Fault root cause association method, apparatus, device and readable storage medium

Abstract

The application provides a fault root cause association method, device, equipment and readable storage medium, through changing the time limit of root cause association from a global fixed time window to a differentiated configuration according to a network element-service combination, that is, defining a special association time limit window for each root cause association rule in combination with the network element-service context of each of the two faults involved, avoiding alarm omission or misassociation caused by the fixed window, significantly improving the accuracy of root cause analysis, and taking the association time limit window as a time rationality criterion for establishing a causal relationship, ensuring that root cause association is only allowed to be constructed under the premise that the propagation delay is reasonable, a directional hierarchical causal chain is constructed, and the fault propagation path in a complex heterogeneous environment is restored.

Description

Technical Field

[0001] This application relates to the field of root cause analysis technology, and in particular to a root cause correlation method, apparatus, device and readable storage medium. Background Technology

[0002] In current network and service operations and maintenance, existing technologies mostly adopt alarm aggregation mechanisms based on fixed time windows, combined with SNMP TRAP OID, alarm source, and other rules for multi-dimensional correlation analysis. However, due to significant differences in keep-alive cycles, detection frequencies, and reporting delays among different business systems, the actual reporting time distribution of fault alarms is inconsistent. Fixed time windows are difficult to adapt to diverse business scenarios, easily leading to problems such as missing key alarms and miscorrelation. They also cannot construct directional hierarchical causal links, lack effective time-series fault tolerance in reverse-order scenarios where the result fault is reported before the cause fault, and are difficult to accurately reconstruct the true fault propagation path. Summary of the Invention

[0003] In view of this, in order to solve the above-mentioned technical problems, this application provides a method, apparatus, device and readable storage medium for fault root cause correlation.

[0004] Specifically, this application is implemented through the following technical solution:

[0005] According to a first aspect of the embodiments of this application, a fault root cause correlation method is provided, the method comprising:

[0006] For each preset root cause association rule, a correlation time window is determined for the network element-service combination pair consisting of the network element-service combination to which the two faults associated by the root cause association rule belong. This correlation time window is used to define the time constraint for establishing a root cause association between the two faults in the preset root cause association rule corresponding to the network element-service combination pair in the current application scenario. Each root cause association rule is used to define the causal relationship between the two faults associated with it. Each network element-service combination is uniquely determined by a single network element and the single service carried by that network element. The correlation time windows of at least two different network element-service combination pairs are different from each other.

[0007] When determining that the current fault needs to participate in the current root cause association in the fault sequence, all other faults after the current fault in the fault sequence are traversed. If the other faults and the current fault appear together in the same preset root cause association rule, the other faults are regarded as the associated faults of the current fault. The fault sequence refers to the ordered sequence of faults reported by each network element in the current application scenario according to the reporting time.

[0008] For each associated fault of the current fault, based on the root cause association rule that the associated fault and the current fault coexist, check whether the reporting time points of the current fault and the associated fault fall within the association time window of the network element-service combination pair corresponding to the root cause association rule. If so, establish a root cause association between the current fault and the associated fault according to the causal relationship defined by the root cause association rule that the associated fault and the current fault coexist. Otherwise, refuse to establish a root cause association between the current fault and the associated fault.

[0009] Optionally, the time window for determining the association between the network element-service combinations to which the two faults associated by the root cause association rule belong includes:

[0010] For the network element-service combination to which the two faults belong, when it is determined that at least one service in the network element-service combination to which the fault belongs is configured with a heartbeat mechanism, the keep-alive heartbeat cycle configured for that service is obtained.

[0011] Based on the configured keep-alive heartbeat cycle and the set floating value, the associated time window is determined.

[0012] Optionally, based on the configured keep-alive heartbeat cycle and a set floating value, the associated time window is determined, including:

[0013] When the services in the network element-service combination to which the two faults belong are both configured with heartbeat mechanisms, the larger value is selected from the two keep-alive heartbeat cycles obtained, and the associated time window is further determined based on the larger value of the two keep-alive heartbeat cycles and the set floating value.

[0014] Optionally, the time window for determining the association between the network element-service combinations to which the two faults associated by the root cause association rule belong includes:

[0015] If the services in the network element-service combination to which the two faults belong are not configured with a heartbeat mechanism or the configured keep-alive heartbeat cycle cannot be obtained, the time window distribution characteristics of the reporting time are determined based on the historical reporting time point data of the two faults associated with the root cause association rule.

[0016] Based on the static time window and its distribution characteristics, the associated time window is determined.

[0017] Optionally, determining whether the current fault in the fault sequence needs to participate in the current root cause association includes:

[0018] For each root cause association rule including the current fault, determine the maximum window length from the association time window of the network element-service combination pair corresponding to each root cause association rule;

[0019] Obtain the time difference between the reporting time of the current fault and the reporting time of the anchor fault in the fault time sequence; the anchor fault represents the earliest reported fault among the faults that did not participate in the previous root cause association.

[0020] If the time difference does not exceed the maximum window size, it is determined that the current fault in the fault sequence needs to participate in the current root cause association; otherwise, it is determined that the current fault in the fault sequence will no longer participate in the root cause association.

[0021] Optionally, check whether the reporting time points of the current fault and the associated fault fall within the association time window of the network element-service combination pair corresponding to the root cause association rule, including:

[0022] Obtain the reporting time difference between the current fault and the associated fault, and check whether the reporting time difference is less than or equal to the window length of the associated time window;

[0023] If so, it is determined that the reporting time of the current fault and the associated fault both fall within the associated time window; otherwise, it is determined that the reporting time of the current fault and the associated fault do not fall within the associated time window.

[0024] Optionally, the method further includes:

[0025] Cache the root cause association between the current fault and its associated fault in a cache list;

[0026] When it is determined that the current fault is no longer involved in root cause association, all root cause associations of the current fault included in the cache list are stored in the result list, so that the root cause of the fault can be located based on the root cause association relationship in the result list during fault repair, and the generation or execution of repair strategies can be guided.

[0027] Optionally, the method further includes: constructing a root cause association graph from the preset root cause association rules; wherein, the nodes in the root cause association graph represent the faults included in each root cause association rule; the connection relationship between the nodes in the root cause association graph is a directed edge; each directed edge corresponds to a root cause association rule; the direction of the directed edge is determined according to the causal relationship between the two faults defined by the root cause association rule.

[0028] Find the associated faults of the current fault from the fault timing sequence, including:

[0029] From the faults reported after the current fault in the fault timeline, find the faults represented by the nodes in the root cause association graph that have a connection relationship with the node where the current fault is located, and take the found faults as the associated faults of the current fault.

[0030] According to a second aspect of the embodiments of this application, a root cause correlation device is provided, the device comprising:

[0031] The timeliness determination module is configured to determine the association timeliness window for each preset root cause association rule, which is a network element-service combination pair consisting of the network element-service combination to which the two faults associated by the root cause association rule belong. The association timeliness window is used to define the timeliness constraint for establishing root cause association between the two faults in the preset root cause association rule corresponding to the network element-service combination pair in the current application scenario. Each root cause association rule is used to define the causal relationship between the two faults associated with it. Each network element-service combination is uniquely determined by a single network element and the single service carried by that network element. The association timeliness windows of at least two different network element-service combination pairs are different from each other.

[0032] The associated fault lookup module is configured to, when determining that the current fault in the fault sequence needs to participate in the current root cause association, traverse all other faults after the current fault in the fault sequence, and if the other faults and the current fault appear together in the same preset root cause association rule, the other faults are regarded as associated faults of the current fault; the fault sequence refers to the ordered sequence of faults reported by each network element in the current application scenario according to the reporting time.

[0033] The root cause association module is configured to, for each associated fault of the current fault, check whether the reporting time of the current fault and the associated fault falls within the association time window of the network element-service combination pair corresponding to the root cause association rule based on the root cause association rule that the associated fault and the current fault coexist. If so, a root cause association is established between the current fault and the associated fault according to the causal relationship defined by the root cause association rule that the associated fault and the current fault coexist. Otherwise, the root cause association between the current fault and the associated fault is rejected.

[0034] Optionally, the timeliness determination module is configured as follows:

[0035] The heartbeat cycle acquisition module is configured to acquire the keep-alive heartbeat cycle configured for the network element-service combination to which the two faults belong, when it is determined that at least one service in the network element-service combination to which the fault belongs is configured with a heartbeat mechanism.

[0036] The window determination module is configured to determine the associated time-limited window based on the configured keep-alive heartbeat cycle and a set floating value.

[0037] Optionally, the window determination module is configured to:

[0038] When the services in the network element-service combination to which the two faults belong are both configured with heartbeat mechanisms, the larger value is selected from the two keep-alive heartbeat cycles obtained, and the associated time window is further determined based on the larger value of the two keep-alive heartbeat cycles and the set floating value.

[0039] Optionally, the timeliness determination module is configured as follows:

[0040] If the services in the network element-service combination to which the two faults belong are not configured with a heartbeat mechanism or the configured keep-alive heartbeat cycle cannot be obtained, the time window distribution characteristics of the reporting time are determined based on the historical reporting time point data of the two faults associated with the root cause association rule.

[0041] Based on the static time window and its distribution characteristics, the associated time window is determined.

[0042] Optionally, the associated fault finding module is configured to: determine when the current fault in the fault timeline needs to participate in the current root cause association.

[0043] For each root cause association rule including the current fault, determine the maximum window length from the association time window of the network element-service combination pair corresponding to each root cause association rule;

[0044] Obtain the time difference between the reporting time of the current fault and the reporting time of the anchor fault in the fault time sequence; the anchor fault represents the earliest reported fault among the faults that did not participate in the previous root cause association.

[0045] If the time difference does not exceed the maximum window size, it is determined that the current fault in the fault sequence needs to participate in the current root cause association; otherwise, it is determined that the current fault in the fault sequence will no longer participate in the root cause association.

[0046] Optionally, the root cause association module is configured as follows:

[0047] Obtain the reporting time difference between the current fault and the associated fault, and check whether the reporting time difference is less than or equal to the window length of the associated time window;

[0048] If so, it is determined that the reporting time of the current fault and the associated fault both fall within the associated time window; otherwise, it is determined that the reporting time of the current fault and the associated fault do not fall within the associated time window.

[0049] Optionally, the device further includes:

[0050] Cache the root cause association between the current fault and its associated fault in a cache list;

[0051] When it is determined that the current fault is no longer involved in root cause association, all root cause associations of the current fault included in the cache list are stored in the result list, so that the root cause of the fault can be located based on the root cause association relationship in the result list during fault repair, and the generation or execution of repair strategies can be guided.

[0052] Optionally, the device further includes:

[0053] The graphing module is configured to construct a root cause association graph from the preset root cause association rules; wherein, the nodes in the root cause association graph represent the faults included in each root cause association rule; the connection between the nodes in the root cause association graph is a directed edge; each directed edge corresponds to a root cause association rule; the direction of the directed edge is determined according to the causal relationship between the two faults defined by the root cause association rule.

[0054] The associated fault finding module is configured to: find the fault represented by the node in the root cause association graph that has a connection relationship with the node where the current fault is located from the faults reported after the current fault in the fault time sequence, and take the found fault as the associated fault of the current fault.

[0055] According to a third aspect of the embodiments of this application, an electronic device is provided, the electronic device comprising: a memory and a processor; the memory being used to store a computer program; the processor being used to execute the above-described root cause correlation method by invoking the computer program.

[0056] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the above-described root cause correlation method.

[0057] The technical solutions provided in this application embodiment may include the following beneficial effects:

[0058] In the technical solution provided in this application, the time constraint of root cause association is changed from a fixed global time window to a differentiated configuration based on network element-service combination. That is, for each root cause association rule, a unique association time window is defined in combination with the network element-service context of the two faults involved. This avoids alarm omissions or false associations caused by fixed windows, significantly improves the accuracy of root cause analysis, and uses the association time window as a criterion for the time rationality of establishing causal relationship. This ensures that root cause association is allowed to be constructed only under the premise of reasonable propagation delay, thus constructing a directional hierarchical causal chain. This enables accurate reconstruction of fault propagation path in complex heterogeneous environments and provides data basis for operation and maintenance fault location and repair.

[0059] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this application. Furthermore, no embodiment in this application needs to achieve all the effects described above. Attached Figure Description

[0060] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0061] Figure 1A This is a schematic flowchart of a fault root cause correlation method illustrated in an exemplary embodiment of this application;

[0062] Figure 1B This is a schematic diagram illustrating an exemplary embodiment of the present application of a process for determining the associated time window of a network element-service combination pair;

[0063] Figure 1C This is a flowchart illustrating an exemplary embodiment of the present application for determining whether a current fault is involved in the current root cause association:

[0064] Figure 1D This is a schematic diagram of a root cause association map shown in an exemplary embodiment of this application;

[0065] Figure 1E This is a schematic diagram illustrating an exemplary embodiment of the present application of a process for verifying whether the reporting time points of the current fault and the associated fault meet the associated time limit window;

[0066] Figure 2A This is an example diagram of a root cause association graph shown in an exemplary embodiment of this application;

[0067] Figure 2B This is a schematic diagram illustrating a multi-round root cause correlation for fault timing, as shown in an exemplary embodiment of this application.

[0068] Figure 3 This is a schematic diagram of the structure of a fault root cause correlation device shown in an exemplary embodiment of this application;

[0069] Figure 4 This is a hardware schematic diagram of an electronic device illustrated in an exemplary embodiment of this application. Detailed Implementation

[0070] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims. It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another.

[0071] In current network and service operation and maintenance systems, alarm aggregation is a key step in achieving rapid fault location and root cause analysis. Existing technologies generally adopt alarm aggregation mechanisms based on fixed time windows. That is, by pre-setting a unified time window, alarm events with similar characteristics reported within this window are merged and processed to reduce alarm surges and improve readability.

[0072] However, this mechanism reveals adaptability flaws in cross-business, multi-system scenarios. Due to significant differences in keep-alive heartbeat cycles, fault detection frequencies, and reporting delays among different business systems, the actual observable time distribution of fault alarms is inconsistent. For example, core network elements may use second-level heartbeat detection, while the heartbeat cycle for edge devices or batch processing services can reach tens of seconds or even longer. Using a uniform static time window for aggregation can easily lead to the following problems:

[0073] Key alarm omission: The aggregation window was closed before some slow-responding business faults were reported;

[0074] Timing misalignment: upstream and downstream related faults are segmented into different windows due to reporting delays, disrupting the integrity of the causal chain;

[0075] Increased risk of false associations: Setting an excessively large window to avoid omissions may lead to irrelevant alarms being incorrectly clustered.

[0076] Furthermore, some intelligent alarm aggregation systems introduce rule-based multidimensional correlation analysis mechanisms. These mechanisms define alarm source information, Simple Network Management Protocol Traps Object Identifiers (SNMP TRAP OIDs), parameter matching, and other conditions, and then use logical operations to cluster TRAP messages that satisfy the rules. While this approach improves the accuracy of alarm matching, its overall architecture remains based on a flat aggregation model—it can only reflect the horizontal similarity between alarms and cannot construct directional, hierarchical causal links.

[0077] When the reporting time of business interruptions is reversed due to differences in monitoring mechanisms (e.g., the result failure is reported before the cause failure), traditional methods lack effective time-series fault tolerance and struggle to accurately reconstruct the actual fault propagation path. Furthermore, in actual deployments, existing solutions typically rely on manual experience to set window parameters, lacking dynamic perception and adaptive adjustment capabilities, making it difficult to meet the demands of complex and ever-changing production environments.

[0078] It is evident that existing alarm aggregation technologies suffer from poor time adaptability, weak causal modeling capabilities, and insufficient configuration flexibility when facing heterogeneous business environments, which severely restricts the accuracy and automation level of root cause analysis.

[0079] In view of this, this application provides a fault root cause correlation method, which improves the accuracy and rationality of determining the causal relationship between faults in multi-network element and multi-service scenarios by constructing a refined time constraint mechanism. This method is particularly suitable for the automatic analysis and localization of complex fault propagation paths in communication networks, cloud computing platforms, or distributed systems. By determining a correlation time window for each preset root cause correlation rule, it dynamically adapts to the characteristics of different network element-service combinations, thereby improving the accuracy of fault log aggregation and the effectiveness of root cause analysis.

[0080] See Figure 1A The flowchart shown is an example of a root cause correlation method. The fixed root cause correlation method provided in this application may include at least the following steps:

[0081] S101, for each preset root cause association rule, determine the association time window for the network element-service combination pair consisting of the network element-service combination to which the two faults associated by the root cause association rule belong, and the association time window is used to define the time constraint for establishing root cause association between the two faults in the preset root cause association rule corresponding to the network element-service combination pair in the current application scenario; any root cause association rule is used to define the causal relationship between the two faults associated with it; any network element-service combination is uniquely determined by a single network element and the single service carried by that network element; the association time windows of at least two different network element-service combination pairs are different from each other;

[0082] A network element refers to a physical or virtual device in a network that has specific functions, such as a router, switch, or server. Each network element can carry one or more services.

[0083] In the context of this embodiment, a service refers to a service or function provided by a network element, such as a voice call service or a data transmission service. Each service is provided by a specific network element and may be affected by the state of that network element.

[0084] A network element-service combination is a logical pairing that represents a specific network element and the specific service it carries. For example, an IPSec encrypted channel (service) running on a router (network element) constitutes a network element-service combination, "Router-IPSec Encrypted Channel." This combination reflects the context of a fault occurrence and is an important dimension for determining the fault propagation path. The network element-service combination to which a fault belongs can be uniquely determined based on the network element that reported the fault and the service to which the fault belongs within that network element. The network element and the service carried on that network element constitute the context of the fault occurrence. For example, both are "link interruption" type faults, but a link interruption fault belonging to the "Router-IPSec Encrypted Channel" network element-service combination and a link interruption fault belonging to the "Video Streaming Service on Base Station X" network element-service combination have completely different impact ranges, propagation paths, and potential causal relationships due to their different network element and service environments. They are considered two independent fault scenarios. Therefore, when defining and establishing root cause association rules, the network element-service combination to which the fault belongs must be used as the basic unit, rather than relying solely on the fault type, in order to ensure the accuracy of causal relationship modeling and scenario adaptability.

[0085] Root cause association rules represent pre-configured knowledge rules describing the potential causal relationship between two faults. Each rule contains two faults—a causal fault and an outcome fault—defining the direction of fault propagation from cause to effect. These rules are vector-based, reflecting the process of fault diffusion. This vector characteristic allows root cause analysis to not only identify correlations but also pinpoint the root cause of faults. The causal fault refers to the initial fault upstream in the fault propagation chain, potentially triggering other faults; it is the potential root cause anomaly. The outcome fault refers to the derived or phenomenological fault downstream in the fault propagation chain, usually an observable anomaly exhibited by the system. The relationship between causal and outcome faults is directional (i.e., vector-based): from the causal fault to the outcome fault, it indicates that the former may lead to the latter.

[0086] The two faults included in the root cause association rule can belong to the same or different network element-service combinations. That is, the two faults may belong to the same service on the same network element. For example, the "link interruption" fault (i.e. cause fault) of service M1 reported by network element 1 causes "service packet loss" (i.e. result fault) in service M1 reported by network element 1. Or, the two faults may belong to different services of different network elements. For example, the "power abnormality" of service 3 of network element 1 causes the "service unavailable" of service 1 of network element 2.

[0087] Each root cause association rule describes a relationship where one fault is the cause or result of another fault under a specific condition. That is, the causal relationship described by the root cause association rule is jointly defined by the network element-service combination to which the two faults belong. For example, if a "link interruption" fault in service M1 reported by network element 1 causes "packet loss" in service M2 reported by network element 1, this causal relationship is encoded into a root cause association rule.

[0088] Root cause correlation rules can be generated through various methods, such as expert experience, historical data analysis, or system topology, and serve as the knowledge base for the root cause analysis system. During the manual definition of rules, correlations are typically established based on the connection relationships between network elements and business dependencies. For example, operations and maintenance personnel can determine which faults might affect each other based on network topology, device interconnection relationships, and business call chains. Furthermore, the phenomenological faults caused by root cause faults can be deduced, following a cause-and-effect reasoning logic. Low-level physical faults (such as link interruptions or resource exhaustion) are designated as the cause, and high-level observable anomalies (such as business interruptions or response delays) are designated as the result, ensuring that each rule has a clear propagation direction. When establishing root cause correlation rules, rules are bound to specific network element-business pairs to avoid generalized matching and improve the accuracy and applicability of the rules.

[0089] For example, when an operations and maintenance expert discovers that "the link of service M1 in network element 1 is interrupted", it is often accompanied by "the service M2 in network element 1 experiences packet loss". Since the two have a topological relationship of sharing network elements and resources, a root cause association rule can be defined based on this: (network element 1, M1) link interruption → (network element 1, M2) service packet loss. This rule not only records the fault type, but also solidifies the context and propagation direction of its occurrence, forming a vector causal chain with semantic integrity.

[0090] A network element-service combination pair refers to a binary pair formed by the network element-service combinations to which the cause fault and the result fault belong in a root cause association rule. For example, if the cause fault occurs in "service X of network element 1" and the result fault occurs in "service Y of network element 2", then the corresponding network element-service combination pair is "(network element 1, X) - (network element 2, Y)". This combination pair is the binding object of the association time window, that is, each combination pair has an independent fault association time constraint that is adapted to the service operation status under the current application scenario.

[0091] Predefined root cause association rules define potential causal relationships between different faults. However, due to the significant time-sensitive nature of fault propagation in network devices or business systems, and the varying propagation delays between faults across different application scenarios, static rule matching is insufficient to guarantee the authenticity and effectiveness of causal relationships in actual operational scenarios. Specifically, when a fault (such as "power outage," "link jitter," or "CPU overload") occurs, its impact on downstream devices or upper-layer services typically occurs within a limited time window. For example, after a power outage, the server may restart within 3 seconds; increased link packet loss may cause application layer timeouts within 10 seconds; accumulated database lock waits may cause front-end service unavailability within 15 seconds. Once this reasonable propagation delay range is exceeded, subsequent faults are more likely to be caused by other independent events rather than being a direct result of the aforementioned faults. Therefore, even if a predefined causal rule exists between two fault types, if their reporting interval exceeds the maximum reasonable duration of the propagation process, the probability of an actual causal relationship between the two is extremely low.

[0092] For example, suppose the rule defines "power outage of network element A" as potentially causing "service interruption of network element B". However, if the power outage occurs at 09:00:00, but the service interruption is not reported until 09:15:00, and there are no other related events during this period, this delay far exceeds the timescale of typical power restoration or system cascading effects. Establishing a causal relationship in this situation would lead to incorrect attribution and mislead operational decisions.

[0093] Based on this, this embodiment introduces a dynamic time verification mechanism on top of rule matching. Specifically, it configures a time-limited window for each root cause association rule, adapting to the specific business operation on the network element involved in the current application scenario. This window serves as a time-limited constraint, used to confirm the rationality of the causal relationship between two faults during actual root cause association in the current application scenario. This avoids mis-associations or incorrect root cause inferences caused by directly establishing causal relationships based solely on preset root cause association rules without considering time-limited constraints.

[0094] The associated timeliness window represents a time range set for each network element-service combination pair. It constrains the temporal reasonableness of whether two related faults in an actual fault sequence can be considered to meet a preset causal relationship. Root cause correlation is only allowed when the time difference between the reporting times of two faults falls within this window range. This window is not a fixed value but is dynamically determined based on the specific service characteristics of the network element-service combination pair, thereby avoiding misjudgments or omissions caused by a uniform window setting.

[0095] In this embodiment, for each pre-defined root cause association rule, the network element-service combination pair corresponding to the two faults involved in the root cause association rule is formed by the network element-service combination to which each belongs. Furthermore, based on the specific service characteristics and requirements of the two network element-service combinations in the network element-service combination pair, a suitable association time window is configured for the network element-service combination pair. It is ensured that the association time windows of at least two different network element-service combination pairs are different to accommodate their unique response times and detection cycles. When different root cause association rules correspond to the same network element-service combination pair, the same association time window applies. Based on this, the network element-service combination pairs corresponding to each pre-defined root cause association rule can be deduplicated first, and an association time window can be determined for each deduplicated network element-service combination pair.

[0096] For example, the two preset root cause association rules are as follows:

[0097] T0: Link interruption causes service packet loss, involving network element-service combination pairs (link service B of router A) and (database service D of server C).

[0098] T1: A power supply module health degradation alarm caused a brief service interruption, involving the network element-service combination pair (power supply F for data center E) and (cloud computing service H for server G).

[0099] T2: Power failure affects computing power and involves the network element-service combination pair (power supply F for data center E) and (cloud computing service H for server G).

[0100] For T0, set the associated time window to 5 minutes; for T1 and T2, set the associated time window to 10 minutes.

[0101] In this embodiment, when determining the association time window for the network element-service combination pair corresponding to the root cause association rule, the specific service characteristics in the network element-service combination may include the service's keep-alive heartbeat cycle. The keep-alive heartbeat mechanism refers to the heartbeat signal actively sent by a service to maintain its connection state or periodically report its own liveness status. Examples include TCP keepalive probes, application layer health checks (such as HTTP health probes), and renewal messages from microservice registry centers. This mechanism is used to detect whether a service is online or whether a node is alive. The keep-alive heartbeat cycle of a service may differ in different scenarios, or the keep-alive heartbeat cycle of a service in the same scenario may adaptively change as the service progresses. The keep-alive heartbeat cycle refers to the time interval between two heartbeat signal transmissions, typically in seconds or milliseconds. For example, if a service sends a heartbeat every 5 seconds, its keep-alive heartbeat cycle is 5 seconds. This cycle reflects the health detection frequency of the service and is an important indicator for measuring the delay in fault detection.

[0102] Based on this, it is possible to detect in advance whether the services included in each network element-service combination are configured with a keep-alive heartbeat mechanism. When it is determined that the service in the network element-service combination to which at least one fault belongs in the root cause association rule is configured with a heartbeat mechanism, a time-sensitive constraint mechanism with context adaptability is dynamically constructed based on the keep-alive heartbeat cycle of the service. This fully utilizes the operational characteristics of the service itself, making the setting of the association window closer to the actual fault exposure and propagation patterns, and avoiding the misjudgment or omission problems caused by using a unified fixed window.

[0103] See Figure 1B The illustrative diagram illustrates a process for determining the associated timeframe window of a network element-service combination pair. The determination of the associated timeframe window can be completed through the following process:

[0104] S1011, for the network element-service combination to which the two faults belong respectively, when it is determined that at least one service in the network element-service combination to which the fault belongs is configured with a heartbeat mechanism, the keep-alive heartbeat cycle configured for the service is obtained.

[0105] For each network element-service combination to which a fault belongs in the root cause association rule, query whether the services included in that network element-service combination are configured with a keep-alive heartbeat mechanism. If it is determined that a service in at least one network element-service combination to which a fault belongs in the root cause association rule is configured with a heartbeat mechanism, the configured keep-alive heartbeat period for that service can be accurately obtained by parsing the network element configuration carrying that service. It should be noted that not all services are configured with a heartbeat mechanism; therefore, this step only performs the retrieval operation for services that are already configured.

[0106] When both faults belong to network element-service combinations where services are configured with heartbeat mechanisms, step S1011 will retrieve the root cause association rule, including the keep-alive heartbeat period configured for each fault's network element-service combination. Conversely, if it is determined that neither fault's network element-service combination where services are configured with heartbeat mechanisms, other methods such as default values, historical average fault propagation time, or manual configuration strategies can be used to set the association timeframe window.

[0107] For example, for root cause association rule T2: (Data Center E, Power Supply F) Power failure → (Server G, Cloud Computing Service H) Decreased computing power, then check the following respectively:

[0108] Does the "Power Supply F" service have a heartbeat mechanism? If so, obtain its heartbeat cycle T1.

[0109] Does the "Cloud Computing Service H" service have a heartbeat mechanism configured? If so, obtain its heartbeat cycle T2.

[0110] This step ensures that the timeliness window is built based on real operating parameters, rather than subjective settings.

[0111] S1012, Based on the configured keep-alive heartbeat cycle and the set floating value, determine the associated time window.

[0112] The floating value is set as a pre-introduced fixed duration or proportional coefficient to cover network transmission delays, jitter handling, or detection errors. The floating value can be dynamically adjusted based on network environment, service level, or historical accuracy to further improve the adaptability and accuracy of root cause analysis. For example, the floating value Δ can be set to 1.5 times the period, or Δ = 10 seconds. The formula for calculating the associated time window W can be expressed as: W = T × k + Δ, where T represents the keep-alive heartbeat period, k is the safety factor (e.g., 1.0 or 1.2), and Δ is the additional buffer time (i.e., the set floating value).

[0113] When all services in a network element-service combination belonging to only one fault are configured with a heartbeat mechanism, the associated time limit window is determined directly based on the keep-alive heartbeat cycle configured for that service under the heartbeat mechanism and the set floating value.

[0114] In a causal propagation chain, the fault detection speed is limited by the slowest-responding link. Therefore, the exposure delay of a fault determines the lower limit of the causal judgment time. From the actual occurrence of a fault to its capture and reporting by the monitoring system, it typically requires at least one complete keep-alive heartbeat cycle. If the heartbeat cycle of the service to which the causal fault belongs is 8 seconds, the fault may be detected with a maximum delay of 8 seconds. Even if the heartbeat cycle of the resulting fault is shorter (e.g., 5 seconds), its reporting time still cannot be earlier than the observable time of the causal fault. Therefore, when constructing the correlation time window, using a shorter cycle as a benchmark may lead to incorrect exclusion of the true causal relationship due to the upstream fault reporting delay. To ensure the completeness and robustness of root cause correlation determination, the longest keep-alive heartbeat cycle at both ends of the causal chain must be used as the basis for time constraints. This maximum cycle reflects the bottleneck of fault detection capability in the path and is the key basis for determining a reasonable correlation window.

[0115] Therefore, when the services in the network element-service combination to which the two faults belong are both configured with heartbeat mechanisms, the larger value is selected from the two keep-alive heartbeat cycles. The correlation time window is then determined based on the larger value of the two keep-alive heartbeat cycles and the set floating value. This can accommodate the worst-case detection delay and avoid missed correlations caused by instantaneous jitter or detection lag, thereby improving the accuracy and coverage of root cause analysis.

[0116] Taking the aforementioned root cause association rule T2: (Data Center E, Power Supply F) Power Failure → (Server G, Cloud Computing Service H) Computing Power Degradation as an example, when two heartbeat cycles are obtained: T1 = 8s (Power Monitoring Heartbeat), T2 = 6s (Cloud Service Health Check):

[0117] If a larger value T1 is chosen, and k = 1.0, Δ = 10s, then the keep-alive heartbeat period for the network element-service combination pair corresponding to root cause association rule T2 can be set to 18s. That is, when two faults are detected in the fault sequence: a power supply fault reported by data center E belonging to power supply F, and a computing power degradation fault reported by server G belonging to cloud computing service H, a root cause association is only allowed if the reporting time difference between the two faults is less than or equal to 18 seconds. Otherwise, even if the preset root cause association rule explicitly defines a causal relationship between the two faults, they are considered unrelated events during this root cause association process, and the root cause association between the two faults is refused.

[0118] It should be understood that the method described above for determining the association timeframe based on the keep-alive heartbeat cycle is applicable to scenarios where the relevant services have a configured heartbeat mechanism and the relevant parameters are available. However, in actual network environments, not all network elements or services have standardized heartbeat reporting capabilities. Some traditional devices, outdated systems, or specific functional modules may not have deployed health detection mechanisms, or their monitoring interfaces may be limited, preventing the collection of heartbeat cycles. In such cases, if a dynamic window generation strategy based on the heartbeat cycle is still adopted, the rules will become invalid or the association judgment will be missing.

[0119] To enhance the robustness and applicability of this method, this embodiment further provides an alternative scheme for determining the correlation time-sensitivity window in the absence of a heartbeat mechanism. This scheme, by mining the temporal distribution characteristics of historical fault data and combining them with preset static parameters, achieves a reasonable derivation of the time-sensitivity window, ensuring that the root cause association rules remain complete and usable in diverse deployment environments. (Continue to see...) Figure 2B As shown, it may also include the following steps:

[0120] S1013, In the case that neither of the services in the network element-service combination to which the two faults belong has a heartbeat mechanism configured, or the configured keep-alive heartbeat cycle cannot be obtained, the time window distribution characteristics of the reporting time are determined based on the historical reporting time point data of the two faults associated with the root cause association rule.

[0121] Historical reporting time point data represents the actual reporting / occurrence time records of cause failures and result failures under the same context within a past period. That is, it is the reporting / occurrence time statistics of two failures that belong to the same network element-service combination. This data can be obtained from the alarm logs of the operation and maintenance system, the event center, or the monitoring platform, and is usually stored in the form of timestamps.

[0122] The time window distribution characteristic refers to the statistical distribution characteristics of the time difference between the causal failure and the resulting failure in multiple real-world failure events. This characteristic can be described by calculating statistical measures such as the mean, median, standard deviation, and quantiles (e.g., the 90th percentile) of the time difference, reflecting the typical response delay and fluctuation range of the causal path. For example, if the reporting time difference between two failures is concentrated between 10 and 30 seconds, its distribution characteristic can be modeled as "mean 20 seconds, standard deviation 5 seconds".

[0123] When it is detected that any service involved in the current root cause association rule does not have a heartbeat mechanism configured, or the heartbeat cycle information is unavailable, a fault pair record that meets the following conditions will be retrieved from the historical alarm database:

[0124] The fault type is consistent with the cause fault and result fault in the current root cause association rule;

[0125] The fault occurred in the same or similar network element-service combination pair;

[0126] The fault occurred within a preset time range (e.g., within the last 3 months).

[0127] The fault has been manually confirmed or automatically determined to be a true cause-and-effect relationship.

[0128] For each pair of matching historical fault records, the reporting time difference (i.e., the time difference between the result fault time and the cause fault time) is calculated to form a set of time difference sample sets. Subsequently, statistical analysis is performed on the sample set to extract its distribution characteristics, such as: calculating the average delay; obtaining the 90th percentile as an upper limit reference; fitting a normal distribution or gamma distribution model; marking and removing outliers, thereby obtaining the time window distribution characteristics of the causal path, which serves as the core basis for generating the associated time window.

[0129] For example, for the root cause association rule T2: "(Data Center E, Power Supply F) Power Abnormality → (Server G, Cloud Computing Service H) Service Interruption", the time differences of the past 6 real events were retrieved: 12s, 15s, 18s, 14s, 20s, and 16s. According to statistics, the average value is 15.8 seconds, and the 90th percentile is about 19 seconds. The failure propagation delay is concentrated between 12 and 20 seconds.

[0130] S1014. Based on the static time window and its distribution characteristics, determine the associated time window.

[0131] A static time window represents a fixed duration, either based on human experience or a system default setting, used for the preliminary estimation of causal relationships. It can serve as an initial reference or a safety net for historical data analysis. For example, a preset window of 60 seconds can be used for "general network failures," 30 seconds for "core business failures," and 120 seconds for "environmental failures."

[0132] After obtaining the time window distribution characteristics, the process can determine the correlation timeliness window in any of the following ways: The high quantile value of the distribution characteristics can be used as the window length; for example, the time difference between the 90th or 95th quantiles can be used as the upper limit of the window to cover most real-world situations. Alternatively, the time window distribution characteristics and the static time window can be weighted or limited. For example, if the distribution characteristics show a mean of 15 seconds, while the static time window is 30 seconds, the final window can be set to max(15×1.5, 30) = 30 seconds to avoid the window being too small due to insufficient samples. Alternatively, the static time window can be dynamically adjusted. Initially, a static window is used for preliminary correlation, and as historical data accumulates, statistical characteristics are gradually replaced, achieving an evolution from "experience-driven" to "data-driven." Furthermore, other implementation methods can be used, such as machine learning. Based on the historical reporting time points of two faults, combined with the contextual information at the time of the fault occurrence (such as network element type, service load, time period, network topology, etc.), a time-series prediction model can be constructed to dynamically infer the reasonable correlation timeliness window under the causal path.

[0133] S102, when it is determined that the current fault in the fault sequence needs to participate in the current root cause association, all other faults after the current fault in the fault sequence are traversed, and if the other faults and the current fault appear together in the same preset root cause association rule, the other faults are regarded as the associated faults of the current fault; the fault sequence refers to the ordered sequence of faults reported by each network element in the current application scenario according to the reporting time.

[0134] This step describes the process of finding associated faults that satisfy preset root cause association rules for a specific fault (i.e., the current fault) in a root cause association process. The fault sequence refers to an ordered sequence of faults reported by various network elements that belong to their respective services, arranged chronologically according to their reporting time. Each fault record may include, but is not limited to, information such as: fault type, network element-service combination, reporting timestamp, fault level, and processing status. The root cause association can be executed using periodic triggering or event-driven triggering.

[0135] Periodic triggering: The system initiates root cause association analysis once at a preset time interval (e.g., every 5 minutes);

[0136] Event-driven triggering: When a new fault is reported and meets specific conditions (such as a pre-defined fault type that needs to be focused on), the analysis process is immediately triggered.

[0137] The root cause association process triggered at the current moment is designated as the current root cause association. For this process: if the current root cause association is the first root cause association (i.e., the first root cause association process triggered after the system starts running and a fault sequence is formed), then all faults included in the fault sequence participate in the current fault association. This means that for each fault in the fault sequence, its associated faults need to be found sequentially, and the subsequent root cause association processing flow is executed for that fault and its associated faults. If the current root cause association is not the first root cause association, to improve the efficiency of the root cause association operation, each fault that needs to participate in the current fault association is determined from the fault sequence, and the corresponding associated fault finding and root cause association processing flow is executed.

[0138] After entering the current root cause association process, each fault in the fault sequence is sequentially designated as the current fault. Further determination is made as to whether the current fault has been excluded from participating in this or subsequent root cause associations. To facilitate rapid identification, an identification information (e.g., a flag field) can be introduced to indicate that the fault will no longer participate in new root cause association operations. Specifically, this identification information can be detected in the following way: It is checked whether the current fault has an identification information set, which indicates that the current fault will no longer participate in the current root cause association; if this identification information is detected, it is determined that the current fault will no longer participate in the current root cause association; otherwise, if this identification information is not detected, it is determined that the current fault needs to participate in the current root cause association.

[0139] Because the fault sequence is an ordered sequence arranged according to the fault reporting time, and the root cause association analysis process progresses step by step according to time windows, the entire analysis process has a clear temporal direction and is irreversible. Once a fault is determined not to participate in root cause association in the current root cause association cycle, it means that its potential association opportunities as a cause or result have been completely covered on the timeline, and the fault has no need or possibility to participate in subsequent root cause associations. Based on this sequence characteristic, when a fault is first determined not to participate in the current root cause association, the identification information can be immediately set for that fault, thereby avoiding repeated judgment and retrieval of the fault in each root cause association cycle and improving the efficiency of root cause association.

[0140] Alternatively, in addition to judgments based on identification information, an active time window determination mechanism can be used to determine whether the current fault needs to participate in the current root cause association. This is applicable to non-first-time root cause associations. By judging whether the current fault is still within the effective impact period that may trigger subsequent faults, it dynamically decides whether it needs to participate in the current root cause association. See [link to relevant documentation]. Figure 1C An exemplary flowchart for determining whether a current fault is involved in the current root cause association is shown below:

[0141] S1021, For each root cause association rule including the current fault, determine the maximum window length from the association time window of the network element-service combination pair corresponding to each root cause association rule;

[0142] Including the various root cause association rules of the current fault, in this embodiment, it refers to the root cause association rules with "current fault" as the cause fault or the result fault. That is, the root cause association rules describe the causal relationship of the current fault causing other faults, or other faults causing the current fault.

[0143] The maximum window length represents the largest value within the corresponding association time window among all root cause association rules, including the current fault. This value reflects the longest reasonable time span during which the current fault may affect or be affected in the entire causal propagation network. In other words, regardless of whether the current fault is a cause or a consequence, as long as there is a long time window corresponding to an association rule, the entire participation determination mechanism must cover this longest time delay to avoid incorrectly excluding true causal relationships due to an excessively narrow window.

[0144] For example, if the current fault can cause three different business anomalies, with corresponding windows of 10s, 15s, and 8s respectively, and another business fault triggers the current fault with a corresponding window of 20s, then the maximum window length Wmax = 20s. Under this maximum window length selection method, if the reporting time of the current fault is earlier than the reporting time of the other business fault that triggered it, the fault association can be effectively detected based on the maximum window length of 20 seconds. If a judgment window of less than 20 seconds is used, the true causal relationship may be incorrectly excluded due to the time difference exceeding the limit. By selecting the maximum correlation time window among all root cause association rules related to the current fault as a unified judgment standard, this can effectively cover such reverse reporting situations where "results are reported first, causes are reported later," avoiding the omission of the true root cause, thereby improving the completeness and fault tolerance of root cause analysis.

[0145] S1022, obtain the time difference between the reporting time of the current fault and the reporting time of the anchor fault in the fault time sequence; the anchor fault represents the earliest reported fault among the faults that did not participate in the previous root cause association; the previous root cause association represents the root cause association that was most recently triggered before the current root cause association.

[0146] An anchor failure refers to the first failure after the last root cause association was triggered, following the latest reported failure processed in the previous root cause association. For example, in the failure sequence: A1, A2, A4, A3, A6, A7, A5, A9, assuming the last root cause association was triggered after A3 was reported, then the latest reported failure processed in the previous root cause association was A3, and the anchor failure was A6. By using this anchor failure as the time benchmark for the current analysis, we can measure whether the current failure is still within the effective association time range, ensuring the continuity and non-overlapping nature of the root cause association processing range, and avoiding repeated or out-of-order analysis of historical causal chains.

[0147] S1023, when the time difference does not exceed the maximum window size, determine that the current fault in the fault sequence needs to participate in the current root cause association; otherwise, determine that the current fault in the fault sequence will no longer participate in the root cause association.

[0148] If the time difference does not exceed the maximum window size, it means that the current fault is still within the effective causal influence period that may trigger subsequent faults or be affected by upstream faults. In this case, other faults that are causally related to the current fault may appear within the time series of faults to be dealt with in the current root cause association. Therefore, the current fault should be included in the scope of this analysis to determine whether it needs to participate in the current root cause association.

[0149] Conversely, if the time difference exceeds the maximum window length, it indicates that the current fault has exceeded its effective causal influence period, which may trigger subsequent faults or be affected by upstream faults. In this case, even if other faults with potential causal relationships to the current fault appear within the fault time series processed by the current root cause association, the reporting time difference between them will exceed the preset association time window range, failing to meet the time rationality condition for establishing a causal association. In other words, the current fault and its possible related faults no longer have the possibility of falling into the same effective association window, and therefore cannot form an identifiable causal pair. If this fault is still included in the current or subsequent root cause association analysis, not only will a new effective causal chain not be formed, but it may also produce false matches with unrelated faults due to its excessive time offset, leading to false associations and reducing the accuracy and reliability of root cause analysis.

[0150] Furthermore, because fault sequences have a strict temporal order, and the root cause association process proceeds sequentially over time, once a fault exceeds its maximum impact window and remains unassociated, no new faults that could reasonably form a causal relationship with it will subsequently appear. Therefore, this fault no longer needs to participate in subsequent root cause analysis. Based on this, once it is determined that the current fault is no longer involved in the current root cause association, a flag can be set for it to avoid repeated judgments in subsequent analyses and improve processing efficiency.

[0151] To find the associated faults of the current fault from the fault sequence, all other faults following the current fault in the fault sequence can be traversed. If any of these other faults coexist with the current fault under the same preset root cause association rule, then that other fault is considered an associated fault of the current fault. The situation where other faults coexist with the current fault under the same preset root cause association rule only indicates that the other fault and the current fault are two faults defined by that root cause association rule. It does not require that the order in which the other fault and the current fault appear in the fault sequence conforms to the causal direction of the two faults defined by the root cause association rule. That is, the matching process is a non-directional rule membership judgment; when determining associated faults, the causal direction of the two faults defined by the root cause association rule is not considered. As long as one of the two faults included in the root cause association rule is the current fault and the other is an other fault, it is considered that the other fault and the current fault coexist under the same preset root cause association rule. For example, if the current fault is fault D and another fault is fault C, and the pre-established root cause association rule M9 is CD, based on the fact that other fault C and current fault D appear in M9 at the same time, it is determined that the two "appear together in the same root cause association rule". Then, other fault C is regarded as the associated fault of current fault D, even if fault C appears later than current fault D in the fault time sequence.

[0152] Alternatively, first search for all root cause association rules that include the current fault. A root cause association rule for the current fault represents a causal relationship between two faults where one fault has the same type as the current fault and the network element-service combination to which that fault belongs completely matches the network element-service combination to which the current fault belongs. In other words, a rule is considered relevant to the current fault only if the fault type, network element, and service carried by it at one end are all consistent with the current fault. For example:

[0153] The current fault is "Database service DB on network element A is abnormal". If there is a root cause association rule: "Database service DB is abnormal → Application service response timeout", and the network element-service combination defined in the cause side of the rule is also (network element A, DB), then the rule belongs to the rule set "including the current fault". Conversely, if the rule corresponds to "DB is abnormal on network element B", even if the fault type is the same, but the network element-service combination is different, it will not be included in the matching range.

[0154] Based on the root cause association rule for each root cause, if a fault is found among the faults reported after the current fault in the fault timeline that has the same fault type, network element, and service as the other fault, then the found fault is considered an associated fault of the current fault. It can be understood that determining associated faults requires participation in the current root cause association.

[0155] In some embodiments, to improve the organization efficiency and query performance of root cause association rules and facilitate the rapid identification of causal propagation paths between faults, the preset root cause association rules can be constructed into a root cause association graph. A root cause association graph is a directed graph structure used to represent the potential causal relationship network between different fault types. Nodes in the root cause association graph represent the faults included in each root cause association rule. Each node corresponds to a fault in a network element-service combination; for example, "Network element A - Database service DB anomaly" can be considered an independent node. The connections between nodes in the root cause association graph are directed edges. Each directed edge corresponds to a root cause association rule, representing the causal propagation relationship between two faults. The direction of the directed edge is determined according to the causal relationship between the two faults defined by the root cause association rule. The starting node of the directed edge is the cause fault, and the ending node is the result fault.

[0156] See Figure 1D This exemplary root cause mapping diagram illustrates a fault instance where each node corresponds to a specific network element-service combination. To ensure accurate differentiation of the same fault type across different contexts, a unique node identifier is assigned to each fault type within each network element-service combination. The diagram assigns a unique identifier to each fault type within each network element-service combination, such as node identifier B_1X for power outage of (Network Element 1 Service X) and node identifier B_2Z for power outage of (Network Element 2 Service Z), uniquely representing a fault in a specific service within a specific network element. Through this identifier mechanism, even if the fault type is the same (e.g., both being "power outage"), as long as the network element or the service it carries is different, they are considered different nodes and thus independently represented in the root cause mapping. This accurately reflects the spatial and service context attributes of the fault, avoids confusion of causal relationships across network elements or services, and improves the accuracy of root cause analysis.

[0157] Regarding the example of directed edges, as shown in the figure, if there is a rule "(Network Element 1 Service X) power outage leads to (Network Element 2 Service Y) service outage", then a directed edge is established in the graph from the node "(Network Element 1 Service X) power outage" to the node "Network Element 2 Service Y) service outage". This directed edge only represents the possible consequences of "power outage of Service X on Network Element 1" and is not applicable to other network elements or business scenarios.

[0158] Based on this root cause correlation graph, when searching for associated faults of the current fault in the fault timeline, the faults reported after the current fault in the fault timeline can be searched for faults represented by nodes in the root cause correlation graph that have a connection relationship with the node where the current fault is located. These found faults are then considered associated faults of the current fault. That is, each fault reported after the current fault is considered a candidate fault. The root cause correlation graph is then queried to determine if there is a directed edge from the node corresponding to the current fault to the node corresponding to the candidate fault, or vice versa. If a directed edge exists in either direction, it indicates that there is a pre-defined causal relationship rule supporting the relationship, and the candidate fault is then identified as an associated fault of the current fault.

[0159] S103. For each associated fault of the current fault, based on the root cause association rule that the associated fault and the current fault coexist, check whether the reporting time of the current fault and the associated fault falls within the association time window of the network element-service combination pair corresponding to the root cause association rule. If so, establish a root cause association between the current fault and the associated fault according to the causal relationship defined by the root cause association rule that the associated fault and the current fault coexist. Otherwise, refuse to establish a root cause association between the current fault and the associated fault.

[0160] This step introduces a dynamic time verification mechanism based on root cause association rule matching. Specifically, it determines whether the reporting times of the current fault and related faults simultaneously fall within the association timeframe window corresponding to their matched root cause association rule (i.e., the root cause association rule in which both the related and current faults occur). This further determines whether the two faults meet preset time constraints, thus deciding whether to formally establish a root cause association. Essentially, it combines prior knowledge (rules) with empirical data (time series). In other words, root cause association rules provide possible causal paths between the current and related faults, while the association timeframe window provides the criteria for determining whether an event actually occurred. Together, they achieve the screening from theoretical associations to practically establishable root cause associations, thereby avoiding false associations caused by rule generalization and improving the credibility and interpretability of root cause analysis results.

[0161] Whether the reporting timestamps fall within the associated timeframe window means that the time interval between the occurrences of the two faults should be within the maximum propagation delay allowed by the fault path. Since different types of faults have different response speeds in different network element-service combinations, each root cause association rule is bound to an associated timeframe window for its corresponding network element-service combination pair. Therefore, when checking whether the reporting timestamps of the current fault and its associated fault simultaneously fall within the associated timeframe window of the network element-service combination pair corresponding to the matched root cause association rule, refer to... Figure 1EAn exemplary flowchart illustrating whether the reporting times of the current fault and the associated fault meet the associated timeframe window may include at least the following steps:

[0162] S1031, Obtain the reporting time difference between the current fault and the reporting time of the associated fault;

[0163] Calculate the time difference between the reporting time of the current fault and the reporting time of the associated fault, denoted as ΔTreport, i.e.: ΔTreport=|Tcurrent−Tassociated|, where Tcurrent is the reporting time of the current fault and Tassociated is the reporting time of the associated fault.

[0164] S1032, Detect whether the reporting time difference is less than or equal to the window length of the associated time window;

[0165] S1033, if so, then determine that the reporting time of the current fault and the associated fault both fall within the associated time window;

[0166] S1034, if not, then determine that the reporting time of the current fault and the associated fault does not fall within the associated time window.

[0167] That is, the calculated ΔTreport is compared with the window length W of the association time window configured by the root cause association rule: if ΔTreport≤W, it is determined that the reporting time of the current fault and the associated fault both fall within the association time window; if ΔTreport>W, it is determined that the two do not fall within the same valid window range and do not constitute a credible causal relationship.

[0168] For example, suppose the current fault is "Service X of network element A is abnormal", and the reporting time is 10:00:05; the associated fault is "Service Y of network element B is interrupted", and the reporting time is 10:00:12; the matching root cause association rule is "(A,X) Service X is abnormal → (B,Y) Service Y is interrupted", and the corresponding association time window length is 10 seconds. Then the reporting time difference ΔTreport=7s<10s, and the two fall into the same association time window, so a root cause association can be established.

[0169] For fault pairs verified through the aforementioned associated time window, a root cause association between the current fault and associated faults is established based on the causal direction defined in the root cause association rule they match. For example, if the rule is defined as "Fault A causes Fault B", and the associated time window constraint is satisfied, then a root cause association of "A→B" is established. This root cause association can further include contextual information such as fault type, network element-service combination, reporting time, and matching rule ID.

[0170] It's important to understand that in real-world network environments, different business systems or network elements have varying fault detection mechanisms and reporting cycles. This can lead to the actual reporting time of a resulting fault being earlier than its corresponding causal fault, resulting in a "result reported first, cause reported later" phenomenon in the fault timeline. For example, "server downtime" (result) might be reported at 10:00:05, while the "power module failure" (cause) that caused the problem might not be reported until 10:00:12. In this situation, relying solely on the reporting order of faults in the timeline to determine the causal direction will fail to correctly identify the true root cause and may even lead to a misjudgment of the causal relationship. Compared to the traditional method of root cause analysis based on the order of fault reporting in the fault sequence, the establishment of root cause association in this embodiment does not depend on the absolute order of fault reporting. Instead, it is based on the reasonableness verification of preset causal rules and time windows. As long as the time difference between the reporting of two faults falls within the association time window specified by the matching rule, they can be considered to be within the same causal propagation cycle and have the conditions to establish an association. Therefore, even if the result fault is reported before the cause fault, as long as the time constraint is met, the "cause → result" root cause association is still established in the direction defined by the rule, thereby accurately restoring the real fault propagation path. This effectively overcomes the problem of time sequence misalignment caused by real-world factors such as inconsistent monitoring granularity and reporting delays, and achieves robust identification of causal relationships in complex operation and maintenance scenarios, improving the accuracy and practicality of root cause analysis.

[0171] Furthermore, the newly established root cause association between the current fault and the associated fault is temporarily cached in a cache list, rather than being immediately fixed to the final result. The cache list is used to temporarily store causal relationship records during the analysis process, supporting dynamic updates and rollback operations, so as to support the retention of intermediate states in multiple rounds of root cause association processes and prevent the misuse of intermediate results that have not been attributed.

[0172] When it is determined that the current fault is no longer involved in root cause correlation, a result persistence operation is triggered: all root cause correlations including the current fault in the cached linked list are migrated to the result linked list, and persistently stored as a complete and reliable set of causal chains. This result linked list not only records the causal propagation paths between historical faults, but also, during fault repair, can locate the root cause of the fault based on the root cause correlations in the result linked list, and guide the generation or execution of repair strategies. For example, in fault tracing, the original root cause fault can be quickly located by querying the result linked list during a certain service recovery phase; in repair strategy generation, a repair order can be automatically recommended based on known causal chains (e.g., resolving power issues first, then restarting the service). The root cause correlations in the result linked list can also be used to accumulate fault propagation patterns in real networks to feed back into the optimization of the root cause correlation rule base. Furthermore, the result linked list can also serve as a training data source for machine learning models, used to dynamically predict possible future cascading faults.

[0173] In this embodiment, a fine-grained context-aware dynamic correlation timeliness window configuration method is provided. This transforms the timeliness constraint of root cause correlation from a globally fixed time window to a differentiated configuration based on network element-service combinations. Specifically, for each root cause correlation rule, a dedicated correlation timeliness window is defined based on the network element-service context of the two faults involved. This avoids alarm omissions or false correlations caused by fixed windows, significantly improving the accuracy of root cause analysis. This correlation timeliness window serves as a criterion for the time reasonableness of establishing causal relationships, ensuring that root cause correlations are only allowed to be constructed under reasonable propagation delays. This constructs a directional hierarchical causal chain, achieving accurate reconstruction of fault propagation paths in complex heterogeneous environments. Furthermore, this embodiment does not rely on the fault reporting order; instead, it allows the establishment of causal relationships as long as the time difference between two fault reports is within a reasonable window. This effectively addresses the reality of "results reported first, causes reported later," enhancing root cause correlation capabilities in situations such as alarm reporting delays and reverse order caused by monitoring heterogeneity. In addition, when adding or changing network element-service combination / root cause association rules, only the corresponding association time window parameters need to be updated, which does not affect the overall architecture and facilitates operation and maintenance and automated management.

[0174] To enable those skilled in the art to better understand the fault root cause association method provided in this application, this embodiment provides an exemplary description of the implementation process of the fault root cause association method based on examples of root cause association maps and fault timing.

[0175] See Figure 2A An example root cause correlation graph is shown, where each node represents a fault that occurs on a specific network element and belongs to a specific service. The relationship between nodes represents a root cause correlation rule and is used to describe the causal relationship between the faults represented by two nodes.

[0176] by Figure 2A For example, see the root cause association rule shown. Figure 2B The process of performing multi-round root cause correlation on the fault sequence is shown below:

[0177] (a) First-round root cause association

[0178] Assuming the root cause correlation for the fault sequence is first triggered at time t1, the fault sequence at this time is as follows: Figure 2B The fault sequence S1 shown includes reported faults A1, A2, A3, and A4, all of which are confirmed to participate in the current root cause association. To accommodate changes in the fault sequence where faults no longer participate in the current and subsequent root cause associations, the faults confirmed to participate in the current root cause association can be written into the fault list alarmList in the order of the fault sequence. By traversing each fault in the fault list and considering the node connection relationships in the root cause association graph, we can obtain:

[0179] The current fault is A1, and the associated fault is A3. Both fall into the associated time limit window W13.

[0180] The current fault is A2, and a related fault A4 is found; both fall into the related time limit window W24.

[0181] The current fault is A3, and the associated fault is A1; both fall into the associated time limit window W13.

[0182] The current fault is A4, and the associated fault is A2; both fall into the associated time limit window W24.

[0183] Therefore, the root cause associations established in this round of root cause analysis are: A1→A3, A2→A4. At this point, the root cause association results are temporarily stored in the cache list.

[0184] (ii) Second round of root cause association

[0185] Assume that a second root cause correlation for the fault sequence is triggered at time t2. The fault sequence at this time is as follows: Figure 2B The fault sequence S2 shown includes reported faults A1, A2, A3, A4, A5, A6, and A7. Before performing the second root cause association, the first reported fault A5 after the latest reported fault A4 in the previous round of root cause association processing in the fault chain can be used as the anchor fault. Based on the reporting time difference between faults A1, A2, A3, and A4 and the anchor fault, it is determined whether faults A1, A2, A3, and A4 participate in the second round of root cause association: if they participate, the fault is retained in the fault chain; if they do not participate, the fault is removed from the fault chain, and the root cause association involving the fault is migrated from the cache chain to the result chain.

[0186] As shown in the figure, assuming that A1 no longer participates in root cause association at time t2, while A2, A3, and A4 continue to participate, the root cause association A1→A3 in the cache list will be moved to the result list, and the root cause associations in the cache list that are not related to A1 will remain unchanged.

[0187] At time t2, the faults that need to participate in root cause association include A2-A7. Therefore, by traversing A2-A7 in the fault time sequence S2 and based on the node connection relationships in the root cause association graph, we can obtain:

[0188] For current fault A2, related faults A4 and A7 are found. A2 and A4 fall within the associated time-limit window W24; A2 and A7 do not fall within the associated time-limit window W27.

[0189] The current fault is A3. Related faults A5 and A6 are found. A3 and A5 fall into the associated time-limit window W35; A3 and A6 do not fall into the associated time-limit window W36.

[0190] The current fault is A4, and the associated fault is A2. Both fall into the associated time limit window W24.

[0191] The current fault is A5, and the associated fault is A3. Both fall into the associated time limit window W35.

[0192] The current fault is A6, and the associated fault is A3. Both fall into the associated time limit window W36.

[0193] No associated fault was found for current fault A7;

[0194] Therefore, the root cause associations established in this round of root cause analysis are: A2→A4, A3→A5, A3→A6, updating the cache linked list. For A2 and A7, even though root cause association rules are defined in the graph, the root cause association for A2 and A7 is rejected because the reporting time difference between A2 and A7 in the fault sequence does not meet the association time window constraint configured for the root cause association rules matching A2 and A7.

[0195] (III) Third round of root cause association

[0196] Assume that the third root cause correlation for the fault sequence is triggered at time t3. The fault sequence at this time is as follows: Figure 2B The fault timing sequence S3 shown includes reported faults A1, A2, A3, A4, A5, A6, A7, A11, and A9.

[0197] Before performing the third root cause association, the first fault A11 reported after the latest reported fault A7 in the fault sequence S2 of the previous round of root cause association processing in the fault chain can be used as the anchor fault. Based on the reporting time difference between faults A2-A7 and the anchor fault, it is determined whether faults A2-A7 participate in the third round of root cause association: if they participate, the fault is retained in the fault chain; if they do not participate, the fault is removed from the fault chain, and the root cause associations involving the fault are migrated from the cache chain to the result chain.

[0198] As shown in the figure, assuming that A2 no longer participates in root cause association at time t3, while A3-A7 continue to participate, the root cause association A2→A4 in the cache list is moved to the result list, while the root cause associations in the cache list that are unrelated to A2 remain unchanged. At this time, A3 is the root cause of A5 and A6, and in fact, A1 is the root cause of A3. The final association result presented in the result list will be A1 as the root cause of A3, A5, and A6.

[0199] The implementation principle of the third root cause association process is the same as that of the aforementioned root cause association process, and can be implemented according to the same process as described above.

[0200] Corresponding to the aforementioned embodiments of the root cause correlation method, see [link to relevant documentation]. Figure 3As shown, this application also provides an embodiment of a root cause correlation device, the device comprising:

[0201] The timeliness determination module 301 is configured to determine the association timeliness window for each preset root cause association rule, which is a network element-service combination pair consisting of the network element-service combination to which the two faults associated by the root cause association rule belong. The association timeliness window is used to define the timeliness constraint for establishing root cause association between the two faults in the preset root cause association rule corresponding to the network element-service combination pair in the current application scenario. Each root cause association rule is used to define the causal relationship between the two faults associated with it. Each network element-service combination is uniquely determined by a single network element and the single service carried by that network element. The association timeliness windows of at least two different network element-service combination pairs are different from each other.

[0202] The associated fault lookup module 302 is configured to, when determining that the current fault in the fault sequence needs to participate in the current root cause association, traverse all other faults after the current fault in the fault sequence, and if the other faults and the current fault appear together in the same preset root cause association rule, take the other faults as associated faults of the current fault; the fault sequence refers to the ordered sequence of faults reported by each network element in the current application scenario according to the reporting time.

[0203] The root cause association module 303 is configured to, for each associated fault of the current fault, check whether the reporting time of the current fault and the associated fault fall within the association time window of the network element-service combination pair corresponding to the root cause association rule based on the root cause association rule that the associated fault and the current fault coexist. If so, a root cause association is established between the current fault and the associated fault according to the causal relationship defined by the root cause association rule that the associated fault and the current fault coexist. Otherwise, the root cause association between the current fault and the associated fault is refused to be established.

[0204] In some embodiments, the timeliness determination module is configured to:

[0205] The heartbeat cycle acquisition module is configured to acquire the keep-alive heartbeat cycle configured for the network element-service combination to which the two faults belong, when it is determined that at least one service in the network element-service combination to which the fault belongs is configured with a heartbeat mechanism.

[0206] The window determination module is configured to determine the associated time-limited window based on the configured keep-alive heartbeat cycle and a set floating value.

[0207] In some embodiments, the window determination module is configured to:

[0208] When the services in the network element-service combination to which the two faults belong are both configured with heartbeat mechanisms, the larger value is selected from the two keep-alive heartbeat cycles obtained, and the associated time window is further determined based on the larger value of the two keep-alive heartbeat cycles and the set floating value.

[0209] In some embodiments, the timeliness determination module is configured to:

[0210] If the services in the network element-service combination to which the two faults belong are not configured with a heartbeat mechanism or the configured keep-alive heartbeat cycle cannot be obtained, the time window distribution characteristics of the reporting time are determined based on the historical reporting time point data of the two faults associated with the root cause association rule.

[0211] Based on the static time window and its distribution characteristics, the associated time window is determined.

[0212] In some embodiments, the associated fault finding module is configured to: determine that the current fault in the fault time series needs to participate in the current root cause association.

[0213] For each root cause association rule including the current fault, determine the maximum window length from the association time window of the network element-service combination pair corresponding to each root cause association rule;

[0214] Obtain the time difference between the reporting time of the current fault and the reporting time of the anchor fault in the fault time sequence; the anchor fault represents the earliest reported fault among the faults that did not participate in the previous root cause association.

[0215] If the time difference does not exceed the maximum window size, it is determined that the current fault in the fault sequence needs to participate in the current root cause association; otherwise, it is determined that the current fault in the fault sequence will no longer participate in the root cause association.

[0216] In some embodiments, the root cause association module is configured to:

[0217] Obtain the reporting time difference between the current fault and the associated fault, and check whether the reporting time difference is less than or equal to the window length of the associated time window;

[0218] If so, it is determined that the reporting time of the current fault and the associated fault both fall within the associated time window; otherwise, it is determined that the reporting time of the current fault and the associated fault do not fall within the associated time window.

[0219] In some embodiments, the device further includes:

[0220] Cache the root cause association between the current fault and its associated fault in a cache list;

[0221] When it is determined that the current fault is no longer involved in root cause association, all root cause associations of the current fault included in the cache list are stored in the result list, so that the root cause of the fault can be located based on the root cause association relationship in the result list during fault repair, and the generation or execution of repair strategies can be guided.

[0222] In some embodiments, the device further includes:

[0223] The graphing module is configured to construct a root cause association graph from the preset root cause association rules; wherein, the nodes in the root cause association graph represent the faults included in each root cause association rule; the connection between the nodes in the root cause association graph is a directed edge; each directed edge corresponds to a root cause association rule; the direction of the directed edge is determined according to the causal relationship between the two faults defined by the root cause association rule.

[0224] The associated fault finding module is configured to: find the fault represented by the node in the root cause association graph that has a connection relationship with the node where the current fault is located from the faults reported after the current fault in the fault time sequence, and take the found fault as the associated fault of the current fault.

[0225] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0226] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0227] This application also provides an electronic device, the structural schematic diagram of which is shown below. Figure 4 As shown, the electronic device 400 includes at least one processor 401, a memory 402, and a bus 403. At least one processor 401 is electrically connected to the memory 402. The memory 402 is configured to store at least one computer-executable instruction, and the processor 401 is configured to execute the at least one computer-executable instruction to perform the steps of any root cause correlation method provided in any embodiment or optional implementation of this application.

[0228] Furthermore, the processor 401 can be an FPGA (Field-Programmable Gate Array) or other devices with logic processing capabilities, such as an MCU (Microcontroller Unit) or a CPU (Central Processing Unit).

[0229] This application also provides another readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the root cause association methods provided in any embodiment or optional implementation of this application.

[0230] The readable storage media provided in this application include, but are not limited to, any type of disk (including floppy disk, hard disk, optical disk, CD-ROM, and magneto-optical disk), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic cards, or optical cards. In other words, readable storage media include any medium by which a device (e.g., a computer) stores or transmits information in a readable form.

[0231] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0232] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0233] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A root cause correlation method for faults, characterized in that, The method includes: For each preset root cause association rule, a correlation time window is determined for the network element-service combination pair consisting of the network element-service combination to which the two faults associated by the root cause association rule belong. This correlation time window is used to define the time constraint for establishing a root cause association between the two faults in the preset root cause association rule corresponding to the network element-service combination pair in the current application scenario. Each root cause association rule is used to define the causal relationship between the two faults associated with it. Each network element-service combination is uniquely determined by a single network element and the single service carried by that network element. The correlation time windows of at least two different network element-service combination pairs are different from each other. When determining that the current fault needs to participate in the current root cause association in the fault sequence, all other faults after the current fault in the fault sequence are traversed. If the other faults and the current fault appear together in the same preset root cause association rule, the other faults are regarded as the associated faults of the current fault. The fault sequence refers to the ordered sequence of faults reported by each network element in the current application scenario according to the reporting time. For each associated fault of the current fault, based on the root cause association rule that the associated fault and the current fault coexist, check whether the reporting time points of the current fault and the associated fault fall within the association time window of the network element-service combination pair corresponding to the root cause association rule. If so, establish a root cause association between the current fault and the associated fault according to the causal relationship defined by the root cause association rule that the associated fault and the current fault coexist. Otherwise, refuse to establish a root cause association between the current fault and the associated fault.

2. The method according to claim 1, characterized in that, The network element-service combination pair to which the two faults associated by the root cause association rule belong constitutes the time window for determining the association, including: For the network element-service combination to which the two faults belong, when it is determined that the service in at least one network element-service combination to which the fault belongs is configured with a heartbeat mechanism, the configured keep-alive heartbeat cycle of the service is obtained. Based on the configured keep-alive heartbeat cycle and the set floating value, the associated time window is determined.

3. The method according to claim 2, characterized in that, Based on the configured keep-alive heartbeat cycle and the set floating value, the associated time window is determined, including: When the services in the network element-service combination to which the two faults belong are both configured with heartbeat mechanisms, the larger value is selected from the two keep-alive heartbeat cycles obtained, and the associated time window is further determined based on the larger value of the two keep-alive heartbeat cycles and the set floating value.

4. The method according to claim 1 or 2, characterized in that, The network element-service combination pair to which the two faults associated by the root cause association rule belong constitutes the time window for determining the association, including: If the services in the network element-service combination to which the two faults belong are not configured with a heartbeat mechanism, or the keep-alive heartbeat cycle configured for the services cannot be obtained, the time window distribution characteristics of the reporting time are determined based on the historical reporting time point data of the two faults associated with the root cause association rule. Based on the static time window and its distribution characteristics, the associated time window is determined.

5. The method according to claim 1, characterized in that, Determine if the current fault in the fault sequence needs to participate in the current root cause association, including: For each root cause association rule associated with the current fault, determine the maximum window length from the association time window of the network element-service combination pair corresponding to each root cause association rule; Obtain the time difference between the reporting time of the current fault and the reporting time of the anchor fault in the fault time sequence; the anchor fault represents the earliest reported fault among the faults that did not participate in the previous root cause association. If the time difference does not exceed the maximum window size, it is determined that the current fault in the fault sequence needs to participate in the current root cause association; otherwise, it is determined that the current fault in the fault sequence will no longer participate in the root cause association.

6. The method according to claim 1, characterized in that, Check whether the reporting times of the current fault and the associated fault fall within the association timeframe window of the network element-service combination pair corresponding to the root cause association rule, including: Obtain the reporting time difference between the current fault and the associated fault, and check whether the reporting time difference is less than or equal to the window length of the associated time window; If so, it is determined that the reporting time of the current fault and the associated fault both fall within the associated time window; otherwise, it is determined that the reporting time of the current fault and the associated fault do not fall within the associated time window.

7. The method according to claim 1, characterized in that, The method further includes: Cache the root cause association between the current fault and its associated fault in a cache list; When it is determined that the current fault is no longer involved in root cause association, all root cause associations of the current fault included in the cache list are stored in the result list, so that the root cause of the fault can be located based on the root cause association relationship in the result list during fault repair, and the generation or execution of repair strategies can be guided.

8. The method according to claim 1, characterized in that, The method further includes: constructing a root cause association graph from the preset root cause association rules; wherein, the nodes in the root cause association graph represent the faults included in each root cause association rule; the connection relationship between the nodes in the root cause association graph is a directed edge; each directed edge corresponds to a root cause association rule; the direction of the directed edge is determined according to the causal relationship between the two faults defined by the root cause association rule. Find the associated faults of the current fault from the fault timing sequence, including: From the faults reported after the current fault in the fault timeline, find the faults represented by the nodes in the root cause association graph that have a connection relationship with the node where the current fault is located, and take the found faults as the associated faults of the current fault.

9. A root cause correlation device, characterized in that, The device includes: The timeliness determination module is configured to determine the association timeliness window for each preset root cause association rule, which is a network element-service combination pair consisting of the network element-service combination to which the two faults associated by the root cause association rule belong. The association timeliness window is used to define the timeliness constraint for establishing root cause association between the two faults in the preset root cause association rule corresponding to the network element-service combination pair in the current application scenario. Each root cause association rule is used to define the causal relationship between the two faults associated with it. Each network element-service combination is uniquely determined by a single network element and the single service carried by that network element. The association timeliness windows of at least two different network element-service combination pairs are different from each other. The associated fault lookup module is configured to, when determining that the current fault in the fault sequence needs to participate in the current root cause association, traverse all other faults after the current fault in the fault sequence, and if the other faults and the current fault appear together in the same root cause association rule, the other faults are regarded as associated faults of the current fault; the fault sequence refers to the ordered sequence of faults reported by each network element in the current application scenario arranged in time. The root cause association module is configured to, for each associated fault of the current fault, check whether the reporting time of the current fault and the associated fault falls within the association time window of the network element-service combination pair corresponding to the root cause association rule based on the root cause association rule that the associated fault and the current fault coexist. If so, a root cause association is established between the current fault and the associated fault according to the causal relationship defined by the root cause association rule that the associated fault and the current fault coexist. Otherwise, the root cause association between the current fault and the associated fault is rejected.

10. An electronic device, characterized in that, include: Memory, processor; The memory is used to store computer programs; The processor is configured to invoke the computer program to implement the method as described in any one of claims 1-8.

11. A readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8.

Images