Data processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a storage medium and electronic equipment. Relates to the field of artificial intelligence, and the method comprises the steps: obtaining a network topological graph of a target network under the condition that a network anomaly exists in the target network, nodes in the network topological graph being devices in the target network, edges representing an interaction relationship between the devices in a target time range, and attributes of the nodes being determined based on logs associated with the devices; processing the network topological graph through a graph neural network model to obtain feature vectors of nodes in the network topological graph; and based on the similarity between the feature vector of each node and a target root cause feature, determining a target device causing the network abnormality from the target network, the target root cause feature being a feature of a historical root cause device matched with the network abnormality. Through the method and the device, the problem of low root cause positioning accuracy of the network abnormality of the network in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a data processing method, apparatus, storage medium, and electronic device. Background Technology

[0002] With the rapid development of information technology and internet applications, modern network systems have become increasingly complex, including but not limited to telecommunications networks, data center networks, the Internet of Things (IoT), and cloud computing environments. These systems consist of a large number of devices and services, such as servers, routers, switches, databases, microservices, and other network infrastructure. The dynamic and high-dimensional nature of networks makes network anomaly detection an extremely challenging task.

[0003] Root cause analysis is particularly important in information technology and network operations and maintenance scenarios because the complexity of network and IT (Information Technology) systems can lead to multiple levels of indirect correlation between the manifestation of a fault or anomaly and its actual cause. For example, if an application experiences a service interruption, the direct cause might be excessive server response latency, but the root cause could be instability in the underlying network links, hardware failure, software misconfiguration, or resource contention. By accurately locating the root cause, operations personnel or automated systems can take targeted measures to fix the problem, rather than simply alleviating the symptoms. This helps improve system stability and availability, reduce the recurrence of faults, and optimize resource utilization and cost control. Currently, most traditional root cause localization techniques rely on static modeling and fixed cause-effect graphs, resulting in low accuracy in locating the root cause of network anomalies.

[0004] There is currently no effective solution to the aforementioned problems in the relevant technologies. Summary of the Invention

[0005] The main objective of this application is to provide a data processing method, apparatus, storage medium, and electronic device to solve the problem of low accuracy in locating the root cause of network anomalies in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a data processing method is provided. The method includes: when a network anomaly exists in a target network, acquiring a network topology map of the target network, wherein nodes in the network topology map are devices in the target network, edges represent the interaction relationships between devices within a target time range, and the attributes of the nodes are determined based on the logs associated with the devices; processing the network topology map using a graph neural network model to obtain feature vectors of the nodes in the network topology map; and determining the target device causing the network anomaly from the target network based on the similarity between the feature vectors of each node and target root cause features, wherein the target root cause features refer to the features of historical root cause devices that match the network anomaly.

[0007] Optionally, the data processing method further includes: using devices in the target network as nodes in the initial network topology graph; for a pair of devices in the target network, determining the interaction frequency of the devices in the pair within a target time range, wherein the pair of devices consists of any two devices in the target network; and generating edges between the corresponding nodes of the pair in the initial network topology graph when the interaction frequency is greater than the historical reference interaction frequency, thereby obtaining the network topology graph.

[0008] Optionally, the data processing method further includes: determining the node score of a node in the network topology graph based on the interaction frequency between devices in the target network within a target time range and the basic weights corresponding to the devices, wherein the node score represents the importance of the node under network anomalies; determining the anomaly contribution of a node in the network topology graph based on the anomaly event data of devices in the target network, wherein the anomaly contribution is used to represent the degree of influence of the node in network anomalies; and processing the network topology graph, node scores, and anomaly contribution through a graph neural network model to obtain the feature vector of the node in the network topology graph.

[0009] Optionally, the data processing method further includes: for each node in the network topology graph, determining the edge weights between the node and its neighboring nodes based on the interaction frequency between the node and its neighboring nodes within a target time range and the historical reference interaction frequency, wherein a neighboring node refers to a node connected to the node; determining the updated initial node score of the node based on the edge weights between the node and its neighboring nodes, the initial node score of the neighboring nodes, and the basic weight of the node, wherein each node in the network topology graph has a corresponding initial node score; repeatedly executing the step of updating the initial node score of the node based on the updated initial node score of the neighboring nodes until the iteration reaches a preset iteration condition, and then determining the latest initial node score of the node as the node score.

[0010] Optionally, the data processing method further includes: processing the network topology graph, node scores, and abnormal contribution rates to obtain the initial features of each node in the network topology graph; for node pairs in the network topology graph, determining the attention coefficient of the node pair based on the initial features and abnormal contribution rates of the nodes in the node pair, wherein the node pair consists of two connected nodes in the network topology graph; for each node in the network topology graph, updating the initial features of the node based on the attention coefficient corresponding to the node in the network topology graph to obtain the feature vector of the node.

[0011] Optionally, the data processing method also includes: determining the association weight of the node pair based on the sum of the abnormal contributions of the nodes in the node pair; and determining the attention coefficient of the node pair based on the association weight of the node pair and the initial characteristics of the nodes.

[0012] Optionally, the data processing method further includes: for each node, calculating the product between the node score and the first coefficient to obtain a first value; calculating the product between the node's abnormal contribution and the second coefficient to obtain a second value; calculating the product between the node's corresponding similarity and the third coefficient to obtain a third value; determining the root cause confidence of the node based on the first value, the second value, and the third value, and determining the target device causing the network abnormality from the target network based on the root cause confidence of each node.

[0013] To achieve the above objectives, according to another aspect of this application, a data processing apparatus is provided. The apparatus includes: an acquisition module, configured to acquire a network topology map of the target network when a network anomaly exists in the target network, wherein nodes in the network topology map are devices in the target network, edges represent the interaction relationships between devices within a target time range, and the attributes of the nodes are determined based on logs associated with the devices; a processing module, configured to process the network topology map using a graph neural network model to obtain feature vectors of the nodes in the network topology map; and a determination module, configured to determine the target device causing the network anomaly from the target network based on the similarity between the feature vectors of each node and target root cause features, wherein the target root cause features refer to the features of historical root cause devices that match the network anomaly.

[0014] Optionally, the acquisition module further includes: a first processing submodule, used to use devices in the target network as nodes in the initial network topology graph; a first determining submodule, used to determine the interaction frequency of devices in a device pair within a target time range for a device pair in the target network, wherein the device pair consists of any two devices in the target network; and a second processing submodule, used to generate edges between the corresponding nodes of the device pair in the initial network topology graph when the interaction frequency is greater than the historical reference interaction frequency, to obtain the network topology graph.

[0015] Optionally, the processing module further includes: a second determining submodule, used to determine the node score of a node in the network topology graph based on the interaction frequency between devices in the target network within a target time range and the basic weights corresponding to the devices, wherein the node score characterizes the importance of the node under network anomalies; a third determining submodule, used to determine the anomaly contribution of a node in the network topology graph based on the anomaly event data of devices in the target network, wherein the anomaly contribution characterizes the degree of influence of the node in network anomalies; and a third processing submodule, used to process the network topology graph, node scores, and anomaly contribution through a graph neural network model to obtain the feature vector of the node in the network topology graph.

[0016] Optionally, the second determining submodule further includes: a first determining unit, used to determine the edge weight between a node and its neighboring nodes for each node in the network topology graph based on the interaction frequency between the node and its neighboring nodes within a target time range and the historical reference interaction frequency, wherein a neighboring node refers to a node connected to the node; a second determining unit, used to determine the updated initial node score of a node based on the edge weight between the node and its neighboring nodes, the initial node score of the neighboring nodes, and the basic weight of the node, wherein each node in the network topology graph has a corresponding initial node score; and a third determining unit, used to repeatedly execute the step of updating the initial node score of the node based on the updated initial node score of the neighboring nodes until the iteration reaches a preset iteration condition, and then determine the latest initial node score of the node as the node score.

[0017] Optionally, the third processing submodule further includes: a first processing unit, used to process the network topology graph, node scores, and abnormal contribution rates to obtain the initial features of each node in the network topology graph; a fourth determining unit, used to determine the attention coefficient of a node pair in the network topology graph based on the initial features and abnormal contribution rates of the nodes in the node pair, wherein the node pair consists of two connected nodes in the network topology graph; and an updating unit, used to update the initial features of each node in the network topology graph based on the attention coefficient corresponding to the node in the network topology graph to obtain the feature vector of the node.

[0018] Optionally, the fourth determining unit further includes: a first determining subunit, used to determine the association weight of the node pair based on the sum of the abnormal contributions of the nodes in the node pair; and a second determining subunit, used to determine the attention coefficient of the node pair based on the association weight of the node pair and the initial features of the nodes.

[0019] Optionally, the determining module further includes: a first calculation submodule, used to calculate the product between the node score and the first coefficient for each node to obtain a first value; a second calculation submodule, used to calculate the product between the abnormal contribution of the node and the second coefficient to obtain a second value; a third calculation submodule, used to calculate the product between the similarity corresponding to the node and the third coefficient to obtain a third value; and a fourth determining submodule, used to determine the root cause confidence of the node based on the first value, the second value, and the third value, and to determine the target device causing the network abnormality from the target network based on the root cause confidence of each node.

[0020] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is provided, which includes a stored executable program, wherein, when the executable program is running, it controls the device where the computer-readable storage medium is located to perform the above-described data processing method.

[0021] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, the electronic device including a memory storing an executable program; and a processor for running the program, wherein the program executes the above-described data processing method during runtime.

[0022] To achieve the above objectives, according to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the data processing method described above.

[0023] In this embodiment, by acquiring the network topology map of the target network, the network status and device relationships of the target network within a specific time range (i.e., the target time range) are effectively determined. By processing the network topology map using a graph neural network model, feature vectors of the nodes in the network topology map are obtained. The graph neural network model can automatically learn the interactions and associations between nodes (i.e., between devices) within a specific time range, thereby achieving accurate determination of node features. By determining the target device causing the network anomaly based on the similarity between the feature vectors of each node and the target root cause features, the root cause device is identified. This achieves the determination of the root cause device based on the correlation between node features and historical reference data, thereby improving the accuracy of root cause localization of network anomalies.

[0024] Therefore, the method provided in this application achieves the goal of using graph neural networks to analyze the network topology graph of a network for root cause localization, thereby improving the accuracy of root cause localization of network anomalies and solving the technical problem of low accuracy in root cause localization of network anomalies in related technologies. Attached Figure Description

[0025] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 This is a hardware structure block diagram of a computer terminal provided according to an embodiment of this application;

[0027] Figure 2 This is a flowchart of a data processing method provided according to an embodiment of this application;

[0028] Figure 3 This is a schematic diagram of a data processing apparatus provided according to an embodiment of this application;

[0029] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0033] Example 1

[0034] According to an embodiment of this application, an embodiment of a data processing method is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a data processing method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor (MCU) or a field-programmable gate array (FPGA), etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output (I / O) interface, a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0036] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0037] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data processing method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the aforementioned data processing method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0038] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0039] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0040] Under the aforementioned operating environment, this application provides the following: Figure 2 The data processing method shown. Figure 2 This is a flowchart of the data processing method according to Embodiment 1 of this application.

[0041] Step S201: In the event of a network anomaly in the target network, obtain the network topology map of the target network. In the network topology map, the nodes are devices in the target network, the edges represent the interaction relationships between devices within the target time range, and the attributes of the nodes are determined based on the logs associated with the devices.

[0042] Optionally, electronic devices, application systems, servers, or other similar devices can be used as the execution subject of this application. In this embodiment, the target processing system is used as the execution subject to execute the above-described data processing method.

[0043] The target network can be a carrier network, a data center network, or other IT systems. The target network includes various devices such as servers, routers, switches, databases, microservices, and other network infrastructure. Network anomalies refer to performance degradation, service interruptions, or other unexpected service behaviors. A network topology diagram is a graphical representation that uses devices / system modules as nodes and edges to represent the interactions between devices, providing a visual representation of the network's connections and structure.

[0044] In an optional embodiment, the network topology of the target network is dynamically determined after a network anomaly is detected. For example, when an anomaly is detected in the target network, multi-source log data of the target network is immediately collected and analyzed. Relevant information is extracted from the multi-source log data, including device-generated log records, system status data, network traffic data, etc. By analyzing the interaction frequency and interaction patterns of devices in these log data, a network topology is constructed. In the network topology, each node represents a specific device or system module in the network, such as a base station, server, database, etc., while edges represent the real-time interaction relationships between devices or modules within a target time range. The weight of the edges can be determined based on the interaction frequency between devices. Node attributes are determined based on the logs associated with the device. Node attributes may include the device type, status, performance indicators, interaction with other devices, etc., and this information is also determined based on the log data associated with the device.

[0045] In the above method of determining the network topology, the end point of the target time range can be the time point at which a network anomaly is detected in the target network. For example, the target time range is five minutes before the network anomaly is detected.

[0046] In another optional embodiment, the network topology of the target network is dynamically determined according to a preset time interval. For example, the target processing system collects multi-source log data of the target network every 5 minutes and dynamically generates the network topology of the target network based on the collected log data. In this case, the aforementioned target time range can be the time range corresponding to the preset time interval. The end point of the target time range is the time point of the latest log collection, and the start point of the target time range is the time point of the previous log collection.

[0047] Step S202: Process the network topology graph using a graph neural network model to obtain the feature vectors of the nodes in the network topology graph.

[0048] Optionally, a graph neural network model is a special type of machine learning model that is suitable for processing graph-structured data. It can learn the embedded representations of nodes (i.e., feature vectors) and take into account the relationships between nodes.

[0049] The target processing system can input a network topology graph into a graph neural network model, which processes the network topology graph to obtain the feature vector of each node.

[0050] Step S203: Based on the similarity between the feature vectors of each node and the target root cause features, determine the target device that causes the network anomaly from the target network. Here, the target root cause features refer to the features of the historical root cause device that matches the network anomaly.

[0051] Target root cause features refer to the feature vectors of historical anomaly root causes that match the current network anomaly. They can be learned from historical data and used to compare and identify potential current anomaly root causes.

[0052] In an optional embodiment, an initial graph neural network model is trained based on a training sample set to obtain a graph neural network model. The training samples in the training sample set include at least a sample network topology graph of sample networks with network anomalies, and the ground truth labels of the training samples are the ground truth root devices of the sample networks. During training, a task head (e.g., a classifier) ​​can be appended to the initial graph neural network model, and then the entire model (initial graph neural network model + classifier) ​​can be trained using the ground truth labels. For example, the training samples are input into the initial graph neural network model to obtain the sample feature vectors of each sample node in the sample network topology graph. Then, the sample feature vectors are processed by the task head to obtain the predicted class label (whether it is a root node) of each sample node. Subsequently, loss is calculated based on the predicted class label and ground truth label of the sample node, and backpropagation is used to update the initial graph neural network model and the classifier. Finally, the trained graph neural network model can learn to generate feature vectors that are "helpful for classification".

[0053] After training the graph neural network model, the training samples can be processed based on the trained graph neural network model to obtain the features of historical root cause devices that match different types of network anomalies. A historical root cause feature library is then constructed based on the features of historical root cause devices that match different types of network anomalies.

[0054] Optionally, the target processing system can determine the target root cause features that match the network anomalies in the target network from a historical root cause feature database. Then, it calculates the similarity between the feature vectors of each node and the target root cause features, for example, using cosine similarity or other distance metrics. Based on this similarity, the target device causing the network anomaly is determined from the target network. For example, the device corresponding to the node with the highest similarity is identified as the root cause device (i.e., the target device). Alternatively, the target device can be determined by combining similarity with other evaluation data of the node.

[0055] In this embodiment, by acquiring the network topology map of the target network, the network status and device relationships of the target network within a specific time range (i.e., the target time range) are effectively determined. By processing the network topology map using a graph neural network model, feature vectors of the nodes in the network topology map are obtained. The graph neural network model can automatically learn the interactions and associations between nodes (i.e., between devices) within a specific time range, thereby achieving accurate determination of node features. By determining the target device causing the network anomaly based on the similarity between the feature vectors of each node and the target root cause features, the root cause device is identified. This achieves the determination of the root cause device based on the correlation between node features and historical reference data, thereby improving the accuracy of root cause localization of network anomalies.

[0056] Therefore, the method provided in this application achieves the goal of using graph neural networks to analyze the network topology graph of a network for root cause localization, thereby improving the accuracy of root cause localization of network anomalies and solving the technical problem of low accuracy in root cause localization of network anomalies in related technologies.

[0057] Optionally, in the data processing method provided in this application embodiment, obtaining the network topology map of the target network includes: taking devices in the target network as nodes in the initial network topology map; for device pairs in the target network, determining the interaction frequency of the devices in the device pair within a target time range, wherein the device pair consists of any two devices in the target network; and generating edges between the corresponding nodes of the device pair in the initial network topology map when the interaction frequency is greater than the historical reference interaction frequency, thereby obtaining the network topology map.

[0058] Optionally, the target processing system can identify devices in the target network, such as base stations, servers, routers, and databases, and then treat these devices as nodes in the initial network topology map. Each device or service module can be assigned a unique identifier for accurate identification and tracking in subsequent analysis and processing.

[0059] For each device pair (consisting of any two devices) in the target network, log data is collected to count the number of interactions between device A and device B within a target time range (e.g., the most recent 5 minutes). This yields the interaction frequency between the devices in the pair within the target time range, such as a log interaction frequency of 10 times per 5 minutes. Interactions can be any type of interaction, including data transmission, service calls, and state synchronization.

[0060] In an optional embodiment, the historical reference interaction frequency is a preset fixed value.

[0061] In another optional embodiment, the historical average interaction frequency is obtained based on the analysis of the historical interactions between the two devices in the device pair, and this historical average interaction frequency is determined as the historical reference interaction frequency.

[0062] If the interaction frequency between device A and device B in a device pair is greater than the historical reference interaction frequency within the target time range, then an edge is generated between the nodes corresponding to device A and device B in the initial network topology graph, indicating that there is a relatively significant interaction relationship between them. The weight of this edge can be set as the ratio between the interaction frequency and the historical reference interaction frequency, so that the difference in interaction strength between different device pairs can be reflected in the subsequent processing by the graph neural network model.

[0063] Optionally, if the interaction frequency is less than or equal to the historical reference interaction frequency, no edge is generated between the corresponding nodes in the initial network topology graph.

[0064] It should be noted that by mapping devices to nodes in the network, statistically analyzing the real-time interaction frequency of device pairs, and dynamically generating edges based on the interaction frequency, a network topology graph that can reflect the dynamic interaction relationships of network devices in real time is constructed. This method can not only capture changes in network topology but also identify critical paths for the propagation of anomalies between devices, providing a more accurate and dynamic network model foundation for subsequent root cause localization.

[0065] Optionally, in the data processing method provided in this application embodiment, the network topology graph is processed by a graph neural network model to obtain the feature vectors of the nodes in the network topology graph, including: determining the node score of the nodes in the network topology graph based on the interaction frequency between devices in the target network within a target time range and the basic weights corresponding to the devices, wherein the node score characterizes the importance of the node under network anomalies; determining the anomaly contribution of the nodes in the network topology graph based on the anomaly event data of devices in the target network, wherein the anomaly contribution is used to characterize the influence of the node in network anomalies; and processing the network topology graph, node scores, and anomaly contribution through a graph neural network model to obtain the feature vectors of the nodes in the network topology graph.

[0066] Optionally, the base weight of a device reflects its inherent importance in the network architecture. The base weight is a preset value; for example, the base weight for core network devices is 0.8, and the base weight for terminals is 0.3. The interaction frequency of a device within the target time range is obtained by analyzing log data, representing how frequently the device communicates with other devices within a specific time window. The target processing system can substitute the interaction frequency and base weight into a preset node score calculation formula to obtain the node's node score.

[0067] Optionally, the anomaly contribution of nodes in the network topology can be determined based on anomaly event data from devices in the target network. For example, anomaly event data from devices in the target network can be collected, and then the index values ​​of the anomaly events can be extracted from the data. The ratio between the index value of the device for that anomaly event and the total index value of that anomaly event in the target network can be calculated to obtain the anomaly contribution. For example, when the call drop rate of a device exceeds the standard, the anomaly contribution of that device = the number of call drops within 5 minutes (i.e., within the target time range) / the total number of call drops in the target network within 5 minutes. The aforementioned excessive call drop rate is the anomaly event, and the number of call drops is the index value of the aforementioned anomaly event. The number of call drops measures the number of unexpected interruptions to calls or data sessions caused by various reasons. The anomaly contribution reflects the magnitude of the impact of device anomalies on the overall health of the network.

[0068] For example, abnormal event data from devices in the target network is collected. Then, the index values ​​of the abnormal events are extracted from this data. The ratio of the index value of the abnormal event to the associated normal threshold is calculated to obtain the abnormal contribution. The normal threshold associated with the abnormal event can be understood as a threshold used to assess whether an abnormal event has been triggered. For example, assuming that a call drop rate exceeding 100 within 5 minutes is considered excessive, 100 would be determined as the normal threshold associated with the excessive call drop rate.

[0069] In an optional embodiment, if there is no abnormal event data in the device, a preset contribution level is determined as the abnormal contribution level of the device, for example, the preset contribution level is 0.

[0070] Optionally, after determining the node score and abnormal contribution of each node, the network topology graph, node scores, and abnormal contribution are input into the graph neural network model. The graph neural network model processes the input data to obtain the feature vectors of the nodes in the network topology graph.

[0071] It should be noted that by combining the node's score and abnormal contribution with the network topology graph to determine the node's feature vector, we can determine the node's features based on richer information about the node, thereby improving the accuracy of the determined node feature vector.

[0072] Optionally, in the data processing method provided in this application embodiment, determining the node score of a node in the network topology graph based on the interaction frequency between devices in the target network within a target time range and the basic weights corresponding to the devices includes: for each node in the network topology graph, determining the edge weight between the node and its neighboring nodes based on the interaction frequency between the node and its neighboring nodes within the target time range and the historical reference interaction frequency, wherein a neighboring node refers to a node connected to the node; determining the updated initial node score of the node based on the edge weight between the node and its neighboring nodes, the initial node score of the neighboring nodes, and the basic weight of the node, wherein each node in the network topology graph has a corresponding initial node score; repeatedly executing the step of updating the initial node score of the node again based on the updated initial node score of the neighboring nodes until the iteration reaches a preset iteration condition, and then determining the latest initial node score of the node as the node score.

[0073] Optionally, a node's neighboring nodes refer to nodes directly connected to it. In an optional embodiment, the edge weights between nodes can be calculated based on the following formula:

[0074]

[0075] Where i represents node i, and j represents node j. This represents the edge weight between nodes ij.

[0076] Optionally, the target processing system can calculate the updated initial node score based on the following formula:

[0077]

[0078] in, This represents the updated initial node score for node i. This represents the basic weight of node i. This represents the edge weight between node i and its neighbor node j. This represents the initial node score of the neighboring nodes. Optionally, each node in the network topology graph has a corresponding initial node score. In each iteration, the iteration is considered complete after it is determined that each node in the network topology graph has completed an update of its initial node score in that iteration.

[0079] If the preset iteration condition is not met during iteration, the step of updating the initial node score of the node again based on the updated initial node score of the neighboring nodes is repeated until the preset iteration condition is met. At this point, the latest initial node score of the node is determined as the node score. The aforementioned preset iteration condition can be that the iteration reaches a preset number of iterations, which can be 10.

[0080] It should be noted that the above iterative update mechanism improves the convergence and accuracy of node scores.

[0081] Optionally, in the data processing method provided in this application embodiment, the network topology graph, node scores, and abnormal contribution degrees are processed by a graph neural network model to obtain the feature vectors of the nodes in the network topology graph. This includes: processing the network topology graph, node scores, and abnormal contribution degrees to obtain the initial features of each node in the network topology graph; for node pairs in the network topology graph, determining the attention coefficient of the node pair based on the initial features and abnormal contribution degrees of the nodes in the node pair, wherein the node pair consists of two connected nodes in the network topology graph; and for each node in the network topology graph, updating the initial features of the node based on the attention coefficient corresponding to the node in the network topology graph to obtain the feature vector of the node.

[0082] In an optional embodiment, the graph neural network model is a graph neural network incorporating an attention mechanism; that is, the graph neural network model can be a Graph Attention Network (GAT) model. The network structure of the graph neural network model can be a two-layer GAT network, and its input data includes the network topology graph, the node scores of each node, and the anomaly contribution of each node. The hidden layer dimension of the graph neural network model can be 32, and the output layer dimension can be 16.

[0083] In an optional embodiment, after receiving input data, the graph neural network model first processes the input data through a first-layer GAT network. The input data includes the 3D original vectors of each node (node ​​attributes and edge weights, node scores, and anomaly contributions in the network topology graph). For example, the 3D original vectors of the nodes in the input data are linearly up-dimensionalized using a learnable first matrix to obtain the initial features of each node. Then, for node pairs in the network topology graph, the attention coefficients of the node pairs are determined based on the initial features and anomaly contributions of the nodes in the pair. After calculating the attention coefficients, a weighted aggregation method is used to calculate the intermediate features of the nodes based on the attention coefficients and the initial features of the neighboring nodes.

[0084] Optionally, intermediate features can be obtained based on the following formula:

[0085]

[0086] in, This represents the intermediate features of node i. This represents the activation function. Let i represent the set of neighboring nodes. This represents the attention coefficient between node i and its neighbor node j. This represents the initial characteristics of node j.

[0087] After obtaining the intermediate features of a node, these features are input into the first layer of the GAT network. The second layer of the GAT network processes the same process as the first layer. For example, after receiving the intermediate features, the second layer first uses a learnable second matrix to perform a linear mapping on the intermediate features, obtaining updated intermediate features. Then, based on the updated intermediate features of the nodes in the node pair and their anomaly contributions, the updated attention coefficients of the node pair are determined. Finally, a weighted aggregation method is used to calculate the node's feature vector based on the updated attention coefficients and the updated intermediate features of its neighboring nodes.

[0088] In an optional embodiment, if the graph neural network model is a single-layer GAT network structure, the intermediate features output by the first layer GAT network can be directly determined as the feature vectors of the nodes.

[0089] In another alternative embodiment, the graph neural network model can also be a regular graph neural network without an attention mechanism.

[0090] In an optional embodiment, the feature vector of a node is a 16-dimensional vector, which represents the interaction features of the node that are exceptionally strongly correlated with the network. For example, the feature vector of a node can represent at least the following interaction features:

[0091] (1) Percentage of abnormal increase in interaction latency: How much the communication latency between devices exceeds the normal level (for example, if the current latency is 300ms and the normal latency is 50ms, it is "extremely severe latency abnormality").

[0092] (2) Cross-correlation strength: Whether the anomalies of the two devices are tied together (for example, when the bit error rate of the transmission link is high, the call drop rate of the base station is also high, which is a "strong causal relationship").

[0093] (3) Percentage of abnormal interaction: The proportion of abnormal interaction between devices (high-frequency communication abnormality) to the overall abnormal cycle (e.g., the overall abnormality is 12 minutes, and the interaction abnormality accounts for 10 minutes).

[0094] (4) Collaborative coefficient of anomaly contribution: the combined force of two devices causing an anomaly (e.g., the multiplication of the respective impact of the transmission link and the base station on the anomaly, reflecting the joint effect).

[0095] (5) Abnormal fluctuation range of high frequency interaction: How much the frequency of interaction between devices deviates from the normal situation (for example, the current interaction frequency is 94% higher than normal, which is "abnormal surge in interaction").

[0096] It should be noted that the above method enables the accurate determination of the feature vectors of nodes.

[0097] Optionally, in the data processing method provided in this application embodiment, determining the attention coefficient of a node pair based on the initial characteristics and abnormal contribution of the nodes in the node pair includes: determining the association weight corresponding to the node pair based on the sum of the abnormal contributions of the nodes in the node pair; and determining the attention coefficient of the node pair based on the association weight corresponding to the node pair and the initial characteristics of the nodes.

[0098] For example, the attention coefficient of a node pair can be calculated based on the following formula:

[0099]

[0100] in, This represents the attention coefficient of a node to node ij. This indicates normalization processing. This represents the activation function. , ... Indicates to , Linear scoring, also known as correlation calculation, This represents the association weight of a node with respect to ij.

[0101] In an optional embodiment, the sum of the abnormal contributions of the nodes in a node pair is calculated, and then the sum of the abnormal contributions is divided by 2 to obtain the association weight corresponding to the node pair.

[0102] It should be noted that by calculating the association weight of node pairs and determining the attention coefficient based on this weight and the initial features of the nodes, the association weight can effectively amplify abnormal edges. It can double the attention weight between nodes with an association weight ≥ 1.2, thereby improving the accuracy of the determined attention coefficient.

[0103] Optionally, in the data processing method provided in this application embodiment, determining the target device causing network anomalies from the target network based on the similarity between the feature vectors of each node and the target root cause features includes: for each node, calculating the product between the node score and a first coefficient to obtain a first value; calculating the product between the anomaly contribution of the node and a second coefficient to obtain a second value; calculating the product between the similarity corresponding to the node and a third coefficient to obtain a third value; determining the root cause confidence of the node based on the first value, the second value, and the third value, and determining the target device causing network anomalies from the target network based on the root cause confidence of each node.

[0104] For example, the target processing system can calculate the root cause confidence of a node using the following formula: Root cause confidence = 0.3 × Node score + 0.4 × Anomaly contribution + 0.3 × Similarity. For example, if a node score of a certain transmission link is 0.92, anomaly contribution is 1.5, and similarity is 0.9 (matching the historical "transmission failure → dropped call" pattern), then the root cause confidence of that node is 0.3 × 0.92 + 0.4 × 1.5 + 0.3 × 0.9 = 0.906.

[0105] In an optional embodiment, the device corresponding to the node with the highest root cause confidence is identified as the target device causing the network anomaly.

[0106] In another optional embodiment, nodes with a similarity greater than a preset similarity threshold (e.g., 0.85) are identified as candidate nodes, and then the device corresponding to the candidate node with the highest root cause confidence is identified as the target device causing the network anomaly.

[0107] It should be noted that the above method enables accurate identification of the target equipment.

[0108] In an optional embodiment, the above application process is illustrated with a specific example. The scenario is that the call drop rate of the operator's network suddenly increases to 18% (historical threshold = 5%), and multi-source logs cover data from base stations (B023), transmission links (TL001), and core networks (MME005), requiring the identification of the root cause of the anomaly. The target processing system can perform the following steps:

[0109] (1) Dynamic topology network construction: Node basic weights: TL001=0.7, B023=0.8, MME005=0.9; Edge weights: TL001 and B023 interaction frequency = 28 times / 5 minutes (historical average = 12 times), edge weights = 28 / 12≈2.33; Node scores: After 10 iterations, TL001 score = 0.92, B023 score = 0.78, MME005 score = 0.65.

[0110] (2) Calculation of association weight and attention weight:

[0111] Correlation weights: TL001's bit error rate exceeds the standard by 50% (abnormal contribution = 1.5), and B023's call drop rate exceeds the standard by 260% (abnormal contribution = 3.6). Therefore, the correlation weights between TL001 and B023 are... =(1.5+3.6) / 2=2.55;

[0112] Attention weights: TL001 and B023 =0.75 (traditional GAT is only 0.35), and the abnormal feature of "interaction latency increasing from 50ms to 300ms" is extracted first.

[0113] (3) Calculation of root cause confidence:

[0114] TL001: Node score 0.92×0.3=0.276, anomaly contribution 1.5×0.4=0.6, similarity 0.9×0.3=0.27, total confidence = 0.276+0.6+0.27=1.146 (≥0.8).

[0115] B023: Node score 0.78×0.3=0.234, anomaly contribution 3.6×0.4=1.44, similarity 0.6×0.3=0.18, total confidence = 0.234+1.44+0.18=1.854 → Correction: Similarity = 0.5 (most B023 call drops are derivative anomalies), then confidence = 0.234+1.44+0.15=1.824 → Supplementary intervention test: After virtually repairing the TL001 error, the B023 call drop rate dropped to 4.8%, determining TL001 as the true root cause and B023 as a derivative anomaly. Adjust the B023 causal matching degree = 0.3, confidence = 0.234+1.44+0.09=1.764 (although high, it is a derivative anomaly and needs to be combined with causal chain screening).

[0116] Ultimate root cause: TL001 (confidence level 1.146), root cause link: "TL001 bit error → B023 weak signal → terminal dropped call".

[0117] Therefore, the method provided in this application achieves the goal of using graph neural networks to analyze the network topology graph of a network for root cause localization, thereby improving the accuracy of root cause localization of network anomalies and solving the technical problem of low accuracy in root cause localization of network anomalies in related technologies.

[0118] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0119] Example 2

[0120] This application also provides a data processing apparatus. It should be noted that the data processing apparatus of this application can be used to execute the data processing method provided in this application. The data processing apparatus provided in this application will be described below.

[0121] According to an embodiment of this application, an apparatus for implementing the above-described data processing method is also provided, such as... Figure 3 As shown, the device includes:

[0122] The acquisition module 301 is used to acquire a network topology map of the target network when there is a network anomaly in the target network. The nodes in the network topology map are devices in the target network, the edges represent the interaction relationships between devices within the target time range, and the attributes of the nodes are determined based on the logs associated with the devices.

[0123] The processing module 302 is used to process the network topology graph through a graph neural network model to obtain the feature vectors of the nodes in the network topology graph;

[0124] The determination module 303 is used to determine the target device that causes network anomalies from the target network based on the similarity between the feature vectors of each node and the target root cause features, wherein the target root cause features refer to the features of historical root cause devices that match the network anomalies.

[0125] In this embodiment, by acquiring the network topology map of the target network, the network status and device relationships of the target network within a specific time range (i.e., the target time range) are effectively determined. By processing the network topology map using a graph neural network model, feature vectors of the nodes in the network topology map are obtained. The graph neural network model can automatically learn the interactions and associations between nodes (i.e., between devices) within a specific time range, thereby achieving accurate determination of node features. By determining the target device causing the network anomaly based on the similarity between the feature vectors of each node and the target root cause features, the root cause device is identified. This achieves the determination of the root cause device based on the correlation between node features and historical reference data, thereby improving the accuracy of root cause localization of network anomalies.

[0126] Therefore, the method provided in this application achieves the goal of using graph neural networks to analyze the network topology graph of a network for root cause localization, thereby improving the accuracy of root cause localization of network anomalies and solving the technical problem of low accuracy in root cause localization of network anomalies in related technologies.

[0127] Optionally, in the data processing apparatus provided in this application embodiment, the acquisition module further includes: a first processing submodule, used to use devices in the target network as nodes in the initial network topology graph; a first determining submodule, used to determine the interaction frequency of devices in a device pair within a target time range for a device pair in the target network, wherein the device pair consists of any two devices in the target network; and a second processing submodule, used to generate edges between the corresponding nodes of the device pair in the initial network topology graph when the interaction frequency is greater than the historical reference interaction frequency, thereby obtaining a network topology graph.

[0128] Optionally, in the data processing apparatus provided in this application embodiment, the processing module further includes: a second determining submodule, used to determine the node score of a node in the network topology graph based on the interaction frequency between devices in the target network within a target time range and the basic weight corresponding to the device, wherein the node score characterizes the importance of the node under network anomalies; a third determining submodule, used to determine the anomaly contribution of a node in the network topology graph based on the anomaly event data of devices in the target network, wherein the anomaly contribution characterizes the degree of influence of the node in network anomalies; and a third processing submodule, used to process the network topology graph, node scores, and anomaly contribution through a graph neural network model to obtain the feature vector of the node in the network topology graph.

[0129] Optionally, in the data processing apparatus provided in this application embodiment, the second determining submodule further includes: a first determining unit, configured to determine the edge weight between a node and its neighboring nodes for each node in the network topology graph based on the interaction frequency between the node and its neighboring nodes within a target time range and the historical reference interaction frequency, wherein a neighboring node refers to a node connected to the node; a second determining unit, configured to determine the updated initial node score of a node based on the edge weight between the node and its neighboring nodes, the initial node score of the neighboring nodes, and the basic weight of the node, wherein each node in the network topology graph has a corresponding initial node score; and a third determining unit, configured to repeatedly execute the step of updating the initial node score of the node based on the updated initial node score of the neighboring nodes until the iteration reaches a preset iteration condition, and then determine the latest initial node score of the node as the node score.

[0130] Optionally, in the data processing apparatus provided in this application embodiment, the third processing submodule further includes: a first processing unit, used to process the network topology graph, node scores, and abnormal contribution degrees to obtain the initial features of each node in the network topology graph; a fourth determining unit, used to determine the attention coefficient of a node pair in the network topology graph based on the initial features and abnormal contribution degrees of the nodes in the node pair, wherein the node pair consists of two connected nodes in the network topology graph; and an updating unit, used to update the initial features of each node in the network topology graph based on the attention coefficient corresponding to the node in the network topology graph to obtain the feature vector of the node.

[0131] Optionally, in the data processing apparatus provided in the embodiments of this application, the fourth determining unit further includes: a first determining subunit, used to determine the association weight corresponding to the node pair based on the sum of the abnormal contributions of the nodes in the node pair; and a second determining subunit, used to determine the attention coefficient of the node pair based on the association weight corresponding to the node pair and the initial characteristics of the nodes.

[0132] Optionally, in the data processing apparatus provided in this application embodiment, the determining module further includes: a first calculation submodule, used to calculate the product between the node score of the node and the first coefficient for each node to obtain a first value; a second calculation submodule, used to calculate the product between the abnormal contribution degree of the node and the second coefficient to obtain a second value; a third calculation submodule, used to calculate the product between the similarity corresponding to the node and the third coefficient to obtain a third value; and a fourth determining submodule, used to determine the root cause confidence of the node based on the first value, the second value and the third value, and to determine the target device causing the network abnormality from the target network based on the root cause confidence of each node.

[0133] It should be noted that the acquisition module 301, processing module 302, and determination module 303 mentioned above correspond to steps S201 to S203 in Embodiment 1. The three modules and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0134] Example 3

[0135] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) processor 1002, memory 1004, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0136] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0137] The processor can access information and applications stored in memory via a transmission device to perform the following steps: In the event of a network anomaly in the target network, obtain a network topology map of the target network, where nodes in the network topology map represent devices in the target network, edges represent the interaction relationships between devices within a target time range, and node attributes are determined based on the logs associated with the device; process the network topology map using a graph neural network model to obtain feature vectors of the nodes in the network topology map; based on the similarity between the feature vectors of each node and the target root cause features, determine the target device causing the network anomaly from the target network, where the target root cause features refer to the features of historical root cause devices that match the network anomaly.

[0138] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: taking the devices in the target network as nodes in the initial network topology graph; for a pair of devices in the target network, determining the interaction frequency of the devices in the pair within the target time range, wherein the pair of devices consists of any two devices in the target network; if the interaction frequency is greater than the historical reference interaction frequency, generating edges between the corresponding nodes of the pair in the initial network topology graph to obtain the network topology graph.

[0139] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: determining the node score of a node in the network topology graph based on the interaction frequency between devices in the target network within a target time range and the basic weights of the devices, where the node score characterizes the importance of the node under network anomalies; determining the anomaly contribution of a node in the network topology graph based on the anomaly event data of devices in the target network, where the anomaly contribution characterizes the degree of influence of the node in network anomalies; and processing the network topology graph, node scores, and anomaly contribution through a graph neural network model to obtain the feature vector of the node in the network topology graph.

[0140] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: For each node in the network topology graph, determine the edge weight between the node and its neighboring nodes based on the interaction frequency between the node and its neighboring nodes within the target time range and the historical reference interaction frequency, where a neighboring node refers to a node connected to the node; determine the updated initial node score of the node based on the edge weight between the node and its neighboring nodes, the initial node score of the neighboring nodes, and the basic weight of the node, where each node in the network topology graph has a corresponding initial node score; repeat the step of updating the initial node score of the node based on the updated initial node score of the neighboring nodes until the iteration reaches the preset iteration condition, and then determine the latest initial node score of the node as the node score.

[0141] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: processing the network topology graph, node scores, and anomaly contributions to obtain the initial features of each node in the network topology graph; for node pairs in the network topology graph, determining the attention coefficient of the node pair based on the initial features and anomaly contributions of the nodes in the node pair, wherein the node pair consists of two connected nodes in the network topology graph; for each node in the network topology graph, updating the initial features of the node based on the attention coefficient corresponding to the node in the network topology graph to obtain the feature vector of the node.

[0142] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the association weight of the node pair based on the sum of the abnormal contributions of the nodes in the node pair; determine the attention coefficient of the node pair based on the association weight of the node pair and the initial characteristics of the nodes.

[0143] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: For each node, calculate the product between the node score and the first coefficient to obtain a first value; calculate the product between the node's abnormal contribution and the second coefficient to obtain a second value; calculate the product between the node's corresponding similarity and the third coefficient to obtain a third value; determine the root cause confidence of the node based on the first value, the second value, and the third value, and determine the target device causing the network abnormality from the target network based on the root cause confidence of each node.

[0144] In this embodiment, by acquiring the network topology map of the target network, the network status and device relationships of the target network within a specific time range (i.e., the target time range) are effectively determined. By processing the network topology map using a graph neural network model, feature vectors of the nodes in the network topology map are obtained. The graph neural network model can automatically learn the interactions and associations between nodes (i.e., between devices) within a specific time range, thereby achieving accurate determination of node features. By determining the target device causing the network anomaly based on the similarity between the feature vectors of each node and the target root cause features, the root cause device is identified. This achieves the determination of the root cause device based on the correlation between node features and historical reference data, thereby improving the accuracy of root cause localization of network anomalies.

[0145] Therefore, the method provided in this application achieves the goal of using graph neural networks to analyze the network topology graph of a network for root cause localization, thereby improving the accuracy of root cause localization of network anomalies and solving the technical problem of low accuracy in root cause localization of network anomalies in related technologies.

[0146] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0147] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0148] Example 4

[0149] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the data processing method provided in Embodiment 1.

[0150] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0151] This application also provides a computer program product, which, when executed on a data processing device, is a program adapted to perform data processing method steps.

[0152] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0153] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0155] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0156] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0157] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0158] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A data processing method, characterized in that, include: In the event of a network anomaly in the target network, a network topology map of the target network is obtained. In this map, nodes represent devices in the target network, edges represent the interaction relationships between devices within a target time range, and the attributes of the nodes are determined based on the logs associated with the devices. The network topology graph is processed by a graph neural network model to obtain the feature vectors of the nodes in the network topology graph; Based on the similarity between the feature vectors of each node and the target root cause features, the target device causing the network anomaly is determined from the target network, wherein the target root cause features refer to the features of the historical root cause device that matches the network anomaly.

2. The method according to claim 1, characterized in that, Obtain the network topology map of the target network, including: The devices in the target network are used as nodes in the initial network topology graph; For a device pair in the target network, determine the interaction frequency of the devices in the device pair within a target time range, wherein the device pair consists of any two devices in the target network; When the interaction frequency is greater than the historical reference interaction frequency, the device generates edges between the corresponding nodes in the initial network topology graph to obtain the network topology graph.

3. The method according to claim 1, characterized in that, The network topology graph is processed using a graph neural network model to obtain the feature vectors of the nodes in the network topology graph, including: Based on the interaction frequency between devices in the target network within the target time range and the basic weight of the devices, the node score of the node in the network topology graph is determined, wherein the node score represents the importance of the node under the network anomaly. The anomaly contribution of nodes in the network topology is determined based on the abnormal event data of devices in the target network, wherein the anomaly contribution is used to characterize the degree of influence of the node in the network anomaly. The network topology graph, node scores, and abnormal contribution values ​​are processed by the graph neural network model to obtain the feature vectors of the nodes in the network topology graph.

4. The method according to claim 3, characterized in that, Based on the interaction frequency between devices in the target network within a target time range and the basic weights corresponding to the devices, the node score of the nodes in the network topology graph is determined, including: For each node in the network topology graph, the edge weight between the node and its neighboring nodes is determined based on the interaction frequency between the node and its neighboring nodes within a target time range and the historical reference interaction frequency, wherein the neighboring node refers to the node connected to the node. Based on the edge weights between the node and its neighboring nodes, the initial node scores of the neighboring nodes, and the basic weights of the node, the updated initial node score of the node is determined, wherein each node in the network topology graph has a corresponding initial node score. Repeat the step of updating the initial node score of the node based on the updated initial node score of the neighboring nodes until the iteration reaches the preset iteration condition, and then determine the latest initial node score of the node as the node score.

5. The method according to claim 3, characterized in that, The network topology graph, node scores, and anomaly contribution values ​​are processed using the graph neural network model to obtain feature vectors of nodes in the network topology graph, including: The network topology graph, the node scores, and the abnormal contribution values ​​are processed to obtain the initial characteristics of each node in the network topology graph; For a node pair in the network topology graph, the attention coefficient of the node pair is determined based on the initial characteristics and abnormal contribution of the nodes in the node pair, wherein the node pair consists of two connected nodes in the network topology graph; For each node in the network topology graph, the initial features of the node are updated based on the attention coefficient corresponding to the node in the network topology graph to obtain the feature vector of the node.

6. The method according to claim 5, characterized in that, Based on the initial characteristics and anomaly contributions of the nodes in the node pair, the attention coefficient of the node pair is determined, including: The association weight of the node pair is determined based on the sum of the abnormal contributions of the nodes in the node pair. The attention coefficient of the node pair is determined based on the association weights corresponding to the node pair and the initial features of the node.

7. The method according to claim 3, characterized in that, Based on the similarity between the feature vectors of each node and the target root cause features, the target device causing the network anomaly is determined from the target network, including: For each node, the product of the node score and the first coefficient is calculated to obtain the first value; The second value is obtained by multiplying the abnormal contribution of the node by the second coefficient. Calculate the product between the similarity corresponding to the node and the third coefficient to obtain the third value; The root cause confidence of the node is determined based on the first value, the second value, and the third value, and the target device causing the network anomaly is determined from the target network based on the root cause confidence of each node.

8. A data processing apparatus, characterized in that, include: The acquisition module is used to acquire a network topology map of the target network when there is a network anomaly in the target network. The nodes in the network topology map are devices in the target network, the edges represent the interaction relationships between devices within a target time range, and the attributes of the nodes are determined based on the logs associated with the devices. The processing module is used to process the network topology graph through a graph neural network model to obtain the feature vectors of the nodes in the network topology graph; The determination module is used to determine the target device causing the network anomaly from the target network based on the similarity between the feature vectors of each node and the target root cause features, wherein the target root cause features refer to the features of historical root cause devices that match the network anomaly.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the data processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, performs the data processing method according to any one of claims 1 to 7.

Images