Fault root cause determination method and electronic equipment

Abstract

The invention provides a fault root cause determination method and electronic equipment, relates to the technical field of service fault root cause determination, and is used for improving the efficiency and precision of determining a service fault root cause. The method comprises the following steps: acquiring operation data of each function node in a service topological structure, and determining whether the function node is an abnormal node based on the operation data; under the condition that the service fault is detected, determining a current service link corresponding to the service fault; screening out the abnormal nodes in the current service link from the abnormal nodes in the service topological structure, and taking the abnormal nodes as to-be-selected abnormal nodes; calculating the similarity between each abnormal node to be selected and the service fault; the similarity is used for representing the time-space association strength between the to-be-selected abnormal node and the service fault; and based on the similarity, determining a root cause node of the service fault from each abnormal node to be selected.

Description

Technical Field

[0001] This application relates to the field of business failure root cause determination technology, and in particular to a failure root cause determination method and electronic device. Background Technology

[0002] With the widespread adoption of microservices and cloud-native architectures, there are numerous service components within the system and complex call relationships. A business request initiated by a user often needs to traverse multiple services and middleware to be completed. Performance degradation or failure of any single node may propagate along the call chain, ultimately manifesting as abnormal business functions on the user side, making it extremely challenging to quickly locate the root cause of the failure.

[0003] Traditional manual troubleshooting is inefficient, necessitating automated root cause analysis. One approach is to use rule-based expert systems for root cause analysis. This relies on pre-summarized fault patterns and handling rules by operations experts, inferring the root cause by matching real-time data with a rule base. Another approach involves constructing a backend system dependency graph manually or using a call chain analysis system, then employing graph algorithms (such as random walks and community detection) to identify key anomaly nodes and pinpoint the root cause.

[0004] However, rule-based expert experience systems lack flexibility, cannot adapt to dynamic topology changes, require rewriting rules for new services, and have high knowledge base maintenance costs, necessitating continuous investment in updating the rule base with expert experience. Furthermore, the root cause identification of business failures is not accurate enough. On the other hand, solutions that locate key abnormal nodes using graph algorithms have high computational overhead, potentially leading to computational delays, making them unsuitable for scenarios with high real-time requirements. Summary of the Invention

[0005] This application provides a method and electronic device for determining the root cause of a fault, which can improve the efficiency and accuracy of determining the root cause of a business fault.

[0006] To achieve the above objectives, this application adopts the following technical solution: In a first aspect, this application provides a method for determining the root cause of a fault, comprising: Obtain the running data of each functional node in the business topology and determine whether the functional node is an abnormal node based on the running data; the business topology contains multiple business links, and each business link contains multiple functional nodes. The business link is used to represent the calling path taken to complete a business. In the event of a service failure, determine the current service link corresponding to the service failure; From the abnormal nodes in the business topology, select the abnormal nodes located in the current business link as candidate abnormal nodes; Calculate the similarity between each candidate abnormal node and the business failure; the similarity is used to characterize the spatiotemporal correlation strength between the candidate abnormal node and the business failure. Based on similarity, the root cause node of the business failure is determined from each candidate abnormal node.

[0007] The technical solution provided in this application brings at least the following beneficial effects: This application identifies abnormal nodes in the global business topology in real time. When a business failure occurs, it determines the current business link corresponding to the failure and combines this information with the real-time identified abnormal nodes in the global business topology to filter out potential abnormal nodes. In other words, when a business failure occurs, the analysis scope is narrowed down from all abnormal nodes in the business topology to a few directly related to the failed business. This effectively reduces the computational load during failure analysis, thereby shortening the delay in root cause localization, improving the efficiency of root cause localization, and making real-time root cause diagnosis of complex systems possible.

[0008] Furthermore, the fault root cause determination step based on the business link in this application can ensure that the starting point for fault root cause determination is the specific fault scenario that users can perceive, rather than the abnormal technical indicators out of context.

[0009] By calculating the similarity between candidate abnormal nodes and business failures, evidence of their relevance to business failures in the time dimension is added to each candidate abnormal node. This effectively identifies and eliminates nodes that are abnormal but not related to the occurrence time of the current failure, avoiding interference from other failures in multi-failure scenarios and accurately locating the root cause of the current business failure.

[0010] In summary, this application employs a process of "real-time detection of global abnormal nodes → selection of candidate abnormal nodes from the current business chain → calculation of the similarity between candidate abnormal nodes and business failures → determination of the root cause node based on similarity." By using dynamic topological associations and statistical similarity for root cause inference, it can adapt to constantly changing microservice architectures and business chains. This approach not only eliminates the need for frequent adjustments to root cause localization rules but also reduces the investment of significant human resources. The solution presented in this application can determine the root cause node more quickly and accurately.

[0011] Optionally, the business topology is constructed based on page operation data collected by the front-end probe and microservice call data collected by the microservice call probe.

[0012] Optionally, the operational data is collected periodically; determining whether a functional node is an abnormal node based on the operational data includes: determining a functional node as an abnormal node if the operational data of the current period does not fall within the preset threshold range corresponding to the current period; or, comparing the operational data of the current period with the operational data of the same time period in the previous period to determine whether a functional node is an abnormal node; or, comparing the operational data of the current period with the operational data of the previous period to determine whether a functional node is an abnormal node.

[0013] Optionally, the similarity between each candidate abnormal node and the business failure is calculated, including: determining a target time period based on the occurrence time of the business failure, where the occurrence time of the business failure falls within the target time period; obtaining the first change curve of the running data of each candidate abnormal node within the target time period, and the second change curve of the business failure; using the Pearson correlation coefficient algorithm to calculate the correlation coefficient between the first change curve and the second change curve, and using the correlation coefficient as the similarity between the candidate abnormal node and the business failure.

[0014] Optionally, the candidate abnormal nodes form an abnormal subgraph, which is a directed weighted graph; the nodes in the abnormal subgraph are candidate abnormal nodes, and the edges in the abnormal subgraph are used to represent the calling relationship between the candidate abnormal nodes; the direction of the edges is used to represent the calling direction; the edges have weights, which are determined based on the calling index data between the candidate abnormal nodes and the similarity between the candidate abnormal nodes and the business faults.

[0015] Optionally, among the two candidate abnormal nodes connected by an edge, one is the parent node and the other is the child node, with the edge pointing from the parent node to the child node. The weight of the edge is determined as follows: the ratio between at least one call indicator data of the parent node to the child node and the sum of the call indicator data of the parent node is determined as the call indicator score of the child node; the ratio between the similarity of the child node and the similarity of the parent node is determined as the similarity score of the child node; the proportion of the total score of the child node corresponding to the edge to the sum of the total scores of the child nodes corresponding to all outgoing edges of the parent node is determined as the weight of the edge; the total score of the child node is the sum of the call indicator score and the similarity score of the child node.

[0016] Optionally, the call metric data includes call volume, average call duration, and call error count. The call metric score of the child node is determined by the ratio between at least one call metric data point from the parent node to the child node and the sum of the call metric data corresponding to the parent node. This includes: determining the call volume score of the child node by the ratio between the call volume from the parent node to the child node and the sum of the call volumes corresponding to the parent node; determining the average call duration score of the child node by the ratio between the average call duration from the parent node to the child node and the sum of the call durations corresponding to the parent node; determining the call error count score of the child node by the ratio between the call error count from the parent node to the child node and the sum of the call error counts corresponding to the parent node; and determining the call metric score by the sum of the call volume score, the average call duration score, and the call error count score.

[0017] Optionally, based on similarity, the root cause node of the business failure is determined from each candidate abnormal node, including: calculating the root cause probability of each candidate abnormal node using a graph sorting algorithm based on the weight of the edges between the candidate abnormal nodes in the abnormal subgraph; and determining the root cause node of the business failure from each candidate abnormal node according to the root cause probability.

[0018] Optionally, the graph sorting algorithm is the PageRank algorithm; based on the weights of the edges between the candidate anomaly nodes in the anomaly subgraph, the root cause probability of each candidate anomaly node is calculated by the graph sorting algorithm, including: using the weights of the edges between the candidate anomaly nodes in the anomaly subgraph as the propagation probability of the edges in the PageRank algorithm; and based on the propagation probability, iteratively calculating the root cause probability of each candidate anomaly node by the PageRank algorithm.

[0019] Optionally, based on the propagation probability, the root cause probability of each candidate anomalous node is iteratively calculated using the PageRank algorithm, including: assigning an initial probability value to each candidate anomalous node; performing multiple rounds of iterative calculation using the PageRank algorithm; updating the root cause probability of the candidate anomalous node based on its current root cause probability and propagation probability during each round of iterative calculation; stopping the iterative calculation process when the iteration termination condition is met, and determining the root cause probability of the candidate anomalous node after the last round of iterative calculation as the final root cause probability of the candidate anomalous node.

[0020] Optionally, in the two candidate anomalous nodes connected by the edge, one is the parent node and the other is the child node, and the direction of the edge is from the parent node to the child node; based on the current root cause probability and propagation probability of the candidate anomalous node, the root cause probability of the candidate anomalous node is updated, including: for each candidate anomalous node, the root cause probability of the candidate anomalous node is obtained based on the base probability and the allocation probability corresponding to each parent node of the candidate anomalous node; the allocation probability corresponding to the parent node is determined based on the root cause probability of the parent node in the previous iteration calculation process and the propagation probability of the edge between the parent node and the candidate anomalous node.

[0021] Secondly, this application provides a fault root cause determination apparatus, comprising: The acquisition module is used to acquire the running data of each functional node in the business topology. The business topology contains multiple business links, and each business link contains multiple functional nodes. The business link is used to represent the call path taken to complete a business. Processing module, used for: Determine whether a functional node is an abnormal node based on operational data; In the event of a service failure, determine the current service link corresponding to the service failure; From the abnormal nodes in the business topology, select the abnormal nodes located in the current business link as candidate abnormal nodes; Calculate the similarity between each candidate abnormal node and the business failure; the similarity is used to characterize the spatiotemporal correlation strength between the candidate abnormal node and the business failure. Based on similarity, the root cause node of the business failure is determined from each candidate abnormal node.

[0022] Optionally, the business topology is constructed based on page operation data collected by the front-end probe and microservice call data collected by the microservice call probe.

[0023] Optionally, the running data is collected periodically; the processing module is specifically used to: determine the functional node as an abnormal node if the running data of the current period does not fall within the preset threshold range corresponding to the current period; or, compare the running data of the current period with the running data of the same time period in the previous period to determine whether the functional node is an abnormal node; or, compare the running data of the current period with the running data of the previous period to determine whether the functional node is an abnormal node.

[0024] Optionally, the processing module is specifically used to: determine a target time period based on the occurrence time of the business failure, and the occurrence time of the business failure falls within the target time period; obtain the first change curve of the running data of each candidate abnormal node within the target time period, and the second change curve of the business failure; use the Pearson correlation coefficient algorithm to calculate the correlation coefficient between the first change curve and the second change curve, and use the correlation coefficient as the similarity between the candidate abnormal node and the business failure.

[0025] Optionally, the candidate abnormal nodes form an abnormal subgraph, which is a directed weighted graph; the nodes in the abnormal subgraph are candidate abnormal nodes, and the edges in the abnormal subgraph are used to represent the calling relationship between the candidate abnormal nodes; the direction of the edges is used to represent the calling direction; the edges have weights, which are determined based on the calling index data between the candidate abnormal nodes and the similarity between the candidate abnormal nodes and the business faults.

[0026] Optionally, among the two candidate abnormal nodes connected by an edge, one is a parent node and the other is a child node, with the edge pointing from the parent node to the child node. Specifically, the processing module is used to: determine the child node's call metric score by comparing the ratio of at least one call metric data point from the parent node to the child node with the sum of the call metric data corresponding to the parent node; determine the child node's similarity score by comparing the similarity score corresponding to the child node with the similarity score corresponding to the parent node; determine the edge weight by the proportion of the total score of the child node corresponding to the edge to the sum of the total scores of all child nodes corresponding to the parent node's outgoing edges; and the child node's total score is the sum of its call metric score and its similarity score.

[0027] Optionally, the call metric data includes call volume, average call duration, and call error count. Specifically, the processing module is used to: determine the call volume score of the child node by comparing the call volume from the parent node to the child node with the total call volume corresponding to the parent node; determine the average call duration score of the child node by comparing the average call duration from the parent node to the child node with the total call duration corresponding to the parent node; determine the call error count score of the child node by comparing the call error count from the parent node to the child node with the total call error count corresponding to the parent node; and determine the call metric score by summing the call volume score, average call duration score, and call error count score.

[0028] Optionally, the processing module is specifically used to: calculate the root cause probability of each candidate anomaly node based on the weight of the edges between the candidate anomaly nodes in the anomaly subgraph using a graph sorting algorithm; and determine the root cause node of the business failure from the candidate anomaly nodes according to the root cause probability.

[0029] Optionally, the graph sorting algorithm is the PageRank algorithm; the processing module is specifically used to: use the weights of the edges between the candidate anomaly nodes in the anomaly subgraph as the propagation probability of the edges in the PageRank algorithm; and based on the propagation probability, iteratively calculate the root cause probability of each candidate anomaly node using the PageRank algorithm.

[0030] Optionally, the processing module is specifically used to: assign an initial probability value to each candidate anomalous node; perform multiple rounds of iterative calculation using the PageRank algorithm; during each round of iterative calculation, update the root cause probability of the candidate anomalous node based on the current root cause probability and propagation probability of the candidate anomalous node; and stop the iterative calculation process when the iteration termination condition is met, and determine the root cause probability of the candidate anomalous node after the last round of iterative calculation as the final root cause probability of the candidate anomalous node.

[0031] Optionally, in the two candidate anomalous nodes connected by the edge, one is the parent node and the other is the child node, and the direction of the edge is from the parent node to the child node; the processing module is specifically used to: for each candidate anomalous node, obtain the root cause probability of the candidate anomalous node based on the base probability and the allocation probability corresponding to each parent node of the candidate anomalous node; the allocation probability corresponding to the parent node is determined based on the root cause probability of the parent node in the previous iteration calculation process and the propagation probability of the edge between the parent node and the candidate anomalous node.

[0032] Thirdly, this application provides an electronic device, including: a processor and a memory; the memory is used to store computer execution instructions, the processor is connected to the memory, and when the electronic device is running, the processor executes the computer execution instructions stored in the memory to cause the electronic device to perform any of the above-mentioned root cause determination methods.

[0033] Fourthly, this application provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform any of the aforementioned root cause determination methods.

[0034] Fifthly, this application provides a computer program product containing computer execution instructions, which, when run on a computer, causes the computer to execute any of the aforementioned root cause determination methods.

[0035] In the specific implementation of this application, the names of the components of the aforementioned device do not limit the device itself. In actual implementation, these components may appear under other names. As long as the function of each component is similar to the specific implementation of this application, it falls within the scope of the claims of this application and its equivalents.

[0036] Furthermore, the technical effects of any of the design methods in aspects two through five can be found in the technical effects of the different design methods in aspect one above, and will not be repeated here. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the structure of a fault root cause determination system provided in an embodiment of this application; Figure 2 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application; Figure 3 A schematic diagram of the hardware structure of another electronic device provided in an embodiment of this application; Figure 4 A flowchart illustrating a method for determining the root cause of a fault, provided in an embodiment of this application; Figure 5 This is a schematic diagram of a fault root cause determination device provided in an embodiment of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0040] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "connected" and "linked" should be interpreted broadly, for example, as a fixed connection, a detachable connection, or an integral connection. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances. Furthermore, when describing pipelines, the terms "connected" and "linked" as used in this application have the meaning of establishing electrical connection. The specific meaning needs to be understood in conjunction with the context.

[0041] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0042] As described in the background section, current root cause analysis methods are not accurate enough and are inefficient, making them unsuitable for scenarios with high real-time requirements.

[0043] To address the aforementioned issues, this application provides a method for determining the root cause of a fault, comprising: acquiring operational data of each functional node in a business topology structure, and determining whether a functional node is an abnormal node based on the operational data; the business topology structure contains multiple business links, each business link contains multiple functional nodes, and the business link is used to characterize the calling path traversed to complete a business; in the event of a detected business fault, determining the current business link corresponding to the business fault; filtering out abnormal nodes located in the current business link from the abnormal nodes in the business topology structure as candidate abnormal nodes; calculating the similarity between each candidate abnormal node and the business fault; the similarity is used to characterize the spatiotemporal correlation strength between the candidate abnormal node and the business fault; and determining the root cause node of the business fault from each candidate abnormal node based on the similarity.

[0044] During business operations, abnormal nodes in the global business topology are identified in real time. When a business failure occurs, the current business link corresponding to the failure is determined and combined with the real-time identified abnormal nodes in the global business topology to filter out potential abnormal nodes. In other words, when a business failure occurs, all abnormal nodes in the business topology analysis scope are narrowed down to a few directly related to the failed business. This effectively reduces the computational load in the failure analysis process, thereby shortening the latency of the root cause localization process, improving the efficiency of root cause localization, and making real-time root cause diagnosis of complex systems possible.

[0045] Furthermore, the fault root cause determination step based on the business link in this application can ensure that the starting point for fault root cause determination is the specific fault scenario that users can perceive, rather than the abnormal technical indicators out of context.

[0046] By calculating the similarity between candidate abnormal nodes and business failures, evidence of their relevance to business failures in the time dimension is added to each candidate abnormal node. This effectively identifies and eliminates nodes that are abnormal but not related to the occurrence time of the current failure, avoiding interference from other failures in multi-failure scenarios and accurately locating the root cause of the current business failure.

[0047] In summary, this application employs a process of "real-time detection of global abnormal nodes → selection of candidate abnormal nodes from the current business chain → calculation of the similarity between candidate abnormal nodes and business failures → determination of the root cause node based on similarity." By using dynamic topological associations and statistical similarity for root cause inference, it can adapt to constantly changing microservice architectures and business chains. This approach not only eliminates the need for frequent adjustments to root cause localization rules but also reduces the investment of significant human resources. The solution presented in this application can determine the root cause node more quickly and accurately.

[0048] Figure 1 This is a schematic diagram of a fault root cause determination system provided in an embodiment of this application. Figure 1 As shown, the fault root cause determination system 1 includes: user terminal 10, server 20 and electronic device 30.

[0049] The user terminal 10 communicates with the server 20, and the server 20 communicates with the electronic device 30. The connection can be direct or indirect.

[0050] In some embodiments, the user terminal 10 is used to provide a service access and interaction interface.

[0051] Specifically, user terminal 10 displays a business service page where users can initiate business operations (such as clicking, logging in, etc.). User terminal 10 can also receive and display business results returned by server 20. In the event of a business failure, user terminal 10 can also display a failure page (such as an error pop-up window) and an entry point to trigger root cause diagnosis.

[0052] User terminal 10 can be a terminal device used by the user, such as a mobile phone, computer, or tablet computer. This application does not limit the specific implementation of user terminal 10.

[0053] In some embodiments, server 20 is used to provide business services and computing core.

[0054] Specifically, server 20 runs all the software components that constitute the business application (front-end services, microservices, databases, etc.). Server 20 processes requests sent by user terminal 10, executes business logic, and returns responses. Server 20 hosts all functional nodes in the business topology.

[0055] Server 20 can be a single server or a server cluster. For example, server 20 may include a message queue server (such as a Kafka cluster), a time-series database server (such as an InfluxDB or Prometheus server), a distributed storage / index server (such as an Elasticsearch cluster), etc.

[0056] In some embodiments, a front-end probe is deployed in the user terminal 10 to collect page operation data.

[0057] Specifically, the front-end probe can be deployed in the browser or APP client of the user terminal 10.

[0058] Page operation data can include page performance metrics (such as page load time), user operation events (such as clicks, swipes, etc.), front-end program errors, API requests sent to server 20, global trace identifiers (Trace IDs), etc.

[0059] In some embodiments, a microservice call probe is deployed in server 20 to collect microservice call data.

[0060] Specifically, the microservice call probe can be deployed on each microservice instance running on server 20.

[0061] Microservice call data can include call relationships between services, call duration, status codes (success / error), API requests sent by user terminal 10, Trace ID, etc.

[0062] The front-end probe and microservice call probe can be program code, embedded in the business program of user terminal 10 and server 20.

[0063] In some embodiments, the front-end probe and the microservice call probe may also collect runtime data of each functional node in the business process.

[0064] The data collected by the front-end probe is transmitted from the user terminal 10 to the server 20. The server 20 then transmits the data collected by the front-end probe and the data collected by the microservice call probe to the electronic device 30.

[0065] In some embodiments, electronic device 30 is used to perform a root cause determination process.

[0066] Specifically, electronic device 30 stores received page operation data, microservice call data, and runtime data. It constructs a business topology based on the page operation data collected by the front-end probe and the microservice call data collected by the microservice call probe. This business topology contains multiple business links, each with multiple functional nodes. Each business link represents the call path taken to complete a business task.

[0067] By constructing a business topology structure, the entire business call process chain topology, from business to process to page to backend service to component, was connected.

[0068] Electronic device 30 determines whether a functional node is an abnormal node based on operational data; in the event of a business failure, it determines the current business link corresponding to the business failure; from the abnormal nodes in the business topology, it selects the abnormal nodes located in the current business link as candidate abnormal nodes; it calculates the similarity between each candidate abnormal node and the business failure; the similarity is used to characterize the spatiotemporal correlation strength between the candidate abnormal node and the business failure; based on the similarity, it determines the root cause node of the business failure from each candidate abnormal node.

[0069] The electronic device 30 may specifically be a server or server cluster, or other devices with high-performance computing capabilities, to achieve the process of determining the root cause of a fault in a high-efficiency and accurate manner.

[0070] Electronic device 30 does not directly participate in the real-time business processing; it is an independent device used to analyze the root causes of failures.

[0071] In some embodiments, the fault root cause determination system 1 may further include an interactive device for providing a manual or automatic triggered interface for detecting a business fault (e.g., displaying a one-click diagnostic control when a business fault is detected), and visually displaying the root cause of the business fault.

[0072] Interactive devices can be workstations, mobile terminals, or large-screen displays used by maintenance personnel.

[0073] In some embodiments, the hardware structure of the electronic device may be as follows: Figure 2 As shown, the electronic device includes a processor 101, a memory 102, a communication interface 103, and a bus 104. The memory 102 exists independently of the processor 101. The processor 101, the memory 102, and the communication interface 103 can be connected via the bus 104.

[0074] Processor 101 is the control center of the electronic device. It can be a single processor or a collective term for multiple processing elements. For example, processor 101 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0075] As one embodiment, processor 101 may include one or more CPUs, for example Figure 2 CPU 0 and CPU 1 are shown in the diagram.

[0076] The memory 102 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0077] The memory 102 can be connected to the processor 101 via the bus 104 and is used to store instructions or program code. When the processor 101 calls and executes the instructions or program code stored in the memory 102, it can implement the fault root cause determination method provided in this embodiment of the invention.

[0078] The communication interface 103 is used to connect with other devices via a communication network. The communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. The communication interface 103 may include a receiving unit for receiving data and a transmitting unit for sending data.

[0079] Bus 104 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 2 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0080] In other embodiments, the memory 102 may also be integrated with the processor 101. For example... Figure 3 As shown, the electronic device may include a processor 105 and a communication interface 106, with the processor 105 coupled to the communication interface 106.

[0081] The functions of processor 105 can be referred to in the description of processor 101 above. In addition, processor 105 also has storage functions, which can be referred to in the description of memory 102 above.

[0082] The communication interface 106 is used to provide data to the processor 105. The communication interface 106 can be an internal interface of the electronic device or an external interface of the electronic device (equivalent to the communication interface 103).

[0083] It should be pointed out that, Figure 2 (or Figure 3 The structures shown in the document do not constitute a limitation on the electronic device, except... Figure 2 (or Figure 3 In addition to the components shown in the diagram, the electronic device may include more or fewer components than those shown, or combine certain components, or have different component arrangements.

[0084] The following is in conjunction with the above. Figure 1 The fault root cause determination system shown above and the above Figure 2 (or Figure 3 The electronic device shown in the present application provides a detailed description of the fault root cause determination method provided in the embodiments of this application.

[0085] Figure 4 This is a flowchart illustrating a method for determining the root cause of a fault, provided in an embodiment of this application. This method can be executed by the aforementioned electronic device 30 and includes: S101. Obtain the running data of each functional node in the business topology and determine whether the functional node is an abnormal node based on the running data.

[0086] In some embodiments, the operating data is collected periodically; the electronic device determines whether a functional node is an abnormal node based on the operating data, which can be specifically implemented as follows: if the operating data of the current period does not fall within the preset threshold range corresponding to the current period, the functional node is determined to be an abnormal node; or, the operating data of the current period is compared with the operating data of the same time period in the previous period to determine whether the functional node is an abnormal node; or, the operating data of the current period is compared with the operating data of the previous period to determine whether the functional node is an abnormal node.

[0087] For example, through statistical analysis (such as calculating moving averages and standard deviations), it can be concluded that: on weekdays between 9-10 AM, the normal latency range for service A is typically between 50ms ± 15ms; while between 2-3 AM, the normal range is between 20ms ± 5ms. When operational data is obtained between 9-10 AM, it is determined whether the corresponding functional node is an abnormal node by checking if the data falls within the preset threshold range of "50ms ± 15ms". When operational data is obtained between 2-3 AM, it is determined whether the corresponding functional node is an abnormal node by checking if the data falls within the preset threshold range of "20ms ± 5ms".

[0088] Another example involves longer periods, such as days or weeks, comparing the current time period's operational data with the same time period in the previous period. For instance, a daily year-on-year comparison (comparing to the same time the previous day): if the service error rate at 10:00 AM today is 0.5%, while the error rate at 10:00 AM yesterday was 0.1%, representing a 5-fold increase compared to the same time the previous day, this high growth rate indicates that the functional node is an abnormal node. Similarly, a weekly year-on-year comparison (comparing to the same time of the same day last week): if today is Tuesday at 10:00 AM, the operational data for this time period is compared with the operational data at 10:00 AM last Tuesday to determine whether the corresponding functional node is an abnormal node.

[0089] Another example involves shorter periods, such as minutes or hours, comparing operational data over time. For instance, if the service request volume suddenly drops by 80% compared to the previous minute, this could indicate a problem with the ingress network or load balancer, identifying the functional node corresponding to this service request volume as an abnormal node.

[0090] Based on the above approach, the step of "identifying anomalous nodes" is upgraded from a simple judgment based on fixed rules to intelligent analysis based on historical data and time-series patterns. This greatly improves the accuracy of anomaly detection, ensuring that the nodes in the subsequent "anomaly subgraph" are high-quality, truly suspicious root cause candidates, thus laying a reliable data foundation for the entire root cause diagnosis process.

[0091] S102. In the event of a detected service failure, determine the current service link corresponding to the service failure.

[0092] Specifically, when a service failure occurs, the user terminal, server, or interactive device sends a root cause diagnosis trigger request to the electronic device. This request contains contextual information that can pinpoint the specific service operation, such as the user session identifier, user ID, timestamp of the failure, the specific page or service function code where the failure occurred, and the Trace ID corresponding to the front-end operation that caused the failure. The electronic device then queries the service topology based on the contextual information to locate the current service link corresponding to the service failure.

[0093] S103. Select abnormal nodes located in the current business link from the abnormal nodes in the business topology as candidate abnormal nodes.

[0094] Based on the process of real-time detection of abnormal nodes in the service topology in step S101 above, the electronic device maintains a real-time updated global list of abnormal nodes, recording all functional nodes marked as abnormal in the entire system at the current moment and their identifiers (such as service name, instance IP, etc.). Combined with the current service link corresponding to the service fault determined in step S102, abnormal nodes located in the current service link can be filtered out.

[0095] S104. Calculate the similarity between each candidate abnormal node and the business failure.

[0096] Among them, similarity is used to characterize the spatiotemporal correlation strength between candidate abnormal nodes and business failures.

[0097] In some embodiments, step S104 can be specifically implemented as follows: based on the occurrence time of the business failure, determine the target time period, and the occurrence time of the business failure falls within the target time period; obtain the first change curve of the running data of each candidate abnormal node within the target time period, and the second change curve of the business failure; use the Pearson correlation coefficient algorithm to calculate the correlation coefficient between the first change curve and the second change curve, and use the correlation coefficient as the similarity between the candidate abnormal node and the business failure.

[0098] Optionally, the similarity value ranges from [-1, 1].

[0099] For example, the target time period is a first preset time period before the occurrence of the business failure and a second preset time period after the occurrence of the business failure.

[0100] For example, the system obtains the operational data of the candidate abnormal node at multiple times within a target time period, resulting in a first curve showing the change of the candidate abnormal node's operational data over time. Then, it obtains data at multiple times within the target time period that directly characterizes the current business failure, resulting in a second curve representing the change of the business failure data over time. The time points of the first and second curves are aligned, meaning they share the same timestamp sequence.

[0101] When the correlation coefficient calculated using the Pearson correlation coefficient algorithm is approximately 1, it indicates that the first change curve of the candidate anomaly node rises and falls almost in tandem with the second change curve of the current business failure, making it highly likely to be the direct cause or key link leading to the failure. When the correlation coefficient is approximately 0, it indicates that the anomaly of the candidate anomaly node is unrelated to the current business failure in time, and may be an independent anomaly event. When the correlation coefficient is approximately -1, it indicates that the first change curve of the candidate anomaly node shows a completely opposite trend to the second change curve of the current business failure, possessing special diagnostic value.

[0102] By calculating the correlation coefficient using the Pearson correlation coefficient algorithm, the qualitative correlation is transformed into a quantitative correlation strength, providing objective and calculable data for subsequent determination of the root cause of the failure, thereby accurately locating the root cause of the failure.

[0103] Optionally, electronic devices can also use algorithms such as Spearman's rank correlation coefficient algorithm, dynamic time warping algorithm, mutual information algorithm, and cosine similarity algorithm to calculate the spatiotemporal correlation strength between candidate abnormal nodes and business faults.

[0104] In some embodiments, the candidate abnormal nodes constitute an abnormal subgraph, which is a directed weighted graph; the nodes in the abnormal subgraph are candidate abnormal nodes, and the edges in the abnormal subgraph are used to represent the calling relationship between the candidate abnormal nodes; the direction of the edges is used to represent the calling direction; the edges have weights, which are determined based on the calling index data between the candidate abnormal nodes and the similarity between the candidate abnormal nodes and the business failure.

[0105] The abnormal subgraph is actually obtained by pruning normal functional nodes and functional nodes that are not related to the current business link. This constructs a weighted abnormal subgraph that integrates multi-dimensional business evidence (call metrics) and fault context evidence (similarity), providing accurate, efficient, interpretable and adaptive input for subsequent intelligent ranking algorithms, fundamentally improving the accuracy, speed and reliability of fault root cause diagnosis.

[0106] In the two candidate abnormal nodes connected by the edge, one is the parent node and the other is the child node, and the direction of the edge is from the parent node to the child node.

[0107] In some embodiments, the weight of an edge is determined as follows: the ratio between at least one call metric data of the parent node to the child node and the sum of the call metric data corresponding to the parent node is determined as the call metric score of the child node; the ratio between the similarity of the child node and the similarity of the parent node is determined as the similarity score of the child node; the proportion of the total score of the child node corresponding to the edge to the sum of the total scores of the child nodes corresponding to all outgoing edges of the parent node is determined as the weight of the edge; the total score of the child node is the sum of the call metric score of the child node and the similarity score of the child node.

[0108] By integrating indicator data with similarity from multiple dimensions, the edge weights simultaneously carry dual information: the importance of the propagation path and its relevance to the business failure. This allows for more comprehensive and accurate reasoning that closely reflects the actual failure propagation logic, significantly improving the accuracy of root cause identification. Furthermore, probability normalization is performed during edge weight calculation, ensuring that the sum of the weights of edges from a parent node to all its child nodes is 1. This allows the calculated weights to be directly used as transition probabilities (propagation probabilities) in subsequent random walk algorithms like PageRank, without any additional transformation. This converts the importance scores of the propagation path into usable parameters for the algorithm, achieving seamless integration from business indicators to algorithm input and guaranteeing the mathematical rationality and efficiency of algorithm convergence. Each calculation step has a clear business meaning, forming a complete chain of evidence, making the root cause diagnosis process traceable, verifiable, and trustworthy, thus improving the credibility of the root cause diagnosis results. Moreover, the entire calculation process involves only ratio, addition, and division operations, resulting in extremely low computational complexity. This reduces computational latency, improves computational efficiency, and ensures the real-time nature of root cause identification.

[0109] Specifically, the call metric data includes call volume, average call duration, and call error count. The call metric score for a child node is determined by the ratio of at least one call metric data point from the parent node to the child node, to the sum of all call metric data for the parent node. This includes: determining the child node's call volume score by the ratio of the parent node's call volume to the sum of all call volumes for the parent node; determining the child node's average call duration score by the ratio of the parent node's average call duration to the sum of all call durations for the parent node; determining the child node's call error count score by the ratio of the parent node's call error count to the sum of all call error counts for the parent node; and finally, the sum of the call volume score, average call duration score, and call error count score is determined as the call metric score.

[0110] Call volume score: Represents the business traffic dimension. A high ratio indicates that this path is the parent node's primary business exit point, and its problems will affect a wider range of user requests.

[0111] Average call time score: Represents the performance bottleneck. A high score indicates that this path is the slowest part of the parent node's processing flow, and is likely the direct cause of upstream congestion and timeouts.

[0112] Error call score: Represents the dimension of functional failure. A high ratio indicates that this path is the primary failure exit point of the parent node, directly generating a large number of failed requests.

[0113] The units and ranges of call volume, time consumption, and error volume vary greatly (e.g., tens of thousands of calls, single digits of errors). Ratio calculations scale them down to the same scale (between 0 and 1), making the subsequent summation operation fair and avoiding the natural suppression of smaller metrics (e.g., error volume) by larger absolute values ​​(e.g., call volume).

[0114] The score does not reflect the absolute severity, but rather the relative severity among all outgoing paths from the parent node. Even if the absolute error value of a path is not high, it will still receive a high error score if other paths from the parent node are almost error-free, which accurately points out the weakest link in the business process.

[0115] The aforementioned calculation rules transform the originally abstract "call indicator data" into a quantifiable "path anomaly comprehensive index," which is a combination of three key indicators—business traffic, performance bottlenecks, and functional failures—after fair normalization. This allows subsequent edge weight calculations and even the entire PageRank algorithm to no longer be based on fuzzy "connection relationships," but rather on a multi-dimensional, refined, and comparable quantitative assessment of the severity of anomalies in each call path. This significantly improves the accuracy, reliability, and practicality of locating the true root cause of problems in the entire system.

[0116] S105. Based on similarity, determine the root cause node of the business failure from each candidate abnormal node.

[0117] In some embodiments, step S105 can be specifically implemented as follows: based on the weights of the edges between the candidate abnormal nodes in the abnormal subgraph, the root cause probability of each candidate abnormal node is calculated using a graph sorting algorithm; and based on the root cause probability, the root cause node of the business failure is determined from each candidate abnormal node.

[0118] For example, sort the nodes in descending order of their root cause probability values ​​and identify the first-ranked (highest root cause probability) candidate anomaly node as the root cause node of the business failure.

[0119] For example, candidate abnormal nodes whose root cause probability values ​​exceed a preset threshold are identified as the root cause nodes of business failures.

[0120] For example, sort the nodes in descending order of their root cause probability values ​​and identify the top N (where N is a positive integer, such as N=3) of the candidate abnormal nodes as the root cause nodes of the business failure.

[0121] Determining root causes is not simply a matter of similarity ranking, but rather a comprehensive calculation based on graph structures. Through the mathematical model of graph ranking, the abnormal subgraph containing rich business semantics is transformed into a precise, stable, and interpretable root cause probability ranking, facilitating the identification of the root cause nodes most likely to lead to business failures.

[0122] In some embodiments, the graph sorting algorithm is the PageRank algorithm. Based on the weights of the edges between candidate anomalous nodes in the anomalous subgraph, the root cause probability of each candidate anomalous node is calculated by the graph sorting algorithm. Specifically, this can be implemented as follows: the weights of the edges between candidate anomalous nodes in the anomalous subgraph are used as the propagation probability of the edges in the PageRank algorithm; based on the propagation probability, the root cause probability of each candidate anomalous node is iteratively calculated using the PageRank algorithm.

[0123] The weights of edges in the anomaly subgraph contain rich business semantics (call volume, error volume, similarity, etc.). The edge weights serve as the propagation probability of the edges, transforming the business judgment problem into an iteratively solvable mathematical problem. This allows subsequent complex reasoning processes to be built on a rigorous and computable mathematical foundation, eliminating the ambiguity of the calculation process.

[0124] The iterative computation process of the PageRank algorithm possesses robust mathematical properties. It has been mathematically proven that the algorithm inevitably converges to a unique stable probability distribution, meaning that regardless of the structure of the anomalous subgraph, the computation will always terminate and produce a definite result. The computation time of the iterative computation is deterministic and predictable, meeting the real-time requirements of fault diagnosis scenarios and avoiding problems such as infinite loops or computational explosion. The iterative computation process of the PageRank algorithm can guarantee stable and rapid output results under any fault scenario.

[0125] In some embodiments, the root cause probability of each candidate anomalous node is iteratively calculated using the PageRank algorithm based on the propagation probability. This can be specifically implemented as follows: assigning an initial probability value to each candidate anomalous node; performing multiple rounds of iterative calculation using the PageRank algorithm; updating the root cause probability of the candidate anomalous node based on its current root cause probability and propagation probability during each round of iterative calculation; stopping the iterative calculation process when the iteration termination condition is met, and determining the root cause probability of the candidate anomalous node after the last round of iterative calculation as the final root cause probability of the candidate anomalous node.

[0126] For example, the iteration termination condition can be: the number of iterations reaches a preset maximum number, or the change in the root cause probability value of all nodes between two consecutive iterations is less than a preset threshold.

[0127] If a node (such as service A) is itself abnormal (high similarity) and its path to calling its downstream (service B) is seriously problematic (significant edge weight), then service A's "suspicion" (root cause probability) will flow heavily to service B. In the next iteration, the highly suspicious service B will act as a "significant voter," feeding back a portion of its root cause probability to its upstream service A according to its weight. This process repeats, and the true source of the problem (root cause) will continuously receive "suspicion" feedback through the entire downstream problem network, thus standing out in the final ranking. Those isolated abnormal nodes or those weakly associated with the main failure chain will have their root cause probability diluted during iterations because they cannot form this positive amplification and negative convergence network effect.

[0128] By leveraging the mutual corroboration of edge weights among candidate anomaly nodes, the root cause probability of the final root cause node is significantly higher than that of other nodes, thus achieving accurate determination of the true root cause in complex scenarios.

[0129] In some embodiments, updating the root cause probability of a candidate anomalous node based on its current root cause probability and propagation probability can be specifically implemented as follows: for each candidate anomalous node, the root cause probability of the candidate anomalous node is obtained based on the base probability and the allocation probability corresponding to each parent node of the candidate anomalous node; the allocation probability corresponding to the parent node is determined based on the root cause probability of the parent node in the previous iteration calculation process and the propagation probability of the edge between the parent node and the candidate anomalous node.

[0130] Specifically, the root cause probability satisfies the following relationship: ; Where PR(i) represents the root cause probability of the i-th candidate anomalous node in the anomalous subgraph, d represents the damping factor, and N represents the number of candidate anomalous nodes in the anomalous subgraph. This is used to represent the root cause probability of each parent node of the i-th candidate anomalous node in the previous iteration calculation process. This is used to represent the propagation probability from each parent node of the i-th candidate anomalous node to the i-th candidate anomalous node. This represents the allocation probability of each parent node corresponding to the i-th candidate abnormal node, and n represents the number of parent nodes of the i-th candidate abnormal node.

[0131] The damping factor is used to prevent isolated nodes or nodes that only enter but never exit. A typical value for the damping factor is 0.85. Under the influence of the damping factor d, the graph will eventually converge to a unique, stable probability distribution independent of the initial value. This means that regardless of where the calculation begins, as long as the graph structure and edge weights remain unchanged, the same root cause probability ranking will be obtained.

[0132] The base probability represents the randomness at which a failure can occur independently on any node. This ensures that a node without any incoming edges (i.e., not invoked by any other anomalous node) still has a chance to obtain a certain root cause probability if it is anomalous, thus preventing the underreporting of independent, source-related failures. Each update includes a stable injection of the base probability, which prevents the root cause probability from decaying to zero or overflowing during iterations, guaranteeing the numerical stability of the computation.

[0133] The parent node allocation probability represents the inevitability of a fault propagating downstream along the call chain, and its calculation method precisely quantifies the responsibility allocation of the parent node to the child node.

[0134] The probability that a node is the root cause comes partly from the possibility that it might have a problem itself (base probability), but a larger part is the probability assigned to it by its upstream "suspects" (parent nodes) based on the severity of their respective problems. This calculation method is intuitive and greatly enhances the credibility and acceptability of the algorithm's conclusions.

[0135] Alternatively, electronic devices may also use algorithms such as Personalized PageRank, Random Walk with Restart, Eigenvector centrality, and Katz centrality to calculate the root cause probability of each candidate anomalous node.

[0136] Figure 4 The technical solution shown brings at least the following beneficial effects: During business operations, abnormal nodes in the global business topology are identified in real time. When a business failure occurs, the current business link corresponding to the failure is determined and combined with the real-time identified abnormal nodes in the global business topology to filter out potential abnormal nodes. In other words, when a business failure occurs, all abnormal nodes in the business topology analysis scope are narrowed down to a few directly related to the failed business. This effectively reduces the computational load in the failure analysis process, thereby shortening the latency of the root cause localization process, improving the efficiency of root cause localization, and making real-time root cause diagnosis of complex systems possible.

[0137] Furthermore, the fault root cause determination step based on the business link in this application can ensure that the starting point for fault root cause determination is the specific fault scenario that users can perceive, rather than the abnormal technical indicators out of context.

[0138] By calculating the similarity between candidate abnormal nodes and business failures, evidence of their relevance to business failures in the time dimension is added to each candidate abnormal node. This effectively identifies and eliminates nodes that are abnormal but not related to the occurrence time of the current failure, avoiding interference from other failures in multi-failure scenarios and accurately locating the root cause of the current business failure.

[0139] In summary, this application employs a process of "real-time detection of global abnormal nodes → selection of candidate abnormal nodes from the current business chain → calculation of the similarity between candidate abnormal nodes and business failures → determination of the root cause node based on similarity." By using dynamic topological associations and statistical similarity for root cause inference, it can adapt to constantly changing microservice architectures and business chains. This approach not only eliminates the need for frequent adjustments to root cause localization rules but also reduces the investment of significant human resources. The solution presented in this application can determine the root cause node more quickly and accurately.

[0140] The foregoing primarily describes the solution provided in this application from a methodological perspective. It is understood that, to achieve the aforementioned functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the algorithmic steps of the examples described in conjunction with the embodiments disclosed herein, the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0141] like Figure 5 The diagram shown is a structural schematic of a fault root cause determination device 40 provided in an embodiment of this application. The fault root cause determination device 40 includes: an acquisition module 401 and a processing module 402.

[0142] The acquisition module 401 is used to acquire the running data of each functional node in the business topology structure. The business topology structure contains multiple business links, and each business link contains multiple functional nodes. The business link is used to represent the calling path taken to complete a business. The processing module 402 is used to: determine whether a functional node is an abnormal node based on the running data; determine the current business link corresponding to the business fault when a business fault is detected; filter the abnormal nodes located in the current business link from the abnormal nodes in the business topology structure as candidate abnormal nodes; calculate the similarity between each candidate abnormal node and the business fault; the similarity is used to represent the spatiotemporal correlation strength between the candidate abnormal node and the business fault; and determine the root cause node of the business fault from each candidate abnormal node based on the similarity.

[0143] Optionally, the business topology is constructed based on page operation data collected by the front-end probe and microservice call data collected by the microservice call probe.

[0144] Optionally, the running data is collected periodically; the processing module 402 is specifically used to: determine the functional node as an abnormal node if the running data of the current period does not fall within the preset threshold range corresponding to the current period; or, compare the running data of the current period with the running data of the same time period in the previous period to determine whether the functional node is an abnormal node; or, compare the running data of the current period with the running data of the previous period to determine whether the functional node is an abnormal node.

[0145] Optionally, the processing module 402 is specifically used to: determine a target time period based on the occurrence time of the business failure, wherein the occurrence time of the business failure falls within the target time period; obtain the first change curve of the running data of each candidate abnormal node within the target time period, and the second change curve of the business failure; use the Pearson correlation coefficient algorithm to calculate the correlation coefficient between the first change curve and the second change curve, and use the correlation coefficient as the similarity between the candidate abnormal node and the business failure.

[0146] Optionally, the candidate abnormal nodes form an abnormal subgraph, which is a directed weighted graph; the nodes in the abnormal subgraph are candidate abnormal nodes, and the edges in the abnormal subgraph are used to represent the calling relationship between the candidate abnormal nodes; the direction of the edges is used to represent the calling direction; the edges have weights, which are determined based on the calling index data between the candidate abnormal nodes and the similarity between the candidate abnormal nodes and the business faults.

[0147] Optionally, among the two candidate abnormal nodes connected by the edge, one is the parent node and the other is the child node, and the direction of the edge is from the parent node to the child node; the processing module 402 is specifically used to: determine the child node's call index score by comparing the ratio between at least one call index data of the parent node to the child node and the sum of the call index data of the parent node; determine the child node's similarity score by comparing the similarity of the child node to the similarity of the parent node; determine the edge weight by comparing the total score of the child node corresponding to the edge with the total score of the child nodes corresponding to all outgoing edges of the parent node; the total score of the child node is the sum of the child node's call index score and the child node's similarity score.

[0148] Optionally, the call metric data includes call volume, average call time, and call error count. The processing module 402 is specifically used to: determine the call volume score of the child node by comparing the call volume from the parent node to the child node with the total call volume corresponding to the parent node; determine the average call time score of the child node by comparing the average call time from the parent node to the child node with the total call time corresponding to the parent node; determine the call error count score of the child node by comparing the call error count from the parent node to the child node with the total call error count corresponding to the parent node; and determine the call metric score by summing the call volume score, the average call time score, and the call error count score.

[0149] Optionally, the processing module 402 is specifically used to: calculate the root cause probability of each candidate abnormal node based on the weight of the edges between the candidate abnormal nodes in the abnormal subgraph using a graph sorting algorithm; and determine the root cause node of the business failure from each candidate abnormal node according to the root cause probability.

[0150] Optionally, the graph sorting algorithm is the PageRank algorithm; the processing module 402 is specifically used to: use the weights of the edges between the candidate abnormal nodes in the abnormal subgraph as the propagation probability of the edges in the PageRank algorithm; and based on the propagation probability, iteratively calculate the root cause probability of each candidate abnormal node through the PageRank algorithm.

[0151] Optionally, the processing module 402 is specifically used to: assign an initial probability value to each candidate anomalous node; perform multiple rounds of iterative calculation using the PageRank algorithm; during each round of iterative calculation, update the root cause probability of the candidate anomalous node based on the current root cause probability and propagation probability of the candidate anomalous node; and stop the iterative calculation process when the iteration termination condition is met, and determine the root cause probability of the candidate anomalous node after the last round of iterative calculation as the final root cause probability of the candidate anomalous node.

[0152] Optionally, in the two candidate abnormal nodes connected by the edge, one is the parent node and the other is the child node, and the direction of the edge is from the parent node to the child node; the processing module 402 is specifically used to: for each candidate abnormal node, based on the base probability and the allocation probability corresponding to each parent node of the candidate abnormal node, obtain the root cause probability of the candidate abnormal node; the allocation probability corresponding to the parent node is determined based on the root cause probability of the parent node in the previous iteration calculation process and the propagation probability of the edge between the parent node and the candidate abnormal node.

[0153] This application embodiment can divide the fault root cause determination device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0154] This application also provides an electronic device, including a processor and a memory. The memory stores computer execution instructions, and the processor is connected to the memory. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to enable the electronic device to perform any of the fault root cause determination methods provided in the above embodiments.

[0155] This application also provides a computer-readable storage medium including computer-executable instructions that, when run on a computer, cause the computer to execute any of the fault root cause determination methods provided in the above embodiments.

[0156] This application also provides a computer program product containing computer execution instructions, which, when run on a computer, causes the computer to execute any of the fault root cause determination methods provided in the above embodiments.

[0157] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer-executable instructions. When these computer-executable instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer-executable instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0158] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0159] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0160] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A failure root cause determination method, characterized by, The method comprises: obtaining running data of each functional node in a service topology, and determining whether the functional node is an abnormal node based on the running data; the service topology comprises a plurality of service links, each service link comprising a plurality of functional nodes, and the service link is used to represent a calling path for completing a service; in the case of detecting a service failure, determining a current service link corresponding to the service failure; from the abnormal nodes in the service topology, screening out abnormal nodes located in the current service link as candidate abnormal nodes; calculating the similarity between each candidate abnormal node and the service failure; the similarity is used to represent the spatio-temporal correlation strength between the candidate abnormal node and the service failure; based on the similarity, determining a root cause node of the service failure from each candidate abnormal node.

2. The method of claim 1, wherein, The service topology is constructed based on page operation data collected by a front-end probe and micro-service calling data collected by a micro-service calling probe.

3. The method of claim 1, wherein, The running data is collected periodically; the determination of whether the functional node is an abnormal node based on the running data comprises: in the case where the running data of the current period does not fall within a preset threshold range corresponding to the current period, determining that the functional node is an abnormal node; or, comparing the running data of the current period with the running data of the same time period in the last period to determine whether the functional node is an abnormal node; or, comparing the running data of the current period with the running data of the last period to determine whether the functional node is an abnormal node.

4. The method of claim 1, wherein, The calculation of the similarity between each candidate abnormal node and the service failure comprises: based on the occurrence time of the service failure, determining a target time period, and the occurrence time of the service failure falls within the target time period; obtaining a first change curve of the running data of each candidate abnormal node in the target time period and a second change curve of the service failure; using a Pearson correlation coefficient algorithm to calculate the correlation coefficient between the first change curve and the second change curve, and taking the correlation coefficient as the similarity between the candidate abnormal node and the service failure.

5. The method of claim 1, wherein, The candidate abnormal nodes form an abnormal subgraph, and the abnormal subgraph is a directed weighted graph; the nodes of the abnormal subgraph are the candidate abnormal nodes, the edges in the abnormal subgraph are used to represent the calling relationship between the candidate abnormal nodes, the direction of the edge is used to represent the calling direction, and the edge has a weight, which is determined based on the calling index data between the candidate abnormal nodes and the similarity between the candidate abnormal nodes and the service failure.

6. The method of claim 5, wherein, of the two candidate abnormal nodes connected by the edge, one is a parent node and the other is a child node, and the direction of the edge is from the parent node to the child node; the weight of the edge is determined by: determining the calling index score of the child node as the ratio between at least one calling index data of the parent node to the child node and the total sum of the calling index data corresponding to the parent node. determine a ratio between the similarity corresponding to the child node and the similarity corresponding to the parent node as a similarity score of the child node; determine a ratio between the total score of the child node and a sum of total scores of all child nodes corresponding to all outgoing edges of the parent node as a weight of the edge; the total score of the child node is a sum of the call indicator score of the child node and the similarity score of the child node.

7. The method of claim 6, wherein, The call indicator data includes a call volume, a call average time consumption, and a call error volume; The call indicator score of the child node is determined by a ratio between at least one call indicator data of the child node and a sum of call indicator data corresponding to the parent node, including: The call volume score of the child node is determined by a ratio between a call volume of the child node and a sum of call volumes corresponding to the parent node; The call average time consumption score of the child node is determined by a ratio between a call average time consumption of the child node and a sum of call time consumptions corresponding to the parent node; The call error volume score of the child node is determined by a ratio between a call error volume of the child node and a sum of call error volumes corresponding to the parent node; The call indicator score is determined by a sum of the call volume score, the call average time consumption score, and the call error volume score.

8. The method of claim 5, wherein, The root cause node of the service fault is determined from each of the candidate abnormal nodes based on the similarity, including: The root cause probability of each of the candidate abnormal nodes is calculated by a graph ranking algorithm based on the weight of the edge between the candidate abnormal nodes in the abnormal subgraph; The root cause node of the service fault is determined from each of the candidate abnormal nodes according to the root cause probability.

9. The method of claim 8, wherein, The graph ranking algorithm is a PageRank algorithm; The root cause probability of each of the candidate abnormal nodes is calculated by the PageRank algorithm based on the weight of the edge between the candidate abnormal nodes in the abnormal subgraph, including: The weight of the edge between the candidate abnormal nodes in the abnormal subgraph is taken as a propagation probability of the edge in the PageRank algorithm; The root cause probability of each of the candidate abnormal nodes is iteratively calculated by the PageRank algorithm based on the propagation probability.

10. The method of claim 9, wherein, The root cause probability of each of the candidate abnormal nodes is iteratively calculated by the PageRank algorithm based on the propagation probability, including: An initial probability value is assigned to each of the candidate abnormal nodes; The PageRank algorithm is used for multi-round iterative calculation; In each round of iterative calculation, the root cause probability of the candidate abnormal node is updated based on the current root cause probability of the candidate abnormal node and the propagation probability; In the case of meeting an iteration termination condition, the iterative calculation process is stopped, and the root cause probability of the candidate abnormal node after the last round of iterative calculation is determined as the final root cause probability of the candidate abnormal node.

11. The method of claim 10, wherein, In the two candidate abnormal nodes connected by the edge, one is a parent node and the other is a child node, and the direction of the edge is from the parent node to the child node; The updating of the root cause probability of the candidate abnormal node based on the current root cause probability of the candidate abnormal node and the propagation probability comprises: For each candidate abnormal node, a root cause probability of the candidate abnormal node is obtained based on a basic probability and assigned probabilities of respective parent nodes of the candidate abnormal node; the assigned probability of the parent node is determined based on a root cause probability of the parent node in a last round of iteration calculation and a propagation probability of an edge between the parent node and the candidate abnormal node.

12. An electronic device, comprising: The electronic device comprises a memory and a processor; The memory and the processor are coupled; The memory is configured to store computer program code, the computer program code comprising computer instructions; When the processor executes the computer instructions, the electronic device is caused to perform the method of any one of claims 1-11.

Images