed to obtain a non-operation indicator baseline; the operation indicator baseline is fitted with the non-operation indicator baseline to set the dynamic baseline of the equipment operation.

[0026] The equipment operation cycle refers to the periodic behavior pattern exhibited by the equipment during long-term operation, such as daily business peaks and troughs, and the difference between working days and rest days of the week. Based on the equipment operation cycle, historical equipment status data within the corresponding time period is extracted from the database. This data covers key information such as the equipment's performance indicators, configuration information, and log records. Based on the extracted historical equipment status data, slice processing is performed according to the operating time period. For example, a day can be divided into multiple time periods (such as one slice per hour), and each time period corresponds to a data slice. Then, equipment operation clustering analysis is performed on multiple data slices, and clustering algorithms (such as K-means, DBSCAN, etc.) are used to group similar data slices into one category; through clustering, multiple operating mode data slices and non-operating mode data slices of the equipment can be distinguished. The operating mode data slice reflects the typical operating status of the equipment under normal business load, while the non-operating mode data slice may correspond to the equipment being idle, under maintenance, or in an abnormal state.

[0027] After obtaining the clustering results, autoregressive analysis is performed on the operating mode data slices. An autoregressive model (such as ARIMA) can be used to fit the time series data in these operating mode data slices. This captures trends and cyclical changes in the device's normal operating mode and generates an operating indicator baseline. Similarly, autoregressive analysis is performed on the non-operating mode data slices to generate a non-operating indicator baseline. The operating indicator baseline and the non-operating indicator baseline describe the normal behavior of the device in both the operating and non-operating states, respectively. By fitting the operating indicator baseline with the non-operating indicator baseline, a complete dynamic baseline for device operation is formed.

[0028] Furthermore, an abnormality determination is performed according to the dynamic baseline based on the device status data set, monitoring and extraction are performed based on the determination result, and an abnormal event sequence is constructed. The method includes:

[0029] The device status data set is divided into a device dynamic data set and a device static data set; the deviation of the device dynamic data set is calculated according to the operation indicator baseline to obtain the device operation offset value; the device dynamic data set is judged to be abnormal according to the device operation offset value to determine the device dynamic abnormal data point; the deviation of the device static data set is calculated according to the non-operation indicator baseline to obtain the device non-operation offset value; the device static data set is judged to be abnormal according to the device non-operation offset value to determine the device static abnormal data point; the device dynamic abnormal data point and the device static abnormal data point are spatiotemporally clustered using a continuous time window to construct the abnormal event sequence.

[0030] Specifically, the device status dataset is divided into a dynamic dataset and a static dataset. The dynamic dataset primarily contains data that changes frequently over time, such as performance metrics like CPU usage, memory utilization, and bandwidth utilization. The static dataset, on the other hand, covers relatively stable data, such as device configuration information, firmware version, and hardware model. For the dynamic dataset, deviations are calculated using a pre-defined operational metric baseline. This baseline reflects the performance trends and periodic changes of the device under normal operating conditions. By calculating the deviation between the real-time dynamic data and the baseline, the device operational offset is obtained, which quantifies the degree to which the current data differs from the normal state. Based on the operational offset, anomaly determination is performed on the dynamic dataset. A reasonable threshold is set. When the offset exceeds this threshold, the corresponding dynamic data point is considered an anomaly, i.e., a dynamic anomaly data point. Furthermore, for the static dataset, deviations are calculated using a non-operational metric baseline. This baseline describes the normal behavior of the device in non-operational states (such as idle or maintenance). The non-operational offset is calculated by calculating the deviation between the static data and the non-operational metric baseline. Based on the device's non-operational offset value, anomalies are determined for the device's static data set. Similarly, a threshold is set to determine whether a static data point is abnormal, i.e., an abnormal static data point. Finally, a spatiotemporal clustering analysis is performed on the device's dynamic and static abnormal data points using a continuous time window. These abnormal data points are aggregated spatially and temporally to identify the occurrence patterns of abnormal events. Through clustering, the scattered abnormal data points can be integrated into an abnormal event sequence with clear temporal and spatial characteristics.

[0031] Retrieve a computer network device topology map, perform association mapping based on the computer network device topology map, construct a network device dependency graph, traverse the network device dependency graph according to the abnormal event sequence to trace the source and determine the fault source device identification set.

[0032] A computer network device topology diagram shows the physical or logical connection relationships between computer network devices, including how devices are connected to each other through various links and paths.

[0033] In an embodiment of the present application, a computer network device topology map is retrieved from a database, and association mapping is performed based on the retrieved computer network device topology map to form a network device dependency map. The network device dependency map graphically displays the dependency relationships between devices, including direct dependencies (such as device A is directly connected to device B) and indirect dependencies (such as device A is connected to device C through device B).

[0034] After constructing the network device dependency graph, the graph is traversed according to the sequence of abnormal events to trace the source of the fault. The traversal process begins at the starting point of the abnormal event and gradually traces upward or downward along the path in the device dependency graph, analyzing the status and behavior of each dependent device at the time of the abnormal event. By examining these devices' log information, performance indicators, configuration changes, and other data, it is possible to further confirm whether they played a role in the abnormal event. If the status or behavior of a device is closely related to the abnormal event, and other dependent devices also exhibit abnormalities, the scope of the fault can be gradually narrowed down, ultimately locating the faulty device. Through source tracing and location, the faulty device is identified, forming a set of faulty device identifiers.

[0035] Furthermore, association mapping is performed based on the computer network device topology diagram to construct a network device dependency graph, and the method includes:

[0036] Based on the computer network device topology diagram, the computer network device is configured and parsed to obtain the physical connection relationship of the device; based on the computer network device topology diagram, the computer network device is traffic parsed to obtain the device logical path information; the physical connection relationship of the device and the device logical path information are bi-dimensionally correlated and mapped to determine multiple dependency weights, and the network device dependency relationship map is constructed based on the multiple dependency weights.

[0037] Based on the computer network device topology diagram, device configuration analysis is performed to identify the physical paths between devices via network cables, optical fibers, or wireless connections to obtain the physical connection relationships between devices. Based on the computer network device topology diagram, device traffic analysis is performed on the devices, that is, analyzing the data flow path in the network, including information such as source IP, destination IP, transmission protocol, port number, etc., to obtain logical path information between devices. Through traffic analysis, the logical communication relationship between devices is identified, such as how data packets are transmitted from the source device to the destination device through multiple intermediate devices, forming a logical network path.

[0038] After obtaining information about the physical connections and logical paths of devices, two-dimensional association mapping is performed. This combines physical connections with logical paths to analyze inter-device dependencies. For example, a device may be physically connected to multiple other devices, but logically only interact frequently with a few of them. Association mapping can be used to determine the dependency weights between devices—that is, the degree to which device A depends on device B. Device dependencies with stronger physical connections are assigned higher weights, while logical path dependencies are weighted based on the impact of data traffic and network structure.

[0039] Based on multiple dependency weights, a network device dependency graph is constructed. This graph graphically displays the dependencies between devices, with each device acting as a node in the graph and the dependency weights as edges between nodes. This graph allows you to intuitively identify key devices and closely related dependencies, providing strong support for subsequent fault tracing and root cause analysis.

[0040] Furthermore, the method includes tracing the network device dependency graph according to the abnormal event sequence to locate the source and determine the fault source device identification set.

[0041] Based on the abnormal event sequence, the network device dependency graph is traversed for matching to determine multiple graph nodes; the abnormal event sequence is mapped to the multiple graph nodes to determine multiple abnormal nodes; the network device dependency graph is reversely traversed according to the multiple abnormal nodes to determine multiple fault nodes, and backtracking positioning is performed based on the multiple fault nodes to determine the fault source device identifier.

[0042] When traversing the network device dependency graph, match the key information in the abnormal event sequence (such as the time period when the abnormality occurred, the network area involved, etc.) with the nodes in the graph. For example, if the abnormal event sequence shows that network congestion occurs in a specific subnet within a certain time period, the node corresponding to the subnet and the nodes directly or indirectly connected to the subnet can be located in the graph. These nodes are the multiple graph nodes that have been preliminarily determined. Specific abnormal information in the abnormal event sequence, such as abnormal equipment performance indicators, error information in the log, etc., are mapped to the multiple graph nodes previously determined. By analyzing the status data of the device associated with each graph node, it is determined whether the node has an abnormality. For example, if the CPU usage of the device corresponding to a certain graph node continues to exceed the threshold during the time period when the abnormal event occurs, and a large number of error prompts appear in the log, then the node can be determined to be an abnormal node.

[0043] Starting from the identified multiple abnormal nodes, reverse traversal is performed according to the dependency relationships in the network device dependency graph to identify the upstream devices or factors that caused the abnormal nodes to behave abnormally. For example, if an abnormal node is an access switch, reverse traversal may reveal that the connected aggregation switch has a configuration error or performance bottleneck, causing the access switch to behave abnormally. This reverse traversal can identify multiple faulty nodes, which may be the direct root cause of the abnormal event.

[0044] Perform a comprehensive analysis of the multiple identified fault nodes, and through further data collection and analysis (such as in-depth inspection of device configurations, logs, and performance indicators), determine the ultimate source device for the fault. For example, if multiple fault nodes all point to the same core router, and a detailed inspection of that router reveals a fault in a key module, then the core router can be identified as the source device, and its device identifier (such as device name, IP address, etc.) is recorded to form a set of source device identifiers.

[0045] Furthermore, the network device dependency graph is reversely traversed according to the multiple abnormal nodes to determine multiple fault nodes, and backtracking and locating the multiple fault nodes to determine the fault source device identifier is performed. The method includes:

[0046] Based on the multiple abnormal nodes, multiple dependency edges in the network device dependency graph are traversed in reverse to determine the upstream node set; based on the upstream node set, a fault propagation analysis is performed to determine multiple fault propagation probabilities, and the multiple fault propagation probabilities correspond to the upstream node set; a fault propagation critical threshold is set to determine whether the multiple fault propagation probabilities exceed the fault propagation critical threshold; according to the fault propagation probabilities that exceed the fault propagation critical threshold among the multiple fault propagation probabilities, multiple fault nodes are determined; based on the multiple fault nodes, a starting node is determined by backtracing and added as a label to the computer network device to construct the fault source device identification set.

[0047] Starting from the multiple abnormal nodes identified previously, reverse traverse along the dependency edges in the network device dependency graph. Dependency edges represent the dependency relationship between devices, for example, device A depends on the normal operation of device B. By reverse traversal, all direct and indirect upstream device nodes of these abnormal nodes can be traced to form an upstream node set. Perform fault propagation analysis on each node in the upstream node set, that is, evaluate the degree of influence of each upstream node on the abnormal node, that is, the probability of the fault propagating from the upstream node to the abnormal node; optionally, use historical fault data analysis: collect fault records that occurred in the network in the past, including information such as the time and location of the fault, the equipment involved, and the propagation path of the fault; use data analysis techniques such as data mining and machine learning to identify common patterns and laws of fault propagation, for example, certain equipment combinations are prone to fault propagation under certain conditions, or certain types of faults are more likely to spread in the network; based on historical fault data, count the number of times the upstream node causes abnormal node failure to the total number of failures as an estimate of the fault propagation probability. For example, in the past year, the upstream node C caused abnormal node D to fail 5 times, and the total number of failures was 100 times, so the preliminary estimate P CD 5%.

[0048] Based on the actual needs and historical experience of network operation and maintenance, a critical threshold for fault propagation is set. This threshold is used to distinguish which upstream nodes have significant fault propagation probabilities and which can be ignored. By comparing the fault propagation probability of each upstream node with this threshold, the upstream nodes that are most likely to cause abnormal events can be screened out. Nodes whose fault propagation probabilities exceed the critical threshold are screened out from the upstream node set. These nodes are multiple fault nodes. Further backtracking analysis is performed on the multiple fault nodes identified to determine the final starting node, that is, the fault source device. The starting node is usually the starting point of the fault propagation path. Its fault will propagate to other nodes along the dependency relationship, eventually leading to the occurrence of abnormal events. The device identifier of the starting node (such as device name, IP address, etc.) is added as a label to the computer network device to form a set of fault source device identifiers.

[0049] Perform a root cause analysis of the fault according to the fault source device identification set, determine the fault root cause data, and feed the fault root cause data back to the network operation and maintenance unit to execute automated fault handling.

[0050] Root cause analysis is performed based on the device identifiers of the fault source. Based on the identified fault source device identifiers, the system analyzes the relationships between these devices and other devices in the network. Combined with the device's status, configuration, and historical operational data, the system determines the specific cause of the fault. The goal of root cause analysis is to identify the root cause of network device failures, not just the symptoms. Specifically, all data related to the fault source device is collected, including device configuration, historical operational status, recent event logs, and traffic data. Using data correlation analysis techniques, combined with failure modes and inter-device dependencies, the system can extract the underlying factors that led to the failure, generating root cause data. This data contains the specific root cause of the failure and detailed information related to the fault source device. For example, improper device configuration, hardware failure, software conflicts, or changes in the external environment are all possible root causes. This root cause data is fed back to the network operations and maintenance unit, which automatically implements the fault resolution based on this data. The automated fault resolution system then implements a pre-defined action based on the root cause, including device reconfiguration, rebooting, switching to a backup device, updating device firmware, or taking other remedial measures. Through automated fault handling, we can quickly respond to network problems, reduce manual intervention, and improve fault repair efficiency.

[0051] Furthermore, performing a fault root cause analysis according to the fault source device identification set, determining fault root cause data, and feeding the fault root cause data back to the network operation and maintenance unit for automated fault handling, the method includes:

[0052] Perform three-source verification based on the fault source device identification set to obtain fault root cause data; synchronously feed back the fault root cause data to the network operation and maintenance unit for data correlation analysis to generate a fault handling strategy, wherein the fault handling strategy includes a fault risk level; execute the fault handling strategy based on the fault risk level to perform an operation and maintenance evaluation and generate an operation and maintenance effect; update the fault handling strategy according to the operation and maintenance effect, and feed back the update result to the network operation and maintenance unit.

[0053] Three-source verification is performed based on the identified fault source device identifiers to obtain root cause data. This verification typically involves a comprehensive analysis of device logs, performance metrics, and configuration change records. By examining the fault source device logs, the operating status and anomaly information at the time of the fault can be obtained. Analysis of performance metrics (such as CPU usage, memory utilization, and bandwidth utilization) can reveal device load and performance bottlenecks. Reviewing configuration change records can track configuration changes that may have caused the fault. Next, the obtained root cause data is synchronously fed back to the network operation and maintenance unit for data correlation analysis, generating a fault handling strategy that includes a fault risk level. Data correlation analysis involves a comprehensive comparison of the root cause data with network topology, dependencies, and historical fault records to identify the fault's impact and potential risks. Based on the analysis results, a fault handling strategy is generated, clearly indicating the fault's risk level (e.g., high, medium, or low) to ensure targeted follow-up. The fault handling strategy is then implemented based on the fault risk level, and an operation and maintenance evaluation is conducted to generate operational results. High-risk faults may require immediate emergency measures, such as restarting the device, rolling back the configuration, or isolating the faulty node; medium- and low-risk faults can be scheduled for maintenance based on actual conditions. After executing the handling strategy, the operation and maintenance results are evaluated, including whether the fault has been completely resolved, whether network performance has been restored, and whether the impact on the business has been eliminated. Finally, the fault handling strategy is updated based on the operation and maintenance results, and the updated results are fed back to the network operation and maintenance unit. If the handling strategy achieves good results during implementation, it can be solidified into the knowledge base for reference for similar faults in the future; if the results are not good, it is necessary to analyze the reasons and optimize the strategy, such as adjusting the handling steps, optimizing resource allocation, or improving automation scripts. The updated handling strategy is fed back to the network operation and maintenance unit again, forming a closed-loop management and continuously improving the intelligence and automation level of network operation and maintenance.

[0054] Furthermore, three-source verification is performed based on the fault source device identification set to obtain fault root cause data, and the method includes:

[0055] Based on the fault source device identification set, the configuration of the computer network device is verified to determine the device configuration difference set; based on the fault source device identification set, the log of the computer network device is scanned to determine the fault mode set; based on the fault source device identification set, the traffic forensics of the computer network device is collected to determine the traffic anomaly indicator set; the device configuration difference set, the fault mode set, and the traffic anomaly indicator set are integrated to generate triple root cause data, and the triple root cause data is added to the fault generation root cause data.

[0056] The configuration of computer network devices is verified based on the fault source device identification set. By comparing the current configuration with the baseline configuration, checking the recent change records, and verifying whether the configuration parameters comply with the network policy, the device configuration difference set is determined, that is, the collection of configuration items that are inconsistent with expectations or may cause failures.

[0057] Based on the fault source device identification set, computer network device logs are scanned to identify a set of fault patterns. Logs are real-time records of device operating status and contain rich fault information. By scanning and analyzing the logs of the fault source device, abnormal behavior patterns at the time of the fault can be identified. For example, frequent interface errors, high-frequency alarm messages, or unusual service interruption records may form part of the fault pattern set.

[0058] Traffic forensics is performed on computer network devices based on the device identifier set of the fault source to identify a set of traffic anomaly indicators. Traffic forensics monitors network traffic between devices and identifies abnormal traffic patterns and indicators, such as excessive requests, packet loss, and network congestion. Traffic forensics can identify a set of traffic anomaly indicators. These indicators may include bandwidth utilization, number of error packets, and retransmission rate, which directly reflect network performance issues.

[0059] The device configuration difference set, failure mode set, and traffic anomaly indicator set are integrated to generate triplet root cause data. This triplet root cause data brings together information on configuration, failure mode, and traffic flow, and can comprehensively and accurately reflect the root cause of the failure.

[0060] In summary, the embodiments of the present application have at least the following technical effects:

[0061] First, multi-source operation data collection is performed on computer network devices to generate a device status data set. Next, a dynamic baseline for device operation is set, and abnormality judgments are made according to the dynamic baseline based on the device status data set. Monitoring and extraction are performed based on the judgment results to construct an abnormal event sequence. Then, the computer network device topology map is retrieved, and association mapping is performed based on the computer network device topology map to construct a network device dependency graph. The network device dependency graph is traversed according to the abnormal event sequence to trace the source and locate the fault source device identification set. Finally, the root cause of the fault is analyzed according to the fault source device identification set to determine the root cause data of the fault generation, and the root cause data of the fault generation is fed back to the network operation and maintenance unit for automated fault handling. This solves the technical problems of low efficiency and poor positioning accuracy of network equipment fault positioning in the existing technology, and achieves the technical effect of accurately and efficiently locating the fault source.

[0062] Embodiment 2 is based on the same inventive concept as the method for locating a computer network device fault in the above embodiment. Figure 2As shown, the present application provides a computer network device fault location system, wherein the system includes:

[0063] Data acquisition module 11: performs multi-source operation collection on computer network equipment to generate an equipment status data set; abnormality judgment module 12: sets a dynamic baseline for equipment operation, performs abnormality judgment according to the dynamic baseline based on the equipment status data set, performs monitoring and extraction based on the judgment results, and constructs an abnormal event sequence; positioning module 13: retrieves the computer network equipment topology map, performs association mapping based on the computer network equipment topology map, constructs a network equipment dependency map, traverses the network equipment dependency map according to the abnormal event sequence to trace the source and locate the fault source, and determines the fault source equipment identification set; analysis module 14: performs fault root cause analysis according to the fault source equipment identification set, determines the fault root cause data, and feeds the fault root cause data back to the network operation and maintenance unit for automated fault handling.

[0064] Furthermore, the abnormality determination module 12 is configured to execute the following method:

[0065] An equipment operation cycle is introduced, and historical equipment status data is extracted according to the equipment operation cycle; based on the historical equipment status data, the data is sliced ​​according to the operation time period to obtain multiple data slices; based on the multiple data slices, equipment operation is clustered to determine multiple operation mode data slices and multiple non-operation mode data slices; based on the multiple operation mode data slices, autoregression is performed to obtain an operation indicator baseline; based on the multiple non-operation mode data slices, autoregression is performed to obtain a non-operation indicator baseline; the operation indicator baseline is fitted with the non-operation indicator baseline to set the dynamic baseline of the equipment operation.

[0066] Furthermore, the abnormality determination module 12 is configured to execute the following method:

[0067] The device status data set is divided into a device dynamic data set and a device static data set; the deviation of the device dynamic data set is calculated according to the operation indicator baseline to obtain the device operation offset value; the device dynamic data set is judged to be abnormal according to the device operation offset value to determine the device dynamic abnormal data point; the deviation of the device static data set is calculated according to the non-operation indicator baseline to obtain the device non-operation offset value; the device static data set is judged to be abnormal according to the device non-operation offset value to determine the device static abnormal data point; the device dynamic abnormal data point and the device static abnormal data point are spatiotemporally clustered using a continuous time window to construct the abnormal event sequence.

[0068] Furthermore, the positioning module 13 is configured to perform the following method:

[0069] Based on the computer network device topology diagram, the computer network device is configured and parsed to obtain the physical connection relationship of the device; based on the computer network device topology diagram, the computer network device is traffic parsed to obtain the device logical path information; the physical connection relationship of the device and the device logical path information are bi-dimensionally correlated and mapped to determine multiple dependency weights, and the network device dependency relationship map is constructed based on the multiple dependency weights.

[0070] Furthermore, the positioning module 13 is configured to perform the following method:

[0071] Based on the abnormal event sequence, the network device dependency graph is traversed for matching to determine multiple graph nodes; the abnormal event sequence is mapped to the multiple graph nodes to determine multiple abnormal nodes; the network device dependency graph is reversely traversed according to the multiple abnormal nodes to determine multiple fault nodes, and backtracking positioning is performed based on the multiple fault nodes to determine the fault source device identifier.

[0072] Furthermore, the positioning module 13 is configured to perform the following method:

[0073] Based on the multiple abnormal nodes, multiple dependency edges in the network device dependency graph are traversed in reverse to determine the upstream node set; based on the upstream node set, a fault propagation analysis is performed to determine multiple fault propagation probabilities, and the multiple fault propagation probabilities correspond to the upstream node set; a fault propagation critical threshold is set to determine whether the multiple fault propagation probabilities exceed the fault propagation critical threshold; according to the fault propagation probabilities that exceed the fault propagation critical threshold among the multiple fault propagation probabilities, multiple fault nodes are determined; based on the multiple fault nodes, a starting node is determined by backtracing and added as a label to the computer network device to construct the fault source device identification set.

[0074] Furthermore, the analysis module 14 is configured to perform the following method:

[0075] Perform three-source verification based on the fault source device identification set to obtain fault root cause data; synchronously feed back the fault root cause data to the network operation and maintenance unit for data correlation analysis to generate a fault handling strategy, wherein the fault handling strategy includes a fault risk level; execute the fault handling strategy based on the fault risk level to perform an operation and maintenance evaluation and generate an operation and maintenance effect; update the fault handling strategy according to the operation and maintenance effect, and feed back the update result to the network operation and maintenance unit.

[0076] Furthermore, the analysis module 14 is configured to perform the following method:

[0077] Based on the fault source device identification set, the configuration of the computer network device is verified to determine the device configuration difference set; based on the fault source device identification set, the log of the computer network device is scanned to determine the fault mode set; based on the fault source device identification set, the traffic forensics of the computer network device is collected to determine the traffic anomaly indicator set; the device configuration difference set, the fault mode set, and the traffic anomaly indicator set are integrated to generate triple root cause data, and the triple root cause data is added to the fault generation root cause data.

[0078] Example 3. Based on the same inventive concept as the computer network device fault locating method described in the previous embodiment, this embodiment provides a computer-readable storage medium that can be used to store software programs, computer executable programs, and modules, such as the program instructions / modules corresponding to the computer network device fault locating method described in the present embodiment. The processor executes the software programs, instructions, and modules stored in the memory to execute various functional applications and data processing of the computer device, thereby implementing the aforementioned computer network device fault locating method.

[0079] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0080] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0081] This specification and drawings are merely illustrative of the present application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of this application. Thus, this application is intended to include such modifications and variations as fall within the scope of this application and its equivalents.

Claims

1. A computer network equipment fault location method, characterized in that: The method comprises: Conduct multi-source operation collection of computer network equipment to generate equipment status data sets; Set a dynamic baseline for equipment operation, perform abnormality determination based on the dynamic baseline according to the equipment status data set, perform monitoring and extraction based on the determination results, and construct an abnormal event sequence; Retrieving a computer network device topology map, performing association mapping based on the computer network device topology map, constructing a network device dependency graph, traversing the network device dependency graph according to the abnormal event sequence to perform source tracing and positioning, and determining a fault source device identifier set; Perform a root cause analysis of the fault according to the fault source device identification set, determine the fault root cause data, and feed the fault root cause data back to the network operation and maintenance unit to execute automated fault handling.

2. A computer network device fault location method according to claim 1, characterized in that: The process of setting a dynamic baseline for device operation includes: Introducing an equipment operation cycle and extracting historical equipment status data according to the equipment operation cycle; Slicing the historical device status data according to the operating time period to obtain multiple data slices; Performing device operation clustering based on the multiple data slices to determine multiple operation mode data slices and multiple non-operation mode data slices; Perform autoregression based on the multiple operating mode data slices to obtain an operating indicator baseline, and perform autoregression based on the multiple non-operating mode data slices to obtain a non-operating indicator baseline. The operating indicator baseline is fitted with the non-operating indicator baseline to set a dynamic baseline for the operation of the device.

3. A computer network device fault location method according to claim 2, characterized in that: Anomaly determination is performed according to the dynamic baseline based on the device status data set, monitoring and extraction are performed based on the determination result, and an abnormal event sequence is constructed, the method comprising: Dividing the device status data set into a device dynamic data set and a device static data set; Calculating the deviation of the equipment dynamic data set according to the operation indicator baseline to obtain an equipment operation offset value; Performing anomaly determination on the device dynamic data set according to the device operation offset value to determine an abnormal data point of the device dynamics; According to the non-operation indicator baseline, the device static data set is subjected to deviation calculation to obtain the device non-operation offset value; Performing an abnormality determination on the static data set of the device according to the non-operation offset value of the device to determine an abnormal static data point of the device; A continuous time window is used to perform spatiotemporal clustering on the dynamic abnormal data points of the device and the static abnormal data points of the device to construct the abnormal event sequence.

4. A computer network equipment fault location method according to claim 1, characterized in that: Performing association mapping based on the computer network device topology diagram to construct a network device dependency graph, the method includes: Performing configuration analysis on the computer network devices based on the computer network device topology diagram to obtain physical connection relationships of the devices; Performing traffic analysis on computer network devices based on the computer network device topology diagram to obtain device logical path information; The physical connection relationship of the device and the logical path information of the device are bi-dimensionally associated and mapped to determine a plurality of dependency weights, and the network device dependency graph is constructed based on the plurality of dependency weights.

5. A computer network equipment fault location method according to claim 1, characterized in that: Traversing the network device dependency graph according to the abnormal event sequence to trace the source and locate the fault source device identifier set, the method includes: Traversing the network device dependency graph based on the abnormal event sequence to perform matching and determine a plurality of graph nodes; Mapping the abnormal event sequence to the multiple graph nodes to determine multiple abnormal nodes; The network device dependency graph is reversely traversed according to the multiple abnormal nodes to determine multiple fault nodes, and backtracking positioning is performed based on the multiple fault nodes to determine the fault source device identifier.

6. A computer network equipment fault location method according to claim 5, characterized in that: The method includes: traversing the network device dependency graph in reverse according to the multiple abnormal nodes to determine multiple fault nodes; performing backtracking positioning based on the multiple fault nodes to determine the fault source device identifier; Determine an upstream node set by reversely traversing multiple dependency edges in the network device dependency graph based on the multiple abnormal nodes; Performing fault propagation analysis based on the upstream node set to determine a plurality of fault propagation probabilities, wherein the plurality of fault propagation probabilities correspond to the upstream node set; Setting a critical fault propagation threshold, and determining whether the plurality of fault propagation probabilities exceeds the critical fault propagation threshold; Screening the multiple fault propagation probabilities according to the fault propagation probabilities exceeding the critical fault propagation threshold to determine multiple fault nodes; Based on the multiple fault nodes, a starting node is determined by backtracing and added as a label to the computer network device to construct the fault source device identification set.

7. A computer network equipment fault location method according to claim 1, characterized in that: Performing a fault root cause analysis based on the fault source device identifier set to determine fault root cause data, and feeding the fault root cause data back to a network operation and maintenance unit for automated fault handling, the method comprising: Perform three-source verification based on the fault source device identification set to obtain fault root cause data; Synchronously feeding back the fault root cause data to the network operation and maintenance unit for data correlation analysis to generate a fault handling strategy, wherein the fault handling strategy includes a fault risk level; Executing the fault handling strategy based on the fault risk level to perform operation and maintenance evaluation and generate an operation and maintenance effect; The fault handling strategy is updated according to the operation and maintenance effect, and the update result is fed back to the network operation and maintenance unit.

8. A computer network equipment fault location method according to claim 7, characterized in that: Performing three-source verification based on the fault source device identification set to obtain fault root cause data includes: Performing configuration verification on the computer network device based on the fault source device identification set to determine a device configuration difference set; Scanning the logs of the computer network device based on the fault source device identification set to determine the fault mode set; Performing traffic forensics on the computer network device based on the fault source device identification set to determine a traffic anomaly indicator set; The device configuration difference set, the fault mode set, and the traffic anomaly indicator set are integrated to generate triplet root cause data, and the triplet root cause data is added to the fault generation root cause data.

9. A computer network equipment fault location system, characterized in that: A system for implementing a computer network device fault locating method according to any one of claims 1 to 8, comprising: Data acquisition module: collects multi-source operation data of computer network equipment and generates equipment status data sets; Abnormality determination module: sets a dynamic baseline for equipment operation, performs abnormality determination based on the dynamic baseline according to the equipment status data set, performs monitoring and extraction based on the determination results, and constructs an abnormal event sequence; Positioning module: retrieves a computer network device topology map, performs association mapping based on the computer network device topology map, constructs a network device dependency graph, traverses the network device dependency graph according to the abnormal event sequence to perform source tracing and positioning, and determines the fault source device identification set; Analysis module: performs fault root cause analysis according to the fault source device identification set, determines fault root cause data, and feeds the fault root cause data back to the network operation and maintenance unit for automatic fault handling.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a computer network device fault locating method according to any one of claims 1 to 8 is implemented.

Images