Cloud platform-based fault capturing and simulation reproducing method and system

Abstract

The application discloses a cloud platform-based fault capturing and simulation reproducing method and system. By collecting the log, abnormal identifier and calling chain information of a distributed system, an event stream is generated after uniform timestamping; a frequency matrix of events is constructed by using an improved Count-Min Sketch for sliding window frequency statistics; high-frequency abnormal events are identified according to a set threshold to form an abnormal event set; a LiNGAM model is used for non-Gaussian independent component analysis of the abnormal events to deduce the causal direction between events and generate a causal direction matrix; the frequency matrix and the causal direction matrix are fused to obtain a frequency-cause joint matrix; event sequences with closed-loop structures are identified in the joint matrix, and a minimum causal event sequence is formed through topological sorting; simulation trigger instructions are generated according to the sequence, state snapshots are loaded in the cloud one by one, and abnormal events are replayed, so that the accurate reproduction and analysis of faults in a complex distributed system are realized.

Description

Technical Field

[0001] This invention relates to the field of cloud computing and distributed system operation and maintenance technology, and in particular to a method and system for fault capture and simulation reproduction based on a cloud platform. Background Technology

[0002] With the widespread application of cloud computing, large-scale distributed architectures, and microservice systems, the number of logs and abnormal events generated during system operation is growing exponentially. Fault detection and problem localization in distributed environments have gradually become key aspects of system operation and maintenance. Existing fault diagnosis methods typically rely on offline log analysis and manual review, achieving initial localization through simple keyword matching or anomaly pattern retrieval.

[0003] In complex environments with multiple nodes and multiple threads executing concurrently, traditional methods have significant limitations: on the one hand, log collection lacks a unified time synchronization mechanism, leading to disordered event sequences and making it difficult to accurately reconstruct the fault triggering path; on the other hand, existing statistical analysis methods can only identify the frequency of anomalies but cannot characterize the causal relationships between events, making it difficult to accurately reproduce faults. Although some systems have introduced rule-based or machine learning-based anomaly detection models, they cannot dynamically handle the evolution of high-frequency anomalies within a sliding window, resulting in unstable causal inference and ineffective identification of closed-loop faults. Based on the above problems, this method proposes a cloud-based fault capture and simulation reproduction technology that combines frequency statistics and causal modeling. Through event stream aggregation, causal direction inference, and simulation execution processes, it achieves automatic identification and closed-loop replay of abnormal events in complex distributed systems, thereby solving the technical defects of existing technologies, such as difficulty in time alignment, inaccurate causal inference, and limited simulation reproduction.

[0004] Therefore, how to provide cloud-based fault capture and simulation reproduction methods and systems is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a fault capture and simulation reproduction method and system based on a cloud platform. It adopts a technical approach that combines an improved Count-Min Sketch with a LiNGAM causal reasoning model. Through event flow construction, frequency matrix generation, abnormal event identification, causal direction calculation, and simulation instruction sequence replay, it achieves accurate capture of complex abnormal events and causal chain reproduction in a distributed system.

[0006] The fault capture and simulation reproduction method and system based on a cloud platform according to embodiments of the present invention includes the following steps:

[0007] The event stream construction module collects log data, exception identifiers, and call chain information in the cloud platform, aggregates them according to a unified timestamp format, and generates an event stream.

[0008] The frequency statistics module receives the event stream, adopts an improved Count-Min Sketch structure, and outputs a frequency matrix;

[0009] The anomaly detection module receives the frequency matrix, compares the frequency of each event with a set threshold, and outputs a set of high-frequency anomaly events.

[0010] The causal reasoning module receives a set of high-frequency abnormal events and generates a causal direction matrix based on the LiNGAM model.

[0011] The joint modeling module receives the frequency matrix and the causal direction matrix, and performs matrix fusion to generate a frequency-causal joint matrix.

[0012] The causal closed-loop identification module receives the frequency-causal joint matrix and outputs the minimum causal event sequence that satisfies the topological sorting requirement.

[0013] The trigger instruction generation module receives the minimum causal event sequence and generates an instruction sequence according to the causal direction between events. Each instruction corresponds to a state snapshot identifier and loading order.

[0014] The simulation execution module loads snapshots sequentially in the cloud environment according to the state snapshot identifiers and loading order in the instruction sequence, and replays the corresponding abnormal events to generate event response data generated during the execution process.

[0015] Optionally, modules can be integrated using the following methods:

[0016] Collect log data, exception identifiers, and call chain information generated in the distributed system, aggregate data from different sources using a unified timestamp, and construct an event stream;

[0017] Perform streaming frequency statistics on the event stream, using an improved Count-Min Sketch data structure to update the event frequency within a sliding window and generate a frequency matrix;

[0018] Based on a set frequency threshold, identify abnormal events whose frequency exceeds the threshold from the frequency matrix and output a set of high-frequency abnormal events;

[0019] Based on a set of high-frequency anomalous events, non-Gaussian independent component analysis is performed using the LiNGAM model to calculate the causal direction relationship between anomalous events and generate a causal direction matrix.

[0020] The frequency matrix and the causal orientation matrix are fused to construct a frequency-causal joint matrix;

[0021] Identify event sequences with causal closed-loop structures from the frequency-causality joint matrix, and perform topological sorting on the sequences to generate the minimum causal event sequence;

[0022] Based on the event order and causal relationship in the minimal causal event sequence, a simulation trigger instruction sequence is generated, and each instruction contains a state snapshot identifier and loading order information;

[0023] In the cloud simulation environment, corresponding state snapshots are loaded one by one according to the instruction sequence, the event sequence is replayed in sequence, and the event response data in the reproduction process is output.

[0024] Optionally, the generation of the frequency matrix includes:

[0025] Collect event streams, which consist of sequentially generated runtime events during system operation. Each runtime event includes an event identifier, event occurrence time, and event source identifier.

[0026] The event stream is taken as input and fed into the improved Count-Min Sketch data structure. Frequency statistics are performed on each running event according to the arrival order of the events, and the event frequency statistics results are output.

[0027] Based on the time window division criteria, the statistical frequency corresponding to each event identifier in the event frequency statistics results is classified, and the statistical data of events belonging to the same time window are summarized into frequency statistics values ​​within the time period.

[0028] Set the structure of the frequency matrix, use event identifiers as row indices and time windows as column indices, and fill the matrix cells sequentially according to the frequency values ​​of each event identifier in each time window in the frequency statistics results to complete the content filling of the frequency matrix.

[0029] Optional, improved Count-Min Sketch data structures include:

[0030] Take the event stream as input;

[0031] A fixed number of hash functions are set in the event stream buffer. Each hash function corresponds to a counting array. Each index unit of the counting array corresponds one-to-one with the time index table. The time index table records the correspondence between the event identifier, the event occurrence time, and the index position.

[0032] Each event identifier in the event stream is sequentially input into all hash functions for mapping, a count value is added at the index position of the corresponding counting array, and the binding information between the event identifier and the index position is registered in the time index table to generate a hash snapshot of the current time period.

[0033] Establish a sliding hash snapshot queue, which consists of consecutively arranged time snapshot units. Each time snapshot unit stores the complete state of the counting array and the corresponding time index table. When the time reaches the sliding step size condition, the current snapshot is archived and a new time snapshot unit is generated.

[0034] Between two adjacent time snapshot units, calculate the difference in the count values ​​at the same index position and record the difference results in the frequency difference table;

[0035] Extract all index positions with non-zero differences from the frequency difference table, and look up the corresponding event identifier and event occurrence time from the time index table to construct an event frequency offset sequence. The event frequency offset sequence records all events whose frequency changes within the current sliding cycle.

[0036] If the frequency increment of any event identifier in the event frequency offset sequence exceeds the set threshold, the event identifier and its corresponding hash index sequence are written into the abnormal event index table, and the event identifier is added to the abnormal trigger queue.

[0037] Reconstruct the event causal chain index structure based on the chronological order of event identifiers in the exception trigger queue;

[0038] The counting array states in all sliding hash snapshot queues are combined into a frequency statistics matrix in chronological order. Each row in the frequency statistics matrix corresponds to an event identifier, each column corresponds to a time window number, and each cell represents the cumulative frequency of the event identifier in the corresponding time window.

[0039] Optionally, the construction of the high-frequency abnormal event set includes:

[0040] Obtain the frequency matrix;

[0041] Based on the arrangement order of the sliding time windows, extract the frequency vector corresponding to each event identifier. Each element in the frequency vector represents the frequency of the event identifier within a certain time window.

[0042] Calculate the mean and standard deviation of the frequency distribution of the frequency vector, and obtain the global mean and global standard deviation of all event identifiers in the previous sliding period to form a window context fluctuation parameter set;

[0043] Based on the context fluctuation parameter set, an adaptive frequency threshold for the event identifier is set. The adaptive frequency threshold is the result of a weighted calculation of the current frequency mean and the standard deviation of the previous period.

[0044] Based on the calculation of the adaptive frequency threshold, dual-threshold recognition conditions are set, including:

[0045] Threshold 1: The frequency of an event identifier within any time window is higher than its corresponding adaptive frequency threshold;

[0046] Threshold 2: The frequency difference of an event identifier within two consecutive time windows exceeds a set frequency growth rate threshold;

[0047] Event identifiers that meet the above two conditions are filtered to construct an abnormal event candidate set. Each element in the abnormal event candidate set contains an event identifier, a time window number, and a corresponding frequency value.

[0048] Each event identifier is read from the candidate set of abnormal events. The event node with a directed connection to the event identifier is searched in the historical cause-effect graph pre-generated by the system. If a closed path structure is formed between the candidate event and the node in the cause-effect graph, the event identifier is marked as a high-frequency abnormal event.

[0049] All event identifiers that satisfy the causal closed-loop verification are grouped into a high-frequency abnormal event set, and this high-frequency abnormal event set is output.

[0050] Optionally, the generation of the causal direction matrix includes:

[0051] Extracting each event from the set of high-frequency abnormal events Frequency data within a time window are used to construct an observation data matrix. ,matrix The Middle Line number Column elements Indicates an event In the Frequency of occurrence within a time window;

[0052] For matrix Calculate the standard deviation for each column. A normalized diagonal weight matrix is ​​constructed based on all standard deviations. ;

[0053] Multiplying the observation matrix on the left by the weight matrix yields the weighted observation matrix. And use it as input for causal modeling;

[0054] For the weighted observation matrix Perform centering and variance normalization to obtain a standardized matrix. Each column has a zero mean and a unit standard deviation;

[0055] For the standardized matrix Perform independent component analysis to establish the following decomposition relationships: ,in This is the mixing coefficient matrix, representing the intensity of direct contributions between events; The matrix consists of independent non-Gaussian source signals;

[0056] Sliding window bootstrap resampling is performed along the row dimensions of the normalized matrix, for a total of Each resampling yields a set of candidate mixing matrices. ,

[0057] And count the position of each matrix in The proportion of non-zero values ​​in each iteration; setting a stability threshold. Construct a stability mask matrix ;

[0058] Mixing matrix With mask matrix Element-wise multiplication yields a stable mixture matrix. ;in This represents Hadamard multiplication;

[0059] Structural equation modeling is performed based on stable hybrid matrices to construct causal direction matrices. ;

[0060] For the causal direction matrix The graph structure is subjected to loop detection. If a directed cycle is detected, the edges with the lowest causal strength are deleted in ascending order of edge weight and the topology is re-sorted until a directed acyclic graph is formed.

[0061] Output the corrected causal direction matrix .

[0062] Optionally, the construction of the frequency-causality joint matrix includes the following steps:

[0063] The frequency matrix is ​​received. Each row in the frequency matrix corresponds to an event identifier, and each column corresponds to a time window number. The elements in the matrix represent the statistical frequency value of the corresponding event within the specified time window.

[0064] Receive the causal direction matrix. Each row in the causal direction matrix represents the source event, each column represents the target event, and the elements in the matrix represent the causal strength value of the source event to the target event.

[0065] The average frequency value of each event identifier in the statistical frequency matrix over all time windows is used to obtain the frequency mean vector, where each vector element represents the average statistical frequency of an event identifier over all time windows.

[0066] The frequency mean vector is transformed into a diagonal matrix, and the diagonal elements of the diagonal matrix are filled with the average frequency value of each event identifier, while the off-diagonal elements are set to zero.

[0067] Perform matrix multiplication to multiply the causal direction matrix with the frequency diagonal matrix to obtain the frequency-causal joint matrix. Each element in the joint matrix represents the frequency weighting intensity of a target event in the causal propagation direction.

[0068] Output frequency-causality joint matrix.

[0069] Optionally, the generation of the minimal causal event sequence includes:

[0070] Extract the frequency-causality joint matrix, and construct a directed weighted graph structure based on the value of each element in the joint matrix. Each node in the graph represents an abnormal event identifier, the direction of each directed edge represents the causal propagation direction, and the edge weight is the value of the corresponding element in the joint matrix.

[0071] Perform a loop detection operation on the directed graph structure. Determine whether there is a causal closed loop based on the closed path formed by path backtracking in the graph structure. If there is, record all participating nodes in the closed loop path.

[0072] In the path where causal loops are detected, all edge weights are sorted, the directed edge with the smallest edge weight is identified and removed from the graph structure.

[0073] After performing the edge deletion operation, the loop detection operation is re-executed. If a closed loop path still exists, the deletion and backtracking detection of the edge with the smallest edge weight are continued until the cause-effect graph structure no longer contains any directed loops.

[0074] After completing the construction of the acyclic structure, a topological sorting operation is performed on all nodes in the causal graph. All event nodes are arranged according to the connection order between the start and end points of the directed edges, forming an event sorting list under the undirected cycle constraint.

[0075] The event nodes after topological sorting are renumbered according to their positions in the sorting list, and the number sequence is output as the minimum causal event sequence.

[0076] Optionally, the generation of the simulation trigger instruction sequence includes:

[0077] Receive the minimum causal event sequence. Each event identifier in the minimum causal event sequence corresponds to a topological sorting index, which indicates the order of the event in the causal dependency path.

[0078] Based on each event identifier in the minimum causal event sequence, the index mapping rules are invoked to retrieve the corresponding historical state snapshot from the event snapshot storage database, extract the globally unique identifier of each state snapshot, and establish a one-to-one mapping relationship between the event identifier and the state snapshot identifier.

[0079] All event identifiers are sorted in ascending order according to the topological sorting index. The state snapshot identifiers mapped to each event identifier are read sequentially according to the sorting order to generate a list of state snapshot identifiers. Each element in the list represents the loading position in the simulation execution flow.

[0080] Each element in the state snapshot identifier list is assigned a corresponding loading sequence number, which is equal to the sorting position number of the state snapshot in the minimum causal event sequence.

[0081] Construct simulation trigger instructions. Each simulation trigger instruction consists of two fields: a state snapshot identifier field and a loading sequence field. Combine the state snapshot identifier with the corresponding loading sequence number to form a complete instruction.

[0082] Arrange all simulation trigger commands in ascending order of loading order to generate a simulation trigger command sequence.

[0083] The beneficial effects of this invention are:

[0084] (1) This invention constructs a multi-source event stream with a unified timestamp and uses an improved Count-Min Sketch structure to perform efficient frequency statistics within a sliding window, thereby realizing real-time aggregation and dynamic analysis of large-scale distributed system operation data and effectively improving the sensitivity and accuracy of abnormal event identification.

[0085] (2) This invention introduces a non-Gaussian independent component analysis method based on the LiNGAM model to accurately infer the causal direction between high-frequency abnormal events. Combined with the frequency-causal joint matrix construction mechanism, it makes up for the defects of inaccurate causal chain construction and inability to characterize complex event dependencies in the prior art, and improves the completeness and logic of fault path identification.

[0086] (3) The present invention automatically generates the minimum causal event sequence through topological sorting and causal loop detection method, which can effectively eliminate redundant causal edges, ensure the directed acyclicity of the sequence, and improve the execution efficiency and stability of subsequent instruction generation and replay. Attached Figure Description

[0087] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0088] Figure 1 The flowchart shows the fault capture and simulation reproduction method and system based on the cloud platform proposed in this invention.

[0089] Figure 2This is a structural diagram of the improved Count-Min Sketch structure and sliding window frequency update proposed in this invention;

[0090] Figure 3 This is a schematic diagram of the causal direction reasoning and causal direction matrix generation based on the LiNGAM model proposed in this invention. Detailed Implementation

[0091] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0092] refer to Figure 1 - Figure 3 A cloud-based method and system for fault capture and simulation reproduction includes the following steps:

[0093] The event stream construction module collects log data, exception identifiers, and call chain information in the cloud platform, aggregates them according to a unified timestamp format, and generates an event stream.

[0094] The frequency statistics module receives the event stream, adopts an improved Count-Min Sketch structure, and outputs a frequency matrix;

[0095] The anomaly detection module receives the frequency matrix, compares the frequency of each event with a set threshold, filters events whose frequency exceeds the threshold, and outputs a set of high-frequency anomaly events.

[0096] The causal reasoning module receives a set of high-frequency abnormal events, calculates the causal directions between events based on the LiNGAM model, and generates a causal direction matrix.

[0097] The joint modeling module receives the frequency matrix and the causal direction matrix, and performs matrix fusion to generate a frequency-causal joint matrix.

[0098] The causal closed-loop identification module receives the frequency-causal joint matrix, identifies event sequences with closed-loop structures, and outputs the minimum causal event sequence that satisfies the topological sorting requirements.

[0099] The trigger instruction generation module receives the minimum causal event sequence and generates an instruction sequence according to the causal direction between events. Each instruction corresponds to a state snapshot identifier and loading order.

[0100] The simulation execution module loads snapshots sequentially in the cloud environment according to the state snapshot identifiers and loading order in the instruction sequence, and replays the corresponding abnormal events to generate event response data generated during the execution process.

[0101] In this embodiment, the modules are interconnected using the following method:

[0102] Collect log data, exception identifiers, and call chain information generated in the distributed system, aggregate data from different sources using a unified timestamp, and construct an event stream;

[0103] Perform streaming frequency statistics on the event stream, using an improved Count-Min Sketch data structure to update the event frequency within a sliding window and generate a frequency matrix;

[0104] Based on a set frequency threshold, identify abnormal events whose frequency exceeds the threshold from the frequency matrix and output a set of high-frequency abnormal events;

[0105] Based on a set of high-frequency anomalous events, non-Gaussian independent component analysis is performed using the LiNGAM model to calculate the causal direction relationship between anomalous events and generate a causal direction matrix.

[0106] The frequency matrix and the causal orientation matrix are fused to construct a frequency-causal joint matrix;

[0107] Identify event sequences with causal closed-loop structures from the frequency-causality joint matrix, and perform topological sorting on these sequences to generate minimal causal event sequences;

[0108] Based on the event order and causal relationship in the minimal causal event sequence, a simulation trigger instruction sequence is generated, and each instruction contains a state snapshot identifier and loading order information;

[0109] In the cloud simulation environment, corresponding state snapshots are loaded one by one according to the instruction sequence, the event sequence is replayed in sequence, and the event response data in the reproduction process is output.

[0110] In this embodiment, constructing the event stream includes:

[0111] In the log collection subsystem of the cloud platform, log records, abnormal event identifiers, and call chain tracing data continuously generated during operation are obtained from various business nodes of the distributed system; the log records include operation information logs, performance logs, and error logs; the abnormal event identifiers include alarm items, error codes, and exception stacks; the call chain tracing data includes call chain identifiers, upstream call nodes, downstream adjustment points, and call time information;

[0112] Raw records from different data sources are written to the cloud platform's streaming message channel through the data access gateway. All input data is encapsulated into standard event units according to a preset structure format. The standard event unit contains three basic fields: event identifier, event occurrence time, and event source identifier, in order to achieve format unification for multiple types of data.

[0113] The time field of all event units is standardized through the time synchronization service of the cloud platform, and the local time of the data generated by each business node is uniformly converted into a standard timestamp based on a unified time benchmark; the network time protocol is used for time calibration to keep the synchronization deviation of event timestamps within milliseconds.

[0114] All event units are sorted according to standard timestamps, and events from different service nodes are rearranged according to the order in which they occurred. For events with the same call chain identifier, they are aggregated at the link level according to time order to form a continuous call chain event sequence. For independent events without call chain identifiers, they are directly assigned to the global event sequence according to their timestamps.

[0115] Define the rules for constructing the event flow, divide the sorted event units into several event segments according to continuous time intervals, and combine all event units in each segment in sequence to form a structured sequence; each structured event sequence represents a set of running events that occur within that time segment;

[0116] The resulting structured event sequence is output as an event stream.

[0117] In this embodiment, the generation of the frequency matrix includes:

[0118] The collected event stream is used as input to an improved Count-Min Sketch data structure. This structure uses several hash functions, each corresponding to a count array, to map event identifiers to a fixed-length index space. When the event stream arrives, the event identifier of each running event is mapped sequentially through all the hash functions according to the chronological order of the events, and a count value is incremented at the mapped index position, thus achieving event frequency statistics. To support sliding statistics over time, this Count-Min Sketch structure introduces a sliding window mechanism, independently recording the event frequency within each time period and maintaining the difference between historical snapshots and the latest count as time slides.

[0119] After the statistics are completed, the event frequency statistics results are archived according to the preset time window division criteria. Specifically, the frequency values ​​corresponding to all event identifiers within the current time window are extracted and aggregated by event identifier, and the frequency data of events belonging to the same time window are integrated into a set of frequency statistics values ​​for a time period.

[0120] Define the data structure for the frequency matrix, setting all event identifiers as row indices and time window numbers as column indices. Fill the corresponding matrix cells with the frequency values ​​of events in each time window according to statistical values, thus completing the structure construction and data filling of the frequency matrix.

[0121] Output the constructed frequency matrix.

[0122] In this embodiment, the construction of the improved Count-Min Sketch structure includes the following steps:

[0123] The event stream is used as input. The event stream consists of running events generated sequentially during system operation. Each running event includes at least three fields: event identifier, event occurrence time, and event source identifier. The events are input into the event stream buffer in the order of their occurrence time. The event stream buffer is used to ensure that the events are processed in the order of time during subsequent statistical processes.

[0124] A fixed number of hash functions are configured in the event stream buffer. Each hash function corresponds to a counting array. Each index unit of the counting array corresponds one-to-one with an index position in the time index table. The time index table records the correspondence between the event identifier, the event occurrence time and the index position, which is used to realize the bidirectional mapping between the event identifier and the counting position.

[0125] The event identifier of each running event in the event stream is sequentially input into all hash functions for mapping. At the index position output by each hash function, the count value in the corresponding counting array is incremented by one. The event identifier, the event occurrence time and the binding information of each index position are recorded in the time index table to complete the hash count update of the current time slice and form the hash snapshot data of the current time period.

[0126] A sliding hash snapshot queue is established, which consists of multiple time snapshot units arranged consecutively in chronological order. Each time snapshot unit stores a complete set of counting array states and a corresponding time index table. When the system detects that the time difference between the current time and the previous time snapshot reaches the preset sliding step size condition, the current snapshot is archived to the sliding hash snapshot queue, and a new time snapshot unit is created to record the count changes in the next time period.

[0127] Between two adjacent time snapshot units, a difference operation is performed on the count values ​​at the same index position in each counting array to obtain the frequency change value of the index in the two time periods. The difference results of each index position are recorded in the frequency difference table. Each item in the frequency difference table is used to represent the frequency increase or decrease of the corresponding event in the current sliding cycle.

[0128] Extract all index positions with non-zero differences from the frequency difference table, and perform reverse lookup on these index positions based on the time index table to obtain the corresponding event identifier and event occurrence time information. Construct an event frequency offset sequence. The event frequency offset sequence is used to centrally record all events whose frequency changes within the current sliding cycle and the magnitude of the change.

[0129] The frequency increment of each event identifier in the event frequency offset sequence is compared with a pre-set frequency increment threshold. If the frequency increment of any event identifier exceeds the threshold, the event identifier and its corresponding hash index sequence are written into the abnormal event index table, and the event identifier is added to the abnormal trigger queue, thereby realizing the rapid marking of frequency surge events and the capture of abnormal trigger sources.

[0130] Based on the chronological order of event identifiers in the abnormal trigger queue and their association information in the time index table, the event causal chain index structure is reconstructed. The event causal chain index structure represents the sequence of abnormal events that may have causal dependencies in the time dimension, and serves as the input for the subsequent simulation trigger control instruction generation step, to ensure that abnormal events are loaded and replayed in a near-original causal order in the cloud simulation environment.

[0131] The counting array states contained in each time snapshot unit in the entire sliding hash snapshot queue are combined according to the time window number to form a frequency statistics matrix. Each row in the frequency statistics matrix corresponds to an event identifier, each column corresponds to a time window number, and each cell represents the cumulative frequency of the event identifier in the corresponding time window. This frequency statistics matrix is ​​used as the input data for the frequency matrix generation step, and the event causal chain index structure is used as the input basis for the fault triggering control logic.

[0132] In this embodiment, the construction of the high-frequency abnormal event set includes:

[0133] Obtain the frequency matrix, which consists of event identifiers and time windows. Each cell represents the frequency statistics of that event identifier within that time window.

[0134] Based on the arrangement order of the sliding time windows, extract the frequency vector corresponding to each event identifier. Each element in the frequency vector represents the frequency of the event identifier within a certain time window.

[0135] Calculate the mean and standard deviation of the frequency distribution of the frequency vector, and obtain the global mean and global standard deviation of all event identifiers in the previous sliding period to form a window context fluctuation parameter set;

[0136] Based on the contextual fluctuation parameter set, an adaptive frequency threshold is set for this event identifier. The adaptive frequency threshold is the result of a weighted calculation of the current frequency mean and the standard deviation of the previous period. The specific calculation method is as follows:

[0137] Adaptive frequency threshold = mean of current event frequency vector + α × standard deviation of global frequency in the previous period

[0138] Where α is a preset scaling factor with a fixed value;

[0139] Based on the calculation of the adaptive frequency threshold, dual-threshold recognition conditions are set, including:

[0140] Threshold 1: The frequency of an event identifier within any time window is higher than its corresponding adaptive frequency threshold;

[0141] Threshold 2: The frequency difference of an event identifier within two consecutive time windows exceeds a set frequency growth rate threshold;

[0142] Event identifiers that meet the above two conditions are filtered to construct an abnormal event candidate set. Each element in the abnormal event candidate set contains an event identifier, a time window number, and a corresponding frequency value.

[0143] Each event identifier is read from the candidate set of abnormal events. The event node with a directed connection to the event identifier is searched in the historical cause-effect graph pre-generated by the system. If a closed path structure is formed between the candidate event and the node in the cause-effect graph, the event identifier is marked as a high-frequency abnormal event.

[0144] All event identifiers that satisfy the causal closed-loop verification are grouped into a high-frequency abnormal event set, and this high-frequency abnormal event set is output as input data for the causal direction relationship calculation step and the fault reproduction triggering step.

[0145] In this embodiment, the generation of the causal direction matrix includes the following steps:

[0146] Frequency data of each event in a high-frequency anomalous event set across multiple time windows are extracted to construct an observation data matrix. Observation data matrix The Middle Line number Column elements Indicates an event In the Frequency of occurrence within a time window;

[0147] For matrix Calculate the standard deviation for each column. A normalized diagonal weight matrix is ​​constructed based on all standard deviations. Its definition is:

[0148] ;

[0149] in, Represents the observation matrix The Middle Columns, corresponding events The standard deviation of the frequency series over the entire time window is used to construct the weight matrix. normalized parameters

[0150] Multiplying the observation matrix on the left by the weight matrix yields the weighted observation matrix. And use it as input for causal modeling;

[0151] For the weighted observation matrix Perform centering and variance normalization to obtain a standardized matrix. Each column has a zero mean and a unit standard deviation;

[0152] For the standardized matrix Perform independent component analysis to establish the following decomposition relationships: ,in This is the mixing coefficient matrix, representing the intensity of direct contributions between events; The matrix consists of independent non-Gaussian source signals;

[0153] Sliding window bootstrap resampling is performed along the row dimensions of the normalized matrix, for a total of Each resampling yields a set of candidate mixing matrices. ,

[0154] And count the position of each matrix in The proportion of non-zero values ​​in each iteration; setting a stability threshold. Construct a stability mask matrix ,in:

[0155] ;

[0156] Mixing matrix With mask matrix Element-wise multiplication yields a stable mixture matrix. ;in This represents Hadamard multiplication;

[0157] Structural equation modeling is performed based on stable hybrid matrices to construct causal direction matrices. The calculation formula is as follows: ;

[0158] in, It is the identity matrix. Indicates an event Regarding the event The intensity of the direct causal influence;

[0159] For the causal direction matrix The graph structure is subjected to loop detection. If a directed cycle is detected, the edges with the lowest causal strength are deleted in ascending order of edge weight and the topology is re-sorted until a directed acyclic graph is formed.

[0160] Output the corrected causal direction matrix And use it as input data for the frequency-causality joint matrix construction step and as the basis for the causal source in the minimum causal closed loop identification step;

[0161] In constructing the causal orientation matrix, a stable mixing matrix is ​​obtained. This matrix is ​​a square matrix with the number of rows and columns equal to the number of high-frequency anomalous events. Each row in the matrix represents an affected event, and each column represents a potential causal event. The value in the i-th row and j-th column represents the mixing contribution coefficient of event j to event i. Under the premise that the matrix satisfies the invertibility condition, its inverse matrix is ​​calculated. Subsequently, an identity matrix with the same dimensions as the stable mixing matrix is ​​constructed. The main diagonal elements of the identity matrix are 1, and the other elements are 0. The inverse matrix of the stable mixing matrix is ​​subtracted from the identity matrix to obtain the causal orientation matrix. Each element in the causal orientation matrix represents the direct causal effect strength of a potential causal event on another event. If the element is zero, it means that there is no direct causal relationship between the two events. After completing the calculation of the causal orientation matrix, this matrix is ​​used as the input for subsequent construction of the frequency-causal joint matrix and identification of the causal relationship of the smallest causal event sequence.

[0162] In this embodiment, the construction of the frequency-causality joint matrix includes:

[0163] The frequency matrix is ​​received. Each row in the frequency matrix corresponds to an event identifier, and each column corresponds to a time window number. The elements in the matrix represent the statistical frequency value of the corresponding event within the specified time window.

[0164] Receive the causal direction matrix. Each row in the causal direction matrix represents the source event, each column represents the target event, and the elements in the matrix represent the causal strength value of the source event to the target event.

[0165] The average frequency value of each event identifier in the statistical frequency matrix over all time windows is used to obtain the frequency mean vector, where each vector element represents the average statistical frequency of an event identifier over all time windows.

[0166] The frequency mean vector is transformed into a diagonal matrix, and the diagonal elements of the diagonal matrix are filled with the average frequency value of each event identifier, while the off-diagonal elements are set to zero.

[0167] Perform matrix multiplication to multiply the causal direction matrix with the frequency diagonal matrix to obtain the frequency-causal joint matrix. Each element in the joint matrix represents the frequency weighting intensity of a target event in the causal propagation direction.

[0168] Output a frequency-causality joint matrix, used for filtering event sequences and constructing causal paths in the minimum causal event closed-loop identification step.

[0169] In this embodiment, the generation of the minimum causal event sequence includes:

[0170] Extract the frequency-causality joint matrix, and construct a directed weighted graph structure based on the value of each element in the joint matrix. Each node in the graph represents an abnormal event identifier, the direction of each directed edge represents the causal propagation direction, and the edge weight is the value of the corresponding element in the joint matrix.

[0171] Perform a loop detection operation on the directed graph structure. Determine whether there is a causal closed loop based on the closed path formed by path backtracking in the graph structure. If there is, record all participating nodes in the closed loop path.

[0172] In the path where causal loops are detected, all edge weights are sorted, the directed edge with the smallest edge weight is identified and removed from the graph structure.

[0173] After performing the edge deletion operation, the loop detection operation is re-executed. If a closed loop path still exists, the deletion and backtracking detection of the edge with the smallest edge weight are continued until the cause-effect graph structure no longer contains any directed loops.

[0174] After completing the construction of the acyclic structure, a topological sorting operation is performed on all nodes in the causal graph. All event nodes are arranged according to the connection order between the start and end points of the directed edges, forming an event sorting list under the undirected cycle constraint.

[0175] The event nodes after topological sorting are renumbered according to their positions in the sorting list, and the number sequence is output as the minimum causal event sequence.

[0176] In this embodiment, the generation of the simulation trigger instruction sequence includes:

[0177] Receive the minimum causal event sequence. Each event identifier in the minimum causal event sequence corresponds to a topological sorting index, which indicates the order of the event in the causal dependency path.

[0178] Based on each event identifier in the minimum causal event sequence, the index mapping rules are invoked to retrieve the corresponding historical state snapshot from the event snapshot storage database, extract the globally unique identifier of each state snapshot, and establish a one-to-one mapping relationship between the event identifier and the state snapshot identifier.

[0179] All event identifiers are sorted in ascending order according to the topological sorting index. The state snapshot identifiers mapped to each event identifier are read sequentially according to the sorting order to generate a list of state snapshot identifiers. Each element in the list represents the loading position in the simulation execution flow.

[0180] Each element in the state snapshot identifier list is assigned a corresponding loading sequence number, which is equal to the sorting position number of the state snapshot in the minimum causal event sequence.

[0181] Construct simulation trigger instructions. Each simulation trigger instruction consists of two fields: a state snapshot identifier field and a loading sequence field. Combine the state snapshot identifier with the corresponding loading sequence number to form a complete instruction.

[0182] Arrange all simulation trigger commands in ascending order of loading order to generate a simulation trigger command sequence. This sequence serves as the input sequence used in the simulation execution steps to drive the snapshot to load and replay the corresponding abnormal events sequentially.

[0183] Example:

[0184] To verify the feasibility and effectiveness of this invention, it was applied to a data-driven financial cloud service company whose core business is real-time settlement and payment transactions. The company employs a distributed microservice architecture, with its system consisting of over a thousand container nodes, processing approximately 200 million transaction requests daily. The system experiences high operational pressure and complex data chains, frequently exhibiting short-term, unreproducible anomalies such as interface timeouts, database connection leaks, and cache blocking. Traditional log analysis methods primarily rely on manual retrieval and experience-based judgment. Due to the asynchronous timelines of different nodes and the massive volume of events, it often takes several hours to locate the problem, and most anomalies are difficult to reproduce. This invention aims to solve this problem, achieving accurate fault detection, causal reasoning, and simulation reproduction.

[0185] In this project, the method of this invention is deployed on an enterprise's cloud operations and maintenance platform. By integrating a distributed log system, a call chain tracing system, and a snapshot storage module, a unified event stream collection environment is constructed. The system first unifies the timestamps of the runtime logs, exception identifiers, and call chain information. Data from different nodes is then reordered according to UTC time format to align event order with millisecond-level precision, generating standardized multi-source event streams. During the peak trading period in the early morning of September 2nd, the system collected approximately 12GB of log data, containing about 3.2 million event records. After unified time aggregation, 5800 complete call chain event streams were generated, with each event stream containing an average of 52 nodes. Through this preprocessing, the system effectively solves the event out-of-order problem caused by time drift in a distributed environment, providing high-precision input data for subsequent frequency statistics and causal analysis.

[0186] After the event stream is constructed, the system enters the frequency statistics phase. This invention employs an improved Count-MinSketch structure to perform streaming statistics on event frequencies within a sliding window. The system sets the window size to 5 minutes and the sliding step size to 30 seconds. Each time window corresponds to a counting array, and event identifiers are mapped and counted using a hash function. As the time window slides, the system automatically generates a new counting snapshot and calculates the difference between adjacent snapshots to obtain the event frequency change matrix. If the frequency increment of an event within the sliding period exceeds an adaptive threshold (calculated by multiplying the standard deviation of the previous period by 1.5), the system automatically determines that the event is a potential abnormal event. In a transaction peak detection, the system found that the frequency of the "Redis connection timeout" event increased from 4 times to 27 times between adjacent windows, exceeding the threshold of 19 times. The system then marked this event as an abnormal event and added it to the abnormal event candidate set. Through the sliding snapshot differential mechanism, the system can capture the dynamic evolution process of high-frequency anomalies in real time, improving detection sensitivity by approximately 40% compared to traditional statistical methods.

[0187] After obtaining the set of high-frequency anomalous events, the system enters the causal inference stage. This invention uses the LiNGAM model to infer the causal direction between anomalous events. The system constructs an observation matrix from the frequency data of anomalous events within different time windows and extracts potential non-Gaussian source signals through independent component analysis. The system executes the FastICA algorithm on cloud computing nodes, setting the number of iterations to 1000 and the convergence threshold to 0.0001, calculating the mixture matrix and its inverse matrix to construct the causal direction matrix. To improve the stability of inference, the system performs 100 bootstrap resampling operations on the data, calculates the stability mask matrix, removes unstable causal relationships, and finally generates a stable causal direction matrix. The inference results show that in this anomalous scenario, the causal chain is "thread pool blocking → Redis access delay → database connection exhaustion → payment interface timeout," with "Redis access delay" having the highest causal weight of 0.82. This model effectively reveals the true transmission relationship between events, avoiding the drawback of traditional correlation analysis's inability to distinguish causal directions.

[0188] The system generates a frequency-causality joint matrix by fusing the causal direction matrix and the frequency matrix. This matrix comprehensively reflects both the frequency intensity and the causal influence intensity of events. Based on the numerical relationships within the joint matrix, the system constructs a directed weighted graph and performs loop detection. When a closed loop is detected, the system automatically identifies the smallest causal loop and gradually eliminates edges with lower causal strength until a loop-free structure is formed. After processing, the system generates the smallest causal event sequence as follows: "Thread pool blocking → Redis access delay → Database connection exhaustion → Payment interface timeout". This result indicates that the root cause of the payment anomaly lies in the cache access blocking caused by upstream thread pool resource consumption, which further leads to database connection resource exhaustion. Through causal loop identification and topology sorting, the system successfully simplifies complex event chains into executable core causal paths.

[0189] After the causal path is determined, the system automatically generates a sequence of simulation trigger instructions, each corresponding to a state snapshot identifier and a loading sequence number. For example, the system generates the instruction "snapshot_redis_20240902T010205" as the first instruction, representing loading a snapshot of the Redis abnormal state in the simulation environment; the second instruction is "snapshot_mysql_20240902T010225," corresponding to a snapshot of the database resource state; and the third instruction is "snapshot_threadpool_20240902T010255," used to reproduce the thread pool blocking state. The cloud simulation execution module loads each snapshot in sequence according to the instruction sequence and replays the events sequentially in the isolated sandbox environment. By comparing the event stream generated by the simulation with the original log records, the system found that the event matching rate reached 98.6%, and the similarity of the CPU utilization curve was 97.2%. The entire replay process took only 12 minutes, completely reproducing the abnormal scenario of "payment interface timeout" in the production environment.

[0190] To verify the performance advantages of the system of this invention, the company selected 48 complex faults from September 1st to September 10th for comparative testing. Of these, 24 were diagnosed using traditional manual troubleshooting methods, and 24 were diagnosed using the method of this invention. The test results are shown in the table below:

[0191] Table 1 Comparison of the effects of traditional methods and the method of this invention

[0192] ;

[0193] As shown in Table 1, this invention achieves a systematic leap in key operational indicators compared to traditional troubleshooting methods: the average fault location time has decreased from 142.7 minutes to 26.3 minutes, a reduction of approximately 81.6%, indicating that "unified timestamp event stream + sliding window frequency statistics" significantly compresses the time spent on retrieval and initial judgment; the fault reproduction success rate has increased from 35.4% to 92.3%, an improvement of 56.9 percentage points (approximately 2.6 times), demonstrating that "causal closed-loop identification + minimum causal sequence replay" can stably reconstruct complex links; the accuracy rate of high-frequency anomaly identification has increased from 70.8% to 97.1%, an improvement of 26.3 percentage points, and combined with the causal path consistency rate increasing from 67.5% to 94.6% (+27.1 percentage points), it reflects the "Count-Min" principle. The combination of Sketch enhanced statistics, LiNGAM causal reasoning, and frequency-causal joint matrix synergistically enhances the effectiveness of root cause localization and noise filtering. The proportion of manual intervention in operation and maintenance decreased from 88.5% to 29.4% (a decrease of 59.1 percentage points, or about 67% reduction in investment), which is consistent with the decrease in fault misjudgment rate from 12.1% to 2.4% (a decrease of 80%). This demonstrates that automated analysis and cloud simulation replay not only improve accuracy but also significantly reduce labor costs and the risk of secondary interference. Overall, it reflects a closed-loop benefit of "faster localization - more accurate reproduction - less manpower - more stable decision-making".

[0194] The above experiments demonstrate that this invention possesses significant advantages in distributed systems. On one hand, the improved Count-Min Sketch sliding hash snapshot structure enables high-precision dynamic capture of event frequency; on the other hand, non-Gaussian causal analysis based on the LiNGAM model accurately infers the directional relationships between abnormal events, and, combined with the frequency-causality joint matrix, achieves causal loop identification, thereby generating a minimal causal event sequence and providing an executable path for cloud simulation. Finally, through a state snapshot loading and replay mechanism, automated reproduction and causal verification of complex faults are achieved.

[0195] In summary, this invention not only solves the problems of out-of-order events, difficulty in reproducing anomalies, and unclear causal chains in distributed systems, but also achieves an integrated design of anomaly detection, causal reasoning, and cloud replay. Practical verification has shown that this method significantly improves the intelligence and automation level of system operation and maintenance, and possesses scalability and engineering application value.

[0196] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cloud platform based fault capture, simulation reproduction system, characterized in that, include: The event stream construction module collects log data, exception identifiers, and call chain information in the cloud platform, aggregates them according to a unified timestamp format, and generates an event stream. The frequency statistics module receives event streams, adopts an improved Count-Min Sketch structure, and outputs a frequency matrix; Use the event stream as input; A fixed number of hash functions are set in the event stream buffer. Each hash function corresponds to a counting array. Each index unit of the counting array corresponds one-to-one with the time index table. The time index table records the correspondence between the event identifier, the event occurrence time, and the index position. Each event identifier in the event stream is sequentially input into all hash functions for mapping, a count value is added at the index position of the corresponding counting array, and the binding information between the event identifier and the index position is registered in the time index table to generate a hash snapshot of the current time period. Establish a sliding hash snapshot queue, which consists of consecutively arranged time snapshot units. Each time snapshot unit stores the complete state of the counting array and the corresponding time index table. When the time reaches the sliding step size condition, the current snapshot is archived and a new time snapshot unit is generated. Between two adjacent time snapshot units, calculate the difference in the count values ​​at the same index position and record the difference results in the frequency difference table; Extract all index positions with non-zero differences from the frequency difference table, and look up the corresponding event identifier and event occurrence time from the time index table to construct an event frequency offset sequence. The event frequency offset sequence records all events whose frequency changes within the current sliding cycle. If the frequency increment of any event identifier in the event frequency offset sequence exceeds the set threshold, the event identifier and its corresponding hash index sequence are written into the abnormal event index table, and the event identifier is added to the abnormal trigger queue. Reconstruct the event causal chain index structure based on the chronological order of event identifiers in the exception trigger queue; The counting array states in all sliding hash snapshot queues are combined into a frequency statistics matrix in chronological order. Each row in the frequency statistics matrix corresponds to an event identifier, each column corresponds to a time window number, and each cell represents the cumulative frequency of the event identifier in the corresponding time window. The anomaly detection module receives the frequency matrix, compares the frequency of each event with a set threshold, and outputs a set of high-frequency anomaly events. The causal reasoning module receives a set of high-frequency abnormal events and generates a causal direction matrix based on the LiNGAM model. The joint modeling module receives the frequency matrix and the causal direction matrix, and performs matrix fusion to generate a frequency-causal joint matrix. The causal closed-loop identification module receives the frequency-causal joint matrix and outputs the minimum causal event sequence that satisfies the topological sorting requirement. The trigger instruction generation module receives the minimum causal event sequence and generates an instruction sequence according to the causal direction between events. Each instruction corresponds to a state snapshot identifier and loading order. The simulation execution module loads snapshots sequentially in the cloud environment according to the state snapshot identifiers and loading order in the instruction sequence, and replays the corresponding abnormal events to generate event response data generated during the execution process.

2. A method for fault capture and simulation reproduction based on a cloud platform, characterized in that, The system modules are interconnected using the following methods: Collect log data, exception identifiers, and call chain information generated in the distributed system, aggregate data from different sources using a unified timestamp, and construct an event stream; The event stream is subjected to streaming frequency statistics. An improved Count-Min Sketch structure is used to update the event frequency within a sliding window and generate a frequency matrix. The event stream is used as input. A fixed number of hash functions are set in the event stream buffer. Each hash function corresponds to a counting array. Each index unit of the counting array corresponds one-to-one with the time index table. The time index table records the correspondence between the event identifier, the event occurrence time and the index position. Each event identifier in the event stream is sequentially input into all hash functions for mapping, a count value is added at the index position of the corresponding counting array, and the binding information between the event identifier and the index position is registered in the time index table to generate a hash snapshot of the current time period. Establish a sliding hash snapshot queue, which consists of consecutively arranged time snapshot units. Each time snapshot unit stores the complete state of the counting array and the corresponding time index table. When the time reaches the sliding step size condition, the current snapshot is archived and a new time snapshot unit is generated. Between two adjacent time snapshot units, calculate the difference in the count values ​​at the same index position and record the difference results in the frequency difference table; Extract all index positions with non-zero differences from the frequency difference table, and look up the corresponding event identifier and event occurrence time from the time index table to construct an event frequency offset sequence. The event frequency offset sequence records all events whose frequency changes within the current sliding cycle. If the frequency increment of any event identifier in the event frequency offset sequence exceeds the set threshold, the event identifier and its corresponding hash index sequence are written into the abnormal event index table, and the event identifier is added to the abnormal trigger queue. Reconstruct the event causal chain index structure based on the chronological order of event identifiers in the exception trigger queue; The counting array states in all sliding hash snapshot queues are combined into a frequency statistics matrix in chronological order. Each row in the frequency statistics matrix corresponds to an event identifier, each column corresponds to a time window number, and each cell represents the cumulative frequency of the event identifier in the corresponding time window. Based on a set frequency threshold, identify abnormal events whose frequency exceeds the threshold from the frequency matrix and output a set of high-frequency abnormal events; Based on a set of high-frequency anomalous events, non-Gaussian independent component analysis is performed using the LiNGAM model to calculate the causal direction relationship between anomalous events and generate a causal direction matrix. The frequency matrix and the causal orientation matrix are fused to construct a frequency-causal joint matrix; Identify event sequences with causal closed-loop structures from the frequency-causality joint matrix, and perform topological sorting on the event sequences to generate the minimum causal event sequence; Based on the event order and causal relationship in the minimal causal event sequence, a simulation trigger instruction sequence is generated, and each instruction contains a state snapshot identifier and loading order information; In the cloud simulation environment, corresponding state snapshots are loaded one by one according to the instruction sequence, the event sequence is replayed in sequence, and the event response data in the reproduction process is output.

3. The fault capture and simulation reproduction method based on a cloud platform according to claim 2, characterized in that, The generation of the frequency matrix includes: Collect event streams, which consist of sequentially generated runtime events during system operation. Each runtime event includes an event identifier, event occurrence time, and event source identifier. The event stream is taken as input and fed into the improved Count-Min Sketch structure. Frequency statistics are performed on each running event according to the arrival order of the events, and the event frequency statistics results are output. Based on the time window division criteria, the statistical frequency corresponding to each event identifier in the event frequency statistics results is classified, and the statistical data of events belonging to the same time window are summarized into frequency statistics values ​​within the time period. Set the structure of the frequency matrix, use event identifiers as row indices and time windows as column indices, and fill the matrix cells sequentially according to the frequency values ​​of each event identifier in each time window in the frequency statistics results to complete the content filling of the frequency matrix.

4. The fault capture and simulation reproduction method based on a cloud platform according to claim 2, characterized in that, The construction of a high-frequency abnormal event set includes: Obtain the frequency matrix; Based on the arrangement order of the sliding time windows, extract the frequency vector corresponding to each event identifier. Each element in the frequency vector represents the frequency of the event identifier within a certain time window. Calculate the mean and standard deviation of the frequency distribution of the frequency vector, and obtain the global mean and global standard deviation of all event identifiers in the previous sliding period to form a window context fluctuation parameter set; Based on the context fluctuation parameter set, an adaptive frequency threshold for the event identifier is set. The adaptive frequency threshold is the result of a weighted calculation of the current frequency mean and the standard deviation of the previous period. Based on the calculation of the adaptive frequency threshold, dual-threshold recognition conditions are set, including: Threshold 1: The frequency of an event identifier within any time window is higher than its corresponding adaptive frequency threshold; Threshold 2: The frequency difference of an event identifier within two consecutive time windows exceeds a set frequency growth rate threshold; Event identifiers that meet the above two conditions are filtered to construct an abnormal event candidate set. Each element in the abnormal event candidate set contains an event identifier, a time window number, and a corresponding frequency value. Each event identifier is read from the candidate set of abnormal events. The event node with a directed connection to the event identifier is searched in the historical cause-effect graph pre-generated by the system. If a closed path structure is formed between the candidate event and the node in the cause-effect graph, the event identifier is marked as a high-frequency abnormal event. All event identifiers that satisfy the causal closed-loop verification are grouped into a high-frequency abnormal event set, and the high-frequency abnormal event set is output.

5. The fault capture and simulation reproduction method based on a cloud platform according to claim 2, characterized in that, The generation of the causal direction matrix includes: Extracting each event from the set of high-frequency abnormal events Frequency data within a time window are used to construct an observation data matrix. ,in Number of time windows The number of abnormal events is the number of events in the matrix. Line number Column elements Indicates an event In the Frequency of occurrence within a time window; For matrix Calculate the standard deviation for each column. A normalized diagonal weight matrix is ​​constructed based on all standard deviations. ; Multiplying the observation matrix on the left by the normalized diagonal weight matrix yields the weighted observation matrix. And use it as input for causal modeling; For the weighted observation matrix Perform centering and variance normalization to obtain a standardized matrix. Each column has a zero mean and a unit standard deviation; For the standardized matrix Perform independent component analysis to establish the following decomposition relationships: ,in This is the mixing coefficient matrix, representing the intensity of direct contributions between events; The matrix consists of independent non-Gaussian source signals; Sliding window bootstrap resampling is performed along the row dimensions of the normalized matrix, for a total of Each resampling yields a set of candidate mixing matrices. , And count the position of each matrix in The proportion of non-zero values ​​in each iteration; setting a stability threshold. Construct a stability mask matrix ; Mixing matrix With mask matrix Element-wise multiplication yields a stable mixture matrix. ;in This represents Hadamard multiplication; Structural equation modeling is performed based on stable hybrid matrices to construct causal direction matrices. ; For the causal direction matrix The graph structure is subjected to loop detection. If a directed cycle is detected, the edges with the lowest causal strength are deleted in ascending order of edge weight and the topology is re-sorted until a directed acyclic graph is formed. Output the corrected causal direction matrix .

6. The fault capture and simulation reproduction method based on a cloud platform according to claim 2, characterized in that, The construction of the frequency-causality joint matrix includes: The frequency matrix is ​​received. Each row in the frequency matrix corresponds to an event identifier, and each column corresponds to a time window number. The elements in the matrix represent the statistical frequency value of the corresponding event within the specified time window. Receive the causal direction matrix. Each row in the causal direction matrix represents the source event, each column represents the target event, and the elements in the matrix represent the causal strength value of the source event to the target event. The average frequency value of each event identifier in the statistical frequency matrix over all time windows is used to obtain the frequency mean vector, where each vector element represents the average statistical frequency of an event identifier over all time windows. The frequency mean vector is transformed into a diagonal matrix, and the diagonal elements of the diagonal matrix are sequentially filled with the average frequency value of each event identifier, while the off-diagonal elements are set to zero. Perform matrix multiplication to multiply the causal direction matrix with the frequency diagonal matrix to obtain the frequency-causal joint matrix. Each element in the joint matrix represents the frequency weighting intensity of a target event in the causal propagation direction. Output frequency-causality joint matrix.

7. The fault capture and simulation reproduction method based on a cloud platform according to claim 2, characterized in that, The generation of the minimal causal event sequence includes: Extract the frequency-causality joint matrix, and construct a directed weighted graph structure based on the value of each element in the joint matrix. Each node in the graph represents an abnormal event identifier, the direction of each directed edge represents the causal propagation direction, and the edge weight is the value of the corresponding element in the joint matrix. Perform a loop detection operation on the directed weighted graph structure, and determine whether there is a causal closed loop based on the closed path formed by path backtracking in the graph structure. If there is, record all participating nodes in the closed loop path. In the path where causal loops are detected, all edge weights are sorted, the directed edge with the smallest edge weight is identified and removed from the graph structure. After performing the edge deletion operation, the loop detection operation is re-executed. If a closed loop path still exists, the deletion and backtracking detection of the edge with the smallest edge weight are continued until the cause-effect graph structure no longer contains any directed loops. After completing the construction of the acyclic structure, a topological sorting operation is performed on all nodes in the causal graph. All event nodes are arranged according to the connection order between the start and end points of the directed edges, forming an event sorting list under the undirected cycle constraint. The event nodes after topological sorting are renumbered according to their positions in the sorting list, and the numbering sequence is output as the minimum causal event sequence.

8. The fault capture and simulation reproduction method based on a cloud platform according to claim 2, characterized in that, The generation of the simulation trigger command sequence includes: Receive the minimum causal event sequence, where each event identifier in the minimum causal event sequence corresponds to a topological sorting index, which indicates the order of the events in the causal dependency path; Based on each event identifier in the minimum causal event sequence, the index mapping rules are invoked to retrieve the corresponding historical state snapshot from the event snapshot storage database, extract the globally unique identifier of each state snapshot, and establish a one-to-one mapping relationship between the event identifier and the state snapshot identifier. All event identifiers are sorted in ascending order according to the topological sorting index. The state snapshot identifiers mapped to each event identifier are read sequentially according to the sorting order to generate a list of state snapshot identifiers. Each element in the list represents the loading position in the simulation execution flow. Each element in the state snapshot identifier list is assigned a corresponding loading sequence number, which is equal to the sorting position number of the state snapshot in the minimum causal event sequence. Construct simulation trigger instructions. Each simulation trigger instruction consists of two fields: a state snapshot identifier field and a loading sequence field. Combine the state snapshot identifier with the corresponding loading sequence number to form a complete instruction. Arrange all simulation trigger commands in ascending order of loading order to generate a simulation trigger command sequence.

Images