Network fault diagnosis method based on dynamic weighted graph

Abstract

The application relates to the technical field of network management, and aims to provide a network fault diagnosis method based on a dynamic weighted graph, so as to solve the problem that the accuracy of fault positioning in existing network fault management is low or the internal decision process is completely invisible, which leads to the problem that fault troubleshooting and repair are not facilitated, and the technical scheme can be summarized as follows: real-time data in a network is collected, the real-time data including configuration data, topology data, alarm data and service data; a dynamic weighted graph is constructed according to the real-time data of the network, wherein the basic weight, the service weight and the time sequence correlation weight of each edge are obtained according to the real-time data in the network, then the weight value of each edge is obtained, and the dynamic update of the weight value is set; when the alarm data is received, the node of a fault root cause is calculated by using a reverse random walk algorithm and is pushed, and an evidence chain is attached. The application can improve the accuracy of fault positioning, can attach the evidence chain, and is suitable for network management.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network management, and in particular to a network fault diagnosis method based on a dynamic weighted graph. BACKGROUND

[0002] With the continuous expansion of network scale and the increasing complexity of architecture (such as cloud data center, 5G core network, etc.), network fault management faces great challenges. When a fault occurs, the network management system often receives a large number of and associated alarms, forming an "alarm storm", making it difficult for the operation and maintenance personnel to quickly locate the root cause.

[0003] However, the network fault management in the prior art has the following defects:

[0004] 1. It is based on pre-defined rules or expert systems, which is difficult to adapt to the dynamically changing network environment and has low positioning accuracy.

[0005] 2. The graph structure is static, which fails to fully consider the influence strength between dynamically changing network nodes and links, and has weak adaptability.

[0006] 3. It ignores the alarm timing, only analyzes from the spatial topology association, ignores the time sequence information of the occurrence of the alarm, and is prone to misjudgment, resulting in low positioning accuracy in complex networks.

[0007] 4. It has poor interpretability. If a relatively complex deep learning is used, although its accuracy is high, the internal decision-making process is completely invisible, lacks evidence chain, and is a "black box" to the operation and maintenance personnel, which is not conducive to fault troubleshooting and repair.

[0008] In summary, the existing network fault management has the problem of low accuracy in fault positioning or completely invisible internal decision-making process, which is not conducive to fault troubleshooting and repair. SUMMARY

[0009] The purpose of the present application is to provide a network fault diagnosis method based on a dynamic weighted graph to solve the problem of low accuracy in fault positioning or completely invisible internal decision-making process in the existing network fault management, which is not conducive to fault troubleshooting and repair.

[0010] The technical solution adopted by the present application to solve the above technical problems provides a network fault diagnosis method based on a dynamic weighted graph, comprising the following steps:

[0011] Collecting real-time data in the network, the real-time data including configuration data, topology data, alarm data and service data;

[0012] According to real-time data of the network, a dynamic weighted graph is constructed, wherein nodes of the dynamic weighted graph represent network devices and key service processes, and edges of the dynamic weighted graph represent relationships between the nodes; a basic weight of each edge is obtained according to configuration data and topology data, a service weight of each edge is obtained according to service data, a time sequence correlation weight of each edge is obtained according to alarm data, a weight value of each edge is obtained according to the basic weight, the service weight and the time sequence correlation weight of each edge, and dynamic updating of the weight value is set;

[0013] When fault localization is needed, a node of a fault root cause is calculated and pushed according to the dynamic weighted graph by using a reverse random walk algorithm, and an evidence chain is attached, wherein the evidence chain includes relevant alarm data and a reverse random walk path.

[0014] In some embodiments, to provide feasible configuration data, topology data, alarm data and service data, the configuration data includes service services and network devices, bearers and borne data; the topology data includes physical connection data and logical connection data of the network devices; the alarm data includes alarm information, wherein the alarm information includes real-time messages indicating that the network devices, services or applications in the network are currently or will soon be in an abnormal state; and the service data includes session numbers, user numbers and transmission data.

[0015] In some embodiments, to provide a feasible network device, the network device includes a router and / or a switch and / or a server and / or a virtual machine.

[0016] In some embodiments, to avoid interference caused by excessive data, the alarm data is further compressed and de-duplicated, including:

[0017] Starting from a first alarm information in all alarm information according to time, the first alarm information is selected, and alarm information identical to the first alarm information within a preset time after the first alarm information is deleted;

[0018] The next alarm information is selected, and the step of deleting alarm information identical to the next alarm information within a preset time after the next alarm information is repeated until all alarm information is processed to obtain final alarm data.

[0019] In some embodiments, to provide a feasible method for obtaining a basic weight of each edge according to configuration data and topology data, the method for obtaining the basic weight of each edge according to the configuration data and the topology data includes:

[0020] According to the configuration data and the topology data, a basic weight of each edge is obtained according to a basic weight assignment rule;

[0021] The basic weight assignment rule includes:

[0022] For any two nodes;

[0023] When the topology data indicates that these two nodes are physically directly connected, the basic weight of the corresponding edge is assigned a higher value.

[0024] When the topology data indicates that there is a critical logical dependency between these two nodes, the basic weight of the corresponding edge is assigned a high value.

[0025] When the configuration data indicates that there is a carrying relationship between these two nodes, the basic weight of the corresponding edge is assigned a high value;

[0026] When the topology data indicates that there is a non-critical logical dependency or indirect logical dependency between two nodes, the base weight of the corresponding edge is assigned a lower value.

[0027] Otherwise, the basic weight of the corresponding edge is assigned a low value;

[0028] The lower value is less than the lower value, the lower value is less than the higher value, and the higher value is less than the higher value.

[0029] In some embodiments, to provide a feasible method for obtaining the business weights of each side based on business data, the method of obtaining the business weights of each side based on business data includes:

[0030] For any two nodes, they are denoted as the first node and the second node, respectively, and for any edge in which the data flows from the first node to the second node, it is denoted as the first edge;

[0031] The proportion of business volume from the first node to the second node within a certain period of time is calculated, and the proportion is converted into the business weight of the first node using a conversion function.

[0032] In some embodiments, to provide a feasible transformation function, the transformation function includes an identity function, an amplification function, a smoothing function, or a threshold function.

[0033] In some embodiments, to provide a feasible method for obtaining the temporal correlation weights of each side based on alarm data, the method for obtaining the temporal correlation weights of each side based on alarm data includes:

[0034] For any two nodes, they are denoted as the first node and the second node, respectively, and for any edge in which the data flows from the first node to the second node, it is denoted as the first edge;

[0035] Based on the alarm data analysis, the time series of alarm information generated by the first node and the second node are analyzed, the temporal correlation between the alarm information of the first node and the alarm information of the second node is calculated, and the temporal correlation weight of the first side is obtained.

[0036] In some embodiments, to provide a feasible method for analyzing the time series of alarm information generated by a first node and a second node based on alarm data, calculating the temporal correlation between the alarm information of the first node and the alarm information of the second node, and obtaining the temporal correlation weight of the first side, the step of analyzing the time series of alarm information generated by the first node and the second node based on alarm data, calculating the temporal correlation between the alarm information of the first node and the alarm information of the second node, and obtaining the temporal correlation weight of the first side includes:

[0037] Convert alarm data into a time-point series;

[0038] The alarm information of the first node in the statistical time sequence;

[0039] For each alarm message of the first node in the time point sequence, find the first alarm message of the second node after each alarm message of the first node in the time point sequence, and match them one by one.

[0040] Calculate the time difference between the alarm information of each first node and the corresponding alarm information of each second node;

[0041] The validity of each time difference is determined based on whether it falls within a preset threshold range, and the valid time differences are recorded.

[0042] The propagation probability of the second node issuing an alarm message after the first node issues an alarm message is calculated based on the number of effective time differences and the number of alarm messages of the first node in the time point sequence.

[0043] The average propagation delay is obtained by averaging the effective time differences.

[0044] The temporal correlation weights are calculated based on the propagation probability and the average propagation delay.

[0045] In some embodiments, to provide a feasible method for calculating the temporal correlation weight based on propagation probability and average propagation delay, the method for calculating the temporal correlation weight based on propagation probability and average propagation delay includes:

[0046] The following formula is used for calculation:

[0047] ;

[0048] in, This refers to the time-series correlation weight. This refers to the probability of propagation. It is a decay function. This refers to the average propagation delay; It is a natural constant; It is a decay coefficient used to control the sensitivity of the delay to the weight.

[0049] In some embodiments, to provide a feasible method for obtaining the weights of each edge based on its basic weight, business weight, and time-series correlation weight, the step of obtaining the weights of each edge based on its basic weight, business weight, and time-series correlation weight includes:

[0050] The weights of each side are obtained by weighting and fusing the basic weights, business weights, and time-series correlation weights of each side.

[0051] In some embodiments, to provide a feasible method for dynamically updating the set weights, the dynamic updating of the set weights includes:

[0052] The rules for setting the dynamic update include:

[0053] When configuration data and / or topology data change, the base weights are recalculated;

[0054] An update cycle is set. When the current update cycle ends, the new business weight and the new time-series correlation weight are calculated using the data from the previous update cycle. The new business weight and the new time-series correlation weight are then iterated smoothly with the previously used business weight and the previously used time-series correlation weight to obtain the updated business weight and the updated time-series correlation weight, which are then adopted.

[0055] In some embodiments, to provide a feasible method for calculating and pushing nodes that are the root cause of a fault based on a dynamically weighted graph using a reverse random walk algorithm, while attaching a chain of evidence, the step of calculating and pushing nodes that are the root cause of a fault based on a dynamically weighted graph using a reverse random walk algorithm, while attaching a chain of evidence, includes:

[0056] Mark all nodes that generated alarm information during this fault as seed nodes;

[0057] Each seed node is used as a starting point, and a random walk is performed in the opposite direction of the edge. The random walk is performed with a probability proportional to the edge weight, until the visited node does not generate an alarm message in this fault.

[0058] For any given node, the root cause score is obtained based on the number of times the node is visited by a random walk.

[0059] Sort the root cause scores of each node, and select a preset number of nodes with the highest root cause scores as the root cause of the failure.

[0060] The node that caused the failure and its root cause score are pushed out, along with the chain of evidence.

[0061] In some embodiments, to further improve the accuracy of fault location, when collecting real-time data in the network, an indicator causal graph is also obtained. The indicator causal graph is a pre-established graph used to indicate the relationship between indicators of each node. The relationship between indicators of each node includes unidirectional driving relationship and bidirectional coupling relationship.

[0062] When obtaining the weights of each edge based on its basic weight, business weight, and time-series correlation weight, the process includes:

[0063] The weights of each side are obtained based on the basic weights, business weights, time-series correlation weights, and the causal graph of the indicators.

[0064] In some embodiments, to provide a feasible method for obtaining the weights of each edge based on its basic weight, business weight, temporal correlation weight, and indicator causal graph, the step of obtaining the weights of each edge based on its basic weight, business weight, temporal correlation weight, and indicator causal graph includes:

[0065] The data weights of each side are obtained by weighted fusion based on the basic weights, business weights, and time-series correlation weights of each side.

[0066] The causal graph of the indicator is pre-set with attention influence factors for each side calculated based on the content of historical alarm data;

[0067] The weight of each side is obtained by multiplying the data weight of each side by the corresponding attention influence factor.

[0068] The beneficial effects of this application are that, through the network fault diagnosis method based on the dynamic weighted graph described above, the actual fault propagation path is modeled more accurately by introducing temporal correlation weights into the dynamic weighted graph, thereby finding the actual fault nodes and improving the accuracy of fault location. Moreover, the use of a dynamic weighting mechanism allows the method to adapt to network changes without requiring extensive manual rule configuration. In addition, the reverse random walk algorithm naturally fits the reasoning process of tracing the root cause from the symptoms, with computational power highly concentrated on the tracing path starting from the symptom point. Computational resources are entirely concentrated on the most relevant fault area, with a clear objective, avoiding the exploration of irrelevant network areas. Compared with machine learning models such as deep learning models, it has high computational efficiency, is suitable for large-scale networks, and perfectly replicates the troubleshooting thinking of human experts, making the algorithm results very easy to understand and interpret. Its output evidence chain provides clear diagnostic basis for operation and maintenance personnel, and is no longer a "black box". Attached Figure Description

[0069] Figure 1This is a schematic flowchart of a network fault diagnosis method based on a dynamic weighted graph according to an embodiment of this application. Detailed Implementation

[0070] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0071] It should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0072] Figure 1 A schematic flowchart of a network fault diagnosis method based on a dynamic weighted graph according to a preferred embodiment of this application is shown. For ease of explanation, only the parts relevant to this embodiment are shown, and are described in detail below:

[0073] This embodiment of a network fault diagnosis method based on dynamic weighted graphs includes the following steps:

[0074] S1. Collect real-time data from the network, including configuration data, topology data, alarm data, and service data;

[0075] S2. Construct a dynamic weighted graph based on real-time network data. In the dynamic weighted graph, the nodes represent network devices and key service processes, and the edges represent the relationships between nodes. Obtain the basic weight of each edge based on configuration data and topology data, the service weight of each edge based on service data, and the time-series correlation weight of each edge based on alarm data. Obtain the weight of each edge based on the basic weight, service weight, and time-series correlation weight, and set the dynamic update of the weight.

[0076] S3. When fault location is required, the root cause node is calculated using the reverse random walk algorithm based on the dynamic weighted graph and pushed out, along with an evidence chain, which includes relevant alarm data and the reverse random walk path.

[0077] It is understood that in the above embodiments, the nodes of the dynamic weighted graph representing network devices and key service processes can mean that network devices and key service processes are abstracted as nodes in the dynamic weighted graph; the edges of the dynamic weighted graph represent the relationships between nodes, which may include: physical relationships obtained based on topology data, bearer relationships obtained based on configuration data, and dynamic communication relationships obtained based on service data and alarm data, such as the physical relationship of a switch and a router being directly connected, the bearer relationship of a web service being carried by a server, etc. Here, dynamic communication relationship can refer to: the communication strength calculated based on the service relationship data between nodes, and the correlation calculated based on the time sequence of alarm information, with corresponding service weights and time sequence correlation weights.

[0078] The weights of each edge are obtained by considering their basic weights, business weights, and time-series correlation weights. The weight of an edge represents the strength of a fault propagating from one node to another. Its calculation is a multi-factor fusion process. Its initial value should be based on network configuration and topology, i.e., configuration data and topology data. However, in use, it should increasingly rely on business data and alarm data. Therefore, the weights of each edge should be calculated based on their basic weights, business weights, and time-series correlation weights, such as by using weighted fusion calculation.

[0079] Additionally, the requirement for fault location here refers to the need for maintenance personnel to locate faults, or to perform fault location periodically according to a preset fault troubleshooting cycle. This can be configured according to the actual situation and will not be detailed here.

[0080] As can be seen, the above embodiments fully consider real-time data in the network and set weights for the temporal correlation of alarm data, that is, introducing temporal correlation weights, which more accurately models the real fault propagation path, thereby finding the real fault node and improving the accuracy of fault location. The dynamic update of the weights allows the method to adapt to network changes without the need for a lot of manual rule configuration. Moreover, the reverse random walk algorithm naturally fits the reasoning process of tracing the root cause from the symptoms. The computational power is highly concentrated on the tracing path starting from the symptom point, and the computational resources are completely concentrated on the most relevant fault area. The target is clear and avoids the exploration of irrelevant network areas. Compared with machine learning models such as deep learning models, its computational efficiency is high, it is suitable for large-scale networks, and it perfectly replicates the troubleshooting thinking of human experts, making the algorithm results very easy to understand and interpret. Its output evidence chain provides clear diagnostic basis for operation and maintenance personnel, and is no longer a "black box".

[0081] In some embodiments, to provide feasible configuration data, topology data, alarm data, and service data, the configuration data may include service and network device bearer and bearer data; the topology data may include physical connection data and logical connection data of network devices; the alarm data may include various alarm messages, and the alarm messages may include real-time messages indicating that network devices, services, or applications in the network are currently or about to experience abnormal states; the service data may include the number of sessions, the number of users, and transmission data.

[0082] It is understood that the configuration data, topology data, alarm data and service data mentioned in the above embodiments are all commonly used data in network construction and operation, and will not be described in detail here.

[0083] In some embodiments, to provide a feasible network device, the network device may include routers and / or switches and / or servers and / or virtual machines, etc.

[0084] It is understandable that routers and / or switches and / or servers and / or virtual machines are all commonly used network devices, and will not be discussed in detail here.

[0085] In some embodiments, to avoid interference caused by excessive data, the alarm data can also be compressed and deduplicated, including:

[0086] Starting with the first alarm message from all alarm messages, select that alarm message and delete any alarm messages that are identical to that alarm message within a preset time period after that alarm message;

[0087] Select the next alarm message and repeat the steps of deleting the same alarm message within a preset time after the current alarm message until all alarm messages have been processed and the final alarm data is obtained.

[0088] It is understandable that in the above embodiments, the alarm information is compressed and deduplicated to avoid errors and interference caused by multiple identical alarm information in a short period of time to subsequent calculations.

[0089] In some embodiments, to provide a feasible method for obtaining the basic weights of each edge based on configuration data and topology data, obtaining the basic weights of each edge based on configuration data and topology data may include:

[0090] Based on the configuration data and topology data, the basic weights of each edge are obtained according to the basic weight assignment rules.

[0091] The basic weight assignment rules include:

[0092] For any two nodes;

[0093] When the topology data indicates that these two nodes are physically directly connected, the basic weight of the corresponding edge is assigned a higher value.

[0094] When the topology data indicates that there is a critical logical dependency between these two nodes, the basic weight of the corresponding edge is assigned a high value.

[0095] When the configuration data indicates that there is a carrying relationship between these two nodes, the basic weight of the corresponding edge is assigned a high value;

[0096] When the topology data indicates that there is a non-critical logical dependency or indirect logical dependency between two nodes, the base weight of the corresponding edge is assigned a lower value.

[0097] Otherwise, the basic weight of the corresponding edge is assigned a low value;

[0098] The lower value is less than the lower value, the lower value is less than the higher value, and the higher value is less than the higher value.

[0099] Understandably, the low, lower, higher, and high values ​​here can be set according to the actual situation, as long as the requirements of low value being less than lower, lower value being less than higher, and higher value being less than high are met. For example, the low value can be set to 0, the lower value to greater than 0 and less than or equal to 0.5, the higher value to greater than 0.5 and less than or equal to 0.8, and the high value to greater than 0.8 and less than 1. More assignment rules can be added or other assignment rules can be used to further distinguish between low, lower, higher, and high values ​​to improve the accuracy of the basic weights; this will not be elaborated on here.

[0100] In some embodiments, to provide a feasible method for obtaining the business weights of each side based on business data, obtaining the business weights of each side based on business data may include:

[0101] For any two nodes, they are denoted as the first node and the second node, respectively, and for any edge in which the data flows from the first node to the second node, it is denoted as the first edge;

[0102] The proportion of business volume from the first node to the second node within a certain period of time is calculated, and the proportion is converted into the business weight of the first node using a conversion function.

[0103] Understandably, if we denote the first node as u and the second node as v, then this method calculates the proportion of the traffic sent from the first node to the second node within a certain time period relative to the total traffic flowing into the second node. A conversion function is then used to convert this proportion into the traffic weight of the first node. The calculation formula is as follows:

[0104] ;

[0105] in, This represents the business weight of the edge from u to v. This represents the amount of traffic sent from node u to node v within a certain time period. This represents the total amount of traffic received by node v from all nodes within the same time period, which is the sum of all traffic flowing into v.

[0106] function Represent a transformation function that transforms... The calculation results should be transformed as needed, but this transformation should not alter the relative weights of different business functions. For example, transforming a business weight with a larger original weight into one with a smaller original weight may not be appropriate. This transformation includes, but is not limited to, the following functions: identity functions, such as... Amplification functions, such as Smoothing functions, such as Threshold functions, such as , This represents a given threshold.

[0107] In some embodiments, to provide a feasible method for obtaining the temporal correlation weights of each side based on alarm data, obtaining the temporal correlation weights of each side based on alarm data may include:

[0108] For any two nodes, they are denoted as the first node and the second node, respectively, and for any edge in which the data flows from the first node to the second node, it is denoted as the first edge;

[0109] Based on the alarm data analysis, the time series of alarm information generated by the first node and the second node are analyzed, the temporal correlation between the alarm information of the first node and the alarm information of the second node is calculated, and the temporal correlation weight of the first side is obtained.

[0110] It is understood that in the above embodiments, the time-series correlation weight is directly related to the time series of alarm information generated by the first node and the second node respectively.

[0111] In some embodiments, to provide a feasible method for analyzing the time series of alarm information generated by a first node and a second node based on alarm data, calculating the temporal correlation between the alarm information of the first node and the alarm information of the second node, and obtaining the temporal correlation weight of the first side, the method may include:

[0112] Convert alarm data into a time-point series;

[0113] The alarm information of the first node in the statistical time sequence;

[0114] For each alarm message of the first node in the time point sequence, find the first alarm message of the second node after each alarm message of the first node in the time point sequence, and match them one by one.

[0115] Calculate the time difference between the alarm information of each first node and the corresponding alarm information of each second node;

[0116] The validity of each time difference is determined based on whether it falls within a preset threshold range, and the valid time differences are recorded.

[0117] The propagation probability of the second node issuing an alarm message after the first node issues an alarm message is calculated based on the number of effective time differences and the number of alarm messages of the first node in the time point sequence.

[0118] The average propagation delay is obtained by averaging the effective time differences.

[0119] The temporal correlation weights are calculated based on the propagation probability and the average propagation delay.

[0120] It is understood that the above embodiments can be exemplified as follows:

[0121] If we denote the first node as u and the second node as v, we can calculate the temporal correlation weight of the first edge.

[0122] Convert alarm data into a time-point series;

[0123] Statistical analysis of alarm information for u in the time series;

[0124] Alarm information for each u in the time sequence Search for v in the time series. The first alarm message that appeared later And correspond one-to-one;

[0125] Calculate the time difference: ;

[0126] Then determine Whether it is within the preset threshold range to determine each Whether it is valid or not, record the valid ones. Here, the preset threshold range can be The value range can be set according to the actual situation, such as setting it to... minute;

[0127] Statistically valid The number of effective N;

[0128] The total number of alarm messages N_u issued by u in the time sequence is counted;

[0129] Calculate the propagation probability: As a propagation probability, its value directly reflects the likelihood that v will fail when u fails.

[0130] For effective Calculate the average value to obtain the average propagation delay. ,and The smaller the value, the faster the fault propagates, the more sensitive the link, and the higher the weight should be.

[0131] The propagation probability and average propagation delay are combined into a comprehensive time-series weight. The requirement is that the higher the propagation probability and the shorter the propagation delay, the greater the weight of the time-series correlation should be. This can be calculated using the following formula:

[0132] ;

[0133] in, This refers to the time-series correlation weight. This refers to the probability of propagation. It is a decay function. This refers to the average propagation delay; It is a natural constant; It is a decay coefficient used to control the sensitivity of the delay to the weight.

[0134] Of course, other formulas that can meet the above requirements can also be used for calculation, which will not be detailed here.

[0135] In some embodiments, to provide a feasible method for obtaining the weights of each edge based on its basic weight, business weight, and time-series correlation weight, obtaining the weights of each edge based on its basic weight, business weight, and time-series correlation weight may include:

[0136] The weights of each side are obtained by weighting and fusing the basic weights, business weights, and time-series correlation weights of each side.

[0137] It is understandable that the final weights of each edge, such as the weight of the edge flowing from the first node u to the second node v, will be determined. It can be a weighted fusion of the above multiple weights, and its calculation formula is as follows:

[0138] ;

[0139] in, Based on weights, As a business weight, For time-series correlation weights, , and It is a harmonic parameter that satisfies During initial setup, you can... Set to a larger proportion, that is It is relatively large, but with the accumulation of historical data, The proportion can be gradually increased, that is... The value is getting larger and larger, while The value decreases over time. This specific setting can be adjusted according to the actual situation, such as when it first starts running. ,and Set to 0, and increase proportionally with time as runtime increases. Value, decrease value.

[0140] In some embodiments, to provide a feasible method for dynamically updating the weights, the dynamic updating of the weights may include:

[0141] The rules for setting the dynamic update include:

[0142] When configuration data and / or topology data change, the base weights are recalculated;

[0143] An update cycle is set. When the current update cycle ends, the new business weight and the new time-series correlation weight are calculated using the data from the previous update cycle. The new business weight and the new time-series correlation weight are then iterated smoothly with the previously used business weight and the previously used time-series correlation weight to obtain the updated business weight and the updated time-series correlation weight, which are then adopted.

[0144] It is understandable that the smoothing iteration here can employ smoothing iteration algorithms such as exponential smoothing, and its calculation formula can be:

[0145] ;

[0146] in, This represents the updated business weights or the updated time-series correlation weights. This indicates the business weights or time-series correlation weights before the update, i.e., the business weights or time-series correlation weights used previously. This represents the new business weights or new time-series correlation weights calculated in the latest period. This represents the smoothing coefficient, which can be set according to the actual situation.

[0147] The update cycle should correspond to the aforementioned time period to avoid inaccuracies during dynamic updates.

[0148] In some embodiments, to provide a feasible method for calculating and pushing the root cause node of a fault using a reverse random walk algorithm based on a dynamically weighted graph, while attaching an evidence chain, the method of calculating and pushing the root cause node of the fault using a reverse random walk algorithm based on a dynamically weighted graph, while attaching an evidence chain, may include:

[0149] Mark all nodes that generated alarm information during this fault as seed nodes;

[0150] Each seed node is used as a starting point for a random walk in the opposite direction of the edge. The random walk is performed with a probability proportional to the edge weight, until the visited node does not generate an alarm message in this fault.

[0151] For any given node, the root cause score is obtained based on the number of times the node is visited by a random walk.

[0152] Sort the root cause scores of each node, and select a preset number of nodes with the highest root cause scores as the root cause of the failure.

[0153] The node that caused the failure and its root cause score are pushed out, along with the chain of evidence.

[0154] It is understood that the above embodiments can be specifically described as follows:

[0155] S301. Mark all nodes that generate alarm information in this fault as seed nodes.

[0156] S302. Perform a reverse random walk starting from each seed node:

[0157] S302.1. Perform a random walk in the opposite direction of the edge, that is, start from the seed node and walk in the opposite direction to the direction specified by the edge; for example, if there is an edge in the dynamic weighted graph from node A to node B, it means that a failure of node A will cause a failure of node B. In this case, the walk should be from node B to node A in the opposite direction, because the direction from node B to node A is the direction of tracing the source of the failure.

[0158] S302.2 Currently at node V, the algorithm needs to choose which parent node to backtrack to next. This involves examining all inflow edges pointing to node V (i.e., all possible sources of parent node failure). Each inflow edge... (in, Each node (representing the parent node) has a weight. This indicates that the fault originates from... The probability or strength of propagation from node V to node V. The probability of choosing to jump to parent node Ui is proportional to the edge weight. An edge with a higher weight means that the path is the main channel for fault propagation, and therefore the greater the likelihood of choosing this path for backtracking.

[0159] S303.3 Random walks will continue for a certain number of steps until the visited nodes have not generated any events in this failure, to ensure that the root cause can be traced back to a sufficient number of parents without excessive propagation.

[0160] S303. Calculate root cause scores and push output:

[0161] S303.1 For any node, obtain the root cause score of the node based on the number of times the node is visited by a random walk. The number of times the node is visited by a random walk can be directly used as the root cause score of the node, or when it is necessary to limit the root cause score to a certain proportion, the number of times the node is visited by a random walk can be divided by the total step size of the random walk as the root cause score of the node.

[0162] S303.2 Sort the root cause scores of each node, and select a preset number of nodes with the highest root cause scores as the root cause of the fault.

[0163] S303.3 Push the node of the root cause of the failure and its root cause score, along with the evidence chain.

[0164] In some embodiments, to further improve the accuracy of fault location, when collecting real-time data in the network, an indicator causal graph can also be obtained. Here, the indicator causal graph is a pre-established graph used to indicate the relationship between indicators of each node, and the relationship between indicators of each node includes unidirectional driving relationship and bidirectional coupling relationship.

[0165] When obtaining the weights of each edge based on its basic weights, business weights, and time-series correlation weights, the following can be included:

[0166] The weights of each side are obtained based on the basic weights, business weights, time-series correlation weights, and the causal graph of the indicators.

[0167] It is understandable that, in the actual operation of the entire network, there may be edges that should have heavy weights flowing from node A to node B, but a certain device or program of node A does not have a relationship with node B. In this case, the alarm information issued by the damage or error of the device or program will not cause node B to issue an alarm information. Therefore, an indicator causal graph is added here to indicate the relationship between the indicators of each node. The indicator here can refer to the aforementioned device or program of node A.

[0168] The weights of each side are obtained based on their basic weights, business weights, time-series correlation weights, and causal graphs of indicators. These weights can include:

[0169] The data weights of each side are obtained by weighted fusion based on the basic weights, business weights, and time-series correlation weights of each side.

[0170] The causal graph of the indicator is pre-set with attention influence factors for each side calculated based on the content of historical alarm data;

[0171] The weight of each side is obtained by multiplying the data weight of each side by the corresponding attention influence factor.

[0172] Understandably, the specific formula for calculating the edge weights here is as follows:

[0173] ;

[0174] in, Let the weight be the edge weight. The attention factor affecting the edge. The data weights of the edges;

[0175] ;

[0176] in, Based on weights, As a business weight, For time-series correlation weights, , and It is the harmonic parameter.

[0177] Attention-influencing factors It can be calculated using a bilinear model, which has the following form:

[0178] ;

[0179] Where Query is the alarm vector and Key is the edge vector.

[0180] Here, a bilinear model is used to simultaneously capture the interaction between alarm vectors and edge vectors to determine whether an edge should receive higher attention.

[0181] The training process for this bilinear model can be as follows:

[0182] Historical information, including alarm information, edge information, and various attention influencing factors, is collected and mapped to form a sample set. The attention influencing factors are obtained manually based on historical alarm information. Edge information refers to the information of all edges in the causal graph of the above indicators. The edge information specifically comes from configuration data, topology data, and business data.

[0183] The sample set is input into the bilinear model for training;

[0184] An alarm information encoder is used to independently encode each input alarm message, transforming the original alarm content into an n-dimensional alarm vector Query, with one Query corresponding to each alarm message. Similarly, an edge information encoder is used to independently encode each input edge information, transforming it into an n-dimensional edge vector Key, with one Key corresponding to each edge message. The dimensions of the alarm vector Query and the edge vector Key are the same. Here, to balance the expressive power and computational efficiency of the vector, the vector dimension n is typically set to 768, but other dimensions can be chosen depending on the specific requirements.

[0185] The backpropagation algorithm is used to learn the relation matrix in the bilinear model.

[0186] During the actual operation of the entire network, when new alarm information is generated, the attention influence factor of each edge is calculated using the trained bilinear model. The specific calculation steps are as follows:

[0187] Step 1: Input alarm information and edge information into the bilinear model. The alarm information here is the alarm information generated in real time, and the edge information refers to the information of all edges in the above-mentioned causal graph. The bilinear model is the bilinear model that obtains the corresponding relation matrix after training.

[0188] Step 2: Encode the input alarm information and edge information using the same method as during training, and output the corresponding alarm vector and edge vector.

[0189] Here, if there are multiple alarm messages, a self-attention fusion processor can be used to fuse the corresponding alarm vectors into a single vector. The structure of the self-attention fusion processor can include a self-attention layer and a pooling layer. The self-attention layer receives the input alarm messages, and its output is fed into the pooling layer, which then outputs the fused alarm vector. For example, five alarm messages will encode five n-dimensional alarm vectors. These five alarm vectors are input into the self-attention layer, and after passing through the pooling layer, a single n-dimensional alarm vector is output. It is important to note that during the training of the bilinear model, the alarm vectors do not need to be fused.

[0190] In addition, the reason for re-entering the edge information and encoding the edge information in steps 1 and 2 is that the configuration data and topology data may change during actual use, thereby modifying the corresponding causal graph of the index. Therefore, it is necessary to re-enter the edge information and encode the edge information.

[0191] Step 3: Calculate the corresponding attention influence factor based on the alarm vector and edge vector combined with the relation matrix to obtain the attention influence factor of each input edge.

[0192] Of course, attention influence factors can also be calculated manually using other methods or specified manually based on the actual situation, which will not be elaborated here.

[0193] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0194] Another embodiment of this application provides a network fault diagnosis system based on dynamic weighted graphs.

[0195] This embodiment of the network fault diagnosis system based on dynamic weighted graphs includes: a processing unit, a storage unit, and a computer program stored in the storage unit and executable on the processing unit, such as a network fault diagnosis program based on dynamic weighted graphs. The processing unit includes network communication functionality. When the processing unit executes the computer program, it implements the steps in the various embodiments of the network fault diagnosis method based on dynamic weighted graphs described above, for example... Figure 1 The steps are shown.

[0196] For example, the computer program can be divided into one or more modules / units, which are stored in the storage unit and executed by the processing unit to complete this application. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the network fault diagnosis system based on dynamic weighted graphs. For example, the computer program can be divided into a data acquisition module, a dynamic weighted graph construction and update module, and a reverse random walk module, with the specific functions of each module as follows:

[0197] The data acquisition module is used to collect real-time data from the network, including configuration data, topology data, alarm data, and service data.

[0198] The dynamic weighted graph construction and update module is used to construct a dynamic weighted graph based on real-time network data. In this module, the nodes of the dynamic weighted graph represent network devices and key service processes, and the edges of the dynamic weighted graph represent the relationships between nodes. The module obtains the basic weights of each edge based on configuration data and topology data, the service weights of each edge based on service data, and the time-series correlation weights of each edge based on alarm data. The module then obtains the weights of each edge based on the basic weights, service weights, and time-series correlation weights, and sets the dynamic update of the weights.

[0199] The reverse random walk module is used to calculate the root cause node of the fault based on the reverse random walk algorithm according to the dynamic weighted graph when fault location is required, and push it along with the evidence chain, which includes relevant alarm data and the reverse random walk path.

[0200] The network fault diagnosis system based on dynamic weighted graphs can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The system may include, but is not limited to, a processing unit and a storage unit. Those skilled in the art will understand that the above description of the network fault diagnosis system based on dynamic weighted graphs is merely an example and does not constitute a limitation on the system. It may include more or fewer components than described above, or combine certain components, or use different components. For example, the system may also include input / output devices, network access devices, buses, etc.

[0201] The processing unit can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0202] The storage unit can be an internal storage unit of the network fault diagnosis system based on dynamic weighted graphs, such as the hard drive or memory of the system. Alternatively, the storage unit can be an external storage device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the storage unit can include both internal and external storage devices. The storage unit is used to store the computer program and other programs and data required by the network fault diagnosis system. It can also be used to temporarily store data that has been output or will be output.

[0203] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0204] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0205] Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0206] In the embodiments provided in this application, it should be understood that the disclosed systems / devices / terminal devices and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, and may be electrical, mechanical, or other forms.

[0207] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0208] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0209] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0210] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A network fault diagnosis method based on dynamic weighted graphs, characterized in that, Includes the following steps: Collect real-time data from the network, including configuration data, topology data, alarm data, and service data; A dynamic weighted graph is constructed based on real-time network data. In the dynamic weighted graph, the nodes represent network devices and key service processes, and the edges represent the relationships between nodes. The basic weights of each edge are obtained based on configuration data and topology data, the service weights of each edge are obtained based on service data, the time-series correlation weights of each edge are obtained based on alarm data, and the weights of each edge are obtained based on the basic weights, service weights, and time-series correlation weights. The dynamic updates of the weights are set. When fault location is required, the node of the root cause of the fault is calculated by the reverse random walk algorithm based on the dynamic weighted graph and pushed, along with an evidence chain, which includes relevant alarm data and the reverse random walk path. The step of obtaining the temporal correlation weights of each side based on the alarm data includes: For any two nodes, they are denoted as the first node and the second node, respectively, and for any edge in which the data flows from the first node to the second node, it is denoted as the first edge; Based on the alarm data analysis, the time series of alarm information generated by the first node and the second node are analyzed, and the temporal correlation between the alarm information of the first node and the alarm information of the second node is calculated to obtain the temporal correlation weight of the first side: Convert alarm data into a time-point series; The alarm information of the first node in the statistical time sequence; For each alarm message of the first node in the time point sequence, find the first alarm message of the second node after each alarm message of the first node in the time point sequence, and match them one by one. Calculate the time difference between the alarm information of each first node and the corresponding alarm information of each second node; The validity of each time difference is determined based on whether it falls within a preset threshold range, and the valid time differences are recorded. The propagation probability of the second node issuing an alarm message after the first node issues an alarm message is calculated based on the number of effective time differences and the number of alarm messages of the first node in the time point sequence. The average propagation delay is obtained by averaging the effective time differences. The temporal correlation weights are calculated based on the propagation probability and the average propagation delay.

2. The network fault diagnosis method based on dynamic weighted graph as described in claim 1, characterized in that, The configuration data includes data on the bearer and the carried by service and network devices; the topology data includes physical connection data and logical connection data of network devices; the alarm data includes various alarm messages, which include real-time messages indicating that network devices, services or applications in the network are currently or about to experience abnormal states; the service data includes the number of sessions, the number of users, and the transmission data.

3. The network fault diagnosis method based on dynamic weighted graph as described in claim 2, characterized in that, The alarm data is also compressed and deduplicated, including: Starting with the first alarm message from all alarm messages, select that alarm message and delete any alarm messages that are identical to that alarm message within a preset time period after that alarm message; Select the next alarm message and repeat the steps of deleting the same alarm message within a preset time after the current alarm message until all alarm messages have been processed and the final alarm data is obtained.

4. The network fault diagnosis method based on dynamic weighted graph as described in claim 1, characterized in that, The process of obtaining the basic weights of each edge based on configuration data and topology data includes: Based on the configuration data and topology data, the basic weights of each edge are obtained according to the basic weight assignment rules. The basic weight assignment rules include: For any two nodes; When the topology data indicates that these two nodes are physically directly connected, the basic weight of the corresponding edge is assigned a higher value. When the topology data indicates that there is a critical logical dependency between these two nodes, the basic weight of the corresponding edge is assigned a high value. When the configuration data indicates that there is a carrying relationship between these two nodes, the basic weight of the corresponding edge is assigned a high value; When the topology data indicates that there is a non-critical logical dependency or indirect logical dependency between two nodes, the base weight of the corresponding edge is assigned a lower value. Otherwise, the basic weight of the corresponding edge is assigned a low value; The lower value is less than the lower value, the lower value is less than the higher value, and the higher value is less than the higher value.

5. The network fault diagnosis method based on dynamic weighted graph as described in claim 1, characterized in that, The process of obtaining the business weights of each side based on business data includes: For any two nodes, they are denoted as the first node and the second node, respectively, and for any edge in which the data flows from the first node to the second node, it is denoted as the first edge; The proportion of business volume from the first node to the second node within a certain period of time is calculated, and the proportion is converted into the business weight of the first node using a conversion function.

6. The network fault diagnosis method based on dynamic weighted graph as described in claim 1, characterized in that, The dynamic update of the set weights includes: The rules for setting the dynamic update include: When configuration data and / or topology data change, the base weights are recalculated; An update cycle is set. When the current update cycle ends, the new business weight and the new time-series correlation weight are calculated using the data from the previous update cycle. The new business weight and the new time-series correlation weight are then iterated smoothly with the previously used business weight and the previously used time-series correlation weight to obtain the updated business weight and the updated time-series correlation weight, which are then adopted.

7. The network fault diagnosis method based on dynamic weighted graph as described in claim 1, characterized in that, The node for calculating the root cause of the fault using a reverse random walk algorithm based on the dynamic weighted graph is then pushed out, along with a chain of evidence, including: Mark all nodes that generated alarm information during this fault as seed nodes; Each seed node is used as a starting point for a random walk in the opposite direction of the edge. The random walk is performed with a probability proportional to the edge weight, until the visited node does not generate an alarm message in this fault. For any given node, the root cause score is obtained based on the number of times the node is visited by a random walk. Sort the root cause scores of each node, and select a preset number of nodes with the highest root cause scores as the root cause of the failure. The node that caused the failure and its root cause score are pushed out, along with the chain of evidence.

8. The network fault diagnosis method based on dynamic weighted graphs as described in any one of claims 1-7, characterized in that, When collecting real-time data from the network, an indicator causal graph is also acquired. The indicator causal graph is a pre-established graph used to indicate the relationship between indicators of each node. The relationship between indicators of each node includes unidirectional driving relationship and bidirectional coupling relationship. When obtaining the weights of each edge based on its basic weight, business weight, and time-series correlation weight, the process includes: The weights of each side are obtained based on the basic weights, business weights, time-series correlation weights, and the causal graph of the indicators.

Images