Network fault root cause positioning system based on multi-modal learning and causal inference

Abstract

The invention relates to a network fault root cause positioning system based on multi-modal learning and causal inference, and belongs to the technical field of network fault diagnosis and positioning. The system comprises a data processing and association mining module, an intelligent fault diagnosis and evaluation module, a root cause positioning module and a system optimization module which are connected in sequence. The data processing module collects data through edge nodes, constructs a hierarchical knowledge graph and outputs a feature matrix; the diagnosis module performs fault detection by adopting a multi-modal model of a fusion graph neural network, integrates a small sample learning mechanism and outputs a fault event with confidence; the positioning module constructs a causal graph based on a knowledge graph, fuses multi-source evidences and realizes root cause tracing through a random walk algorithm; and the optimization module adjusts diagnosis parameters by utilizing reinforcement learning, expands a sample set based on the generative adversarial network, and realizes continuous optimization of the model through an automatic assembly line. Closed-loop self-optimization from fault sensing to root cause positioning is realized, and the network fault management capability is improved.

Description

Technical Field

[0001] This invention belongs to the field of network fault diagnosis and localization technology, specifically relating to a network fault root cause localization system based on multimodal learning and causal inference. Background Technology

[0002] As communication networks evolve towards heterogeneity and large-scale deployment, the dependencies between network devices, links, and service systems are becoming increasingly complex. Fault propagation paths exhibit multi-directional diffusion characteristics, and a single fault source often triggers a massive number of related alarms, forming an "alarm storm." If the root cause of such faults is not quickly located, it will lead to increased service interruption time and significant economic losses. Therefore, fault root cause localization has become a core requirement in the field of network operation and maintenance. Current methods for locating the root cause of network failures have several limitations: Fragmented data processing: Existing systems often rely on single-type monitoring data, lacking effective mechanisms to correlate structured numerical data with unstructured alarm text and other multi-source data. After data collection, misalignment in time and space, along with interference from redundant information, makes it difficult to form a unified analytical foundation, leading to incomplete fault feature extraction. While some solutions attempt to integrate multi-source data, they fail to construct dynamically updated knowledge graphs, making them unable to adapt to changes in node relationships caused by network topology alterations. Insufficient adaptability of diagnostic models: Traditional rule-driven diagnostic methods rely on manually preset logic, requiring repeated rule modifications when facing new fault scenarios, resulting in extremely high maintenance costs. Preliminary diagnostic solutions often employ single-modal models, failing to integrate complementary information from graph-structured data and text data, and lacking few-shot learning capabilities. The root cause localization logic is weak: existing localization methods are mostly based on the correlation analysis of indicators rather than causal reasoning, which easily leads to the misjudgment of intermediate nodes in the fault propagation process as the root cause. In multi-device cascading fault scenarios, due to the lack of support from heterogeneous cause-effect graphs, it is impossible to clearly trace the transmission path of the fault from the manifestation to the source. Moreover, the confidence fusion strategy of multi-source evidence is simple and difficult to filter out alarm noise interference.

[0003] The system's iteration mechanism is rigid: most diagnostic systems rely on manual triggering for model parameter updates, lacking an automated iteration pipeline that incorporates operational feedback. Furthermore, the scarcity of real-world fault samples leads to insufficient model training data, especially in complex topology scenarios, making it difficult to improve model generalization capabilities and cope with dynamically changing network operating environments. Summary of the Invention

[0004] To address the aforementioned problems in the existing technology, this invention provides a network fault root cause localization system based on multimodal learning and causal inference. The objective of this invention can be achieved through the following technical solutions: A network fault root cause localization system based on multimodal learning and causal inference includes a data processing and correlation mining module, an intelligent fault diagnosis and assessment module, a root cause localization module, and a system optimization module connected in sequence. The data processing and association mining module collects network operation data in a distributed manner through edge computing nodes; cleans and deduplicates the network operation data; and constructs a hierarchical knowledge graph of devices-links-services based on the network resource list and topology data; and outputs a spatiotemporal alignment feature matrix associated with the knowledge graph. The intelligent fault diagnosis and assessment module receives the feature matrix and knowledge graph, and uses a multimodal diagnostic model that integrates graph neural networks to perform fault detection; the intelligent fault diagnosis and assessment module integrates a few-shot learning mechanism and outputs fault events with confidence and severity levels; The root cause localization module receives the fault event and the knowledge graph; constructs a heterogeneous causal graph based on the knowledge graph, and extracts multi-source evidence that is spatiotemporally associated with the fault event; performs confidence fusion on the multi-source evidence, and performs reverse tracing on the heterogeneous causal graph based on a random walk algorithm to locate the root cause node and calculate the confidence level.

[0005] The system optimization module adjusts the decision parameters of the intelligent fault diagnosis and assessment module using reinforcement learning strategies based on the root cause localization results and operation and maintenance verification feedback, and expands the training sample set based on conditional adversarial network generation; it also constructs an automated machine learning pipeline to periodically retrain, verify, and deploy the multimodal diagnostic model.

[0006] As a preferred embodiment of the present invention, the hierarchical knowledge graph is constructed using a dual-mode structure, specifically including: The static dependency layer forms a physical and logical connection topology of device-port-link-service by parsing device attributes in the network resource list and connection relationships generated by the automatic topology discovery protocol. The dynamic influence layer analyzes the state change sequences of various entities in historical failure events, and uses transfer entropy or Granger causality analysis to calculate the intensity and direction of influence between entities, thus constructing a dynamic influence relationship network.

[0007] Specifically, the data processing and correlation mining module adopts a two-level data simplification strategy, which includes: The first level is coarse-grained filtering based on dynamic baseline thresholds. The system establishes a dynamic baseline for key performance indicators that changes over time, and triggers detailed data collection only when the indicator deviation exceeds the baseline adaptive threshold. The second level is streaming deduplication based on sliding window and similarity hashing algorithm. It generates semantic fingerprints for each data event within a preset time window, and identifies and merges duplicate events caused by network probing cycle jitter or redundant reporting.

[0008] Specifically, the graph neural network component in the multimodal diagnostic model adopts a graph attention network. The attention network learns the importance of different connection relationships by assigning appropriate attention weights to the neighbors of each node in the knowledge graph. For any network device node, the edge connected to the power supply equipment and the edge connected to another ordinary switching equipment are assigned different weight coefficients.

[0009] Specifically, the few-shot learning mechanism is implemented as a metric learning framework based on a prototype network, which includes: During the training phase, historical fault samples of various types are mapped to a high-dimensional embedding space, and a prototype center is calculated for each fault category. When faced with a new type of fault with only a few samples, the new sample embedding is assigned to the nearest category by calculating the Euclidean distance or cosine similarity between the Euclidean distance and the prototypes of all known categories.

[0010] Specifically, the intelligent fault diagnosis and assessment module incorporates a high availability degradation protection mechanism, which includes: The protection mechanism includes a lightweight time-series anomaly detection model based on the isolated forest algorithm as a backup. When the system monitors that the continuous load on computing resources exceeds the safety threshold, or the response delay of the primary multimodal diagnostic model exceeds the service level agreement due to processing complex graph relationships, the system automatically routes the diagnostic task to the lightweight model. The lightweight model maintains the system's basic diagnostic capabilities by quickly scoring key indicators for anomalies.

[0011] Specifically, the severity level assessment of the fault event is completed by a multi-input single-output fuzzy inference system. The fuzzy inference system uses the quantified fault confidence, the affected service level protocol level, and the number and importance score of the network nodes affected by the fault as three input dimensions. Each dimension is divided into multiple fuzzy sets and defuzzified through a preset expert rule base to output the fault level.

[0012] Specifically, the directed edges and weight coefficients connecting the nodes in the heterogeneous causal graph adopt a hybrid initialization strategy, which includes: The co-occurrence probability of faults between each pair of nodes is calculated based on historical fault data as the basic weight; a decay factor based on the number of hops in the network topology is introduced to reduce the weight of connections that are physically far apart; a predefined rule base based on expert experience is constructed, and the deterministic causal relationships defined in the rule base are initialized as directed edges in the causal graph, and a high initial weight value is assigned to the directed edges.

[0013] Specifically, the reverse tracing process based on the random walk algorithm is as follows: The random walk algorithm sets multiple observed surface fault nodes as the starting point of the walker. Each step of the walker moves to a neighbor node with a preset probability or jumps back to the starting point with a restart probability. After multiple iterations, the probability distribution of each node being visited tends to stabilize, and the nodes with the highest page rank values ​​are identified as potential root causes.

[0014] Specifically, the system optimization module uses the context multi-armed gambling machine algorithm for strategy optimization; the context multi-armed gambling machine algorithm uses the overall state of the current network as context information to dynamically adjust the calling weights of different sub-models in the intelligent fault diagnosis and evaluation module, as well as the confidence thresholds for triggering different levels of fault events.

[0015] Specifically, the system optimization module utilizes conditional generative adversarial networks for data augmentation, and the specific method is as follows: Using the type labels and key feature profiles of historical rare faults as conditions, the generator is driven to produce synthetic fault samples. After the synthetic fault samples are verified by the discriminator, they are checked by predefined logical rules based on domain knowledge. The samples that pass the logical rule verification are injected into the training dataset.

[0016] Specifically, the automated machine learning pipeline includes a shadow mode deployment phase for the online evaluation of new multimodal diagnostic models, specifically including: During the shadow mode deployment phase, the system runs the new multimodal diagnostic model and the currently online multimodal diagnostic model in parallel, collects the outputs and root cause data of both for comparison, and makes automatic decisions based on a set of configurable strategies. The strategy stipulates that the automatic switching process can only be initiated when the new multimodal diagnostic model continuously meets the preset winning conditions in terms of precision and recall.

[0017] The beneficial effects of this invention are as follows: In terms of data processing, the system overcomes the bottleneck of multi-source data association, improving data utilization efficiency and accuracy. It constructs a dual-mode knowledge graph consisting of a static dependency layer and a dynamic influence layer, integrating static network topology connections with dynamic entity influence relationships. This solves the problems of traditional graphs being unable to adapt to topology changes and lacking dynamic associations, achieving deep integration of device-link-business data. Simultaneously, through a two-level strategy of dynamic baseline filtering and streaming deduplication, it eliminates invalid data interference, outputting a lightweight, high-value spatiotemporal aligned feature matrix, providing a precise data foundation for diagnostic positioning.

[0018] In the fault diagnosis dimension, we enhance model adaptability and service stability, and improve the comprehensiveness and reliability of diagnosis. The multimodal diagnostic model uses graph attention networks to weight different connection relationships, solving the problem of one-sided feature extraction in single-modality models; the prototype network small sample learning mechanism quickly adapts to new faults and expands the diagnostic coverage; the lightweight degradation guarantee mechanism automatically switches when resources are insufficient to ensure the continuous availability of diagnostic services; and the fuzzy inference system combines multiple factors to assess the fault level, optimizing the efficiency of operation and maintenance resource allocation.

[0019] Root cause localization dimensions strengthen causal logic support and improve the accuracy and credibility of root cause tracing. Heterogeneous causal graphs adopt a hybrid initialization strategy, integrating the advantages of data-driven and rule-driven approaches to construct a precise causal relationship network; a reverse tracing algorithm based on random walks avoids misjudgment of intermediate nodes and accurately locates the root cause of the fault; multi-source evidence and confidence calculation provide quantitative basis for root cause determination and enhance the interpretability of results.

[0020] In terms of system iteration, adaptive optimization and security updates are achieved to improve the system's long-term adaptability. Conditional generative adversarial networks synthesize rare fault samples to enhance the model's generalization ability. The contextual multi-armed gambling machine algorithm dynamically adjusts model parameters to adapt to changes in the network environment. The automated machine learning pipeline validates new models through shadow mode and combines periodic retraining to continuously upgrade diagnostic capabilities.

[0021] From a practical perspective, the system reduces operational complexity and improves overall network operational efficiency. It automates the entire process of data collection, diagnosis, location, and optimization, lowering the technical threshold for operations and maintenance. Precise root cause identification and fault classification prevent "alarm storms" and shorten fault repair time. Module collaboration and dynamic response capabilities make the operational process more aligned with actual network conditions, ensuring long-term stable operation. Attached Figure Description

[0022] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0023] Figure 1 This is a flowchart illustrating a network fault root cause localization system based on multimodal learning and causal inference according to the present invention. Figure 2This is an architectural diagram of the root cause localization module of the present invention; Figure 3 This is a diagram illustrating the interactive and collaborative architecture between the degradation protection mechanism and the multimodal diagnostic model of this invention. Detailed Implementation

[0024] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0025] Please see Figure 1 A network fault root cause localization system based on multimodal learning and causal inference includes a data processing and correlation mining module, an intelligent fault diagnosis and assessment module, a root cause localization module and a system optimization module connected in sequence. The data processing and association mining module collects network operation data in a distributed manner through edge computing nodes; cleans and deduplicates the network operation data; and constructs a hierarchical knowledge graph of devices-links-services based on the network resource list and topology data; and outputs a spatiotemporal alignment feature matrix associated with the knowledge graph. The intelligent fault diagnosis and assessment module receives the feature matrix and knowledge graph, and uses a multimodal diagnostic model that integrates graph neural networks to perform fault detection; the intelligent fault diagnosis and assessment module integrates a few-shot learning mechanism and outputs fault events with confidence and severity levels; The root cause localization module receives the fault event and the knowledge graph; constructs a heterogeneous causal graph based on the knowledge graph, and extracts multi-source evidence that is spatiotemporally associated with the fault event; performs confidence fusion on the multi-source evidence, and performs reverse tracing on the causal graph based on a random walk algorithm to locate the root cause node and calculate the confidence level.

[0026] The system optimization module adjusts the decision parameters of the intelligent fault diagnosis and assessment module using reinforcement learning strategies based on the root cause localization results and operation and maintenance verification feedback, and expands the training sample set based on conditional adversarial network generation; it also constructs an automated machine learning pipeline to periodically retrain, verify, and deploy the multimodal diagnostic model.

[0027] Specifically, the hierarchical knowledge graph is constructed using a dual-mode structure, which includes: The static dependency layer forms a physical and logical connection topology of device-port-link-service by parsing device attributes in the network resource list and connection relationships generated by the automatic topology discovery protocol. The dynamic influence layer analyzes the state change sequences of various entities in historical failure events, and uses transfer entropy or Granger causality analysis to calculate the intensity and direction of influence between entities, thus constructing a dynamic influence relationship network.

[0028] This embodiment uses a medium-sized enterprise campus network as the application scenario. The network covers the core network area, the access network area, and the business server area, and includes various entities such as core switches, access switches, firewalls, application servers, database servers, and network storage devices. It carries key businesses such as office automation systems, customer relationship management systems, and enterprise resource planning systems. The following details the construction process and application of the hierarchical knowledge graph static dependency layer and dynamic influence layer.

[0029] The static dependency layer focuses on the physical connections and logical dependencies of network entities, and is constructed through a dual-path approach of "resource inventory parsing + automatic topology discovery". The specific steps are as follows: Network Resource Inventory Analysis: A standardized resource inventory of the campus network is collected, and the core attribute information of each entity is extracted. Core switch attributes include device model, device location, power supply method, management IP address, number of ports, and port configurations (e.g., speed mode, VLAN affiliation, link aggregation status); application server attributes include device name, deployment location, affiliated business system, operating system type, bound IP address, and dependent network services (e.g., domain name resolution, port mapping); firewall attributes include security zone division, access control policy number, and associated internal and external network interface information. This attribute information is structured and entered into a graph database, establishing a unique identifier and basic attribute set for each entity.

[0030] Automatic Topology Connection Acquisition: A link-layer discovery protocol is enabled on all network devices to automatically collect connection information between devices. The core switch uses this protocol to identify its uplink ports and establish gigabit fiber optic connections with the firewall's external network interface, and its eight downlink ports to establish 10-gigabit twisted-pair connections with the uplink ports of different access switches. Access switches use this protocol to identify the connections between their downlink ports and office terminals and small servers within the area. Simultaneously, by calling the configuration files of each business system through the application programming interface (API), the logical dependencies between business functions and servers are extracted—for example, the office automation system relies on the load balancing service of two application servers, which in turn rely on the read / write service of a database server, which in turn has a data synchronization dependency with network storage devices.

[0031] Static topology integration: This involves associating the resolved resource attributes with automatically discovered connectivity relationships to construct a hierarchical topology of "device-port-link-service". With the core switch as the core node, it extends downwards to access switches and terminal devices, and upwards to firewalls and external network exits. At the logical level, with the business system as the top-level node, it is layered with the application servers, database servers, and network devices supporting its operation, forming a static dependency network that includes physical connection links, port configuration information, and business dependency rules. This layer is ultimately presented in a visual graph, intuitively displaying the complete dependency chain of "Office Automation System - Application Server A - Core Switch Port 2 - Access Switch B".

[0032] The dynamic impact layer is based on mining the dynamic interaction relationships between entities from historical fault data, and is achieved through state sequence analysis and causal calculation. The specific process is as follows: Historical Fault Data Collection and State Sequence Extraction: Fault event records from the past two years were collected for the campus network, resulting in six major categories of fault cases: power supply anomalies, port failures, link interruptions, and server crashes. For each type of fault, state change data of related entities was extracted to form a time-aligned state sequence. Taking the "core switch power supply module failure" case as an example, the extracted state sequence includes: the voltage value of the power supply module (normal before the fault, suddenly dropping below the threshold during the fault), the port traffic of the core switch (the traffic of the associated port instantly returned to zero after the fault), the uplink port status of the access switch (changing from "UP" to "DOWN"), the network latency of the application server (soaring from the normal range to unresponsive), and the service status of the office automation system (changing from "available" to "interrupted"). All state data is aligned to millisecond-level timestamps.

[0033] Calculation of the strength and direction of influence between entities: For the extracted state sequence, the transfer entropy algorithm is used to calculate the strength of influence transmission between entities, and Granger causality analysis is used to verify the direction of influence. In the above power supply module failure case, the calculation results show that: the transfer entropy value of the power supply module state to the core switch port state is 0.82 (the value ranges from 0 to 1, the higher the value, the stronger the influence), the transfer entropy value of the core switch port state to the access switch uplink port state is 0.76, the transfer entropy value of the access switch state to the application server network latency is 0.63, and the transfer entropy value of the application server state to the office automation system service state is 0.91. The Granger causality test results show that the above influences all exhibit unidirectional transmission characteristics, that is, the power supply module failure is the initial cause of the subsequent series of state anomalies, rather than a reverse influence.

[0034] Dynamic Influence Network Construction and Update: The calculated influence strength and direction are used as edge attributes to construct a dynamic influence relationship network. In the graph, a directed edge is established between the core switch power supply module and the core switch port, labeled "Influence Strength 0.82, Influence Direction Unidirectional"; a directed edge is established between the core switch port and the access switch, labeled "Influence Strength 0.76, Influence Direction Unidirectional," and so on, forming a complete dynamic influence chain. Simultaneously, a dynamic update mechanism is established—when a new fault occurs ("Firewall policy configuration error causing abnormal access to the CRM system"), the entity state sequence in that case is extracted immediately, the influence relationship between the firewall policy and the CRM system server and database server is calculated, and new directed edges and attributes are added to the dynamic influence layer, allowing the graph to continuously adapt to changes in network operation.

[0035] The static dependency layer and the dynamic impact layer complement each other: When a "office automation system inaccessible" fault occurs in the campus network, the static dependency layer first quickly locates the critical entities such as application servers and core switches on which the system depends, as well as their physical connection paths, ruling out the possibility of faults caused by physical link interruptions. The dynamic impact layer, based on the impact relationships constructed from historical data, prioritizes checking the power supply modules of the core switches and the status of the application servers, which have the highest impact intensity. Ultimately, it is found that the fault is caused by abnormal disk read / write operations on the application servers, rather than a problem with the core switches, significantly shortening the fault diagnosis time. The dual-mode structure ensures the stability of the topology relationship while reflecting the dynamic nature of the entity impact, providing comprehensive and accurate knowledge support for subsequent fault diagnosis and root cause localization.

[0036] Specifically, the data processing and correlation mining module adopts a two-level data simplification strategy, which includes: The first level is coarse-grained filtering based on dynamic baseline thresholds. The system establishes a dynamic baseline for key performance indicators that changes over time, and triggers detailed data collection only when the indicator deviation exceeds the baseline adaptive threshold. The second level is streaming deduplication based on sliding window and similarity hashing algorithm. It generates semantic fingerprints for each data event within a preset time window, and identifies and merges duplicate events caused by network probing cycle jitter or redundant reporting.

[0037] Specifically, the graph neural network component in the multimodal diagnostic model adopts a graph attention network. The attention network learns the importance of different connection relationships by assigning appropriate attention weights to the neighbors of each node in the knowledge graph. For any network device node, the edge connected to the power supply equipment and the edge connected to another ordinary switching equipment are assigned different weight coefficients.

[0038] Specifically, the few-shot learning mechanism is implemented as a metric learning framework based on a prototype network, which includes: During the training phase, historical fault samples of various types are mapped to a high-dimensional embedding space, and a prototype center is calculated for each fault category. When faced with a new type of fault with only a few samples, the new sample embedding is assigned to the nearest category by calculating the Euclidean distance or cosine similarity between the Euclidean distance and the prototypes of all known categories.

[0039] Specifically, the intelligent fault diagnosis and assessment module incorporates a high availability degradation protection mechanism, which includes: The protection mechanism includes a lightweight time-series anomaly detection model based on the isolated forest algorithm as a backup. When the system monitors that the continuous load on computing resources exceeds the safety threshold, or the response delay of the primary multimodal diagnostic model exceeds the service level agreement due to processing complex graph relationships, the system automatically routes the diagnostic task to the lightweight model. The lightweight model maintains the system's basic diagnostic capabilities by quickly scoring key indicators for anomalies.

[0040] Specifically, the severity level assessment of the fault event is completed by a multi-input single-output fuzzy inference system. The fuzzy inference system uses the quantified fault confidence, the affected service level protocol level, and the number and importance score of the network nodes affected by the fault as three input dimensions. Each dimension is divided into multiple fuzzy sets and defuzzified through a preset expert rule base to output the fault level.

[0041] Specifically, the directed edges and weight coefficients connecting the nodes in the heterogeneous causal graph adopt a hybrid initialization strategy, which includes: The co-occurrence probability of faults between each pair of nodes is calculated based on historical fault data as the basic weight; a decay factor based on the number of hops in the network topology is introduced to reduce the weight of connections that are physically far apart; a predefined rule base based on expert experience is constructed, and the deterministic causal relationships defined in the rule base are initialized as directed edges in the causal graph, and a high initial weight value is assigned to the directed edges.

[0042] Specifically, the reverse tracing process based on the random walk algorithm is as follows: The random walk algorithm sets multiple observed surface fault nodes as the starting point of the walker. Each step of the walker moves to a neighbor node with a preset probability or jumps back to the starting point with a restart probability. After multiple iterations, the probability distribution of each node being visited tends to stabilize, and the nodes with the highest page rank values ​​are identified as potential root causes.

[0043] In this embodiment, the power module of a core switch in a large data center is aging, which causes intermittent network latency spikes and packet loss in multiple critical business servers connected to it, resulting in a large number of sporadic alarms in the business monitoring system.

[0044] Edge collectors deployed in the core switching area and server area can detect abnormal power status alarms from switches and network latency metrics from multiple servers exceeding dynamic baseline thresholds.

[0045] The data processing module initiates two-level data simplification. First, it filters out a large amount of normal periodic performance data. Then, it performs streaming deduplication based on a sliding window for delay alarms with highly similar content caused by network jitter, which greatly reduces the analysis burden on downstream systems.

[0046] The multimodal diagnostic model began analyzing the feature matrix and knowledge graph. However, due to peak business hours, system computing resources were strained, causing the complex model's diagnostic response to slow down.

[0047] The system immediately triggered a high-availability degradation mechanism, seamlessly switching the diagnostic task to a lightweight time-series anomaly detection model based on the Isolation Forest algorithm within one second. This model quickly scored key indicators as anomalies, determining it to be a "severe network link anomaly," maintaining the continuity of basic diagnostic services and preventing the system from completely failing under pressure.

[0048] The root cause localization module constructs a heterogeneous causal graph. Based on a hybrid initialization strategy, the deterministic rule "a power outage of the core switch will inevitably lead to the loss of connection of its downstream servers," which is predefined by the operation and maintenance experts, is initialized as a directed edge with a high initial weight.

[0049] The module integrates multi-source evidence, including switch power alarms (infrastructure evidence) and server latency data (application performance evidence), and initiates a random walk algorithm. The algorithm traces back from multiple nodes exhibiting "high server latency" to the root cause. Ultimately, the probability of the walker is highly concentrated on the power module node of the core switch, which the system identifies as the root cause and assigns a confidence level of up to 95%.

[0050] Based on the system location, maintenance personnel directly replaced the power module, resolving the fault within 15 minutes, which is much faster than the traditional method of checking each server one by one.

[0051] Specifically, the system optimization module uses the context multi-armed gambling machine algorithm for strategy optimization; the context multi-armed gambling machine algorithm uses the overall state of the current network as context information to dynamically adjust the calling weights of different sub-models in the intelligent fault diagnosis and evaluation module, as well as the confidence thresholds for triggering different levels of fault events.

[0052] In this embodiment, a distributed business system experiences slow response from its underlying database, which leads to the exhaustion of the thread pool on the upstream application server. This, in turn, causes a decrease in the API success rate of the entire service chain, resulting in a complex chain of failures.

[0053] The system utilizes a hierarchical knowledge graph to clearly display the static dependency relationship of "database -> application service A -> application service B -> front-end API". Meanwhile, its dynamic impact layer, through analysis of historical data, has learned that "slow database queries" have a strong influence on upstream applications.

[0054] The Graph Attention Network (GAT) in the AI ​​diagnostic module assigned a high attention weight to the edge from "database" to "application service A" when analyzing the graph, indicating that the model considers this connection to be crucial in fault propagation.

[0055] The root cause localization module starts with multiple nodes exhibiting "low API success rates" and performs a random walk on the causal graph. Because the graph accurately depicts dependencies, the walk path is quickly guided upstream, ultimately pinpointing the database node as the root cause of the entire service avalanche.

[0056] Based on the feedback from this successful root cause localization, the system optimization module uses the contextual multi-armed gambling machine algorithm for learning.

[0057] The algorithm discovered that when the network load exhibits "database-intensive" characteristics (context), the confidence threshold for abnormal database-related indicators in the diagnostic module should be appropriately increased, and the weight of model calls relying on graph analysis should be increased. Based on this, the system dynamically adjusted the decision parameters, enabling it to pinpoint database-level issues more quickly and accurately in similar scenarios in the future.

[0058] The system not only accurately located the root cause of this complex cascading failure, but also optimized its diagnostic strategy through reinforcement learning, improving the efficiency and accuracy of handling similar problems in the future.

[0059] Specifically, the system optimization module utilizes conditional generative adversarial networks for data augmentation, and the specific method is as follows: Using the type labels and key feature profiles of historical rare faults as conditions, the generator is driven to produce synthetic fault samples. After the synthetic fault samples are verified by the discriminator, they are checked by predefined logical rules based on domain knowledge. The samples that pass the logical rule verification are injected into the training dataset.

[0060] Specifically, the automated machine learning pipeline includes a shadow mode deployment phase for the online evaluation of new multimodal diagnostic models, specifically including: During the shadow mode deployment phase, the system runs the new multimodal diagnostic model and the currently online multimodal diagnostic model in parallel, collects the outputs and root cause data of both for comparison, and makes automatic decisions based on a set of configurable strategies. The strategy stipulates that the automatic switching process can only be initiated when the new multimodal diagnostic model continuously meets the preset winning conditions in terms of precision and recall.

[0061] In this embodiment, after a microservice framework upgrade, a new type of non-fatal thread blocking fault was introduced, which caused the response time of a certain API to increase periodically, but there were no clear error logs, making it difficult for traditional monitoring to identify.

[0062] Based on feedback from the business side, the operations and maintenance personnel marked the first few cases of this fault. The small sample learning mechanism of the diagnostic module was then activated.

[0063] The prototype network-based metric learning framework compares these new samples with the prototype centers of historical faults in the embedding space. By calculating the cosine similarity, it quickly identifies them as a new type of "periodic thread blocking" fault and outputs the diagnostic results.

[0064] The fuzzy inference system begins operation. It receives three inputs: fault confidence (medium), the affected business SLA level (high, due to involvement of core transaction links), and the number of affected network nodes (low).

[0065] The system infers based on a pre-set expert rule base (e.g., "If the SLA impact is high, then the severity is at least medium") and ultimately assesses the fault as "medium" severity, which both draws sufficient attention and avoids excessive alarms.

[0066] Based on the newly identified fault, the system optimization module initiates a Conditional Generative Adversarial Network (C-GAN). Using the fault's label and features as conditions, it generates a large number of diverse synthetic fault samples, which are then validated using domain rules and injected into the training set.

[0067] Subsequently, the automated machine learning pipeline trained a new diagnostic model using the enhanced data and put it into shadow mode. The new model ran in parallel with the old model for a week, and the results showed that the new model improved the recall rate for this novel fault by more than the preset value, without introducing false positives. The system automatically triggered a process to promote the new model to the production model.

[0068] With only a few samples, the system can quickly identify and continuously learn new types of faults, ultimately achieving automated and accurate diagnosis of such faults and forming a complete "discovery-learning-optimization" closed loop.

[0069] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A network fault root cause localization system based on multimodal learning and causal inference, characterized in that, It includes a data processing and correlation mining module, an intelligent fault diagnosis and assessment module, a root cause localization module, and a system optimization module connected in sequence; The data processing and association mining module collects network operation data in a distributed manner through edge computing nodes; cleans and deduplicates the network operation data; and constructs a hierarchical knowledge graph of devices-links-services based on the network resource list and topology data; and outputs a spatiotemporal alignment feature matrix associated with the knowledge graph. The intelligent fault diagnosis and assessment module receives the feature matrix and knowledge graph, and uses a multimodal diagnostic model that integrates graph neural networks to perform fault detection; the intelligent fault diagnosis and assessment module integrates a few-shot learning mechanism and outputs fault events with confidence and severity levels; The root cause localization module receives the fault event and the knowledge graph; A heterogeneous causal graph is constructed based on the knowledge graph, and multi-source evidence that is spatiotemporally associated with the fault event is extracted. The confidence scores of the multi-source evidence are fused, and the root cause nodes are located and the confidence scores are calculated based on the random walk algorithm in the heterogeneous causal graph. The system optimization module adjusts the decision parameters of the intelligent fault diagnosis and assessment module using reinforcement learning strategies based on the root cause localization results and operation and maintenance verification feedback, and expands the training sample set based on conditional adversarial network generation; it also constructs an automated machine learning pipeline to periodically retrain, verify, and deploy the multimodal diagnostic model.

2. The system according to claim 1, characterized in that, The hierarchical knowledge graph is constructed using a dual-modal structure, specifically including: The static dependency layer forms a physical and logical connection topology of device-port-link-service by parsing device attributes in the network resource list and connection relationships generated by the automatic topology discovery protocol. The dynamic influence layer analyzes the state change sequences of various entities in historical failure events, and uses transfer entropy or Granger causality analysis to calculate the intensity and direction of influence between entities, thus constructing a dynamic influence relationship network.

3. The system according to claim 1, characterized in that, The data processing and correlation mining module employs a two-level data simplification strategy, specifically including: The first level is coarse-grained filtering based on dynamic baseline thresholds. The system establishes a dynamic baseline for key performance indicators that changes over time, and triggers detailed data collection only when the indicator deviation exceeds the baseline adaptive threshold. The second level is streaming deduplication based on sliding window and similarity hashing algorithm. It generates semantic fingerprints for each data event within a preset time window, and identifies and merges duplicate events caused by network probing cycle jitter or redundant reporting.

4. The system according to claim 1, characterized in that, The graph neural network component in the multimodal diagnostic model employs a graph attention network. This attention network differentiates the importance of different connections by assigning appropriate attention weights to the neighbors of each node in the knowledge graph. Specifically, for any network device node, the edge connected to the power supply equipment and the edge connected to another ordinary switching device are assigned different weight coefficients.

5. The system according to claim 1, characterized in that, The few-shot learning mechanism is specifically implemented as a metric learning framework based on a prototype network, which includes: During the training phase, historical fault samples of various types are mapped to a high-dimensional embedding space, and a prototype center is calculated for each fault category. When faced with a new type of fault with only a few samples, the new sample embedding is assigned to the nearest category by calculating the Euclidean distance or cosine similarity between the Euclidean distance and the prototypes of all known categories.

6. The system according to claim 1, characterized in that, The intelligent fault diagnosis and assessment module incorporates a high availability degradation protection mechanism, specifically including: The protection mechanism includes a lightweight time-series anomaly detection model based on the isolated forest algorithm as a backup. When the system monitors that the continuous load on computing resources exceeds the safety threshold, or the response delay of the primary multimodal diagnostic model exceeds the service level agreement due to processing complex graph relationships, the system automatically routes the diagnostic task to the lightweight model. The lightweight model maintains the system's basic diagnostic capabilities by quickly scoring key indicators for anomalies.

7. The system according to claim 1, characterized in that, The severity level assessment of the fault event is completed by a multi-input single-output fuzzy inference system. The fuzzy inference system uses the quantified fault confidence, the affected service level protocol level, and the number and importance score of the network nodes affected by the fault as three input dimensions. Each dimension is divided into multiple fuzzy sets and defuzzified through a preset expert rule base to output the fault level.

8. The system according to claim 1, characterized in that, The directed edges and weight coefficients connecting the nodes in the heterogeneous causal graph employ a hybrid initialization strategy, specifically including: The co-occurrence probability of faults between each pair of nodes is calculated based on historical fault data as the basic weight; a decay factor based on the number of hops in the network topology is introduced to reduce the weight of connections that are physically far apart; a predefined rule base based on expert experience is constructed, and the deterministic causal relationships defined in the rule base are initialized as directed edges in the causal graph, and a high initial weight value is assigned to the directed edges.

9. The system according to claim 1, characterized in that, The reverse tracing process based on the random walk algorithm is as follows: The random walk algorithm sets multiple observed surface fault nodes as the starting point of the walker. Each step of the walker moves to a neighbor node with a preset probability or jumps back to the starting point with a restart probability. After multiple iterations, the probability distribution of each node being visited tends to stabilize, and the nodes with the highest page rank values ​​are identified as potential root causes.

10. The system according to claim 1, characterized in that, The system optimization module uses the context multi-armed gambling machine algorithm for strategy optimization; the context multi-armed gambling machine algorithm uses the overall state of the current network as context information to dynamically adjust the calling weights of different sub-models in the intelligent fault diagnosis and assessment module, as well as the confidence thresholds for triggering different levels of fault events.

11. The system according to claim 1, characterized in that, The system optimization module utilizes conditional generative adversarial networks for data augmentation, specifically as follows: Using the type labels and key feature profiles of historical rare faults as conditions, the generator is driven to produce synthetic fault samples. After the synthetic fault samples are verified by the discriminator, they are checked by predefined logical rules based on domain knowledge. The samples that pass the logical rule verification are injected into the training dataset.

12. The system according to claim 1, characterized in that, The automated machine learning pipeline includes a shadow mode deployment phase for evaluating new multimodal diagnostic models before deployment, specifically including: During the shadow mode deployment phase, the system runs the new multimodal diagnostic model and the currently online multimodal diagnostic model in parallel, collects the outputs and root cause data of both for comparison, and makes automatic decisions based on a set of configurable strategies. The strategy stipulates that the automatic switching process can only be initiated when the new multimodal diagnostic model continuously meets the preset winning conditions in terms of precision and recall.

Images