Root cause positioning method and system based on time sequence decomposition and multi-agent cooperation

Abstract

The invention relates to the technical field of intelligent operation and maintenance, in particular to a root cause positioning method and system based on time sequence decomposition and multi-agent cooperation. The method comprises the following steps: acquiring a time sequence data set of a target system, analyzing the time sequence data set of the target system, and determining a multi-dimensional independent component time sequence data set; based on a multi-agent collaborative parallel analysis strategy, performing multi-agent collaborative parallel anomaly analysis on the multi-dimensional independent component time sequence data set, and determining an anomaly index positioning information set; and according to a root cause fusion analysis strategy, performing fusion decision analysis on the abnormal index positioning information set, and determining and outputting a root cause analysis report. Through multi-dimensional component time sequence decomposition of the time sequence data of the target system and in combination with fusion decision analysis of the abnormal index positioning information set, the fault root cause is quickly positioned under the condition that the multi-dimensional time sequence variables are mutually coupled, and the fault positioning accuracy and the operation and maintenance decision efficiency of the complex system are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent operation and maintenance technology, and in particular to a root cause location method and system based on time series decomposition and multi-agent collaboration. Background Art

[0002] In modern information systems, as system complexity and scale continue to increase, fault root cause location has become a key issue in ensuring the stable operation of the system. Quickly and accurately locating the root cause of system faults can significantly improve the speed of fault resolution, thereby reducing downtime and economic losses to the enterprise, and ensuring system reliability and response efficiency.

[0003] However, existing root cause location methods are usually based on statistical or machine learning methods, which perform a holistic analysis of system time series variables. Although this method can capture the overall trend of system abnormal behavior, it is difficult to quickly locate the root cause of the fault when multi-dimensional time series variables are coupled with each other. This leads to long troubleshooting time and significant system delays in the operation and maintenance process, causing economic losses to the enterprise and poor user experience. Summary of the Invention

[0004] The present application provides a root cause location method and system based on time series decomposition and multi-agent collaboration to solve the above technical problems.

[0005] In a first aspect, the present application provides a root cause location method based on time series decomposition and multi-agent collaboration, the method comprising: Acquire the target system time series data set, analyze the target system time series data set, and determine the multidimensional independent component time series data set; based on the multi-agent collaborative parallel analysis strategy, perform multi-agent collaborative parallel anomaly analysis on the multi-dimensional independent component time series data set to determine the anomaly indicator location information set; according to the root cause fusion analysis strategy, perform fusion decision analysis on the anomaly indicator location information set to determine and output the root cause analysis report.

[0006] Optionally, analyzing the target system time series data set to determine a multi-dimensional independent component time series data set includes: According to the target system time series data set, each target system time series data set in the target system time series data set is supplemented with missing values ​​and aligned with time series to determine a preprocessed time series data set; based on a preset sliding time window span and a preset periodic time window span, the preprocessed time series data set is analyzed, and each preprocessed time series data in the preprocessed time series data set is subjected to time series decomposition processing to determine the corresponding trend component, periodic component and burst component of each preprocessed time series data at different time points; according to the corresponding trend component of each preprocessed time series data at different time points, a trend component data sequence is constructed; according to the corresponding periodic component of each preprocessed time series data at different time points, a periodic component data sequence is constructed; according to the corresponding burst component of each preprocessed time series data at different time points, a burst component data sequence is constructed; according to the corresponding burst component of each preprocessed time series data at different time points, a multi-dimensional independent component time series data set is constructed based on the trend component data sequence, the periodic component data sequence and the burst component data sequence.

[0007] Optionally, based on the preset sliding time window span and the preset periodic time window span, the preprocessed time series data set is analyzed, time series decomposition processing is performed on each preprocessed time series data in the preprocessed time series data set, and the corresponding trend component, periodic component and burst component of each preprocessed time series data at different time points are determined, specifically as follows: ; in, The current time point The trend component under is the preset sliding time window span, The preprocessed time series data at the time point The data value at For time point The periodic component under is the preset period time window span, is the preprocessed time series data, The timestamp corresponding to the current cycle time point, For time point The burst component below.

[0008] Optionally, the multi-agent collaborative parallel analysis strategy is based on which a multi-agent collaborative parallel anomaly analysis is performed on the multi-dimensional independent component time series data set to determine an anomaly indicator location information set, including: The multi-agent includes a performance monitoring agent, an indicator tracking agent, and a question-answering agent; based on the performance monitoring agent, the trend component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the trend change mapping index corresponding to each trend component data; based on the positive and negative properties of the numerical values ​​of each trend change mapping index, it is judged whether the operation and maintenance indicators corresponding to different trend component data have trend-type faults, and if so, the corresponding trend-type abnormal operation and maintenance indicators are extracted; based on the indicator tracking agent, the periodic component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the periodic component amplitude corresponding to each periodic component data; The amplitude of each of the periodic components is compared with the preset periodic amplitude threshold value to determine whether the operation and maintenance indicators corresponding to different periodic component data have periodic faults. If so, the corresponding periodic abnormal operation and maintenance indicators are extracted; based on the question-answering intelligent agent, the burst component data sequence in the multi-dimensional independent component time series data set is analyzed, and according to the sudden fault judgment condition, it is determined whether the operation and maintenance indicators corresponding to different burst component data have sudden faults. If so, the corresponding sudden abnormal operation and maintenance indicators are extracted; based on the trend-type abnormal operation and maintenance indicators, the periodic abnormal operation and maintenance indicators and the sudden abnormal operation and maintenance indicators, the abnormal indicator positioning information set is constructed.

[0009] Optionally, the performance monitoring agent is based on analyzing the trend component data sequence in the multi-dimensional independent component time series data set to determine the trend change mapping index corresponding to each trend component data, specifically the following formula: ; in, is the trend change mapping index, is the total number of time points corresponding to the current trend component data in the trend component data sequence, is the time point index, For time point The trend component below.

[0010] Optionally, the indicator-based tracking agent analyzes the periodic component data sequence in the multi-dimensional independent component time series data set to determine the periodic component amplitude corresponding to each periodic component data, specifically according to the following formula: ; in, The current period component data sequence is in the The amplitude of the periodic component in the periodic time window is The current period component data sequence is in the Sub-data sequence under the period time window, is the preset period time window span, is the total number of cycle time windows.

[0011] Optionally, the sudden fault judgment condition is specifically the following formula:

[0012] in, For time point The burst component under For time point The burst component under is the standard deviation of the variation between the burst components in the current burst component data sequence, is the average value of the burst component in the current burst component data sequence, is the standard deviation of the burst component in the current burst component data sequence.

[0013] Optionally, performing fusion decision analysis on the abnormal indicator location information set according to the root cause fusion analysis strategy to determine and output a root cause analysis report includes: Acquire a real-time operation and maintenance optimization target, and based on the real-time operation and maintenance optimization target, determine a root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set according to the abnormal indicator location information set; analyze the root cause assessment coefficient corresponding to each abnormal indicator, perform a significant difference assessment on each root cause assessment coefficient, and determine a number of root cause abnormal operation and maintenance indicators; and construct and output the root cause analysis report based on the several root cause abnormal operation and maintenance indicators.

[0014] Optionally, based on the real-time operation and maintenance optimization goal and according to the abnormal indicator location information set, a root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set is determined, specifically as follows: ; in, For the real-time operation and maintenance optimization goal, Position the first Abnormal indicators, Locating information set for the abnormal indicator, To remove the data subset corresponding to the abnormal indicator from the abnormal indicator location information set, is the root cause assessment coefficient corresponding to the current abnormal indicator, For the current operation and maintenance optimization goals and The conditional covariance between the anomaly indicators, is the variance corresponding to the current operation and maintenance optimization target, is the variance corresponding to the current abnormal indicator.

[0015] In a second aspect, the present application provides a root cause location system based on time series decomposition and multi-agent collaboration, the system comprising: The time series decomposition module is used to obtain the target system time series data set, analyze the target system time series data set, and determine the multi-dimensional independent component time series data set; the parallel analysis module is used to perform multi-agent collaborative parallel anomaly analysis on the multi-dimensional independent component time series data set based on the multi-agent collaborative parallel analysis strategy, and determine the anomaly indicator location information set; the fusion decision module is used to perform fusion decision analysis on the anomaly indicator location information set according to the root cause fusion analysis strategy, and determine and output the root cause analysis report.

[0016] Optionally, the time series decomposition module is specifically used to: perform missing value supplementation and time series alignment processing on each target system time series data set in the target system time series data set according to the target system time series data set, and determine a preprocessed time series data set; based on a preset sliding time window span and a preset periodic time window span, analyze the preprocessed time series data set, perform time series decomposition processing on each preprocessed time series data in the preprocessed time series data set, and determine the corresponding trend component, periodic component and burst component of each preprocessed time series data at different time points; construct a trend component data sequence according to the corresponding trend component of each preprocessed time series data at different time points; construct a periodic component data sequence according to the corresponding periodic component of each preprocessed time series data at different time points; construct a burst component data sequence according to the corresponding burst component of each preprocessed time series data at different time points; construct a multi-dimensional independent component time series data set according to the trend component data sequence, the periodic component data sequence and the burst component data sequence.

[0017] Optionally, the time series decomposition module analyzes the preprocessed time series data set based on the preset sliding time window span and the preset periodic time window span, performs time series decomposition processing on each preprocessed time series data in the preprocessed time series data set, and determines the corresponding trend component, periodic component, and burst component of each preprocessed time series data at different time points. Specifically, the formula is as follows: ; in, The current time point The trend component under is the preset sliding time window span, The preprocessed time series data at the time point The data value at For time point The periodic component under is the preset period time window span, is the preprocessed time series data, The timestamp corresponding to the current cycle time point, For time point The burst component below.

[0018] Optionally, the parallel analysis module is specifically used to: The multi-agent includes a performance monitoring agent, an indicator tracking agent, and a question-answering agent; based on the performance monitoring agent, the trend component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the trend change mapping index corresponding to each trend component data; based on the positive and negative properties of the numerical values ​​of each trend change mapping index, it is judged whether the operation and maintenance indicators corresponding to different trend component data have trend-type faults, and if so, the corresponding trend-type abnormal operation and maintenance indicators are extracted; based on the indicator tracking agent, the periodic component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the periodic component amplitude corresponding to each periodic component data; The amplitude of each of the periodic components is compared with the preset periodic amplitude threshold value to determine whether the operation and maintenance indicators corresponding to different periodic component data have periodic faults. If so, the corresponding periodic abnormal operation and maintenance indicators are extracted; based on the question-answering intelligent agent, the burst component data sequence in the multi-dimensional independent component time series data set is analyzed, and according to the sudden fault judgment condition, it is determined whether the operation and maintenance indicators corresponding to different burst component data have sudden faults. If so, the corresponding sudden abnormal operation and maintenance indicators are extracted; based on the trend-type abnormal operation and maintenance indicators, the periodic abnormal operation and maintenance indicators and the sudden abnormal operation and maintenance indicators, the abnormal indicator positioning information set is constructed.

[0019] Optionally, when the parallel analysis module analyzes the trend component data sequence in the multi-dimensional independent component time series data set based on the performance monitoring agent and determines the trend change mapping index corresponding to each trend component data, the specific formula is as follows: ; in, is the trend change mapping index, is the total number of time points corresponding to the current trend component data in the trend component data sequence, is the time point index, For time point The trend component below.

[0020] Optionally, when the parallel analysis module analyzes the periodic component data sequence in the multi-dimensional independent component time series data set based on the indicator tracking agent and determines the periodic component amplitude corresponding to each periodic component data, the specific formula is as follows: ; in, The current period component data sequence is in the The amplitude of the periodic component in the periodic time window is The current period component data sequence is in the Sub-data sequence under the period time window, is the preset period time window span, is the total number of cycle time windows.

[0021] Optionally, the sudden fault judgment condition in the parallel analysis module is specifically the following formula:

[0022] in, For time point The burst component under For time point The burst component under is the standard deviation of the variation between the burst components in the current burst component data sequence, is the average value of the burst component in the current burst component data sequence, is the standard deviation of the burst component in the current burst component data sequence.

[0023] Optionally, the fusion decision module is specifically used to: obtain a real-time operation and maintenance optimization target, and based on the real-time operation and maintenance optimization target, determine the root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set according to the abnormal indicator location information set; analyze the root cause assessment coefficient corresponding to each abnormal indicator, perform a significant difference assessment on each root cause assessment coefficient, and determine several root cause abnormal operation and maintenance indicators; and construct and output the root cause analysis report based on the several root cause abnormal operation and maintenance indicators.

[0024] Optionally, the fusion decision module determines, based on the real-time operation and maintenance optimization goal and according to the abnormal indicator location information set, a root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set, specifically the following formula: ; in, For the real-time operation and maintenance optimization goal, Position the first Abnormal indicators, Locating information set for the abnormal indicator, To remove the data subset corresponding to the abnormal indicator from the abnormal indicator location information set, is the root cause assessment coefficient corresponding to the current abnormal indicator, For the current operation and maintenance optimization goals and The conditional covariance between the anomaly indicators, is the variance corresponding to the current operation and maintenance optimization target, is the variance corresponding to the current abnormal indicator.

[0025] The above technical solution adopted in this application has the following beneficial effects: Through this solution, the target system time series data is decomposed into multi-dimensional components, effectively removing noise interference and extracting meaningful feature components, constructing a multi-dimensional independent component time series data set. On this basis, through a multi-agent collaborative and parallel analysis method, the abnormal operation and maintenance indicators mapping different types of system failures are located and analyzed, and an abnormal indicator location information set is obtained. Then, based on the root cause fusion analysis strategy, the root cause of the system failure is located through fusion decision analysis of the abnormal indicator location information set, and the corresponding root cause analysis report is provided to the operation and maintenance team. It is possible to quickly locate the root cause of the fault when the multi-dimensional time series variables are coupled with each other, significantly improving the accuracy of complex system fault location and the efficiency of operation and maintenance decision-making, thereby reducing the economic losses of the enterprise and improving the user experience. The target system time series dataset is preprocessed to obtain a preprocessed time series dataset. Based on this, the preset sliding time window span and the preset periodic time window span are combined to analyze the trend component, periodic component, and burst component of each preprocessed time series data at different time points. The trend component data sequence, periodic component data sequence, and burst component data sequence are constructed, and then a multi-dimensional independent component time series dataset is constructed. Through the three-stage processing flow of "data preprocessing-feature decoupling-component reconstruction", the original complex target system time series dataset is decomposed into independent component sequences in three orthogonal feature spaces, providing structured input data for subsequent multi-agent parallel analysis, effectively improving the accuracy and interpretability of root cause location. Using mathematical analysis methods, based on the preset sliding time window span and the preset periodic time window span, the pre-processed time series data set is analyzed. The characteristics of the pre-processed time series data set are decoupled through a double sliding window mechanism, and the trend component, periodic component and burst component are quantified respectively, thereby improving the scientificity and accuracy of the component characteristics. By utilizing the division of labor and collaboration among multiple intelligent agents, corresponding special anomaly analyses are performed on trend components, periodic components, and sudden components, and the operation and maintenance indicators corresponding to different types of anomalies are used as corresponding trend-type anomaly operation and maintenance indicators, periodic-type anomaly operation and maintenance indicators, and sudden-type anomaly operation and maintenance indicators, respectively, to construct an anomaly indicator positioning information set. While decoupling the data features, the analysis process is also decoupled to prevent cross-interference between different types of feature components during the analysis process, which may mask some anomalies and improve the accuracy and comprehensiveness of the abnormal operation and maintenance indicator analysis process. Using mathematical analysis methods, we analyze the trend component data sequences in the multi-dimensional independent component time series data set and quantify the trend change mapping index that reflects the trend of operation and maintenance indicators. This allows us to accurately capture the changing trends of different operation and maintenance indicators and improve the accuracy and scientificity of trend-type anomaly analysis. Using mathematical analysis methods, we analyze the periodic component data sequences in the multi-dimensional independent component time series data set, quantify the maximum fluctuation of the periodic component data in different periodic time windows, and use it as the periodic component amplitude corresponding to the periodic component data, providing a reliable data standard for the evaluation of periodic anomalies. Based on the instantaneous fluctuation characteristics and numerical deviation characteristics of sudden anomalies, mathematical conditions for judging whether there are sudden anomalies are established to determine the conditions for sudden fault judgment and improve the comprehensiveness and accuracy of the sudden anomaly analysis process. Based on the real-time operation and maintenance optimization goals and the abnormal indicator location information set, the multi-dimensional independent component time series data set is analyzed to quantify the root cause evaluation coefficient that reflects the degree of causal relationship between each abnormal indicator and the real-time operation and maintenance optimization goal. On this basis, by evaluating the significant differences of each root cause evaluation coefficient, several root cause abnormal operation and maintenance indicators that cause the current system abnormality are determined. Based on this, a root cause analysis report is constructed and output. Through a unified decision convergence method, under the clear real-time operation and maintenance optimization goal, the corresponding abnormal indicators under different component characteristics are integrated for root cause analysis to improve the comprehensiveness and accuracy of the root cause abnormal operation and maintenance indicator analysis process. Using mathematical analysis methods, based on the real-time operation and maintenance optimization goal and according to the abnormal indicator positioning information set, the independent contribution of each abnormal indicator to the real-time operation and maintenance optimization goal is measured to quantify the root cause assessment coefficient corresponding to the abnormal indicator. The root cause assessment coefficient can accurately reflect the degree of causal relationship between the abnormal indicator and the real-time operation and maintenance optimization goal, thereby improving the accuracy and scientificity of root cause positioning. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0027] Figure 1 A schematic diagram of an application scenario provided in one embodiment of the present application; Figure 2 A flowchart of a root cause location method based on time series decomposition and multi-agent collaboration provided in one embodiment of the present application; Figure 3 A schematic structural diagram of a root cause location system based on time series decomposition and multi-agent collaboration provided in one embodiment of the present application. DETAILED DESCRIPTION

[0028] To make the purpose, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0029] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document, unless otherwise specified, generally indicates an "or" relationship between the related objects.

[0030] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0031] Existing root cause location methods are usually based on statistical or machine learning methods to conduct a holistic analysis of system time series variables. Although this method can capture the overall trend of system abnormal behavior, it is difficult to quickly locate the root cause of the fault when multi-dimensional time series variables are coupled with each other. This leads to long troubleshooting time and significant system delays in the operation and maintenance process, causing economic losses to the enterprise and poor user experience.

[0032] Based on this, the present application provides a root cause location method and system based on time series decomposition and multi-agent collaboration. The target system time series data is decomposed into multi-dimensional component time series, noise interference is effectively removed and feature components with clear meaning are extracted to construct a multi-dimensional independent component time series data set. On this basis, through the collaborative and parallel analysis method of multiple agents, the abnormal operation and maintenance indicators that map different types of system failures are located and analyzed, and an abnormal indicator location information set is obtained. Then, based on the root cause fusion analysis strategy, the root cause of the system failure is located through the fusion decision analysis of the abnormal indicator location information set, and the corresponding root cause analysis report is provided to the operation and maintenance team, so as to realize the rapid location of the root cause of the failure when the multi-dimensional time series variables are coupled with each other, significantly improving the accuracy of complex system fault location and the efficiency of operation and maintenance decision-making, so as to reduce the economic losses of the enterprise and improve the user experience.

[0033] Figure 1 This is a schematic diagram of an application scenario provided by this application. In the automated operation and maintenance process, the method provided by this application can be applied to quickly locate the root cause of a fault when multi-dimensional time series variables are coupled with each other, significantly improving the accuracy of fault location and the efficiency of operation and maintenance decision-making in complex systems.

[0034] Specifically, the method of the present application is applied to any server, which communicates with the log recording component, obtains and analyzes the target system time series data set provided by the log recording component through the server, performs multi-dimensional component time series decomposition on the target system time series data, effectively removes noise interference and extracts meaningful feature components, and constructs a multi-dimensional independent component time series data set. On this basis, through the collaborative and parallel analysis method of multiple agents, the abnormal operation and maintenance indicators mapping different types of system failures are located and analyzed, and an abnormal indicator location information set is obtained. Then, based on the root cause fusion analysis strategy, the root cause of the system failure is located through the fusion decision analysis of the abnormal indicator location information set, and the corresponding root cause analysis report is provided to the operation and maintenance team, so as to realize the rapid location of the root cause of the failure when the multi-dimensional time series variables are coupled with each other, significantly improving the accuracy of complex system fault location and the efficiency of operation and maintenance decision-making, so as to reduce the economic losses of the enterprise and improve the user experience. The specific implementation method can refer to the following embodiments.

[0035] Figure 2 This is a flowchart of a root cause location method based on time series decomposition and multi-agent collaboration provided in one embodiment of the present application. The method of this embodiment can be applied to the server in the above scenario. Figure 2 As shown, the method includes: S201 , obtaining a target system time series data set, analyzing the target system time series data set, and determining a multi-dimensional independent component time series data set.

[0036] The target system time series data set can be a set of time series data generated when the target operation and maintenance system is running, such as time series data of indicators such as CPU usage, memory usage, network latency, and device temperature. The target system time series data set can be obtained by the system's built-in logging component.

[0037] The multidimensional independent component time series data set may be a collection of several independent component data sequences obtained by performing time series decomposition on the target system time series data set, such as trend components, periodic components, burst components, and the like.

[0038] Specifically, in complex system operation and maintenance scenarios, the difficulty in root cause location lies in the fact that system failures are often caused by the anomalies of multiple interrelated indicators, and traditional single-dimensional analysis methods are difficult to effectively distinguish potential failure modes. Existing technologies usually directly perform correlation analysis on the original time series data, but do not consider the independent characteristics of different components (trends, cycles, bursts), resulting in the analysis results being seriously interfered by noise. Different component characteristics can map different potential problems in the system. For example, the development trend characteristics of operation and maintenance indicators reflected by the trend component can map persistent system vulnerabilities such as memory leaks. This solution uses mathematical analysis methods to target different component characteristics and perform time series decomposition of different component types on the target system time series data set to determine a multi-dimensional independent component time series data set that reflects the change characteristics of operation and maintenance indicators from different component directions. The above time series decomposition operation can divide the mixed features in the original time series data into meaningful dimensions, providing a structured data foundation for subsequent multi-dimensional root cause analysis.

[0039] S202. Based on the multi-agent collaborative parallel analysis strategy, perform multi-agent collaborative parallel anomaly analysis on the multi-dimensional independent component time series data set to determine the anomaly indicator location information set.

[0040] The multi-agent collaborative parallel analysis strategy can be a distributed analysis architecture that includes different agents, such as performance monitoring agents, indicator tracking agents, and question-answering agents.

[0041] Multi-agent collaborative parallel anomaly analysis can be an analysis process in which different agents analyze the time series data they are responsible for in parallel to determine the anomaly indicators in the time series data.

[0042] The abnormal indicator location information set may be an information set containing all abnormal operation and maintenance indicators in the current system.

[0043] Specifically, the traditional operation and maintenance anomaly analysis method uses a single algorithm model to analyze the entire data, which has the defects of low computational efficiency and incomplete feature capture. This solution adopts an anomaly analysis strategy of collaborative parallel operation of different intelligent agents. Through targeted parallel analysis of different intelligent agents, different types of anomalies in the system are captured. For example, the sudden component characteristics in the multi-dimensional independent component time series data set are analyzed by question-and-answer intelligent agents, and operation and maintenance indicators that map the sudden anomalies of the system are extracted to capture the sudden anomalies in the system. Different types of intelligent agents are used to process the anomaly capture tasks in parallel in a distributed computing framework, and the abnormal operation and maintenance indicators obtained by each analysis are integrated to obtain an abnormal indicator positioning information set. While ensuring the accuracy of anomaly analysis, the efficiency of anomaly analysis is significantly improved.

[0044] S203: According to the root cause fusion analysis strategy, perform fusion decision analysis on the abnormal indicator location information set, determine and output a root cause analysis report.

[0045] The fusion decision analysis strategy can be an analytical method used to uniformly quantify the strength of the causal relationship between different abnormal indicators and system failures.

[0046] The root cause analysis report may be a visual report containing root cause indicators corresponding to the current system failure and corresponding repair suggestions.

[0047] Specifically, after determining the abnormal indicator location information set, the causal relationship between each abnormal indicator is quantitatively analyzed through mathematical analysis to determine several root cause indicators that cause the current system failure. Then, through a large language model or operation and maintenance knowledge graph, operation and maintenance suggestions for solving the current system failure based on several root cause indicators are obtained. Through data visualization technology, several root cause indicators and corresponding operation and maintenance suggestions are visualized to construct a root cause analysis report, and the root cause analysis report is provided to the operation and maintenance team to support the operation and maintenance personnel to quickly locate the core failure points and formulate repair strategies.

[0048] Through this solution, the target system time series data is decomposed into multi-dimensional component time series, effectively removing noise interference and extracting meaningful characteristic components to construct a multi-dimensional independent component time series data set. On this basis, through the collaborative and parallel analysis method of multiple agents, the abnormal operation and maintenance indicators mapping different types of system failures are located and analyzed, and the abnormal indicator location information set is obtained. Then, based on the root cause fusion analysis strategy, the root cause of the system failure is located through the fusion decision analysis of the abnormal indicator location information set, and the corresponding root cause analysis report is provided to the operation and maintenance team, so as to achieve rapid location of the root cause of the failure when the multi-dimensional time series variables are coupled with each other, significantly improving the accuracy of complex system fault location and the efficiency of operation and maintenance decision-making, thereby reducing the economic losses of the enterprise and improving the user experience.

[0049] In some embodiments, based on the target system time series data set, missing value supplementation processing and time series alignment processing are performed on each target system time series data set in the target system time series data set to determine a preprocessed time series data set; based on the preset sliding time window span and the preset periodic time window span, the preprocessed time series data set is analyzed, and time series decomposition processing is performed on each preprocessed time series data in the preprocessed time series data set to determine the corresponding trend component, periodic component and burst component of each preprocessed time series data at different time points; based on the corresponding trend component of each preprocessed time series data at different time points, a trend component data sequence is constructed; based on the corresponding periodic component of each preprocessed time series data at different time points, a periodic component data sequence is constructed; based on the corresponding burst component of each preprocessed time series data at different time points, a burst component data sequence is constructed; based on the corresponding burst component of each preprocessed time series data at different time points, a multi-dimensional independent component time series data set is constructed based on the trend component data sequence, the periodic component data sequence and the burst component data sequence.

[0050] Missing value supplementation processing can be a process of interpolating and supplementing missing values ​​in a target system time series dataset.

[0051] The timing alignment process may be a process of performing timing alignment on multi-source data in a target system timing data set.

[0052] The preprocessed time series dataset may be a standardized dataset obtained through data cleaning and time series normalization.

[0053] The preset sliding time window span may be a time span parameter used to extract data trend features, and may be determined by statistical values ​​of trend change cycles in historical data.

[0054] The preset periodic time window span may be a reference period parameter for identifying periodic characteristics of data, and may be obtained by analyzing data spectrum characteristics through Fourier transform.

[0055] The trend component can be a characteristic component that reflects the long-term change direction of the data.

[0056] The periodic component can be a characteristic component that reflects the periodic fluctuation pattern of data.

[0057] The burst component may be a characteristic component that characterizes sudden abnormal fluctuations of data.

[0058] The trend component data series may be a data set containing trend components corresponding to different operation and maintenance indicators.

[0059] The periodic component data series may be a data set containing periodic components corresponding to different operation and maintenance indicators.

[0060] The burst component data sequence may be a data set containing burst components corresponding to different operation and maintenance indicators.

[0061] Specifically, in the distributed system operation and maintenance scenario, the original collected time series data usually has missing values ​​caused by failures of the collection equipment, as well as time series misalignment problems caused by inconsistent collection frequencies of multi-source data. Missing values ​​are supplemented through missing value interpolation algorithms, such as cubic spline interpolation, and time series alignment algorithms, such as dynamic time warping algorithms, are used to align the time series of multi-source data to generate a pre-processed time series data set with integrity and consistency. Furthermore, since different feature components in the time series characteristics of operation and maintenance data can map different types of anomalies in the system, the trend component mainly maps potential persistent anomalies in the system, such as memory leaks, the periodic component mainly maps potential periodic anomalies in the system, such as excessive periodic loads, and the burst component mainly maps the system's For sudden anomalies, considering that the trend, periodicity, and suddenness characteristics of system operation indicators are often coupled and superimposed, a dual sliding window mechanism is used to decouple component features. Through mathematical analysis, the data is processed by moving average using a preset sliding time window span to extract the trend component after eliminating short-term fluctuations. At the same time, the data is quantified by periodic residuals based on the preset periodic time window span to separate the periodic component, and then the suddenness component is obtained by quantizing the total residual. Through the three-stage processing flow of "data preprocessing-feature decoupling-component reconstruction", the original complex time series data is decomposed into independent component sequences in three orthogonal feature spaces, providing structured input data for subsequent multi-agent parallel analysis, effectively improving the accuracy and interpretability of root cause location.

[0062] Through this solution, the target system time series dataset is preprocessed to obtain a preprocessed time series dataset. On this basis, combined with the preset sliding time window span and the preset periodic time window span, the corresponding trend component, periodic component and burst component of each preprocessed time series data at different time points are analyzed respectively, and the trend component data sequence, periodic component data sequence and burst component data sequence are constructed, and then a multi-dimensional independent component time series dataset is constructed. Through the three-stage processing flow of "data preprocessing-feature decoupling-component reconstruction", the original complex target system time series dataset is decomposed into independent component sequences in three orthogonal feature spaces, providing structured input data for subsequent multi-agent parallel analysis, effectively improving the accuracy and interpretability of root cause location.

[0063] In some embodiments, based on the preset sliding time window span and the preset periodic time window span, the preprocessed time series data set is analyzed, and time series decomposition processing is performed on each preprocessed time series data set to determine the corresponding trend component, periodic component, and burst component of each preprocessed time series data at different time points, specifically the following formula (1): (1) in, The current time point The trend component below, is the preset sliding time window span, For the current preprocessed time series data at time point The data value at For time point The periodic component under is the preset period time window span, To preprocess time series data, The timestamp corresponding to the current cycle time point, For time point The burst component below.

[0064] Specifically, the trend component is a smooth trend that reflects the long-term development direction of the time series data. , use the sliding time window to smooth the data, calculate the trend value of each time point as the trend component; the periodic component is used to represent the repeated periodic fluctuation characteristics in the time series data, through ,use Extract the residuals, and solve the mean of the residual values ​​within the preset period time window to extract the data periodicity and quantify the periodic component; the burst component is the part of the time series that cannot be explained by the trend and cycle. Quantify the burst component.

[0065] Through this solution, mathematical analysis methods are used to analyze the preprocessed time series data set based on the preset sliding time window span and the preset periodic time window span. The characteristics of the preprocessed time series data set are decoupled through the double sliding window mechanism, and the trend component, periodic component and burst component are quantified respectively, thereby improving the scientificity and accuracy of the component characteristics.

[0066] In some embodiments, the multi-agent includes a performance monitoring agent, an indicator tracking agent, and a question-and-answer agent; based on the performance monitoring agent, the trend component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the trend change mapping index corresponding to each trend component data; based on the positive and negative properties of the numerical values ​​of each trend change mapping index, it is judged whether the operation and maintenance indicators corresponding to different trend component data have trend-type faults, and if so, the corresponding trend-type abnormal operation and maintenance indicators are extracted; based on the indicator tracking agent, the periodic component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the periodic component amplitude corresponding to each periodic component data; each periodic component amplitude is compared with a preset periodic amplitude threshold to determine whether the operation and maintenance indicators corresponding to different periodic component data have periodic faults, and if so, the corresponding periodic abnormal operation and maintenance indicators are extracted; based on the question-and-answer agent, the burst component data sequence in the multi-dimensional independent component time series data set is analyzed, and based on the burst fault judgment condition, it is judged whether the operation and maintenance indicators corresponding to different burst component data have burst faults, and if so, the corresponding burst-type abnormal operation and maintenance indicators are extracted; based on the trend-type abnormal operation and maintenance indicators, the periodic abnormal operation and maintenance indicators, and the burst-type abnormal operation and maintenance indicators, an abnormal indicator positioning information set is constructed.

[0067] A performance monitoring agent can be an agent module used to analyze trend component data series to detect trend-type anomalies. An indicator tracking agent can be an agent module used to analyze period component data series to detect periodic anomalies. A question-answering agent can be an agent module used to analyze sudden component data series to detect sudden failures. A trend change mapping index can be a quantitative value used to characterize the direction and intensity of trend changes in a trend component data series.

[0068] The positive or negative nature of the numerical value can be an indicator used to characterize whether the trend change mapping index is positive or negative. When the trend change mapping index is positive, it indicates that the corresponding operation and maintenance indicator is showing a continuous upward trend. When the trend change mapping index is negative, it indicates that the corresponding operation and maintenance indicator is showing a continuous downward trend.

[0069] The trend-type abnormal operation and maintenance indicator may be an operation and maintenance indicator that reflects the presence of trend-type abnormalities in the current system.

[0070] The periodic component amplitude can be a quantitative value that represents the intensity of fluctuations in the periodic component data sequence within a single period window. The preset periodic amplitude threshold can be a critical value used to determine whether the periodic fluctuations are abnormal, and can be obtained through historical periodic component data statistics.

[0071] The periodic abnormal operation and maintenance indicator may be an operation and maintenance indicator that reflects the existence of periodic abnormalities in the current system.

[0072] The sudden fault judgment condition may be a mathematical condition used to judge whether a sudden abnormality currently exists.

[0073] The sudden abnormal operation and maintenance indicator may be an operation and maintenance indicator that reflects the existence of sudden abnormalities in the current system.

[0074] Specifically, in the process of analyzing system anomalies, the trend component data sequence, periodic component data sequence and burst component data sequence in the multi-dimensional independent component time series data set are respectively handed over to the performance monitoring agent responsible for continuous indicator monitoring, the indicator tracking agent responsible for indicator feature tracking and the question-answering agent responsible for sudden anomaly assessment for abnormal indicator location analysis. While decoupling the data features, the analysis process is decoupled to prevent cross-interference between different types of feature components during the analysis process, which may mask some anomalies. For example, periodic fluctuations may mask trend degradation, resulting in the inability to accurately identify long-term degradation trends. The performance monitoring agent uses mathematical analysis methods to quantitatively analyze the trend component data sequence and determine the trend change mapping index. Then, according to the positive and negative properties of the trend change mapping index, when the current trend change mapping index is a positive number significantly higher than the mean or a negative number significantly lower than the mean, it represents the current operation and maintenance. If the indicator has a trend of long-term growth or long-term decline, it means that there is a trend-type anomaly at present, and the corresponding operation and maintenance indicator is used as a trend-type anomaly operation and maintenance indicator; the indicator tracking intelligent agent uses mathematical analysis methods to quantitatively analyze the periodic component data series, determine the periodic component amplitude, and compare each of the periodic component amplitudes with the preset periodic amplitude threshold. When there is a periodic component amplitude greater than the preset periodic amplitude threshold, and the abnormal amplitude continues to appear in different period windows, it means that the corresponding operation and maintenance indicator has periodic abnormal fluctuations, and the corresponding operation and maintenance indicator is used as a periodic abnormal operation and maintenance indicator; the sudden fault judgment condition constructed by the question-answering intelligent agent is used to compare and judge the sudden component data series, and the operation and maintenance indicator reflecting the existence of sudden anomaly is used as the sudden abnormal operation and maintenance indicator, and then the trend-type abnormal operation and maintenance indicator, the periodic abnormal operation and maintenance indicator and the sudden abnormal operation and maintenance indicator are integrated to obtain the abnormal indicator positioning information set.

[0075] Through this solution, multi-agent division of labor and collaboration are utilized to conduct corresponding special anomaly analysis for trend components, periodic components, and sudden components respectively. The operation and maintenance indicators corresponding to different types of anomalies are used as corresponding trend-type anomaly operation and maintenance indicators, periodic anomaly operation and maintenance indicators, and sudden anomaly operation and maintenance indicators, respectively, to construct an anomaly indicator positioning information set. While decoupling the data features, the analysis process is also decoupled to prevent cross-interference between different types of feature components during the analysis process, which may cause some anomalies to be masked, thereby improving the accuracy and comprehensiveness of the abnormal operation and maintenance indicator analysis process.

[0076] In some embodiments, based on the performance monitoring agent, the trend component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the trend change mapping index corresponding to each trend component data, specifically the following formula (2): (2) in, is the trend change mapping index, is the total number of time points corresponding to the current trend component data in the trend component data sequence, is the time point index, For time point The trend component below.

[0077] Specifically, through formula (2) Describe the deviation of each time point relative to the time mean to eliminate the overall translation effect in the time series data, so that the quantitative process of the trend change mapping index focuses on the trend change of the data without being affected by the time position information; Describe the deviation of each trend component relative to the mean of the overall trend component to eliminate the average value in the trend component series, so as to focus on the change pattern of the trend data itself; and then Reflects the linear relationship between time and trend component. If the value corresponding to this part is a positive number, then the time and trend component are positively correlated (i.e., as time increases, the trend component increases). If the value corresponding to this part is a negative number, then the time and trend component are negatively correlated (i.e., as time increases, the trend component decreases). Further, combined with , using the variance corresponding to the time point deviation, the influence of the time series scale is eliminated, so that the quantified trend change mapping index is presented as a dimensionless standardized trend change index.

[0078] Through this solution, mathematical analysis methods are used to analyze the trend component data sequence in the multi-dimensional independent component time series data set, and the trend change mapping index reflecting the changing trend of operation and maintenance indicators is quantified, so as to accurately capture the changing trends of different operation and maintenance indicators and improve the accuracy and scientificity of trend-type anomaly analysis.

[0079] In some embodiments, based on the indicator tracking agent, the periodic component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the periodic component amplitude corresponding to each periodic component data, specifically the following formula (3): (3) in, The component data sequence of the current cycle is in The amplitude of the periodic component in the periodic time window is The component data sequence of the current cycle is in Sub-data sequence under the period time window, is the preset period time window span, is the total number of cycle time windows.

[0080] Specifically, the periodic component data series is divided into Periodic data segments with the same time span, through The difference between the maximum and minimum values ​​of the periodic component data in each periodic time window is quantified to reflect the maximum fluctuation of the periodic component data in the current periodic time window. This is used as the corresponding periodic component amplitude, providing a reliable data standard for the evaluation of periodic anomalies.

[0081] Through this scheme, mathematical analysis methods are used to analyze the periodic component data sequence in the multidimensional independent component time series data set, and the maximum fluctuation of the periodic component data in different periodic time windows is quantified as the periodic component amplitude corresponding to the corresponding periodic component data, providing a reliable data standard for the evaluation of periodic anomalies.

[0082] In some embodiments, the sudden fault judgment condition is specifically the following formula (4): (4) in, For time point The burst component under For time point The burst component under is the standard deviation of the variation between the burst components in the current burst component data sequence, is the average value of the burst component in the current burst component data sequence, is the standard deviation of the burst component in the current burst component data sequence.

[0083] Specifically, during the system operation and maintenance process, the manifestation of sudden abnormalities in the operation and maintenance indicators has two main characteristics: one is the instantaneous and drastic fluctuation of the operation and maintenance indicators, and the operation and maintenance indicator values ​​​​mutate in a short period of time (such as instantaneous network interruption); the other is that the operation and maintenance indicator values ​​​​are out of the normal fluctuation range (such as high load caused by bad disk sectors); In order to capture the above two characteristics, two conditions need to be combined in the sudden fault judgment condition: one is that the change rate of the sudden component exceeds the normal fluctuation range, and the other is that the absolute value of the sudden component exceeds the global abnormal threshold; through formula (4) Capture the absolute change value of the sudden component at different time points (corresponding to the instantaneous fluctuation of the operation and maintenance indicators), and compare the absolute change value with the standard deviation of the change (indicating the average dispersion of normal changes). When the absolute change value exceeds 2 times the standard deviation of the change, it indicates that there is a significant mutation abnormality in the current value fluctuation; at the same time, due to the normal distribution of the time series of the sudden component, its mean Indicates the central tendency of the series, and its standard deviation Indicates the normal fluctuation range of the sequence. Based on the normal distribution principle, 99.7% of the data points will fall within When the burst component exceeds , indicating that the corresponding operation and maintenance indicator value is out of the normal fluctuation range.

[0084] Through this solution, starting from the instantaneous fluctuation characteristics and numerical deviation characteristics of sudden anomalies, mathematical conditions for judging whether there are sudden anomalies are present are constructed to determine the sudden fault judgment conditions and improve the comprehensiveness and accuracy of the sudden anomaly analysis process.

[0085] In some embodiments, a real-time operation and maintenance optimization target is obtained, and based on the real-time operation and maintenance optimization target and the multi-dimensional independent component time series data set, the root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set is determined according to the abnormal indicator location information set; the root cause assessment coefficient corresponding to each abnormal indicator is analyzed, and a significant difference assessment is performed on each root cause assessment coefficient to determine several root cause abnormal operation and maintenance indicators; based on the several root cause abnormal operation and maintenance indicators, a root cause analysis report is constructed and output.

[0086] The real-time operation and maintenance optimization target can be a quantitative indicator that needs to be prioritized during the current system operation and maintenance process. The real-time operation and maintenance optimization target is obtained through dynamic configuration of the operation and maintenance management platform.

[0087] The root cause evaluation coefficient may be a quantitative value used to measure the degree of influence of an abnormal indicator on an operation and maintenance optimization target. A larger root cause evaluation coefficient indicates a greater probability that the corresponding abnormal indicator is the root cause indicator.

[0088] The significant difference assessment may be an evaluation process for determining whether the root cause assessment coefficient significantly deviates from a normal range.

[0089] The root cause abnormal operation and maintenance indicator may be an indicator of the root cause causing the current system abnormality.

[0090] Specifically, in complex system operation and maintenance, the ultimate goal of root cause analysis must be aligned with real-time business needs. Based on the real-time operation and maintenance goals corresponding to the current system, mathematical analysis methods are used to jointly analyze the causal relationships between different abnormal indicators in the abnormal indicator location information set and the real-time operation and maintenance goals. Root cause assessment coefficients corresponding to each abnormal indicator, which represent the degree of causal association, are quantified. When at least one root cause assessment coefficient is significantly greater than the other root cause assessment coefficients, it indicates that the abnormal indicators corresponding to these root cause assessment coefficients have a significant causal relationship with the real-time operation and maintenance goals. These abnormal indicators are the root cause abnormal operation and maintenance indicators that caused the current abnormality. Based on these root cause abnormal operation and maintenance indicators, large language model analysis or operation and maintenance knowledge graph retrieval are used to analyze the actual operation and maintenance processes required to optimize each root cause abnormal operation and maintenance indicator. These operations and maintenance recommendations corresponding to the current root cause abnormal operation and maintenance indicators are then integrated and visualized using a data visualization tool set to generate a root cause analysis report. The root cause analysis report is then provided to the operation and maintenance team via human-computer interaction devices such as high-definition display screens.

[0091] Through this solution, based on the real-time operation and maintenance optimization goals and the abnormal indicator positioning information set, the multi-dimensional independent component time series data set is analyzed to quantify the root cause evaluation coefficient that reflects the degree of causal relationship between each abnormal indicator and the real-time operation and maintenance optimization goal. On this basis, by evaluating the significant differences of each root cause evaluation coefficient, several root cause abnormal operation and maintenance indicators that cause the current system abnormality are determined, and a root cause analysis report is constructed and output. Through a unified decision convergence method, under the clear real-time operation and maintenance optimization goal, the corresponding abnormal indicators under different component characteristics are integrated for root cause analysis to improve the comprehensiveness and accuracy of the root cause abnormal operation and maintenance indicator analysis process.

[0092] In some embodiments, based on the real-time operation and maintenance optimization goal and according to the abnormal indicator location information set, the root cause evaluation coefficient corresponding to each abnormal indicator in the abnormal indicator location information set is determined, specifically as follows: ; in, To optimize the goal of real-time operation and maintenance, Locate the first Abnormal indicators, Locate the information set for abnormal indicators, It is the data subset after removing the corresponding abnormal indicators from the abnormal indicator location information set. is the root cause evaluation coefficient corresponding to the current abnormal index, is the correlation between the current operation and maintenance optimization goal and the The conditional covariance between the anomaly indicators, is the variance corresponding to the current operation and maintenance optimization target, is the variance corresponding to the current abnormal indicator.

[0093] Specifically, through formula (5) , using conditional covariance to describe the linear correlation between the real-time operation and maintenance optimization target and the abnormal indicators after removing the corresponding abnormal indicators in the multidimensional independent component time series data set, and through Describes the comprehensive residual fluctuation of the real-time operation and maintenance optimization target and the abnormal indicator after the current abnormal indicator is removed from the abnormal indicator positioning information set, and then The conditional covariance is standardized, and the independent contribution of the current abnormal indicator to the real-time operation and maintenance optimization goal is measured with an absolute value to quantify the root cause assessment coefficient corresponding to the abnormal indicator.

[0094] Through this solution, mathematical analysis methods are used, based on the real-time operation and maintenance optimization goal and the abnormal indicator positioning information set, to measure the independent contribution of each abnormal indicator to the real-time operation and maintenance optimization goal, so as to quantify the root cause assessment coefficient corresponding to the abnormal indicator. The root cause assessment coefficient can accurately reflect the degree of causal relationship between the abnormal indicator and the real-time operation and maintenance optimization goal, thereby improving the accuracy and scientificity of root cause positioning.

[0095] Figure 3 This is a structural diagram of a root cause location system based on time series decomposition and multi-agent collaboration provided by an embodiment of the present application, as shown in FIG. Figure 3 As shown, a root cause location system 300 based on time series decomposition and multi-agent collaboration in this embodiment includes: a time series decomposition module 301 , a parallel analysis module 302 and a fusion decision module 303 .

[0096] The time series decomposition module 301 is used to obtain the target system time series data set, analyze the target system time series data set, and determine the multi-dimensional independent component time series data set; the parallel analysis module 302 is used to perform multi-agent collaborative parallel anomaly analysis on the multi-dimensional independent component time series data set based on the multi-agent collaborative parallel analysis strategy, and determine the anomaly indicator location information set; the fusion decision module 303 is used to perform fusion decision analysis on the anomaly indicator location information set according to the root cause fusion analysis strategy, and determine and output the root cause analysis report.

[0097] Optionally, the time series decomposition module 301 is specifically used to: perform missing value supplementation and time series alignment processing on each target system time series data set in the target system time series data set according to the target system time series data set, and determine a preprocessed time series data set; based on a preset sliding time window span and a preset periodic time window span, analyze the preprocessed time series data set, perform time series decomposition processing on each preprocessed time series data in the preprocessed time series data set, and determine the corresponding trend component, periodic component and burst component of each preprocessed time series data at different time points; construct a trend component data sequence according to the corresponding trend component of each preprocessed time series data at different time points; construct a periodic component data sequence according to the corresponding periodic component of each preprocessed time series data at different time points; construct a burst component data sequence according to the corresponding burst component of each preprocessed time series data at different time points; and construct a multi-dimensional independent component time series data set according to the trend component data sequence, the periodic component data sequence and the burst component data sequence.

[0098] Optionally, the time series decomposition module 301 analyzes the preprocessed time series data set based on the preset sliding time window span and the preset periodic time window span, performs time series decomposition processing on each preprocessed time series data in the preprocessed time series data set, and determines the corresponding trend component, periodic component, and burst component of each preprocessed time series data at different time points. Specifically, the formula is as follows: ; in, The current time point The trend component under is the preset sliding time window span, The preprocessed time series data at the time point The data value at For time point The periodic component under is the preset period time window span, is the preprocessed time series data, The timestamp corresponding to the current cycle time point, For time point The burst component below.

[0099] Optionally, the parallel analysis module 302 is specifically used for: the multi-agent includes a performance monitoring agent, an indicator tracking agent and a question-answering agent; based on the performance monitoring agent, the trend component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the trend change mapping index corresponding to each trend component data; based on the positive and negative properties of the numerical values ​​of each trend change mapping index, it is judged whether the operation and maintenance indicators corresponding to different trend component data have trend-type faults, and if so, the corresponding trend-type abnormal operation and maintenance indicators are extracted; based on the indicator tracking agent, the periodic component data sequence in the multi-dimensional independent component time series data set is analyzed to determine the number of each periodic component. According to the corresponding periodic component amplitude; each of the periodic component amplitudes is compared with the preset periodic amplitude threshold value to determine whether the operation and maintenance indicators corresponding to different periodic component data have periodic faults, and if so, extract the corresponding periodic abnormal operation and maintenance indicators; based on the question-answering intelligent agent, analyze the burst component data sequence in the multi-dimensional independent component time series data set, and according to the sudden fault judgment condition, determine whether the operation and maintenance indicators corresponding to different burst component data have sudden faults, and if so, extract the corresponding sudden abnormal operation and maintenance indicators; construct the abnormal indicator positioning information set based on the trend-type abnormal operation and maintenance indicators, the periodic abnormal operation and maintenance indicators and the sudden abnormal operation and maintenance indicators.

[0100] Optionally, when the parallel analysis module 302 analyzes the trend component data sequence in the multi-dimensional independent component time series data set based on the performance monitoring agent and determines the trend change mapping index corresponding to each trend component data, the specific formula is as follows: ; in, is the trend change mapping index, is the total number of time points corresponding to the current trend component data in the trend component data sequence, is the time point index, For time point The trend component below.

[0101] Optionally, when the parallel analysis module 302 analyzes the periodic component data sequence in the multi-dimensional independent component time series data set based on the indicator tracking agent and determines the periodic component amplitude corresponding to each periodic component data, the formula is specifically as follows: ; in, is the periodic component amplitude of the current periodic component data sequence in the periodic time window, The current period component data sequence is in the Sub-data sequence under the period time window, is the preset period time window span, is the total number of cycle time windows.

[0102] Optionally, the sudden fault judgment condition in the parallel analysis module 302 is specifically the following formula: ; in, For time point The burst component under For time point The burst component under is the standard deviation of the variation between the burst components in the current burst component data sequence, is the average value of the burst components in the current burst component data sequence, and is the standard deviation of the burst components in the current burst component data sequence.

[0103] Optionally, the fusion decision module 303 is specifically used to: obtain a real-time operation and maintenance optimization target, and based on the real-time operation and maintenance optimization target, determine the root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set according to the abnormal indicator location information set; analyze the root cause assessment coefficient corresponding to each abnormal indicator, perform a significant difference assessment on each root cause assessment coefficient, and determine several root cause abnormal operation and maintenance indicators; and construct and output the root cause analysis report based on the several root cause abnormal operation and maintenance indicators.

[0104] Optionally, the fusion decision module 303 determines the root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set based on the real-time operation and maintenance optimization goal and according to the abnormal indicator location information set, specifically the following formula: ; in, For the real-time operation and maintenance optimization goal, Position the first Abnormal indicators, Locating information set for the abnormal indicator, To remove the data subset corresponding to the abnormal indicator from the abnormal indicator location information set, is the root cause assessment coefficient corresponding to the current abnormal indicator, For the current operation and maintenance optimization goals and The conditional covariance between the anomaly indicators, is the variance corresponding to the current operation and maintenance optimization target, is the variance corresponding to the current abnormal indicator.

[0105] The system of this embodiment can be used to execute the method of any of the above embodiments. Its implementation principles and technical effects are similar and will not be described in detail here.

Claims

1. A root cause location method based on time series decomposition and multi-agent collaboration, characterized by: include: Acquire a target system time series data set, analyze the target system time series data set, and determine a multi-dimensional independent component time series data set; Based on a multi-agent collaborative parallel analysis strategy, a multi-agent collaborative parallel anomaly analysis is performed on the multi-dimensional independent component time series data set to determine an anomaly indicator location information set; According to the root cause fusion analysis strategy, a fusion decision analysis is performed on the abnormal indicator location information set to determine and output a root cause analysis report.

2. The method according to claim 1, characterized in that The analyzing the target system time series data set to determine a multi-dimensional independent component time series data set includes: According to the target system time series data set, performing missing value supplementation processing and time series alignment processing on each target system time series data set in the target system time series data set to determine a preprocessed time series data set; Based on the preset sliding time window span and the preset periodic time window span, the preprocessed time series data set is analyzed, and time series decomposition processing is performed on each preprocessed time series data in the preprocessed time series data set to determine the trend component, periodic component and burst component corresponding to each preprocessed time series data at different time points; Constructing a trend component data sequence according to the corresponding trend component of each preprocessed time series data at different time points; Constructing a periodic component data sequence according to the periodic component corresponding to each preprocessed time series data at different time points; Constructing a burst component data sequence according to the burst component corresponding to each preprocessed time series data at different time points; A multi-dimensional independent component time series data set is constructed according to the trend component data sequence, the period component data sequence and the burst component data sequence.

3. The method according to claim 2, characterized in that Based on the preset sliding time window span and the preset periodic time window span, the preprocessed time series data set is analyzed, and time series decomposition processing is performed on each preprocessed time series data in the preprocessed time series data set to determine the trend component, periodic component, and burst component corresponding to each preprocessed time series data at different time points. Specifically, the formula is as follows: ； in, The current time point The trend component under is the preset sliding time window span, The preprocessed time series data at the time point The data value at For time point The periodic component under is the preset period time window span, is the preprocessed time series data, The timestamp corresponding to the current cycle time point, For time point The burst component below.

4. The method according to claim 2, characterized in that The multi-agent collaborative parallel analysis strategy is based on which a multi-agent collaborative parallel anomaly analysis is performed on the multi-dimensional independent component time series data set to determine an anomaly indicator location information set, including: The multi-agent includes a performance monitoring agent, an indicator tracking agent and a question-answering agent; Based on the performance monitoring agent, analyzing the trend component data sequence in the multi-dimensional independent component time series data set, and determining the trend change mapping index corresponding to each trend component data; According to the positive and negative properties of the numerical values ​​of each trend change mapping index, it is judged whether the operation and maintenance indicators corresponding to different trend component data have trend-type faults, and if so, the corresponding trend-type abnormal operation and maintenance indicators are extracted; Analyzing the periodic component data sequence in the multi-dimensional independent component time series data set based on the indicator tracking agent to determine the periodic component amplitude corresponding to each periodic component data; Compare the amplitude of each of the periodic components with a preset periodic amplitude threshold value to determine whether the operation and maintenance indicators corresponding to different periodic component data have periodic faults. If so, extract the corresponding periodic abnormal operation and maintenance indicators; Based on the question-answering agent, the burst component data sequence in the multi-dimensional independent component time series data set is analyzed, and according to the sudden fault judgment condition, it is judged whether the operation and maintenance indicators corresponding to different burst component data have sudden faults. If so, the corresponding sudden abnormal operation and maintenance indicators are extracted; The abnormal indicator positioning information set is constructed according to the trend-type abnormal operation and maintenance indicator, the period-type abnormal operation and maintenance indicator, and the sudden abnormal operation and maintenance indicator.

5. The method according to claim 4, characterized in that The performance monitoring agent is based on analyzing the trend component data sequence in the multi-dimensional independent component time series data set to determine the trend change mapping index corresponding to each trend component data, specifically the following formula: ； in, Mapping index for trend changes, is the total number of time points corresponding to the current trend component data in the trend component data sequence, is the time point index, For time point The trend component below.

6. The method according to claim 4, characterized in that The indicator-based tracking agent analyzes the periodic component data sequence in the multi-dimensional independent component time series data set to determine the periodic component amplitude corresponding to each periodic component data, specifically the following formula: ； in, The current period component data sequence is in the The amplitude of the periodic component in the periodic time window is The current period component data sequence is in the Sub-data sequence under the period time window, is the preset period time window span, is the total number of cycle time windows.

7. The method according to claim 4, characterized in that The sudden fault judgment condition is specifically the following formula: ； in, For time point The burst component under For time point The burst component under is the standard deviation of the variation between the burst components in the current burst component data sequence, is the average value of the burst component in the current burst component data sequence, is the standard deviation of the burst component in the current burst component data sequence.

8. The method according to claim 7, characterized in that The root cause fusion analysis strategy is used to perform fusion decision analysis on the abnormal indicator location information set, and a root cause analysis report is determined and output, including: Obtaining a real-time operation and maintenance optimization target, and determining, based on the real-time operation and maintenance optimization target and according to the abnormal indicator location information set, a root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set; Analyze the root cause assessment coefficient corresponding to each abnormal indicator, perform a significant difference assessment on each root cause assessment coefficient, and determine a number of root cause abnormal operation and maintenance indicators; Based on the root cause abnormal operation and maintenance indicators, the root cause analysis report is constructed and output.

9. The method according to claim 8, characterized in that Based on the real-time operation and maintenance optimization goal, and according to the abnormal indicator location information set, a root cause assessment coefficient corresponding to each abnormal indicator in the abnormal indicator location information set is determined, specifically as follows: ； in, For the real-time operation and maintenance optimization goal, Position the first Abnormal indicators, Locating information set for the abnormal indicator, To remove the data subset corresponding to the abnormal indicator from the abnormal indicator location information set, is the root cause assessment coefficient corresponding to the current abnormal indicator, For the current operation and maintenance optimization goals and The conditional covariance between the anomaly indicators, is the variance corresponding to the current operation and maintenance optimization target, is the variance corresponding to the current abnormal indicator.

10. A root cause location system based on time series decomposition and multi-agent collaboration, characterized by: include: A time series decomposition module is used to obtain a target system time series data set, analyze the target system time series data set, and determine a multi-dimensional independent component time series data set; A parallel analysis module is used to perform multi-agent collaborative parallel anomaly analysis on the multi-dimensional independent component time series data set based on a multi-agent collaborative parallel analysis strategy to determine an anomaly indicator location information set; The fusion decision module is used to perform fusion decision analysis on the abnormal indicator location information set according to the root cause fusion analysis strategy, and determine and output a root cause analysis report.

Images