Fault information determination method and device, equipment, medium and program product

Abstract

The invention provides a fault information determination method and device, equipment, a medium and a program product, and can be applied to the technical field of artificial intelligence and the technical field of financial science and technology. The method comprises the following steps: performing entity identification on abnormal data related to operation of the distributed system to obtain an abnormal entity; an associated entity associated with the abnormal entity is determined from multiple entities included in the target knowledge graph, the entities are used for representing objects related to the fault determination requirement of the distributed system, and the target knowledge graph is obtained by supplementing the basic knowledge graph according to a supplementary entity; the supplementary entity is determined according to a clustering result of multiple candidate entity feature data, and the candidate entity feature data is obtained by performing feature extraction on supplementary corpora related to operation of the distributed system; and determining fault information according to the attribute information of the associated entity.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence technology and financial technology technology, and more specifically to a method, apparatus, device, medium and program product for determining fault information. Background Technology

[0002] Distributed systems are large in scale and highly complex. In the event of system failure, it is necessary to rely on the experience of operation and maintenance personnel to manually locate the cause of the failure. This consumes too much human resources and the accuracy of fault location is not accurate, resulting in low system failure recovery efficiency. Summary of the Invention

[0003] In view of the above problems, this application provides a method, apparatus, device, medium and program product for determining fault information.

[0004] According to a first aspect of this application, a method for determining fault information is provided, comprising: performing entity identification on abnormal data related to the operation of a distributed system to obtain abnormal entities; determining associated entities related to the abnormal entities from multiple entities included in a target knowledge graph, wherein the entities are used to characterize objects related to the fault determination requirements of the distributed system, the target knowledge graph is obtained by supplementing a basic knowledge graph with supplementary entities, the supplementary entities are determined based on the clustering results of feature data of multiple candidate entities, and the candidate entity feature data are obtained by feature extraction from supplementary sample data related to the operation of the distributed system; and determining fault information based on the attribute information of the associated entities.

[0005] According to an embodiment of this application, determining the associated entities related to an abnormal entity from multiple entities included in a target knowledge graph includes: determining a local knowledge subgraph associated with the abnormal entity from the target knowledge graph, wherein the multiple entities in the local knowledge subgraph include the abnormal entity and multiple neighboring entities of the abnormal entity, the multiple relationships in the local knowledge subgraph include the relationship between two related entities, and the multiple neighboring entities include at least one first-order neighboring entities; and determining the associated entities related to the abnormal entity from the multiple entities included in the local knowledge subgraph based on a graph attention strategy and according to the first entity feature data of each of the multiple entities included in the local knowledge subgraph.

[0006] According to an embodiment of this application, based on a graph attention strategy, determining associated entities related to an abnormal entity from multiple neighboring entities included in a local knowledge subgraph based on the first entity feature data of each of the multiple entities included in the local knowledge subgraph includes: aggregating the first entity features of each of the multiple entities included in the local knowledge subgraph based on the graph attention strategy and multiple relations included in the local knowledge subgraph to obtain second entity feature data of each of the multiple entities included in the local knowledge subgraph; and determining associated entities related to an abnormal entity from multiple neighboring entities included in the local knowledge subgraph based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph.

[0007] According to an embodiment of this application, based on a graph attention strategy and multiple relations included in a local knowledge subgraph, the first entity features of each of the multiple entities included in the local knowledge subgraph are aggregated to obtain second entity feature data of each of the multiple entities included in the local knowledge subgraph. This includes: for any entity among the multiple entities included in the local knowledge subgraph, and for any relation among at least one relation associated with the entity in the local knowledge subgraph, based on a graph attention strategy, obtaining an attention weight between the entity and another entity according to the first entity feature data of the entity and the first entity feature data of another entity associated with the relation; and obtaining the second entity feature data of the entity according to the first entity feature data of each of the multiple other entities and the attention weight between the entity and each of the multiple other entities.

[0008] According to an embodiment of this application, determining an associated entity related to an abnormal entity from multiple neighboring entities included in a local knowledge subgraph based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph includes: for any neighboring entity among the multiple neighboring entities included in the local knowledge subgraph, determining the similarity between the abnormal entity and the neighboring entity based on the second entity feature data of the abnormal entity and the second entity feature data of the neighboring entity; and determining an associated entity related to the abnormal entity from multiple neighboring nodes included in the local knowledge subgraph based on the similarity between the abnormal entity and each of the multiple neighboring entities.

[0009] According to an embodiment of this application, entity identification is performed on abnormal data related to the operation of a distributed system to obtain abnormal entities, including: segmenting the abnormal data related to the operation of the distributed system into words to obtain multiple abnormal word vectors; processing the multiple abnormal word vectors based on a self-attention strategy to obtain context vectors for each of the multiple abnormal word vectors; and determining the abnormal entity based on the multiple context vectors.

[0010] According to an embodiment of this application, the associated entities include multiple entities, and the multiple associated entities include solution-type associated entities related to resolving fault information. The method further includes: determining a solution to the fault information based on the attribute information of the solution-type associated entities; and, if the solution is invalid, using the adjusted attribute information of the solution-type associated entities as positive samples for optimizing the target knowledge graph, and using the attribute information of the solution-type associated entities as negative samples for optimizing the target knowledge graph, so as to optimize the target knowledge graph using positive and negative samples.

[0011] According to an embodiment of this application, multiple candidate entity feature data are obtained by performing the following operations: segmenting the supplementary sample data into words to obtain multiple supplementary word vectors; and obtaining multiple candidate entity feature data based on an attention strategy and the multiple supplementary word vectors.

[0012] According to an embodiment of this application, the multiple candidate entity feature data include N, where N is an integer greater than or equal to 2; the supplementary entities are obtained as follows: a target cluster is determined from the supplementary dendrogram based on a predetermined distance threshold and a predetermined number of clusters; supplementary entities are obtained based on the target clusters; wherein, the supplementary dendrogram is obtained by repeatedly performing the following operation until a first cluster is obtained: when 2 < n ≤ N, the distance between the n nth clusters is determined based on the clustering feature data of each of the n nth clusters, thus obtaining n -1 nth distances, where the clustering feature data of the nth cluster is determined based on the candidate entity feature data included in the nth cluster, and each of the N nth clusters includes one candidate entity feature data and the candidate entity feature data included in the N nth clusters are different; determine the target nth distance from the n-1 nth distances, merge the two nth clusters associated with the target nth distance into one cluster, and obtain the n-1th cluster; take the other nth clusters in the n nth clusters except for the two nth clusters as the n-1th clusters.

[0013] According to embodiments of this application, the basic sample data includes at least one of the following: structured basic sample data, semi-structured basic sample data, or unstructured basic sample data; the basic knowledge graph is obtained by performing the following operations: entity recognition, attribute extraction, and relation extraction on the basic sample data to obtain multiple basic entities, attribute information of each of the multiple basic entities, and at least one basic relation, wherein the structured basic sample data, semi-structured basic sample data, and unstructured basic sample data have their own entity recognition methods, their own attribute extraction methods, or their own relation extraction methods; and the basic knowledge graph is obtained based on the multiple basic entities, their own attribute information, and at least one basic relation.

[0014] The second aspect of this application provides a fault information determination apparatus, comprising: an identification module for performing entity identification on abnormal data related to the operation of a distributed system to obtain abnormal entities; a first determination module for determining associated entities related to the abnormal entities from multiple entities included in a target knowledge graph, wherein the entities are used to characterize objects related to the fault determination requirements of the distributed system, the target knowledge graph is obtained by supplementing the basic knowledge graph with supplementary entities, the supplementary entities are determined based on the clustering results of feature data of multiple candidate entities, and the candidate entity feature data are obtained by feature extraction from supplementary sample data related to the operation of the distributed system; and a second determination module for determining fault information based on the attribute information of the associated entities.

[0015] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0016] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0017] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0018] According to embodiments of this application, abnormal data related to the operation of a distributed system is identified through entity recognition to obtain abnormal entities. A target knowledge graph is then acquired to analyze the abnormal entities, identifying associated entities that can influence them. Based on the attribute information of these associated entities, the cause of the abnormal data is determined. Specifically, after constructing a basic knowledge graph, supplementary entities are obtained by extracting features from supplementary sample data. These supplementary entities are then used to update the basic knowledge graph, resulting in the target knowledge graph. Analyzing abnormal entities using the target knowledge graph allows for precise location of associated entities that influence them, avoiding the influence of too many useless entities on fault information judgment. This improves the accuracy and efficiency of fault information determination, reduces resource costs, and, by updating the basic knowledge graph with supplementary entities, avoids information omissions and enhances the accuracy of identifying associated entities. Attached Figure Description

[0019] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0020] Figure 1 The illustration schematically depicts application scenarios of the fault information determination method, apparatus, device, medium, and program product according to embodiments of this application;

[0021] Figure 2 A flowchart illustrating a fault information determination method according to an embodiment of this application is shown schematically.

[0022] Figure 3 A schematic diagram illustrating a fault information determination method according to an embodiment of this application is provided.

[0023] Figure 4 A structural block diagram of a fault information determination device according to an embodiment of this application is shown; and

[0024] Figure 5 A block diagram illustrating an electronic device suitable for implementing a fault information determination method according to an embodiment of this application is shown. Detailed Implementation

[0025] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0026] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0028] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0029] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0030] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0031] Figure 1 This illustration schematically depicts application scenarios of the fault information determination method, apparatus, device, medium, and program product according to embodiments of this application.

[0032] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0033] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0034] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0035] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0036] It should be noted that the fault information determination method provided in this application embodiment can generally be executed by server 105. Correspondingly, the fault information determination device provided in this application embodiment can generally be located in server 105. The fault information determination method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the fault information determination device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] The following will be based on Figure 1 The scenario described herein provides a detailed description of the fault information determination method according to embodiments of this application.

[0039] Figure 2 A flowchart illustrating a fault information determination method according to an embodiment of this application is shown.

[0040] like Figure 2 As shown, the fault information determination method in this embodiment includes operations S210 to S230.

[0041] In operation S210, entity identification is performed on abnormal data related to the operation of the distributed system to obtain abnormal entities.

[0042] In operation S220, the associated entities that are related to the anomalous entity are identified from the multiple entities included in the target knowledge graph.

[0043] Among them, entities are used to represent objects related to the fault determination requirements of distributed systems. The target knowledge graph is obtained by supplementing the basic knowledge graph with supplementary entities. The supplementary entities are determined based on the clustering results of multiple candidate entity feature data. The candidate entity feature data is obtained by feature extraction from supplementary sample data related to the operation of distributed systems.

[0044] In operation S230, fault information is determined based on the attribute information of the associated entity.

[0045] Abnormal data related to the operation of a distributed system can be abnormal logs generated when the distributed system malfunctions, or abnormal system resources obtained by monitoring the system resources during the operation of the distributed system using a distributed monitoring system.

[0046] For exception logs, these can be log data generated during the operation of the distributed system due to system errors. Specifically, the distributed log center collects and scans the log data from each distributed node. When registering logs, distributed nodes in the distributed system need to set an error level. Errors involving accounting, batch interruptions, database anomalies, or other business-related issues are set to ERROR; errors not directly affecting business are set to WARNING. Different processing is applied based on the error level: ERROR errors are sent to the distributed log center in real time, while WARNING errors are sent periodically.

[0047] For abnormal system resources, the distributed monitoring system can determine them from the system resources based on the set anomaly judgment conditions. Specifically, the distributed monitoring system monitors the distributed system's central processing unit (CPU), memory, service throughput, response time and other system resources, and sets thresholds for each system resource. When a system resource is found to be higher than the set threshold, the distributed nodes record the current container logs, machine resources, parameter configuration snapshots and node information as abnormal system resources.

[0048] Abnormal entities in abnormal data can refer to various types of information in abnormal data that have clear meaning and can be identified and distinguished, such as the time and location of the abnormality, which can clearly indicate the abnormal situation.

[0049] According to embodiments of this application, analyzing anomalous data can involve performing contextual analysis on each word or sentence in the anomalous data to identify key information that is of high importance in the anomalous data and treat it as an anomalous entity of the anomalous data.

[0050] A target knowledge graph is a structured data representation of multiple entities and the relationships between them in a graphical form. A target knowledge graph consists of nodes and edges. Nodes represent entities, and edges represent the relationships between multiple entities.

[0051] The target knowledge graph is constructed based on the complex characteristics of distributed systems and the need for root cause localization of faults. The types of entities in the target knowledge graph can include distributed service types, resource types, problem types, and solution types of distributed systems. Each entity is connected according to the entity relationships between them. For example, if resource A is affected by environment A and environment B, resulting in problem A, then the entity "resource A" is related to the entities "environment A" and "environment B" respectively. The entities "environment A", "environment B", and "problem A" are also related.

[0052] The basic sample data can include various types, such as distributed services, resources, problems, and solutions, with each type having a mutually exclusive relationship. Subclasses are also defined for each type: distributed services include in-application services, middleware services, and external services; resources include computing resources, storage resources, and network resources; problems include environmental problems, data problems, and performance problems; and solutions include code changes, version rollbacks, parameter changes, and container operations.

[0053] The basic knowledge graph is a foundational framework generated based on basic sample data related to distributed systems. This framework, according to the complex characteristics of distributed systems, displays the different module frameworks, the relationships between different module functions, and the different hierarchical architectures of the distributed system in the form of a graph. For example, in a distributed system, the relationship between distributed services and in-application services is a parent-child relationship, and the relationship between in-application services and remote procedure call protocol literals is a support relationship. Therefore, the entities "distributed services" and "in-application services" have an edge relationship in the basic knowledge graph, and "remote procedure call protocol literal" is an attribute of the entity "in-application services".

[0054] According to the embodiments of this application, during the construction of the basic knowledge graph, due to the large number of distributed system modules and the significant differences in technical framework and function between different system modules, the basic knowledge graph may omit some nodes and edge relationships. Therefore, it is necessary to supplement the basic knowledge graph with supplementary entities.

[0055] Supplementary entities can be obtained by extracting and clustering supplementary corpora related to the operation of distributed systems using attention mechanisms. These supplementary corpora can include distributed documents, system architecture documents, problem reports, and other corpora.

[0056] Candidate entity feature data is obtained by extracting features from supplementary corpus related to the operation of distributed systems. This candidate entity feature data contains important key information in the supplementary corpus. By clustering multiple candidate entity feature data, they can be divided into structured data, semi-structured data, and unstructured data, thereby obtaining supplementary entities to supplement the corresponding parts of the basic knowledge graph.

[0057] Related entities and abnormal entities have a connection relationship. The related entity can be an entity that has a direct connection relationship with the abnormal entity within a certain range, or it can be an entity that has an indirect connection relationship. There can be multiple related entities, and each related entity is an entity that will affect the abnormal entity.

[0058] According to an embodiment of this application, determining fault information based on the attribute information of associated entities can be done by: splicing and analyzing the attribute information indicated by each of the multiple associated entities to determine the cause of the fault, i.e., fault information. For example, if the abnormal entity is "Resource A", and the associated entities corresponding to the entity "Resource A" are associated entity "Environment A" and associated entity "Environment B", then the fault information is "Resource A is abnormal due to changes in Environment A and / or Environment B".

[0059] According to embodiments of this application, abnormal data related to the operation of a distributed system is identified through entity recognition to obtain abnormal entities. A target knowledge graph is then acquired to analyze the abnormal entities, identifying associated entities that can influence them. Based on the attribute information of these associated entities, the cause of the abnormal data is determined. Specifically, after constructing a basic knowledge graph, supplementary entities are obtained by extracting features from supplementary sample data. These supplementary entities are then used to update the basic knowledge graph, resulting in the target knowledge graph. Analyzing abnormal entities using the target knowledge graph allows for precise location of associated entities that influence them, avoiding the influence of too many useless entities on fault information judgment. This improves the accuracy and efficiency of fault information determination, reduces resource costs, and, by updating the basic knowledge graph with supplementary entities, avoids information omissions and enhances the accuracy of identifying associated entities.

[0060] According to an embodiment of this application, determining the associated entities related to an abnormal entity from multiple entities included in a target knowledge graph includes: determining a local knowledge subgraph associated with the abnormal entity from the target knowledge graph, wherein the multiple entities in the local knowledge subgraph include the abnormal entity and multiple neighboring entities of the abnormal entity, the multiple relationships in the local knowledge subgraph include the relationship between two related entities, and the multiple neighboring entities include at least one first-order neighboring entities; and determining the associated entities related to the abnormal entity from the multiple entities included in the local knowledge subgraph based on a graph attention strategy and according to the first entity feature data of each of the multiple entities included in the local knowledge subgraph.

[0061] A local knowledge subgraph can be a knowledge graph consisting of an abnormal entity, multiple neighboring entities of the abnormal entity, and the relationships between entities. The multiple neighboring entities are determined by preset filtering conditions, which can select a certain number of neighboring entities or select neighboring entities within a certain hierarchy.

[0062] Multiple neighbor entities include at least one-order neighbor entities, that is, neighbor entities that have a connection relationship with the abnormal entity, and may also include multi-order neighbor entities, that is, neighbor entities that have an indirect connection relationship with the abnormal entity.

[0063] According to an embodiment of this application, after identifying an abnormal entity, multiple neighboring entities of the abnormal entity are filtered in the target knowledge graph according to preset filtering conditions, and the abnormal entity, multiple neighboring entities, and the relationship between the entities are determined as a local knowledge subgraph, so as to facilitate the subsequent determination of associated entities based on the local knowledge subgraph.

[0064] Graph attention strategies can be used to calculate the degree of association between two adjacent nodes in a graph. Since adjacent nodes have different degrees of influence on anomalous entities, the degree of association between anomalous entities and entities included in the local knowledge subgraph can be determined based on graph attention strategies. This reflects which entity has a higher degree of influence on the anomalous entity, thereby identifying the associated entities related to the anomalous entity from among the multiple entities included in the local knowledge subgraph.

[0065] The degree of association between entities included in the aforementioned determination of abnormal entities and local knowledge sub-graphs can be calculated based on the first entity feature data of each of the multiple entities. The first entity feature data can be the entity's attribute information and its connection relationships with other entities, etc.

[0066] According to the embodiments of this application, by filtering multiple entities in the local knowledge subgraph based on the graph attention strategy, entities with a high degree of influence on abnormal entities are identified and regarded as associated entities. This avoids inaccurate fault information tracing caused by analyzing too many entities, and achieves accurate determination of fault information, so that the system can locate the cause of the fault in time to restore the system from the abnormality.

[0067] According to an embodiment of this application, based on a graph attention strategy, determining associated entities related to an abnormal entity from multiple neighboring entities included in a local knowledge subgraph based on the first entity feature data of each of the multiple entities included in the local knowledge subgraph includes: aggregating the first entity features of each of the multiple entities included in the local knowledge subgraph based on the graph attention strategy and multiple relations included in the local knowledge subgraph to obtain second entity feature data of each of the multiple entities included in the local knowledge subgraph; and determining associated entities related to an abnormal entity from multiple neighboring entities included in the local knowledge subgraph based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph.

[0068] Aggregating the first entity features of each of the multiple entities included in a local knowledge subgraph can determine the degree of association between any two entities, i.e., the strength, importance, or credibility of the relationship between any two entities.

[0069] In this process, the aggregation of the first entity features can be achieved by analyzing the co-occurrence frequency between the first entity features of two entities. This analysis can be used to determine whether a change in one first entity feature will affect the other first entity feature, thereby obtaining the degree of association between the two entities and ultimately obtaining the second entity feature data for each of the multiple entities.

[0070] After obtaining the second entity feature data of each of the multiple entities, the abnormal entity can select the corresponding entity from the other entities based on its own second entity feature data and use it as the associated entity related to the abnormal entity.

[0071] According to the embodiments of this application, by aggregating the first entity features of each of multiple entities, it is possible not only to analyze the degree of association between abnormal entities and other entities, but also to determine the degree of association between other entities. This allows for the filtering of unnecessary entities while enriching the fault information content, making fault location more in-depth and accurate.

[0072] According to an embodiment of this application, based on a graph attention strategy and multiple relations included in a local knowledge subgraph, the first entity features of each of the multiple entities included in the local knowledge subgraph are aggregated to obtain second entity feature data of each of the multiple entities included in the local knowledge subgraph. This includes: for any entity among the multiple entities included in the local knowledge subgraph, and for any relation among at least one relation associated with the entity in the local knowledge subgraph, based on a graph attention strategy, obtaining an attention weight between the entity and another entity according to the first entity feature data of the entity and the first entity feature data of another entity associated with the relation; and obtaining the second entity feature data of the entity according to the first entity feature data of each of the multiple other entities and the attention weight between the entity and each of the multiple other entities.

[0073] Based on the first entity feature data of an entity and the first entity feature data of another entity with which it is related, the attention weight between the two entities can be obtained. Specifically, this can be achieved by analyzing the co-occurrence frequency of attribute information in the two first entity features, such as the number of times the attribute information of the two entities appears in the same text; or by analyzing the same connection relationship in the connection relationship between the two first entity features, such as whether the two entities have connection relationships with the same other entities. Based on the above analysis, the attention weight between the two entities can be determined.

[0074] Based on the above operations, the attention weights between any entity and other entities are calculated for any entity among the multiple entities, resulting in multiple attention weights. These multiple attention weights are then used as the second entity feature data of that entity.

[0075] According to embodiments of this application, the influence of other entities on different entities varies. Based on the graph attention strategy, the attention weights between entities can be analyzed to obtain the second entity feature data of the entity, thereby clearly distinguishing the degree of association between the entity and other entities.

[0076] According to an embodiment of this application, determining an associated entity related to an abnormal entity from multiple neighboring entities included in a local knowledge subgraph based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph includes: for any neighboring entity among the multiple neighboring entities included in the local knowledge subgraph, determining the similarity between the abnormal entity and the neighboring entity based on the second entity feature data of the abnormal entity and the second entity feature data of the neighboring entity; and determining an associated entity related to the abnormal entity from multiple neighboring nodes included in the local knowledge subgraph based on the similarity between the abnormal entity and each of the multiple neighboring entities.

[0077] Based on the second entity feature data of the abnormal entity and the second entity feature data of the neighboring entities, we analyze whether the attention weights of the abnormal entity and the neighboring entities are similar to determine the similarity between the abnormal entity and the neighboring entities. The similarity represents the degree of consistency between the attention weights of the abnormal entity and the neighboring entities.

[0078] Based on the similarity between the abnormal entity and its multiple neighboring entities, select multiple associated entities with high similarity to the abnormal entity from among the multiple neighboring entities. This can be done by ranking the similarity and selecting a certain number of neighboring entities as associated entities according to the ranking, or by setting a similarity threshold and selecting multiple neighboring entities that meet the similarity threshold as associated entities.

[0079] According to the embodiments of this application, by judging the similarity between abnormal entities and neighboring entities, it is possible to determine whether the attention weights between abnormal entities and neighboring entities are similar, that is, to determine whether abnormal entities and neighboring entities can influence each other, thereby filtering out related entities to facilitate the tracing of the cause of the fault, find out what factors are most likely to cause the fault problem, improve the accuracy of tracing, and reduce resource consumption.

[0080] According to an embodiment of this application, entity identification is performed on abnormal data related to the operation of a distributed system to obtain abnormal entities, including: segmenting the abnormal data related to the operation of the distributed system into words to obtain multiple abnormal word vectors; processing the multiple abnormal word vectors based on an attention strategy to obtain context vectors for each of the multiple abnormal word vectors; and determining the abnormal entity based on the multiple context vectors.

[0081] Tokenize the abnormal data related to the operation of the distributed system to distinguish different text data and obtain abnormal word vectors.

[0082] An attention-based strategy is used to encode anomalous word vectors, considering the information of each anomalous word vector to capture the long-distance dependencies between them. This allows the learning of context vectors for each anomalous word vector. The context vectors can be the vectors of other words or sentences surrounding the anomalous word vector in the anomalous log data. The context vectors help the computer understand the meaning of the anomalous word vectors. For example, if an anomalous word vector represents "module A", the obtained context vector represents "data A is input to module A and related tasks are executed". Based on this context vector, it can be determined that the meaning of the anomalous word vector "module A" can be a structure used to receive data and execute tasks.

[0083] Based on multiple context vectors, the weights of the context vectors are analyzed through an attention mechanism. The importance of the anomalous word vectors is determined based on the context vector weights to better understand the information of each anomalous word vector, thereby identifying the anomalous entities in the anomalous data.

[0084] According to an embodiment of this application, the associated entities include multiple entities, and the multiple associated entities include solution-type associated entities related to resolving fault information. The method further includes: determining a solution to the fault information based on the attribute information of the solution-type associated entities; and, if the solution is invalid, using the adjusted attribute information of the solution-type associated entities as positive samples for optimizing the target knowledge graph, and using the attribute information of the solution-type associated entities as negative samples for optimizing the target knowledge graph, so as to optimize the target knowledge graph using positive and negative samples.

[0085] The resolution-related entity can be an entity that corresponds to other related entities and is used to resolve the cause of the anomaly in the fault information. The attribute information of the resolution-related entity can include code changes, version rollbacks, parameter changes, container operations, etc.

[0086] The solution is used to adjust the corresponding fault location in the fault information, and the effectiveness of the solution is determined based on the adjusted log data and / or system resource data.

[0087] If the solution is ineffective, i.e. the anomaly is not eliminated, or new anomaly log data and / or system resource data are generated after the adjustment, then the solution-related entities of the target knowledge graph need to be optimized.

[0088] Optimizing solution-related entities can involve adjusting their attribute information, such as changing the way code is modified or adjusting the rollback progress of version rollbacks. The attribute information of solution-related entities optimized based on these operations is used as a positive sample for optimizing the target knowledge graph, while the attribute information of unoptimized, original solution-related entities is used as a negative sample.

[0089] According to an embodiment of this application, when optimizing the target knowledge graph, the positive and negative samples obtained above are used to train the natural language model corresponding to the target knowledge graph. The natural language model is used to construct the target knowledge graph so that the target knowledge graph can be continuously optimized based on the relationship between the adjusted solution-related entities and other entities, adapting to the dynamic technical characteristics of the distributed system, maintaining the timeliness and accuracy of the knowledge graph, and enabling the solutions provided by the solution-related entities to accurately resolve the fault information that causes anomalies.

[0090] According to an embodiment of this application, multiple candidate entity feature data are obtained by performing the following operations: segmenting the supplementary sample data into words to obtain multiple supplementary word vectors; and obtaining multiple candidate entity feature data based on an attention strategy and the multiple supplementary word vectors.

[0091] The supplementary sample data is segmented into words, and the sentences are converted into a series of word sequences. Each word is represented by a word vector, resulting in multiple supplementary word vectors.

[0092] By using a long bidirectional short-term memory recurrent neural network, the supplementary word vectors are encoded, taking into account the information of each of the multiple supplementary word vectors, thereby capturing the long-distance dependencies between the supplementary word vectors and learning the context vectors of each of the multiple supplementary word vectors. The context vectors of each supplementary word vector can be the vectors of other words or sentences around the supplementary word vector in the supplementary sample data, which can help the computer understand the meaning of the supplementary word vectors.

[0093] Furthermore, the context vectors of each of the multiple supplementary word vectors are processed based on an attention strategy to obtain the contribution of each of the multiple supplementary word vectors. Then, based on the contribution of each of the multiple supplementary word vectors, multiple candidate entity feature data are determined in the supplementary sample data. Among them, the contribution of each of the multiple supplementary word vectors can be obtained using formula (1).

[0094] (1)

[0095] in, , To query the vector sequence, For key vector sequences, It is a sequence of value vectors. for The dimension of a vector This is the weight matrix. Each of the multiple supplementary word vectors has its own context vector.

[0096] According to the embodiments of this application, a long bidirectional short-term memory recurrent neural network is used to identify and extract keywords in the supplementary sample data, thereby obtaining the context vectors of each of the multiple supplementary word vectors. Then, an attention mechanism is used to process the context vectors of each of the multiple supplementary word vectors to obtain the contribution of each of the multiple supplementary word vectors. This can improve the accuracy and efficiency of candidate entity feature data extraction and avoid the gradient vanishing or gradient exploding problems that are prone to occur in the long bidirectional short-term memory recurrent neural network for long text supplementary sample data.

[0097] According to an embodiment of this application, the multiple candidate entity feature data include N, where N is an integer greater than or equal to 2; the supplementary entities are obtained as follows: a target cluster is determined from the supplementary dendrogram based on a predetermined distance threshold and a predetermined number of clusters; supplementary entities are obtained based on the target clusters; wherein, the supplementary dendrogram is obtained by repeatedly performing the following operation until a first cluster is obtained: when 2 < n ≤ N, the distance between the n nth clusters is determined based on the clustering feature data of each of the n nth clusters, thus obtaining n -1 nth distances, where the clustering feature data of the nth cluster is determined based on the candidate entity feature data included in the nth cluster, and each of the N nth clusters includes one candidate entity feature data and the candidate entity feature data included in the N nth clusters are different; determine the target nth distance from the n-1 nth distances, merge the two nth clusters associated with the target nth distance into one cluster, and obtain the n-1th cluster; take the other nth clusters in the n nth clusters except for the two nth clusters as the n-1th clusters.

[0098] The predetermined distance threshold can be a preset similarity distance value, used to limit the similarity distance of candidate entity feature data in the clustering process, and to avoid the similarity distance being too large, which would cause candidate entity feature data with large differences to be classified into one category.

[0099] The predetermined number of clusters can be a preset number of clusters, used to limit the number of clusters of candidate entity feature data in the clustering process, to ensure the diversity of classification, and to avoid the number of clusters obtained by clustering being too many or too few.

[0100] Based on a predetermined distance threshold and a predetermined number of clusters, the candidate entity feature data are clustered, and a supplementary dendrogram is generated based on the clustering results of each cluster in a bottom-up manner.

[0101] In the clustering process, for N candidate entity feature data, in the first round of clustering, each of the N candidate entity feature data is used as an Nth cluster. Further, the Nth clusters are clustered again to obtain nth clusters.

[0102] In the clustering process of n nth clusters, it is necessary to calculate the distance between each of the n nth clusters, that is, the similarity between the candidate entity feature data of each of the n nth clusters, to obtain n-1 nth distances. Further, the n-1 nth distances are filtered to select the target nth distance, which is used as the merging condition. Two nth clusters that meet the merging condition are merged into one cluster to obtain the (n-1)th cluster, and the other nth clusters are each taken as the (n-1)th cluster.

[0103] Based on the above clustering operations, the distance to the (n-1)th cluster is calculated and the target (n-1)th distance is determined, resulting in the (n-2)th cluster, and so on, until a first cluster is obtained.

[0104] Based on the clustering results of each of the above clustering processes, a supplementary dendrogram is generated in a bottom-up, hierarchical manner.

[0105] According to embodiments of this application, after obtaining the supplementary tree diagram, target clusters for supplementing the basic knowledge graph are obtained from the supplementary tree diagram based on the missing information in the basic knowledge graph. Supplementary entities are then obtained based on the candidate entity feature data contained in the target clusters. Supplementing the basic knowledge graph with these supplementary entities enables knowledge fusion of multi-source heterogeneous data, improving the generalization ability of the basic knowledge graph for distributed scenarios.

[0106] According to embodiments of this application, the basic sample data includes at least one of the following: structured basic sample data, semi-structured basic sample data, or unstructured basic sample data; the basic knowledge graph is obtained by performing the following operations: entity recognition, attribute extraction, and relation extraction on the basic sample data to obtain multiple basic entities, attribute information of each of the multiple basic entities, and at least one basic relation, wherein the structured basic sample data, semi-structured basic sample data, and unstructured basic sample data have their own entity recognition methods, their own attribute extraction methods, or their own relation extraction methods; and the basic knowledge graph is obtained based on the multiple basic entities, their own attribute information, and at least one basic relation.

[0107] Basic entities are words or sentences extracted from basic sample data and have clear physical meanings. The attribute information of a basic entity can be the content contained in or associated with that basic entity. For example, for the basic entity "storage resource", its attribute information can be "storage location", "storage content", etc. Basic relationships can be the association between that basic entity and other basic entities.

[0108] Basic sample data includes structured basic sample data, semi-structured basic sample data, or unstructured basic sample data. Structured basic sample data includes parameter data from the parameter management system, distributed performance monitoring data, and batch scheduling data, etc. Semi-structured basic sample data includes interface call logs and database query logs, etc. Unstructured basic sample data includes distributed documents, system architecture documents, problem reports, operation and maintenance records, etc.

[0109] For structured basic sample data, since the data structure of structured basic sample data is clear and explicit, multiple basic entities, the attribute information of each of the multiple basic entities, and the basic relationships between the basic entities can be directly extracted from the structured basic sample data.

[0110] For semi-structured basic sample data, regular expression-based extraction operations can be used to obtain error codes, call chains, and other information from the semi-structured basic sample data, thereby obtaining multiple basic entities, the attribute information of each of the multiple basic entities, and at least one basic relationship.

[0111] For unstructured basic sample data, a pre-trained natural language model can be used to process the unstructured basic sample data to obtain multiple basic entities, the attribute information of each of the multiple basic entities, and at least one basic relationship.

[0112] In the pre-training phase, the natural language model (NLP) uses labeled distributed technical documents and problem reports as training sets to train the NLP and optimize entity extraction results. Simultaneously, during the NLP learning process, a cross-training method is used, dividing the training set into multiple different training subsets. After training multiple sub-models, the models are integrated to avoid overfitting. For example, with k training sets, k-1 sets are used to train one sub-model each, and the remaining subset is used for training. Finally, the k models are integrated.

[0113] Based on multiple basic entities, their respective attribute information, and at least one basic relationship, a basic knowledge graph is constructed, with basic entities as nodes and basic relationships as edge relationships between nodes.

[0114] According to embodiments of this application, constructing a basic knowledge graph based on structured basic sample data, semi-structured basic sample data, or unstructured basic sample data can make the constructed basic knowledge graph more structural and the edge relationships between nodes in the basic knowledge graph more accurate.

[0115] Figure 3 A schematic diagram illustrating a fault information determination method according to an embodiment of this application is shown.

[0116] According to embodiments of this application, such as Figure 3 As shown, in operation S310, a basic knowledge graph is constructed; then, operation S320 is executed to extract features from supplementary sample data to obtain supplementary entities; in operation S330, the supplementary entities are inserted into the basic knowledge graph to obtain the target knowledge graph. In operations S340 and S350, abnormal data of the distributed system is obtained, including abnormal log data and abnormal system resource data; in operation S360, based on the abnormal entities of the abnormal data, the target knowledge graph is used to determine the fault information of the abnormal data and the corresponding solutions; in operation S370, the target knowledge graph is optimized based on the effectiveness of the solutions.

[0117] Based on the above-described fault information determination method, this application also provides a fault information determination device. The following will be combined with... Figure 4 The device is described in detail.

[0118] Figure 4 A schematic block diagram of a fault information determination device according to an embodiment of this application is shown.

[0119] like Figure 4 As shown, the fault information determination device 400 of this embodiment includes an identification module 410, a first determination module 420, and a second determination module 430.

[0120] The identification module 410 is used to identify entities in abnormal data related to the operation of the distributed system to obtain abnormal entities. In one embodiment, the identification module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0121] The first determining module 420 is used to determine associated entities related to the abnormal entities from multiple entities included in the target knowledge graph. Entities represent objects related to the fault determination requirements of the distributed system. The target knowledge graph is obtained by supplementing the basic knowledge graph with supplementary entities. The supplementary entities are determined based on the clustering results of feature data from multiple candidate entities. The candidate entity feature data is obtained by extracting features from supplementary sample data related to the operation of the distributed system. In one embodiment, the first determining module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0122] The second determining module 430 is used to determine fault information based on the attribute information of the associated entity. In one embodiment, the second determining module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0123] According to embodiments of this application, abnormal data related to the operation of a distributed system is identified through entity recognition to obtain abnormal entities. A target knowledge graph is then acquired to analyze the abnormal entities, identifying associated entities that can influence them. Based on the attribute information of these associated entities, the cause of the abnormal data is determined. Specifically, after constructing a basic knowledge graph, supplementary entities are obtained by extracting features from supplementary sample data. These supplementary entities are then used to update the basic knowledge graph, resulting in the target knowledge graph. Analyzing abnormal entities using the target knowledge graph allows for precise location of associated entities that influence them, avoiding the influence of too many useless entities on fault information judgment. This improves the accuracy and efficiency of fault information determination, reduces resource costs, and, by updating the basic knowledge graph with supplementary entities, avoids information omissions and enhances the accuracy of identifying associated entities.

[0124] According to embodiments of this application, any plurality of modules among the identification module 410, the first determining module 420, and the second determining module 430 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules can be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the identification module 410, the first determining module 420, and the second determining module 430 can be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented by any other reasonable means of integrating or packaging the circuit, or implemented in any one of the three methods of software, hardware, and firmware, or in a suitable combination of any of these. Alternatively, at least one of the identification module 410, the first determining module 420, and the second determining module 430 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0125] According to an embodiment of this application, the first determining module 420 includes a first determining submodule and a second determining submodule.

[0126] The first determining submodule is used to determine the local knowledge subgraph associated with the abnormal entity from the target knowledge graph. The local knowledge subgraph contains multiple entities including the abnormal entity and multiple neighboring entities of the abnormal entity, multiple relationships including the relationship between two related entities, and multiple neighboring entities including at least one-order neighboring entities.

[0127] The second determination submodule is used to determine the associated entities related to the abnormal entity from the multiple entities included in the local knowledge subgraph based on the graph attention strategy and according to the first entity feature data of each of the multiple entities included in the local knowledge subgraph.

[0128] According to an embodiment of this application, the second determining submodule includes a first aggregation unit and a first determining unit.

[0129] The first aggregation unit is used to aggregate the first entity features of each entity in the local knowledge subgraph based on the graph attention strategy and the multiple relations included in the local knowledge subgraph, to obtain the second entity feature data of each entity in the local knowledge subgraph.

[0130] The first determining unit is used to determine the associated entity related to the abnormal entity from the multiple neighboring entities included in the local knowledge subgraph based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph.

[0131] According to an embodiment of this application, the first aggregation unit includes a first obtaining subunit and a second obtaining subunit.

[0132] The first sub-unit is used to obtain the attention weight between an entity and another entity based on a graph attention strategy, for any entity among multiple entities included in the local knowledge subgraph and for any relation among at least one relation associated with the entity in the local knowledge subgraph, according to the first entity feature data of the entity and the first entity feature data of another entity associated with the relation.

[0133] The second sub-unit is used to obtain the second entity feature data of an entity based on the first entity feature data of each of the multiple other entities and the attention weights between the entity and each of the multiple other entities.

[0134] According to an embodiment of this application, the first determining unit includes a first determining subunit and a second determining subunit.

[0135] The first determining subunit is used to determine the similarity between the abnormal entity and the neighboring entity based on the second entity feature data of the abnormal entity and the second entity feature data of the neighboring entity for any of the multiple neighboring entities included in the local knowledge subgraph.

[0136] The second determining subunit is used to determine the associated entity related to the abnormal entity from the multiple neighboring nodes included in the local knowledge subgraph based on the similarity between the abnormal entity and each of its multiple neighboring entities.

[0137] According to an embodiment of this application, the identification module 410 includes a first word segmentation submodule, a third determination submodule, and a fourth determination submodule.

[0138] The first word segmentation submodule is used to segment abnormal data related to the operation of the distributed system into multiple abnormal word vectors.

[0139] The third determination submodule is used to process multiple abnormal word vectors based on an attention strategy to obtain the context vectors of each of the multiple abnormal word vectors.

[0140] The fourth determination submodule is used to determine the abnormal entity based on multiple context vectors.

[0141] According to an embodiment of this application, the associated entities include multiple entities, and the multiple associated entities include resolution-related associated entities associated with resolving fault information. The fault information determination device 400 also includes a third determination module and an optimization module.

[0142] The third determination module is used to determine the solution to the fault information based on the attribute information of the associated entities of the solution class.

[0143] The optimization module is used to optimize the target knowledge graph by using the adjusted attribute information of the associated entities of the solution class as positive samples and the attribute information of the associated entities of the solution class as negative samples when the solution is invalid.

[0144] According to an embodiment of this application, the fault information determination device 400 further includes a word segmentation module and a first obtaining module.

[0145] The word segmentation module is used to segment the supplementary sample data into words, resulting in multiple supplementary word vectors.

[0146] The first module is used to obtain multiple candidate entity feature data based on an attention strategy and multiple supplementary word vectors.

[0147] According to an embodiment of this application, the multiple candidate entity feature data include N, where N is an integer greater than or equal to 2, and the fault information determination device 400 further includes a fourth determination module and a second obtaining module.

[0148] The fourth determination module is used to determine the target cluster from the supplementary dendrogram based on a predetermined distance threshold and a predetermined number of clusters.

[0149] The second module is used to obtain supplementary entities based on the target cluster.

[0150] The fourth determination module includes a fifth determination submodule, a merging submodule, and a function submodule.

[0151] The fifth determination submodule is used to determine the distance between the n nth clusters based on their respective clustering feature data when 2 < n ≤ N, thus obtaining the n-1 nth distance. The clustering feature data of the nth cluster is determined based on the candidate entity feature data included in the nth cluster. Each of the N nth clusters includes one candidate entity feature data, and the candidate entity feature data included in the N nth clusters are different.

[0152] The merging submodule is used to determine the target nth distance from n-1 nth distances, and merge the two nth clusters associated with the target nth distance into one cluster to obtain the (n-1)th cluster.

[0153] As a submodule, it is used to classify each of the n nth clusters (excluding the two nth clusters) as the (n-1)th cluster.

[0154] According to embodiments of this application, the basic sample data includes at least one of the following: structured basic sample data, semi-structured basic sample data, or unstructured basic sample data; the fault information determination device 400 further includes an extraction module and a third obtaining module.

[0155] The extraction module is used to perform entity recognition, attribute extraction, and relation extraction on the basic sample data to obtain multiple basic entities, attribute information of each basic entity, and at least one basic relation. Among them, the structured basic sample data, semi-structured basic sample data, and unstructured basic sample data have their own entity recognition methods, attribute extraction methods, or relation extraction methods.

[0156] The third module is used to obtain a basic knowledge graph based on multiple basic entities, their respective attribute information, and at least one basic relationship.

[0157] Figure 5 A block diagram illustrating an electronic device suitable for implementing a fault information determination method according to an embodiment of this application is shown.

[0158] like Figure 5As shown, an electronic device 500 according to an embodiment of this application includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0159] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 502 and / or RAM 503. It should be noted that the programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0160] According to embodiments of this application, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0161] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0162] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0163] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the fault information determination method provided in the embodiments of this application.

[0164] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0165] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0166] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0167] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0169] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for determining fault information, characterized in that, include: Entity identification is performed on abnormal data related to the operation of the distributed system to obtain abnormal entities; From the multiple entities included in the target knowledge graph, we determine the associated entities that are related to the abnormal entity, wherein the entities are used to characterize objects related to the fault determination requirements of the distributed system, the target knowledge graph is obtained by supplementing the basic knowledge graph with supplementary entities, the supplementary entities are determined based on the clustering results of multiple candidate entity feature data, and the candidate entity feature data are obtained by feature extraction from supplementary sample data related to the operation of the distributed system. Based on the attribute information of the associated entities, the fault information is determined.

2. The method according to claim 1, characterized in that, The step of determining the associated entities related to the anomalous entity from among multiple entities included in the target knowledge graph includes: From the target knowledge graph, a local knowledge subgraph associated with the abnormal entity is determined, wherein multiple entities in the local knowledge subgraph include the abnormal entity and multiple neighboring entities of the abnormal entity, multiple relationships in the local knowledge subgraph include relationships between two related entities, and the multiple neighboring entities include at least one first-order neighboring entities. Based on the graph attention strategy, the associated entities related to the abnormal entity are determined from the multiple entities included in the local knowledge subgraph according to the first entity feature data of each of the multiple entities included in the local knowledge subgraph.

3. The method according to claim 2, characterized in that, The graph attention-based strategy, based on the first entity feature data of each of the multiple entities included in the local knowledge subgraph, determines the associated entities related to the abnormal entity from among the multiple neighboring entities included in the local knowledge subgraph, including: Based on the graph attention strategy and the multiple relations included in the local knowledge subgraph, the first entity features of each of the multiple entities included in the local knowledge subgraph are aggregated to obtain the second entity feature data of each of the multiple entities included in the local knowledge subgraph. Based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph, the associated entities related to the abnormal entity are determined from the multiple neighboring entities included in the local knowledge subgraph.

4. The method according to claim 3, characterized in that, The graph attention strategy and the multiple relations included in the local knowledge subgraph aggregate the first entity features of each of the multiple entities included in the local knowledge subgraph to obtain the second entity feature data of each of the multiple entities included in the local knowledge subgraph, including: For any entity among the multiple entities included in the local knowledge subgraph, For any one of the at least one relations in the local knowledge subgraph associated with the entity, Based on the graph attention strategy, the attention weight between the entity and the other entity is obtained according to the first entity feature data of the entity and the first entity feature data of the other entity associated with the relationship. The second entity feature data of the entity is obtained based on the first entity feature data of each of the multiple other entities and the attention weights between the entity and each of the multiple other entities.

5. The method according to claim 3, characterized in that, The step of determining the associated entity related to the abnormal entity from multiple neighboring entities included in the local knowledge subgraph based on the second entity feature data of each of the multiple entities included in the local knowledge subgraph includes: For any neighbor entity among the multiple neighbor entities included in the local knowledge subgraph, Based on the second entity feature data of the abnormal entity and the second entity feature data of the neighboring entities, the similarity between the abnormal entity and the neighboring entities is determined; Based on the similarity between the anomalous entity and each of the multiple neighboring entities, the associated entities related to the anomalous entity are determined from the multiple neighboring nodes included in the local knowledge subgraph.

6. The method according to any one of claims 1 to 5, characterized in that, The entity identification of abnormal data related to the operation of the distributed system to obtain abnormal entities includes: The abnormal data related to the operation of the distributed system is segmented into words to obtain multiple abnormal word vectors; The multiple anomalous word vectors are processed using an attention strategy to obtain the context vectors of each of the multiple anomalous word vectors. The abnormal entity is determined based on multiple context vectors.

7. The method according to any one of claims 1 to 5, characterized in that, The associated entities include multiple entities, and the multiple associated entities include resolution-related associated entities related to resolving the fault information. The method further includes: Based on the attribute information of the associated entity of the solution class, determine the solution to the fault information; If the solution is invalid, the attribute information of the adjusted solution-class associated entities is used as a positive sample for optimizing the target knowledge graph, and the attribute information of the solution-class associated entities is used as a negative sample for optimizing the target knowledge graph, so as to optimize the target knowledge graph using the positive sample and the negative sample.

8. The method according to any one of claims 1 to 5, characterized in that, The multiple candidate entity feature data were obtained by performing the following operations: The supplementary sample data is segmented into words to obtain multiple supplementary word vectors; Based on the attention strategy, the feature data of the multiple candidate entities are obtained according to the multiple supplementary word vectors.

9. The method according to any one of claims 1 to 5, characterized in that, The multiple candidate entity feature data include N, where N is an integer greater than or equal to 2; the supplementary entities are obtained in the following way: Based on a predetermined distance threshold and a predetermined number of clusters, the target cluster is determined from the supplementary dendrogram. The supplementary entity is obtained based on the target cluster; The supplementary dendrogram is obtained by repeatedly performing the following operation until a first cluster is obtained: In the case that 2 < n ≤ N Based on the clustering feature data of each of the n nth clusters, the distance between each of the n nth clusters is determined, and the n-1 nth distance is obtained. The clustering feature data of the nth cluster is determined based on the candidate entity feature data included in the nth cluster. Each of the N nth clusters includes one of the candidate entity feature data, and the candidate entity feature data included in the N nth clusters are different. Determine the target nth distance from the n-1 nth distances, and merge the two nth clusters associated with the target nth distance into one cluster to obtain the (n-1)th cluster; Each of the n nth clusters, excluding the two nth clusters, is designated as the (n-1)th cluster.

10. The method according to any one of claims 1 to 5, characterized in that, The basic knowledge graph was obtained by performing the following operations: Entity recognition, attribute extraction, and relation extraction are performed on basic sample data to obtain multiple basic entities, attribute information of each basic entity, and at least one basic relation. The basic sample data includes at least one of the following: structured basic sample data, semi-structured basic sample data, or unstructured basic sample data. The structured basic sample data, semi-structured basic sample data, and unstructured basic sample data each have their own entity recognition method, attribute extraction method, or relation extraction method. The basic knowledge graph is obtained based on the multiple basic entities, the attribute information of each of the multiple basic entities, and the at least one basic relationship.

11. A fault information determination device, characterized in that, The device includes: The identification module is used to identify entities in abnormal data related to the operation of the distributed system and obtain abnormal entities. A first determining module is configured to determine associated entities related to the anomalous entity from multiple entities included in the target knowledge graph, wherein the entities are used to characterize objects related to the fault determination requirements of the distributed system, the target knowledge graph is obtained by supplementing the basic knowledge graph with supplementary entities, the supplementary entities are determined based on the clustering results of feature data of multiple candidate entities, and the candidate entity feature data are obtained by feature extraction from supplementary sample data related to the operation of the distributed system; and The second determining module is used to determine fault information based on the attribute information of the associated entity.

12. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

Images