Rapid monitoring equipment fault positioning method based on causal diagram reasoning

Abstract

The invention discloses a monitoring equipment fault rapid positioning method based on causal diagram reasoning, and the method comprises the following steps: building a thermal diffusion model composed of equipment nodes and links through collecting the topological structure and operation data of a monitoring system; normalizing and fusing the operation deviation information into a node abnormal energy value, and establishing an abnormal energy propagation equation; when an alarm is triggered, collecting an energy change sequence of each node to generate a space-time energy distribution matrix, and reversely solving a thermal diffusion equation to calculate a disturbance source item; performing clustering backtracking on disturbance source items, determining fault root cause nodes, and comprehensively evaluating confidence; and when multi-source abnormity exists, thermal field orthogonal decomposition is executed, and model parameters are adaptively updated according to field results. According to the method, abnormal propagation of monitoring equipment is modeled into a thermal diffusion process, and reverse solution and adaptive calibration are combined, so that rapid, explainable and high-precision positioning of fault root causes in a complex monitoring network is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly diagnosis, in particular to a monitoring device fault rapid positioning method based on causal diagram reasoning. BACKGROUND

[0002] With the wide application of video monitoring systems in city security, industrial production and traffic management, the system scale is continuously expanding, and the types and connection levels of monitoring devices are becoming increasingly complex. Multiple types of devices such as cameras, switches, storage devices and power supply devices form a multi-level topology structure through network links, with variable running environments and close coupling relationships, which are prone to faults such as code stream interruption, picture loss or device offline in long-time operation.

[0003] Existing fault positioning methods mostly use alarm analysis based on threshold or correlation to discover anomalies by judging whether the running indicators exceed the threshold or calculating the correlation degree between variables. Such methods are simple to implement, but cannot identify the direction relationship of anomaly propagation, are prone to false positives and false negatives, and have limited effect in topology changes or multi-link parallel scenes.

[0004] There are also studies that attempt to use causal diagram models or Bayesian networks to establish causal dependency relationships between devices to infer fault propagation paths. However, such models are usually based on static topology structures and are difficult to describe the dynamic propagation process of anomalies over time and paths in monitoring systems. When there are signal delays and multi-path interference, the inference accuracy and stability significantly decrease.

[0005] Therefore, how to provide a monitoring device fault rapid positioning method based on causal diagram reasoning is a problem that those skilled in the art need to solve. SUMMARY

[0006] One object of the present application is to provide a monitoring device fault rapid positioning method based on causal diagram reasoning. The present application models the anomaly propagation process between monitoring devices as a heat diffusion process and inversely solves the heat diffusion equation set to realize the inverse positioning of fault causes, which can accurately describe the direction and intensity of anomaly propagation on a continuous space-time scale. Through time synchronization, interpolation compensation and adaptive parameter calibration mechanisms, the consistency of multi-node observation data and the dynamic adaptability of the model are ensured, thereby realizing high-precision, interpretable and rapid fault positioning in complex monitoring networks, significantly reducing the amount of manual troubleshooting and the false positive rate.

[0007] According to the monitoring device fault rapid positioning method based on causal diagram reasoning of the present application, the following steps are included:

[0008] Collect the topology connection relationship, communication link and running attribute information of each monitoring device in the monitoring system, construct a monitoring network model composed of device nodes and links, and set corresponding heat diffusion parameters for each device node;

[0009] According to the operation index, state log and performance data collected by the monitoring system, the operation deviation information of each monitoring device is normalized and weighted to map the node abnormal energy value;

[0010] According to the monitoring network topology and the node heat diffusion parameters, a heat diffusion equation set is established to describe the propagation of abnormal energy between nodes, and the energy change of a node is determined by the energy difference of adjacent nodes and the heat dissipation characteristics of the node itself;

[0011] When a monitoring alarm event is detected, the abnormal energy change sequence of each node within the alarm period is collected, time alignment and interpolation compensation are performed, and a spatio-temporal energy distribution matrix of multiple nodes is obtained;

[0012] Based on the spatio-temporal energy distribution matrix, the heat diffusion equation is solved in reverse to calculate the inversion disturbance source term of each node, which is used to represent the probability of each node as a potential fault source;

[0013] According to the spatial adjacency and heat conduction path constraints, the inversion disturbance source term is subjected to cluster analysis, the abnormal propagation path is traced in reverse according to the heat energy propagation direction, and the fault root cause node is determined;

[0014] The thermal potential gradient change rate, energy accumulation rate and time sequence consistency index of each candidate root cause node are calculated, and the confidence of the fault root cause is comprehensively evaluated;

[0015] When there are multiple independent abnormal events, the heat field is subjected to orthogonal decomposition to distinguish different independent heat sources;

[0016] According to the field verification results, the heat diffusion parameters of the device nodes are adaptively updated.

[0017] Further, the construction of the monitoring network model comprises:

[0018] By sampling and structuring the communication topology of cameras, switches, storage servers, power supply units and control terminals in the monitoring system, the physical connection relationship and data transmission channel between devices are mapped into nodes and links;

[0019] During the model generation process, the directed properties of the links are determined according to the data flow and communication control logic, and in the presence of loops, the feedback paths are hierarchically unfolded through topology decomposition.

[0020] Further, the setting of the heat diffusion parameters comprises:

[0021] Node heat capacity: the performance recovery time and fluctuation amplitude during the stable process after the load surge, video interruption or network fluctuation, the combination result of the recovery time and the fluctuation amplitude is mapped into the ability of the node to absorb and buffer abnormal energy, and the node heat capacity is determined.

[0022] Edge heat transfer coefficient: the average delay change rate, data transmission fluctuation and packet loss ratio change trend of the link in the continuous time window, determine the heat transfer strength of the link according to the propagation rate and attenuation characteristics;

[0023] Environmental heat dissipation coefficient: temperature and humidity sensing data and heat dissipation unit working state in the equipment cabinet, evaluate the node self-recovery ability through the temperature gradient decline speed in the abnormal recovery stage, and set the environmental heat dissipation coefficient.

[0024] Further, the mapping process of the node abnormal energy value includes:

[0025] Time synchronization and abnormal data cleaning are performed on the operation indexes, state logs and performance data collected by the monitoring system;

[0026] Numerical features reflecting the working state of the equipment are extracted from the operation indexes, operation events and abnormal alarm information are extracted from the state logs, and resource occupation and response delay features are extracted from the performance data;

[0027] Various features are normalized according to their influence on the running stability of the monitoring equipment, and the comprehensive deviation value is calculated through a preset weighted fusion function;

[0028] The obtained comprehensive deviation value is taken as the abnormal energy value of the corresponding device node, and the weight coefficient in the weighted fusion function is dynamically adjusted according to the correlation strength between various features and actual fault occurrence in historical running samples.

[0029] Further, the establishment process of the heat diffusion equation set includes:

[0030] On the constructed monitoring network model, the abnormal energy value of the device node is taken as the state variable;

[0031] The transfer relationship matrix describing the energy change is established according to the topological connection relationship between nodes and the heat diffusion parameters;

[0032] The energy change of each node is determined by the energy difference of adjacent nodes, the environmental heat dissipation coefficient of the node itself and the external disturbance term;

[0033] In the solving process, constant energy or adiabatic boundary constraint is applied to the boundary node to limit the energy exchange range;

[0034] And through the time stepping discrete way, the equation set is updated by numerical iteration, simulating the time sequence propagation process of abnormal energy in the monitoring network.

[0035] Further, the construction process of the space-time energy distribution matrix of the multiple nodes includes:

[0036] After detecting the monitoring system alarm event, the alarm triggering time and duration interval are determined, and a time window is set with the alarm triggering time as the starting point, the alarm duration period and its buffer before and after the alarm duration period;

[0037] In the time window, the abnormal energy value change sequence of all device nodes is collected according to the preset sampling interval, and the collected results are organized in the form of time steps as rows and device nodes as columns, to preliminarily form a two-dimensional data structure reflecting the energy change of each node over time;

[0038] The clock offset correction and sampling interval resampling processing are performed on the node data through a unified time reference;

[0039] Time interpolation and trend compensation are performed on the nodes with missing data or transmission delay;

[0040] The corrected and compensated data structure is taken as input to generate a multi-node spatiotemporal energy distribution matrix that is continuous and comparable on a unified time scale.

[0041] Further, the process of solving the inversion disturbance source term includes:

[0042] The multi-node spatiotemporal energy distribution matrix is taken as input data, and energy transfer constraints are established according to the topological connection relationship of the monitoring network and the thermal diffusion parameters of each node;

[0043] The disturbance source distribution that can minimize the difference between the model predicted energy and the actual observed energy at each time step is calculated through time reverse iteration, to obtain the inversion disturbance source term corresponding to each node;

[0044] Non-negativity constraints, sparsity constraints and topological connectivity constraints are imposed during the solving process;

[0045] Stability screening is performed on the obtained disturbance source term in the time sequence;

[0046] After obtaining the disturbance source term, the consistency of its occurrence frequency and spatial adjacency distribution in the time dimension is tested;

[0047] The nodes with stable inversion results and continuous occurrence in multiple time slices are selected as high-confidence inversion disturbance source terms.

[0048] Further, the process of determining the fault root cause node includes:

[0049] After obtaining the inversion disturbance source term of each node, the similarity between nodes is calculated based on the spatial adjacency relationship and heat conduction path reachability between nodes;

[0050] Nodes with similarity higher than a threshold and consistent heat conduction direction are grouped into the same candidate heat source cluster;

[0051] For each candidate heat source cluster, backtrack layer by layer according to the reverse heat propagation direction;

[0052] During the backtracking process, paths that form closed loops and edges that reverse energy flow are eliminated;

[0053] To obtain a unidirectional decreasing anomaly propagation chain, the node located at the beginning of the chain, with the highest energy injection intensity and the largest coverage of downstream anomalies, is identified as the root cause node of the failure.

[0054] Furthermore, the confidence assessment of the root cause of the failure includes:

[0055] For each candidate root cause node, calculate the rate of change of thermal potential gradient, the slope of energy accumulation curve, and the time correlation coefficient with the energy change of downstream nodes within the alarm time window.

[0056] After normalization, the above indicators are comprehensively scored according to preset weights. The comprehensive score reflects the explanatory strength of the node for the overall anomaly propagation.

[0057] When multiple abnormal propagation paths are detected, an energy correlation matrix is ​​constructed based on the spatial overlap and energy coupling degree of the node sets corresponding to each path.

[0058] By performing orthogonalization on the energy correlation matrix, the thermal field components corresponding to different sources are made energy-independent.

[0059] The corresponding independent anomalous events are determined based on the energy center location and propagation direction of each independent thermal field component.

[0060] When multiple candidate nodes have similar scores, path coverage and the frequency of stable node occurrence are used as weighted adjustment terms to determine the node with the highest confidence as the final root cause of the failure.

[0061] Furthermore, the adaptive update includes:

[0062] After performing on-site verification or maintenance intervention, collect the changing trends of abnormal energy of each node in the monitoring network before and after the verification operation and the results of fault recovery.

[0063] Based on the difference between the abnormal energy drop magnitude and the model prediction deviation in the verification results, the heat capacity, environmental heat dissipation coefficient and thermal conductivity of the corresponding node and the adjacent link are locally corrected.

[0064] After the correction is completed, the stability of the model output difference before and after the update is verified.

[0065] The update is confirmed to be effective only if the verification result meets the set consistency conditions.

[0066] The beneficial effects of this invention are:

[0067] The application models the abnormal transmission process between monitoring devices as a heat diffusion process, describes the fault propagation in the form of heat conduction in the network, realizes the transition from discrete correlation analysis to continuous physical modeling, and can accurately reflect the directionality and timing of abnormal propagation.

[0068] By inversely solving the heat diffusion equation set, calculating the disturbance source term of each node, and combining spatial clustering and path backtracking, the reversible mapping from abnormal observation to root cause inversion is realized, and the explainability and credibility of fault location are improved.

[0069] The time synchronization and interpolation compensation mechanism is adopted to ensure the consistency of multi-node observation data, and adaptive calibration is introduced in the parameter updating link, so that the model can be dynamically adjusted with the running state of the device, environmental conditions and topology changes, significantly improving the applicability in complex monitoring networks.

[0070] By screening candidate heat sources at the energy distribution level and determining the final root cause with a confidence score, minute-level fault location can be achieved without human intervention, reducing the amount of manual investigation and reducing the misjudgment rate. BRIEF DESCRIPTION OF DRAWINGS

[0071] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, together with the embodiments of the application, to explain the application, and do not constitute a limitation on the application. In the drawings:

[0072] Figure 1 A flowchart of a monitoring device fault rapid positioning method based on causal graph reasoning proposed by the application;

[0073] Figure 2 An abnormal energy mapping and space-time energy distribution matrix generation diagram of a monitoring device fault rapid positioning method based on causal graph reasoning proposed by the application;

[0074] Figure 3 A reverse solution and candidate source screening diagram of a monitoring device fault rapid positioning method based on causal graph reasoning proposed by the application;

[0075] Figure 4 A clustering backtracking confidence evaluation and adaptive update diagram of a monitoring device fault rapid positioning method based on causal graph reasoning proposed by the application. DETAILED DESCRIPTION

[0076] The application will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams that only schematically illustrate the basic structure of the application, and therefore only show the components related to the application.

[0077] REFERENCE Figures 1-4A monitoring device fault rapid positioning method based on causal diagram reasoning, comprising the following steps:

[0078] Collecting the topological connection relationship, communication link and running attribute information of each monitoring device in the monitoring system, constructing a monitoring network model composed of device nodes and links, and setting corresponding heat diffusion parameters for each device node;

[0079] According to the running index, state log and performance data collected by the monitoring system, the running deviation information of each monitoring device is normalized and weighted and fused to map the node abnormal energy value;

[0080] According to the monitoring network topology and node heat diffusion parameters, a heat diffusion equation set is established to describe the propagation of abnormal energy between nodes, and the energy change of a node is determined by the energy difference of adjacent nodes and its own heat dissipation characteristics;

[0081] When detecting a monitoring alarm event, the abnormal energy change sequence of each node within the alarm period is collected, time alignment and interpolation compensation are performed, and a spatiotemporal energy distribution matrix of multiple nodes is obtained;

[0082] Based on the spatiotemporal energy distribution matrix, the heat diffusion equation is inversely solved to calculate the inversion disturbance source term of each node, which is used to represent the probability of each node as a potential fault source;

[0083] According to the spatial adjacency and heat conduction path constraints, the inversion disturbance source term is subjected to cluster analysis, the abnormal propagation path is traced in reverse according to the heat energy propagation direction, and the fault root cause node is determined;

[0084] The heat potential gradient change rate, energy accumulation rate and time sequence consistency index of each candidate root cause node are calculated, and the confidence of the fault root cause is comprehensively evaluated;

[0085] When there are multiple independent abnormal events, the heat field is subjected to orthogonal decomposition to distinguish different independent heat sources;

[0086] According to the field verification result, the heat diffusion parameters of the device nodes are adaptively updated.

[0087] In the embodiment, the construction of the monitoring network model comprises:

[0088] Through data sampling and structure extraction of the communication topology of cameras, switches, storage servers, power supply units and control terminals in the monitoring system, by reading the device port connection table, forwarding table and link state information, the collected data is aligned according to the time stamp, and the multi-source topology record is integrated by using the conflict priority rule, the repeated and invalid link information is removed, and the physical connection relationship and data transmission channel between devices are mapped into nodes and links;

[0089] In the model generation process, the directed properties of the link are determined according to the data flow and communication control logic, the transmission direction from the data initiation end to the convergence end is the main direction, the direction consistency is checked in combination with the access control rule and the routing strategy, and in the presence of a loop, the feedback path is expanded in layers through topology decomposition, the feedback edge is mapped to the upper layer subgraph in a hierarchical expansion manner, and the original node association relationship is maintained, so as to avoid the propagation path ambiguity caused by the circular dependency.

[0090] In the embodiment, the setting of the heat diffusion parameter includes:

[0091] Node heat capacity: The performance recovery time and fluctuation amplitude of the device after load surge, video interruption or network fluctuation in the stable process, the recovery interval is labeled under the unified time reference, the data during maintenance / configuration change and isolated abnormal points are removed, the combination results of the recovery time and the fluctuation amplitude are counted in the fixed sampling interval with the sliding window, and the deviation degree of the combination results from the device baseline state is established one-to-one correspondence, the combination results of the recovery time and the fluctuation amplitude are mapped as the ability of the node to absorb and buffer abnormal energy, and the node heat capacity is determined;

[0092] Edge heat conduction coefficient: The average delay change rate, data transmission amount fluctuation and packet loss ratio change trend of the link in the continuous time window, which are respectively counted and aligned with the actual forwarding table effective path, the missing samples are forward filled and the burst jitter is median smoothed, a reduction factor is applied to the propagation rate in combination with the bandwidth shaping / speed limiting / congestion avoidance strategy, and the link heat conduction strength is determined according to the propagation rate and the attenuation characteristic;

[0093] Environmental heat dissipation coefficient: The temperature and humidity sensing data and heat dissipation unit working state in the device cabinet, the abnormal recovery stage is jointly defined by the fault clearing mark and the abnormal energy backfall detection, the stable descending segment is extracted according to the temperature difference sequence of adjacent sampling points, the descending speed is corrected in combination with the air duct openness and the heat dissipation unit speed state, the node self-recovery ability is evaluated through the temperature gradient descending speed in the abnormal recovery stage, and the environmental heat dissipation coefficient is set;

[0094] The above parameters are periodically re-evaluated according to the sliding time window during operation, and the consistency check of the model output before and after parameter update is used to take effect.

[0095] In the embodiment, the mapping process of the node abnormal energy value includes:

[0096] The running indicators, state logs and performance data collected by the monitoring system are time-synchronized and abnormal data cleaned, the time stamps of each data source are aligned under the unified time server, the repeated or overdue records are deleted, the sliding window mean replacement is used for the burst peak, the linear interpolation is performed for the missing samples, and the input data is ensured to be continuous on the time axis;

[0097] The numerical features reflecting the working state of the equipment are extracted from the operation indicators, the operation events and abnormal alarm information are extracted from the state logs, the resource occupation and response delay features are extracted from the performance data, and type consistency check and field standardization are performed before data fusion to ensure the compatibility of data from different sources;

[0098] The various features are normalized according to their influence on the running stability of the monitoring equipment, the normalization adopts the interval mapping combined with the percentile amplitude limiting, and the comprehensive deviation value is calculated through the preset weighted fusion function;

[0099] The obtained comprehensive deviation value is taken as the abnormal energy value of the corresponding equipment node, and the weight coefficient in the weighted fusion function is dynamically adjusted according to the correlation strength between the various features in the historical running samples and the actual fault occurrence.

[0100] In the embodiment, the establishment process of the heat diffusion equation set includes:

[0101] On the constructed monitoring network model, the abnormal energy values of the equipment nodes are taken as state variables, the abnormal energy values of each node at continuous sampling time are organized into time sequence vectors, and the corresponding energy update indexes are marked in the node attribute table;

[0102] The transfer relationship matrix describing the energy change is established according to the topological connection relationship between the nodes and the heat diffusion parameters, the energy transfer coefficient matrix is generated and normalized by reading the heat conductivity, node heat capacity and heat dissipation coefficient recorded in the adjacency matrix and parameter table, and the sum of the matrix rows is ensured to be 1;

[0103] The energy change of each node is determined by the energy difference of adjacent nodes, the environmental heat dissipation coefficient of the node itself and the external disturbance term, the energy difference of adjacent nodes is distinguished into incoming and outgoing components according to the link direction, the environmental heat dissipation term is automatically updated according to the device heat sensor data, and the external disturbance term is estimated by the environmental temperature and humidity fluctuation and power voltage deviation monitored by the system;

[0104] In the solving process, the constant energy or adiabatic boundary constraint is applied to the boundary node to limit the energy exchange range, the constant energy condition is used for the node communicating with the external system to maintain the boundary energy balance, the adiabatic condition is used for the non-interconnected boundary to block the energy leakage, and the boundary node energy state is locked by the constraint matrix when the model is solved;

[0105] And the equation set is updated by numerical iteration in a time-stepping discrete manner to simulate the time sequence propagation process of abnormal energy in the monitoring network, after completing the global energy distribution calculation at each time step, the nodes with energy change rate exceeding the threshold value are locally recalculated to prevent numerical oscillation, and the time sequence energy distribution result is output after the iteration converges.

[0106] In the embodiment, the construction process of the multi-node space-time energy distribution matrix comprises:

[0107] After detecting the monitoring system alarm event, the alarm triggering time and duration interval are determined, a time window is set with the alarm triggering time as the starting point, the alarm duration period and the buffer before and after the alarm duration period, the alarm triggering record and event duration are read from the log server, the alarm start and end points are determined in combination with the device heartbeat data, and the time window range is automatically expanded according to the front and rear buffer ratios set in the configuration file;

[0108] Within the time window, the abnormal energy value change sequence of all device nodes is collected according to the preset sampling interval, and the collection result is organized in the form of time step as row and device node as column, to preliminarily form a two-dimensional data structure reflecting the energy change of each node with time;

[0109] The clock offset correction and sampling interval resampling processing of each node data are performed through a unified time reference, the global NTP time source or the master server timestamp is used to align the sampling records of different nodes, linear resampling is performed on the nodes with inconsistent sampling frequencies, and the time step length of the energy sequence is kept consistent;

[0110] Time interpolation and trend compensation are performed on the nodes with missing data or transmission delay. The energy change trend of adjacent time points is used for forward or bidirectional interpolation, the delayed samples are time compensated and reordered according to the network delay log, and the continuity and time alignment accuracy of the energy curves of each node are ensured;

[0111] The corrected and compensated data structure is taken as input to generate a multi-node space-time energy distribution matrix that is continuous and comparable on a unified time scale, wherein the rows of the matrix correspond to time steps, the columns correspond to device nodes, and the matrix elements are the abnormal energy values of the nodes at the time step. After generating the matrix, the system performs standardization and missing rate checking.

[0112] In the embodiment, the process of solving the inverse disturbance source term comprises:

[0113] Taking the multi-node space-time energy distribution matrix as input data, the energy transfer constraints are established according to the topological connection relationship of the monitoring network and the thermal diffusion parameters of each node, the node energy state at each time step is extracted from the energy matrix, and the energy transfer operator is constructed in combination with the topological adjacency matrix and the heat conduction parameter table, to ensure that the energy change of each node is constrained by adjacent nodes and heat dissipation terms;

[0114] The disturbance source distribution capable of minimizing the difference between the model predicted energy and the actual observed energy at each time step is calculated by time reverse iteration to obtain the corresponding inversion disturbance source term of each node, and a step back strategy is adopted in the reverse integration process, the time steps are iterated in reverse order from the alarm termination time, and the energy transfer residual is calculated at each step and the most likely source term distribution is determined by the least square criterion;

[0115] Non-negativity constraint is applied to the disturbance source distribution in the solving process to ensure its physical reasonableness, sparsity constraint is applied to the spatial distribution to highlight the main energy injection point, and structure constraint is applied to the topological connectivity to avoid misjudgment of isolated nodes as source points, and each constraint condition is realized by introducing a penalty factor, wherein the sparsity penalty is dynamically adjusted based on the node energy contribution ranking, and the topological connectivity constraint is automatically determined according to the link reachable matrix;

[0116] The obtained disturbance source term is subjected to stability screening in the time sequence;

[0117] After obtaining the disturbance source term, the consistency of its occurrence frequency in the time dimension and the spatial adjacent distribution is verified;

[0118] The nodes which are stable in the inversion result and continuously appear in multiple time slices are screened out as the inversion disturbance source term with high confidence.

[0119] In the embodiment, the determination process of the fault root cause node includes:

[0120] After obtaining the inversion disturbance source term of each node, the similarity between nodes is calculated based on the spatial adjacency relationship and the heat conduction path reachability between nodes, the distance weight between nodes is generated according to the topological adjacency matrix and the geographical position information, and the similarity index is calculated by comprehensively considering the energy similarity and the heat conduction coefficient to determine the spatial proximity of the source term distribution;

[0121] Nodes with similarity higher than a threshold and consistent heat conduction direction are classified into the same candidate heat source cluster, a density clustering strategy is adopted, adjacent node sets are recursively merged according to the similarity threshold, and the average energy and heat conduction direction vector within the cluster are updated after each merging;

[0122] For each candidate heat source cluster, the reverse heat conduction direction of heat energy propagation is traced layer by layer, starting from the node with the highest energy in the cluster, and the adjacent node path is traversed in the reverse direction along the heat conduction direction, the energy attenuation rate and time correlation are calculated for each path, and only the paths satisfying the monotonic decay condition are retained;

[0123] In the backtracking process, the paths forming closed loops and the edges with reverse energy flow are removed, the loop nodes are detected by a path duplicate detection algorithm, the repeated nodes are pruned, and the edges with heat conduction direction opposite to the sign of the change of the propagated energy are shielded;

[0124] To obtain a unidirectional decreasing abnormal propagation chain, and determine a node located at a starting position of the chain, having a highest energy injection intensity and a largest abnormal coverage to downstream nodes as a fault root cause node, and record a node sequence and an energy transfer weight of each propagation chain in an output result, to provide a basis for subsequent confidence assessment.

[0125] In the embodiment, the confidence assessment of the fault root cause includes:

[0126] The heat potential gradient change rate, the energy accumulation curve slope and the time correlation coefficient of the energy change of the downstream nodes are calculated for each candidate root cause node, the energy gradient of each node at adjacent time steps is calculated according to the energy matrix, and the average change rate is obtained, the cumulative energy curve is extracted, and the slope parameter is obtained through linear fitting, and the Pearson correlation analysis is performed on the energy sequence of the downstream nodes to quantify the time consistency;

[0127] The above indexes are normalized and scored according to a preset weight, and the comprehensive score reflects the explanation strength of the node to the overall abnormal propagation, and the weight value is determined by the index contribution rate in the historical verification sample, and is dynamically corrected according to the error distribution of the window in the running process;

[0128] In the case of detecting multiple abnormal propagation paths, an energy correlation matrix is constructed according to the spatial overlap and energy coupling degree of the node set corresponding to each path, the confidence score of the node with frequent appearance and wide coverage is improved by comparing the appearance times of each node in the inversion result and the propagation chain;

[0129] The energy correlation matrix is orthogonally processed, so that the heat field components corresponding to different sources are independent in energy, the energy proportion and the time sequence overlap coefficient of the node intersection between each candidate path are calculated, and the element values of the energy correlation matrix are formed;

[0130] The energy center position and the propagation direction of each independent heat field component are determined to determine the corresponding independent abnormal event;

[0131] When there are multiple candidate nodes with close scores, the path coverage and the stable appearance frequency of the node are used as weighted correction terms to determine the node with the highest confidence as the final fault root cause.

[0132] In the embodiment, the adaptive updating includes:

[0133] After performing the on-site verification or operation intervention, the change trend of the abnormal energy of each node in the monitoring network before and after the verification operation and the fault recovery result are collected, the operation log and the energy matrix difference of the corresponding time period are recorded, and the energy change amount of the node before and after the intervention is used as a parameter update input sample;

[0134] According to the difference between the abnormal energy drop amplitude in the verification result and the model prediction deviation, the heat capacity of the corresponding node, the environmental heat dissipation coefficient and the thermal conductivity of the adjacent link are locally corrected, the average absolute error of the model prediction energy and the measured energy is calculated, the heat capacity coefficient of the node whose error exceeds the threshold is locally adjusted, and the thermal conductivity coefficient is adjusted when the error distribution is concentrated at both ends of the link;

[0135] After the correction is completed, the stability of the difference between the model outputs before and after the update is verified, the energy change trend of the model output is compared in the last N time windows, when the volatility rate is reduced and the prediction error converges, it is determined that the update is effective, otherwise it is rolled back to the last parameter state;

[0136] Only when the verification result meets the set consistency condition, the update is confirmed to take effect, the effective parameter version and the corresponding time stamp are recorded into the parameter history table, which is used for subsequent backtracking analysis and model iterative training, so as to realize the continuous self-adaptive calibration of the heat diffusion parameters in the monitoring network and the closed-loop optimization of the model.

[0137] Embodiment 1:

[0138] In order to verify the feasibility of the application in implementation, the application is applied to a typical monitoring network of a video monitoring center as an experimental object for verification. The network is composed of 60 front-end cameras, 6 access switches, 2 convergence switches, 1 video storage server and 2 power supply units, forming a multi-level directed topology structure. All devices are interconnected through gigabit Ethernet, the network bandwidth is about 1Gbps, and the average link delay is 2.1ms.

[0139] The system collects the communication relationship and link attribute of each device through SNMP, Syslog and port scanning. According to the data flow direction, the directed attribute of the link is determined, the detected loop is decomposed by topology, and the feedback path is split into a hierarchical expansion subgraph.

[0140] Table 1 Heat diffusion parameter table

[0141] Parameter type Data source Typical value Technical meaning Node heat capacity Video recovery time + frame rate fluctuation 45s / ±8% Device's ability to absorb and buffer abnormal energy Thermal conductivity Bandwidth utilization + latency + packet loss rate 0.78 (normalized) Abnormal energy propagation rate Heat dissipation coefficient Environmental temperature and humidity + fan speed 0.65 (normalized) Device self-recovery ability

[0142] The above parameters are dynamically updated in the system running process according to the sliding time window, when the change of environmental temperature, link load or node state is detected, the parameter re-evaluation is triggered.

[0143] The system collects the frame rate, packet loss rate, power, current, CPU occupancy, memory occupancy and system log records of each device with a sampling period of 30s. After time synchronization, noise elimination and linear interpolation, the sampling data is normalized according to the unified dimension and the weight is allocated according to the influence of the characteristics on the stability of the device. The frame rate deviation weight is 0.4, the time delay fluctuation weight is 0.35, and the CPU occupancy weight is 0.25. The node abnormal energy value is generated after weighted fusion. In the experiment, the abnormal energy value of access switch A1 reaches 0.82 (normalized scale), which is significantly higher than the normal threshold value 0.25, and is determined as the energy injection node.

[0144] The node abnormal energy value is taken as the state variable, and the energy transfer equation set is established according to the topological connection relationship and the heat diffusion parameter. The energy change of each node is determined by the energy difference of adjacent nodes, the heat dissipation characteristics of itself and the external disturbance term. The constant energy boundary constraint is applied to the nodes connected to the external system, and the adiabatic boundary condition is applied to the isolated nodes.

[0145] Time step 5s is used for discrete iteration to simulate the propagation of abnormal energy in the network. The results show that the abnormal energy propagates from switch A1 to sink node B1 within 30s, and spreads along the upstream camera branch.

[0146] When the "video loss" alarm is detected, the system sets a time window with a center of the alarm triggering time and a buffer of 60s before and after. The abnormal energy change sequence of all nodes is collected in this time window, with a uniform sampling interval of 5s, and the sampling time is aligned using the master clock.

[0147] Linear interpolation is performed on the missing samples, and time compensation is performed on the delayed data to generate a space-time energy distribution matrix with a size of 24x71. The matrix row represents the time step, the list represents the device node, and the matrix unit is the abnormal energy value of the node at the time step. After standardization and missing rate verification, the matrix is input to the inverse solving module.

[0148] Taking the space-time energy matrix as the input, the time steps are iterated in reverse order from the alarm termination time, and the energy transfer residual of each step is minimized. Non-negativity, sparsity and topological connectivity constraints are added to avoid false source points.

[0149] The results show that node A1 continuously appears as a high-intensity disturbance source item in multiple time steps, and its energy stability score is 0.93, which is determined as the main candidate source node. After sliding window screening, the node set with a stable energy contribution rate of more than 80% is retained.

[0150] Based on the spatial proximity and heat conduction path accessibility, the similarity of nodes is calculated, and hierarchical clustering is used to classify nodes with high similarity into the same heat source cluster. The energy propagation path is traced back along the reverse heat conduction direction for each cluster, and the closed loop and energy flow reverse edge are removed.

[0151] Two main propagation chains are finally obtained:

[0152] Path 1: A1→A2→camera C12;

[0153] Path 2: A1→B1→server S1.

[0154] Among them, path 1 covers the most downstream abnormal nodes and has the lowest energy attenuation rate, and is determined as the main propagation path.

[0155] For the candidate root cause nodes A1, A2 and B1, the heat potential gradient change rate, energy accumulation slope and time correlation coefficient are calculated, and then the scores are integrated after normalization. The integrated score of A1 node is 0.91, which is the highest, and A1 node is confirmed as the root cause of the fault. Through orthogonal decomposition of the energy correlation matrix, another independent heat source from the branch of camera C45 is detected, and it is determined as a secondary abnormal event.

[0156] On-site maintenance confirms that the power module of A1 switch is abnormal, and after replacement, the energy distribution of the system returns to normal. According to the energy change amount before and after, the heat capacity of A1 node is reduced by 12%, and the thermal conductivity coefficient is improved by 5%, and the parameter version number and timestamp are recorded. The prediction error of the updated model in subsequent operation is reduced from 0.23 to 0.08.

[0157] Table 2 experimental results

[0158] Experimental group Method description Fault location time (min) Accuracy (%) Misjudgment rate (%) Comparison group Based on alarm log correlation analysis 20.5 76.2 18.5 The method of the invention Based on causal path heat diffusion inversion 2.1 95.4 4.3

[0159] As can be seen from Table 2, the positioning speed of the method of the present application is improved by about 9.8 times, and the accuracy is improved by 19.2 percentage points under the same hardware and data environment, which is significantly better than the traditional alarm positioning method based on log association.

[0160] The embodiment fully verifies the practical availability and robustness of the method of the present application in a complex monitoring network. The method can quickly determine the root cause node in the case of multiple concurrent alarms and complex link topology, and maintain long-term stable diagnostic performance through adaptive update of heat diffusion parameters, which has significant engineering promotion value.

[0161] The above describes only the preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can make equivalent substitutions or changes to the technical solutions and inventive concepts of the present application within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1. A method for fast locating device fault based on causal graph reasoning, characterized in that, Includes the following steps: Collect the topology connection relationship, communication link and operation attribute information of each monitoring device in the monitoring system, construct a monitoring network model composed of device nodes and links, and set corresponding heat dissipation parameters for each device node; Based on the operational indicators, status logs, and performance data collected by the monitoring system, the operational deviation information of each monitoring device is normalized and weighted and mapped into node abnormal energy values. Based on the monitoring network topology and node thermal diffusion parameters, a set of thermal diffusion equations describing the propagation of abnormal energy between nodes is established. The change in node energy is determined by the energy difference between adjacent nodes and its own heat dissipation characteristics. When a monitoring alarm event is detected, the abnormal energy change sequence of each node during the alarm period is collected, and time alignment and interpolation compensation are performed to obtain the spatiotemporal energy distribution matrix of multiple nodes. Based on the spatiotemporal energy distribution matrix, the heat diffusion equation is solved in reverse to calculate the inversion perturbation source terms for each node; Based on spatial adjacency and heat conduction path constraints, cluster analysis is performed on the inverted disturbance source terms, and the abnormal propagation path is traced in reverse according to the direction of heat propagation to determine the root cause node of the fault. Calculate the rate of change of thermal potential gradient, energy accumulation rate and time series consistency index for each candidate root cause node, and comprehensively evaluate the confidence of the root cause of the failure. When multiple independent abnormal events exist, the thermal field is orthogonally decomposed to distinguish different independent heat sources; The thermal diffusion parameters of the equipment nodes were updated based on the field verification results.

2. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The construction of the monitoring network model includes: By sampling and extracting the communication topology of cameras, switches, storage servers, power supply units and control terminals in the monitoring system, the physical connection relationship between devices and data transmission channels are mapped into nodes and links; During the model generation process, the directional attributes of the links are determined based on the data flow direction and communication control logic, and the feedback paths are layered and expanded through topology decomposition in scenarios where loops exist.

3. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The setting of the thermal diffusion parameters includes: Node thermal capacity: The performance recovery time and fluctuation amplitude of a device after a sudden load surge, video interruption, or network fluctuation. The node thermal capacity is determined by mapping the combination of recovery time and fluctuation amplitude to the node's ability to absorb and buffer abnormal energy. Edge thermal conductivity: The average delay change rate, data transmission volume fluctuation and packet loss ratio change trend of the link within a continuous time window, and the link thermal conductivity is determined based on the propagation rate and attenuation characteristics; Environmental heat dissipation coefficient: Based on the temperature and humidity sensor data and the working status of the heat dissipation unit in the equipment cabinet, the self-recovery capability of the node is evaluated by the temperature gradient descent rate during the abnormal recovery phase, and the environmental heat dissipation coefficient is set.

4. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The mapping process for the abnormal energy values ​​of the nodes includes: Perform time synchronization and abnormal data cleaning on the operational indicators, status logs and performance data collected by the monitoring system; Extract numerical features reflecting the working status of the equipment from the operating indicators, extract operation events and abnormal alarm information from the status log, and extract resource usage and response latency features from the performance data. Various features are normalized according to their impact on the operational stability of monitoring equipment, and the comprehensive deviation value is calculated through a preset weighted fusion function. The obtained comprehensive deviation value is used as the abnormal energy value of the corresponding device node. The weight coefficients in the weighted fusion function are dynamically adjusted according to the correlation strength between various features in the historical operation samples and the actual occurrence of faults.

5. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The process of establishing the thermal diffusion equation set includes: In the completed monitoring network model, the abnormal energy value of the device node is used as the state variable; A transfer relationship matrix describing energy changes is established based on the topological connection relationship between nodes and the thermal diffusion parameters; The energy change of each node is determined by the energy difference between adjacent nodes, the heat dissipation coefficient of the node's own environment, and external disturbance terms. During the solution process, constant energy or adiabatic boundary constraints are applied to the boundary nodes to limit the energy exchange range. The equations are numerically iterated and updated using a time-stepping discrete method to simulate the temporal propagation process of anomalous energy in the monitoring network.

6. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The process of constructing the spatiotemporal energy distribution matrix of the multi-node system includes: After detecting an alarm event in the monitoring system, determine the alarm trigger time and duration interval, and set a time window consisting of the alarm trigger time as the starting point, the alarm duration period and its preceding and following buffers; Within the time window, the abnormal energy value change sequence of all device nodes is collected according to the preset sampling interval, and the collection results are organized in the manner of time step as row and device node as column, so as to initially form a two-dimensional data structure that reflects the change of energy of each node over time. The data of each node is clock offset corrected and the sampling interval is resampled using a unified time base. Perform time interpolation and trend compensation on nodes with missing data or transmission delays; Using the corrected and compensated data structure as input, a continuous and comparable multi-node spatiotemporal energy distribution matrix is ​​generated on a unified time scale.

7. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The process of solving the inversion perturbation source term includes: Using the multi-node spatiotemporal energy distribution matrix as input data, energy transfer constraints are established according to the topological connection relationship of the monitoring network and the thermal diffusion parameters of each node; The perturbation source distribution that minimizes the difference between the model-predicted energy and the actual observed energy at each time step is calculated by time-backward iteration, and the inverted perturbation source terms corresponding to each node are obtained. Nonnegativity constraints, sparsity constraints, and topological connectivity constraints are applied during the solution process. Stability screening is performed on the time series of the obtained disturbance source terms; After obtaining the disturbance source term, we perform a consistency test between its occurrence frequency in the time dimension and its spatial adjacency distribution. Nodes with stable inversion results and that appear continuously across multiple time slices are selected as high-confidence inversion perturbation source terms.

8. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The process of determining the root cause node of the fault includes: After obtaining the inversion perturbation source terms of each node, the similarity between nodes is calculated based on the spatial adjacency relationship and heat conduction path reachability between nodes; Nodes with similarity higher than the threshold and consistent heat conduction direction are grouped into the same candidate heat source cluster. For each candidate heat source cluster, backtrack layer by layer according to the reverse heat propagation direction; During the backtracking process, paths that form closed loops and edges that reverse energy flow are eliminated; To obtain a unidirectional decreasing anomaly propagation chain, the node located at the beginning of the chain, with the highest energy injection intensity and the largest coverage of downstream anomalies, is identified as the root cause node of the failure.

9. The method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The confidence assessment of the root cause of the failure includes: For each candidate root cause node, calculate the rate of change of thermal potential gradient, the slope of energy accumulation curve, and the time correlation coefficient with the energy change of downstream nodes within the alarm time window. After normalization, the above indicators are comprehensively scored according to preset weights. The comprehensive score reflects the explanatory strength of the node for the overall anomaly propagation. When multiple abnormal propagation paths are detected, an energy correlation matrix is ​​constructed based on the spatial overlap and energy coupling degree of the node sets corresponding to each path. By performing orthogonalization on the energy correlation matrix, the thermal field components corresponding to different sources are made energy-independent. The corresponding independent anomalous events are determined based on the energy center location and propagation direction of each independent thermal field component. When multiple candidate nodes have similar scores, path coverage and the frequency of stable node occurrence are used as weighted adjustment terms to determine the node with the highest confidence as the final root cause of the failure.

10. A method for rapid fault location of monitoring equipment based on causal graph reasoning according to claim 1, characterized in that, The adaptive update includes: After performing on-site verification or maintenance intervention, collect the changing trends of abnormal energy of each node in the monitoring network before and after the verification operation and the results of fault recovery. Based on the difference between the abnormal energy drop magnitude and the model prediction deviation in the verification results, the heat capacity, environmental heat dissipation coefficient and thermal conductivity of the corresponding node and the adjacent link are locally corrected. After the correction is completed, the stability of the model output difference before and after the update is verified. The update is confirmed to be effective only if the verification result meets the set consistency conditions.

Images