Intelligent business exception root cause analysis method and system combined with causal inference

Abstract

The application provides a kind of intelligent business exception root cause analysis method and system combined with causal inference, it is related to business data analysis and exception processing technical field, first, abnormal performance description and occurrence scene information are acquired, and causal inference framework is matched;Then, based on the matching result, the business related elements and historical operation records in the business system are integrated to build a causal transmission model;Then, for the business related elements in the causal transmission model, multi-dimensional causal intervention deduction is executed to generate deduction results;Then, the core trigger element is traced back to generate root cause level transmission information;Finally, the root cause level transmission information and the association rules of the causal transmission model are integrated to generate a set of business exception root cause analysis results.The application can accurately locate the root cause of business exception, provide targeted intervention measures, and improve business operation stability and efficiency.

Description

Technical Field

[0001] This invention relates to the field of business data analysis and anomaly handling technology, and more specifically, to an intelligent business anomaly root cause analysis method and system that combines causal inference. Background Technology

[0002] In the course of business operations, business anomalies occur frequently. Accurately and quickly identifying the root cause of these anomalies is crucial for ensuring stable business operations, reducing losses, and optimizing business processes. Traditional root cause analysis methods for business anomalies have many limitations.

[0003] On the one hand, most existing analytical methods rely on human experience and judgment. Business personnel need to rely on their understanding of the business and past experience to troubleshoot anomalies in complex business systems. However, as business operations continue to expand and become more complex, the scale and complexity of business systems increase dramatically. Manual troubleshooting is not only inefficient but also easily affected by subjective factors, leading to inaccurate and incomplete analysis results, making it difficult to quickly pinpoint the true root cause.

[0004] On the other hand, while some data-based root cause analysis methods can process a certain amount of data, they often lack a deep understanding of business causal relationships. These methods can usually only analyze data from the perspective of correlation, making it difficult to uncover the hidden causal logic behind the data. They cannot accurately determine which factors are the direct causes of the anomalies and which are indirectly affected through intermediate links, thus failing to provide business personnel with effective intervention measures and decision support. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a method for intelligent business anomaly root cause analysis combining causal inference, the method comprising:

[0006] Obtain the description of abnormal behavior and the information of the occurrence scenario; calculate the matching degree between the description of abnormal behavior and the information of the occurrence scenario and the applicable scenario range of multiple predefined causal inference frameworks; select the causal inference framework whose matching degree calculation result meets the preset matching conditions; and generate the matching result.

[0007] Based on the matching results, business-related elements and historical operation records in the business system are integrated to construct a causal transmission model. The causal transmission model includes element causal relationships, state transmission rules, and intervention response processes. The business-related elements include process elements, resource allocation elements, rule execution elements, and external environment elements. The historical operation records include element state change records and anomaly transmission records.

[0008] For the business-related elements in the causal transmission model, perform multi-dimensional causal intervention simulation, configure the state change scenarios of the business-related elements, simulate the change trajectory of abnormal transmission in the causal transmission model after the state change, and generate causal intervention simulation results. The causal intervention simulation results include the intervention effective scenario identifier and the abnormal transmission change trajectory record.

[0009] Based on the causal intervention deduction results, the core triggering elements in the abnormal transmission change trajectory record are traced, the elements that directly trigger the abnormality and the elements that trigger the abnormality through intermediate elements are distinguished, the hierarchical relationship and transmission path between the core triggering elements are established, and the root cause hierarchical transmission information is generated.

[0010] By integrating the root cause hierarchy transmission information with the association rules of the causal transmission model, a set of business anomaly root cause analysis results is generated. The set of business anomaly root cause analysis results includes direct root cause descriptions, fundamental root cause descriptions, hierarchical transmission path records, and targeted intervention measures.

[0011] In another aspect, embodiments of the present invention also provide an intelligent business anomaly root cause analysis system that combines causal inference, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to run the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0012] Based on the above, this embodiment of the invention acquires descriptions of abnormal behavior and occurrence scenarios, and calculates the matching degree with multiple predefined causal inference frameworks. It can select the most suitable causal inference framework for the current abnormal situation, and construct a causal transmission model based on the matching results, integrating business-related elements and historical operation records. This model covers multiple aspects such as process links, resource allocation, rule execution, and external environment, as well as historical records of element state changes and abnormal transmission, enabling the model to realistically and completely reflect the operating mechanism and causal relationships of the business system. Then, multi-dimensional causal intervention simulation is performed, configuring state change scenarios for business-related elements and simulating abnormal transmission trajectories. This allows for the prediction of the impact of different intervention measures on abnormalities in advance, tracing the core triggering elements in the abnormal transmission trajectory, establishing hierarchical relationships and transmission paths, and generating root cause hierarchical transmission information. This enables the location of the direct and fundamental root causes of business anomalies, as well as the transmission relationships between them. Finally, the root cause hierarchical transmission information is integrated with the association rules of the causal transmission model to generate a set of business anomaly root cause analysis results, helping enterprises quickly resolve business anomaly issues, optimize business processes, and improve the stability and efficiency of business operations. Attached Figure Description

[0013] Figure 1This is a schematic diagram of the execution flow of the intelligent business anomaly root cause analysis method combining causal inference provided in the embodiments of the present invention.

[0014] Figure 2 This is a schematic diagram of the hardware architecture of the intelligent business anomaly root cause analysis system that combines causal inference, provided in an embodiment of the present invention. Detailed Implementation

[0015] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating an intelligent business anomaly root cause analysis method combining causal inference provided in an embodiment of the present invention. The following is a detailed description of this intelligent business anomaly root cause analysis method combining causal inference.

[0016] Step S110: Obtain the description of the abnormal behavior and the information of the occurrence scenario. Calculate the matching degree between the description of the abnormal behavior and the information of the occurrence scenario and the applicable scenario range of multiple predefined causal inference frameworks. Select the causal inference framework whose matching degree calculation result meets the preset matching conditions and generate the matching result.

[0017] In this embodiment, a financial and tax management system is used as an example. Assume that the financial and tax management system experiences an anomaly during the monthly tax filing period. The anomaly is described as follows: "When the system automatically generates the VAT tax return, some input tax data is missing, and the time taken to generate the report is significantly longer than normal. Simultaneously, the system interface frequently displays 'data loading failed' messages." The scenario information includes: "The anomaly occurs during a fixed monthly peak period for tax filing; the affected modules are the VAT filing module and the input invoice management module; at the time of the anomaly, the memory usage of the system's backend database server is at a high level, the network transmission rate is significantly lower than normal, and multiple users are simultaneously performing input invoice authentication operations." Several predefined causal inference frameworks include a Bayesian network causal inference framework, a structural equation model causal inference framework, a counterfactual reasoning causal inference framework, and a Granger causality test framework. Each causal inference framework has a clearly defined scope of application. For example, the Bayesian network causal inference framework is suitable for scenarios where there are probabilistic dependencies between variables and uncertainty, such as data anomalies caused by complex interactions between system modules; the structural equation model causal inference framework is suitable for analyzing causal relationships between multiple latent variables, such as the combined impact of resource allocation and user behavior on system performance; the counterfactual reasoning causal inference framework is suitable for evaluating the impact of specific interventions on results, such as whether the system would still experience anomalies if a certain module were operating normally; and the Granger causality test framework is suitable for analyzing causal relationships in time series data, such as the impact of changes in server resource usage over time on system functionality.

[0018] Next, the descriptions of abnormal behavior and the information about the occurrence scenario are transformed into feature vectors. The features of the abnormal behavior description include data missing type (input tax amount), time extension ratio, and error message type (data loading failure). The features of the occurrence scenario information include time characteristics (peak declaration period), module characteristics (VAT declaration module, input invoice management module), server status characteristics (memory usage rate, network transmission rate), and user operation characteristics (multiple users authenticating simultaneously). Each predefined causal inference framework's applicable scenario scope also corresponds to a feature vector. For example, the feature vector for the applicable scenario scope of the Bayesian network causal inference framework includes features such as "multivariate probability dependency," "data uncertainty," and "module interaction anomalies."

[0019] Then, the matching degree between the feature vectors describing the abnormal behavior and the information about the occurrence scenario and the feature vectors of the applicable scenario range for each causal inference framework is calculated. The matching degree calculation uses the cosine similarity algorithm, which measures the similarity between two feature vectors by calculating the cosine value of the angle between them. For each feature dimension, the features are standardized to ensure that all feature values ​​are on the same order of magnitude. For example, features such as memory usage, network transmission rate, and time delay ratio are mapped to standardized values ​​within specific intervals. After the calculation, the matching degree values ​​of each causal inference framework are obtained, such as M1 for the Bayesian network causal inference framework, M2 for the structural equation model causal inference framework, M3 for the counterfactual reasoning causal inference framework, and M4 for the Granger causality test framework. The preset matching condition is that the matching degree is greater than or equal to a preset threshold T. By comparing the matching degree of each framework with T, the causal inference framework that meets the matching degree condition is selected as the matching result.

[0020] Step S120: Based on the matching results, integrate the business-related elements and historical operation records in the business system to construct a causal transmission model. The causal transmission model includes the causal relationship of elements, the state transmission rules, and the intervention response process. The business-related elements include process link elements, resource allocation elements, rule execution elements, and external environment elements. The historical operation records include element state change records and anomaly transmission records.

[0021] In the context of the financial and tax management system, based on the causal inference framework selected in step S110, a causal transmission model is constructed by integrating business-related elements and historical operation records. The business-related elements include process steps such as input invoice collection, invoice authentication, tax calculation, and tax return generation; resource allocation elements include database server memory, CPU resources, network bandwidth, and storage capacity; rule execution elements include invoice authentication rules, tax calculation rules, tax return generation rules, and data verification rules; and external environment elements include user concurrent operations, network stability, third-party data interface response status, and the security level of the network environment in which the system operates. The historical operation records include changes in the status of each process step (e.g., the invoice authentication step changing from "normal processing" to "processing delay"), changes in resource utilization (e.g., database server memory changing from "low utilization" to "high utilization"), and changes in the rule triggering status (e.g., data verification rules changing from "no trigger exception" to "trigger exception"). The exception transmission records include records of an exception in the invoice authentication step leading to an exception in the tax calculation step, and records of high database server memory utilization leading to an exception in the tax return generation step.

[0022] Step S121: Extract the causal structure identification rules, intervention deduction logic, and path tracing process of the causal inference framework from the matching results, as the rules and logical basis for constructing the causal transmission model.

[0023] From the causal inference framework selected in step S110, causal structure identification rules are extracted. These rules are used to determine whether a causal relationship exists between business-related elements, such as whether "high database server memory usage" is the cause of "abnormalities in the application form generation process." Intervention deduction logic is also extracted. This logic guides how to deduce the impact on the entire system when intervening in a certain element. For example, when intervening to reduce the "database server memory" usage, how to deduce the impact on the "application form generation process"? Finally, a path tracing process is extracted. This process guides how to trace the path of anomalies from the source element to the target element. For example, when an anomaly occurs in the "application form generation process," how to trace which intermediate elements the anomaly is transmitted from the source element. The extracted causal structure identification rules, intervention deduction logic, and path tracing process together constitute the rules and logical basis for constructing the causal transmission model.

[0024] Step S122: Extract business-related elements from the business system, describe the functional positioning of each business-related element, record the role of each element in the business process, its interaction with other elements, and the types of state changes it may cause, and generate a set of element functional positioning.

[0025] For the financial and tax management system, business-related elements are extracted one by one. For the input invoice collection step within the process elements, its function is to collect the enterprise's input invoice information through scanning and uploading. It is the starting point for invoice management in the business process and has a direct interaction with the invoice authentication step. The input invoice collection step transmits the collected invoice information to the invoice authentication step. Potential status changes at this step include "collection normal," "collection delay," and "collection failure." For the network bandwidth element within the resource configuration, its function is to ensure the channel capacity for data transmission between system modules and between the system and external systems. It supports all steps involving data transmission in the business process and interacts with elements such as the database server and external third-party data interfaces. Potential status changes include "sufficient bandwidth," "limited bandwidth," and "bandwidth congestion." Following this approach, the functional positioning of all business-related elements is described, recording the role, interaction relationships, and status change types of each element. This information is then integrated to generate a set of element functional positioning.

[0026] Step S123: Extract the historical operation records of the business system, filter the status change records and anomaly transmission records of elements related to business elements, organize the record content in chronological order, and generate a time-series historical operation dataset.

[0027] Historical operation records are extracted from the database of the financial and tax management system. These records contain various data from the system's operation. Based on the business-related elements extracted in step S122, records of element status changes and anomaly propagation records related to these elements are selected. For example, records of status changes related to the "invoice authentication process" (such as records where the status of this process changes from "normal" to "abnormal" at different points in time), records of status changes related to "CPU resources" (such as records of CPU resource utilization changes at different points in time), and records of anomaly propagation related to these elements (such as records where "abnormality in the invoice authentication process" propagates to "abnormality in the tax calculation process"). The selected records are arranged in chronological order. For multiple records at the same point in time, they are categorized and organized according to element type, ultimately generating a time-series historical operation dataset.

[0028] Step S124: Based on the time-series historical operation dataset, analyze the correlation of state changes among business-related elements. When a state change event of an element occurs, count the frequency of state change events of other elements within a preset time window. When the frequency exceeds a preset frequency threshold, mark the corresponding two elements as a potential causal relationship pair.

[0029] Based on the time-series historical operation dataset generated in step S123, one element is selected as the target element. The frequency of state change events occurring in other elements within a preset time window after the state change event of this element occurs is analyzed. For example, if "database server memory" is selected as the target element, and a "sudden increase in occupancy" state change event occurs in "database server memory," the frequency of a "generation delay" state change event occurring in the "application form generation stage" within a preset time window (e.g., a period after the event) is statistically analyzed. The statistically obtained frequency is compared with a preset frequency threshold. If the frequency exceeds the threshold, "database server memory" and "application form generation stage" are marked as a potential causal relationship pair. Following the same method, pairwise analysis is performed on all business-related elements to mark all potential causal relationship pairs that meet the conditions.

[0030] Step S125: Apply the causal structure identification rules in the matching results to verify potential causal relationship pairs, exclude relationship pairs that only exist in temporal sequence but have no actual transmission logic, and generate true causal relationship pairs.

[0031] The causal structure identification rules extracted in step S121 are used to verify the potential causal relationship pairs marked in step S124. For example, for the potential causal relationship pair "increased concurrent user operations" and "network bandwidth congestion," the causal structure identification rules are used to analyze whether "increased concurrent user operations" necessarily leads to "network bandwidth congestion," whether other factors are involved, and whether there is an actual transmission logic between the two (e.g., increased concurrent user operations lead to increased data transmission, which may cause network bandwidth congestion). For potential causal relationship pairs that only have a temporal sequence but no actual transmission logic, such as "upgraded security level of the system's network environment" and "abnormal input invoice collection process," verification shows that the two only occur sequentially in time, but the upgrade in security level itself does not directly lead to the abnormal input invoice collection process; therefore, this potential causal relationship pair is excluded. After verification, the remaining potential causal relationship pairs are the true causal relationship pairs.

[0032] For example, step S1251: Extract the core judgment criteria of the causal structure recognition rule from the matching results. The core judgment criteria include the causal necessity parameter of the change of element state, the interpretability basis of the transmission process, and the independence parameter that excludes interference from third-party elements.

[0033] In step S125, when applying the causal structure identification rules to verify potential causal relationships, the core judgment criteria of the causal structure identification rules are first extracted from the causal inference framework of the matching results. Among these, the causal necessity parameter of the change in the state of the element is used to measure the likelihood that a change in the state of the cause element will lead to a change in the state of the effect element; the interpretability criterion of the transmission process is used to determine whether the change in the state of the cause element leading to a change in the state of the effect element is supported by reasonable business logic or technical principles; and the independence parameter excluding interference from third-party elements is used to determine whether the causal relationship between the cause element and the effect element is independent of the influence of other third-party elements.

[0034] Step S1252: For each potential causal relationship pair, extract all feature state change records corresponding to the relationship pair from the time-series historical running dataset, and arrange them in chronological order to generate a time-series record sequence of the relationship pair.

[0035] For each potential causal pair generated in step S124, such as "network bandwidth congestion" and "abnormal input invoice collection process", all records containing the state changes of these two elements are extracted from the time-series historical operation dataset generated in step S123. These records are arranged in chronological order to form a time-series record sequence of the relationship pairs. This sequence shows the occurrence of state changes for "network bandwidth congestion" and "abnormal input invoice collection process" at different points in time.

[0036] Step S1253: Analyze the time interval distribution of the state changes of cause and effect elements in the time series record sequence of the relationship pair, statistically analyze the distribution of the time interval from the state change of cause element to the state change of effect element in the time series record sequence of the relationship pair, calculate the mode or median of the time interval as the typical time interval of the relationship pair; compare the typical time interval with the reasonable transmission time interval preset based on business rules, determine whether the typical time interval is within the reasonable transmission time interval, and obtain the time logic matching degree.

[0037] Analyze the time-series records of the relation pairs generated in step S1252. For the potential causal relationship pair of "network bandwidth congestion" (causal element) and "abnormal input invoice collection process" (effect element), statistically analyze the time interval between each change in the "network bandwidth congestion" state and the subsequent change in the "abnormal input invoice collection process" state. Calculate the mode or median of these time intervals and use them as the typical time intervals for this relation pair. Based on the business rules of the financial and tax management system, a reasonable transmission time interval (such as a certain time range) for "network bandwidth congestion" to "abnormal input invoice collection process" is preset. Compare the typical time intervals with this reasonable transmission time interval. If the typical time intervals fall within the interval, the time logic matching degree is high; otherwise, the time logic matching degree is low.

[0038] Step S1254: Based on the causal necessity parameter in the causal structure identification rule, statistically analyze the frequency of occurrence of the state change of the cause element in the time series record sequence, and calculate the numerical value of the dependence of the state change of the cause element on the state change of the effect element.

[0039] Based on the causal necessity parameter in the causal structure identification rules, in step S1252, the frequency of state changes of the effect element (e.g., "abnormal in the input invoice collection process") after a state change of the causal element (e.g., "network bandwidth congestion") is statistically analyzed in the time-series record sequence. For example, in N instances of "network bandwidth congestion," M instances are followed by a state change of "abnormal in the input invoice collection process." The dependence of the effect element's state change on the causal element's state change is calculated using the ratio of M to N. The larger this value, the higher the dependence of the effect element on the causal element, and the more certain the causal relationship.

[0040] Step S1255: Based on the interpretability of the transmission process in the causal structure identification rules, and combined with the functional positioning set of business-related elements, analyze the internal logic of how changes in the state of causal elements affect the state of resultant elements, and determine whether there is a reasonable business process or physical action to support it.

[0041] Based on the element function positioning set generated in step S122, analyze the inherent logic of how changes in element status affect the state of effect elements. For the potential causal pair of "network bandwidth congestion" and "abnormal input invoice collection process," the function of "network bandwidth" is to ensure data transmission. The "input invoice collection process" requires transmitting invoice data via the network. When network bandwidth is congested, invoice data transmission is hindered, causing the collection process to be unable to obtain complete data in a timely manner, thus triggering the abnormality. Determine whether the above inherent logic is supported by a reasonable business process (such as a business process where invoice collection relies on network transmission) to assess the interpretability of the transmission process.

[0042] For example, step S12551: Extract the functional descriptions and interaction scenarios of causal and effect elements from the functional positioning set of business-related elements, and determine the roles and collaboration methods of causal and effect elements in the business system.

[0043] From the set of element function positioning generated in step S122, extract the functional descriptions and interaction scenarios of the cause element "network bandwidth congestion" and the effect element "abnormal input invoice collection process". The functional description of "network bandwidth" is "providing a data transmission channel to ensure the rate and stability of data exchange between the system and external systems", and the interaction scenario is "interacting with the upload module of the input invoice collection process to receive uploaded invoice data". The functional description of "input invoice collection process" is "receiving, parsing, and storing input invoice data to provide a data foundation for subsequent certification and declaration", and the interaction scenario is "sending a data transmission request to the network bandwidth through the upload module to obtain transmission status feedback". The role of the cause element in the business system is determined to be "data transmission guarantor", and the role of the effect element is "data collection and processing agent". The collaboration method between the two is "the effect element relies on the transmission channel provided by the cause element to complete data collection".

[0044] Step S12552: Extract the business process steps involving causal and effect elements from the business system, arrange them in sequence to generate a business process chain, and locate the specific positions of causal and effect elements in the process.

[0045] Extract the business process steps in the financial and tax management system involving "network bandwidth" and "input invoice collection," including "user initiates input invoice upload request → upload module encapsulates invoice data → network bandwidth transmits data → input invoice collection receives data → data is parsed → data is stored." Arrange these steps sequentially to generate a business process chain, identifying the cause element "network bandwidth" as occurring after "upload module encapsulates invoice data" and before "input invoice collection receives data," and the effect element "input invoice collection" as occurring after "network bandwidth transmits data."

[0046] Step S12553: Analyze the business dependencies or indirect business relationships between causal and effect elements in the business process chain. Business dependency means that the operation of the effect element is based on the output of the causal element.

[0047] Analyze the business dependencies between causal and effect elements in the business process chain. The "receive data" step of the effect element "input invoice collection" is based on the "transmit data" output of the causal element "network bandwidth". If the network bandwidth cannot successfully transmit data, the input invoice collection step cannot receive data. Therefore, there is a direct business dependency between the two. In addition, there may also be indirect business connections, such as the transmission quality of network bandwidth affecting the accuracy of data parsing in the input invoice collection step (transmission errors may lead to data corruption).

[0048] Step S12554: Based on the interpretability of the transmission process in the causal structure identification rules, explore the inherent logic of how changes in the state of causal elements affect the state of effect elements. If it is a business process element, analyze the connection logic of the process links; if it is a resource allocation element, analyze the correlation logic of resource allocation.

[0049] Since the element "network bandwidth" belongs to the resource allocation category, based on the interpretability of the transmission process in the causal structure identification rules, we explore the inherent logic of how its state changes affect the state of the resulting element. Network bandwidth congestion (state change) leads to a decrease in data transmission rate and a reduction in the amount of data transmitted per unit time. This causes the invoice collection process to fail to receive complete invoice data within a preset time, resulting in "abnormalities in the invoice collection process" (such as "collection timeout" or "incomplete data"). The underlying logic is that insufficient resource allocation (bandwidth congestion) prevents the business processes (collection processes) that rely on this resource from obtaining the required input (complete data), thus triggering the abnormality.

[0050] Step S12555: Extract the operational specifications and technical manuals of the business system, and find explanations about the relationship between the states of causal and effect elements.

[0051] Extract the operational specifications and technical manuals of the financial and tax management system, and look for explanations regarding the relationship between "network bandwidth" and the "input invoice collection process." For example, the technical manual may explicitly state that "when the network bandwidth transmission rate is lower than a certain value, the timeout threshold for receiving input invoices will be triggered, and the system will mark it as a collection anomaly," or the operational specifications may mention that "to ensure normal input invoice collection, the network bandwidth must meet the minimum transmission rate requirement; otherwise, data loss or collection failure may occur."

[0052] Step S12556: Extract actual business experience records provided by the business domain node terminal that cause changes in the state of the cause element to lead to changes in the state of the effect element, verify the rationality of the internal action logic, and compare the state change patterns of the cause element and the effect element with the logical consistency of the business process or physical action to determine whether the state change matches the expected result of the action logic.

[0053] Actual business experience records were extracted from business domain node terminals (such as financial and tax system operation and maintenance logs and technical support work orders). For example, records such as "During multiple periods of network bandwidth congestion, the anomaly rate in the input invoice collection process increased significantly" and "After network bandwidth expansion, the number of anomalies in the input invoice collection process decreased significantly" verified the rationality of the inherent logic that "network bandwidth congestion leads to anomalies in the input invoice collection process." Comparing the state change patterns of causal and effect factors, the periods of network bandwidth congestion highly overlap with the periods of anomalies in the input invoice collection process, consistent with the "data transmission → data reception" logic in the business process. The expected result of the state change (congestion leading to anomalies) matches the actual records.

[0054] Step S12557: If there is a clear description or record in the business process chain, operation specification document, technical manual or actual business experience record that indicates that the change in the state of the cause element is a necessary condition, sufficient condition or conventional prerequisite step for triggering the change in the state of the effect element, then it is determined that the potential causal relationship meets the requirements for interpretability of the transmission process.

[0055] If, in the business process chain of step S12552, "network bandwidth transmission of data" is a necessary prerequisite step for "receiving data in the input invoice collection stage"; the technical manual of step S12555 clearly states that network bandwidth rate is a sufficient condition for the normal operation of the collection stage; and the actual business experience records of step S12556 indicate that network bandwidth congestion is a common triggering factor for abnormalities in the collection stage, then by combining this information, it is determined that the potential causal relationship between "network bandwidth congestion" and "abnormalities in the input invoice collection stage" meets the requirements for interpretability of the transmission process.

[0056] Step S12558: If there is no clear business process or physical action to support it, or if the state change pattern is inconsistent with the action logic, record the specific reasons that cannot be explained, generate an interpretability analysis report of the transmission process, and determine the analysis results, supporting evidence, or reasons for the inexplicable causes of each potential causal relationship pair.

[0057] If, for a potential causal relationship pair, no direct correlation between the causal and effect elements can be found in the business process chain, and there is no explanation of the relevant state correlation in the operational specifications and technical manuals, and the state change patterns and operational logic of the two are inconsistent in actual business experience records (e.g., after the state of the causal element changes, the state change of the effect element is irregular or contrary to expectations), then record the specific unexplainable reasons, such as "No business process connection was found between network bandwidth and invoice authentication rules, the technical manual does not mention the state correlation between the two, and experience records show that the authentication rule state does not change significantly when bandwidth changes." Generate an interpretability analysis report of the transmission process, recording in detail the analysis results (satisfied or not satisfied), supporting evidence (such as business process steps, manual descriptions, experience record summaries), or unexplainable reasons for each potential causal relationship pair.

[0058] Step S1256: Based on the independence parameter in the causal structure identification rule, filter the records of third-party element status changes in the time-series historical running dataset, and analyze whether the status changes of third-party elements will simultaneously trigger status changes of causal and effect elements in the relationship pair, so as to eliminate third-party interference.

[0059] Based on the independence parameter in the causal structure identification rules, the status change records of third-party elements (such as "server disk I / O busy") that may affect "network bandwidth congestion" and "abnormal input invoice collection process" are filtered from the time-series historical operation dataset in step S123. The analysis examines whether a change in the status of "server disk I / O busy" simultaneously triggers both "network bandwidth congestion" and "abnormal input invoice collection process." If such a situation exists, it indicates that the potential causal relationship may be affected by third-party elements and has poor independence; otherwise, the independence is relatively good.

[0060] Step S1257: Mark potential causal relationship pairs that meet the requirements of temporal logic matching degree, causal necessity parameter, transmission interpretability basis, and independence parameter as candidate true causal relationship pairs.

[0061] The potential causal relationship pairs are evaluated by combining the temporal logical matching degree of step S1253, the causal necessity parameter of step S1254, the transmission interpretability basis of step S1255, and the independence parameter of step S1256. When a potential causal relationship pair simultaneously meets the temporal logical matching degree requirement (e.g., reaching a certain threshold), the causal necessity parameter requirement (the degree of dependence reaches a certain threshold), the transmission interpretability basis requirement (there is reasonable support), and the independence parameter requirement (minor third-party interference), it is marked as a candidate true causal relationship pair.

[0062] Step S1258: Extract candidate true causal relationship pairs from the time-series historical operation dataset and sub-datasets under various preset business scenario classifications; calculate the degree of dependence of the state change of the effect element on the state change of the cause element in each sub-dataset; calculate the variance or standard deviation of the degree of dependence as a stability assessment value.

[0063] From the time-series historical operational dataset, candidate true causal relationship pairs are extracted into subsets under various preset business scenario classifications (such as application scenarios at different time periods, operation scenarios with different numbers of users, etc.). For the candidate true causal relationship pair "network bandwidth congestion" and "abnormality in the input invoice collection process," the dependence of the change in the state of the effect element on the change in the state of the cause element is calculated in subsets such as "beginning-of-month application scenario" and "end-of-month application scenario." The variance or standard deviation of these dependence values ​​is calculated. The smaller the variance or standard deviation, the more stable the performance of the candidate true causal relationship pair under different business scenarios, and the higher the stability assessment value.

[0064] Step S1259: Compare the candidate true causal relationship pairs with the rules and logical basis for constructing the causal transmission model, and verify whether the relationship pairs conform to the logical framework constraints of the model.

[0065] The candidate true causal relationship pairs marked in step S1257 are compared with the rules and logical basis for constructing the causal transmission model extracted in step S121 to verify whether the candidate true causal relationship pairs conform to the logical framework constraints of the model. For example, does the logical framework of the causal transmission model allow "network bandwidth congestion" as a cause of "abnormalities in the input invoice collection process," and is the relationship between the two consistent with the overall causal structure of the model? If the constraints are met, the verification is passed; otherwise, the candidate true causal relationship pair is excluded.

[0066] Step S12510: Integrate all verified candidate true causal relationship pairs to generate true causal relationship pairs.

[0067] All candidate true causal pairs that have passed the stability assessment in step S1258 and the logical framework constraint verification in step S1259 are integrated. These candidate true causal pairs meet the requirements in terms of temporal logic, causal necessity, interpretability, independence, stability, and model compatibility, and are determined as the final true causal pairs.

[0068] Step S126: For true causal pairs, analyze the state transmission mode between elements, record the specific process by which a state change of one element triggers a state change of another element, extract the triggering conditions, transmission delay parameters, and scope of influence of state transmission, and generate state transmission rules.

[0069] Taking the real causal relationship between "high database server memory usage" and "abnormal tax return generation" as an example, this paper analyzes the state transmission mechanism between the two. When the database server memory usage reaches a certain level (e.g., a certain percentage of total memory), it causes a delay in data reading during the tax return generation process, leading to an abnormality in that process. The specific process is recorded as follows: high database server memory usage → data reading delay → insufficient data acquisition in the tax return generation process → abnormality in the tax return generation process. The triggering condition for state transmission is "database server memory usage reaching the trigger threshold"; the transmission delay parameter is the time elapsed from the start of high database server memory usage to the occurrence of an abnormality in the tax return generation process; the scope of impact includes the affected data items in the tax return generation process (e.g., input tax data, output tax data, etc.). Following the same approach, all real causal relationships are analyzed to generate state transmission rules.

[0070] Step S127: Based on the intervention deduction logic in the matching results, set the intervention response process of the causal transmission model, define the steps of the model to simulate the transmission process, the dimensions of recording the change trajectory, and the criteria for judging the intervention effect when any element is configured to change its state.

[0071] Based on the intervention deduction logic extracted in step S121, the intervention response process of the causal transmission model is set. When any business-related element is configured to change its state, the model first records the initial state and the target state after the change. Then, according to the state transmission rules, the model simulates the impact of the change in the state of the element on its related elements in turn. For example, when "network bandwidth" is configured to change from "congested" to "sufficient", the model simulates its impact on related elements such as "input invoice collection" and "invoice authentication". During the simulation, the change trajectory is recorded from multiple dimensions, such as the time dimension (the time point of each element's state change) and the degree dimension (the severity of each element's state change). Finally, the criteria for judging the intervention effect are set. For example, when the abnormal state of the target element (such as the declaration form generation stage) disappears after the intervention, and the proportion of related elements whose states return to normal reaches a certain standard, the intervention is judged to be effective.

[0072] Step S128: Integrate the real causal relationship pairs, state transmission rules, and intervention response processes, and construct an initial causal transmission model with business-related elements as nodes and real causal relationships as connections.

[0073] The model integrates the real causal relationship pairs generated in step S125, the state transmission rules generated in step S126, and the intervention response process set in step S127. Business-related elements are used as nodes in the model, such as "input invoice collection" and "database server memory." Real causal relationships are used as connections between nodes; for example, a directed connection exists between the "high database server memory usage" node and the "abnormal declaration form generation" node, representing the causal relationship between them. An initial causal transmission model is constructed in this way, which can initially reflect the causal relationships and state transmission between business-related elements.

[0074] Step S129: Import the abnormal transmission records from the time-series historical running dataset, dynamically calibrate the initial causal transmission model, and adjust the parameters in the state transmission rules to minimize the difference between the abnormal transmission process simulated by the model and the actual process in the historical records.

[0075] Import the anomaly propagation records from the time-series historical execution dataset generated in step S123 into the initial causal propagation model. For example, import an anomaly propagation record stating "High database server memory usage caused an anomaly in the declaration form generation process." The model simulates this anomaly propagation process according to its own state propagation rules, obtaining simulated propagation delay parameters, impact range, etc. Compare the simulated results with the actual propagation delay parameters and impact range in the historical records, and calculate the difference between the two. Based on the difference, adjust the parameters in the state propagation rules, such as adjusting the trigger threshold for "high database server memory usage" causing "anomaly in the declaration form generation process," to minimize the difference between the anomaly propagation process simulated by the model and the actual process in the historical records.

[0076] Step S1210: Integrate the calibrated real causal pairs, state transmission rules, and intervention response processes to generate a causal transmission model that includes element causal relationships, state transmission rules, and intervention response processes.

[0077] After dynamic calibration in step S129, the calibrated true causal relationship pairs (the strength of some causal relationships may have been adjusted), calibrated state transmission rules (parameters optimized), and calibrated intervention response procedures (simulation steps may have been fine-tuned based on the calibrated rules) are obtained. Integrating these calibrated contents, a causal transmission model containing element causal relationships, state transmission rules, and intervention response procedures is finally generated. This model can more accurately reflect the causal relationships and state transmission patterns among business-related elements in the financial and tax management system.

[0078] Step S130: For business-related elements in the causal transmission model, perform multi-dimensional causal intervention simulation, configure the state change scenarios of business-related elements, simulate the change trajectory of abnormal transmission in the causal transmission model after the state change, and generate causal intervention simulation results. The causal intervention simulation results include the intervention effective scenario identifier and the abnormal transmission change trajectory record.

[0079] After constructing the causal transmission model, multi-dimensional causal intervention simulations are performed on business-related elements in the financial and tax management system. For example, for the resource allocation element "database server memory," its state is configured to change from "high usage" to "medium usage" and "low usage," etc.; for the rule execution element "invoice authentication rules," its state is configured to change from "strict verification" to "lenient verification" and "normal verification," etc. By simulating these state change scenarios, the trajectory of abnormal transmission in the causal transmission model is observed. For example, when the state of "database server memory" changes, is the "abnormality in the declaration form generation process" alleviated? Does the path of abnormal transmission change? These results are then used to generate causal intervention simulations.

[0080] Step S131: Extract all business-related elements and their causal relationships from the causal transmission model, record the position of each element in the causal network, related upstream and downstream elements, and generate an element relationship diagram.

[0081] From the causal transmission model generated in step S1210, extract all business-related elements, such as process elements, resource allocation elements, etc., and the causal relationships between these elements. For each element, determine its position in the causal network; for example, the "input invoice collection stage" is upstream, and the "tax declaration form generation stage" is downstream. Record the upstream and downstream elements related to each element; for example, the upstream element of the "invoice authentication stage" is the "input invoice collection stage," and the downstream element is the "tax calculation stage." Present the above information graphically to generate an element relationship diagram, which clearly shows the connections and positional distribution between the elements.

[0082] Step S132: Based on the element relationship diagram, determine the key state type of each business-related element. The key state type includes the standard state when the business system is running normally, the abnormal state that has appeared in the historical record, and the critical state that may trigger a chain reaction.

[0083] Based on the element relationship diagram generated in step S131, analyze the state type of each business-related element. For the element "network bandwidth," the standard state during normal operation of the business system is "smooth transmission, no data loss"; the abnormal state that has occurred in the historical records is "transmission delay, high data loss rate"; the critical state that may trigger a chain reaction is "transmission bandwidth is close to the maximum carrying capacity, and data transmission is occasionally interrupted." In the same way, determine the key state types for each business-related element to ensure that its typical state under different conditions is covered.

[0084] Step S133: Configure multi-dimensional state change scenarios for each business-related element. Each scenario corresponds to a key state type change. At the same time, set the triggering time, duration, and scope of impact of the scenario.

[0085] For the business-related element of "CPU resources," its key state types include "Normal Load," "High Load," and "Overload." Multi-dimensional state change scenarios are configured for it: Scenario 1: Changing the "High Load" state to "Normal Load," with the trigger timing set before the system performs large-scale data processing, the duration set for the entire data processing process, and the impact scope set for all modules that rely on CPU resources; Scenario 2: Changing the "Overload" state to "High Load," with the trigger timing set when the system issues a CPU resource alarm, the duration set for a period after the alarm is cleared, and the impact scope set for core modules that directly use CPU resources. For each business-related element, multiple state change scenarios are configured in a similar manner, with each scenario clearly defining the change method, trigger timing, duration, and impact scope of the key state type.

[0086] For example, step S1331: Extract the core functions, interaction scenarios, and state change types of each business-related element, and determine the business scope that the change in the element's state may involve.

[0087] For each business-related element, such as "storage capacity," its core function is extracted as "storing various types of data during system operation, including invoice data, declaration data, etc."; the interaction scenarios include "interacting with the data writing module to receive data and interacting with the data reading module to provide data"; and the status change types include "idle," "normal use," "near saturation," and "saturation." Based on this information, the business scope that may be involved in changes to the "storage capacity" status is determined, such as related businesses such as invoice data storage, declaration data storage, and data backup.

[0088] Step S1332: Based on the key state types of business-related elements, configure the corresponding change method for each key state type. The change methods include restoring the state to the standard state, adjusting the state to a new critical state, and switching the state to the opposite abnormal state.

[0089] Based on the key status types of the business-related elements determined in step S132, a change method is configured for each key status type. Taking the "storage capacity" element as an example, its key status types include "normal use" (standard status), "near saturation" (critical status), and "saturation" (abnormal status). The change method configured for the "saturation" abnormal status is to restore the status to the standard status (from "saturation" to "normal use"); the change method configured for "normal use" is to adjust the status to a new critical status (from "normal use" to "near saturation"); and the change method configured for "near saturation" is to switch the status to the opposite abnormal status (from "near saturation" to "idle," where "idle" is the opposite of "saturation").

[0090] Step S1333: Based on the characteristics of the business process of the business system, set the triggering time for each state change scenario.

[0091] Based on the business process characteristics of the financial and tax management system, triggering times are set for scenarios involving changes in the "storage capacity" element. For the change of "restoring the saturated state to the normal usage state", the triggering time is set before the system performs monthly data archiving, because data archiving will transfer some historical data to archive storage, which can release the current storage capacity; for the change of "adjusting the normal usage state to a near-saturated state", the triggering time is set before a large amount of new invoice data is imported into the system, at which time the system will pre-allocate storage resources, which may bring the storage capacity close to saturation.

[0092] Step S1334: Based on the continuous pattern of element state changes in historical operation records, set the duration of each state change scenario. The duration includes short-term duration, medium-term duration, and long-term duration.

[0093] Based on the continuous pattern of changes in the "storage capacity" element in historical operation records, the duration of state change scenarios is set. If the "storage capacity" changes from "near saturation" to "normal use" in the historical record and usually remains stable for a short period of time, then the duration of the scenario "restoring the saturation state to the normal use state" is set as a short duration (such as a short time range). If the "storage capacity" is adjusted to the "near saturation" state and requires a period of business operations before it changes, it is set as a medium duration (such as a medium time range). For state changes that need to be maintained for a long time, such as adjusting the state to a specific critical state for a long-term test, it is set as a long duration (such as a long time range).

[0094] Step S1335: Based on the relevant range of elements in the element relationship diagram, set the impact range of each state change scenario. The impact range includes the range that only affects itself, the range that affects directly related elements, and the range that affects all related elements in the entire chain.

[0095] Based on the element relationship diagram generated in step S131, the relevant scope of the "storage capacity" element is determined. Its directly related elements include the "data writing module" and "data reading module," while the entire chain of related elements includes all stages that depend on data storage, such as the "input invoice collection stage" and the "invoice authentication stage." For the scenario of "restoring the saturated state to normal usage," the impact is set to affect all related elements in the entire chain, because restoring storage capacity will benefit all stages that depend on storage. For the scenario of "adjusting the normal usage state to near saturation," the impact is set to affect directly related elements, only affecting the performance of the data writing and reading modules. For certain special scenarios, such as testing only the performance of the storage capacity itself, the impact is set to affect only itself.

[0096] Step S1336: For each business-related element, combine different key state type change methods, triggering times, durations, and impact ranges to generate multiple basic scenario units.

[0097] For the business-related element of "storage capacity," multiple basic scenario units are generated by combining its key state type change methods (such as "saturation → normal use" and "normal use → near saturation"), triggering timing (such as "before data archiving" and "before new data import"), duration (short-term, medium-term, and long-term), and scope of impact (itself, directly related elements, and all related elements in the entire chain). For example, basic scenario unit one: the change method is "saturation → normal use," the triggering timing is "before data archiving," the duration is short-term, and the scope of impact is all related elements in the entire chain; basic scenario unit two: the change method is "normal use → near saturation," the triggering timing is "before new data import," the duration is medium-term, and the scope of impact is directly related elements.

[0098] Step S1337: Input each basic scenario unit into the intervention response process of the causal transmission model for simulation verification; if the system reports an error or fails to generate simulation records during the simulation, it is determined to be inconsistent with the feasibility of the model simulation and is removed; compare the remaining scenario units with the predefined business constraint rule library and remove the scenario units that violate any business constraint rule; retain the scenario units that have not been removed.

[0099] Each basic scenario unit generated in step S1336 is input into the intervention response process of the causal transmission model for simulation verification. If a basic scenario unit causes a system error during simulation or fails to generate a valid simulation record (e.g., missing key data), the scenario unit is deemed not to meet the model's simulation feasibility and is removed. The remaining scenario units that pass the simulation verification are compared with a predefined business constraint rule base (e.g., "Interventions that may cause performance degradation of core modules are prohibited during peak business periods" and "Intervention measures must not violate data security specifications"). If a scenario unit violates any rule in the business constraint rule base, it is removed. All scenario units that are not removed are retained.

[0100] Step S1338: Analyze the coverage between the retained basic scene units and supplement the scene units corresponding to the key intervention angles that were not involved.

[0101] Perform a coverage analysis on the basic scenario units retained in step S1337 to check whether they cover all key intervention angles related to the business. For example, the intervention angles for the "storage capacity" element may include "increasing capacity", "reducing capacity", and "maintaining capacity stability". If the retained basic scenario units do not involve the key intervention angle of "maintaining capacity stability", supplement the corresponding scenario units (such as changing the method to "near saturation → near saturation", i.e., maintaining this state, with the triggering time being "when the system is running stably") to ensure the comprehensiveness of the scenario units.

[0102] Step S1339: Classify and organize the supplemented scenario units, group them according to the dimensions of state change method, triggering time, duration, and scope of impact, and generate a multi-dimensional state change scenario set corresponding to each business-related element.

[0103] The scenario units supplemented in step S1338 are categorized and organized according to dimensions such as state change method (e.g., recovery, adjustment, switching), triggering time (e.g., before, during, and after business operation), duration (short-term, medium-term, and long-term), and scope of impact (self, directly related, and related to the entire chain). For example, all scenario units with "recovery" change methods are grouped together, and scenario units with "before business operation" triggering time are grouped together. Through grouping, a multi-dimensional set of state change scenarios corresponding to each business-related element is generated, making the scenario units more organized and easier to manage.

[0104] Step S134: Use the initial state of business anomaly in the causal transmission model as the baseline state for intervention simulation, and record the initial trajectory of anomaly transmission under the baseline state.

[0105] Before implementing the intervention simulation, the initial state of the business anomaly in the current causal transmission model (e.g., "abnormality in the tax return generation process, with some input tax data missing") is used as the baseline state. The model records the initial trajectory of the anomaly from the source element (e.g., "high memory usage of the database server") to the target element (e.g., "tax return generation process") in this baseline state, including information such as the intermediate elements involved in the transmission process and the order of state changes of each element.

[0106] Step S135: Input the configured multi-dimensional state change scenarios into the causal transmission model one by one, start the model's intervention response process, and simulate the dynamic process of abnormal transmission after the element state changes.

[0107] The multi-dimensional state change scenarios configured in step S133 are input into the causal transmission model one by one in a certain order. For example, first input the state change scenario of "database server memory", and then input the state change scenario of "network bandwidth". For each input scenario, the model intervention response process set in step S127 is activated. The model simulates the dynamic process of anomaly transmission between elements after the element state changes, based on the state transmission rules and intervention inference logic, such as how the element state change affects upstream and downstream elements, and how the anomaly transmission path is adjusted.

[0108] Step S136: During the simulation, record the status change data of each business-related element in the model, the path adjustment information of abnormal transmission, and the change value of transmission intensity at preset time intervals to generate a scenario-based simulation record.

[0109] During the dynamic process of anomaly propagation after a change in the state of simulated elements, data is collected from the model at preset time intervals (e.g., every fixed time unit). The data records the state changes of each business-related element, such as the state of the "tax calculation stage" changing from "abnormal" to "normal"; the adjustment information of the anomaly propagation path, such as an anomaly originally propagated through "path A" now being propagated through "path B"; and the changes in the propagation intensity, such as the impact of the anomaly on the "tax return generation stage" changing from "severe" to "minor". These records are then categorized and organized according to scenarios to generate scenario-based simulation records.

[0110] Step S137: Analyze the scenario-based simulation records for each scenario, compare them with the initial trajectory under the baseline state, determine the threshold for abnormal trajectory changes based on the preset trajectory change judgment, mark the scenario where the abnormal transmission trajectory has changed, and generate an intervention effective scenario identifier.

[0111] For each scenario-based simulation record, compare it with the initial trajectory under the baseline state recorded in step S134. Analyze the changes in the abnormal transmission trajectory, such as whether the transmission path has changed or the number of involved elements has changed. Based on a preset trajectory change judgment threshold, when the degree of trajectory change exceeds the threshold, mark the scenario as a scenario where the abnormal transmission trajectory has changed, and generate a corresponding intervention effective scenario identifier to distinguish whether different scenarios have had a significant impact on abnormal transmission.

[0112] Step S138: For the scenario corresponding to the intervention effective scenario identifier, extract the abnormal transmission change details from the scenario simulation record, including the new record of the transmission path, the record of the disappearance of the transmission path, the record of the change of the transmission direction, and the record of the change of the number of elements involved in the transmission, and generate an abnormal transmission change trajectory record.

[0113] For the scenario corresponding to the intervention effective scenario identifier generated in step S137, extract the details of abnormal transmission changes from its scenario-based simulation record. For example, in a certain scenario, the abnormal transmission path adds a "data verification rule abnormality" step, while the original "invoice authentication step abnormality" path disappears. The transmission direction changes from "from resource element to process element" to "from rule element to process element," and the number of elements involved in the transmission changes from N to M. Organize the above changes to generate an abnormal transmission change trajectory record, which records the specific changes of the abnormal transmission trajectory in this scenario.

[0114] Step S139: Classify and organize all intervention effective scenario identifiers and corresponding abnormal transmission change trajectory records, group them according to the type of elements involved in the intervention and the dimension of abnormal transmission change, and generate classification inference results.

[0115] All intervention-effective scenarios and their corresponding abnormal transmission trajectory records are categorized and organized. They are grouped according to the type of elements involved in the intervention (e.g., scenarios involving resource allocation elements are grouped together, and scenarios involving rule execution elements are grouped together); and according to the dimension of abnormal transmission changes (e.g., scenarios with changes in transmission paths are grouped together, and scenarios with changes in the number of elements involved in the transmission are grouped together). This grouping and organization generates categorized inference results, making the effects and trajectory changes of different types of interventions clearer.

[0116] Step S1310: Integrate the intervention effective scenario identifiers and abnormal transmission change trajectory records from the classification and inference results to generate causal intervention inference results containing complete intervention inference information.

[0117] The categorized projection results generated in step S139 are integrated, summarizing all intervention-effective scenario identifiers and corresponding abnormal transmission change trajectory records. The integrated results are ensured to include the identifier information for each effective scenario and the complete trajectory record of abnormal transmission changes within that scenario, forming a causal intervention projection result containing complete intervention projection information.

[0118] Step S140: Based on the causal intervention deduction results, trace the core triggering elements in the abnormal transmission change trajectory record, distinguish between elements that directly trigger abnormalities and elements that trigger abnormalities through intermediate elements, establish the hierarchical relationship and transmission path between the core triggering elements, and generate root cause hierarchical transmission information.

[0119] Using the causal intervention deduction results generated in step S1310, an in-depth analysis of the abnormal transmission trajectory records is conducted to identify the core triggering factors leading to the anomalies. For example, analysis reveals that "high database server memory usage" and "abnormal data verification rules" are both core triggering factors. Further distinction is made between factors that directly trigger anomalies (such as "abnormal data verification rules" directly causing abnormal data in the declaration form) and factors that trigger anomalies through intermediate elements (such as "high database server memory usage" causing "data read delay" as an intermediate element, thus triggering anomalies in the declaration form generation). A hierarchical relationship is established between these core triggering factors, such as "high database server memory usage" at a higher level and "abnormal data verification rules" at a lower level, and the transmission paths between them are clarified, ultimately generating root cause hierarchical transmission information.

[0120] Step S141: Extract all intervention effective scenario identifiers and corresponding abnormal transmission change trajectory records from the causal intervention deduction results. Compare the abnormal transmission change trajectory records with the baseline initial trajectory, calculate the difference between the abnormal transmission change trajectory and the baseline initial trajectory in each scenario, and take the scenarios with the difference exceeding the preset difference threshold as the key analysis objects for root cause tracing.

[0121] From the causal intervention deduction results in step S1310, extract all intervention-effective scenario identifiers and corresponding abnormal transmission trajectory records. Compare the abnormal transmission trajectory record of each scenario with the baseline initial trajectory in step S134. Calculate the degree of difference by comparing the differences between the two in terms of transmission path, involved elements, and transmission intensity. When the degree of difference for a scenario exceeds a preset degree of difference threshold, it indicates that the intervention in that scenario has had a significant impact on the abnormal transmission trajectory, and it is identified as a key analysis object for root cause tracing.

[0122] Step S142: Deconstruct the abnormal transmission change trajectory record of the key analysis object, and extract the key nodes in the trajectory in chronological order. The key nodes are business-related elements whose state exceeds the preset change amplitude threshold during the abnormal transmission process.

[0123] For the key analysis objects identified in step S141, their anomaly propagation trajectory records are broken down. Following a chronological order, the status changes of each business-related element during the anomaly propagation process are examined sequentially. When the status change of an element exceeds a preset threshold, that element is marked as a critical node. For example, in the anomaly propagation trajectory of a certain scenario, the status of the "tax calculation step" changes from "minor anomaly" to "serious anomaly," and its change exceeds the preset threshold; therefore, the "tax calculation step" is identified as a critical node.

[0124] Step S143: Analyze the degree of correlation between each key node and the business anomaly. By comparing the synchronization data of node status changes and anomaly performance changes, calculate the directness of the node's impact on the anomaly.

[0125] For each key node, such as the "invoice authentication process," analyze its correlation with business anomalies (such as missing data in the declaration form). Compare the synchronization data between the time of status change in the "invoice authentication process" and the time of occurrence of the anomaly (missing data). If the two times are highly consistent, it indicates a high degree of correlation. Based on factors such as synchronization data and the node's position in the transmission path, calculate the numerical value of the node's direct impact on the anomaly. The larger this value, the greater the direct impact of the node on the anomaly.

[0126] Step S144: Based on the directness of the impact value and according to the preset direct impact judgment threshold, distinguish between elements that directly trigger anomalies and elements that trigger anomalies through intermediate elements. Elements that directly trigger anomalies refer to nodes that immediately cause changes in abnormal behavior after a change in state. Elements that trigger anomalies through intermediate elements refer to nodes that need to be transmitted through other nodes after a change in state to affect the anomaly.

[0127] Based on the direct impact value calculated in step S143, and combined with the preset direct impact judgment threshold, key nodes are classified. When the direct impact value of a node exceeds the threshold, it is determined to be a direct triggering element for anomalies. For example, if a change in the "data verification rule anomaly" status immediately leads to missing data in the declaration form, it is a direct triggering element for anomalies. When the direct impact value does not exceed the threshold, it indicates that the change in the node's status requires transmission through other nodes to affect the anomaly, and it is determined to be a triggering element for anomalies through transmission through intermediate elements. For example, "high database server memory usage" requires transmission through the "data read delay" node to affect the generation of the declaration form.

[0128] Step S145: Extract the relationship data between the elements that directly trigger the anomaly and the elements that trigger the anomaly through intermediate elements, record the specific process by which the latter acts on the former through intermediate nodes, and generate the element transmission chain.

[0129] Extract the relationship data between elements that directly trigger anomalies (such as "data validation rule anomaly") and elements that trigger anomalies through intermediate elements (such as "high database server memory usage"). Record the specific process by which "high database server memory usage" affects "data validation rule anomaly" through the intermediate node of "data read latency": high database server memory usage leads to data read latency, and the data validation rule triggers an anomaly due to excessive waiting time when reading data. Record this process in the form of a chain, generating an element transmission chain that clearly shows the interaction path between elements.

[0130] For example, step S1451: take the element that directly triggers the exception as the end point of the chain, and take the element that triggers the exception through the intermediate element as the starting point of the chain, and preliminarily screen possible connection paths based on the element relationship diagram.

[0131] The element that directly triggers the exception (such as "data validation rule exception") determined in step S144 is taken as the end point of the chain, and the element that triggers the exception through intermediate elements (such as "database server high memory usage") is taken as the starting point of the chain. Based on the element relationship graph generated in step S131, all possible connection paths from the starting element to the ending element are searched, and possible paths are initially filtered out, such as "database server high memory usage → data read delay → data validation rule exception" and "database server high memory usage → cache module exception → data validation rule exception", etc.

[0132] Step S1452: Extract abnormal transmission change trajectory records related to the starting point and ending point elements from the causal intervention inference results, locate the intermediate node connecting the starting point and ending point in the trajectory, and the intermediate node is the business-related element whose state exceeds the preset change amplitude threshold during the transmission process.

[0133] From the causal intervention deduction results in step S1310, extract the abnormal transmission change trajectory records related to the starting element "high database server memory usage" and the ending element "abnormal data verification rules". In these trajectory records, find the intermediate nodes connecting the starting and ending points. These intermediate nodes are business-related elements whose states change beyond a preset threshold during the transmission process. For example, in a certain trajectory record, the state change of "data read delay" exceeds the preset threshold, therefore it is identified as an intermediate node.

[0134] Step S1453: Arrange the starting point elements, intermediate nodes, and ending point elements according to the time sequence in the abnormal transmission change trajectory record to generate a preliminary transmission sequence.

[0135] Based on the intermediate nodes located in step S1452, the starting point elements, intermediate nodes, and ending point elements are arranged according to the time sequence in the abnormal transmission change trajectory record. For example, in the trajectory record, the "database server memory high usage" state change occurs first, followed by the "data read delay" state change, and finally the "data verification rule abnormality" state change. Therefore, the initial transmission sequence is generated as "database server memory high usage → data read delay → data verification rule abnormality".

[0136] Step S1454: Analyze the state transmission mode between adjacent elements in the preliminary transmission sequence, and record the specific process by which the state change of the previous element triggers the state change of the next element, in conjunction with the state transmission rules of the causal transmission model.

[0137] Based on the state propagation rules of the causal propagation model in step S1210, analyze the state propagation mode between adjacent elements in the initial propagation sequence. For the two adjacent elements "high database server memory usage" and "data read latency," the state propagation rule may stipulate that "when the database server memory usage exceeds a certain threshold, the response time of data read operations will be prolonged." Record the specific process by which the state change of the former element "high database server memory usage" (usage rate changes from "normal" to "high") triggers the state change of the latter element "data read latency" (response time changes from "normal" to "latent"): High memory usage leads to a decrease in data cache hit rate, requiring frequent data reads from the disk, thereby prolonging the data read response time.

[0138] Step S1455: Compare the initial transmission sequence with the causal relationships of the elements in the causal transmission model, and adjust the transmission sequence to ensure that the transmission of each link is consistent with the causal relationships of the elements in the model.

[0139] Compare the preliminary transmission order generated in step S1453 with the causal relationships of the elements in the causal transmission model. If "caching module anomaly" is one of the causes of "data read delay" in the causal transmission model, and "caching module anomaly" is not included in the preliminary transmission order, but the anomaly transmission change trajectory record shows that "caching module anomaly" also participated in the transmission process, then adjust the transmission order and add "caching module anomaly" to the intermediate node so that the transmission order is consistent with the causal relationships of the elements in the model.

[0140] Step S1456: Supplement the missing details in the preliminary conduction sequence, including the triggering conditions, conduction delay parameters, and state change amplitudes for each conduction stage, to make the conduction process description complete.

[0141] Based on the adjusted transmission sequence in step S1455, supplement the detailed information for each transmission link. For the transmission link of "high memory usage of database server → data read delay", the trigger condition is supplemented as "memory usage exceeds threshold T for N consecutive time units", the transmission delay parameter is "the time interval from when memory usage exceeds the threshold to when data read delay occurs", and the state change magnitude is "the data read delay time increases by a certain percentage". Supplement similar detailed information for each link in the transmission sequence to ensure a complete description of the transmission process.

[0142] Step S1457: Identify possible branch paths in the transmission sequence, that is, the path through which the starting element combines with multiple intermediate nodes to act on the ending element, and record the specific content of each branch path.

[0143] Identify potential branch paths within the transmission sequence. For example, the starting element "high database server memory usage" may affect the ending element not only through the path "data read latency → data validation rule anomaly," but also through the branch path "CPU resource contention → data processing latency → data validation rule anomaly." Record the details of each branch path, including intermediate nodes, transmission sequence, and transmission link details.

[0144] Step S1458: For each branch path, extract the product or weighted sum of the state change amplitudes of all nodes on the branch path from the abnormal transmission change trajectory record, and use it as the transmission intensity value of the branch path; sort all branch paths according to their transmission intensity values, mark the paths with a ranking higher than the preset rank threshold as the main transmission paths, and mark the rest as secondary transmission paths.

[0145] For each branch path identified in step S1457, the state change amplitude of all nodes on that path is extracted from the abnormal propagation trajectory record. For example, for the branch path "high database server memory usage → data read delay → abnormal data verification rule", the state change amplitude A of "high database server memory usage", the state change amplitude B of "data read delay", and the state change amplitude C of "abnormal data verification rule" are extracted. A×B×C (product) or A×weight1+B×weight2+C×weight3 (weighted sum) is calculated as the propagation strength value of that branch path. The propagation strength values ​​of all branch paths are sorted (e.g., from largest to smallest). Paths with a ranking higher than a preset threshold (e.g., top 20%) are marked as primary propagation paths, and the rest are marked as secondary propagation paths.

[0146] Step S1459: Integrate the main transmission path and the secondary transmission path to generate an element transmission chain with the starting element as the source, the ending element as the target, and including all key intermediate nodes and transmission links.

[0147] The primary and secondary transmission paths marked in step S1458 are integrated, taking into account all key intermediate nodes (nodes whose state changes exceed the threshold) and transmission links (state transmission between adjacent elements) in all paths. An element transmission chain is generated with the starting element as the source and the ending element as the target. This chain includes all intermediate nodes and transmission links that have a significant impact on the transmission of anomalies, fully demonstrating how the starting element affects the ending element through different paths.

[0148] Step S14510: Label the attributes of each node in the feature transmission chain and the rules of each transmission link, and generate a feature transmission chain that reflects the complete process of the feature that triggers the anomaly through the transmission of intermediate features acting on the feature that directly triggers the anomaly.

[0149] In the element transmission chain generated in step S1459, the attributes of each node are labeled. For example, the attribute of "high database server memory usage" is "resource configuration element, memory capacity is a certain value," and the attribute of "data read delay" is "process link element, belonging to the data processing module." The rules for each transmission link are also labeled. For example, the transmission rule for "high database server memory usage → data read delay" is "memory usage rate and data read delay time are positively correlated, and the correlation coefficient is a certain value." Through labeling, an element transmission chain is generated that reflects the complete process of the element that triggers the anomaly through intermediate elements acting on the element that directly triggers the anomaly.

[0150] Step S146: Based on the element transmission chain, construct a hierarchical structure of core triggering elements, take the elements that trigger the anomaly through intermediate elements as the upper level, and the elements that directly trigger the anomaly as the lower level, and define the subordinate relationship between each level.

[0151] Based on the element transmission chain generated in step S145, construct a hierarchical structure of core triggering elements. Elements that trigger anomalies through intermediate elements, such as "high database server memory usage" and "network bandwidth congestion," are classified as upper-level elements; elements that directly trigger anomalies, such as "data validation rule anomaly" and "tax calculation rule anomaly," are classified as lower-level elements. Clarify the hierarchical relationship between upper-level and lower-level elements; that is, upper-level elements act on lower-level elements through intermediate nodes, and lower-level elements directly cause business anomalies.

[0152] Step S147: Trace the transmission path of the core triggering elements in each level, and record in detail the specific process of the element state change being transmitted from the upper level to the lower level, including the intermediate nodes involved, the transmission order, and the state change content of each link.

[0153] For the upper-level element "network bandwidth congestion" and the lower-level element "abnormality in the input invoice collection process," the transmission path between them is traced. The transmission process is recorded in detail: network bandwidth congestion → input invoice data upload delay → incomplete data reception in the input invoice collection process → abnormality in the input invoice collection process. The intermediate node involved is "input invoice data upload delay." The transmission order is: network bandwidth congestion occurs first, then leads to data upload delay, which in turn causes incomplete data reception in the collection process, ultimately leading to the abnormality in the collection process. The state changes of each step are also recorded in detail in the transmission path.

[0154] Step S148: Integrate the hierarchical structure and transmission path, mark the hierarchical position of each core triggering element, the corresponding transmission path details, and the relationship with other elements, and generate a hierarchical transmission relationship diagram.

[0155] Integrate the hierarchical structure constructed in step S146 and the transmission path traced in step S147. In the hierarchical transmission relationship diagram, mark the hierarchical position (upper or lower level) of each core triggering element, as well as the details of the corresponding transmission path (such as intermediate nodes involved, transmission order, etc.). Simultaneously, mark the relationships between each core triggering element and other elements, such as the relationship between "network bandwidth congestion" and "delay in uploading input invoice data," and the relationship between "delay in uploading input invoice data" and "abnormalities in the input invoice collection process," thus generating a complete hierarchical transmission relationship diagram.

[0156] Step S149: Compare the hierarchical transmission relationship diagram with the causal intervention inference results, adjust the hierarchical relationships and transmission paths in the relationship diagram to make them consistent with the information in the abnormal transmission change trajectory record, and supplement the relationship diagram details based on the element causal relationship of the causal transmission model.

[0157] Compare the hierarchical transmission relationship diagram generated in step S148 with the causal intervention inference results in step S1310. Check whether the hierarchical relationships in the diagram are consistent with the influence levels of the elements in the inference results, and whether the transmission paths match the actual paths recorded in the abnormal transmission change trajectory records. If inconsistencies exist, adjust the hierarchical relationships and transmission paths. Simultaneously, based on the causal relationships of the elements in the causal transmission model of step S1210, supplement any missing element association details in the relationship diagram to ensure that the hierarchical transmission relationship diagram accurately reflects the causal connections between elements.

[0158] Step S1410: Integrate the hierarchical structure, transmission path, and core triggering element attributes after comparison and supplementation to generate root cause hierarchical transmission information that includes the direct root cause hierarchy, the fundamental root cause hierarchy, and the inter-hierarchical transmission path.

[0159] Integrate the hierarchical structure (upper-level root cause hierarchy and lower-level direct cause hierarchy) after comparison and supplementation in step S149, the transmission paths between each level, and the attributes of core triggering elements (such as element type, state characteristics, etc.). Organize this information in a structured manner to generate root cause hierarchy transmission information. This information clearly shows which elements are included in the direct cause hierarchy, which elements are included in the root cause hierarchy, and how the elements in the root cause hierarchy affect the elements in the direct cause hierarchy through the inter-level transmission paths.

[0160] Step S150: Integrate the root cause hierarchy transmission information with the association rules of the causal transmission model to generate a set of business anomaly root cause analysis results. The set of business anomaly root cause analysis results includes direct root cause description, fundamental root cause description, hierarchical transmission path record, and targeted intervention measures.

[0161] Combining the root cause hierarchy information generated in step S1410 with the association rules (such as element causal relationships, state transmission rules, etc.) of the causal transmission model in step S1210, a comprehensive analysis of the root causes of business anomalies is conducted. The specific details of the direct root causes, the specific details of the fundamental root causes, the hierarchical transmission paths between root causes, and the targeted intervention measures that can be taken for the aforementioned root causes are described. The above content is then integrated to generate a set of business anomaly root cause analysis results.

[0162] Step S151: Extract the core triggering elements of the direct root cause level from the root cause level transmission information, combine the causal relationship and functional positioning of these elements in the causal transmission model, describe in detail the attribute characteristics, abnormal state manifestations, and direct effects on business anomalies of each direct root cause, and generate a direct root cause description.

[0163] From the root cause hierarchy information in step S1410, extract the core triggering elements of the direct root cause hierarchy, such as "data verification rule anomaly". Combining the causal relationship of this element in the causal transmission model (there is a causal relationship with the "declaration form generation stage") and its functional positioning (responsible for verifying the accuracy and completeness of declaration data), describe in detail its attribute characteristics (belongs to the rule execution element, which verifies the data based on a preset algorithm), abnormal status manifestation (the verification result of some input tax data is incorrect, and the data is misjudged as incomplete), and the direct impact on business anomalies (causing data that fails verification to be excluded from the declaration form, resulting in data loss), and generate a direct root cause description.

[0164] Step S152: Extract the core triggering elements of the root cause level in the root cause hierarchy transmission information, describe the attribute characteristics, abnormal state performance, and process of transmission to the direct root cause through intermediate elements based on the state transmission rules of the causal transmission model, and generate a root cause description.

[0165] Extract the core triggering elements of the root cause level in the root cause hierarchy transmission information, such as "high memory usage of the database server". Based on the state transmission rules of the causal transmission model, describe its attribute characteristics (belonging to resource allocation elements, providing memory space for system data storage and retrieval), abnormal state manifestations (memory usage rate is consistently high, and available memory space is insufficient), and the process of transmission through intermediate elements to the direct root cause (high memory usage leads to data read delays, and data verification rules trigger anomalies due to data timeouts), and generate a root cause description.

[0166] Step S153: Extract the inter-level transmission paths from the root cause hierarchical transmission information, combine the causal relationships of the elements in the causal transmission model, and record in detail each node in the path, the transmission rules between nodes, and the state change data during the transmission process in the transmission order to generate a hierarchical transmission path record.

[0167] Extract inter-level transmission paths from the root cause hierarchy information, such as "high database server memory usage → data read latency → data validation rule anomaly". Combining the causal relationships of the elements in the causal transmission model ("high database server memory usage" is the cause of "data read latency", and "data read latency" is the cause of "data validation rule anomaly"), record in detail each node in the path (database server memory, data read stage, data validation rule), the transmission rules between nodes (high memory usage leads to reduced data read speed, and read latency exceeding the waiting threshold of the data validation rule triggers a rule anomaly), and the state change data during the transmission process (database server memory changes from "normal usage" to "high usage", data read stage changes from "normal speed" to "lagging speed", and data validation rule changes from "normal validation" to "abnormal validation"), generating a hierarchical transmission path record.

[0168] Step S154: For each direct cause in the description of direct causes, based on the intervention response process of the causal transmission model, construct intervention measures that can change the abnormal state of the direct cause, and define the implementation targets, implementation methods, and implementation steps of the measures.

[0169] To address the "data validation rule anomaly" described as the direct root cause, an intervention measure is constructed based on a causal transmission model. The target is defined as the "data validation rule"; the implementation method involves adjusting the rule's validation parameters and optimizing the validation algorithm. The implementation steps include: first, backing up the current data validation rule's configuration parameters; second, analyzing the parameters causing the validation anomaly, such as the data waiting timeout threshold; third, adjusting the timeout threshold parameter to extend the waiting time; fourth, restarting the data validation service and applying the new configuration parameters; and fifth, monitoring the rule's running status to verify whether the anomaly has been resolved. These steps construct an intervention measure capable of changing the state of the direct root cause anomaly.

[0170] Step S155: For each root cause in the root cause description, extract its corresponding transmission path in the hierarchical transmission path record; on the transmission path, identify one or more key intermediate nodes on which the state change transmission depends; for each key intermediate node, generate an intervention instruction, which includes: the target node identifier to be operated, the time conditions for instruction execution, and the node state target expected to be achieved after instruction execution; use the intervention instruction as an intervention measure for the root cause.

[0171] For the root cause description of "high database server memory usage," the corresponding transmission path is extracted from the hierarchical transmission path record: "high database server memory usage → data read latency → abnormal data validation rules." On this transmission path, the key intermediate node upon which the state change transmission depends is identified as "data read latency." For this key intermediate node, "data read latency," an intervention command is generated: the target node to be operated on is identified as "data read module"; the command is executed when the database server memory usage exceeds the warning threshold; the expected node state target after command execution is that the data read speed returns to normal levels, and the read latency time is lower than the set threshold. This intervention command is used as the intervention measure for the root cause of "high database server memory usage."

[0172] For example, step S1551: Extract the abnormal state manifestations and attribute characteristics of each root cause from the root cause description, and determine the abnormal core of the root cause.

[0173] From the root cause descriptions generated in step S152, extract the abnormal state manifestations and attribute characteristics of each root cause. Taking "high memory usage of the database server" as an example, its abnormal state manifestations are "memory usage remains consistently high, and the system frequently issues memory shortage alarms," ​​and its attribute characteristics are "resource configuration elements, dynamic memory allocation, and support for data caching and process execution." By analyzing this information, the core anomaly of the root cause is determined to be "unreasonable memory resource allocation, caching mechanism failure, leading to a large number of processes competing for limited memory resources."

[0174] Step S1552: Analyze in detail the complete process of transmission from the root cause to the direct cause in the hierarchical transmission path record, and locate the key intermediate nodes and core transmission links in the transmission chain.

[0175] A detailed analysis of the hierarchical transmission path record generated in step S153 reveals the complete process of the transmission from the root cause "high database server memory usage" to the direct cause "abnormal data validation rules," such as "high database server memory usage → data read latency → abnormal data validation rules." In this transmission chain, the key intermediate node is identified as "data read latency," and the core transmission links are "high database server memory usage → data read latency" (because this link is the starting point of the transmission and determines whether subsequent transmission occurs) and "data read latency → abnormal data validation rules" (this link directly leads to the generation of the direct cause).

[0176] Step S1553: Based on the functional positioning of key intermediate nodes and the transmission rules of core transmission links, identify key intervention nodes that can block transmission. Key intervention nodes are nodes in the transmission chain that play a decisive role in the transmission process.

[0177] Based on the functional positioning of the key intermediate node "data read delay" (responsible for reading data from the database and passing it to the data verification rules) and the transmission rules of the core transmission link "data read delay → data verification rule anomaly" (an anomaly is triggered if the data read delay exceeds the waiting threshold of the data verification rule), key intervention nodes that can block the transmission are identified. Since "data read delay" is the intermediate node that directly causes "data verification rule anomaly" and plays a decisive role in the transmission process, it is identified as the key intervention node.

[0178] Step S1554: For each key intervention node, analyze its role in the transmission chain, record the impact of the state changes of the intervention node on the subsequent transmission process, and determine the intervention attributes of the intervention node.

[0179] This analysis examines the role of the key intervention node, "data read latency," in the transmission chain, highlighting how it affects subsequent "data validation rules" by transmitting delayed data flows. It records that when the "data read latency" status changes from "delayed" to "normal," the "data validation rule anomaly" status disappears during subsequent transmission; conversely, as the "data read latency" status worsens, the severity of the "data validation rule anomaly" intensifies. The study identifies the modifiable attributes of the intervention node, such as "the number of read threads in the data read module," "the size of the data read cache," and "the data prefetching strategy." These attributes can be adjusted through system configuration or optimization.

[0180] Step S1555: Combining the core abnormality of the root cause and the time sequence of the transmission chain, determine the timing of the intervention measures. The timing of the intervention measures should be selected before the abnormality of the root cause is transmitted to the intervention node.

[0181] Based on the core anomaly of the root cause (unreasonable memory resource allocation) identified in step S1551 and the temporal sequence of the transmission chain (high database server memory usage → data read delay → abnormal data verification rules), the timing for implementing intervention measures should be determined. To effectively block the transmission, the intervention should be implemented before the abnormal state of the root cause (high memory usage) propagates to the intervention node (data read delay). For example, intervention should be implemented when the system detects that the database server memory usage rate has reached the warning threshold, but has not yet caused data read delay.

[0182] Step S1556: Based on the intervened attributes and implementation timing of the intervention node, construct a specific intervention operation method. The intervention operation method conforms to the operating rules of the business system and can change the state of the intervention node.

[0183] Based on the interveneable attributes of the intervention node "data read latency" (such as "data read cache size") determined in step S1554 and the implementation timing set in step S1555, a specific intervention operation method is constructed. For example, the intervention operation method is to "dynamically adjust the cache size of the data read module when the database server memory occupancy rate reaches the warning threshold, increase the cache capacity to improve the data hit rate, and reduce disk read operations." This operation method conforms to the operating rules of the business system (supports dynamic adjustment of cache parameters) and can change the state of the intervention node "data read latency" from "latency" to "normal".

[0184] Step S1557: Define the implementation goal of the intervention measures. The implementation goal is to cause a specific change in the state of the intervention node in order to cut off the transmission from the root cause to the direct cause and prevent the abnormal transmission from continuing.

[0185] Define the implementation goals of the intervention measures. For the intervention operation of "adjusting the cache size of the data reading module," the implementation goal is to "increase the cache hit rate of the data reading module to a certain level and reduce the data reading latency to below a certain threshold." By achieving this goal, the state of "data reading latency" at the intervention node undergoes a specific change, thereby cutting off the transmission from the root cause "high database server memory usage" to the direct cause "abnormal data validation rules," and preventing the abnormal transmission from continuing.

[0186] Step S1558: In the causal transmission model, load the state change scenario corresponding to the intervention measure and perform simulation; record the unexpected state changes generated by the transmission chain and other related nodes in the simulation results, in addition to the expected blocking effect; for each unexpected state change, generate a new state change scenario, with the node where the unexpected state change occurs as the implementation object, and its state change goal is to eliminate the unexpected state change; store the new state change scenario as a response plan associated with the intervention measure.

[0187] In the causal transmission model, the state change scenario corresponding to the intervention measure constructed in step S1556 (such as "increase in data reading module cache size") is loaded, and simulation is performed. Besides recording the expected blocking effect (such as mitigation of "abnormal data verification rules"), it is also necessary to record unexpected state changes in the transmission chain and other related nodes in the simulation results, such as "the increase in data reading cache size leads to a decrease in cache refresh frequency, resulting in excessively long retention time for some temporary data." For this unexpected state change, a new state change scenario is generated, with the "cache refresh module" as the implementation object, and the state change goal is "to increase the cache refresh frequency to a certain value to ensure timely cleanup of temporary data." This new state change scenario is used as a contingency plan and stored in association with the original intervention measure.

[0188] Step S1559: Combining the state transmission rules of the causal transmission model, simulate the implementation process of the intervention measures, verify the effect of the intervention measures in blocking transmission, and adjust the details of the measures to optimize the blocking effect.

[0189] By combining the state propagation rules of the causal propagation model, the implementation process of intervention measures is simulated. For example, after simulating "adjusting the cache size of the data reading module," according to the state propagation rules, the data reading latency decreases, thereby alleviating the data verification rule anomalies. The effectiveness of the intervention measures in blocking propagation is verified to meet the expected goals (e.g., whether the degree of anomaly mitigation meets the requirements). If the effect does not meet expectations, the details of the measures are adjusted, such as further increasing the cache size or simultaneously adjusting the cache replacement strategy, and simulation verification is performed again until the optimized intervention measures can effectively block propagation.

[0190] Step S15510: Determine the final intervention measures, and define the implementation nodes, timing, implementation methods, implementation objectives, and contingency plans for potential impacts of the intervention measures.

[0191] Following simulation verification and optimization in step S1559, the final intervention measures were determined. The implementation node for these intervention measures was clearly defined as the "data reading module," the implementation timing as "when the database server memory occupancy rate reaches the warning threshold," the implementation method as "dynamically adjusting the cache size and cache replacement strategy of the data reading module," and the implementation goal as "reducing data reading latency to below a certain threshold and eliminating data verification rule anomalies," along with contingency plans for potential impacts (such as the cache refresh frequency adjustment plan generated in step S1558). Through clear definition, a complete intervention measure was formed.

[0192] Step S156: Analyze the positional relationship of the target nodes targeted by different intervention measures in the causal transmission model: if the target nodes have no direct or indirect causal relationship, they are marked as parallel measures; if the target nodes are located on the same transmission path, they are marked as alternative measures; if multiple measures have logical contradictions in their state requirements for the same target node, they are marked as conflicting measures, and one of them is retained according to the preset conflict resolution rules; based on the relationship after parallelism, substitution and conflict resolution, different combination schemes of measures are generated.

[0193] Analyze the positional relationship of the target nodes of the intervention measures generated in steps S154 and S155 within the causal transmission model. For example, the target node for the intervention measure targeting "data verification rule anomaly" is "data verification rule," and the target node for the intervention measure targeting "network bandwidth congestion" is "network bandwidth module." Since "data verification rule" and "network bandwidth module" have no direct or indirect causal relationship in the causal transmission model, these two measures are marked as parallelizable measures. If the target nodes of both intervention measures are located on the transmission path of "database server memory → data read delay → data verification rule anomaly," they are marked as alternative measures. If two measures both target the "data read module," one requiring increased read speed and the other requiring decreased read speed, and there is a logical contradiction in their requirements for the target node's state, they are marked as conflicting measures. One of them is retained according to the preset conflict resolution rules (such as retaining the measure with a more significant effect on alleviating the anomaly). Based on the above analysis, different combination schemes of measures are generated.

[0194] Step S157: Based on the state transmission rules of the causal transmission model, simulate the implementation process of each intervention measure and combination of measures, and predict the degree of improvement of business anomalies after the implementation of the measures.

[0195] Based on the state transmission rules of the causal transmission model, the implementation process of each intervention measure generated in steps S154 and S155, as well as the combination of measures generated in step S156, is simulated. For example, the simulation examines how the state change of the data verification rule is transmitted to the declaration form generation stage after implementing the measure "adjusting data verification rule parameters," predicting the degree of improvement in the problem of missing data in the declaration form; it also simulates the overall improvement in business anomalies after simultaneously implementing the combination of "adjusting data verification rule parameters" and "optimizing network bandwidth." The simulation yields the predicted improvement results for each measure and combination.

[0196] Step S158: Based on the simulated implementation effect data, prioritize the intervention measures and combination of measures. The ranking criteria include the difficulty of implementation, speed of effectiveness, and scope of impact of the measures.

[0197] Based on the implementation effect data (degree of improvement in business anomalies) simulated in step S157, and combined with indicators such as the implementation difficulty of intervention measures and combinations of measures (e.g., whether system downtime is required, whether professional personnel are required to operate), the speed of effectiveness (the time required for anomaly improvement after implementation), and the scope of impact (the impact of the measures on other modules of the system, whether it is a positive or negative impact), the intervention measures and combinations of measures are prioritized. Measures with low implementation difficulty, fast effectiveness, positive impact, and high degree of improvement are ranked first, generating a priority ranking result.

[0198] Step S159: Structure and integrate the direct root cause description, fundamental root cause description, hierarchical transmission path record, priority-ordered intervention measures and combination schemes, unify the description format, standardize the expression logic, and generate a set of business anomaly root cause analysis results containing complete structured information.

[0199] The direct root cause descriptions generated in step S151, the fundamental root cause descriptions generated in step S152, the hierarchical transmission path records generated in step S153, and the intervention measures and combination schemes after priority ranking in step S158 are structurally integrated. The description formats of each part are standardized (e.g., using a unified element attribute description template), and the expression logic is standardized (e.g., expressed in order of root cause importance and measure priority) to ensure that the information is clear and organized, ultimately generating a set of business anomaly root cause analysis results containing complete structured information.

[0200] Figure 2 The hardware structure schematic of the intelligent business anomaly root cause analysis system 100 combining causal inference provided in an embodiment of the present invention is shown, as follows: Figure 2 As shown, the intelligent business anomaly root cause analysis system 100, which combines causal inference, may include a processor 110, a machine-readable storage medium 120, a bus 130, and a communication unit 140.

[0201] Machine-readable storage medium 120 can store data and / or instructions. In some embodiments, machine-readable storage medium 120 can store data acquired from an external terminal. In some embodiments, machine-readable storage medium 120 can store data and / or instructions used by the intelligent business anomaly root cause analysis system 100 with causal inference to execute or use in order to complete the exemplary methods described in this invention. In a specific implementation, one or more processors 110 execute the computer-executable instructions stored in machine-readable storage medium 120, enabling processor 110 to execute the intelligent business anomaly root cause analysis method with causal inference as described in the above method embodiments. Processor 110, machine-readable storage medium 120, and communication unit 140 are connected via bus 130, and processor 110 can be used to control the transmission and reception actions of communication unit 140. The specific implementation process of processor 110 can be found in the various method embodiments executed by the intelligent business anomaly root cause analysis system 100 with causal inference described above, and their implementation principles and technical effects are similar, so they will not be repeated here.

[0202] Furthermore, embodiments of the present invention also provide a readable storage medium containing computer-executable instructions. When the processor executes the computer-executable instructions, the above-mentioned intelligent business anomaly root cause analysis method combining causal inference is implemented.

[0203] It should be noted that, in order to simplify the description of this invention and thus aid in the understanding of one or more embodiments, the foregoing description of the embodiments of this invention sometimes combines multiple features into a single embodiment, drawing, or description thereof. Similarly, it should be noted that, in order to simplify the description of this invention and thus aid in the understanding of one or more embodiments, the foregoing description of the embodiments of this invention sometimes combines multiple features into a single embodiment, drawing, or description thereof.

Claims

1. A method for intelligent business anomaly root cause analysis combining causal inference, characterized in that, The method includes: Obtain the description of abnormal behavior and the information of the occurrence scenario; calculate the matching degree between the description of abnormal behavior and the information of the occurrence scenario and the applicable scenario range of multiple predefined causal inference frameworks; select the causal inference framework whose matching degree calculation result meets the preset matching conditions; and generate the matching result. Based on the matching results, business-related elements and historical operation records in the business system are integrated to construct a causal transmission model. The causal transmission model includes element causal relationships, state transmission rules, and intervention response processes. The business-related elements include process elements, resource allocation elements, rule execution elements, and external environment elements. The historical operation records include element state change records and anomaly transmission records. For the business-related elements in the causal transmission model, perform multi-dimensional causal intervention simulation, configure the state change scenarios of the business-related elements, simulate the change trajectory of abnormal transmission in the causal transmission model after the state change, and generate causal intervention simulation results. The causal intervention simulation results include the intervention effective scenario identifier and the abnormal transmission change trajectory record. Based on the causal intervention deduction results, the core triggering elements in the abnormal transmission change trajectory record are traced, the elements that directly trigger the abnormality and the elements that trigger the abnormality through intermediate elements are distinguished, the hierarchical relationship and transmission path between the core triggering elements are established, and the root cause hierarchical transmission information is generated. By integrating the root cause hierarchy transmission information with the association rules of the causal transmission model, a set of business anomaly root cause analysis results is generated. The set of business anomaly root cause analysis results includes direct root cause descriptions, fundamental root cause descriptions, hierarchical transmission path records, and targeted intervention measures.

2. The intelligent business anomaly root cause analysis method combining causal inference according to claim 1, characterized in that, Based on the matching results, the business-related elements and historical operation records in the business system are integrated to construct a causal transmission model, including: Extract the causal structure identification rules, intervention deduction logic, and path tracing process of the causal inference framework from the matching results, as the rules and logical basis for constructing the causal transmission model; Extract business-related elements from the business system, describe the functional positioning of each business-related element, record the role of each element in the business process, its interaction with other elements, and the types of state changes it may cause, and generate a set of element functional positioning. Extract the historical operation records of the business system, filter the status change records and anomaly transmission records of elements related to the business, organize the record content in chronological order, and generate a time-series historical operation dataset. Based on the time-series historical operation dataset, the correlation of state changes among the business-related elements is analyzed. When a state change event of an element occurs, the frequency of state change events of other elements within a preset time window is counted. When the frequency exceeds a preset frequency threshold, the corresponding two elements are marked as a potential causal relationship pair. The causal structure identification rules in the matching results are applied to verify the potential causal relationship pairs, eliminating relationship pairs that only have a temporal sequence but no actual transmission logic, and generating true causal relationship pairs. For the real causal relationship pairs, analyze the state transmission mode between elements, record the specific process of state change of one element triggering state change of another element, extract the triggering conditions, transmission delay parameters, and influence range of state transmission, and generate state transmission rules; Based on the intervention deduction logic in the matching results, the intervention response process of the causal transmission model is set, and the steps of the model to simulate the transmission process, the dimensions of recording the change trajectory, and the criteria for judging the intervention effect are defined when any element is configured to change its state. The true causal relationship pairs, the state transmission rules, and the intervention response process are integrated, and an initial causal transmission model is constructed using the business-related elements as nodes and the true causal relationships as connections. Import the abnormal transmission records from the time-series historical running dataset, dynamically calibrate the initial causal transmission model, and adjust the parameters in the state transmission rules to minimize the difference between the abnormal transmission process simulated by the model and the actual process in the historical records. By integrating and calibrating the real causal pairs, state transmission rules, and intervention response processes, a causal transmission model containing element causal relationships, state transmission rules, and intervention response processes is generated.

3. The intelligent business anomaly root cause analysis method combining causal inference according to claim 1, characterized in that, The process involves performing multi-dimensional causal intervention simulations for business-related elements in the causal transmission model, configuring state change scenarios for these elements, simulating the abnormal transmission trajectory in the causal transmission model after the state change, and generating causal intervention simulation results, including: Extract all business-related elements and their causal relationships from the causal transmission model, record the position of each element in the causal network and its related upstream and downstream elements, and generate an element relationship diagram; Based on the element relationship diagram, the key state type of each business-related element is determined. The key state type includes the standard state when the business system is running normally, the abnormal state that has appeared in the historical record, and the critical state that may trigger a chain reaction. For each of the aforementioned business-related elements, configure multi-dimensional state change scenarios. Each scenario corresponds to a change in a key state type. At the same time, set the triggering time, duration, and scope of impact of the scenario. The initial state of the business anomaly in the causal transmission model is used as the baseline state for intervention simulation, and the initial trajectory of anomaly transmission under the baseline state is recorded. The configured multi-dimensional state change scenarios are input into the causal transmission model one by one, the model's intervention response process is initiated, and the dynamic process of abnormal transmission after the element state changes is simulated. During the simulation, the system records the status change data of each business-related element in the model, the path adjustment information of abnormal transmission, and the change value of transmission intensity at preset time intervals, generating scenario-based simulation records. The scenario-based simulation records for each scenario are analyzed, compared with the initial trajectory under the baseline state, and the scenarios in which abnormal transmission trajectories have changed are marked according to the preset trajectory change determination threshold, and intervention effective scenario identifiers are generated. For the scenario corresponding to the intervention effective scenario identifier, extract the abnormal transmission change details from the scenario simulation record, including the addition record of transmission path, the disappearance record of transmission path, the change record of transmission direction, and the change record of the number of transmission-related elements, and generate an abnormal transmission change trajectory record; All intervention effective scenario identifiers and corresponding abnormal transmission change trajectory records are classified and organized, grouped according to the type of elements involved in the intervention and the dimension of abnormal transmission change, and a classification inference result is generated. By integrating the intervention effectiveness scenario identifiers and abnormal transmission change trajectory records from the classification and extrapolation results, a causal intervention extrapolation result containing complete intervention extrapolation information is generated.

4. The intelligent business anomaly root cause analysis method combining causal inference according to claim 1, characterized in that, Based on the causal intervention deduction results, the core triggering elements in the abnormal transmission and change trajectory record are traced, distinguishing between elements that directly trigger the anomaly and elements that trigger the anomaly through intermediate elements, establishing the hierarchical relationship and transmission path between the core triggering elements, and generating root cause hierarchical transmission information, including: Extract all intervention effective scenario identifiers and corresponding abnormal transmission change trajectory records from the causal intervention deduction results. Compare the abnormal transmission change trajectory records with the baseline initial trajectory, calculate the difference between the abnormal transmission change trajectory and the baseline initial trajectory in each scenario, and take the scenarios with the difference exceeding the preset difference threshold as the key analysis objects for root cause tracing. The abnormal transmission change trajectory record of the key analysis object is decomposed, and the key nodes in the trajectory are extracted in chronological order. The key nodes are business-related elements whose state exceeds a preset change amplitude threshold during the abnormal transmission process. Analyze the degree of correlation between each key node and the business anomaly, and calculate the directness of the node's impact on the anomaly by comparing the synchronization data of node status changes and anomaly behavior changes. Based on the numerical value of the degree of directness of influence, and according to the preset direct influence judgment threshold, the elements that directly trigger anomalies and the elements that trigger anomalies through the transmission of intermediate elements are distinguished. The elements that directly trigger anomalies refer to nodes that immediately cause changes in abnormal behavior after a change in state. The elements that trigger anomalies through the transmission of intermediate elements refer to nodes that need to be transmitted through other nodes after a change in state to affect the anomaly. Extract the relationship data between the elements that directly trigger the anomaly and the elements that trigger the anomaly through intermediate elements, record the specific process by which the latter acts on the former through intermediate nodes, and generate an element transmission chain. Based on the aforementioned element transmission chain, a hierarchical structure of core triggering elements is constructed, with elements that trigger anomalies through intermediate elements as upper-level elements and elements that directly trigger anomalies as lower-level elements, defining the subordinate relationships between each level. Trace the transmission path of the core triggering elements in each level, and record the specific process of the element state change from the upper level to the lower level, including the intermediate nodes involved, the transmission order, and the state change content of each link; The hierarchical structure and the transmission path are integrated, and the hierarchical position of each core triggering element, the corresponding transmission path details, and the relationship with other elements are marked to generate a hierarchical transmission relationship diagram. The hierarchical transmission relationship diagram is compared with the causal intervention inference results. The hierarchical relationships and transmission paths in the relationship diagram are adjusted to make them consistent with the information in the abnormal transmission change trajectory record. The relationship diagram details are supplemented based on the element causal relationships of the causal transmission model. By integrating, comparing, and supplementing the hierarchical structure, transmission path, and core triggering element attributes, root cause hierarchical transmission information is generated, which includes the direct root cause hierarchy, the fundamental root cause hierarchy, and the transmission path between levels.

5. The intelligent business anomaly root cause analysis method combining causal inference according to claim 1, characterized in that, The process of integrating the root cause hierarchy transmission information with the association rules of the causal transmission model to generate a set of business anomaly root cause analysis results includes: Extract the core triggering elements of the direct root cause level from the root cause hierarchy transmission information, and combine these elements with the causal relationship and functional positioning of the elements in the causal transmission model to describe the attribute characteristics, abnormal state manifestations, and direct effects on business anomalies of each direct root cause, and generate a direct root cause description. Extract the core triggering elements of the root cause level in the root cause hierarchy transmission information, and based on the state transmission rules of the causal transmission model, describe the attribute characteristics, abnormal state manifestations, and the process of transmission to the direct root cause through intermediate elements for each root cause, and generate a root cause description. Extract the inter-level transmission paths from the root cause hierarchical transmission information, combine them with the causal relationships of the elements in the causal transmission model, and record each node in the transmission path, the transmission rules between nodes, and the state change data during the transmission process in the transmission order to generate a hierarchical transmission path record; For each direct cause in the description of direct causes, based on the intervention response process of the causal transmission model, an intervention measure that can change the abnormal state of the direct cause is constructed, and the implementation target, implementation method and implementation steps of the intervention measure are defined. For each root cause in the root cause description, extract its corresponding transmission path in the hierarchical transmission path record; on the transmission path, identify one or more key intermediate nodes on which the state change transmission depends; for each key intermediate node, generate an intervention instruction, the intervention instruction including: the target node identifier to be operated, the time condition for instruction execution, and the node state target expected to be achieved after instruction execution; use the intervention instruction as an intervention measure for the root cause; The positional relationship of the target nodes targeted by different intervention measures in the causal transmission model is analyzed: if the target nodes have no direct or indirect causal relationship, they are marked as parallelizable measures; if the target nodes are located on the same transmission path, they are marked as alternative measures; if multiple measures have logical contradictions in their state requirements for the same target node, they are marked as conflicting measures, and one of them is retained according to the preset conflict resolution rules; based on the relationship after parallelism, substitution, and conflict resolution, different combination schemes of measures are generated. Based on the state transmission rules of the causal transmission model, the implementation process of each intervention measure and combination of measures is simulated to predict the degree of improvement of business anomalies after the implementation of the measures. Based on the simulated implementation effect data, the intervention measures and the combination of measures are prioritized and ranked according to the difficulty of implementation, speed of effectiveness, and scope of impact of the measures. The direct root cause description, fundamental root cause description, hierarchical transmission path record, priority-ordered intervention measures and combination schemes are structurally integrated, and the description format and expression logic are standardized to generate a set of business anomaly root cause analysis results containing complete structured information.

6. The intelligent business anomaly root cause analysis method combining causal inference according to claim 2, characterized in that, The application of the causal structure identification rules in the matching results to verify the potential causal relationship pairs excludes relationship pairs that only have a temporal sequence without actual transmission logic, and generates true causal relationship pairs, including: The core judgment criteria for causal structure identification rules are extracted from the matching results. The core judgment criteria include the causal necessity parameter of the change of element state, the interpretability basis of the transmission process, and the independence parameter that excludes interference from third-party elements. For each potential causal relationship pair, extract all feature state change records corresponding to the relationship pair from the time-series historical operation dataset, and arrange them in chronological order to generate a time-series record sequence of the relationship pair; Analyze the time interval distribution of the state changes of cause and effect elements in the time-series record sequence of the relationship pair, statistically analyze the distribution of the time interval from the state change of cause element to the state change of effect element in the time-series record sequence of the relationship pair, calculate the mode or median of the time interval as the typical time interval of the relationship pair; compare the typical time interval with a reasonable transmission time interval preset based on business rules, determine whether the typical time interval is within the reasonable transmission time interval, and obtain the time logic matching degree. Based on the causal necessity parameter in the causal structure identification rule, the frequency of occurrence of the relationship on the state changes of the consequence elements in the time-series record sequence due to the state changes of the cause elements is statistically analyzed, and the degree of dependence of the state changes of the consequence elements on the state changes of the cause elements is calculated. Based on the interpretability of the transmission process in the causal structure identification rules, and combined with the functional positioning set of the business-related elements, the internal logic of the change in the state of the cause element leading to the change in the state of the effect element is analyzed to determine whether there is a reasonable business process or physical action to support it. Based on the independence parameter in the causal structure identification rule, records of third-party element state changes in the time-series historical running dataset are filtered out, and it is analyzed whether the state changes of third-party elements will simultaneously trigger state changes of the causal and effect elements in the relationship pair, so as to eliminate third-party interference. Potential causal relationship pairs that meet the requirements of temporal logical matching degree, causal necessity parameter, transmission interpretability basis, and independence parameter are marked as candidate true causal relationship pairs; From the time-series historical operation dataset, extract the candidate true causal relationship pairs into sub-datasets under various preset business scenario classifications; calculate the degree of dependence of the state change of the effect element on the state change of the cause element in each sub-dataset; calculate the variance or standard deviation of the degree of dependence as a stability evaluation value. By comparing the candidate true causal relationship pairs with the rules and logical basis for constructing the causal transmission model, it is verified whether the relationship pairs conform to the logical framework constraints of the model. Integrate all verified candidate true causal relationship pairs to generate true causal relationship pairs.

7. The intelligent business anomaly root cause analysis method combining causal inference according to claim 3, characterized in that, For each of the aforementioned business-related elements, multi-dimensional state change scenarios are configured, with each scenario corresponding to a key state type change. The triggering timing, duration, and scope of impact for each scenario are also defined, including: Extract the core functions, interaction scenarios, and state change types of each business-related element, and determine the business scope that may be involved in the change of element state. Based on the key state types of the business-related elements, a corresponding change method is configured for each key state type. The change method includes restoring the state to the standard state, adjusting the state to a new critical state, and switching the state to the opposite abnormal state. Based on the characteristics of the business process of the business system, the triggering time for each state change scenario is set, and the triggering time selection element is the node that plays a key role in the business process; Based on the continuous pattern of element state changes in historical operation records, the duration of each state change scenario is set, including short-term duration, medium-term duration, and long-term duration. Based on the relevant range of the elements in the element relationship diagram, the influence range of each state change scenario is set. The influence range includes the range that only acts on itself, the range that acts on directly related elements, and the range that acts on all related elements in the chain. For each of the aforementioned business-related elements, different key state type change methods, triggering times, durations, and impact ranges are combined to generate multiple basic scenario units; Each basic scenario unit is input into the intervention response process of the causal transmission model for simulation verification; if the system reports an error or fails to generate a simulation record during the simulation, it is determined to be inconsistent with the feasibility of the model simulation and is removed; the remaining scenario units are compared with the predefined business constraint rule library, and scenario units that violate any business constraint rule are removed; the scenario units that have not been removed are retained. Analyze the coverage between the retained basic scene units and supplement the scene units corresponding to the key intervention angles that were not covered; The supplemented scenario units are categorized and organized, and grouped according to the dimensions of state change method, triggering time, duration, and scope of impact, generating a multi-dimensional set of state change scenarios corresponding to each business-related element.

8. The intelligent business anomaly root cause analysis method combining causal inference according to claim 4, characterized in that, The step of extracting the relationship data between the elements that directly trigger the anomaly and the elements that trigger the anomaly through intermediate elements, recording the specific process by which the latter acts on the former through intermediate nodes, and generating an element transmission chain includes: The element that directly triggers the anomaly is taken as the end point of the chain, and the element that triggers the anomaly through intermediate elements is taken as the starting point of the chain. Possible connection paths are initially screened based on the element relationship diagram. Extract abnormal transmission change trajectory records related to the starting point and ending point elements from the causal intervention inference results, locate the intermediate node connecting the starting point and ending point in the trajectory, and the intermediate node is the business-related element whose state exceeds the preset change amplitude threshold during the transmission process; Arrange the starting point elements, intermediate nodes, and ending point elements according to the time sequence recorded in the abnormal transmission change trajectory to generate a preliminary transmission sequence; Analyze the state transmission mode between adjacent elements in the preliminary transmission sequence, and combine the state transmission rules of the causal transmission model to record the specific process by which the state change of the previous element triggers the state change of the next element. The preliminary transmission sequence is compared with the element causal relationship of the causal transmission model, and the transmission sequence is adjusted to ensure that the transmission of each link is consistent with the element causal relationship of the model. Supplement the missing details in the preliminary conduction sequence, including the triggering conditions, conduction delay parameters, and state change amplitudes for each conduction stage, to make the conduction process a complete description; Identify possible branch paths in the transmission sequence, that is, the path through which the starting element combines with multiple intermediate nodes to act on the ending element, and record the specific content of each branch path. For each branch path, the product or weighted sum of the state change amplitudes of all nodes on that branch path is extracted from the abnormal transmission change trajectory record and used as the transmission intensity value of that branch path; the transmission intensity values ​​of all branch paths are sorted, and the paths with a ranking higher than a preset rank threshold are marked as primary transmission paths, and the rest are marked as secondary transmission paths. By integrating the primary and secondary transmission paths, an element transmission chain is generated, with the starting element as the source, the ending element as the target, and including all key intermediate nodes and transmission links. The attributes of each node in the element transmission chain and the rules of each transmission link are labeled to generate an element transmission chain that reflects the complete process of the element that triggers the anomaly through the transmission of intermediate elements acting on the element that directly triggers the anomaly.

9. The intelligent business anomaly root cause analysis method combining causal inference according to claim 5, characterized in that, For each root cause described in the root cause description, and in conjunction with the hierarchical transmission path record, intervention measures capable of blocking the transmission of the root cause to the direct root cause are constructed. The implementation nodes, timing, and objectives of the intervention measures are defined, including: Extract the abnormal state manifestations and attribute characteristics of each root cause from the root cause description to determine the core of the abnormality of the root cause. Analyze the complete process of transmission from the root cause to the direct cause in the hierarchical transmission path record, and locate the key intermediate nodes and core transmission links in the transmission chain; Based on the functional positioning of the key intermediate nodes and the transmission rules of the core transmission links, key intervention nodes that can block transmission are identified. The key intervention nodes are the nodes in the transmission chain that play a decisive role in the transmission process. For each of the key intervention nodes, analyze its role in the transmission chain, record the impact of the state changes of the intervention node on the subsequent transmission process, and determine the interventionlable attributes of the intervention node; Based on the abnormal state of the root cause and the time sequence of the transmission chain, the timing of the intervention measures is set, and the timing of the intervention measures is selected before the abnormal state of the root cause is transmitted to the intervention node. Based on the intervened attributes of the intervention node and the implementation timing, a specific intervention operation method is constructed. The intervention operation method conforms to the operating rules of the business system and can change the state of the intervention node. Define the implementation objective of the intervention measures, which is to cause a specific change in the state of the intervention node in order to cut off the transmission from the root cause to the direct cause and prevent the abnormal transmission from continuing; In the causal transmission model, the state change scenarios corresponding to the intervention measures are loaded, and simulations are performed. The simulation results are recorded, including any unexpected state changes in the transmission chain and other related nodes, in addition to the expected blocking effect. For each unexpected state change, a new state change scenario is generated, with the node experiencing the unexpected state change as the implementation target, and its state change objective being to eliminate the unexpected state change. The new state change scenario is then stored as a contingency plan associated with the intervention measures. Based on the state transmission rules of the causal transmission model, the implementation process of the intervention measures is simulated to verify the effect of the intervention measures in blocking transmission, and the details of the measures are adjusted to optimize the blocking effect; Determine the final intervention measures, and define the implementation nodes, timing, methods, objectives, and contingency plans for potential impacts of the intervention measures.

10. A smart business anomaly root cause analysis system combining causal inference, characterized in that, The intelligent business anomaly root cause analysis system combining causal inference includes a processor and a memory, the memory and the processor are connected, the memory is used to store programs, instructions or code, and the processor is used to run the programs, instructions or code in the memory to implement the intelligent business anomaly root cause analysis method combining causal inference as described in any one of claims 1-9.

Images