Intelligent alarm root cause analysis method and device, electronic equipment and storage medium

Abstract

The invention discloses an intelligent alarm root cause analysis method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring alarm data to be analyzed, and inputting the alarm data to be analyzed into a target graph convolutional neural network model into which a cross-layer information transmission mechanism and a causal relationship propagation mechanism are introduced; determining potential relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data based on a target graph convolutional neural network model; determining causal association relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data based on a target graph convolutional neural network model; and performing weighted fusion processing on the potential relationship information and the causal association relationship information between the alarm data to be analyzed and each group of associated alarm data to obtain root cause information between the alarm data to be analyzed and each group of associated alarm data. By adopting the scheme, the complex relationship between the alarm source and the system component is effectively captured, and the alarm processing efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence operation and maintenance, and in particular to an intelligent alarm root cause analysis method and device, an electronic device and a storage medium. BACKGROUND

[0002] Artificial intelligence operation and maintenance utilizes artificial intelligence technology and machine learning algorithms to optimize IT operation and maintenance, automatically identifying, classifying and processing a large number of alarm events in large-scale distributed systems.

[0003] The prior art provides an artificial intelligence operation and maintenance method to solve the problems of high operation and maintenance cost and low efficiency. Specifically, the method includes: capturing a current exception according to the running log of an application system; repairing the application system based on a scheme recommendation model according to the current exception; wherein the scheme recommendation model is a model trained according to historical exceptions and corresponding effective solutions. In the case of repair failure, an alarm notification can be sent, and a manual repair scheme can be collected, and whether to iterate the model according to the repair result. The prior art effectively utilizes historical repair cases, makes up for the lack of experience of operation and maintenance personnel, reduces the operation and maintenance cost, and improves the operation and maintenance efficiency.

[0004] In traditional operation and maintenance alarm analysis, alarm data is usually classified and filtered by rule engines or threshold-based methods. However, these methods are usually limited to simple filtering and priority sorting, and lack a deep understanding of the complex relationships between alarm data. Most traditional methods rely on pre-set rules and cannot flexibly cope with complex correlations and multi-level dependencies in the system. At the same time, due to the large number of alarms and the redundancy or false positives, operation and maintenance personnel often need to manually intervene to confirm the root cause of the problem, which not only consumes time but also is prone to misdiagnosis. Root cause analysis relies on expert experience and manual processing, resulting in low efficiency and difficulty in ensuring accuracy of fault location. SUMMARY

[0005] The present application provides an intelligent alarm root cause analysis method, device, electronic device and storage medium to solve the problem of low efficiency and difficulty in ensuring accuracy of fault location caused by complex relationships between alarm data.

[0006] According to an aspect of the present application, an intelligent alarm root cause analysis method is provided, the method comprising:

[0007] Obtaining alarm data to be analyzed and inputting the alarm data to be analyzed into a pre-constructed target graph convolutional neural network model; wherein the target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism;

[0008] determine potential relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the target graph convolutional neural network model;

[0009] determine causal relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the target graph convolutional neural network model;

[0010] perform weighted fusion processing on the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each set of associated alarm data, to obtain root cause information between the to-be-analyzed alarm data and each set of associated alarm data.

[0011] According to another aspect of the present application, there is provided an intelligent alarm root cause analysis device, which comprises:

[0012] an alarm data acquisition module configured to acquire to-be-analyzed alarm data and input the to-be-analyzed alarm data into a pre-constructed target graph convolutional neural network model; wherein the target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism;

[0013] a potential relationship information determination module configured to determine potential relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the target graph convolutional neural network model;

[0014] a causal relationship information determination module configured to determine causal relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the target graph convolutional neural network model;

[0015] an alarm root cause analysis module configured to perform weighted fusion processing on the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each set of associated alarm data, to obtain root cause information between the to-be-analyzed alarm data and each set of associated alarm data.

[0016] According to another aspect of the present application, there is provided an electronic device, which comprises:

[0017] at least one processor; and

[0018] a memory in communication with the at least one processor; wherein

[0019] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the intelligent alarm root cause analysis method according to any one of the embodiments of the present application.

[0020] According to another aspect of the present application, there is provided a computer readable storage medium storing computer instructions for causing a processor to implement the intelligent alarm root cause analysis method according to any of the embodiments of the present application when executed.

[0021] According to another aspect of the present application, there is provided a computer program product comprising a computer program for implementing the intelligent alarm root cause analysis method according to any of the embodiments of the present application when executed by a processor.

[0022] The technical solution of the embodiments of the present application comprises the following steps: obtaining alarm data to be analyzed, and inputting the alarm data to be analyzed into a target graph convolutional neural network model constructed in advance; the target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism; based on the target graph convolutional neural network model, potential relationship information between the alarm data to be analyzed and at least one group of associated alarm data is determined; based on the target graph convolutional neural network model, causal relationship information between the alarm data to be analyzed and at least one group of associated alarm data is determined; the potential relationship information and the causal relationship information between the alarm data to be analyzed and each group of associated alarm data are weighted and fused to obtain root cause information between the alarm data to be analyzed and each group of associated alarm data. The problem that the efficiency of fault positioning is low and the accuracy is difficult to guarantee due to the complex relationship between alarm data is solved. The complex graph structure relationship between the alarm source and the system component is effectively captured, and the complex alarm data is adaptively processed, which not only improves the efficiency of alarm processing, but also greatly reduces the demand for human intervention.

[0023] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0025] Figure 1 is a flowchart of an intelligent alarm root cause analysis method according to an embodiment of the present application;

[0026] Figure 2 is a flowchart of a target graph convolutional neural network model construction method according to an embodiment of the present application;

[0027] Figure 3 is a whole flow schematic diagram of a smart alarm root cause analysis method according to Embodiment Two of the present application;

[0028] Figure 4 is a whole framework schematic diagram of a target graph convolutional neural network model according to Embodiment Two of the present application;

[0029] Figure 5 is a flow schematic diagram of cross-layer information and causal chain fusion according to Embodiment Two of the present application;

[0030] Figure 6 is a flowchart of a smart alarm root cause analysis method according to Embodiment Three of the present application;

[0031] Figure 7 is a structural schematic diagram of a smart alarm root cause analysis device according to Embodiment Four of the present application;

[0032] Figure 8 is a structural schematic diagram of an electronic device according to Embodiment Five of the present application. DETAILED DESCRIPTION

[0033] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor should belong to the protection scope of the present application.

[0034] In the technical solutions of the present application, the acquisition, storage, use and processing of data all comply with the relevant provisions of laws and regulations. It should be noted that the terms "first", "second", "target", "original" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include", "equal" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0035] Embodiment One

[0036] Figure 1 A flowchart of an intelligent alarm root cause analysis method is provided for the first embodiment of the present application. The first embodiment can be applied to the case where the potential relationship information of alarm data is determined based on the cross-layer information transmission mechanism introduced based on the model, and the causal relationship propagation mechanism introduced based on the model is used to determine the causal correlation relationship information of alarm data, and the intelligent alarm root cause analysis of alarm data is performed. The method can be executed by an intelligent alarm root cause analysis device, which can be realized in the form of hardware and / or software, and can be configured in any electronic device with network communication function. As shown in the figure, the method comprises: Figure 1

[0037] S110, obtaining alarm data to be analyzed, and inputting the alarm data to be analyzed into a pre-constructed target graph convolutional neural network model.

[0038] The alarm data to be analyzed refers to the alarm data obtained from multiple monitoring systems through the AIOps system, and the alarm data to be analyzed includes but is not limited to alarm events, alarm types, alarm levels, alarm occurrence times and other information.

[0039] The target graph convolutional neural network model can refer to a graph convolutional neural network based on the convolution operation on each node in the dynamic knowledge graph to extract the complex relationship between the alarm source and the system component, so as to more accurately identify the root cause. The dynamic knowledge graph is a knowledge graph pre-constructed based on historical alarm data, so as to analyze the complex relationship between the alarm data and the system component.

[0040] Optionally, the pre-constructed target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism. The cross-layer information transmission mechanism can refer to the process of realizing information interaction and sharing between different layers (such as physical layer, data link layer, network layer, application layer, etc.) of the network system, and the core goal is to break the independence limit of the traditional layered architecture, form a unified decision framework by integrating the information of each layer, and thus improve the overall performance and efficiency of the system. In the present embodiment, the cross-layer information transmission mechanism is introduced into the original graph convolutional neural network, so that the single-layer graph convolutional neural network model is expanded to a multi-layer graph convolutional neural network model, so as to effectively capture the potential relationship between the alarm data and the system component at a deeper level. The causal relationship propagation mechanism can refer to the mining of the causal relationship between variables from the data. In the present embodiment, the causal relationship propagation mechanism is introduced into the original graph convolutional neural network, based on the alarm data, the device state and the connection structure between devices, the possible causal chain is inferred, and the indirect causal relationship is helped to analyze.

[0041] ​In the embodiment of the present application, by introducing a cross-layer information transmission mechanism in the graph convolutional neural network model, the model is no longer limited to the propagation of local information, but can realize deep fusion and modeling. By introducing a causal relationship propagation mechanism, the model has the ability to discover causal paths, and can not only analyze surface correlation relationships, but also identify potential causal chains across multiple hops and modules.

[0042] In S120, potential relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data is determined based on the target graph convolutional neural network model.

[0043] The associated alarm data refers to alarm data obtained from other systems associated with the to-be-analyzed alarm data. The potential relationship information can refer to a complex relationship between the to-be-analyzed alarm data and system components. Based on the cross-layer information transmission mechanism introduced in the target graph convolutional neural network model, the potential relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data can be determined in a multi-level perspective.

[0044] In S130, causal correlation relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data is determined based on the target graph convolutional neural network model.

[0045] The causal correlation relationship information can refer to a cause-and-effect relationship between the to-be-analyzed alarm data and at least one group of associated alarm data. By introducing a causal relationship propagation mechanism in the target graph convolutional neural network model, the model can simulate the causal correlation relationship between the to-be-analyzed alarm data and at least one group of associated alarm data, thereby inferring potential root causes and achieving more accurate root cause analysis.

[0046] In S140, weighted fusion processing is performed on the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each group of associated alarm data, to obtain root cause information between the to-be-analyzed alarm data and each group of associated alarm data.

[0047] The weighted fusion processing can refer to assigning corresponding weights to the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each group of associated alarm data, and performing adaptive fusion processing according to the respective weights.

[0048] The root cause information can refer to a set of information containing the root cause of the occurrence of the alarm data. The root cause information contains the potential relationship between the to-be-analyzed alarm data and each group of associated alarm data and the deeper causal correlation relationship information captured.

[0049] The embodiment of the present application provides a kind of intelligent warning root cause analysis method, by obtaining the alarm data to be analyzed, and the alarm data to be analyzed is input into the target graph convolutional neural network model constructed in advance;Wherein, the target graph convolutional neural network model introduces cross-layer information transmission mechanism and causal relationship propagation mechanism;Determine the potential relationship information between the alarm data to be analyzed and at least one group of associated alarm data based on the target graph convolutional neural network model;Determine the causal association relationship information between the alarm data to be analyzed and at least one group of associated alarm data based on the target graph convolutional neural network model;The potential relationship information and causal association relationship information existing between the alarm data to be analyzed and each group of associated alarm data are carried out weighted fusion processing, and the root cause information between the alarm data to be analyzed and each group of the associated alarm data is obtained.The technical scheme of the embodiment of the present application is introduced into cross-layer information transmission mechanism and causal relationship propagation mechanism, to effectively capture the complex graph structure relationship between alarm source and system component, to adaptively process complex alarm data, not only improve the efficiency of alarm processing, also greatly reduce the demand of human intervention.

[0050] Embodiment two

[0051] Figure 2 The flow chart of a target graph convolutional neural network model construction method provided for the second embodiment of the present application, the foregoing embodiment is further optimized based on the above-mentioned embodiment, and the embodiment of the present application can be combined with each optional scheme in one or more of the above-mentioned embodiments.Combination, as shown in Figure 2 The method comprises:

[0052] S210, according to historical alarm data, a dynamic knowledge graph is constructed, and a first graph convolutional neural network is constructed according to the dynamic knowledge graph.

[0053] Wherein, referring to Figure 3 Before root cause analysis of alarm data, alarm data needs to be collected, dynamic knowledge graph is constructed and alarm noise reduction is carried out.Specifically, historical alarm data is obtained from multiple monitoring systems through AIOps system, and a preliminary alarm data set is formed;Wherein, the historical alarm data includes but is not limited to alarm event, alarm type, alarm level and alarm occurrence time and other information.

[0054] Dynamic knowledge graph is constructed by using collected historical alarm data.The dynamic knowledge graph includes but is not limited to device information, network topology, alarm source, event history and alarm response and multidimensional data. Optionally, the dynamic knowledge graph is constructed based on graph database, and real-time updating and expansion of graph are supported.

[0055] The first graph convolutional neural network can refer to extracting complex relationships between alarm sources and system components by performing convolution operations on each node in the dynamic knowledge graph, thereby more accurately identifying the root cause. Optionally, the first graph convolutional neural network adopts a single-layer information transmission mechanism.

[0056] As an optional but non-limiting implementation, after constructing the dynamic knowledge graph according to the historical alarm data, the method further includes:

[0057] Based on the historical alarm data and device information in the dynamic knowledge graph, the historical alarm data is denoised through correlation analysis, rule reasoning and clustering analysis algorithms, redundant alarm data is identified, low-priority alarm data is automatically filtered out, and high-priority alarm data is retained.

[0058] S220, on the basis of the first graph convolutional neural network, a cross-layer information transmission mechanism is introduced to obtain a second graph convolutional neural network.

[0059] In actual application, many faults or alarms are not simply dependent on local information of a layer, but are affected by a deep relationship chain between multiple layers to finally determine the root cause. Therefore, combining cross-layer information transmission and causal relationship modeling helps to capture deeper causal chains and improve the performance of the model in complex situations. Therefore, cross-layer information transmission and deep causal relationship modeling of root cause analysis are very important. In the embodiment of the application, the cross-layer information transmission mechanism is introduced into the first graph convolutional neural network to break the single-layer information transmission limitation of the traditional GCN model (the first graph convolutional neural network), and to realize more comprehensive cross-layer information transmission.

[0060] The cross-layer information transmission mechanism is used to expand the single-layer graph convolutional neural network into a multi-layer graph convolutional neural network, and introduce the cross-layer information transmission mechanism to represent the potential relationship information between nodes.

[0061] As an optional but non-limiting implementation, introducing the cross-layer information transmission mechanism on the basis of the first graph convolutional neural network to obtain the second graph convolutional neural network includes but is not limited to steps A1-A3:

[0062] Step A1: introducing a cross-layer convolution mechanism on the basis of the first graph convolutional neural network to transmit node information of a high-layer node to a low-layer node.

[0063] Step A2: introducing a graph attention mechanism in each layer of the first graph convolutional neural network to determine attention coefficients of a current node to its neighbor nodes, performing standardization processing on the attention system, and updating node features of the current node by using the standardized attention coefficients.

[0064] Step A3: Introduce cross-layer connections in the first graph convolutional neural network to fuse the node feature information of high-level nodes with the node feature information of low-level nodes to obtain the second graph convolutional neural network.

[0065] Among them, see Figure 4 Based on the first convolutional neural network, this embodiment of the invention designs a cross-layer convolution mechanism, which allows information from higher-level nodes to propagate to lower-level nodes. The node information of the k-th layer not only depends on the neighboring nodes of the (k-1)-th layer, but can also be fused with the information of the nodes of the (k+1)-th layer through the cross-layer mechanism.

[0066] In each layer of the first graph convolutional neural network, a graph attention mechanism (GAT) is introduced, allowing each node to adaptively determine the amount of information passed based on the weights of its neighbors. Optionally, in each layer, the attention coefficients of each node to its neighbors are calculated; for node i and its neighbor j, the attention coefficients are calculated... The attention coefficient can be expressed as:

[0067]

[0068] in, It is a learnable weight matrix. It is the parameter vector of the attention mechanism. This represents a vector concatenation operation. Let i represent the original feature vector of node i. This represents the original feature vector of node j.

[0069] The attention coefficient, standardized using the Softmax function, can be expressed as:

[0070]

[0071] The node features are updated using the standardized attention coefficients. Represented as:

[0072]

[0073] Drawing inspiration from ResNet, cross-layer connections are introduced into GCN. For the first The output of the layer, The output is after convolution and activation; the output after cross-layer connections is:

[0074]

[0075] Introducing cross-layer connections allows information from lower layers to jump to higher layers and be fused, avoiding gradient vanishing and ensuring that information can be effectively propagated in deeper network layers.

[0076] The embodiment of the application introduces a cross-layer fusion mechanism of GCN+GAT+ResNet structure in the first graph convolutional neural network, which not only propagates information between adjacent layers, but also allows high-level features to be transmitted to low-level layers, and realizes information backflow by means of residual connection. In combination with the graph attention mechanism (GAT) and the cross-layer connection mechanism, the model is no longer limited to the propagation of local information, but can realize the fusion and modeling of deep node features. The aggregation of such multi-dimensional features significantly enhances the perception ability of the model to the global dependency structure of the system, so that when facing complex chain and linkage alarms, the key influencing factors and root nodes can still be accurately mined, greatly improving the precision and stability of fault location.

[0077] S230, on the basis of the second graph convolutional neural network, introducing a causal relationship propagation mechanism to obtain a third graph convolutional neural network.

[0078] Among them, the causal relationship propagation mechanism is introduced to represent the causal association relationship information between nodes. By introducing the causal relationship propagation mechanism in the second graph convolutional neural network, the propagation of the causal relationship is simulated in the convolutional layer of the graph convolutional neural network, and based on the historical alarm data, the device state and the connection structure between devices, the possible causal chain is inferred to help analyze the indirect causal relationship.

[0079] As an optional but non-limiting implementation manner, the introducing a causal relationship propagation mechanism on the basis of the second graph convolutional neural network to obtain a third graph convolutional neural network includes but is not limited to steps B1-B3:

[0080] Step B1: based on historical alarm data, device state and connection structure between devices, a causal graph is constructed.

[0081] Step B2: according to the causal graph, the node feature update formula is modified to simulate the propagation of the causal relationship.

[0082] Step B3: the simulated causal relationship is optimized for the second graph convolutional neural network to obtain a third graph convolutional neural network.

[0083] Among them, based on historical alarm data, device state and connection structure, a causal graph is constructed , wherein V is a node set, E is a causal relationship edge set; in the convolutional layer of the graph convolutional neural network (GCN), the node feature update formula is modified to simulate the propagation of the causal relationship. The modified node feature update formula is represented as:

[0084]

[0085] Among them, The node features obtained according to the modified node feature updating formula are characterized, and C represents a causal relationship matrix, and The transformation matrix of the causal relationship matrix.

[0086] In the embodiment of the application, the node feature updating is performed by embedding the causal relationship matrix in the GCN. By introducing the causal relationship matrix, the node feature updating formula is adjusted to realize the explicit modeling of the causal path. The deep causal model is introduced, and the multi-level GCN structure is combined for joint optimization. In the convolution process, not only the correlation between nodes is modeled, but also the causal relationship is modeled, so that the root cause chain is more comprehensively captured.

[0087] As an optional but non-limiting implementation manner, after the simulated causal relationship is used to optimize the second graph convolutional neural network to obtain the third graph convolutional neural network, the method further includes but is not limited to steps C1-C2:

[0088] Step C1: defining a joint optimization objective function according to the correlation between nodes determined by the second graph convolutional neural network and the simulated causal relationship.

[0089] Step C2: optimizing the third graph convolutional neural network according to the joint optimization objective function.

[0090] Among them, the correlation between nodes and the causal relationship are considered at the same time to define a joint optimization objective function, and the third graph convolutional neural network is optimized by using the joint optimization objective function. The joint optimization objective function can be represented as:

[0091]

[0092] Among them, L represents the joint optimization objective function; represents a correlation loss, which is determined by the correlation between nodes; represents a causal relationship loss, which is determined by the simulated causal relationship; is a hyperparameter for balancing the two losses.

[0093] As an optional but non-limiting implementation manner, after the simulated causal relationship is used to optimize the second graph convolutional neural network to obtain the third graph convolutional neural network, the method further includes but is not limited to steps D1-D2:

[0094] Step D1: traversing the causal graph to determine at least two causal paths, and determining the causal probability of each causal path by using Bayesian inference.

[0095] Step D2: combine the causal probability with the graph attention mechanism to assign a weight to each causal path to quantitatively represent the influence of the root cause analysis of each causal path.

[0096] In the embodiment of the present application, a causal path discovery module is arranged to evaluate the causal path of each node and identify the possible causal chain in the graph by an automated method. The influence of each causal path is further quantified by using Bayesian inference and a graph attention mechanism, thereby improving the accuracy of root cause analysis. Through the arranged causal path discovery module, the causal path of each node is evaluated by traversing the causal graph. A depth-first search (DFS) or breadth-first search (BFS) algorithm is used in combination with Bayesian inference to calculate the probability of each causal path.

[0097] Specifically, based on the causal graph and the observed data, the probability of each causal path is calculated using Bayesian inference. Let be the probability of the causal path under the observation of evidence E, which is calculated by the Bayes formula as follows:

[0098]

[0099] The causal probability obtained by Bayesian inference is combined with the graph attention mechanism to assign a weight to each causal path to quantitatively represent the influence of the root cause analysis.

[0100] The embodiment of the present application introduces a causal graph modeling and Bayesian inference module, so that the model has the ability to discover causal paths. Not only can it analyze surface correlation relationships, but also can identify potential causal chains of multiple hops and across modules. By constructing a causal graph, embedding a causal matrix, and simulating causal information flow through a propagation process combined with graph convolution, and introducing Bayesian calculation to quantify the causal probability of each path, the model can infer the "root path of possible failure" based on historical data and structure after a failure occurs. This capability not only helps to reduce false positives and false negatives, but also improves the ability to identify unknown or hidden risk sources.

[0101] S240, weighting and fusing the output of the second graph convolutional neural network with the output of the third graph convolutional neural network to obtain a target graph convolutional neural network model.

[0102] Among them, referring to Figure 5 , the fusion and optimization of cross-layer information and causal links optimize the overall root cause analysis process based on cross-layer information transmission and causal modeling, and improve the model accuracy. Specifically, the output of the second graph convolutional neural network is weighted and fused with the output of the third graph convolutional neural network to obtain a target graph convolutional neural network model for overall analysis of root causes.

[0103] As an optional but non-limiting implementation, the output of the second graph convolutional neural network and the output of the third graph convolutional neural network are fused by weighting to obtain the target graph convolutional neural network model, including but not limited to steps E1-E2:

[0104] Step E1: The output fusion weight of the second graph convolutional neural network and the output fusion weight of the third graph convolutional neural network are determined respectively according to the causal relationship of nodes and the graph layer depth between different layers.

[0105] Step E2: After the output of each layer, the output of the second graph convolutional neural network and the output of the third graph convolutional neural network are fused by weighting to obtain the target graph convolutional neural network model.

[0106] Among different layers, the information is adaptively fused according to the causal relationship of nodes and the graph layer depth; after the output of each layer, the weighted fusion mechanism is used to balance the contribution of cross-layer information and causal information, so as to enhance the root cause analysis effect of the final output.

[0107] Specifically, among different layers, the fusion weights of cross-layer information and causal information are calculated according to the causal relationship of nodes and the graph layer depth, and are denoted as and respectively, which are calculated by the following formula:

[0108]

[0109]

[0110] wherein, is the current graph layer depth, is a preset depth threshold, is a hyperparameter for controlling the weight change.

[0111] After the output of each layer, the cross-layer information and the causal information are fused by using the weighted fusion mechanism, which can be represented as

[0112]

[0113] wherein, is the fused output, is the output of the second graph convolutional neural network, is the output of the third graph convolutional neural network.

[0114] As an optional but non-limiting implementation, after obtaining the target graph convolutional neural network model, the method further includes:

[0115] A multi-task loss function is defined, and the multi-task loss function is used to optimize the model parameters of the target graph convolutional neural network model.

[0116] In the embodiment of the application, the root cause analysis task is refined into multiple subtasks, and joint optimization is performed. Part of the task focuses on the causal relationship modeling of nodes, and another part of the task focuses on the transmission and fusion of cross-layer information. Through multi-task optimization, the model can better understand the complex dependency relationship in the system, and the accuracy of root cause analysis is improved.

[0117] Optionally, the root cause analysis task is refined into multiple subtasks, for example, a causal relationship modeling subtask and a cross-layer information transmission and fusion subtask. A multi-task loss function is defined, and the multi-task loss function can be represented as:

[0118]

[0119] wherein, is a causal relationship modeling subtask loss function, a cross-layer information transmission and fusion subtask loss function. A random gradient descent (SGD) is used to jointly optimize the multi-task loss function and update the model parameters.

[0120] In the embodiment of the application, the multi-task learning framework is used to jointly train the two subtasks of “causal modeling” and “cross-layer information fusion”. In the optimization process, the weights of different tasks are balanced, so that the model not only has strong recognition ability for causal dependency paths, but also has robustness enhancement in deep information fusion of the graph structure. The adaptive fusion mechanism and hierarchical weight control means introduced by the system can dynamically adjust the information fusion strategy in different depth layers, significantly enhance the adaptability of the model to complex scenes such as heterogeneous systems, multi-level alarms, and system dynamic changes, and improve the scalability and practicality of the overall root cause analysis system.

[0121] Embodiment three

[0122] Figure 6 A flowchart of an intelligent alarm root cause analysis method provided by the third embodiment of the application is shown in the above embodiment. The above embodiment is further optimized, and the third embodiment of the application can be combined with one or more optional schemes in the above embodiments. As shown in Figure 6 The method comprises the following steps:

[0123] S610, obtaining the alarm data to be analyzed, and inputting the alarm data to be analyzed into the target graph convolutional neural network model constructed in advance.

[0124] S620, determine potential relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the cross-layer information transmission mechanism introduced by the target graph convolutional neural network model.

[0125] The associated alarm data refers to alarm data obtained from other systems associated with the to-be-analyzed alarm data. Through the cross-layer information transmission mechanism introduced by the target graph convolutional neural network model, at least one set of associated alarm data having a potential relationship with the to-be-analyzed alarm data is deeply analyzed, and potential relationship information associated with the at least one set of associated alarm data is obtained. The potential relationship information includes but is not limited to a complex relationship between the to-be-analyzed alarm data and system components. By introducing the cross-layer information transmission mechanism, the expression ability of the system for deep information is enhanced, so that the system can determine the potential relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data from a multi-level perspective.

[0126] S630, determine causal relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the causal relationship propagation mechanism introduced by the target graph convolutional neural network model.

[0127] By introducing the causal relationship propagation mechanism in the target graph convolutional neural network model, the model can simulate the causal relationship between the to-be-analyzed alarm data and at least one set of associated alarm data, thereby inferring the potential root cause and achieving more accurate root cause analysis.

[0128] S640, perform weighted fusion processing on the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each set of associated alarm data to obtain root cause information between the to-be-analyzed alarm data and each set of associated alarm data.

[0129] After determining the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each set of associated alarm data, weights are assigned to the potential relationship information and the causal relationship information for weighted fusion to obtain root cause information between the to-be-analyzed alarm data and each set of associated alarm data.

[0130] As an optional but non-limiting implementation manner, the weighted fusion processing on the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each set of associated alarm data to obtain root cause information between the to-be-analyzed alarm data and each set of associated alarm data includes but is not limited to steps F1-F2:

[0131] Step F1: according to the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each group of associated alarm data, respectively assigning weights to the potential relationship information and the causal correlation relationship information.

[0132] Step F2: according to the assigned weights, performing weighted fusion on the potential relationship information and the causal correlation relationship information to obtain root cause information between the to-be-analyzed alarm data and each group of the associated alarm data.

[0133] In the embodiment of the application, after determining the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each group of associated alarm data, weights are respectively assigned to the potential relationship information and the causal correlation relationship information according to the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each group of associated alarm data, and weighted fusion is performed to obtain root cause information between the to-be-analyzed alarm data and each group of the associated alarm data.

[0134] The adaptive fusion mechanism and the hierarchical weight control means introduced in the embodiment of the application enable the system to dynamically adjust the information fusion strategy in different depth layers, significantly enhance the adaptability of the model to complex scenarios such as heterogeneous systems, multi-level alarms, and system dynamic changes, and improve the scalability and practicality of the overall root cause analysis system.

[0135] As an optional but non-limiting implementation, after performing weighted fusion on the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each group of associated alarm data to obtain root cause information between the to-be-analyzed alarm data and each group of the associated alarm data, the method further includes:

[0136] analyzing the root cause information and adaptively triggering corresponding response measures according to the root cause analysis result; wherein the response measures include repair suggestions, operation instructions, and system adjustments;

[0137] or, optimizing the model parameters of the target graph convolutional neural network model according to the root cause analysis result.

[0138] The root cause information is analyzed to generate a root cause analysis result. Specifically, the obtained root cause information is combined with cross-layer information transmission and deep causal relationship modeling to generate an accurate root cause analysis result. Each node (alarm source or device) will output a vector representation containing a deep causal chain through the GCN model. The vector not only contains the basic features of the node, but also captures deep causal relationship information. Through subsequent classifier or regression modules, the most likely root cause related to the alarm event is output according to the causal chain of the node representation. Based on this root cause information, the system accurately gives a detailed root cause chain of the system fault or alarm to assist the operation and maintenance personnel to quickly locate and handle the problem.

[0139] Optionally, after determining the root cause analysis result, a corresponding response measure is automatically triggered according to the root cause analysis result, including a repair suggestion, an operation guide and a system adjustment; at the same time, historical alarm data is fed back and optimized to improve the accuracy and efficiency of alarm noise reduction and root cause analysis. Among them, the root cause analysis method is based on the combination of deep learning model and graph neural network (GNN) in machine learning, adopts a self-supervised learning mechanism to enhance the adaptability and analysis accuracy of the knowledge graph in a dynamic environment, can adapt to the changes of the alarm environment in real time, and as time goes by, the system continuously optimizes the effect of alarm noise reduction and root cause analysis through learning.

[0140] The embodiment of the application enhances the expression ability of the model to deep information by introducing a cross-layer information transmission mechanism in the model, so that the system can analyze the problem from a multi-level perspective, avoiding the information loss and hierarchical isolation problem in the traditional method. Secondly, the introduction of the causal relationship propagation mechanism in the model enables the model to simulate the causal relationship between alarms, infer the potential root cause, and then realize more accurate root cause analysis. In this way, the system can adaptively process complex alarm data, not only improving the efficiency of alarm processing, but also greatly reducing the demand for human intervention.

[0141] Embodiment four

[0142] Figure 7 A structural schematic diagram of an intelligent alarm root cause analysis device provided by the fourth embodiment of the application is shown in FIG. 7. As shown in the figure, the device includes: Figure 7

[0143] An alarm data acquisition module 710 is configured to acquire alarm data to be analyzed and input the alarm data to be analyzed into a target graph convolutional neural network model pre-constructed; wherein the target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism;

[0144] A potential relationship information determination module 720 is configured to determine potential relationship information between the alarm data to be analyzed and at least one group of associated alarm data based on the target graph convolutional neural network model;

[0145] A causal association relationship information determination module 730 is configured to determine causal association relationship information between the alarm data to be analyzed and at least one group of associated alarm data based on the target graph convolutional neural network model;

[0146] An alarm root cause analysis module 740 is configured to perform weighted fusion processing on the potential relationship information and the causal association relationship information between the alarm data to be analyzed and each group of associated alarm data, to obtain root cause information between the alarm data to be analyzed and each group of associated alarm data.

[0147] ​Optionally, before acquiring the alarm data to be analyzed and inputting the alarm data to be analyzed into the pre-constructed target graph convolutional neural network model, the device further comprises a model construction module, specifically configured to:

[0148] construct a dynamic knowledge graph according to historical alarm data, and construct a first graph convolutional neural network according to the dynamic knowledge graph;

[0149] introduce a cross-layer information transmission mechanism on the basis of the first graph convolutional neural network to obtain a second graph convolutional neural network; wherein the cross-layer information transmission mechanism is used to extend a single-layer graph convolutional neural network into a multi-layer graph convolutional neural network, and the cross-layer information transmission mechanism is introduced to represent potential relationship information between nodes;

[0150] introduce a causal relationship propagation mechanism on the basis of the second graph convolutional neural network to obtain a third graph convolutional neural network; wherein the causal relationship propagation mechanism is introduced to represent causal association relationship information between nodes;

[0151] weight and fuse the output of the second graph convolutional neural network and the output of the third graph convolutional neural network to obtain a target graph convolutional neural network model.

[0152] Optionally, the model construction module is specifically configured to:

[0153] introduce a cross-layer convolution mechanism on the basis of the first graph convolutional neural network to transmit node information of a high-layer node to a low-layer node;

[0154] introduce a graph attention mechanism in each layer of the first graph convolutional neural network to determine an attention coefficient of a current node to its neighbor nodes, standardize the attention system, and update node features of the current node by using the standardized attention coefficient;

[0155] introduce a cross-layer connection in the first graph convolutional neural network to fuse node feature information of a high-layer node and node feature information of a low-layer node to obtain a second graph convolutional neural network.

[0156] Optionally, the model construction module is further specifically configured to:

[0157] construct a causal graph based on historical alarm data, device states, and connection structures between devices;

[0158] modify a node feature update formula according to the causal graph to simulate propagation of a causal relationship;

[0159] optimize the second graph convolutional neural network by using the simulated causal relationship to obtain a third graph convolutional neural network.

[0160] Optionally, the model construction module is further configured to:

[0161] The inter-node association relationship determined according to the second graph convolutional neural network and the simulated causal relationship are used to define a joint optimization objective function.

[0162] The third graph convolutional neural network is optimized according to the joint optimization objective function.

[0163] Optionally, the model construction module is further configured to:

[0164] The at least two causal paths are determined by traversing the causal graph, and the causal probability of each causal path is determined by Bayesian inference.

[0165] The causal probability is combined with the graph attention mechanism to assign a weight to each causal path, so as to quantitatively represent the influence of the root cause of each causal path.

[0166] Optionally, the model construction module is further configured to:

[0167] The output fusion weight of the second graph convolutional neural network and the output fusion weight of the third graph convolutional neural network are determined according to the causal relationship of the nodes and the depth of the graph layers between different layers.

[0168] After the output of each layer, the outputs of the second graph convolutional neural network and the third graph convolutional neural network are fused by a weighted fusion mechanism to obtain a target graph convolutional neural network model.

[0169] Optionally, the model construction module is further configured to:

[0170] A multi-task loss function is defined, and the multi-task loss function is used to optimize the model parameters of the target graph convolutional neural network model; wherein the multi-task loss function is composed of a causal relationship modeling sub-task loss function and a cross-layer information transmission and fusion sub-task loss function.

[0171] Optionally, the latent relationship information determination module is configured to:

[0172] Based on the cross-layer information transmission mechanism introduced by the target graph convolutional neural network model, the latent relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data is determined; wherein the associated alarm data refers to the alarm data obtained from other systems associated with the to-be-analyzed alarm data.

[0173] Optionally, the causal association relationship information determination module is configured to:

[0174] Determine the causal correlation relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data based on the causal relationship propagation mechanism introduced by the target graph convolutional neural network model.

[0175] Optionally, the alarm root cause analysis module is specifically configured to:

[0176] According to the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each set of associated alarm data, weights are respectively assigned to the potential relationship information and the causal correlation relationship information.

[0177] According to the assigned weights, the potential relationship information and the causal correlation relationship information are weighted and fused to obtain the root cause information between the to-be-analyzed alarm data and each set of associated alarm data.

[0178] Optionally, after the potential relationship information and the causal correlation relationship information between the to-be-analyzed alarm data and each set of associated alarm data are weighted and fused to obtain the root cause information between the to-be-analyzed alarm data and each set of associated alarm data, the device further comprises an alarm response and optimization module, which is specifically configured to:

[0179] analyze the root cause information and adaptively trigger a corresponding response measure according to the root cause analysis result, wherein the response measure includes a repair suggestion, an operation guide, and a system adjustment.

[0180] Or, according to the root cause analysis result, the model parameters of the target graph convolutional neural network model are optimized.

[0181] The intelligent alarm root cause analysis device provided in the embodiments of the present application can execute the intelligent alarm root cause analysis method provided in any of the embodiments of the present application, has the corresponding functions and beneficial effects of executing the intelligent alarm root cause analysis method, and the detailed process is described in the foregoing embodiments of the intelligent alarm root cause analysis method.

[0182] Embodiment five

[0183] Figure 8 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0184] As shown in Figure 8 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., connected to the at least one processor 11 in communication, wherein the memory stores a computer program executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0185] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, a speaker, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0186] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the intelligent alarm root cause analysis method.

[0187] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present application. For example, embodiments of the present application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication unit 19, or installed from the storage unit 18, or installed from the ROM 12. When the computer program is executed by the processor 11, the above-mentioned functions defined in the methods of embodiments of the present application are performed.

[0188] In some embodiments, the intelligent alarm root cause analysis method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of the intelligent alarm root cause analysis method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the intelligent alarm root cause analysis method by other means, e.g., with the aid of firmware.

[0189] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0190] Computer programs used to implement the methods of the application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor of the machine, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0191] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0192] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0193] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0194] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0195] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.

[0196] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for intelligent alarm root cause analysis, characterized in that, The method comprises: acquiring alarm data to be analyzed, and inputting the alarm data to be analyzed into a target graph convolutional neural network model constructed in advance; wherein the target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism; determining potential relationship information between the alarm data to be analyzed and at least one group of associated alarm data based on the target graph convolutional neural network model; determining causal relationship information between the alarm data to be analyzed and at least one group of associated alarm data based on the target graph convolutional neural network model; performing weighted fusion processing on the potential relationship information and the causal relationship information between the alarm data to be analyzed and each group of associated alarm data to obtain root cause information between the alarm data to be analyzed and each group of associated alarm data.

2. The method of claim 1, wherein, Before acquiring the alarm data to be analyzed and inputting the alarm data to be analyzed into the target graph convolutional neural network model constructed in advance, the method further comprises: constructing a dynamic knowledge graph according to historical alarm data, and constructing a first graph convolutional neural network according to the dynamic knowledge graph; introducing a cross-layer information transmission mechanism on the basis of the first graph convolutional neural network to obtain a second graph convolutional neural network; wherein the cross-layer information transmission mechanism is used to expand a single-layer graph convolutional neural network into a multi-layer graph convolutional neural network, and the cross-layer information transmission mechanism is introduced to represent potential relationship information between nodes; introducing a causal relationship propagation mechanism on the basis of the second graph convolutional neural network to obtain a third graph convolutional neural network; wherein the causal relationship propagation mechanism is introduced to represent causal relationship information between nodes; performing weighted fusion on the output of the second graph convolutional neural network and the output of the third graph convolutional neural network to obtain the target graph convolutional neural network model.

3. The method of claim 2, wherein, The introducing of the cross-layer information transmission mechanism on the basis of the first graph convolutional neural network to obtain the second graph convolutional neural network comprises: introducing a cross-layer convolution mechanism on the basis of the first graph convolutional neural network to transmit node information of a high-layer node to a low-layer node; introducing a graph attention mechanism in each layer of the first graph convolutional neural network to determine an attention coefficient of a current node to its neighbor nodes, performing standardization processing on the attention system, and updating node features of the current node by using the standardized attention coefficient; introducing cross-layer connection in the first graph convolutional neural network to fuse node feature information of a high-layer node with node feature information of a low-layer node to obtain the second graph convolutional neural network.

4. The method of claim 2, wherein, The introducing of the causal relationship propagation mechanism on the basis of the second graph convolutional neural network to obtain the third graph convolutional neural network comprises: constructing a causal graph based on historical alarm data, device states and connection structures between devices; modifying a node feature updating formula according to the causal graph to simulate propagation of a causal relationship; optimizing the second graph convolutional neural network by using the simulated causal relationship to obtain the third graph convolutional neural network.

5. The method of claim 4, wherein, After the simulated causal relationship is used to optimize the second graph convolutional neural network to obtain a third graph convolutional neural network, the method further comprises: defining a joint optimization objective function according to the correlation between nodes determined by the second graph convolutional neural network and the simulated causal relationship; optimizing the third graph convolutional neural network according to the joint optimization objective function.

6. The method of claim 4, wherein, After the simulated causal relationship is used to optimize the second graph convolutional neural network to obtain a third graph convolutional neural network, the method further comprises: determining at least two causal paths by traversing the causal graph, and determining a causal probability of each causal path by using Bayesian inference; combining the causal probability with a graph attention mechanism to assign a weight to each causal path, so as to quantitatively represent the influence of root cause analysis of each causal path.

7. The method of claim 2, wherein, The weighted fusion of the output of the second graph convolutional neural network and the output of the third graph convolutional neural network to obtain a target graph convolutional neural network model comprises: determining the output fusion weight of the second graph convolutional neural network and the output fusion weight of the third graph convolutional neural network according to the causal relationship between nodes and the depth of the graph layer between different layers; after the output of each layer, using a weighted fusion mechanism to perform weighted fusion of the output of the second graph convolutional neural network and the output of the third graph convolutional neural network to obtain a target graph convolutional neural network model.

8. The method of claim 7, wherein, After obtaining the target graph convolutional neural network model, the method further comprises: defining a multi-task loss function, and using the multi-task loss function to optimize the model parameters of the target graph convolutional neural network model; wherein the multi-task loss function is composed of a causal relationship modeling sub-task loss function and a cross-layer information transmission and fusion sub-task loss function.

9. The method of claim 1, wherein, Based on the target graph convolutional neural network model, determining the potential relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data comprises: based on the cross-layer information transmission mechanism introduced by the target graph convolutional neural network model, determining the potential relationship information between the to-be-analyzed alarm data and at least one set of associated alarm data; wherein the associated alarm data refers to the alarm data obtained from other systems associated with the to-be-analyzed alarm data.

10. The method of claim 1, wherein, Based on the target graph convolutional neural network model, determining the causal correlation information between the to-be-analyzed alarm data and at least one set of associated alarm data comprises: based on the causal relationship propagation mechanism introduced by the target graph convolutional neural network model, determining the causal correlation information between the to-be-analyzed alarm data and at least one set of associated alarm data.

11. The method of claim 1, wherein, The weighted fusion processing of the potential relationship information and the causal correlation information between the to-be-analyzed alarm data and each set of associated alarm data to obtain the root cause information between the to-be-analyzed alarm data and each set of associated alarm data comprises: according to the potential relationship information and the causal correlation information between the to-be-analyzed alarm data and each set of associated alarm data, respectively assigning weights to the potential relationship information and the causal correlation information. According to the assigned weight, the potential relationship information and the causal relationship information are weighted and fused to obtain root cause information between the to-be-analyzed alarm data and each group of the associated alarm data.

12. The method of claim 1, wherein, After the weighted fusion processing of the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each group of the associated alarm data, the method further comprises: analyzing the root cause information and adaptively triggering a corresponding response measure according to a root cause analysis result; wherein the response measure comprises a repair suggestion, an operation instruction, and a system adjustment; or, optimizing the model parameters of the target graph convolutional neural network model according to the root cause analysis result.

13. An intelligent alarm root cause analysis apparatus, characterized by comprising: The apparatus comprises: an alarm data acquisition module configured to acquire to-be-analyzed alarm data and input the to-be-analyzed alarm data into a pre-constructed target graph convolutional neural network model; wherein the target graph convolutional neural network model introduces a cross-layer information transmission mechanism and a causal relationship propagation mechanism; a potential relationship information determination module configured to determine potential relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data based on the target graph convolutional neural network model; a causal relationship information determination module configured to determine causal relationship information between the to-be-analyzed alarm data and at least one group of associated alarm data based on the target graph convolutional neural network model; an alarm root cause analysis module configured to perform weighted fusion processing of the potential relationship information and the causal relationship information between the to-be-analyzed alarm data and each group of the associated alarm data to obtain root cause information between the to-be-analyzed alarm data and each group of the associated alarm data.

14. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the intelligent alarm root cause analysis method of any one of claims 1-12.

15. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to implement the intelligent alarm root cause analysis method of any one of claims 1-12 when executed.

Images