A method and system for root cause analysis of edge gateway anomaly detection results

Abstract

The application relates to the technical field of data processing, and discloses a root cause analysis method and system for edge gateway abnormal detection results, the method comprising the following steps: dynamically obtaining a causal dependence relationship between an abnormal event and a potential root cause in abnormal detection result data under an edge gateway running state, and obtaining a causal weight matrix; in a sliding window, determining an abnormal adaptive threshold of the edge gateway according to the causal weight matrix and historical abnormal mode data of the edge gateway; applying the abnormal adaptive threshold to identify key root cause nodes in the causal weight matrix, and obtaining a root cause candidate set; verifying and prioritizing the root cause candidate set, and obtaining a root cause analysis report; feeding back the root cause analysis report to step S1 to optimize the dynamic acquisition to obtain the causal weight matrix, and generating a target root cause analysis report according to the causal weight matrix of a target edge gateway; and the application can improve the accuracy of root cause analysis of edge gateway abnormal detection results.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a root cause analysis method and system for edge gateway anomaly detection results. Background Technology

[0002] Existing technologies have significant shortcomings in the initial data processing and causal relationship construction stages of edge gateway anomaly root cause analysis. After collecting anomaly detection results, noise and redundant information are not systematically removed, resulting in low-quality preprocessed data that cannot provide a reliable foundation for subsequent dependency relationship construction. Furthermore, after constructing the initial dependency relationship graph, dependency weights are not dynamically adjusted based on occurrence patterns, correlation strength, and timeliness factors from historical operational data; instead, fixed weights or simple empirical adjustments are used. This results in a causal weight matrix that cannot accurately reflect the true correlation between anomaly events and potential root causes, making it difficult to support accurate root cause identification. In addition, the lack of a sliding window mechanism for analyzing historical anomaly pattern data prevents dynamic adjustment of analysis dimensions based on real-time operational status, further reducing the timeliness and adaptability of causal relationship analysis.

[0003] Existing technologies have significant shortcomings in the root cause screening, verification, and optimization stages. When determining the root cause screening threshold, they fail to dynamically generate adaptive thresholds based on anomaly sensitivity, frequency distribution, and node connectivity strength, relying solely on fixed thresholds for root cause node screening. This easily leads to the omission of critical root causes or misjudgment of irrelevant nodes. After screening the candidate root cause set, they fail to exclude isolated nodes and nodes with low connectivity, nor do they verify the true causal relationship between candidate nodes and the current anomaly. They rely solely on weight ranking to determine root cause priority, resulting in low reliability of root cause analysis results. More importantly, they lack a closed-loop optimization mechanism to feed the root cause analysis report back to the initial causal relationship acquisition stage. This prevents adjustments to the dependency discovery strategy based on verified high-confidence causal patterns, hindering iterative optimization of subsequent root cause analysis and maintaining a state of low efficiency and accuracy in the long term. This makes it difficult to meet the accuracy and dynamic adaptability requirements of edge gateway anomaly root cause analysis. Summary of the Invention

[0004] This invention provides a root cause analysis method and system for edge gateway anomaly detection results to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a root cause analysis method for edge gateway anomaly detection results, comprising:

[0006] S1. Dynamically acquire the causal dependencies between abnormal events and potential root causes in the anomaly detection result data during the operation of the edge gateway, and obtain the causal weight matrix of the edge gateway, including:

[0007] Collect anomaly detection results data generated during the operation of the edge gateway;

[0008] Noise and redundant information are removed from the anomaly detection result data to obtain the preprocessed data of the edge gateway;

[0009] Using the abnormal events and potential root causes in the preprocessed data as nodes, and the dependency relationship between the abnormal events and the potential root causes as edges, an initial dependency graph of the edge gateway is constructed.

[0010] The initial dependency weights of the dependency graph are dynamically adjusted based on the historical operational data of the edge gateway to obtain the causal weight matrix of the edge gateway, including:

[0011] Based on the historical operation data, extract the historical occurrence patterns and association strength indicators of the dependency edges in the initial dependency graph;

[0012] Based on the historical occurrence pattern and the association strength index, the dependency weights in the initial dependency graph are dynamically adjusted. The calculation formula for the dynamic adjustment is as follows:

[0013] ;

[0014] In the formula, The dependency weights are dynamically adjusted. The original dependency weights in the initial dependency graph. The historical occurrence frequency in the aforementioned historical occurrence pattern. This refers to the confidence factor in the association strength index that represents the true root cause and dependency relationship. The timeliness factor from the historical running data to the current running state is used. Frequency weighting As the confidence level weight, As a time-sensitive factor, It is an exponential function;

[0015] The dynamically corrected initial dependency graph is converted into a matrix representation to obtain the causal weight matrix of the edge gateway;

[0016] S2. In the sliding window, based on the causal weight matrix and the historical abnormal pattern data of the edge gateway, determine the abnormal adaptive threshold of the edge gateway;

[0017] S3. Apply the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix to obtain the root cause candidate set of the edge gateway;

[0018] S4. Verify and prioritize the root cause candidate set to obtain the root cause analysis report of the edge gateway;

[0019] S5. Feedback the root cause analysis report to step S1 to optimize the dynamic acquisition, so as to obtain the causal weight matrix of the target edge gateway, and generate the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway.

[0020] In a preferred embodiment, determining the anomaly adaptive threshold of the edge gateway within the sliding window, based on the causal weight matrix and the historical anomaly pattern data of the edge gateway, includes:

[0021] Set a time-dimensional sliding window to collect historical abnormal pattern data of the edge gateway within the sliding window;

[0022] Based on the historical anomaly pattern data, extract the frequency distribution features of anomaly events and the weight distribution features of root cause nodes within the sliding window;

[0023] The anomaly sensitivity of the current sliding window is evaluated based on the frequency distribution characteristics, the weight distribution characteristics, and the connection strength of the nodes in the causal weight matrix.

[0024] The threshold baseline value of the edge gateway is dynamically adjusted based on the anomaly sensitivity to obtain the anomaly adaptive threshold of the edge gateway.

[0025] In a preferred embodiment, the formula for calculating the anomaly adaptive threshold is as follows:

[0026] ;

[0027] In the formula, The abnormal adaptive threshold, The threshold reference value, This is the threshold adjustment coefficient. It is the hyperbolic tangent function. The abnormal sensitivity of the current sliding window. The sensitivity adjustment range factor is a predefined value. This is a preset sensitivity threshold.

[0028] In a preferred embodiment, the step of applying the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix to obtain the root cause candidate set of the edge gateway includes:

[0029] Traverse the root cause nodes in the causal weight matrix, and determine the comprehensive anomaly score of the root cause node based on the connection weight of the root cause node in the causal weight matrix and the length of the anomaly propagation path.

[0030] Root cause nodes whose comprehensive anomaly score exceeds the anomaly adaptive threshold are selected as preliminary candidate nodes;

[0031] Exclude isolated nodes and low-connectivity nodes from the initial candidate nodes;

[0032] The excluded key root cause nodes are used to form the root cause candidate set of the edge gateway.

[0033] In a preferred embodiment, the step of verifying and prioritizing the root cause candidate set to obtain the root cause analysis report of the edge gateway includes:

[0034] Confirm the true causal relationship between the candidate root cause nodes in the root cause candidate set and the current abnormal event;

[0035] When the true causal relationship is true, the scope of the impact of the candidate root cause node is assessed based on the number of edge services affected by the candidate root cause node and its business criticality.

[0036] The priority of the candidate root cause nodes is determined by combining the scope of influence and the frequency of historical root cause recurrence in the historical anomaly pattern data.

[0037] The nodes in the root cause candidate set are sorted according to the priority to obtain the root cause analysis report of the edge gateway.

[0038] In a preferred embodiment, the step of feeding back the root cause analysis report to step S1, optimizing the dynamic acquisition to obtain the causal weight matrix of the target edge gateway, and generating the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway, includes:

[0039] The verified root cause node information in the root cause analysis report is analyzed to extract high-confidence causal relationship patterns;

[0040] Based on the causal relationship pattern, the dependency discovery strategy in the dynamic acquisition process is adjusted.

[0041] The adjusted dependency discovery strategy is used to re-acquire the anomaly detection result data of the edge gateway in its running state, and the optimized causal weight matrix is ​​obtained.

[0042] Based on the optimized causal weight matrix, a root cause analysis report for the target edge gateway is generated.

[0043] To address the above problems, the present invention also provides a root cause analysis system for edge gateway anomaly detection results, the system comprising:

[0044] The weight matrix generation module is used to dynamically obtain the causal dependencies between abnormal events and potential root causes in the anomaly detection result data under the operating state of the edge gateway, and to obtain the causal weight matrix of the edge gateway, including:

[0045] Collect anomaly detection results data generated during the operation of the edge gateway;

[0046] Noise and redundant information are removed from the anomaly detection result data to obtain the preprocessed data of the edge gateway;

[0047] Using the abnormal events and potential root causes in the preprocessed data as nodes, and the dependency relationship between the abnormal events and the potential root causes as edges, an initial dependency graph of the edge gateway is constructed.

[0048] The initial dependency weights of the dependency graph are dynamically adjusted based on the historical operational data of the edge gateway to obtain the causal weight matrix of the edge gateway, including:

[0049] Based on the historical operation data, extract the historical occurrence patterns and association strength indicators of the dependency edges in the initial dependency graph;

[0050] Based on the historical occurrence pattern and the association strength index, the dependency weights in the initial dependency graph are dynamically adjusted. The calculation formula for the dynamic adjustment is as follows:

[0051] ;

[0052] In the formula, The dependency weights are dynamically adjusted. The original dependency weights in the initial dependency graph. The historical occurrence frequency in the aforementioned historical occurrence pattern. This refers to the confidence factor in the association strength index that represents the true root cause and dependency relationship. The timeliness factor from the historical running data to the current running state is used. Frequency weighting As the confidence level weight, As a time-sensitive factor, It is an exponential function;

[0053] The dynamically corrected initial dependency graph is converted into a matrix representation to obtain the causal weight matrix of the edge gateway;

[0054] An anomaly adaptive threshold confirmation module is used to determine the anomaly adaptive threshold of the edge gateway in a sliding window based on the causal weight matrix and the historical anomaly pattern data of the edge gateway.

[0055] The root cause candidate set acquisition module is used to apply the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix and obtain the root cause candidate set of the edge gateway.

[0056] The sorting module is used to verify and prioritize the root cause candidate set to obtain the root cause analysis report of the edge gateway.

[0057] The feedback report module is used to feed the root cause analysis report back to the weight matrix generation module, optimize the dynamic acquisition to obtain the causal weight matrix of the target edge gateway, and generate the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] 1. This invention collects anomaly detection results data from edge gateways through a weight matrix generation module. After denoising and redundancy removal, high-quality preprocessed data is obtained. An initial dependency graph is constructed using anomaly events and potential root causes as nodes and dependencies as edges. Then, by combining occurrence patterns, correlation strength, and timeliness factors extracted from historical operational data, a causal weight matrix is ​​generated by dynamically adjusting dependency weights using a standardized formula. This accurately captures the true correlation between anomaly events and potential root causes, providing highly reliable data support for subsequent root cause analysis and significantly improving the accuracy and adaptability of causal relationship analysis. Simultaneously, an anomaly adaptive threshold confirmation module uses a sliding window to collect historical anomaly pattern data, extracting frequency and weight distribution features. Anomaly sensitivity is assessed by combining node connection strength, and an anomaly adaptive threshold is generated by dynamically adjusting the threshold baseline value using a formula, effectively improving the accuracy of root cause node screening.

[0060] 2. The root cause candidate set acquisition module of this invention traverses the causal weight matrix, calculates a comprehensive anomaly score by combining the connection weights of root cause nodes and the length of anomaly propagation paths, filters out nodes exceeding the threshold and excludes isolated nodes and nodes with low connectivity, thus obtaining a high-quality root cause candidate set. The sorting module verifies the true causal relationship between candidate nodes and anomaly events, determines priorities by combining the number of affected services, business criticality, and historical recurrence frequency, and generates a root cause analysis report, significantly improving the credibility and practicality of the root cause analysis results. In addition, the feedback report module feeds the analysis report back to the initial stage, analyzes high-confidence causal patterns to adjust dependency discovery strategies, optimizes the causal weight matrix, and generates a target root cause analysis report, forming a closed-loop optimization mechanism to continuously improve the efficiency and accuracy of root cause analysis of edge gateway anomaly detection results. Attached Figure Description

[0061] Figure 1 This is a flowchart illustrating a root cause analysis method for edge gateway anomaly detection results provided in an embodiment of the present invention.

[0062] Figure 2 This is a functional block diagram of a root cause analysis system for edge gateway anomaly detection results provided in an embodiment of the present invention;

[0063] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0064] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0065] This application provides a root cause analysis method for edge gateway anomaly detection results. The execution subject of this root cause analysis method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the root cause analysis method for edge gateway anomaly detection results can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0066] Reference Figure 1 The diagram shown is a schematic flowchart of a root cause analysis method for edge gateway anomaly detection results provided in an embodiment of the present invention. In this embodiment, the root cause analysis method for edge gateway anomaly detection results includes:

[0067] S1. Dynamically obtain the causal dependency relationship between abnormal events and potential root causes in the abnormal detection result data under the operation state of the edge gateway, and obtain the causal weight matrix of the edge gateway.

[0068] In this embodiment of the invention, the step of dynamically acquiring the causal dependencies between abnormal events and potential root causes in the anomaly detection result data under the operating state of the edge gateway, and obtaining the causal weight matrix of the edge gateway, includes:

[0069] Collect anomaly detection results data generated during the operation of the edge gateway;

[0070] Noise and redundant information are removed from the anomaly detection result data to obtain the preprocessed data of the edge gateway;

[0071] Using the abnormal events and potential root causes in the preprocessed data as nodes, and the dependency relationship between the abnormal events and the potential root causes as edges, an initial dependency graph of the edge gateway is constructed.

[0072] The dependency weights of the initial dependency graph are dynamically adjusted based on the historical operating data of the edge gateway to obtain the causal weight matrix of the edge gateway.

[0073] The step of dynamically adjusting the dependency weights of the initial dependency graph based on the historical operating data of the edge gateway to obtain the causal weight matrix of the edge gateway includes:

[0074] Based on the historical operation data, extract the historical occurrence patterns and association strength indicators of the dependency edges in the initial dependency graph;

[0075] Based on the historical occurrence pattern and the association strength index, the dependency weights in the initial dependency graph are dynamically adjusted.

[0076] The dynamically corrected initial dependency graph is converted into a matrix representation to obtain the causal weight matrix of the edge gateway.

[0077] The calculation formula for the dynamic correction is as follows:

[0078] ;

[0079] In the formula, The dependency weights are dynamically adjusted. The original dependency weights in the initial dependency graph. The historical occurrence frequency in the aforementioned historical occurrence pattern. This refers to the confidence factor in the association strength index that represents the true root cause and dependency relationship. The timeliness factor from the historical running data to the current running state is used. Frequency weighting As the confidence level weight, As a time-sensitive factor, It is an exponential function.

[0080] Specifically, through the built-in status monitoring module and data acquisition interface of the edge gateway, the abnormal detection results data generated during the operation of the edge gateway are collected in real time. This data includes abnormal event types such as data transmission delay, port connection failure, high CPU utilization, memory leak, timestamp of the abnormal event, device identifier corresponding to the abnormal event, and potential root causes initially determined by the system such as insufficient network bandwidth, hardware interface failure, abnormal process resource consumption. At the same time, the operating parameters of the gateway at the time of the abnormal event are recorded, such as real-time network speed, CPU utilization, and memory usage. All collected information is stored in chronological order and classified by event type to ensure that the data completely covers various abnormal scenarios and related information during the operation of the edge gateway.

[0081] Furthermore, fixed filtering rules are used to process the anomaly detection results data. For noisy information, content that clearly does not conform to the normal anomaly record format of the edge gateway is filtered out, such as data with incorrect timestamp format, missing device identifier, or anomaly event type not in the preset category. These non-compliant data are directly removed. For redundant information, completely duplicate records are identified and deleted, that is, records with completely identical anomaly event type, occurrence timestamp, device identifier, potential root cause, and operating parameters. At the same time, duplicate reports of the same anomaly event are deleted, and only the first report or the record with the most complete information is retained. After noise removal and redundancy removal, preprocessed edge gateway data with a regular structure and valid information is obtained.

[0082] Furthermore, all independent anomalous events and potential root causes are extracted from the preprocessed data. Each anomalous event and each potential root cause is treated as an independent node. For example, data transmission delay is treated as an anomalous event node, and insufficient network bandwidth is treated as a potential root cause node. Then, the correspondence between anomalous events and potential root causes in the preprocessed data is analyzed. If, when an anomalous event occurs, the potential root cause initially determined by the system clearly points to a certain factor, and this correspondence appears multiple times in the preprocessed data and can be verified, then an edge is established between the anomalous event node and the corresponding potential root cause node to indicate that there is a dependency relationship between the two. All nodes and their corresponding edges are integrated according to the association relationship to construct an initial dependency graph of the edge gateway that can intuitively reflect the dependency between anomalous events and potential root causes.

[0083] Furthermore, historical operational data of the edge gateway over the past year is retrieved. This data includes past abnormal events, their corresponding root causes, the frequency of association between abnormal events and root causes, and the elimination of abnormal events after root cause resolution. Based on the historical operational data, the actual number of associations between abnormal events and potential root causes for each edge in the initial dependency graph is calculated. If the number of associations for a certain edge accounts for a high proportion in the historical data, and the elimination rate of abnormal events after root cause resolution is high, the dependency weight of that edge is increased. If the number of associations for a certain edge is low, or if abnormal events still occur frequently after root cause resolution, the dependency weight of that edge is decreased.

[0084] Furthermore, if new associations between anomalous events and potential root causes not covered by the initial dependency graph are discovered in historical data, and these associations are verified to be true and valid multiple times, then corresponding nodes and edges are added to the initial dependency graph, and corresponding dependency weights are assigned based on the frequency of historical associations. All adjusted node dependency weights are arranged in matrix form, where rows represent anomalous event nodes, columns represent potential root cause nodes, and the values ​​in the matrix represent the dependency weights of the corresponding anomalous events and potential root causes, ultimately yielding the causal weight matrix of the edge gateway.

[0085] Specifically, from the historical operational data of the edge gateway, records related to each dependency edge in the initial dependency graph are selected. The number of times the abnormal event and potential root cause corresponding to each dependency edge occur simultaneously for each record is recorded. The temporal distribution pattern of these simultaneously occurring records in the historical data is statistically analyzed, such as the frequency of occurrence within a specific time period and the number of consecutive occurrences, forming the historical occurrence pattern of each dependency edge. At the same time, the probability of the abnormal event corresponding to each dependency edge occurring after the potential root cause occurs, and the probability of the potential root cause occurring before the abnormal event occurs are calculated. The average of these two probabilities is used as the association strength index of the dependency edge. In this way, the historical occurrence pattern and association strength index of the dependency edges in the initial dependency graph are extracted from the historical operational data.

[0086] Furthermore, for each dependency edge in the initial dependency graph, its historical occurrence pattern is compared with a preset pattern standard. If the historical occurrence pattern of a dependency edge shows that it appears frequently in historical data and has a stable time distribution, the initial dependency weight of the dependency edge is increased according to the preset rules; if the historical occurrence pattern shows that it appears infrequently and has a scattered time distribution, the initial dependency weight of the dependency edge is decreased. At the same time, the association strength index of each dependency edge is compared with a preset strength threshold. If the association strength index is higher than the threshold, the dependency weight of the dependency edge is further increased; if it is lower than the threshold, its dependency weight is further decreased. By combining the dual judgment of historical occurrence pattern and association strength index, the dependency weights in the initial dependency graph are dynamically corrected.

[0087] Furthermore, all anomalous event nodes in the dynamically corrected initial dependency graph are arranged in a fixed order as rows of a matrix, and all potential root cause nodes are arranged in a fixed order as columns of the matrix. For each element in the matrix, its row corresponds to an anomalous event node, and its column corresponds to a potential root cause node. If there is a dependency edge between the anomalous event node and the potential root cause node, the dynamically corrected dependency weight of the dependency edge is used as the value of the element. If there is no dependency edge, the value of the element is zero. In this way, the dynamically corrected initial dependency graph is converted into a matrix representation, and the causal weight matrix of the edge gateway is obtained.

[0088] Specifically, It originates from the initial dependency graph, which is constructed by the correspondence between anomalous events and potential root causes in the preprocessed data. The original dependency weights are directly set when constructing the initial dependency graph based on the preliminary association between anomalous events and potential root causes.

[0089] Furthermore, Extract from historical operational data, count the total number of times an abnormal event and a potential root cause corresponding to a certain dependency edge in the initial dependency graph of historical operational data occur simultaneously, and then divide the total number of times by the total number of records in historical operational data. The result is the historical occurrence frequency.

[0090] Furthermore, The confidence factor is calculated by first counting the number of times a potential root cause in the historical operating data is verified as the true root cause of the corresponding abnormal event, and then counting the total number of times the potential root cause is determined as the root cause of the abnormal event. The confidence factor is obtained by dividing the number of true root causes by the total number of determinations.

[0091] Furthermore, Based on the interval between the time recorded in historical operation data and the current operation status, the time difference between the historical data recording time and the current time is first calculated, and then the time difference is converted into a corresponding value according to a fixed rule. This value is the timeliness factor. The larger the time difference, the larger the timeliness factor value.

[0092] Furthermore, , , These are fixed values ​​preset based on the importance of each factor in the actual application scenario, among which... Corresponding frequency weights The corresponding confidence weights, summed to 1, are used to balance the influence of historical frequency and the confidence factor. The corresponding timeliness weight is used to control the degree to which the timeliness factor affects the correction result.

[0093] Furthermore, In other words, the exponential function is calculated using fixed mathematical rules. For a given value, the result is calculated according to the logic of exponential operation. In the formula, it is used to convert the influence of time-sensitive factors into a decay effect. When the input value increases, the result of the exponential function decreases, and when the input value decreases, the result of the exponential function increases.

[0094] Furthermore, the significance of this formula is to dynamically correct the original dependency weights in the initial dependency graph. By combining historical frequency, confidence factor, and timeliness factor, the corrected dependency weights can reflect both the frequency and reliability of the association between abnormal events and potential root causes in historical data, as well as the impact of the timeliness of historical data on the current dependency relationship. Ultimately, this yields dependency weights that better fit the actual operation of the edge gateway, providing accurate data support for the subsequent construction of the causal weight matrix.

[0095] Furthermore, when the frequency of historical occurrences increases, it means that anomalous events and underlying causes occur simultaneously more frequently in history. The product of frequency and historical occurrence will increase, thus making The sum of historical frequency As the sum of the confidence factor and the overall value increases, the dynamically adjusted dependency weights will increase, provided that the original dependency weights and the result of the exponential function remain unchanged.

[0096] Furthermore, as the confidence factor increases, it indicates a higher degree of confidence that the potential root cause is the true root cause of the anomalous event. The product of the confidence factor and the confidence factor will increase, which will also make... The sum of historical frequency As the sum of the confidence factor and the overall value increases, the dynamically adjusted dependency weights will increase, assuming other conditions remain unchanged.

[0097] Furthermore, as the timeliness factor increases, meaning the historical data is further back in time, The product of the timeliness factor will increase, the input value of the exponential function will become negative and the absolute value will be larger, and the result of the exponential function will decrease, in the original dependency weights and The sum of historical frequency With the sum of the confidence factors remaining constant, the dynamically adjusted dependency weights will decrease.

[0098] Furthermore, when the original dependency weight increases, the dynamically corrected dependency weight will increase directly while other parameter values ​​remain unchanged.

[0099] Furthermore, when As the frequency of historical occurrences increases, its impact on the overall result strengthens. If the frequency of historical occurrences is high, the dynamically adjusted dependency weights will be more significant than before. Larger when smaller; when As the confidence factor increases, its influence strengthens. If the confidence factor is high, the dynamically adjusted dependency weights will be more significant than... Larger when smaller; when As the timeliness factor increases, its attenuation effect strengthens. When the timeliness factor is large, the dynamically adjusted dependency weight will be greater than... Smaller when smaller.

[0100] In summary, collecting anomaly detection results data during edge gateway operation can comprehensively capture key information such as the type of anomaly, the time of occurrence, the corresponding device identifier, and the potential root cause, covering various anomaly scenarios. This provides complete raw data support for subsequent causal analysis and avoids bias in correlation judgments caused by missing data.

[0101] In summary, removing noise and redundant information from anomaly detection results, eliminating invalid data, and deleting duplicate records can improve data quality, obtain well-organized and effective preprocessed data, avoid low-quality data interfering with dependency construction, and ensure the reliability of subsequent causal association analysis.

[0102] In summary, an initial dependency graph is constructed using nodes and dependencies in the preprocessed data as edges to transform abstract associations into an intuitive graphical structure. This clearly presents the corresponding connections between anomalies and root causes, providing a clear framework for adjusting dependency weights and facilitating the subsequent identification of core association paths.

[0103] In summary, the dependency weights of the initial dependency graph are dynamically adjusted based on historical operational data. The weights are then corrected by combining historical association frequency and verification results, and finally transformed into a causal weight matrix. This allows the matrix values ​​to accurately reflect the true correlation strength between anomalies and root causes, providing a quantitative basis for subsequent root cause identification and improving the accuracy and adaptability of the analysis.

[0104] In summary, extracting historical occurrence patterns and association strength indicators of dependency edges from the initial dependency graph based on historical operational data can uncover the frequency of occurrence, temporal distribution, and reliability of the association between anomalies and root causes of dependency edges in history. This provides objective data for subsequent weight adjustments and avoids adjustment biases caused by relying solely on subjective experience.

[0105] In summary, dynamically adjusting the initial dependency weights based on historical occurrence patterns and correlation strength indicators can strengthen the weights of high-frequency and high-reliability correlations and weaken the weights of low-frequency and low-reliability correlations, making the dependency weights more consistent with the actual operating rules of edge gateways and improving the accuracy of causal relationship representation.

[0106] In summary, converting the dynamically corrected initial dependency graph into a matrix representation to obtain the causal weight matrix can transform graphical relationships into quantitative matrix data, facilitating subsequent rapid retrieval, calculation, and analysis. This provides a structured and accurate basis for identifying the root causes of anomalies, further ensuring the efficiency and accuracy of root cause analysis.

[0107] In summary, this dynamic correction calculation formula adjusts dependency weights through the synergistic effect of multi-dimensional factors, which can accurately optimize the weight settings in the initial dependency graph and significantly improve the ability of the causal weight matrix to represent the true correlation between edge gateway abnormal events and potential root causes.

[0108] In summary, by introducing historical frequency of occurrence, the frequency of occurrence of dependent edges in past operations can be quantified, allowing high-frequency anomalies and root cause associations to receive more reasonable weights, which aligns with the association patterns in the long-term operation of edge gateways and avoids ignoring the impact of common associations on weights.

[0109] In summary, incorporating confidence factors can combine historical root cause verification results to strengthen the weights of dependency edges that have been proven to be genuine associations, while weakening the weights of associations that have not been verified or have failed to be verified. This ensures that weight adjustments are based on reliable causal relationships and reduces the interference of spurious associations on subsequent analyses.

[0110] In summary, by incorporating a timeliness factor and transforming it through an exponential function, recent historical data can be given greater influence, while the weight of older data can be reduced. This adapts to the dynamic changes in the edge gateway's operating status, avoids weight bias caused by outdated data, and makes the corrected weights more suitable for the current operating scenario.

[0111] In summary, by balancing the influence of each factor through frequency weight, confidence weight, and timeliness weight, the importance of each dimension can be flexibly adjusted according to the actual application needs of the edge gateway. This ensures that the calculation results of the formula not only comprehensively cover key influencing factors but also focus on core correlation features. The resulting dynamically corrected dependency weights provide accurate quantitative basis for the construction of the causal weight matrix, further ensuring the accuracy and adaptability of subsequent root cause identification.

[0112] S2. In the sliding window, based on the causal weight matrix and the historical abnormal pattern data of the edge gateway, determine the abnormal adaptive threshold of the edge gateway;

[0113] In this embodiment of the invention, determining the anomaly adaptive threshold of the edge gateway within the sliding window, based on the causal weight matrix and the historical anomaly pattern data of the edge gateway, includes:

[0114] Set a time-dimensional sliding window to collect historical abnormal pattern data of the edge gateway within the sliding window;

[0115] Based on the historical anomaly pattern data, extract the frequency distribution features of anomaly events and the weight distribution features of root cause nodes within the sliding window;

[0116] The anomaly sensitivity of the current sliding window is evaluated based on the frequency distribution characteristics, the weight distribution characteristics, and the connection strength of the nodes in the causal weight matrix.

[0117] The threshold baseline value of the edge gateway is dynamically adjusted based on the anomaly sensitivity to obtain the anomaly adaptive threshold of the edge gateway.

[0118] The formula for calculating the anomaly adaptive threshold is as follows:

[0119] ;

[0120] In the formula, The abnormal adaptive threshold, The threshold reference value, This is the threshold adjustment coefficient. It is the hyperbolic tangent function. The abnormal sensitivity of the current sliding window. The sensitivity adjustment range factor is a predefined value. This is a preset sensitivity threshold.

[0121] Specifically, a fixed-duration time-dimension sliding window is set, for example, 24 hours as a window duration. The window slides forward once every hour. Within each sliding window, the edge gateway's log recording system collects information such as all abnormal event types that occur during this period, the number of times each abnormal event occurs, the potential root cause corresponding to each abnormal event, and the verification results of the root cause. This information is organized according to the abnormal event type and the order of occurrence to form the historical abnormal pattern data of the edge gateway within the sliding window.

[0122] Furthermore, from the historical anomaly pattern data within the sliding window, the total number of times each anomaly event occurred within the window duration is counted, and the proportion of each anomaly event's occurrence to the total number of all anomalies is calculated. These proportions are then arranged to form the frequency distribution characteristics of the anomalies, which directly reflect the frequency of various anomalies within the window. Simultaneously, based on the connection weights between potential root cause nodes and anomaly event nodes in the causal weight matrix, the total weight of each potential root cause node in all associated anomalies within the window is calculated. This total weight of each root cause node is then compared to the total weight of all root cause nodes to obtain the weight percentage of each root cause node. These percentages are then arranged to form the weight distribution characteristics of the root cause nodes, which reflect the influence proportion of each potential root cause within the window.

[0123] Furthermore, the occurrence frequency of various abnormal events in the frequency distribution characteristics is compared with a preset frequency threshold, and the number of abnormal events exceeding the threshold is counted. The more abnormal events there are, the denser the abnormal events in the current window. At the same time, the weight ratio of each root cause node in the weight distribution characteristics is compared with a preset weight threshold, and the number of root cause nodes exceeding the threshold is counted. The more root cause nodes there are, the more concentrated the influence of the main root cause is. Then, combined with the connection strength of the nodes in the causal weight matrix, that is, the dependency weight value between abnormal events and potential root causes, the sum of the connection strength between all abnormal events exceeding the frequency threshold and their corresponding root cause nodes exceeding the weight threshold is calculated. The larger the sum, the closer the association between the abnormal event and the root cause. By comprehensively considering the density of abnormal events, the concentration of the main root cause, and the closeness of association, the abnormality sensitivity of the current sliding window is determined. The higher the density, concentration, and closeness of association, the higher the abnormality sensitivity.

[0124] Furthermore, a fixed threshold benchmark is set, which is determined based on historical data during normal operation of the edge gateway and represents the acceptable range of abnormal fluctuations under normal conditions. When the assessed anomaly sensitivity of the current sliding window is higher than the preset sensitivity benchmark, it indicates that the anomaly situation within the current window is relatively active, and the threshold benchmark needs to be lowered so that the edge gateway can detect potential anomalies more sensitively. When the anomaly sensitivity is lower than the sensitivity benchmark, it indicates that the anomaly situation within the current window is relatively stable, and the threshold benchmark can be increased to reduce unnecessary anomaly alarms. By dynamically adjusting the threshold benchmark based on anomaly sensitivity in this way, the anomaly adaptive threshold of the edge gateway is obtained.

[0125] Specifically, the threshold benchmark value is determined based on historical data during the normal operation phase of the edge gateway. Anomaly detection data of the edge gateway during long-term stable operation is collected, and the average reasonable fluctuation range of the abnormal indicators in these data is statistically analyzed. The upper limit of this range is used as the threshold benchmark value to ensure that the value can cover the normal abnormal fluctuations during the normal operation of the edge gateway.

[0126] Furthermore, the threshold adjustment coefficient is preset by technical personnel based on the actual application scenario and anomaly detection requirements of the edge gateway. When setting it, the effective range of threshold adjustment in the past anomaly handling cases of the edge gateway is referenced to ensure that the coefficient is neither too sensitive to cause false alarms nor too sluggish to cause missed alarms. It is a fixed preset value.

[0127] Furthermore, the calculation process of the hyperbolic tangent function follows a fixed mathematical logic. For the input value, the result is mapped to the range of negative one to one through specific operation rules. In the specific operation, the corresponding hyperbolic sine and hyperbolic cosine values ​​are first calculated based on the input value. Then, the hyperbolic sine value is divided by the hyperbolic cosine value, and the quotient is the result of the hyperbolic tangent function. This function is used to convert the difference between abnormal sensitivity and the preset sensitivity threshold into a smooth adjustment range.

[0128] Furthermore, the anomaly sensitivity of the current sliding window is obtained by evaluating the anomalies within the current sliding window. During the evaluation process, the frequency distribution characteristics of the anomaly events within the sliding window, the weight distribution characteristics of the root cause nodes, and the connection strength of the nodes in the causal weight matrix are combined. The denser the anomaly events, the more concentrated the main root causes, and the tighter the node connections, the higher the anomaly sensitivity value.

[0129] Furthermore, the pre-defined sensitivity adjustment range factor is set by technicians based on the fluctuation range of historical abnormal sensitivity of the edge gateway. By statistically analyzing the maximum and minimum values ​​of abnormal sensitivity within different sliding windows in the past, the difference between the two is calculated. Then, according to the actual adjustment needs, a fixed proportion of this difference is taken as the sensitivity adjustment range factor to control the impact of abnormal sensitivity differences on threshold adjustment.

[0130] Furthermore, the preset sensitivity threshold is determined based on the abnormal sensitivity threshold between normal and abnormal operation of the edge gateway. Abnormal sensitivity data of the edge gateway during normal operation and when a minor abnormality occurs are collected, and the value at the boundary between the two types of data is taken as the preset sensitivity threshold to determine whether the abnormal sensitivity of the current sliding window exceeds the normal range.

[0131] Furthermore, the significance of this formula is to dynamically adjust the threshold baseline value based on the anomaly sensitivity of the current sliding window to obtain an anomaly adaptive threshold. The difference between the anomaly sensitivity and the preset sensitivity threshold is converted into a reasonable adjustment ratio through the hyperbolic tangent function. Combined with the threshold adjustment coefficient and the threshold baseline value, the adjusted threshold can adapt to the anomaly situation of the current sliding window. When the anomaly sensitivity is high, the threshold will be lowered accordingly to improve the sensitivity of anomaly detection. When the anomaly sensitivity is low, the threshold will be raised accordingly to reduce unnecessary anomaly alarms. This ensures that the anomaly detection of the edge gateway can accurately capture potential anomalies while avoiding false alarm interference.

[0132] Furthermore, when the anomaly sensitivity is greater than the preset sensitivity threshold, the difference between the anomaly sensitivity and the preset sensitivity threshold is positive. As the anomaly sensitivity increases, the ratio of this difference to the predefined sensitivity adjustment range factor increases, and the result of the hyperbolic tangent function will approach one. At this time, the value of one plus the product of the threshold adjustment coefficient and the result of the hyperbolic tangent function will increase. With the threshold baseline value and the threshold adjustment coefficient unchanged, the anomaly adaptive threshold will increase accordingly. However, since the upper limit of the hyperbolic tangent function result is one, the increase of the anomaly adaptive threshold will gradually become flat, and eventually stabilize near the sum of the threshold baseline value multiplied by one plus the threshold adjustment coefficient.

[0133] Furthermore, when the abnormal sensitivity is equal to the preset sensitivity threshold, the difference between the abnormal sensitivity and the preset sensitivity threshold is zero, and the result of the hyperbolic tangent function is zero. At this time, the product of one plus the threshold adjustment coefficient and zero is one, and the abnormal adaptive threshold is equal to the threshold reference value, that is, the threshold remains unchanged.

[0134] Furthermore, when the anomaly sensitivity is less than the preset sensitivity threshold, the difference between the anomaly sensitivity and the preset sensitivity threshold is negative. As the anomaly sensitivity decreases, the absolute value of the ratio of this difference to the predefined sensitivity adjustment range factor increases, and the result of the hyperbolic tangent function will approach negative one. At this time, the value of one plus the product of the threshold adjustment coefficient and the result of the hyperbolic tangent function will decrease. With the threshold baseline value and the threshold adjustment coefficient unchanged, the anomaly adaptive threshold will decrease accordingly. Moreover, since the lower limit of the hyperbolic tangent function result is negative one, the decrease in the anomaly adaptive threshold will gradually become more gradual and eventually stabilize near the difference between the threshold baseline value multiplied by one minus the threshold adjustment coefficient.

[0135] Furthermore, when the threshold adjustment coefficient increases, regardless of whether the anomaly sensitivity is greater than or less than the preset sensitivity threshold, the magnitude of the change in the value of the product of the threshold adjustment coefficient and the hyperbolic tangent function will increase, resulting in a corresponding increase in the adjustment magnitude of the anomaly adaptive threshold, making the threshold respond more strongly to changes in anomaly sensitivity. When the threshold adjustment coefficient decreases, the adjustment magnitude of the anomaly adaptive threshold will decrease, and the threshold will respond more smoothly to changes in anomaly sensitivity.

[0136] Furthermore, when the predefined sensitivity adjustment range factor increases, the ratio of the difference between the abnormal sensitivity and the preset sensitivity threshold to the predefined sensitivity adjustment range factor decreases, the change amplitude of the hyperbolic tangent function result decreases, and consequently the change amplitude of the product of the threshold adjustment coefficient and the hyperbolic tangent function result decreases, thus reducing the adjustment amplitude of the abnormal adaptive threshold. When the predefined sensitivity adjustment range factor decreases, the change amplitude of this ratio increases, the change amplitude of the hyperbolic tangent function result increases, and the adjustment amplitude of the abnormal adaptive threshold increases accordingly.

[0137] In summary, setting up a sliding window with a time dimension and collecting historical anomaly pattern data within the window can focus on anomaly information within a specific time range, avoid data being out of touch with the current scenario, and provide a timely and targeted data foundation for threshold determination by dynamically tracking anomaly patterns through window sliding.

[0138] In summary, by extracting the frequency distribution characteristics of abnormal events and the weight distribution characteristics of root cause nodes from historical anomaly pattern data, we can understand the frequency of anomalies and the proportion of root cause influence, transforming abstract data into quantifiable features, providing a clear analytical dimension for assessing anomaly sensitivity, and avoiding one-sided judgments.

[0139] In summary, by combining three types of features to assess anomaly sensitivity, and comprehensively considering anomaly density, root cause concentration, and correlation strength, the system fully reflects the characteristics of anomaly scenarios, ensures accurate assessment results, provides a reliable basis for threshold adjustment, and avoids misjudgment of sensitivity.

[0140] In summary, the threshold baseline value is dynamically adjusted based on anomaly sensitivity. When anomalies are active, the threshold is lowered to increase sensitivity, and when anomalies are stable, the threshold is raised to reduce false alarms. This solves the problem of fixed threshold adaptation and provides a flexible screening standard for identifying key root cause nodes.

[0141] In summary, this adaptive threshold calculation formula can dynamically adjust the threshold based on the actual abnormal scenarios of the edge gateway, significantly improving the accuracy and flexibility of root cause screening and effectively solving the problem that fixed thresholds are difficult to adapt to dynamic abnormal changes in the gateway.

[0142] In summary, the threshold benchmark is used as a basis. This benchmark is determined based on the historical data of the gateway's normal operation, ensuring that the threshold adjustment has a reliable initial basis, avoiding excessive adjustments that deviate from the normal operating range, and ensuring the basic rationality of the threshold.

[0143] In summary, by introducing anomaly sensitivity into the current sliding window, the threshold can be adjusted according to changes in anomaly density, root cause concentration, and correlation within the window. When anomalies are sensitive, the threshold is lowered to capture key root causes, while when anomalies are mild, the threshold is raised to reduce false alarms, thus reflecting the actual anomaly state.

[0144] In summary, the difference between abnormal sensitivity and the preset sensitivity threshold is transformed into a gradual adjustment range by using the hyperbolic tangent function, avoiding sudden changes in the threshold due to small fluctuations in sensitivity and ensuring the stability of the threshold adjustment. At the same time, by using the threshold adjustment coefficient and the sensitivity adjustment range factor, the adjustment intensity and range can be flexibly controlled according to the gateway application scenario, making the threshold more adaptable to different operating requirements. This provides a reasonable screening standard for the subsequent accurate identification of key root cause nodes in the causal weight matrix, further improving the accuracy of root cause analysis.

[0145] S3. Apply the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix to obtain the root cause candidate set of the edge gateway;

[0146] In this embodiment of the invention, the step of applying the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix and obtaining the root cause candidate set of the edge gateway includes:

[0147] Traverse the root cause nodes in the causal weight matrix, and determine the comprehensive anomaly score of the root cause node based on the connection weight of the root cause node in the causal weight matrix and the length of the anomaly propagation path.

[0148] Root cause nodes whose comprehensive anomaly score exceeds the anomaly adaptive threshold are selected as preliminary candidate nodes;

[0149] Exclude isolated nodes and low-connectivity nodes from the initial candidate nodes;

[0150] The excluded key root cause nodes are used to form the root cause candidate set of the edge gateway.

[0151] Specifically, each root cause node in the causal weight matrix is ​​examined one by one. For each root cause node, the connection weights between it and all anomalous event nodes in the causal weight matrix are collected, and these connection weights are added together to obtain the total connection weight of the root cause node. At the same time, the shortest path from the root cause node to each anomalous event node through the dependent edges is determined, and the lengths of these shortest paths are added together to obtain the total anomalous propagation path length of the root cause node. The total connection weight is divided by the total anomalous propagation path length to obtain the comprehensive anomalous score of the root cause node. In this way, the corresponding comprehensive anomalous score is calculated for each root cause node in the causal weight matrix.

[0152] Furthermore, the comprehensive anomaly score of each root cause node is compared with the anomaly adaptive threshold. If the comprehensive anomaly score of a certain root cause node is greater than the anomaly adaptive threshold, the root cause node is selected and classified as a preliminary candidate node. All root cause nodes that meet the condition that the comprehensive anomaly score exceeds the anomaly adaptive threshold are collectively formed into a preliminary candidate node set, ensuring that no root cause node that may be related to the current anomaly is missed.

[0153] Furthermore, each node in the preliminary candidate node set is examined to determine whether it is an isolated node, i.e., the node has no dependent edges connected to any other abnormal event node in the causal weight matrix. If it is an isolated node, it is directly excluded. For non-isolated nodes, the number of abnormal event nodes connected to it in the causal weight matrix is ​​counted. If the number of connections is less than the preset connectivity standard, it is determined to be a low connectivity node and excluded. In this way, nodes that are neither isolated nor have a certain degree of connectivity are selected from the preliminary candidate nodes.

[0154] Furthermore, the remaining root cause nodes after excluding isolated nodes and low connectivity nodes are grouped together. These nodes are all key root cause nodes whose comprehensive anomaly scores exceed the anomaly adaptive threshold and have an effective connection with the anomaly event. These nodes are arranged in descending order of their comprehensive anomaly scores to form a root cause candidate set for the edge gateway, providing clear investigation targets for subsequent accurate location of the root cause of edge gateway anomalies.

[0155] In summary, by traversing the root cause nodes in the causal weight matrix and combining the connection weights with the length of the anomaly propagation path to determine the comprehensive anomaly score, the impact of root cause anomalies can be quantified from both the strength of association and the scope of influence, avoiding single-dimensional bias and providing a scientific basis for screening key root causes.

[0156] In summary, selecting nodes whose scores exceed the adaptive threshold as preliminary candidate nodes can filter out weak influencing root causes by using dynamic thresholds, retain nodes with significant influence, adapt to the current abnormal scenario, and improve the targeting of candidate nodes.

[0157] In summary, by excluding isolated and low-connectivity nodes from the initial candidate nodes and eliminating low-value nodes that are unrelated or have very little connection, the quality of candidate nodes is improved, and the amount of invalid work in subsequent verification is reduced.

[0158] In summary, the remaining key nodes are grouped into a root cause candidate set, integrating nodes with high anomaly impact and effective correlations to provide high-quality objects for subsequent root cause verification and ranking, ensuring the accuracy and efficiency of root cause analysis.

[0159] S4. Verify and prioritize the root cause candidate set to obtain the root cause analysis report of the edge gateway;

[0160] In this embodiment of the invention, the step of verifying and prioritizing the root cause candidate set to obtain the root cause analysis report of the edge gateway includes:

[0161] Confirm the true causal relationship between the candidate root cause nodes in the root cause candidate set and the current abnormal event;

[0162] When the true causal relationship is true, the scope of the impact of the candidate root cause node is assessed based on the number of edge services affected by the candidate root cause node and its business criticality.

[0163] The priority of the candidate root cause nodes is determined by combining the scope of influence and the frequency of historical root cause recurrence in the historical anomaly pattern data.

[0164] The nodes in the root cause candidate set are sorted according to the priority to obtain the root cause analysis report of the edge gateway.

[0165] Specifically, for each candidate root cause node in the root cause candidate set, verification is performed by simulating the blocking of the potential root cause corresponding to that node. That is, the factor represented by the candidate root cause node is artificially eliminated, and it is observed whether the current abnormal event disappears. If the abnormal event disappears, it is confirmed that there is a real causal relationship between the candidate root cause node and the current abnormal event; if the abnormal event still exists, it is confirmed that there is no real causal relationship between the candidate root cause node and the current abnormal event. Through this verification method, the real causal relationship between each candidate root cause node in the root cause candidate set and the current abnormal event is clarified.

[0166] Furthermore, when a candidate root cause node has a genuine causal relationship with the current abnormal event, the specific number of edge services affected by the candidate root cause node is counted, including directly affected edge services and indirectly related edge services. At the same time, based on the importance of edge services in the business process, business criticality levels are divided, such as core business services, important business services, and general business services. Each affected edge service is assigned a corresponding business criticality level. The number of affected edge services is multiplied by their respective business criticality levels and then summed. The result is used to assess the scope of influence of the candidate root cause node. The larger the value, the wider the scope of influence and the more severe the influence.

[0167] Furthermore, the number of times the candidate root cause node appears as the true root cause in historical anomaly pattern data is collected, and the proportion of this number to the total number of historical anomalies is calculated to obtain the historical root cause recurrence frequency of the candidate root cause node. The impact range assessment result is combined with the historical root cause recurrence frequency. If the impact range is wide and the historical recurrence frequency is high, the candidate root cause node is determined to have a high priority; if the impact range is narrow and the historical recurrence frequency is low, the priority is determined to be low. For cases where the impact range and historical recurrence frequency are inconsistent, such as a wide impact range but a low historical recurrence frequency, or a narrow impact range but a high historical recurrence frequency, the impact range is used as the main judgment criterion, while the historical recurrence frequency is also referred to for comprehensive judgment to determine the priority of each candidate root cause node.

[0168] Furthermore, according to the determined priority from high to low, the candidate root cause nodes in the root cause candidate set that have a real causal relationship are arranged. In the arranged list, each candidate root cause node is labeled with its corresponding real causal relationship verification results, impact scope assessment details (including the number of affected edge services and business criticality), and historical root cause recurrence frequency. This information is organized into a structured document, which is the root cause analysis report of the edge gateway, providing technicians with a clear root cause investigation order and basis for handling edge gateway anomalies.

[0169] In summary, confirming the true causal relationship between candidate root cause nodes and the current anomalous event, and verifying the root cause by simulating the blocking of root causes, can eliminate nodes without a real connection, avoid false associations interfering with root cause judgment, ensure that subsequent analysis is based on reliable causal relationships, and improve the credibility of root cause analysis.

[0170] In summary, based on the true causal relationship, the impact range is assessed by combining the number of affected edge services with the business criticality. This allows for the quantification of the actual impact of the root cause on the business—with higher weighting when core services are affected. This avoids the one-sidedness of judging the impact solely by the number of services, and makes the impact range assessment more aligned with actual business needs.

[0171] In summary, prioritizing by combining the scope of impact with the frequency of recurrence of historical root causes allows for a focus on root causes that have a wide impact and have occurred frequently in the past. This ensures that the key root causes of current anomalies are not overlooked, while also referencing historical patterns to improve the rationality of priority determination, providing a clear direction for quickly identifying root causes.

[0172] In summary, generating root cause analysis reports by prioritizing them clearly presents the screened root causes according to their importance, marking the verification results, scope of impact, and recurrence frequency. This provides technical personnel with structured and directly referable investigation basis, significantly improving the efficiency of anomaly handling and reducing the complexity of root cause localization.

[0173] S5. Feedback the root cause analysis report to step S1 to optimize the dynamic acquisition, so as to obtain the causal weight matrix of the target edge gateway, and generate the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway.

[0174] In this embodiment of the invention, the step of feeding back the root cause analysis report to step S1, optimizing the dynamic acquisition to obtain the causal weight matrix of the target edge gateway, and generating the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway, includes:

[0175] The verified root cause node information in the root cause analysis report is analyzed to extract high-confidence causal relationship patterns;

[0176] Based on the causal relationship pattern, the dependency discovery strategy in the dynamic acquisition process is adjusted.

[0177] The adjusted dependency discovery strategy is used to re-acquire the anomaly detection result data of the edge gateway in its running state, and the optimized causal weight matrix is ​​obtained.

[0178] Based on the optimized causal weight matrix, a root cause analysis report for the target edge gateway is generated.

[0179] Specifically, detailed information on all verified root cause nodes is extracted from the root cause analysis report, including the anomalous events corresponding to each node, the verification results of the true causal relationship, the scope of impact, and the priority ranking. Nodes with high priority and verification results showing a true causal relationship are selected. These nodes are combined with their corresponding anomalous events according to the causal correspondence to form multiple causal relationship pairs. The frequency of occurrence and verification success rate of each causal relationship pair in historical anomalous pattern data are statistically analyzed. Causal relationship pairs with high frequency of occurrence and completely accurate verification success rate are selected and identified as high-confidence causal relationship patterns.

[0180] Furthermore, for the extracted high-confidence causal relationship patterns, the focus of the dependency discovery strategy during the dynamic acquisition process is adjusted. Based on the original strategy, the monitoring frequency of abnormal events and root cause nodes involved in the high-confidence causal relationship patterns is increased to ensure that the association information of these events and nodes can be captured more timely and comprehensively when collecting anomaly detection results data. At the same time, when constructing the initial dependency graph, higher initial weights are set for the dependency edges corresponding to the high-confidence causal relationship patterns to strengthen the influence of these verified reliable relationships in the dependency graph. These methods are used to adjust the dependency discovery strategy.

[0181] Furthermore, by adopting the adjusted dependency discovery strategy, the anomaly detection result data collection process of the edge gateway is restarted. During the data collection process, the association data of anomaly events and root cause nodes involved in high-confidence causal relationship patterns are collected according to the new monitoring frequency. At the same time, information on other anomaly events and root cause nodes is collected normally. The collected new data is processed to remove noise and redundant information to obtain new preprocessed data. An initial dependency graph is constructed based on the new preprocessed data, and the dependency weights are dynamically adjusted in combination with historical running data to finally obtain the optimized causal weight matrix.

[0182] Furthermore, based on the optimized causal weight matrix, the steps of anomaly adaptive threshold determination, key root cause node identification, root cause candidate set verification, and priority ranking are re-executed. When determining the anomaly adaptive threshold, the node connection strength in the optimized causal weight matrix is ​​used to evaluate anomaly sensitivity. When identifying key root cause nodes, a comprehensive anomaly score is calculated based on the optimized matrix. During the verification and ranking process, the verification method and priority judgment criteria are maintained in accordance with the previous ones. The final report, which includes optimized key root cause nodes, true causal relationships, scope of impact, and priority ranking, is the target edge gateway's target root cause analysis report.

[0183] In summary, the root cause analysis report verifies root cause node information, extracts high-confidence causal relationship patterns, focuses on verified reliable associations, avoids using unverified associations to guide optimization, provides precise direction for adjusting dependency discovery strategies, and ensures that optimization aligns with the gateway's true causal patterns.

[0184] In summary, adjusting dependency discovery strategies based on high-confidence patterns can enhance the monitoring frequency of core associated anomalies and root cause nodes, increase their weight in the initial dependency graph, reduce ineffective monitoring, and improve the efficiency and accuracy of the dynamic acquisition process.

[0185] In summary, by reacquiring data using the adjusted strategy, generating an optimized causal weight matrix, correcting the correlation bias of the original matrix, and making the matrix more accurately represent causal relationships, we can provide higher quality data support for subsequent root cause analysis.

[0186] In summary, the optimization matrix generates a target root cause analysis report, obtains reliable results with the help of accurate causal data, and forms a closed loop of "analysis-feedback-optimization-reanalysis" to continuously improve the accuracy and efficiency of root cause analysis and avoid stagnation in analysis quality.

[0187] like Figure 2 The diagram shown is a functional block diagram of a root cause analysis system for edge gateway anomaly detection results provided in an embodiment of the present invention.

[0188] The root cause analysis system 100 for edge gateway anomaly detection results described in this invention can be installed in an electronic device. Depending on the functions implemented, the root cause analysis system 100 may include a weight matrix generation module 101, an anomaly adaptive threshold confirmation module 102, a root cause candidate set acquisition module 103, a sorting module 104, and a feedback report module 105. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, stored in the memory of the electronic device.

[0189] In this embodiment, the functions of each module / unit are as follows:

[0190] The weight matrix generation module 101 is used to dynamically obtain the causal dependency relationship between abnormal events and potential root causes in the abnormal detection result data under the operation state of the edge gateway, and obtain the causal weight matrix of the edge gateway.

[0191] The anomaly adaptive threshold confirmation module 102 is used to determine the anomaly adaptive threshold of the edge gateway in a sliding window based on the causal weight matrix and the historical anomaly pattern data of the edge gateway.

[0192] The root cause candidate set acquisition module 103 is used to apply the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix and obtain the root cause candidate set of the edge gateway.

[0193] The sorting module 104 is used to verify and prioritize the root cause candidate set to obtain the root cause analysis report of the edge gateway.

[0194] The feedback report module 105 is used to feed the root cause analysis report back to the weight matrix generation module, optimize the dynamic acquisition to obtain the causal weight matrix of the target edge gateway, and generate the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway.

[0195] In the several embodiments provided by this invention, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0196] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0197] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0198] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0199] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A root cause analysis method for edge gateway anomaly detection results, characterized in that, The method includes: S1. Dynamically acquire the causal dependencies between abnormal events and potential root causes in the anomaly detection result data during the operation of the edge gateway, and obtain the causal weight matrix of the edge gateway, including: Collect anomaly detection results data generated during the operation of the edge gateway; Noise and redundant information are removed from the anomaly detection result data to obtain the preprocessed data of the edge gateway; Using the abnormal events and potential root causes in the preprocessed data as nodes, and the dependency relationship between the abnormal events and the potential root causes as edges, an initial dependency graph of the edge gateway is constructed. The initial dependency weights of the dependency graph are dynamically adjusted based on the historical operational data of the edge gateway to obtain the causal weight matrix of the edge gateway, including: Based on the historical operation data, extract the historical occurrence patterns and association strength indicators of the dependency edges in the initial dependency graph; Based on the historical occurrence pattern and the association strength index, the dependency weights in the initial dependency graph are dynamically adjusted. The calculation formula for the dynamic adjustment is as follows: ； In the formula, The dependency weights are dynamically adjusted. The original dependency weights in the initial dependency graph. The historical occurrence frequency in the aforementioned historical occurrence pattern. This refers to the confidence factor in the association strength index that represents the true root cause and dependency relationship. The timeliness factor from the historical running data to the current running state is used. Frequency weighting As the confidence level weight, As a time-sensitive factor, It is an exponential function; The dynamically corrected initial dependency graph is converted into a matrix representation to obtain the causal weight matrix of the edge gateway; S2. In the sliding window, based on the causal weight matrix and the historical abnormal pattern data of the edge gateway, determine the abnormal adaptive threshold of the edge gateway; S3. Apply the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix to obtain the root cause candidate set of the edge gateway; S4. Verify and prioritize the root cause candidate set to obtain the root cause analysis report of the edge gateway; S5. Feedback the root cause analysis report to step S1 to optimize the dynamic acquisition, so as to obtain the causal weight matrix of the target edge gateway, and generate the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway.

2. The root cause analysis method for edge gateway anomaly detection results as described in claim 1, characterized in that, The step of determining the anomaly adaptive threshold of the edge gateway within the sliding window, based on the causal weight matrix and the historical anomaly pattern data of the edge gateway, includes: Set a time-dimensional sliding window to collect historical abnormal pattern data of the edge gateway within the sliding window; Based on the historical anomaly pattern data, extract the frequency distribution features of anomaly events and the weight distribution features of root cause nodes within the sliding window; The anomaly sensitivity of the current sliding window is evaluated based on the frequency distribution characteristics, the weight distribution characteristics, and the connection strength of the nodes in the causal weight matrix. The threshold baseline value of the edge gateway is dynamically adjusted based on the anomaly sensitivity to obtain the anomaly adaptive threshold of the edge gateway.

3. The root cause analysis method for edge gateway anomaly detection results as described in claim 2, characterized in that, The formula for calculating the anomaly adaptive threshold is as follows: ； In the formula, The abnormal adaptive threshold, The threshold reference value, This is the threshold adjustment coefficient. It is the hyperbolic tangent function. The abnormal sensitivity of the current sliding window. The sensitivity adjustment range factor is a predefined value. This is a preset sensitivity threshold.

4. The root cause analysis method for edge gateway anomaly detection results as described in claim 1, characterized in that, The application of the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix yields a root cause candidate set for the edge gateway, including: Traverse the root cause nodes in the causal weight matrix, and determine the comprehensive anomaly score of the root cause node based on the connection weight of the root cause node in the causal weight matrix and the length of the anomaly propagation path. Root cause nodes whose comprehensive anomaly score exceeds the anomaly adaptive threshold are selected as preliminary candidate nodes; Exclude isolated nodes and low-connectivity nodes from the initial candidate nodes; The excluded key root cause nodes are used to form the root cause candidate set of the edge gateway.

5. The root cause analysis method for edge gateway anomaly detection results as described in claim 1, characterized in that, The step of verifying and prioritizing the root cause candidate set to obtain the root cause analysis report of the edge gateway includes: Confirm the true causal relationship between the candidate root cause nodes in the root cause candidate set and the current abnormal event; When the true causal relationship is true, the scope of the impact of the candidate root cause node is assessed based on the number of edge services affected by the candidate root cause node and its business criticality. The priority of the candidate root cause nodes is determined by combining the scope of influence and the frequency of historical root cause recurrence in the historical anomaly pattern data. The nodes in the root cause candidate set are sorted according to the priority to obtain the root cause analysis report of the edge gateway.

6. The root cause analysis method for edge gateway anomaly detection results as described in claim 1, characterized in that, The step of feeding back the root cause analysis report to step S1, optimizing the dynamic acquisition to obtain the causal weight matrix of the target edge gateway, and generating the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway, includes: The verified root cause node information in the root cause analysis report is analyzed to extract high-confidence causal relationship patterns; Based on the causal relationship pattern, the dependency discovery strategy in the dynamic acquisition process is adjusted. The adjusted dependency discovery strategy is used to re-acquire the anomaly detection result data of the edge gateway in its running state, and the optimized causal weight matrix is ​​obtained. Based on the optimized causal weight matrix, a root cause analysis report for the target edge gateway is generated.

7. A root cause analysis system for edge gateway anomaly detection results, characterized in that, The system includes: The weight matrix generation module is used to dynamically obtain the causal dependencies between abnormal events and potential root causes in the anomaly detection result data under the operating state of the edge gateway, and to obtain the causal weight matrix of the edge gateway, including: Collect anomaly detection results data generated during the operation of the edge gateway; Noise and redundant information are removed from the anomaly detection result data to obtain the preprocessed data of the edge gateway; Using the abnormal events and potential root causes in the preprocessed data as nodes, and the dependency relationship between the abnormal events and the potential root causes as edges, an initial dependency graph of the edge gateway is constructed. The initial dependency weights of the dependency graph are dynamically adjusted based on the historical operational data of the edge gateway to obtain the causal weight matrix of the edge gateway, including: Based on the historical operation data, extract the historical occurrence patterns and association strength indicators of the dependency edges in the initial dependency graph; Based on the historical occurrence pattern and the association strength index, the dependency weights in the initial dependency graph are dynamically adjusted. The calculation formula for the dynamic adjustment is as follows: ； In the formula, The dependency weights are dynamically adjusted. The original dependency weights in the initial dependency graph. The historical occurrence frequency in the aforementioned historical occurrence pattern. This refers to the confidence factor in the association strength index that represents the true root cause and dependency relationship. The timeliness factor from the historical running data to the current running state is used. Frequency weighting As the confidence level weight, As a time-sensitive factor, It is an exponential function; The dynamically corrected initial dependency graph is converted into a matrix representation to obtain the causal weight matrix of the edge gateway; An anomaly adaptive threshold confirmation module is used to determine the anomaly adaptive threshold of the edge gateway in a sliding window based on the causal weight matrix and the historical anomaly pattern data of the edge gateway. The root cause candidate set acquisition module is used to apply the anomaly adaptive threshold to identify key root cause nodes in the causal weight matrix and obtain the root cause candidate set of the edge gateway. The sorting module is used to verify and prioritize the root cause candidate set to obtain the root cause analysis report of the edge gateway. The feedback report module is used to feed the root cause analysis report back to the weight matrix generation module, optimize the dynamic acquisition to obtain the causal weight matrix of the target edge gateway, and generate the target root cause analysis report of the target edge gateway based on the causal weight matrix of the target edge gateway.

Images