Network fault root cause positioning method and device

Abstract

The invention discloses a network fault root cause positioning method and device. The method comprises the following steps: acquiring a plurality of pieces of first alarm data of a target network in a first time period; analyzing each piece of first alarm data by using a fault detection model to obtain a first state tag corresponding to each piece of first alarm data; determining at least one root cause alarm type of the target network in the first time period from an alarm cause and effect graph based on the first state label corresponding to each piece of first alarm data, and determining all association graph nodes of alarm graph nodes corresponding to each piece of first alarm data from a network topology graph; and determining at least one root cause fault device of the target network in the first time period according to respective alarm types of all the association graph nodes of the alarm graph nodes corresponding to the first target alarm data with the first state label as the fault state and each root cause alarm type. According to the invention, the technical problems of low efficiency and low accuracy of positioning the network fault root cause in the prior art are solved.

Description

Technical Field

[0001] This application relates to the field of network operation and maintenance technology, and more specifically, to a method and apparatus for locating the root cause of network faults. Background Technology

[0002] In current communication network operation and maintenance practices, especially for large-scale cloud-network converged architectures, network fault location faces significant efficiency bottlenecks. Traditional fault location mechanisms rely on a single rule engine, lacking a deep understanding of cross-domain correlations, resulting in low efficiency in alarm correlation and severely impacting the accuracy and timeliness of fault handling. Particularly in complex network environments, such as the intertwined effects of transmission and wireless networks, traditional fault location mechanisms struggle to effectively analyze the inherent connections between alarms from multiple disciplines, increasing the frequency and difficulty of manual intervention and leading to low efficiency and poor accuracy in locating the root cause of network faults.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This application provides a method and apparatus for locating the root cause of network faults, so as to at least solve the technical problems of low efficiency and low accuracy in locating the root cause of network faults in related technologies.

[0005] According to one aspect of the embodiments of this application, a network fault root cause localization method is provided, comprising: acquiring multiple first alarm data of a target network within a first time period, wherein the first alarm data includes at least: performance data, traffic data, and alarm type of the alarm network device; analyzing each first alarm data using a fault detection model to obtain a first state label corresponding to each first alarm data, wherein the first state label includes: a fault state for representing the corresponding first alarm data as related to a fault, and a normal state for representing the corresponding first alarm data as unrelated to a fault; determining at least one root cause alarm type of the target network within the first time period from a preset alarm cause-effect graph based on the first state label corresponding to each first alarm data, and determining all associated graph nodes of the alarm graph node corresponding to each first alarm data from a preset network topology graph; and determining at least one root cause fault device of the target network within the first time period based on the alarm types of each associated graph node of the first target alarm data whose first state label is a fault state, and each root cause alarm type.

[0006] Optionally, the training process of the fault detection model includes: acquiring multiple sets of first training sample data, wherein each set of first training sample data includes: second alarm data of the network in a second time period, and the status label and fault type corresponding to the second alarm data, and the second time period is a historical time period before the first time period; constructing a machine learning model, wherein the type of machine learning model includes at least one of the following: decision tree, support vector machine, logistic regression model; iteratively training the machine learning model using multiple sets of first training sample data, and adjusting the model parameters of the machine learning model using an optimization algorithm during the iterative training process until the model parameters converge, thereby obtaining a fault detection model that has been trained.

[0007] Optionally, the construction process of the alarm causal graph includes: acquiring multiple historical alarm data within the target network, wherein the historical alarm data includes at least: alarm network device, alarm occurrence time, and alarm type; sorting the multiple historical alarm data according to alarm occurrence time and alarm type to obtain the alarm occurrence sequence corresponding to each alarm type; analyzing the alarm occurrence sequences corresponding to various alarm types using a multidimensional Hawkes process to obtain an initial causal graph, wherein the initial causal graph uses various alarm types as graph nodes, the causal relationship between every two alarm types as directed edges, and the probability of a causal relationship between every two alarm types as the edge weight of the corresponding directed edge, and the probability is obtained by transforming the expected time of occurrence of one alarm type after the occurrence of another alarm type connected by the directed edge using the Sigmoid function; performing a conditional independence test on the alarm occurrence sequences corresponding to every two graph nodes in the initial causal graph, and removing redundant directed edges in the initial causal graph based on the test results to obtain the alarm causal graph.

[0008] Optionally, based on the first state label corresponding to each first alarm data, at least one root cause alarm type of the target network in the first time period is determined from the preset alarm cause-effect graph, including: determining at least one first target alarm data in the multiple first alarm data whose first state label is a fault label; for each first target alarm data, in the alarm cause-effect graph, starting from the starting graph node corresponding to the first target alarm data, tracing back along the directed edge until a graph node with no out-degree is found, to obtain the root cause alarm type corresponding to the first target alarm data.

[0009] Optionally, the process of constructing the network topology graph includes: using a network scanning tool to obtain all network devices in the target network, wherein the types of network devices include at least one of the following: router, switch, server, storage device; periodically collecting interface information between various network devices in the target network using a network management protocol, wherein the interface information includes at least one of the following: link bandwidth, optical path number; and constructing a network topology graph using each network device in the target network as a graph node, the link between every two network devices as a directed edge, and the interface information between every two network devices as the edge attribute of the corresponding directed edge.

[0010] Optionally, based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first state label of fault state and each root cause alarm type, determine at least one root cause fault device in the target network within the first time period, including: for each root cause alarm type, match the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first state label of fault state with the root cause alarm type, determine the target associated graph node that successfully matches the root cause alarm type, and determine one root cause fault device in the target network within the first time period based on the network device corresponding to the target associated graph node.

[0011] Optionally, determining a root cause fault device in the target network within a first time period based on the network device corresponding to the target association graph node includes: obtaining the operation and maintenance data of the network device corresponding to the target association graph node within the first time period, wherein the operation and maintenance data includes at least: the configuration data and log data of the corresponding network device; performing pattern analysis on the operation and maintenance data of the network device corresponding to the target association graph node using a preset language model to obtain the pattern recognition result of the network device corresponding to the target association graph node, wherein the pattern recognition result includes: an abnormal state reflecting the presence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device, and a normal state reflecting the absence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device; if the pattern recognition result is an abnormal state, determining the network device corresponding to the target association graph node as a root cause fault device in the target network within the first time period, and determining the cause of the fault based on the abnormal configuration information and / or error log information of the network device corresponding to the target association graph node.

[0012] According to another aspect of the embodiments of this application, a network fault root cause localization device is also provided, comprising: an acquisition module, configured to acquire multiple first alarm data of a target network within a first time period, wherein the first alarm data includes at least: performance data, traffic data, and alarm type of the alarm network device; a detection module, configured to analyze each first alarm data using a fault detection model to obtain a first state label corresponding to each first alarm data, wherein the first state label includes: a fault state for representing the corresponding first alarm data as related to a fault, and a normal state for representing the corresponding first alarm data as unrelated to a fault; a determination module, configured to determine at least one root cause alarm type of the target network within the first time period from a preset alarm cause-effect graph based on the first state label corresponding to each first alarm data, and to determine all associated graph nodes of the alarm graph node corresponding to each first alarm data from a preset network topology graph; and a localization module, configured to determine at least one root cause fault device of the target network within the first time period based on the alarm types of each associated graph node of the first target alarm data whose first state label is a fault state, and each root cause alarm type.

[0013] According to another aspect of the embodiments of this application, a computer program product is also provided, the computer program product comprising: a computer program, wherein the computer program, when executed by a processor, implements the above-described network fault root cause localization method.

[0014] According to another aspect of the embodiments of this application, an electronic device is also provided, the electronic device including: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-described network fault root cause localization method through the computer program.

[0015] In this embodiment, a fault detection model is used to perform in-depth analysis on each first alarm data to determine its status, thereby improving the efficiency and accuracy of fault detection. By combining a preset alarm cause-effect graph and network topology graph, the first state labels corresponding to each first alarm data are integrated and analyzed, enabling precise determination of the root cause alarm type and accelerating fault location. Finally, based on the first target alarm data identified as faulty in the first state label, and the alarm types and root cause alarm types of all associated graph nodes in the topology graph, at least one root cause fault device in the target network within the first time period is successfully located. This achieves minute-level precise location of the fault root cause, shortening the fault recovery time and solving the technical problems of low efficiency and low accuracy in locating the root cause of network faults in related technologies. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 This is a flowchart illustrating an optional network fault root cause localization method according to an embodiment of this application;

[0018] Figure 2 This is a schematic diagram of an optional network fault root cause localization device according to an embodiment of this application;

[0019] Figure 3 This is a schematic diagram of the hardware structure of a computer terminal for implementing a network fault root cause localization method according to an embodiment of this application. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] Example 1

[0023] According to an embodiment of this application, a method for locating the root cause of network faults is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] Figure 1This is a flowchart illustrating a network fault root cause localization method according to an embodiment of this application, as shown below. Figure 1 As shown, the method includes the following steps:

[0025] Step S102: Obtain multiple first alarm data from the target network within a first time period. The first alarm data includes at least the performance data, traffic data, and alarm type of the alarm network device.

[0026] Step S104: Analyze each first alarm data using the fault detection model to obtain the first state label corresponding to each first alarm data. The first state label includes: a fault state that represents the corresponding first alarm data as related to the fault, and a normal state that represents the corresponding first alarm data as unrelated to the fault.

[0027] Step S106: Based on the first status label corresponding to each first alarm data, determine at least one root cause alarm type of the target network in the first time period from the preset alarm cause-effect graph, and determine all associated graph nodes of the alarm graph node corresponding to each first alarm data from the preset network topology graph.

[0028] Step S108: Based on the alarm types and root cause alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first state label being in a fault state, determine at least one root cause fault device in the target network within the first time period.

[0029] Based on the scheme defined in steps S102 to S108 above, it can be seen that in this embodiment, the fault detection model is used to perform in-depth analysis on each first alarm data to determine the status of each first alarm data, thereby improving the efficiency and accuracy of fault detection. By combining the preset alarm cause-effect graph and network topology graph to integrate and analyze the first status labels corresponding to each first alarm data, the root cause alarm type is accurately determined, accelerating the fault location speed. Finally, based on the first target alarm data that is determined to be in a fault state in the first status label, and the alarm type and root cause alarm type of all associated graph nodes in the topology graph, at least one root cause fault device in the target network within the first time period is successfully located, achieving minute-level accurate location of the fault root cause and shortening the fault recovery time.

[0030] The following section explains each step of the network fault root cause localization method in conjunction with a specific implementation process.

[0031] In the technical solution provided in step S102 above, the system can first acquire multiple first alarm data from the target network within a first time period. The target network can be a communication network or a cloud network architecture, including but not limited to broadband access networks of telecommunications operators, mobile communication networks, cloud platform infrastructure, and related network services. The first alarm data refers to abnormal status notifications issued by alarm network devices within the target network within the first time period, including but not limited to: performance data of the alarm network devices (such as bandwidth utilization, CPU utilization, memory utilization, etc.), traffic data of the alarm network devices (i.e., transmission traffic data between the alarm network devices and external networks), and alarm types of the alarm network devices (such as port down, traffic overload, high temperature, etc.).

[0032] It should be noted that the aforementioned first alarm data may also include the business impact level, which is quantified by the number of affected users and the duration of SLA (Service Level Agreement) breach. Therefore, the expression for the business impact level can be written as:

[0033]

[0034] In the formula, the number of affected users refers to the number of users served by the alarm network device, the total number of users refers to the number of users in the target network, the SLA default duration refers to the length of time that the alarm network device fails to meet the service quality and performance indicators within the time agreed in the service level agreement (i.e., the fault recovery time exceeds the maximum allowable interruption time specified in the SLA, and the excess time is called the SLA default duration), the SLA threshold refers to the maximum time length agreed in the service level agreement corresponding to the alarm network device, and α and β represent the weighting coefficients, respectively.

[0035] In the technical solution provided in step S104 above, the system can use the fault detection model to analyze each first alarm data and obtain the first status label corresponding to each first alarm data. The first status label includes: fault status, indicating that the first alarm data is directly related to the fault and requires further root cause localization; normal status, indicating that the first alarm data is not related to the fault and may be a false alarm or temporary fluctuation, which does not require further attention.

[0036] The fault detection model described above can be trained using the following method:

[0037] Step 1: Obtain multiple sets of training sample data. Each set of training sample data includes: the second alarm data of the network in the second time period, and the second status label corresponding to the second alarm data based on historical experience by professional operation and maintenance personnel, and the second time period is the historical time period before the first time period.

[0038] The second step is to build a machine learning model, which may include, but is not limited to, decision trees, support vector machines, logistic regression models, etc.

[0039] The third step is to iteratively train the machine learning model using multiple sets of training sample data, and adjust the model parameters of the machine learning model using optimization algorithms (such as gradient descent, stochastic gradient descent, etc.) during the iterative training process until the model parameters converge, thus obtaining a completed fault detection model.

[0040] By using the model training method described above, a highly accurate fault detection model can be constructed. This model can quickly identify real fault alarms in the network environment and distinguish false alarms from those in normal operation, thereby greatly improving the efficiency and accuracy of fault detection.

[0041] Therefore, when the system analyzes each first alarm data using the fault detection model, it can first extract features from each first alarm data and evaluate the correlation between the feature vector corresponding to each first alarm data and the potential fault, so as to obtain the corresponding first state label.

[0042] In addition, this application embodiment can also obtain the traffic data of each network device in the target network within a first time period, and use a time series prediction model to analyze the first traffic data of each network device within the first time period to obtain the predicted traffic data of each network device in the next time period of the first time period; for each network device, if the difference between the first traffic data of the network device within the first time period and the predicted traffic data of the network device in the next time period of the first time period is greater than a preset threshold, then the network device is confirmed to have a fault, and the first status label of the first alarm data of the network device can be set to a fault state; otherwise, the first status label of the first alarm data of the network device is set to a normal state.

[0043] The aforementioned time-series prediction model can also be trained using the following method:

[0044] Step 1: Obtain multiple sets of training sample data. Each set of training sample data includes: the first traffic data of the network device in the second time period, and the second traffic data of the network device in the next time period after the second time period, wherein the second time period and the next time period are historical time periods prior to the first time period.

[0045] The second step is to construct a neural network model, where the type of neural network model includes, but is not limited to, long short-term memory networks, sequence-to-sequence models, etc.

[0046] The third step is to iteratively train the neural network model using multiple sets of training sample data, and adjust the model parameters of the neural network model using optimization algorithms (such as gradient descent, stochastic gradient descent, etc.) during the iterative training process until the model parameters converge, thus obtaining a completed time series prediction model.

[0047] In step 104, the fault detection model / timing prediction model can be loaded into memory. For example, the raw data of the fault detection model / timing prediction model can be loaded from non-volatile memory into volatile memory so that the processor can run the fault detection model / timing prediction model. The raw data of the fault detection model / timing prediction model refers to unprocessed data, which typically includes the parameters and structural data of the fault detection model / timing prediction model. The structural data can be the computational relationships based on the parameters, such as the forward propagation computational relationships between intermediate layers and between neurons. Specifically, the structural data can include the structure-related code of the fault detection model / timing prediction model, such as code used to perform related calculations between intermediate layers and between neurons.

[0048] In one implementation, a region can be partitioned in memory for loading the fault detection model / time series prediction model, which may include a structure data storage area and a parameter storage area. The structure data storage area stores structure-related code, and the parameters referenced by it can be pointed to by pointers to the addresses of specific parameters in the parameter storage area. During the training process of the fault detection model / time series prediction model, it may be necessary to frequently update the parameters; in this case, updating the parameter values ​​in the parameter storage area is sufficient.

[0049] In the technical solution provided in step S106 above, the system can determine at least one root cause alarm type of the target network in the first time period based on the first status label corresponding to each first alarm data from the preset alarm cause-effect graph.

[0050] The alarm cause-effect graph is constructed based on long-term accumulated operational experience and data, and it contains the causal logical relationships between different alarm types. Therefore, the alarm cause-effect graph can be constructed as follows:

[0051] Step 1: Obtain multiple historical alarm data entries from the target network. This historical alarm data can be extracted from the target network's historical maintenance database and must include at least: the device identifier of the alarming network device, the alarm occurrence time, and the alarm type.

[0052] Step 2: Sort multiple historical alarm data according to alarm occurrence time and alarm type to obtain the alarm occurrence sequence corresponding to each alarm type, thereby clearly showing the temporal relationship between the occurrence events of different alarm types.

[0053] Step 3: Analyze the alarm occurrence sequences corresponding to various alarm types using a multidimensional Hawkes process to obtain an initial causal graph. The Hawkes process can capture the self-excitation and mutual excitation in event sequences, i.e., how the occurrence of one alarm event affects the probability of another alarm event. Therefore, by analyzing the alarm occurrence sequences corresponding to various alarm types using a multidimensional Hawkes process, an initial causal graph can be obtained. This graph uses various alarm types as graph nodes, the causal relationship between each pair of alarm types as directed edges, and the probability of a causal relationship between each pair of alarm types as the edge weight of the corresponding directed edge. The probability is obtained by transforming the expected time of occurrence of one alarm type after the occurrence of another alarm type connected by a directed edge using a Sigmoid function (i.e., the probability of self-excitation and mutual excitation of the two alarm types connected by the directed edge), reflecting the strength of the causal relationship.

[0054] Step 4: Perform a conditional independence test on the alarm occurrence sequence corresponding to every two graph nodes in the initial causal graph. Based on the test results, remove redundant directed edges from the initial causal graph to obtain the alarm causal graph. The conditional independence test is typically based on Bayesian networks, Granger causality tests, or other relevant statistical tests. This helps identify and remove edges that do not have a statistically direct causal relationship, avoiding redundant connections in the graph and thus obtaining a more concise and accurate alarm causal graph.

[0055] Through the above steps, the system can construct an efficient and accurate alarm causal graph based on historical alarm data. The node and edge weights in the graph reflect the actual causal relationships and the strength of causal relationships between various alarm events in the network.

[0056] Therefore, based on the above alarm cause-effect graph, the system can determine at least one root cause alarm type of the target network in the first time period using the following method:

[0057] Identify at least one first target alarm data among multiple first alarm data where the first state label is a fault label; for each first target alarm data, within the alarm cause-effect graph, use graph traversal algorithms such as depth-first search or breadth-first search to trace backward along the directed edges (i.e., recursively traverse upward or layer by layer along the directed edges) from the starting graph node corresponding to the first target alarm data to explore the causal chain between alarm types until a graph node with no out-degree is found (i.e., a graph node no longer has a direct alarm type associated with it), thus obtaining the root cause alarm type corresponding to the first target alarm data.

[0058] Therefore, the system effectively utilizes the knowledge resource of alarm cause-effect graphs and combines them with efficient graph traversal algorithms to achieve the goal of reverse-locating the root cause of the fault from complex alarm data.

[0059] Furthermore, in the technical solution provided in step S106 above, the system can also determine all associated graph nodes of the alarm graph node corresponding to each first alarm data from the preset network topology graph.

[0060] The network topology map is constructed based on the physical or logical connections between network devices within the target network. Therefore, the network topology map described above can be constructed using the following method:

[0061] Step 1: Use a network scanning tool to obtain all network devices in the target network. The types of network devices include at least one of the following: routers, switches, servers, and storage devices.

[0062] Step 2: Periodically collect interface information between various network devices in the target network using network management protocols. The interface information includes at least one of the following: link bandwidth and optical path number.

[0063] Step 3: Using each network device in the target network as a graph node, the link between every two network devices as a directed edge, and the interface information between every two network devices as the edge attribute of the corresponding directed edge, construct a network topology graph.

[0064] In other words, the system can use network scanning tools (such as Nmap and Zmap) to perform a comprehensive scan of the target network to obtain detailed information about all network devices in the target network, such as Media Access Control (MAC) addresses, Internet Protocol (IP) addresses, and device signatures. Then, it periodically (e.g., every 5 minutes) collects interface information between various network devices within the target network using network management protocols (Simple Network Management Protocol (SNMP), NetFlow, and Border Gateway Protocol (BGP), including key attributes such as link bandwidth and optical path number. Finally, it constructs a network topology map based on the interface information of each network device in the target network. Furthermore, after constructing the network topology map, it can perform topology optimization, such as reducing redundant edges and merging similar nodes, to make the map more concise.

[0065] It should be noted that the system can periodically update the edge attribute information of the network topology map, such as after the link bandwidth is adjusted or the optical path number is changed, in order to ensure the real-time performance and accuracy of the network topology map.

[0066] Therefore, the system can match each first alarm data with graph nodes in the network topology graph to find the position of each first alarm data in the network topology graph, which is then used as an alarm graph node. Next, the system searches the network topology graph for all associated graph nodes connected to the alarm graph node corresponding to each first alarm data. These associated graph nodes include both upstream and downstream device nodes connected to the alarm graph node, as well as a set of nodes that indirectly affect the faulty device through multi-hop connections.

[0067] Finally, in the technical solution provided in step S108 above, the system can determine at least one root cause fault device in the target network within the first time period based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first state label being faulty, and the root cause alarm types of each root cause alarm.

[0068] As an optional implementation, in the technical solution provided in step S108 above, the method may include: for each root cause alarm type, matching the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first state label as fault state with the root cause alarm type, determining the target associated graph node that successfully matches the root cause alarm type, and determining a root cause fault device of the target network in the first time period based on the network device corresponding to the target associated graph node.

[0069] In other words, for each identified root cause alarm type, the system first traverses all associated graph nodes of the alarm graph node corresponding to the first target alarm data, and then matches the alarm type of each associated graph node with the root cause alarm type to check whether there is a known causal relationship or similar fault manifestations between them. If the alarm type of an associated graph node matches the root cause alarm type, the associated graph node can be marked as a "target associated graph node", and the network device corresponding to the "target associated graph node" can be further analyzed to screen out the most likely source of the fault.

[0070] Specifically, the above-mentioned determination of a root cause fault device in the target network within the first time period based on the network devices corresponding to the target association graph nodes includes:

[0071] Step 1: Obtain the operation and maintenance data of the network device corresponding to the target association graph node within the first time period. The operation and maintenance data includes at least the configuration data and log data of the corresponding network device. The configuration data includes at least the device's parameter settings, port status, software version, and other information, while the log data records the device's status changes and operation log information during operation.

[0072] Step 2: Utilize a pre-defined language model (such as Large Language Mode) to perform pattern analysis on the operation and maintenance data of the network devices corresponding to the target association graph nodes (including natural language processing of log text and structured analysis of configuration data) to obtain the pattern recognition results of the network devices corresponding to the target association graph nodes. The pattern recognition results include: abnormal states reflecting the presence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device; and normal states reflecting the absence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device. Abnormal configuration information refers to illogical settings in the device configuration; while error log information refers to frequently occurring error codes or warning messages in the logs, as well as operating states that do not match known fault cases.

[0073] Step 3: If the pattern recognition result is abnormal, determine that the network device corresponding to the target association graph node is a root cause failure device of the target network in the first time period, and determine the cause of the failure based on the abnormal configuration information and / or error log information of the network device corresponding to the target association graph node, such as device software configuration error, hardware failure, network attack, etc.

[0074] Through the above steps, the system uses a high-level language model to conduct in-depth analysis of the operation and maintenance data of the network devices corresponding to the target association graph nodes, thereby identifying the root cause of the faulty device and analyzing the root cause of the fault.

[0075] In addition, the embodiments of this application can also determine a fault handling strategy that matches the root cause alarm type of each root cause fault device from a preset fault handling knowledge base, and call network resources (such as starting backup routes, adjusting traffic allocation, isolating faulty devices, etc.) according to the network location and root cause alarm type of the root cause fault device to minimize the impact of the fault.

[0076] In the aforementioned network fault root cause localization method, the system can quickly identify the fault state within seconds by utilizing a fault detection model, significantly shortening the time from alarm generation to fault identification compared to traditional methods. Simultaneously, by combining network topology maps, alarm cause-effect maps, and large language models, the system can more accurately locate the root cause device, reducing false association rates and improving the accuracy of fault localization.

[0077] Example 2

[0078] According to an embodiment of this application, a network fault root cause localization device for implementing the network fault root cause localization method in Embodiment 1 is also provided, such as... Figure 2 As shown, the network fault root cause localization device includes at least: an acquisition module 22, a detection module 24, a determination module 26, and a localization module 28, wherein:

[0079] The acquisition module 22 is used to acquire multiple first alarm data of the target network within a first time period, wherein the first alarm data includes at least: performance data, traffic data and alarm type of the alarm network device;

[0080] The detection module 24 is used to analyze each first alarm data using a fault detection model to obtain a first status label corresponding to each first alarm data. The first status label includes: a fault state that represents the corresponding first alarm data and is related to the fault, and a normal state that represents the corresponding first alarm data and is unrelated to the fault.

[0081] The determination module 26 is used to determine at least one root cause alarm type of the target network in the first time period from the preset alarm cause-effect graph based on the first status label corresponding to each first alarm data, and to determine all associated graph nodes of the alarm graph node corresponding to each first alarm data from the preset network topology graph.

[0082] The positioning module 28 is used to determine at least one root cause fault device in the target network within a first time period based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first status label being in a fault state, and the root cause alarm types of each root cause alarm.

[0083] The following section explains the functions of each module of the network fault root cause localization device in conjunction with the specific implementation process.

[0084] First, module 22 acquires multiple first alarm data entries from the target network within the first time period. The target network can be a communication network or a cloud network architecture, including but not limited to broadband access networks of telecom operators, mobile communication networks, cloud platform infrastructure, and related network services. The first alarm data refers to abnormal status notifications issued by alarm network devices within the target network within the first time period, including but not limited to: performance data of the alarm network devices (such as bandwidth utilization, CPU utilization, memory utilization, etc.), traffic data of the alarm network devices (i.e., transmission traffic data between the alarm network devices and external networks), and alarm types of the alarm network devices (such as port down, traffic overload, high temperature, etc.).

[0085] Next, the detection module 24 can use the fault detection model to analyze each first alarm data to obtain the first status label corresponding to each first alarm data. The first status label includes: fault status, which indicates that the first alarm data is directly related to the fault and requires further root cause localization; and normal status, which indicates that the first alarm data is not related to the fault and may be a false alarm or temporary fluctuation, which does not require further attention.

[0086] The fault detection model described above can be trained using the following method:

[0087] Step 1: Obtain multiple sets of training sample data.

[0088] Each training sample data set includes: the second alarm data of the network in the second time period, and the second status label corresponding to the second alarm data based on historical experience by professional operation and maintenance personnel, and the second time period is the historical time period before the first time period.

[0089] The second step is to build a machine learning model, which may include, but is not limited to, decision trees, support vector machines, logistic regression models, etc.

[0090] The third step is to iteratively train the machine learning model using multiple sets of training sample data, and adjust the model parameters of the machine learning model using optimization algorithms (such as gradient descent, stochastic gradient descent, etc.) during the iterative training process until the model parameters converge, thus obtaining a completed fault detection model.

[0091] Then, the determination module 26 first determines at least one root cause alarm type of the target network in the first time period based on the first status label corresponding to each first alarm data from the preset alarm cause-effect graph.

[0092] The alarm cause-effect graph is constructed based on long-term accumulated operational experience and data, and it contains the causal logical relationships between different alarm types. Therefore, the alarm cause-effect graph can be constructed as follows:

[0093] Step 1: Obtain multiple historical alarm data entries from the target network. These historical alarm data entries should include at least: the device identifier of the alarming network device, the time of the alarm occurrence, and the alarm type.

[0094] Step 2: Sort multiple historical alarm data according to alarm occurrence time and alarm type to obtain the alarm occurrence sequence corresponding to each alarm type.

[0095] Step 3: Analyze the alarm occurrence sequences corresponding to various alarm types using a multidimensional Hawkes process to obtain an initial causal graph. The initial causal graph uses various alarm types as graph nodes, the causal relationship between each pair of alarm types as directed edges, and the probability of a causal relationship between each pair of alarm types as the edge weight of the corresponding directed edge. The probability is obtained by transforming the expected time of occurrence of one alarm type after the occurrence of another alarm type connected by a directed edge (i.e., the probability of self-excitation and mutual excitation of the two alarm types connected by the directed edge) using the Sigmoid function, reflecting the strength of the causal relationship.

[0096] Step 4: Perform a conditional independence test on the alarm occurrence sequence corresponding to every two graph nodes in the initial causal graph, and remove redundant directed edges in the initial causal graph based on the test results to obtain the alarm causal graph.

[0097] Therefore, based on the above alarm cause-effect graph, the determination module 26 can determine at least one root cause alarm type of the target network in the first time period according to the following method:

[0098] Identify at least one first target alarm data among multiple first alarm data where the first state label is a fault label; for each first target alarm data, within the alarm cause-effect graph, use graph traversal algorithms such as depth-first search or breadth-first search to trace backward along the directed edges (i.e., recursively traverse upward or layer by layer along the directed edges) from the starting graph node corresponding to the first target alarm data to explore the causal chain between alarm types until a graph node with no out-degree is found (i.e., a graph node no longer has a direct alarm type associated with it), thus obtaining the root cause alarm type corresponding to the first target alarm data.

[0099] Furthermore, the determining module 26 can determine all associated graph nodes of the alarm graph node corresponding to each first alarm data from the preset network topology graph.

[0100] The network topology map is constructed based on the physical or logical connections between network devices within the target network. Therefore, the network topology map described above can be constructed using the following method:

[0101] Step 1: Use a network scanning tool to obtain all network devices in the target network. The types of network devices include at least one of the following: routers, switches, servers, and storage devices.

[0102] Step 2: Periodically collect interface information between various network devices in the target network using network management protocols. The interface information includes at least one of the following: link bandwidth and optical path number.

[0103] Step 3: Using each network device in the target network as a graph node, the link between every two network devices as a directed edge, and the interface information between every two network devices as the edge attribute of the corresponding directed edge, construct a network topology graph.

[0104] Finally, the positioning module 28 can determine at least one root cause fault device in the target network within the first time period based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first status label being in a fault state, and the root cause alarm types of each root cause alarm.

[0105] Optionally, the positioning module 28 can locate the root cause fault device in the following way: for each root cause alarm type, match the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first state label as fault state with the root cause alarm type, determine the target associated graph node that successfully matches the root cause alarm type, and determine a root cause fault device of the target network in the first time period based on the network device corresponding to the target associated graph node.

[0106] Among them, the above-mentioned determination of a root cause fault device in the target network within the first time period based on the network devices corresponding to the target association graph nodes includes:

[0107] Step 1: Obtain the operation and maintenance data of the network device corresponding to the target association graph node within the first time period. The operation and maintenance data includes at least the configuration data and log data of the corresponding network device. The configuration data includes at least the device's parameter settings, port status, software version, and other information, while the log data records the device's status changes and operation log information during operation.

[0108] Step 2: Utilize a pre-defined language model to perform pattern analysis on the operation and maintenance data of the network devices corresponding to the target association graph nodes, obtaining the pattern recognition results for the network devices corresponding to the target association graph nodes. The pattern recognition results include: an abnormal state reflecting the presence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device; and a normal state reflecting the absence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device.

[0109] Step 3: If the pattern recognition result is abnormal, determine that the network device corresponding to the target association graph node is a root cause failure device of the target network in the first time period, and determine the cause of the failure based on the abnormal configuration information and / or error log information of the network device corresponding to the target association graph node.

[0110] It should be noted that each module in the network fault root cause localization device in this application embodiment corresponds one-to-one with each implementation step of the network fault root cause localization method in embodiment 1. Since embodiment 1 has been described in detail, some details not shown in this embodiment can be referred to embodiment 1, and will not be elaborated further here.

[0111] Example 3

[0112] According to an embodiment of this application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, it implements the network fault root cause localization method in embodiment 1.

[0113] According to an embodiment of this application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device containing the non-volatile storage medium executes the network fault root cause localization method in Embodiment 1 by running the computer program.

[0114] According to an embodiment of this application, a processor is also provided for running a computer program, wherein the computer program executes the network fault root cause localization method in embodiment 1 during runtime.

[0115] According to an embodiment of this application, an electronic device is also provided, comprising: a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the network fault root cause localization method of embodiment 1 through the computer program.

[0116] Specifically, the computer program executes the following steps during runtime: acquiring multiple first alarm data entries from the target network within a first time period, wherein the first alarm data entries include at least: performance data, traffic data, and alarm type of the alarm network device; analyzing each first alarm data entry using a fault detection model to obtain a first state label corresponding to each first alarm data entry, wherein the first state label includes: a fault state representing the corresponding first alarm data entry as related to a fault, and a normal state representing the corresponding first alarm data entry as unrelated to a fault; based on the first state labels corresponding to each first alarm data entry, determining at least one root cause alarm type of the target network within the first time period from a preset alarm cause-effect graph, and determining all associated graph nodes of the alarm graph node corresponding to each first alarm data entry from a preset network topology graph; and determining at least one root cause fault device of the target network within the first time period based on the alarm types of each associated graph node of the first target alarm data entry with a first state label of fault state, and each root cause alarm type.

[0117] As an alternative implementation, the above-mentioned electronic device may exist in the form of a mobile terminal, a computer terminal, or a similar computing device. Figure 3 A hardware block diagram of a computer terminal for implementing a network fault root cause localization method is shown. Figure 3As shown, the computer terminal 30 may include one or more processors 302 (shown as 302a, 302b, ..., 302n in the figure) 302 (processor 302 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 3 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, computer terminal 30 may also include... Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown.

[0118] It should be noted that the aforementioned one or more processors 302 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 30. As involved in the embodiments of this application, the data processing circuits serve as processor control (e.g., selection of a variable resistor termination path connected to an interface).

[0119] The memory 304 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network fault root cause localization method in this embodiment. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, thereby implementing the above-mentioned application vulnerability detection method. The memory 304 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 304 may further include memory remotely located relative to the processor 302, and these remote memories can be connected to the computer terminal 30 via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0120] The transmission device 306 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 30. In one example, the transmission device 306 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 306 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0121] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 30.

[0122] The sequence numbers of the above embodiments are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0123] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0124] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0125] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0126] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0127] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0128] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for locating the root cause of network faults, characterized in that, include: Acquire multiple first alarm data of the target network within a first time period, wherein the first alarm data includes at least: performance data, traffic data and alarm type of the alarm network device; The fault detection model is used to analyze each of the first alarm data to obtain the first status label corresponding to each first alarm data. The first status label includes: a fault state that represents the corresponding first alarm data and is related to the fault, and a normal state that represents the corresponding first alarm data and is not related to the fault. Based on the first status label corresponding to each of the first alarm data, at least one root cause alarm type of the target network in the first time period is determined from the preset alarm cause-effect graph, and all associated graph nodes of the alarm graph node corresponding to each of the first alarm data are determined from the preset network topology graph. Based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first status label being in a fault state, and each of the root cause alarm types, at least one root cause fault device in the target network within the first time period is determined.

2. The method according to claim 1, characterized in that, The training process of the fault detection model includes: Multiple sets of training sample data are acquired, wherein each set of training sample data includes: second alarm data of the network in a second time period, and second status label corresponding to the second alarm data, and the second time period is a historical time period before the first time period; Construct a machine learning model, wherein the type of the machine learning model includes at least one of the following: decision tree, support vector machine, logistic regression model; The machine learning model is iteratively trained using the multiple sets of training sample data, and the model parameters of the machine learning model are adjusted using optimization algorithms during the iterative training process until the model parameters converge, thus obtaining the fault detection model that has been trained.

3. The method according to claim 1, characterized in that, The process of constructing the alarm cause-effect graph includes: Obtain multiple historical alarm data within the target network, wherein the historical alarm data includes at least: the device identifier of the alarm network device, the alarm occurrence time, and the alarm type; The multiple historical alarm data are sorted according to the alarm occurrence time and alarm type to obtain the alarm occurrence sequence corresponding to each alarm type; The alarm occurrence sequences corresponding to various alarm types are analyzed using a multidimensional Hawkes process to obtain an initial causal graph. The initial causal graph uses various alarm types as graph nodes, the causal relationship between each pair of alarm types as directed edges, and the probability of a causal relationship between each pair of alarm types as the edge weight of the corresponding directed edge. The probability is obtained by transforming the expected time of occurrence of one alarm type after the occurrence of another alarm type connected by the directed edge using the Sigmoid function. For each pair of alarm occurrence sequences corresponding to the initial causal graph, a conditional independence test is performed. Based on the test results, redundant directed edges in the initial causal graph are removed to obtain the alarm causal graph.

4. The method according to claim 3, characterized in that, Based on the first state label corresponding to each of the first alarm data, at least one root cause alarm type of the target network within a first time period is determined from the preset alarm cause-effect graph, including: Identify at least one first target alarm data among multiple first alarm data where the first status label is a fault label; For each first target alarm data, within the alarm cause-effect graph, starting from the starting graph node corresponding to the first target alarm data, trace backward along the directed edges until a graph node with no out-degree is found, to obtain the root cause alarm type corresponding to the first target alarm data.

5. The method according to claim 1, characterized in that, The process of constructing the network topology map includes: The network scanning tool is used to obtain all network devices in the target network, wherein the types of network devices include at least one of the following: routers, switches, servers, and storage devices; The interface information between various network devices in the target network is periodically collected using a network management protocol, wherein the interface information includes at least one of the following: link bandwidth and optical path number; The network topology graph is constructed by using each network device in the target network as a graph node, the link between every two network devices as a directed edge, and the interface information between every two network devices as the edge attribute of the corresponding directed edge.

6. The method according to claim 1, characterized in that, Based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first status label being in a fault state, and each of the root cause alarm types, at least one root cause fault device in the target network within a first time period is determined, including: For each root cause alarm type, the alarm types of all associated graph nodes corresponding to the first target alarm data with the first state label of fault state are matched with the root cause alarm type. The target associated graph node that successfully matches the root cause alarm type is determined, and a root cause fault device of the target network is determined based on the network device corresponding to the target associated graph node in the first time period.

7. The method according to claim 6, characterized in that, Based on the network devices corresponding to the target association graph nodes, a root cause fault device in the target network within a first time period is determined, including: Obtain the operation and maintenance data of the network device corresponding to the target association graph node within a first time period, wherein the operation and maintenance data includes at least: the corresponding network device configuration data and log data; Using a preset language model, pattern analysis is performed on the operation and maintenance data of the network devices corresponding to the target association graph node to obtain the pattern recognition result of the network devices corresponding to the target association graph node. The pattern recognition result includes: an abnormal state reflecting the presence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device; and a normal state reflecting the absence of abnormal configuration information and / or error log information in the operation and maintenance data of the corresponding root cause fault device. If the pattern recognition result indicates an abnormal state, the network device corresponding to the target association graph node is determined to be a root cause fault device of the target network within the first time period, and the cause of the fault is determined based on the abnormal configuration information and / or error log information of the network device corresponding to the target association graph node.

8. A network fault root cause localization device, characterized in that, include: The acquisition module is used to acquire multiple first alarm data of the target network within a first time period, wherein the first alarm data includes at least: performance data, traffic data and alarm type of the alarm network device; The detection module is used to analyze each of the first alarm data using a fault detection model to obtain a first status label corresponding to each of the first alarm data. The first status label includes: a fault state that represents the corresponding first alarm data as being related to a fault, and a normal state that represents the corresponding first alarm data as being unrelated to a fault. The determination module is used to determine at least one root cause alarm type of the target network in a first time period from the preset alarm cause-effect graph based on the first status label corresponding to each of the first alarm data, and to determine all associated graph nodes of the alarm graph node corresponding to each of the first alarm data from the preset network topology graph. The positioning module is used to determine at least one root cause fault device in the target network within a first time period based on the alarm types of all associated graph nodes of the alarm graph node corresponding to the first target alarm data with the first status label being in a fault state, and each of the root cause alarm types.

9. A computer program product, characterized in that, include: A computer program, wherein when executed by a processor, the computer program implements the network fault root cause localization method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the network fault root cause localization method according to any one of claims 1 to 7 through the computer program.

Images