Internet infrastructure abnormal root cause analysis method, device, equipment and medium

Abstract

The invention provides an Internet infrastructure abnormal root cause analysis method, device and equipment and a medium, and the method comprises the steps: constructing a directed acyclic graph which takes an infrastructure service node as a vertex and takes a dependency relationship between nodes as an edge through a business chain and dependency relationship information based on Internet infrastructure; inputting the historical operation index data of the directed acyclic graph and the nodes of the directed acyclic graph into the graph convolutional network model, determining the influence factors of the operation indexes of the nodes, and associating the influence factors as labels with the corresponding nodes; the method comprises the following steps: acquiring operation indexes of Internet infrastructure in real time, responding to an identified abnormal event, reversely tracking upstream nodes in a directed acyclic graph, determining candidate root cause nodes, calculating a comprehensive influence score of the candidate root cause nodes, and outputting at least one root cause path, so that automatic and intelligent root cause analysis is realized, and the abnormal root cause positioning efficiency is improved; the full coverage and correlation analysis of the multi-level service nodes are realized, and the accuracy and reliability of the root cause analysis result are improved.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to a method, apparatus, device, and medium for analyzing the root causes of anomalies in Internet infrastructure. Background Technology

[0002] With the rapid development of internet technology, network architecture has become increasingly complex, and internet infrastructure has become a crucial cornerstone supporting socio-economic operations. Modern internet services are typically built on complex systems composed of multiple layers and technologies, including DNS root servers, backbone networks, content delivery network (CDN) nodes, cloud computing platforms, and edge computing nodes. These infrastructure components have close service calls and data dependencies, forming a deep service chain. If any link in this chain experiences an anomaly, such as a DNS resolution failure, network congestion, or server performance bottleneck, it can propagate downstream along the dependency chain, ultimately leading to interruptions or degraded quality of user-facing application services, directly impacting the economy, people's livelihoods, and even national security. Traditional methods for root cause analysis of network anomalies have significant limitations. For example, relying on manually set thresholds or subjective judgments of anomaly causes is inefficient and inaccurate. Root cause analysis based on specific business data often focuses only on network KPIs (such as packet loss rate and latency) while ignoring other business-related factors (such as user experience quality), making it difficult to comprehensively pinpoint problems. Furthermore, traditional methods struggle to respond quickly to massive amounts of data (such as 30GB of microservice logs per day). Summary of the Invention

[0003] This invention provides a method, apparatus, device, and medium for root cause analysis of anomalies in Internet infrastructure, which addresses the shortcomings of traditional root cause analysis methods for Internet infrastructure anomalies, such as reliance on manual labor in terms of efficiency, limitation to a single network indicator in terms of perspective, and inability to handle massive amounts of data in terms of processing capacity, resulting in one-sided, slow, and inaccurate root cause analysis.

[0004] This invention provides a method for root cause analysis of anomalies in Internet infrastructure, comprising: Based on the business chain and dependency information of Internet infrastructure, construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges; The historical performance data of the directed acyclic graph and its nodes are input into the graph convolutional network model to determine the influence factors of the performance indicators of each node, and the influence factors are used as labels to associate with the corresponding nodes. Real-time collection of operational metrics of Internet infrastructure; identification of abnormal events and corresponding abnormal nodes based on the operational metrics of Internet infrastructure. In response to the detection of the abnormal event, starting from the abnormal node, upstream nodes are traced in reverse in the directed acyclic graph. Upstream nodes whose operating indicators reach a preset threshold are recorded as candidate root cause nodes. The comprehensive impact score of the candidate root cause nodes is calculated based on the operating indicators and labels of the candidate root cause nodes. At least one root cause path is output based on the comprehensive impact score of the candidate root cause nodes.

[0005] According to the Internet infrastructure anomaly root cause analysis method provided by the present invention, the construction of a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges based on the business chain and dependency information of the Internet infrastructure includes: Based on the business chain of Internet infrastructure, the various service nodes involved in the business chain are identified, including transmission service nodes, access service nodes, network management service nodes, and application service nodes; Obtain dependency information between various service nodes in the business chain. The dependency information includes at least one of microservice call chain data, infrastructure network topology relationships, configuration management database information, and topology scan information. By integrating the various service nodes in the business chain with the dependency information, a directed acyclic graph is generated with the service nodes as vertices and the dependencies between nodes as edges.

[0006] According to the root cause analysis method for internet infrastructure anomalies provided by the present invention, the step of inputting the historical operational index data of the directed acyclic graph and its nodes into a graph convolutional network model to determine the influencing factors of the operational index of each node includes: The topology of the directed acyclic graph, the historical performance data of each node, and the initial influencing factors of each performance indicator are input into the graph convolutional network model. The graph convolutional network model learns the input graph structure and node features, analyzes the abnormal propagation patterns between nodes based on the graph structure, and outputs the corrected influencing factors of each performance indicator as the influencing factors of each node's performance indicator.

[0007] According to the Internet infrastructure anomaly root cause analysis method provided by the present invention, the step of learning the input graph structure and node features through the graph convolutional network model includes: Through at least one graph convolutional layer of the graph convolutional network model, the feature information of adjacent nodes is aggregated according to the topology of the directed acyclic graph to generate a node embedding representation containing neighborhood context information. Based on the aggregated neighborhood information, the feature representation of each node is updated through nonlinear transformation; After the final graph convolutional layer, a fully connected layer maps the updated node feature representations to the corrected influence factor values ​​of the corresponding running metrics.

[0008] According to the Internet infrastructure anomaly root cause analysis method provided by the present invention, the step of identifying abnormal events and corresponding abnormal nodes based on the operational indicators of the Internet infrastructure includes: Collect real-time operational metrics, and perform metric comparison, pattern recognition, or security event detection on the real-time operational metrics; When any operational metric is determined to be abnormal by at least one of the metric comparison, pattern recognition, or security event detection methods, an abnormal event is triggered, and the infrastructure service node to which the operational metric belongs is marked as an abnormal node. The indicator comparison includes comparing the real-time operating indicators with predefined anomaly thresholds; the pattern recognition includes matching and judging based on the real-time collected operating indicator sequence through predefined anomaly pattern rules; and the security event detection includes matching the real-time collected operating indicators or logs with a predefined security rule base.

[0009] According to the Internet infrastructure anomaly root cause analysis method provided by the present invention, the step of calculating the comprehensive impact score of the candidate root cause nodes based on their operational indicators and labels, and outputting at least one root cause path based on the comprehensive impact score of the candidate root cause nodes, includes: Based on the deviation of the operating indicators of each candidate root cause node from a preset threshold and its corresponding influence factor label, the comprehensive influence score of each candidate root cause node is calculated. Based on the combined influence scores of all candidate root cause nodes, at least one root cause path is calculated in the directed acyclic graph using a graph analysis algorithm.

[0010] According to the Internet infrastructure anomaly root cause analysis method provided by the present invention, the step of calculating at least one root cause path in the directed acyclic graph based on the comprehensive impact score of all candidate root cause nodes and using a graph analysis algorithm includes: Based on the topology of the directed acyclic graph and the comprehensive influence score of the candidate root cause nodes, multiple potential propagation paths are generated from each candidate root cause node to the anomalous node. The path evaluation score is calculated based on the combined impact score of the nodes on each propagation path and the path length; Based on the path evaluation score, output at least one path with the highest evaluation score as the root cause path, and output the service node with the highest comprehensive impact score on the root cause path.

[0011] The present invention also provides an internet infrastructure anomaly root cause analysis device, comprising: The building module is used to construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges, based on the business chain and dependency information of Internet infrastructure. The determination module is used to input the historical performance index data of the directed acyclic graph and its nodes into the graph convolutional network model, determine the influence factors of the performance index of each node, and associate the influence factors as labels with the corresponding nodes. The identification module is used to collect operational indicators of the Internet infrastructure in real time, and to identify abnormal events and corresponding abnormal nodes based on the operational indicators of the Internet infrastructure. The output module is used to respond to the detection of the abnormal event, starting from the abnormal node, to trace upstream nodes in reverse in the directed acyclic graph, record upstream nodes whose operating indicators reach a preset threshold as candidate root cause nodes, calculate the comprehensive impact score of the candidate root cause nodes based on the operating indicators and labels of the candidate root cause nodes, and output at least one root cause path based on the comprehensive impact score of the candidate root cause nodes.

[0012] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the Internet infrastructure anomaly root cause analysis method as described in any of the preceding claims.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the Internet infrastructure anomaly root cause analysis method described in any of the preceding claims.

[0014] The present invention provides a method, apparatus, device, and medium for analyzing the root causes of internet infrastructure anomalies. Based on the business chain and dependency information of internet infrastructure, a directed acyclic graph (DAG) is constructed with infrastructure service nodes as vertices and inter-node dependencies as edges. The historical operational index data of the DAG and its nodes are input into a graph convolutional network model to determine the influencing factors of each node's operational index, and these influencing factors are used as labels associated with the corresponding nodes. The operational indexes of the internet infrastructure are collected in real time, and abnormal events and corresponding abnormal nodes are identified based on these indicators. In response to the identification of an abnormal event, the upstream nodes are traced backward from the abnormal node in the DAG, and the operational indexes are recorded. Upstream nodes that reach a preset threshold are selected as candidate root cause nodes. A comprehensive impact score is calculated based on the operational metrics and labels of these candidate root cause nodes. At least one root cause path is output based on this comprehensive impact score. This automated and intelligent analysis process improves the efficiency of anomaly root cause localization. By introducing business chains to construct a directed acyclic graph with global dependencies, it overcomes the limitations of traditional methods that only focus on isolated network performance metrics. This achieves full coverage and correlation analysis of multi-level service nodes, including transmission, access, and applications. The calculation of comprehensive impact scores enables objective and dynamic quantitative reasoning, improving the accuracy and reliability of root cause analysis results and providing precise and reliable reference for operational decisions. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0016] Figure 1 This is one of the flowcharts of the Internet infrastructure anomaly root cause analysis method provided in the embodiments of the present invention; Figure 2 This is the second flowchart of the Internet infrastructure anomaly root cause analysis method provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of service dependencies provided in an embodiment of the present invention; Figure 4 This is a functional structure diagram of the Internet infrastructure anomaly root cause analysis device provided in an embodiment of the present invention; Figure 5 This is a functional structure diagram of the electronic device provided in the embodiments of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0018] Figure 1 A flowchart of the Internet infrastructure anomaly root cause analysis method provided in the embodiments of the present invention is shown below. Figure 1 As shown, the Internet infrastructure anomaly root cause analysis method provided in this embodiment of the invention includes: Step 101: Based on the business chain and dependency information of Internet infrastructure, construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges; Step 102: Input the historical performance index data of the directed acyclic graph and its nodes into the graph convolutional network model, determine the influence factors of the performance index of each node, and associate the influence factors as labels with the corresponding nodes; Step 103: Collect the operational indicators of the Internet infrastructure in real time, and identify abnormal events and corresponding abnormal nodes based on the operational indicators of the Internet infrastructure. Step 104: In response to the identification of the abnormal event, starting from the abnormal node, trace the upstream nodes in reverse in the directed acyclic graph, record the upstream nodes whose operating indicators reach the preset threshold as candidate root cause nodes, calculate the comprehensive impact score of the candidate root cause nodes based on the operating indicators and labels of the candidate root cause nodes, and output at least one root cause path based on the comprehensive impact score of the candidate root cause nodes.

[0019] Traditional root cause analysis methods for network anomalies have significant limitations. For example, relying on manually set thresholds or subjective judgments of anomaly causes is inefficient and lacks accuracy. Root cause analysis based on specific business data often focuses only on network KPIs (such as packet loss rate and latency) while ignoring other business-related factors (such as user experience quality), making it difficult to comprehensively pinpoint problems. Furthermore, traditional methods struggle to respond quickly to massive amounts of data (such as 30GB of microservice logs per day).

[0020] The internet infrastructure anomaly root cause analysis method provided in this invention constructs a directed acyclic graph (DAG) with infrastructure service nodes as vertices and inter-node dependencies as edges based on the business chain and dependency information of the internet infrastructure. The historical operational metrics data of the DAG and its nodes are input into a graph convolutional network model to determine the influencing factors of each node's operational metrics, and these influencing factors are used as labels associated with the corresponding nodes. The operational metrics of the internet infrastructure are collected in real time, and abnormal events and corresponding abnormal nodes are identified based on these metrics. In response to the identification of an abnormal event, the method traces upstream nodes in reverse from the abnormal node in the DAG, recording the achievement of operational metrics. Upstream nodes with a preset threshold are selected as candidate root cause nodes. A comprehensive impact score is calculated based on the operational metrics and labels of these candidate root cause nodes. At least one root cause path is output based on this comprehensive impact score. This automated and intelligent analysis process improves the efficiency of anomaly root cause localization. By introducing business chains to construct a directed acyclic graph with global dependencies, it overcomes the limitations of traditional methods that only focus on isolated network performance metrics. This achieves full coverage and correlation analysis of multi-level service nodes, including transmission, access, and applications. The calculation of the comprehensive impact score enables objective and dynamic quantitative reasoning, improving the accuracy and reliability of root cause analysis results and providing precise and reliable reference for operational decisions.

[0021] Based on any of the above embodiments, the construction of a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges, based on the business chain and dependency information of Internet infrastructure, includes: Step 201: Based on the business chain of Internet infrastructure, identify the various service nodes involved in the business chain, including transmission service nodes, access service nodes, network management service nodes, and application service nodes; Step 202: Obtain dependency information between various service nodes in the business chain. The dependency information includes at least one of the following: microservice call chain data, infrastructure network topology relationship, configuration management database information, and topology scan information. Step 203: Integrate the various service nodes in the business chain with the dependency information to generate a directed acyclic graph with the service nodes as vertices and the dependencies between nodes as edges.

[0022] In this embodiment of the invention, for typical abnormal data of Internet infrastructure services, the system automatically obtains chain data relationships of calls between microservices of Internet infrastructure in a specific area (such as Jaeger, OpenTelemetry), as well as various dependency information such as infrastructure network topology relationships (such as network devices, load balancers, databases, etc.), CMDB, and topology scanning tool scanning information, by combining the mastered business chain, network architecture, or Service Mesh tools (such as Istio + Kiali). The system generates a graph structure representing the Internet infrastructure service dependency graph. In this embodiment of the invention, a directed acyclic graph is used to generate the service dependency graph. In this graph, the nodes represent infrastructure service nodes, and the edges represent call, dependency, and data flow relationships. Based on the network infrastructure service chain structure (mainly including transmission services, access services, network management services, and application services), and combined with the actual situation of industry management and business applications, the system uses graph building tools to intelligently collect and model the network, data, and system structures, sort out and extract the service indicators and risk points corresponding to the business chain, and form modeling and mapping relationships. Based on this, a directed acyclic graph oriented towards indicator nodes, risk nodes, and their impact relationships is constructed.

[0023] Based on any of the above embodiments, the step of inputting the historical performance data of the directed acyclic graph and its nodes into a graph convolutional network model to determine the influencing factors of each node's performance indicators includes: The topology of the directed acyclic graph, the historical performance data of each node, and the initial influencing factors of each performance indicator are input into the graph convolutional network model. The graph convolutional network model learns the input graph structure and node features, analyzes the abnormal propagation patterns between nodes based on the graph structure, and outputs the corrected influencing factors of each performance indicator as the influencing factors of each node's performance indicator.

[0024] This invention combines structured management data (related service nodes, threshold indicators, etc.) from typical infrastructure service anomaly data with a full-chain service dependency graph. It loads identified threshold indicators and preset influencing factors as infrastructure labels onto nodes in a directed acyclic graph (DAG), using the entire dataset as input to a graph convolutional network model for learning. Through model learning, the influence relationship between each infrastructure service node and related threshold indicators can be obtained. The selection of threshold indicators is first based on the type of anomaly event (e.g., high API error rate, slow access, security attack), matching it to the classification and grading standards in GB / T 20986—2023. Then, the classified and graded anomaly events are mapped to corresponding infrastructure service indicator thresholds (e.g., TTFB>2s), and initial influencing factors are set. Through learning and analysis of the historical data, the influencing factors are adjusted and corrected, and finally, the threshold indicators and their influencing factors are loaded as labels onto the DAG. By fully utilizing the dynamic propagation algorithm based on directed acyclic graphs, a risk impact value calculation model for service quality indicator nodes is proposed. This model enables dynamic calculation and evaluation of service quality indicator nodes, and on this basis, key indicators affecting network service quality risks are extracted and obtained, which can support the dynamic service needs of the entire Internet infrastructure service chain.

[0025] In this embodiment of the invention, the step of learning the input graph structure and node features through the graph convolutional network model includes: Step 301: Through at least one graph convolutional layer of the graph convolutional network model, based on the topology of the directed acyclic graph, aggregate the feature information of adjacent nodes to generate a node embedding representation containing neighborhood context information. Step 302: Based on the aggregated neighborhood information, update the feature representation of each node through nonlinear transformation; Step 303: After the final graph convolutional layer, the updated node feature representation is mapped to the corrected influence factor value of the corresponding running index through a fully connected layer.

[0026] Based on any of the above embodiments, the step of identifying abnormal events and corresponding abnormal nodes according to the operational indicators of the Internet infrastructure includes: Step 401: Collect real-time operating indicators, and perform indicator comparison, pattern recognition, or security event detection on the real-time operating indicators; Step 402: When any operational indicator is determined to be abnormal by at least one of the indicator comparison, pattern recognition or security event detection methods, an abnormal event is triggered, and the infrastructure service node to which the operational indicator belongs is marked as an abnormal node. The indicator comparison includes comparing the real-time operating indicators with predefined anomaly thresholds; the pattern recognition includes matching and judging based on the real-time collected operating indicator sequence through predefined anomaly pattern rules; and the security event detection includes matching the real-time collected operating indicators or logs with a predefined security rule base.

[0027] This invention uses network service monitoring tools such as application performance monitoring tools or log aggregation systems to dynamically collect data on the operation of Internet infrastructure. Taking network transmission services as an example, the real-time monitored data can include operational indicators such as throughput, bandwidth utilization, one-way latency, round-trip latency, service availability, and packet loss rate of infrastructure service nodes, as well as user-side indicators (such as DNS resolution time, first byte time, etc.) and security indicators (WAF, DDoS, intrusion detection, etc.). Based on threshold judgment (such as TTFB>2s), pattern recognition (such as a sudden drop in traffic of 50%), security rule matching, and other methods, abnormal events in the operation of infrastructure services are dynamically identified.

[0028] Based on any of the above embodiments, the step of calculating the comprehensive impact score of the candidate root cause node based on its operational metrics and labels, and outputting at least one root cause path based on the comprehensive impact score of the candidate root cause node, includes: Step 501: Based on the deviation of the operating index of each candidate root cause node from the preset threshold and its corresponding influence factor label, calculate the comprehensive influence score of each candidate root cause node. Step 502: Based on the comprehensive influence score of all candidate root cause nodes, at least one root cause path is calculated in the directed acyclic graph using a graph analysis algorithm.

[0029] In this embodiment of the invention, the step of calculating at least one root cause path in the directed acyclic graph using a graph analysis algorithm based on the comprehensive influence score of all candidate root cause nodes includes: Step 5021: Based on the topology of the directed acyclic graph and the comprehensive influence score of the candidate root cause nodes, generate multiple potential propagation paths from each candidate root cause node to the anomalous node. Step 5022: Calculate the path evaluation score based on the comprehensive influence score of the nodes on each propagation path and the path length; Step 5023: Based on the path evaluation score, output at least one path with the highest evaluation score as the root cause path, and output the service node with the highest comprehensive impact score on the root cause path.

[0030] This invention utilizes a full-chain service dependency graph, starting from the node where an anomaly occurs (e.g., an API interface failure), and tracing back to its upstream dependent nodes. It analyzes whether each node meets service threshold conditions (e.g., CPU > 90%, cache breakdown, slow TLS handshake, etc.). If any service indicator reaches the threshold condition, the infrastructure service node and its threshold indicator are recorded, and the tracking of its dependent nodes continues until the top node or a node whose indicator has not reached the threshold is reached. That is, if all service indicators of a node fail to meet the threshold condition, the analysis of that propagation path stops. Finally, based on the traversed records, all related nodes, threshold indicators, and their influencing factors are obtained. Furthermore, graph analysis algorithms (e.g., DFS, PageRank, probability summation algorithms, minimum path algorithms, etc.) are used to calculate the comprehensive impact score of each related node, or the shortest propagation path, thereby filtering out all nodes with high comprehensive scores and their threshold indicator information on the aforementioned path for reference in anomaly handling and decision-making.

[0031] Existing root cause analysis of internet infrastructure anomalies does not comprehensively consider all factors, lacks intelligent processing capabilities for different businesses and anomalies across the entire chain, and suffers from low accuracy and timeliness. This invention, through innovative applications of technologies such as constructing service dependency graphs for the entire chain of businesses and anomaly propagation path analysis and calculation based on graph structures, focuses on realizing a method for dynamic calculation, derivation, and location of root cause paths for internet infrastructure anomalies based on the entire service chain.

[0032] This invention, based on business structure, monitoring data, and model analysis data, describes the entire chain of Internet infrastructure services and nodes through the design of quantitative labels, gradually constructing an Internet infrastructure service dependency graph with structured and quantitative processing capabilities. It utilizes a graph convolutional network model to perform feature learning and training on a directed acyclic graph containing historical information such as service nodes, dependencies, and operational metrics. This fully leverages model calculation methods to efficiently, accurately, and dynamically calculate the impact factors of operational (threshold) metrics for service nodes, and continuously adjusts and corrects them. Based on the graph convolutional network model calculation, the impact factor labels are added to the directed acyclic graph for anomaly propagation path analysis based on the service dependency graph. This allows for the calculation of the path with the highest comprehensive impact factor, or the path with the smallest / fastest propagation, along with the status of all nodes and their threshold metrics on the aforementioned path, providing a reference for user anomaly handling and decision-making.

[0033] Based on any of the above embodiments, such as Figure 2 As shown, the root cause analysis of the abnormal slowdown in webpage access speed specifically includes: (1) Construct a service dependency graph for the entire chain of Internet services, including web page services.

[0034] The entire service infrastructure of internet web services, from the network layer and data layer to the application layer, mainly includes terminal network equipment, routing and switching equipment at all levels of the access network, switching equipment at all levels of the backbone network, website service provider hosts (databases), network firewall equipment, and DNS resolution servers at all levels. Based on the upstream and downstream business and data dependencies between these nodes, a basic service dependency diagram is drawn, such as... Figure 3 As shown.

[0035] (2) Service dependency learning and influencing factor analysis based on graph convolutional network model.

[0036] The aforementioned dependency graph, historical data (including node information, relevant service indicator data, and related root cause results) related to web access service failures from the historical anomaly event database, and preset indicator (such as network bandwidth 0.3, network latency 0.2, load 0.3, TTL 0.2, etc.) influencing factors are input into the graph convolutional network model for learning. The influencing factors of each indicator are corrected and calculated, and added to the service dependency graph as attribute labels of nodes.

[0037] (3) If the network access speed is found to be abnormal and reaches the indicator threshold level through the monitoring system, the abnormal root cause analysis function is activated.

[0038] (4) Based on the service dependency graph, starting from the terminal network device node, the threshold judgment is performed on the upstream link nodes such as router node, each network switching node, DNS recursive service node, and root node in sequence based on the weighted PageRank graph analysis algorithm to obtain all nodes that meet the root cause judgment requirements and their influencing factor information.

[0039] (5) Based on the indicators and influencing factor information of the above-mentioned relevant nodes, the comprehensive influence score of each node can be calculated. The calculation formula is as follows: ), where Xn is the monitoring value of a certain service indicator of the node, X is the abnormal threshold of the service indicator, PRx is the influence factor of the indicator, and n is the number of related nodes of the node.

[0040] (6) Further, based on the comprehensive impact score of the nodes, the most likely impact propagation path is analyzed using path probability calculation algorithms, and finally one or more service paths (such as the switching device A path) with high impact scores and short propagation paths are obtained. The service nodes with the highest comprehensive impact scores in the above paths are sorted and output to provide a reference for the analysis of the correlation between abnormal root causes.

[0041] The internet infrastructure anomaly root cause analysis method provided by this invention constructs a directed acyclic graph (DAG) dependency graph based on business structure, monitoring data, and model analysis data. This DAG performs structured and quantitative dependency analysis on all links and nodes of the internet infrastructure service chain, fully reflecting the influence relationships between internet infrastructure components and their service indicators. This supports scientific root cause analysis of service anomalies and link / node correlation analysis. Furthermore, it utilizes a graph convolutional network model to perform feature learning and training on the DAG containing historical information such as service nodes, dependencies, and operational indicators. This fully leverages model computation methods to efficiently, accurately, and dynamically calculate the influencing factors of service node operational (threshold) indicators, and continuously adjusts and corrects them. Based on the above model calculations, the indicator impact factor labels are added to a directed acyclic graph (DAG) for anomaly propagation path analysis based on service dependency graphs. This allows for the calculation of the path with the highest comprehensive impact factor, or the path with the smallest / fastest propagation, using specific graph analysis algorithms (such as DFS, PageRank, probability summation algorithms, minimum path algorithms, etc.), along with the status of all nodes and their threshold indicators on these paths. This provides a reference for user anomaly handling and decision-making. By modeling the service dependency relationship graph of the entire internet infrastructure chain, structured root cause analysis of dynamic monitoring anomaly indicators of internet infrastructure operation is achieved. Furthermore, quantitative root cause analysis of anomaly service indicators is realized through the calculation of risk impact values ​​for service quality indicator nodes. Ultimately, a comprehensive correlation analysis and correspondence analysis of the root causes of internet infrastructure anomalies is achieved.

[0042] The following describes the Internet infrastructure anomaly root cause analysis device provided by the present invention. The Internet infrastructure anomaly root cause analysis device described below and the Internet infrastructure anomaly root cause analysis method described above can be referred to in correspondence.

[0043] Figure 4 A functional structure diagram of the Internet infrastructure anomaly root cause analysis device provided in the embodiments of the present invention is shown below. Figure 4 As shown, the Internet infrastructure anomaly root cause analysis device provided in this embodiment of the invention includes: Module 401 is used to construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges based on the business chain and dependency information of Internet infrastructure. The determination module 402 is used to input the historical performance index data of the directed acyclic graph and its nodes into the graph convolutional network model, determine the influence factor of the performance index of each node, and associate the influence factor as a label with the corresponding node. The identification module 403 is used to collect the operating indicators of the Internet infrastructure in real time, and identify abnormal events and corresponding abnormal nodes based on the operating indicators of the Internet infrastructure. The output module 404 is used to respond to the detection of the abnormal event, starting from the abnormal node, to trace upstream nodes in reverse in the directed acyclic graph, record upstream nodes whose operating indicators reach a preset threshold as candidate root cause nodes, calculate the comprehensive impact score of the candidate root cause nodes based on the operating indicators and labels of the candidate root cause nodes, and output at least one root cause path according to the comprehensive impact score of the candidate root cause nodes.

[0044] The internet infrastructure anomaly root cause analysis device provided in this invention constructs a directed acyclic graph (DAG) with infrastructure service nodes as vertices and inter-node dependencies as edges based on the business chain and dependency information of the internet infrastructure. It inputs the historical operational index data of the DAG and its nodes into a graph convolutional network model to determine the influencing factors of each node's operational index and associates these influencing factors as labels with the corresponding nodes. It collects the operational indexes of the internet infrastructure in real time and identifies abnormal events and corresponding abnormal nodes based on these indicators. In response to the identification of an abnormal event, it traces upstream nodes in the DAG from the abnormal node, recording the achievement of operational indexes. Upstream nodes with a preset threshold are selected as candidate root cause nodes. A comprehensive impact score is calculated based on the operational metrics and labels of these candidate root cause nodes. At least one root cause path is output based on this comprehensive impact score. This automated and intelligent analysis process improves the efficiency of anomaly root cause localization. By introducing business chains to construct a directed acyclic graph with global dependencies, it overcomes the limitations of traditional methods that only focus on isolated network performance metrics. This achieves full coverage and correlation analysis of multi-level service nodes, including transmission, access, and applications. The calculation of the comprehensive impact score enables objective and dynamic quantitative reasoning, improving the accuracy and reliability of root cause analysis results and providing precise and reliable reference for operational decisions.

[0045] Figure 5 An example is a schematic diagram of the physical structure of a communication device, such as... Figure 5As shown, the communication device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The memory 530 includes computer programs, an operating system, and acquired data. The processor 510 can call logical instructions in the memory 530 to execute an internet infrastructure anomaly root cause analysis method. This method includes: constructing a directed acyclic graph (DAG) with infrastructure service nodes as vertices and inter-node dependencies as edges based on the business chain and dependency information of the internet infrastructure; inputting the historical operating index data of the DAG and its nodes into a graph convolutional network model to determine the influence factors of each node's operating index and associating the influence factors as labels with the corresponding nodes; collecting the operating indexes of the internet infrastructure in real time and identifying abnormal events and corresponding abnormal nodes based on the operating indexes of the internet infrastructure; in response to the identification of the abnormal event, tracing upstream nodes backward in the DAG from the abnormal node, recording upstream nodes whose operating indexes reach a preset threshold as candidate root cause nodes, calculating the comprehensive influence score of the candidate root cause nodes based on the operating indexes and labels of the candidate root cause nodes, and outputting at least one root cause path based on the comprehensive influence score of the candidate root cause nodes.

[0046] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to related technologies, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0047] On the other hand, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the Internet infrastructure anomaly root cause analysis method provided by the above methods. The method includes: constructing a directed acyclic graph (DAG) with infrastructure service nodes as vertices and inter-node dependencies as edges based on the business chain and dependency information of the Internet infrastructure; inputting the historical operating index data of the DAG and its nodes into a graph convolutional network model to determine the influence factors of the operating index of each node, and associating the influence factors as labels with the corresponding nodes; collecting the operating index of the Internet infrastructure in real time, and identifying abnormal events and corresponding abnormal nodes based on the operating index of the Internet infrastructure; in response to the identification of the abnormal event, tracing upstream nodes backward in the DAG from the abnormal node, recording upstream nodes whose operating index reaches a preset threshold as candidate root cause nodes, calculating the comprehensive influence score of the candidate root cause nodes based on the operating index and labels of the candidate root cause nodes, and outputting at least one root cause path based on the comprehensive influence score of the candidate root cause nodes.

[0048] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0049] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of software products. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for root cause analysis of anomalies in Internet infrastructure, characterized in that, include: Based on the business chain and dependency information of Internet infrastructure, construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges; The historical performance data of the directed acyclic graph and its nodes are input into the graph convolutional network model to determine the influence factors of the performance indicators of each node, and the influence factors are used as labels to associate with the corresponding nodes. Real-time collection of operational metrics of Internet infrastructure; identification of abnormal events and corresponding abnormal nodes based on the operational metrics of Internet infrastructure. In response to the detection of the abnormal event, starting from the abnormal node, upstream nodes are traced in reverse in the directed acyclic graph. Upstream nodes whose operating indicators reach a preset threshold are recorded as candidate root cause nodes. The comprehensive impact score of the candidate root cause nodes is calculated based on the operating indicators and labels of the candidate root cause nodes. At least one root cause path is output based on the comprehensive impact score of the candidate root cause nodes.

2. The method for root cause analysis of internet infrastructure anomalies according to claim 1, characterized in that, The business chain and dependency information based on Internet infrastructure are used to construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges, including: Based on the business chain of Internet infrastructure, the various service nodes involved in the business chain are identified, including transmission service nodes, access service nodes, network management service nodes, and application service nodes; Obtain dependency information between various service nodes in the business chain. The dependency information includes at least one of microservice call chain data, infrastructure network topology relationships, configuration management database information, and topology scan information. By integrating the various service nodes in the business chain with the dependency information, a directed acyclic graph is generated with the service nodes as vertices and the dependencies between nodes as edges.

3. The method for root cause analysis of internet infrastructure anomalies according to claim 1, characterized in that, The step of inputting the historical performance data of the directed acyclic graph and its nodes into the graph convolutional network model to determine the influencing factors of each node's performance indicators includes: The topology of the directed acyclic graph, the historical performance data of each node, and the initial influencing factors of each performance indicator are input into the graph convolutional network model. The graph convolutional network model learns the input graph structure and node features, analyzes the abnormal propagation patterns between nodes based on the graph structure, and outputs the corrected influencing factors of each performance indicator as the influencing factors of each node's performance indicator.

4. The method for root cause analysis of internet infrastructure anomalies according to claim 3, characterized in that, The learning of the input graph structure and node features through the graph convolutional network model includes: Through at least one graph convolutional layer of the graph convolutional network model, the feature information of adjacent nodes is aggregated according to the topology of the directed acyclic graph to generate a node embedding representation containing neighborhood context information. Based on the aggregated neighborhood information, the feature representation of each node is updated through nonlinear transformation; After the final graph convolutional layer, a fully connected layer maps the updated node feature representations to the corrected influence factor values ​​of the corresponding running metrics.

5. The method for root cause analysis of internet infrastructure anomalies according to claim 1, characterized in that, The step of identifying abnormal events and corresponding abnormal nodes based on the operational indicators of the Internet infrastructure includes: Collect real-time operational metrics, and perform metric comparison, pattern recognition, or security event detection on the real-time operational metrics; When any operational metric is determined to be abnormal by at least one of the metric comparison, pattern recognition, or security event detection methods, an abnormal event is triggered, and the infrastructure service node to which the operational metric belongs is marked as an abnormal node. The indicator comparison includes comparing the real-time operating indicators with predefined anomaly thresholds; the pattern recognition includes matching and judging based on the real-time collected operating indicator sequence through predefined anomaly pattern rules; and the security event detection includes matching the real-time collected operating indicators or logs with a predefined security rule base.

6. The method for root cause analysis of internet infrastructure anomalies according to claim 1, characterized in that, The process of calculating the comprehensive impact score of the candidate root cause nodes based on their operational metrics and labels, and outputting at least one root cause path based on the comprehensive impact score of the candidate root cause nodes, includes: Based on the deviation of the operating indicators of each candidate root cause node from a preset threshold and its corresponding influence factor label, the comprehensive influence score of each candidate root cause node is calculated. Based on the combined influence scores of all candidate root cause nodes, at least one root cause path is calculated in the directed acyclic graph using a graph analysis algorithm.

7. The method for root cause analysis of internet infrastructure anomalies according to claim 6, characterized in that, Based on the comprehensive influence score of all candidate root cause nodes, at least one root cause path is calculated in the directed acyclic graph using a graph analysis algorithm, including: Based on the topology of the directed acyclic graph and the comprehensive influence score of the candidate root cause nodes, multiple potential propagation paths are generated from each candidate root cause node to the anomalous node. The path evaluation score is calculated based on the combined impact score of the nodes on each propagation path and the path length; Based on the path evaluation score, output at least one path with the highest evaluation score as the root cause path, and output the service node with the highest comprehensive impact score on the root cause path.

8. A device for analyzing the root causes of anomalies in internet infrastructure, characterized in that, include: The building module is used to construct a directed acyclic graph with infrastructure service nodes as vertices and inter-node dependencies as edges, based on the business chain and dependency information of Internet infrastructure. The determination module is used to input the historical performance index data of the directed acyclic graph and its nodes into the graph convolutional network model, determine the influence factors of the performance index of each node, and associate the influence factors as labels with the corresponding nodes. The identification module is used to collect operational indicators of the Internet infrastructure in real time, and to identify abnormal events and corresponding abnormal nodes based on the operational indicators of the Internet infrastructure. The output module is used to respond to the detection of the abnormal event, starting from the abnormal node, to trace upstream nodes in reverse in the directed acyclic graph, record upstream nodes whose operating indicators reach a preset threshold as candidate root cause nodes, calculate the comprehensive impact score of the candidate root cause nodes based on the operating indicators and labels of the candidate root cause nodes, and output at least one root cause path based on the comprehensive impact score of the candidate root cause nodes.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the Internet infrastructure anomaly root cause analysis method as described in any one of claims 1 to 7.

10. A non-transitory readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the Internet infrastructure anomaly root cause analysis method as described in any one of claims 1 to 7.

Images