Log aggregation fault diagnosis method and system based on artificial intelligence

Abstract

The invention relates to the field of log fault analysis, in particular to a log aggregation fault diagnosis method and system based on artificial intelligence. The method comprises the following steps: collecting a multi-modal heterogeneous log, carrying out sliding time sequence slicing processing, carrying out time sequence association sequence reconstruction, and constructing a time sequence reconstruction log data stream; log event deep semantic analysis is carried out on the time sequence reconstruction log data stream, event semantic topological evolution is carried out, and a multi-dimensional event topological representation matrix is constructed; performing routine event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix, and marking abnormal fault points; and the occurrence timestamp and the abnormal propagation rate of the abnormal fault point are calculated, fault space-time diffusion evolution is carried out, and a dynamic fault propagation path map is constructed. Through efficient and accurate fault traceability analysis, the fault diagnosis efficiency is greatly improved, and the stability and reliability of log data are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of log fault analysis, and in particular to a log aggregation fault diagnosis method and system based on artificial intelligence. BACKGROUND

[0002] Traditional log fault diagnosis methods mostly rely on rule matching and manual experience, and it is difficult to achieve efficient and accurate fault detection and positioning in the face of large-scale, multi-source and multi-format log data. These methods usually require a lot of manual annotation and debugging, and are difficult to cope with dynamic changes in system environment and hidden complex fault patterns. At the same time, the noise and missing information in the log data also increase the difficulty of diagnosis, resulting in inaccurate fault root cause analysis results, affecting the stability and reliability of the system.

[0003] In recent years, the rapid development of artificial intelligence technology, especially machine learning and deep learning methods, has injected new vitality into log fault diagnosis. Through intelligent algorithms for automatic processing, feature extraction and pattern recognition of massive log data, the accuracy and response speed of fault detection can be effectively improved. Combined with time series analysis, multi-modal fusion and semantic understanding, artificial intelligence methods can mine complex correlations and time series dependencies hidden in logs, realize early warning and accurate positioning of faults. In addition, artificial intelligence methods have self-learning and self-adaptive capabilities, which can continuously optimize the diagnosis model to adapt to changing system environments and new fault types. However, the current log aggregation fault diagnosis based on artificial intelligence still faces many technical difficulties, including the fusion and unified processing of heterogeneous log data, the time synchronization and alignment of multi-source logs, the accurate mining of fault propagation paths, and the high confidence determination of root cause positioning. These problems restrict the practicality and popularization of intelligent fault diagnosis systems. Therefore, developing an efficient and intelligent log fault diagnosis method has become a key breakthrough to improve system reliability and intelligent level of operation and maintenance. SUMMARY

[0004] To solve the above technical problems, the present application provides a log aggregation fault diagnosis method and system based on artificial intelligence to solve at least one of the above technical problems.

[0005] To achieve the above purpose, the present application provides a log aggregation fault diagnosis method based on artificial intelligence, comprising the following steps: Collecting multi-modal heterogeneous logs, performing sliding time series slicing processing, and reconstructing time series correlation sequences to construct time series reconstructed log data streams; Performing log event deep semantic analysis on the time series reconstructed log data streams, and performing event semantic topology evolution to construct a multi-dimensional event topology representation matrix; Based on the multi-dimensional event topology characterization matrix, the regular event behavior analysis and abnormal fault mode inference are performed, and the abnormal fault point is marked; The occurrence timestamp and abnormal propagation rate of the abnormal fault point are calculated, the fault spatiotemporal diffusion evolution is performed, and a dynamic fault propagation path atlas is constructed; The dynamic fault propagation path atlas is back-propagated and backtracked, the root cause node confidence is calculated, and the fault root cause positioning node is marked; The fault trend evolution of the fault root cause positioning node is performed, the intelligent fault diagnosis optimization decision is made, and an intelligent fault disposal decision agent is constructed.

[0006] In the present specification, an artificial intelligence-based log aggregation fault diagnosis system is provided for performing the artificial intelligence-based log aggregation fault diagnosis method as described above, comprising: The association reconstruction module is used for collecting multi-modal heterogeneous logs, performing sliding time sequence slicing processing, and performing time sequence association sequence reconstruction to construct a time sequence reconstructed log data stream; The event semantic analysis module is used for performing log event deep semantic analysis on the time sequence reconstructed log data stream, and performing event semantic topology evolution to construct a multi-dimensional event topology characterization matrix; The fault mode inference module is used for performing regular event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology characterization matrix, and marking the abnormal fault point; The fault propagation path module is used for calculating the occurrence timestamp and abnormal propagation rate of the abnormal fault point, and performing fault spatiotemporal diffusion evolution to construct a dynamic fault propagation path atlas; The back-propagation and backtracking module is used for back-propagating and backtracking the dynamic fault propagation path atlas, calculating the root cause node confidence, and marking the fault root cause positioning node; The fault diagnosis optimization module is used for performing fault trend evolution on the fault root cause positioning node, making intelligent fault diagnosis optimization decisions, and constructing an intelligent fault disposal decision agent.

[0007] The beneficial effects of the present application are as follows: through the unified collection of multi-modal logs (such as text logs, system call logs, API call stacks, sensor streams, etc.), the log source islands can be broken, and more comprehensive system behavior perception can be achieved. The sliding time sequence slicing strategy ensures that effective state changes can be extracted under different time windows, effectively capturing the fine-grained evolution characteristics in the system running process. The time sequence correlation sequence reconstruction provides structured input based on event order and context dependence for subsequent semantic analysis, and is the premise of building causal and topological models. Deep semantic analysis can extract the behavior patterns, execution intentions and abnormal characteristics of events through NLP and Transformer models, improving the "understanding" ability of machines for log content. The semantic topology evolution model can link seemingly unrelated events into a directed graph structure, reflecting the potential dependence between events, and helping to identify latent faults. The multi-dimensional topology matrix integrates event types, semantic categories, module attribution, time sequence paths and other dimensions, and can more robustly handle log redundancy, missing or format disorder problems. The system can automatically identify abnormal patterns that deviate significantly from normal behavior distribution, reduce the dependence on artificial rules, and improve fault identification efficiency. Based on clustering, graph comparison learning and other methods, abnormal event points in high-dimensional topology are labeled, providing targets for subsequent propagation modeling and root cause analysis. The model has the ability to capture "edge anomalies" or gradual anomalies, which helps to realize early warning before system crash. By explicitizing the abnormal propagation path as a dynamic graph, it can clearly show how the fault spreads in the system, enhancing the understanding of the fault propagation mechanism for engineers. Abnormal propagation speed calculation helps to distinguish between "explosive" and "chronic" faults, providing quantitative basis for selecting intervention strategies (rapid isolation vs. continuous monitoring). Each path in the graph represents a potential causal chain, forming a key link set that supports subsequent root cause positioning. Based on graph backtracking mechanisms (such as Graph Backtracking, probabilistic backtracking path search), the source of the anomaly can be traced back from the abnormal result to locate the initial event that caused the fault. The confidence score mechanism of the root cause node is based on multi-path consensus, propagation influence, semantic confidence interval and other indicators, improving the scientificity and persuasiveness of fault positioning. Precise identification of root cause nodes reduces unnecessary system changes or interventions, and reduces the risk of misoperation in operation and maintenance. Combined with time series prediction and evolution graph model, the evolution of the fault if not handled can be simulated, guiding early intervention. By training decision-making agents based on reinforcement learning or causal reasoning, the optimal disposal strategy (such as traffic isolation, micro-service degradation, resource rescheduling, etc.) can be automatically formulated. The intelligent agent has self-learning and strategy feedback mechanisms, continuously optimizing diagnosis accuracy and disposal efficiency, forming a continuously evolving intelligent operation and maintenance closed-loop system (AIOps). BRIEF DESCRIPTION OF DRAWINGS

[0008] Figure 1A step flow diagram of a log aggregation fault diagnosis method based on artificial intelligence according to the present application is shown in the figure; Figure 2 A detailed implementation step flow diagram of step S1 is shown in the figure; Figure 3 A detailed implementation step flow diagram of step S2 is shown in the figure; Figure 4 A detailed implementation step flow diagram of step S3 is shown in the figure. DETAILED DESCRIPTION

[0009] It should be understood that the specific embodiments described herein are merely intended to explain the present application and are not intended to limit the present application.

[0010] The present application provides a log aggregation fault diagnosis method and system based on artificial intelligence. The execution subject of the log aggregation fault diagnosis method based on artificial intelligence includes but is not limited to mechanical equipment, a data processing platform, a cloud server node, a network upload device, etc., which can be regarded as a general computing node of the present application, and the data processing platform includes but is not limited to at least one of an audio image management system, an information management system, and a cloud data management system.

[0011] Please refer to Figures 1 to 4 The present application provides a log aggregation fault diagnosis method based on artificial intelligence, which includes the following steps: Collecting multi-modal heterogeneous logs, performing sliding time sequence slicing processing, reconstructing time sequence correlation sequences, and constructing time sequence reconstructed log data streams; Performing log event deep semantic analysis on the time sequence reconstructed log data streams, performing event semantic topology evolution, and constructing a multi-dimensional event topology representation matrix; Performing regularized event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix, and marking abnormal fault points; Calculating the occurrence timestamp and abnormal propagation rate of the abnormal fault points, and performing fault spatiotemporal diffusion evolution to construct a dynamic fault propagation path atlas; Performing reverse propagation backtracking on the dynamic fault propagation path atlas, and performing root cause node confidence calculation to mark fault root cause positioning nodes; Performing fault trend evolution on the fault root cause positioning nodes, and performing intelligent fault diagnosis optimization decision to construct an intelligent fault disposal decision intelligent agent.

[0012] In the embodiment of the present application, please refer to Figure 1 A step flow diagram of a log aggregation fault diagnosis method based on artificial intelligence according to the present application is shown in the figure; Collecting multi-modal heterogeneous logs, performing sliding time slicing processing, and reconstructing time-correlated sequences to construct time-reconstructed log data streams; In this embodiment, multi-modal heterogeneous log collection is the basic link of the fault diagnosis system, involving the collection of log data from different sources and different formats of system components. In actual implementation, the system needs to process structured logs (such as database transaction logs), semi-structured logs (such as JSON format application logs), and unstructured logs (such as free text format system error logs) simultaneously. The collection process adopts a distributed log collection architecture, deploying log agents on each monitoring node to collect local log data in real time. The sliding time slicing processing adopts a fixed time window strategy, setting the time window size to 300 seconds and the sliding step to 60 seconds to ensure the continuity and overlap of time series data. For high-frequency systems, the time window can be adjusted to 30 seconds to capture finer-grained time series changes. In the time-correlated sequence reconstruction process, the system sorts and aligns multi-source logs based on timestamps, handles timestamp precision differences, and unifies the time reference to millisecond-level UTC time. Through time interpolation algorithms, missing time point data is processed using linear interpolation or cubic spline interpolation methods to ensure the integrity of time series data. The final time-reconstructed log data stream contains timestamp, event type, source system identifier, event content, and other key fields, and the data stream processing rate can reach 100,000 log records per second.

[0013] Performing log event deep semantic analysis on the time-reconstructed log data stream and event semantic topology evolution to construct a multi-dimensional event topology representation matrix. In this embodiment, the log event depth semantic analysis adopts natural language processing technology based on pre-trained language models, combined with domain-specific knowledge base for semantic understanding. The system first preprocesses the log text, including removing special characters, standardizing time format, extracting keywords, etc. Pre-trained models such as BERT or RoBERTa are used to encode the log content, generating a 768-dimensional semantic vector representation. Through fine-tuning technology, the model is trained on labeled data in a specific domain to improve the accuracy of semantic understanding, achieving a semantic classification accuracy of 92% on the test set. The event semantic topology evolution process constructs a correlation graph between events, and the cosine similarity between event vectors is calculated to identify related events, with a similarity threshold of 0.85. The system uses graph neural networks (GNN) to model event relationships, with nodes representing events and edges representing the strength of the relationship between events. Through multi-layer graph convolution operations, high-order correlation relationships between events are captured, with 3 layers of network and 256 hidden layer dimensions. The final multi-dimensional event topology representation matrix has dimensions N x M x K, where N represents the number of events, M represents the topology feature dimension, and K represents the number of time slices. Each element in the matrix represents the topology feature value of a specific event at a specific time slice, with a value range normalized to 0-1.

[0014] Based on the multi-dimensional event topology representation matrix, regular event behavior analysis and abnormal fault mode inference are performed to mark abnormal fault points. In this embodiment, the regular event behavior analysis establishes a baseline model based on historical normal operation data, and uses statistical methods and machine learning algorithms to identify normal event patterns. The system collects at least 30 days of historical normal operation data as the training set, containing more than 5 million log records. Through principal component analysis (PCA), the multi-dimensional event topology representation matrix is reduced in dimension, retaining 95% of the variance information, and reducing the feature dimension from 256 to 64. A normal behavior baseline based on a Gaussian mixture model is established, with model parameters including mean vector, covariance matrix, and mixing weight, and parameter estimation is performed through the expectation-maximization algorithm. Abnormal fault mode inference uses an integrated method of multiple anomaly detection algorithms, including statistical-based anomaly detection, machine learning-based anomaly detection, and deep learning-based anomaly detection. The statistical method uses the 3σ principle to mark data points that exceed the mean ± 3 times the standard deviation as abnormal, and the detection threshold is dynamically adjusted according to the specific index. The machine learning method uses the Isolation Forest algorithm, with an abnormality ratio of 5%, and through random sampling and feature selection to build decision trees, with an abnormal score threshold of 0.6. The deep learning method uses an autoencoder network, with the encoder and decoder being 3-layer fully connected networks, and the number of hidden layer neurons being 128, 64, and 32 respectively, with a reconstruction error threshold of 0.1. Finally, the detection results of multiple algorithms are integrated through a voting mechanism, and when at least two algorithms determine that it is abnormal, the system marks the event as an abnormal fault point.

[0015] The occurrence timestamp of the abnormal fault point and the abnormal propagation rate are calculated, and the fault space-time diffusion evolution is performed to construct a dynamic fault propagation path atlas; In this embodiment, the occurrence timestamp of the abnormal fault point is calculated based on event timing analysis, and the earliest occurrence time of the fault is determined through backtracking analysis. The system uses a change point detection algorithm to identify mutation points in time series data, uses the CUSUM (Cumulative Sum) method to detect mean changes, and sets the detection threshold to 5 times the standard deviation. The abnormal propagation rate is calculated based on the time difference and physical distance between adjacent nodes. The propagation rate is defined as the expansion speed of the abnormal influence range per unit time, usually in units of nodes / minute. In network topology, the propagation rate is affected by network bandwidth, processing capacity, business load and other factors, and the typical value is between 10-50 nodes / minute.

[0016] The fault space-time diffusion evolution adopts a propagation model based on graph theory, which abstracts the system architecture as a directed graph, with nodes representing system components and edges representing dependency relationships. The propagation process follows the SIR (Susceptible-Infected-Recovered) model, with an infection rate β = 0.3 and a recovery rate γ = 0.1. The fault propagation process is simulated through Monte Carlo simulation, with 1000 simulation experiments run, and the probability distribution of the propagation path is calculated. The dynamic fault propagation path atlas records the influence range and propagation direction of the fault at different time points along the time axis. The atlas contains node state information (normal, abnormal, recovered), edge weight information (propagation probability, propagation delay) and timestamp information. The atlas is updated once every minute to ensure real-time and accuracy.

[0017] The dynamic fault propagation path atlas is backpropagated and backtracked, and the root cause node confidence is calculated to mark the fault root cause positioning node; In this embodiment, the reverse propagation backtracking of the dynamic fault propagation path atlas uses a reverse graph search algorithm, which starts from the known fault symptom node and traces possible fault sources in the opposite direction of the dependency relationship. The algorithm uses a breadth-first search strategy, with a maximum backtracking depth of 10 layers to avoid getting stuck in an infinite loop in a complex network. During the backtracking process, the system calculates the influence weight of each potential root cause node, which is based on the out-degree, historical fault frequency and business importance of the node.

[0018] The root cause node confidence calculation adopts a Bayesian inference framework and combines multiple evidence sources for probability inference. The confidence calculation considers three dimensions of time correlation, spatial correlation and semantic correlation. The time correlation is based on the chronological relationship of fault occurrence time. The smaller the time difference, the stronger the correlation. The correlation function is exp(-λt), where λ=0.1. The spatial correlation is based on the network topology distance. The shortest path algorithm is used to calculate the distance between nodes. The closer the distance, the stronger the correlation. The semantic correlation is based on the semantic similarity of event content. The cosine similarity is used for calculation. The final confidence is calculated by weighted average. The time correlation weight is 0.5, the spatial correlation weight is 0.3, and the semantic correlation weight is 0.2. The confidence threshold is set to 0.8. Nodes exceeding the threshold are marked as fault root cause positioning nodes.

[0019] The fault trend evolution of the fault root cause positioning node is performed, and intelligent fault diagnosis optimization decision is made to construct an intelligent fault handling decision agent.

[0020] In this embodiment, the fault trend evolution analysis of the fault root cause positioning node adopts a time series prediction model to predict the future fault development trend based on historical fault data. The system uses an LSTM (Long Short Term Memory) model for time series prediction. The network structure contains 2 layers of LSTM layers, each layer has 128 neurons, and the dropout rate is set to 0.2 to prevent overfitting. The training data includes fault data from the past 6 months, with a time step of 24 hours, and the fault development trend is predicted for the next 72 hours. The MAPE (Mean Absolute Percentage Error) of the model on the validation set is 8.5%, meeting the actual application requirements. The trend prediction result includes key indicators such as fault severity, impact range, and duration.

[0021] The intelligent fault diagnosis optimization decision is based on a reinforcement learning algorithm to construct an intelligent decision agent. The agent uses a DQN (Deep Q Network) architecture. The state space includes the current state of the system, fault type, resource usage, and other 128-dimensional feature vectors. The action space includes restarting services, switching to backup systems, increasing resource allocation, and manual intervention, etc. 12 kinds of disposal actions. The reward function design considers the disposal effect, disposal cost and disposal time comprehensively, and the reward value ranges from -100 to 100. The agent is trained by interacting with the simulation environment. The cumulative training episodes reach 10,000 times, and the optimal strategy is finally converged. The intelligent fault handling decision agent constructed can give disposal suggestions within 5 seconds, and the disposal success rate reaches more than 85%. The agent also has the ability of continuous learning, which can continuously optimize the decision strategy through online learning and adapt to changes in the system environment.

[0022] In this embodiment, reference is made to Figure 2For the collection of multi-modal heterogeneous logs, sliding time slice processing is performed, and time correlation sequence reconstruction is performed to construct a detailed implementation step flow diagram of a time reconstruction log data stream. In this embodiment, the collection of multi-modal heterogeneous logs, sliding time slice processing, and time correlation sequence reconstruction are performed to construct a detailed implementation step of a time reconstruction log data stream. The detailed implementation steps include: Collecting multi-modal heterogeneous logs; defining equal-length log segment division timestamps, and performing sliding time slice processing on the multi-modal heterogeneous logs to obtain a plurality of time period heterogeneous log sequences; Identifying system information of the multi-modal heterogeneous logs, and performing time format analysis to extract the timestamp standard of each system; According to the timestamp standard, cross-system time reference calibration processing is performed to obtain a unified time standard; Fitting the time deviation between logs for a plurality of time period heterogeneous time sequences to obtain a plurality of time deviation curves between logs; Based on the unified time standard and the plurality of time deviation curves between logs, time deviation elimination is performed to obtain a time reference heterogeneous log sequence; Performing time correlation sequence reconstruction on the time reference heterogeneous log sequence to construct a time reconstruction log data stream.

[0023] In this example, in modern distributed systems, microservice architectures, or large information infrastructures, the logs generated by system components have the characteristics of multi-modal (such as structured JSON logs, semi-structured text logs, and index type time series data) and heterogeneity (different platforms, operating systems, databases, middleware, etc.). When collecting these logs, full consideration should be given to their source, format, collection method, and transmission delay, etc. Usually, log collection agents (such as Filebeat, Fluentd, Telegraf) are deployed on each node of the system to achieve non-invasive collection of multi-modal logs, and preliminary aggregation is performed through a stream processing engine such as Kafka. The collected logs are stored in a structured database or time series database (such as Elasticsearch, InfluxDB) with auxiliary information such as source system identification, timestamp, log level, etc. In order to better support subsequent time series analysis and modeling operations, the original logs need to be sliced according to time order. Here, a fixed length time window (such as 60 seconds) is defined, and a sliding step (such as 30 seconds) is set to slice the logs continuously. This method can form overlapping log sequence segments on the time axis, and each segment represents a potential system running snapshot. The sliding window method not only improves the coverage of log data, but also enhances the robustness of the model in the training and identification process. In the experimental environment, data from five log formats from three platforms (Linux system, Docker container, MySQL database) are collected, and the time window is set to 60 seconds and the step is set to 20 seconds. Finally, about 40,000 heterogeneous log sequence segments are obtained for subsequent processing modules. Because the timestamp formats used by different systems in log recording are different, directly performing time series analysis on the logs will cause alignment errors and even serious causal chain confusion. Therefore, before performing unified time alignment, it is necessary to first identify the timestamp information of each log source system. This process involves two sub-tasks: one is to identify the system to which the log belongs and its clock characteristics, and the other is to parse and standardize the timestamp embedded in the log.

[0024] The system identification part is usually implemented based on log metadata (e.g., hostname, service name, deployment tag) and file path information. For example, when using Fluentd to collect logs, the source system can be distinguished by the tag field. In terms of time format parsing, a time extractor needs to be designed for different log formats. For example, for standard syslog type logs, a regular expression can be used to extract the time field in the form of "Jan 10 12:32:14"; while for JSON structured logs, the timestamp field can be directly accessed. Some logs may use Unix timestamps or millisecond offsets, which need to be converted by referring to the system startup time or call stack context. In order to standardize the timestamps of all logs, a unified format (such as ISO 8601: YYYY-MM-DDTHH:MM:SS.sssZ) is used for conversion, and the original time format, time zone information and system time drift status of each log source system are recorded. In the experimental setup, 8 different timestamp formats were extracted from 5 system logs. Through comparative analysis, it was found that two of the systems did not enable NTP synchronization, causing a maximum deviation of ±2.7 seconds. For this situation, a system-level NTP verification tool is used to confirm the error, and a corresponding relationship is established between each log format and the UTC time standard, providing a basis for subsequent calibration processing. Through offset calculation, event anchor matching and other methods, all log entries are mapped to a unified time reference, usually using Coordinated Universal Time (UTC) as the unified time axis. In a multi-system environment, factors that affect the accuracy of log time alignment include: system clock drift, NTP synchronization failure, time format error and network delay, etc. Therefore, cross-system time calibration generally includes two stages: coarse-grained time alignment and fine-grained drift correction.

[0025] In the coarse-grained alignment phase, the time offset of each system from UTC is first determined based on the system configuration file (e.g., / etc / ntp.conf) or the time synchronization log. If the offset is small (e.g., ±500 ms), the timestamp can be corrected by a fixed offset; if the offset is large or the system has significant drift, further dynamic correction is needed. In the fine-grained correction phase, time anchors are extracted by analyzing co-occurring events across system logs, such as key actions like the start of a distributed transaction, heartbeat signals, and node registration. The time difference between these anchor events is calculated, resulting in a dynamic offset curve between systems. To further improve time consistency, the time error between different log sources needs to be continuously modeled, resulting in a fitted curve of the time offset between systems. This process establishes a time drift model between each pair of systems by fitting the time difference between them over multiple time periods, allowing the offset between system logs to be dynamically corrected. Cross-system co-occurring events are extracted from the log sequences after sliding slicing, and the difference in their occurrence times is recorded. For example, for the same transaction event, the timestamps recorded in the Redis and PostgreSQL systems may be T(1) and T(2), respectively, and their time offset is ΔT = T(2) - T(1). In this way, a data sequence with time as the horizontal axis and offset value as the vertical axis can be constructed. Then, a smooth time offset curve is fitted using polynomial fitting, cubic spline interpolation, or moving average methods. To address nonlinear system drift, dynamic time warping (DTW) or Kalman filtering methods can also be introduced to improve the accuracy and robustness of time alignment.

[0026] A set of 4000 cross-system transaction log pairs was selected to build a bias sample set between 3 groups of systems. By performing cubic spline interpolation on the time difference values, a time bias variation curve was fitted, with the fitting residual RMS controlled within 80ms. Especially during periods of high system load, this curve model can dynamically adjust the offset value, effectively avoiding the alignment distortion problem caused by traditional fixed calibration methods. This provides an accurate drift correction reference for subsequent timestamp de-biasing processing. By mapping the log timestamps of each system to a unified time reference (such as the UTC timeline), a set of globally consistent and time-accurate heterogeneous log sequences is generated, ensuring the accuracy of subsequent causal reasoning and AI diagnosis. For each log record, according to its system identification, the corresponding time bias fitting function f(t) is found, and then the original timestamp t is corrected to t_corrected =t - f(t). To ensure batch processing efficiency, the bias function is implemented using a combination of lookup table and linear interpolation, achieving millisecond-level correction performance on batch log data. The corrected logs are reordered with UTC time as the primary key, and the mapping relationship between the original system time and the corrected time is recorded, facilitating later backtracking analysis and verification. Through correlation analysis and context modeling, the time sequence dependency relationships such as business causal link, operation flow direction, and fault propagation path between logs are identified. The reconstructed time sequence log data stream can be used to drive artificial intelligence models for anomaly detection, root cause positioning, or automated diagnosis. The implementation of this process usually includes three key steps: first, log event recognition, which converts log entries into structured event representations through template extraction, semantic classification, or text embedding; second, event aggregation, which merges multiple log entries based on time proximity, context information, or system topology to form complete behavior links; third, dependency relationship construction, which analyzes the trigger, causal, or concurrent relationships between events to build log causal graphs or time sequence graph models. This process can be assisted by domain knowledge (such as service call graphs, network topology information) for optimization, or use sequence modeling methods (such as Transformer, LSTM) to automatically learn event dependency structures.

[0027] In the embodiment, the specific steps of reconstructing the time reference heterogeneous log sequence into a time sequence event sequence and constructing a time sequence reconstructed log data stream are as follows: Quantitative calculation of time sequence correlation between different logs under multiple time delays is performed to obtain the time sequence correlation degree between different logs; According to the time sequence correlation degree, the dependency relationship between log sources is analyzed, and the time sequence dependency relationship of different log sources is extracted; According to the time sequence dependency relationship, the alignment direction of multiple log sequences is mined to obtain the time sequence dependency path; The time reference heterogeneous log sequences are reconstructed into time event sequences based on time-dependent paths, and a time-reconstructed log data stream is constructed.

[0028] In this embodiment, a maximum time delay window range (e.g. ±10 seconds) is set, and the event time sequences between different log sources are aligned in the window. The event coincidence degree or mutual information index under different delays is compared in turn through a sliding window. For example, the time-lagged mutual information, the lagged Pearson correlation, or the co-occurrence density method can be used to calculate the association strength of each pair of log sources under different time delays. In actual operation, the event strength vector or embedding representation of each pair of log sequences is constructed, and convolution comparison is performed within the set delay range. Each delay value corresponds to an association score, and a "time association spectrum diagram" between the log sources can be drawn to quantify their time response relationship. Finally, a three-dimensional association matrix is output: log source pair × delay value × association degree, which is used to depict the log behavior synchronization characteristics and mutual response relationship in a complex system. The most significant delay window and its corresponding maximum association value are extracted from the time delay association spectrum diagram as the "optimal dependent delay" between the log sources. Subsequently, a reasonable dependence threshold (e.g. association degree greater than 0.6) is set to filter out statistically significant strong dependence pairs. Here, methods such as Granger causality test, transfer entropy calculation, and maximum information coefficient (MIC) can be combined to model the nonlinear and asymmetric causal relationship between multiple log sources.

[0029] In terms of structure construction, a directed graph structure can be used to represent the log dependency relationship, where the nodes represent log sources and the edges represent directional time sequence dependencies, and the weight of the edge is the maximum correlation degree under the corresponding delay. This graph structure can be regarded as a temporal dependency graph of the log system, reflecting the transmission mechanism and behavior driving logic of the log sources in the time sequence. This graph will serve as an important basis for subsequent path mining and sequence reconstruction, supporting system-level causal relationship analysis and behavior trajectory identification. Path search and priority sorting are performed on the temporal dependency graph. Weighted directed traversal algorithms such as weighted breadth-first search and Dijkstra's shortest dependency path can be used to identify high-weight paths in the graph from the source log source to the target log source, i.e., high-frequency and strongly correlated behavior propagation chains. For multi-source dependency cases, path branching, merging, and loop structures also need to be considered, and graph decomposition or path merging techniques can be used to simplify the dependency graph. To ensure the temporal validity of the path, time consistency constraints need to be introduced to accumulate the dependency delay at each hop on the path and exclude false paths that violate the time sequence principle. The final path structure is the temporal alignment direction chain between multiple log sequences, reflecting the module call, data transfer, or fault propagation process in the actual operation of the system. These paths not only provide a structural framework for log sequence reconstruction, but also provide logical support for fault root cause location and abnormal source analysis.

[0030] By combining the temporal dependency path and the unified time reference log sequence, the log data can be processed for temporal event reconstruction, forming a complete and logically continuous temporal reconstructed log data stream. This process aims to restore one or more structured and causally explicit event trajectories from distributed and heterogeneous log fragments for use by artificial intelligence models for anomaly detection, root cause analysis, and behavior prediction. The reconstruction process can be divided into three stages: event mapping, path fusion, and sequence generation. First, according to the temporal dependency path, log entries are mapped to the path nodes they belong to, forming preliminary event stream fragments. Then, the log entries in all paths are time-aligned, and the unified timestamp order and path order are used for fusion. At this time, the problem of event overlap, conflict, and redundancy in multiple paths needs to be solved, and graph compression techniques or path fusion rules can be used to merge duplicate nodes and optimize the sequence structure. The log sequence is reordered according to the temporal logic to generate a sequence output that strictly follows the dependency structure. The final reconstructed log data stream not only has global time consistency but also reflects the driving relationship between events and the business logic context, and can be used as input sequences for artificial intelligence models, such as training Transformer, LSTM, and other models for system behavior modeling or anomaly prediction. The reconstructed data stream can also be used for visual analysis, event playback, and online monitoring systems, providing end-to-end fault explainability support for high-complexity systems.

[0031] In this embodiment, refer to Figure 3 , the detailed implementation step flow diagram of the log event deep semantic analysis on the time series reconstructed log data stream and the event semantic topology evolution and the construction of the multi-dimensional event topology representation matrix, in this embodiment, the detailed implementation step of the log event deep semantic analysis on the time series reconstructed log data stream and the event semantic topology evolution and the construction of the multi-dimensional event topology representation matrix includes: The log event deep identification is performed on the time series reconstructed log data stream, and all log event information is extracted; The log event information is subjected to deep semantic analysis and semantic vectorization coding, and a high-dimensional semantic feature vector sequence is generated; The high-dimensional semantic feature vector sequence is subjected to upper and lower semantic correlation modeling, and deep semantic correlation features between events are constructed; Based on the deep semantic features between events, a key semantic conversion node analysis is performed, and the semantic conversion node is marked; Based on the semantic conversion node, node embedding learning is performed, and event semantic topology evolution is performed to construct a multi-dimensional event topology representation matrix.

[0032] In this embodiment, first, the log text is subjected to syntax analysis and preprocessing, such as word segmentation, denoising, and punctuation standardization; then, through event template matching, regular extraction or BERT-based sequence labeling model (such as BERT-BiLSTM-CRF), the operation verbs, resource entities, state variables and the like in the log entries are structured extracted; further, the named entity recognition (NER) technology can be introduced to identify the entities such as service name, interface, container, node or exception code involved in the log. In a multi-modal environment, time series indicators, JSON structure logs, system call stacks and other non-text data also need to be parsed and abstracted into event types. Through this step, the original time-ordered log data stream is converted into a standardized log event sequence, each event has clear type (such as start, connect, IO failure, timeout, retry), entity, parameter and timestamp attributes, etc. to provide a clear input basis for subsequent semantic modeling, causal analysis and behavior prediction. The semantic embedding of each event text is processed. Common methods include: using pre-trained language models (such as BERT, RoBERTa, LogBERT) to model the context of the log event text and obtain the context-aware semantic vector of the event; or using word embedding model (such as word2vec, GloVe) + event structure field splicing to generate fusion vector. For logs with structured parameters, the parameter type, value, upstream and downstream services and other auxiliary attributes need to be encoded as discrete or continuous features and spliced into the event vector to ensure that the structure and semantic information jointly represent the event features.

[0033] All events are encoded into a set of high-dimensional semantic feature vector sequences arranged in time series, each vector dimension covering event type, contextual semantics, field content, entity label, and other extended features. This semantic vector sequence provides a deep language understanding feature space for subsequent AI tasks such as sequence modeling, dependency mining, and anomaly detection, effectively supporting the model's ability to learn the potential semantic logic and causal behavior between events. Use context modeling deep sequence networks (such as Bi-LSTM, GRU, Transformer) to model semantic vector sequences, capture semantic dependencies between distant events; or use attention mechanism (self-attention) to construct alignment weight matrix between events, to identify which events have semantic activation or pattern association. In addition, for the possible nonlinear or conditional transition relationship in the log event sequence, the Conditional Event Graph method can be introduced to map the semantics between events into a traversable graph structure and encode its path relationship. After modeling, each event vector will carry its context interaction representation with other events, forming a set of deep semantic association features with time, semantic, and structural perception. These features not only reflect the semantic state of the event itself, but also express its semantic position, influence range, and propagation mechanism in the overall log behavior sequence, which is the core support information for subsequent node identification and structure modeling.

[0034] After identifying the deep semantic structure between events, it is necessary to identify and mark the key nodes in the semantic flow that play a "turning" and "conversion" role. The goal of this step is to locate the event nodes that play a role in direction transformation, state switching, and behavior transition in the semantic space by analyzing the distribution changes of semantic feature flow, i.e., the so-called key semantic conversion nodes. These nodes usually correspond to system state changes, behavior chain breaks, and abnormal propagation starting points, and are the core positions in log-driven fault analysis. The implementation path mainly includes two methods: one is vector change rate analysis, which calculates the gradient value or direction angle change of the difference between the previous and subsequent vectors in the event vector sequence, and the significant mutation is identified as a semantic transition point; the second is a semantic importance scoring mechanism based on the attention mechanism, which focuses on high-impact events through attention distribution, and further combines event context change information to evaluate the structural position of events in the overall semantic graph. It can also analyze the edge weight jump and node connection degree in the event semantic graph by combining graph partitioning algorithms (such as community detection, spectral clustering) to extract key nodes at semantic breaks. All identified semantic conversion nodes will be explicitly marked and attached with their position index in the event sequence, context weight distribution, and semantic influence range. These nodes, as the backbone points of the log semantic structure, connect different semantic stages before and after, and are the key entry points for anomaly detection, causal chain extraction, and behavior evolution analysis.

[0035] The semantic conversion node is taken as an anchor point to construct an event semantic graph, in which nodes are log events and edges represent semantic correlation strength. An attention-based graph construction method can be used to define edge weights, for example, a context vector similarity between event pairs or a time-semantic hybrid distance function in an event stream is used for calculation. Then, a graph neural network (such as GCN, GraphSAGE, GAT) is used for node embedding learning, and each event node is represented as a low-dimensional vector while retaining its topological position and semantic state information in the entire graph structure. Further, by learning and aggregating the substructure, community and path of the graph, a multi-dimensional topological representation matrix can be constructed. The matrix integrates the semantic features, time sequence, dependency structure, path connectivity and other multi-dimensional features of events, and is the global topological encoding result of the log system. This representation form can be used to train AI models for complex behavior modeling and prediction, and can also be directly used for visual analysis, behavior pattern comparison and abnormal evolution path playback, and is one of the core data structures for building intelligent operation and maintenance and fault diagnosis systems.

[0036] In this embodiment, reference is made to Figure 4 The detailed implementation step flow diagram of the multi-dimensional event topological representation matrix for normalizing event behavior analysis and abnormal fault mode inference and marking abnormal fault points, in this embodiment, the detailed implementation steps of the multi-dimensional event topological representation matrix for normalizing event behavior analysis and abnormal fault mode inference and marking abnormal fault points include: Perform normalizing event behavior analysis based on the multi-dimensional event topological representation matrix to obtain normalizing time behavior features; Model the normalizing time behavior features to obtain a normalizing behavior baseline; Perform full-process behavior abnormality deviation detection on the multi-modal heterogeneous log based on the normalizing behavior baseline, and perform periodicity quantification to obtain a behavior deviation degree index within a time period; Infer an abnormal fault mode based on a preset normal behavior deviation threshold for the behavior deviation degree index, and mark abnormal fault points.

[0037] In this embodiment, the node embedding and edge weight features in the topology matrix are statistically described, and the distribution rule and stability index of event behavior in time are calculated. The sliding time window technology (such as 1 hour or 1 day window, which is adjusted according to the characteristics of the system) is used to sample and calculate the statistical quantities of event features, such as mean, variance, peak frequency, etc., to form the time series description of behavior. Further, principal component analysis (PCA) or independent component analysis (ICA) is used to reduce the dimension of the multi-dimensional feature space, eliminate redundant or weakly correlated features, and focus on the main behavior patterns. For the structural features in the topology matrix, the time sequence stability of the topological relationship between events can be quantified by calculating the node degree distribution, the clustering coefficient of the graph, the path length distribution, and other network indicators. Combined with time series analysis techniques (such as autocorrelation function, power spectrum analysis), the periodicity and trend characteristics of behavior are captured. The distribution of normal behavior features is fitted by statistical learning methods. Common methods include Gaussian mixture model (GMM) for modeling the probability distribution of multi-peak behavior patterns, or kernel density estimation (KDE) for non-parametric distribution estimation, to capture the complex distribution form of behavior features. For the time dynamic characteristics of different features, time-dependent dynamic behavior benchmarks can be established by combining time series probability models (such as hidden Markov model HMM, time series Bayesian network). To further improve the generalization ability and robustness of the model, outlier removal techniques (based on box plot, three times standard deviation principle) can be used to remove abnormal data during training, to ensure that the benchmark accurately reflects the normal behavior. Finally, the normal behavior benchmark exists in the form of probability distribution, which clearly defines the normal fluctuation range of behavior features, provides a threshold judgment basis for real-time behavior monitoring, and realizes the probability evaluation of future observed behavior.

[0038] The newly collected logs are converted into multi-dimensional behavior features through the aforementioned semantic analysis and topology characterization process, and are compared with the baseline distribution in real time. The likelihood probability of the new observed behavior features is calculated using probability density estimation, and if it is significantly lower than the normal probability threshold, it is determined that there is an abnormal deviation. In order to measure the strength and persistence of the behavior deviation, the system uses the cumulative deviation integral calculation within a sliding time window, combined with the deviation degree of the behavior features (such as Z-score deviation) and the time span, to form a quantitative behavior deviation index. For example, the abnormal intensity index of the time period is calculated by calculating the behavior deviation cumulative amount within an hour window. Combined with the deviation fusion strategy between multi-modal data sources (such as weighted average, Bayesian fusion), the accuracy and noise resistance of the deviation detection are improved. The output result is the behavior deviation degree index in multiple time periods (such as hours, days, weeks), reflecting the abnormal risk level of the system at different time granularities. According to actual system experience or historical data analysis, set the threshold of the behavior deviation index, such as the deviation index exceeding 0.8 is considered as high-risk abnormality, and exceeding 0.95 is judged as serious failure. The system compares the behavior index with the threshold in real time, and automatically triggers abnormal alarm. Further, combined with the multi-threshold hierarchical alarm mechanism, the abnormality can be divided into warning, secondary failure, serious failure and other levels. In order to improve the accuracy of fault mode inference, a rule-based inference engine or a machine learning-based classifier (such as random forest, support vector machine) can also be introduced to classify the abnormal types using the behavior deviation index and its time evolution features. The system marks the abnormal fault points on the time series, associates the corresponding log events and semantic structures, and forms a complete fault event link.

[0039] In the embodiment, the specific steps of calculating the occurrence timestamp of the abnormal fault point and the abnormal propagation rate, and performing fault spatio-temporal diffusion evolution, and constructing a dynamic fault propagation path atlas are as follows: Calculate the occurrence timestamp of the abnormal fault point and the abnormal propagation rate; Perform fault impact range analysis according to the occurrence timestamp and the fault propagation rate to obtain the fault impact range; Based on the fault impact range, perform spatial propagation path mining to obtain a fault propagation path set; Perform fault path confidence calculation on the fault propagation path set, and perform fault relationship verification to extract real fault propagation links; Based on the real fault propagation links, perform fault state transition probability analysis to obtain the inter-system fault state transition probability; Based on the inter-system fault state transition probability, perform fault wave propagation boundary analysis, and perform fault spatio-temporal diffusion evolution to construct a dynamic fault propagation path atlas.

[0040] In this embodiment, the timestamp corresponding to the marked abnormal failure point log event is accurately extracted under the unified time standard, ensuring accurate synchronization of cross-system log time. The timestamp identifies the earliest time of failure occurrence as the starting node of the propagation chain. The calculation of abnormal propagation rate relies on the time difference and spatial distance of the fault from the initial point to other systems or components. By analyzing the timestamp sequence of multiple failure nodes, combined with system topology information (such as service dependency, network connection topology), the propagation time interval between adjacent failure nodes is calculated. Using the ratio of timestamp difference and topological distance between nodes on the propagation path, the numerical expression of fault propagation rate is obtained. To improve the accuracy of the propagation rate, a weighted average propagation speed model can be used, considering different link bandwidths, service delays, and other factors to give different weights. In addition, the time resolution of the propagation rate is controlled by a sliding time window to capture the dynamic changes in the rate during the propagation process. This step provides a quantitative basis for subsequent propagation path modeling and impact range assessment. Considering the fault propagation as a dynamic propagation process in the system topology space, combined with the propagation rate, the set of nodes that may be affected by the fault within a certain time period is calculated. The implementation method usually uses diffusion models, such as graph-based diffusion process simulation (e.g., SIR model or probability-based diffusion model), which uses the connection relationship between nodes and the propagation rate parameter to iteratively simulate the process of fault propagation from the starting point to adjacent nodes. In the simulation, the time step is advanced, and the infected (fault) node set is dynamically updated until the preset time window or propagation convergence is reached. According to the service level and importance indicators of the nodes in the system, the propagation impact weight is adjusted to refine the spatial distribution of fault impact. The final fault impact range is presented in the form of a node set or service set, clearly defining the boundary of the fault propagation in the system, providing a basis for decision-making for precise intervention and resource scheduling.

[0041] Based on the service dependency graph or physical network topology of the system, the path between the starting fault point and other affected nodes is searched using graph traversal algorithms (such as depth-first search DFS, breadth-first search BFS) and timestamp constraints. The filtering of the path is based on the consistency of the timestamp order, ensuring that the event time on the path is increasing, meeting the time-causal logic of fault propagation. At the same time, the propagation rate threshold is introduced to filter the path, excluding the path whose transmission time exceeds the reasonable range. To deal with large-scale systems, heuristic search strategies and parallel computing are used to improve the efficiency of path mining. The output of this step is a set of multiple fault propagation paths, which provides candidate data for subsequent path credibility evaluation and real propagation link extraction. After obtaining the set of fault propagation paths, the reliability of each path needs to be quantitatively evaluated, and the path confidence is calculated, and the real fault propagation link is selected based on the confidence. Path confidence reflects the probability and rationality of fault propagation on the path, ensuring that the diagnosis result is accurate and reliable. Confidence calculation is usually based on multi-dimensional index fusion, including the continuity of event timestamps within the path, the semantic correlation strength between events, the system dependency strength, and the matching degree of historical fault propagation patterns. Bayesian inference method or Markov Chain Monte Carlo (MCMC) simulation is used to estimate the path probability, and the overall path confidence is obtained by accumulating the probability product of path nodes and edges. Subsequently, combined with system expert rules and historical fault cases, the fault relationship is verified, and the causal logic and physical feasibility of the path are checked, and the false path caused by abnormal data or log loss is removed. Finally, the path with high confidence and passing the verification is retained, forming the real fault propagation link, providing accurate trajectory support for fault root cause analysis and propagation evolution.

[0042] Each node in the system is regarded as a state of a state machine, and the fault propagation between nodes is regarded as a state transition event. The order and frequency of node faults in the real propagation link are counted, and the conditional probability from node A fault to node B fault is calculated, that is, the state transition probability. The maximum likelihood estimation (MLE) method is used to estimate the transition probability matrix. Through time series analysis techniques such as Hidden Markov Model (HMM), the dynamic change of state transition probability with time is modeled, capturing the time-varying characteristics of fault propagation in different operating stages of the system. The final output of the system inter-fault state transition probability matrix provides an accurate probability basis for subsequent fault diffusion prediction and risk assessment.

[0043] By combining the transition probability matrix with the system topology, the probability distribution and diffusion boundary of the fault state propagation among nodes over time are simulated. The diffusion process simulation algorithm, such as random walk simulation based on the Monte Carlo method, is adopted to dynamically deduce the spatial range and time process of the nodes possibly affected by the fault. The evolution process is visualized in the form of a dynamic graph, with the node size representing the fault probability, the edge width reflecting the propagation strength, and the time axis showing the propagation evolution sequence, which supports the operation and maintenance personnel to intuitively understand and accurately intervene the fault propagation path, speed and potential risk area. The dynamic graph not only reflects the spatial diffusion trend of the fault, but also reflects the key nodes and bottlenecks in the propagation, providing a scientific basis for intelligent fault early warning, resource scheduling and repair strategy formulation.

[0044] In the embodiment, the specific steps of reverse propagation backtracking of the dynamic fault propagation path graph and root cause node confidence calculation and marking of the fault root cause positioning node are as follows: Reverse propagation backtracking of the dynamic fault propagation path graph is performed, and multiple potential fault trace points are extracted; Precedence analysis is performed on the multiple potential fault trace points to obtain a potential fault point trace sequence; Predecessor node analysis is performed on the potential fault point trace sequence to extract a fault trace point without a predecessor node; Root cause node confidence calculation is performed on the fault trace point without a predecessor node to obtain root cause confidence of different trace points; The highest confidence trace point is extracted according to the root cause confidence, and is marked as a fault root cause positioning node.

[0045] In this embodiment, starting from the identified abnormal fault nodes, all possible propagation paths are traversed in the reverse direction of fault propagation in the graph to find the earliest abnormal node set. The reverse traversal algorithm of the graph (such as reverse breadth-first search) is combined with the timestamp constraint to ensure the reasonable time sequence of the backtracking path. By limiting the backtracking depth and the propagation delay threshold, paths with inconsistent timing or abnormal propagation speed are filtered out to improve the efficiency and accuracy of backtracking. Combined with the fault occurrence probability of the node and the event semantic information, the credibility of different paths is evaluated, and multiple potential fault tracing points with high confidence are extracted. These nodes are the possible root cause candidates, providing candidate space for subsequent accurate positioning. After obtaining multiple potential fault tracing points, pre-order analysis is performed to clarify the causal relationship between these tracing points, forming an ordered tracing sequence of potential fault points. This step sorts the event sequence of the tracing nodes through time and causal constraints, reflecting the evolution path of the fault. A timestamp-based ordering mechanism is used to establish a partial order relationship between the fault tracing points, combined with the semantic correlation between events and the system dependency topology. For cases with concurrency or race conditions, a topological sorting algorithm in the graph structure is used to handle the dependency relationship between the tracing points and eliminate loops and contradictions. Through this serialization process, multiple scattered tracing candidate nodes can be organized into one or more logical and time-continuous fault tracing chains, laying the foundation for the next step of predecessor node analysis and improving the interpretability and traceability of the tracing analysis.

[0046] Further predecessor node analysis is performed on the constructed tracing sequence to filter out the real tracing starting point, i.e., those fault points without any predecessor nodes in the sequence. These nodes are considered as the starting point of the fault propagation link and have a higher root cause possibility. This analysis traverses all nodes in the tracing sequence to check whether each node has a pre-fault associated node. Using the in-degree calculation in graph theory, nodes with zero in-degree are considered as nodes without predecessors. Combined with the timestamp and event semantics, false nodes without predecessors caused by data loss or abnormalities are excluded to ensure the accuracy of the screening results. The set of nodes without predecessors provides a candidate node set for subsequent root cause confidence evaluation, ensuring the rationality and scientificity of root cause positioning.

[0047] For the selected nodes without predecessors, the root cause node confidence is calculated to quantitatively evaluate the likelihood of each potential fault tracing point as a root cause node. This confidence reflects the importance of the node in the fault propagation chain and its reasonableness as a cause. The implementation method combines multi-dimensional information fusion: including the time of node event occurrence, the semantic association strength with other nodes, the criticality of the node in the system topology (such as node degree centrality, betweenness centrality), and the root cause frequency of similar nodes in historical fault data. Bayesian inference model or support vector machine (SVM) based classification method is used to calculate the root cause confidence. In addition, Granger causality test or causal graph model based on causal inference is introduced to assist in strengthening the causal reasonableness of the confidence. Finally, a numerical root cause confidence score is generated for each tracing point, which is used for fault root cause sorting and positioning.

[0048] According to the root cause confidence result, the potential fault tracing point with the highest confidence is selected as the fault root cause positioning node. This node represents the most likely trigger of the fault chain in the system and is the key target for fault diagnosis and repair. The confidence ranking is used as a priority indicator, combined with system expert rules (such as business importance, node security level) for secondary confirmation to ensure the scientificity and practicality of root cause positioning. The root cause node is recorded and fed back to the intelligent operation and maintenance system, triggering automated root cause analysis report and subsequent processing suggestions. In addition, combined with the positioning result, the depth analysis of the root cause propagation path can be carried out to assist in developing targeted repair strategies and preventive measures, significantly improving the fault recovery speed and stability of the system.

[0049] In this embodiment, the specific steps of constructing the intelligent fault handling decision-making agent for the fault root cause positioning node to evolve the fault trend and make intelligent fault diagnosis optimization decisions are as follows: Evolve the fault trend for the fault root cause positioning node and make multi-time point trend prediction to generate multi-time point fault prediction results; Perform fault state comprehensive diagnosis on the multi-time point fault prediction results to generate a log fault state diagnosis report; Solve the multi-objective optimization for the log fault state diagnosis report to generate a multi-objective optimization parameter scheme; Based on the multi-objective optimization parameter scheme, evaluate the fault optimization decision to obtain multiple scheme effect evaluation values; Based on the multiple scheme effect evaluation values, perform online learning feedback and make intelligent fault diagnosis optimization decisions to construct an intelligent fault handling decision-making agent.

[0050] In this embodiment, after determining the fault root cause node, first focus on the state evolution of the node at different time points, and deeply analyze its fault trend evolution. The specific operation is to model the time series data reflecting the fault events in the historical log of the node, which includes multi-dimensional indicators such as event frequency, abnormal indicator fluctuation, and system performance decline. A combination of statistical and machine learning methods is used to analyze the stationarity and seasonality of the fault time series data using the ARIMA model, identify the periodicity of the fault occurrence; at the same time, the long short-term memory network (LSTM) in deep learning is used to capture nonlinear dynamic characteristics, especially for the prediction ability of abnormal mutation points. In order to improve the generalization ability and accuracy of the model prediction, combined with the model integration strategy, the outputs of ARIMA and LSTM are fused by weighting to reduce the deviation that a single model may bring. The input data is normalized to eliminate the influence of different index dimensions, and the sliding window technology is introduced, setting the time window length (such as the past 24 hours, 48 hours) and step parameters to ensure the continuity and real-time of trend capture. Finally, through model prediction, multiple future time points (such as 1 hour, 6 hours, 12 hours, 24 hours in the future) are generated. The fault trend prediction results, the prediction form covers the fault probability distribution and the possible evolution of fault level, effectively supporting subsequent diagnosis and early warning decision.

[0051] The prediction results at different time points are weighted according to time weight, considering that the influence of the latest time point is greater; secondly, combined with the current system running state, including CPU usage, memory occupation, network delay and other key performance indicators, a multi-dimensional fault influence matrix is constructed. A fault risk fusion algorithm based on fuzzy logic is used to map multi-source heterogeneous data to a unified risk space, and to alleviate the influence of uncertainty and data noise between indicators. In addition, a semantic rule engine is introduced to embed expert experience and historical fault patterns into the diagnosis process, assist in classifying fault types (such as hardware failure, software failure, network failure), and assign different response strategies according to the fault severity level. The final output of the log fault state diagnosis report includes fault risk score, fault type prediction, impact range analysis, recommended treatment scheme and priority sorting, the report format is standardized, convenient for automatic system call and operation and maintenance personnel to quickly understand, effectively improve the fault response speed and processing accuracy.

[0052] Explicit optimization objectives: including minimizing fault recovery time, reducing operation and maintenance costs, reducing business impact, and optimizing resource allocation. Abstract these objectives as mathematical optimization problems, construct multi-objective functions and add system constraints such as hardware resource limits, maintenance window time and security policies, etc. Use multi-objective evolutionary algorithms (such as NSGA-II) for solution, the advantage is that this algorithm can handle multiple objectives at the same time, obtain a set of Pareto optimal solutions, avoid single target over-optimization leading to other target deterioration. The specific process includes initialization of population, fitness calculation, crossover and mutation operations, and non-dominated sorting, to ensure the diversity and convergence of the solution space. By setting algorithm parameters such as population size (usually 100-200), iteration number (usually 100-300 generations), combined with fault feature adaptive adjustment, to improve the efficiency of the algorithm and the quality of the solution. Finally output a set of multi-objective optimization parameter schemes, each scheme balances different objectives, providing diverse and personalized options for operation and maintenance decision-making.

[0053] Evaluation indicators include recovery efficiency, resource consumption, business continuity assurance degree, and security risk. Evaluation uses a combination of simulation and historical data playback: first, by building a fault simulation environment, simulate the execution process of different schemes, collect key performance indicator data; second, use real processing data of similar historical faults to verify the effect of the scheme, combined with performance prediction models in machine learning (such as regression analysis or neural networks), estimate future performance. In order to realize the comprehensive comparison of multi-dimensional evaluation indicators, introduce multi-criteria decision analysis methods (such as TOPSIS, AHP), normalize the indicators and calculate the comprehensive score according to the weight, and sort the schemes. The weight setting is based on expert experience and business demand dynamic adjustment, to ensure that the evaluation results meet the actual operation and maintenance priority. Through the above process, the effect evaluation value of multiple schemes is obtained, helping decision-makers identify the optimal and alternative schemes, improving the scientificity and accuracy of fault handling decision-making.

[0054] The intelligent agent takes the historical evaluation values and actual processing results of multiple schemes as training samples, and establishes a decision model by using a reinforcement learning framework (such as a deep Q network DQN or a policy gradient method). The model input includes the current system state, fault features and candidate scheme parameters, and the output is the optimal decision action. The intelligent agent learns through a reward mechanism feedback, and a reward function comprehensively considers fault recovery speed, cost saving and business impact to ensure that the decision is biased towards the overall optimum. In combination with an online learning algorithm, the intelligent agent continuously learns from real-time fault processing results, dynamically updates the policy parameters, and adapts to environmental changes and fault mode evolution. To prevent overfitting, an experience replay mechanism and an exploration strategy are applied to ensure the stability and diversity of learning. The intelligent agent also integrates a multi-objective trade-off strategy to flexibly adjust to different scenarios and business needs. Ultimately, the intelligent fault handling decision intelligent agent can automatically identify fault scenarios and quickly make optimal processing decisions, greatly improving fault response speed and system stability, and embodying the closed-loop fault management capability driven by artificial intelligence.

[0055] In the embodiment, an artificial intelligence-based log aggregation fault diagnosis system is provided for performing the artificial intelligence-based log aggregation fault diagnosis method as described above, comprising: An association reconstruction module is configured to collect multi-modal heterogeneous logs, perform sliding time sequence slicing processing, and perform time sequence association sequence reconstruction to construct a time sequence reconstructed log data stream. An event semantic analysis module is configured to perform log event deep semantic analysis on the time sequence reconstructed log data stream, and perform event semantic topology evolution to construct a multi-dimensional event topology representation matrix. A fault mode inference module is configured to perform regularized event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix to mark abnormal fault points. A fault propagation path module is configured to calculate the occurrence timestamp and abnormal propagation rate of the abnormal fault points, and perform fault spatio-temporal diffusion evolution to construct a dynamic fault propagation path atlas. A back-propagation backtracking module is configured to perform back-propagation backtracking on the dynamic fault propagation path atlas, and perform root cause node confidence calculation to mark a fault root cause positioning node. A fault diagnosis optimization module is configured to perform fault trend evolution on the fault root cause positioning node, and perform intelligent fault diagnosis optimization decision to construct an intelligent fault handling decision intelligent agent.

[0056] Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting, and the scope of the present application is defined by the appended claims rather than the above description, and therefore all changes falling within the meaning and scope of the equivalent elements of the application file are intended to be included in the present application.

[0057] The foregoing merely illustrates the principles of the application and application of its principles. Various modifications and alterations to this implementation will occur to those skilled in the art. The scope of the application should be determined, however, by the following claims rather than by the embodiments shown.

Claims

1. An artificial intelligence-based log aggregation fault diagnosis method, characterized in that, The method comprises the following steps: Collecting multi-modal heterogeneous logs, performing sliding time slice processing, and performing time correlation sequence reconstruction to construct a time reconstruction log data stream; Performing log event deep semantic analysis on the time reconstruction log data stream, and performing event semantic topology evolution to construct a multi-dimensional event topology representation matrix; Based on the multi-dimensional event topology representation matrix, regular event behavior analysis and abnormal fault mode inference are performed to mark abnormal fault points; Calculate the occurrence timestamp and abnormal propagation rate of the abnormal fault point, and perform fault spatiotemporal diffusion evolution to construct a dynamic fault propagation path atlas; Backtracking the dynamic fault propagation path atlas and calculating the root cause node confidence, marking the fault root cause positioning node; Performing fault trend evolution on the fault root cause positioning node, and making intelligent fault diagnosis optimization decision to construct an intelligent fault disposal decision agent. 2.The artificial intelligence-based log aggregation fault diagnosis method according to claim 1, characterized in that, The specific steps of collecting multi-modal heterogeneous logs, performing sliding time slice processing, and performing time correlation sequence reconstruction to construct a time reconstruction log data stream are as follows: Collecting multi-modal heterogeneous logs; Defining equal-length log segment division timestamps, and performing sliding time slice processing on the multi-modal heterogeneous logs to obtain a plurality of time period heterogeneous log sequences; Identify the system information of the multi-modal heterogeneous logs and perform time format analysis to extract the timestamp standard of each system; According to the time stamp standard, cross-system time reference calibration processing is performed to obtain a unified time standard; Fitting the time deviation between logs in the plurality of time period heterogeneous time sequences to obtain a plurality of log time deviation curves; Based on the unified time standard and the plurality of log time deviation curves, eliminate the time deviation to obtain a time reference heterogeneous log sequence; Performing time correlation sequence reconstruction on the time reference heterogeneous log sequence to construct a time reconstruction log data stream. 3.The AI-based log aggregation fault diagnosis method of claim 2, wherein, The specific steps of reconstructing the time reference heterogeneous log sequence into a time event sequence to construct a time reconstruction log data stream are as follows: Performing time correlation quantification calculation on the time reference heterogeneous log sequence under multiple time delays to obtain the time correlation degree between different logs; According to the time correlation degree, analyze the inter-log source dependency relationship to extract the time dependency relationship of different log sources; According to the time dependency relationship, mine the alignment direction of the multi-log sequence to obtain a time dependency path; Based on the time dependency path, reconstruct the time reference heterogeneous log sequence into a time event sequence to construct a time reconstruction log data stream. 4.The AI-based log aggregation fault diagnosis method of claim 1, wherein, The specific steps of performing log event deep semantic analysis on the time reconstruction log data stream, and performing event semantic topology evolution to construct a multi-dimensional event topology representation matrix are as follows: Performing deep identification on the log events of the time reconstruction log data stream to extract all log event information; Performing deep semantic analysis on the log event information and performing semantic vectorization coding to generate a high-dimensional semantic feature vector sequence; Performing upper and lower semantic correlation modeling on the high-dimensional semantic feature vector sequence to construct deep semantic correlation features between events; Based on the deep semantic features between events, analyze the key semantic conversion nodes to mark the semantic conversion nodes; Node embedding learning is performed based on the semantic conversion node, and event semantic topology evolution is performed to construct a multi-dimensional event topology representation matrix. 5.The artificial intelligence-based log aggregation fault diagnosis method of claim 1, wherein, The specific steps of performing normalized event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix to mark the abnormal fault points are as follows: Perform normalized event behavior analysis based on the multi-dimensional event topology representation matrix to obtain normal time behavior characteristics. Model the normal time behavior characteristics to obtain a normal behavior baseline. Perform all-process behavior anomaly deviation detection based on the normal behavior baseline on the multi-modal heterogeneous log, and perform periodic degree quantification to obtain a behavior deviation degree index within a time period. Perform abnormal fault mode inference on the behavior deviation degree index based on a preset normal behavior deviation threshold to mark the abnormal fault points. 6.The artificial intelligence-based log aggregation fault diagnosis method of claim 1, wherein The specific steps of calculating the occurrence timestamp and abnormal propagation rate of the abnormal fault points, and performing fault spatiotemporal diffusion evolution to construct a dynamic fault propagation path atlas are as follows: Calculate the occurrence timestamp and abnormal propagation rate of the abnormal fault points. Perform fault influence range analysis according to the occurrence timestamp and fault propagation rate to obtain a fault influence range. Perform spatial propagation path mining based on the fault influence range to obtain a fault propagation path set. Perform fault path confidence calculation on the fault propagation path set, and perform fault relationship verification to extract a real fault propagation link. Perform fault state transition probability analysis based on the real fault propagation link to obtain an inter-system fault state transition probability. Perform fault wave propagation boundary analysis based on the inter-system fault state transition probability, and perform fault spatiotemporal diffusion evolution to construct a dynamic fault propagation path atlas. 7.The artificial intelligence-based log aggregation fault diagnosis method of claim 1, wherein, The specific steps of performing reverse propagation backtracking on the dynamic fault propagation path atlas, and performing root cause node confidence calculation to mark a fault root cause positioning node are as follows: Perform reverse propagation backtracking on the dynamic fault propagation path atlas to extract a plurality of potential fault trace points. Perform preposition sequence analysis on the plurality of potential fault trace points to obtain a potential fault point trace sequence. Perform predecessor node analysis on the potential fault point trace sequence to extract a fault trace point without a predecessor. Perform root cause node confidence calculation on the fault trace point without a predecessor to obtain a root cause confidence of different trace points. Extract a trace point with the highest confidence according to the root cause confidence, and mark it as a fault root cause positioning node. 8.The AI-based log aggregation fault diagnosis method of claim 1, wherein, The specific steps of performing fault trend evolution on the fault root cause positioning node, and performing intelligent fault diagnosis optimization decision to construct an intelligent fault disposal decision agent are as follows: Perform fault trend evolution on the fault root cause positioning node, and perform multi-time-point trend prediction to generate a multi-time-point fault prediction result. Perform fault state comprehensive diagnosis on the multi-time-point fault prediction result to generate a log fault state diagnosis report. Perform multi-objective optimization solving on the log fault state diagnosis report to generate a multi-objective optimization parameter scheme. Perform fault optimization decision evaluation based on the multi-objective optimization parameter scheme to obtain a plurality of scheme effect evaluation values. Online learning feedback is performed based on the multiple scheme effect evaluation values, and intelligent fault diagnosis optimization decisions are made, and an intelligent fault handling decision intelligent agent is constructed. 9.A log aggregation fault diagnosis system based on artificial intelligence, characterized in that, The application discloses an artificial intelligence-based log aggregation fault diagnosis method. The association reconstruction module is used for collecting multi-modal heterogeneous logs, performing sliding time sequence slicing processing, and performing time sequence association sequence reconstruction to construct a time sequence reconstruction log data stream. The event semantic analysis module is used for performing log event deep semantic analysis on the time sequence reconstruction log data stream and performing event semantic topology evolution to construct a multi-dimensional event topology representation matrix. The fault mode inference module is used for performing normalized event behavior analysis and abnormal fault mode inference based on the multi-dimensional event topology representation matrix to mark abnormal fault points. The fault propagation path module is used for calculating the occurrence time stamp and abnormal propagation rate of the abnormal fault points, performing fault space-time diffusion evolution, and constructing a dynamic fault propagation path atlas. The back propagation backtracking module is used for performing back propagation backtracking on the dynamic fault propagation path atlas, performing root cause node confidence calculation, and marking a fault root cause positioning node. The fault diagnosis optimization module is used for performing fault trend evolution on the fault root cause positioning node, performing intelligent fault diagnosis optimization decisions, and constructing an intelligent fault handling decision intelligent agent.

Images