Network fault diagnosis method and device based on path graph, electronic equipment and storage medium

Abstract

The application discloses a network fault diagnosis method and device based on a path graph, electronic equipment and a storage medium, relates to the technical field of artificial intelligence and network security, can capture subtle local anomalies and macro global features in the path graph at the same time, avoids the problem of global context missing, and improves the accuracy of network fault diagnosis. The method comprises the following steps: based on a local feature extraction layer in a pre-trained path graph analysis model, generating a corresponding local feature vector for each graph node in a plurality of graph nodes included in the path graph; through a global feature extraction layer in the path analysis model, performing global pooling processing on the plurality of local feature vectors to obtain a global feature vector; using a classification layer in the path graph analysis model, performing anomaly evaluation on the plurality of local feature vectors to obtain a local anomaly abstract vector, constructing a joint feature vector, and using the classification layer in the path graph analysis model to perform analysis to obtain a fault diagnosis result of the path graph.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and network security technology, and in particular to a network fault diagnosis method, device, electronic device and storage medium based on path graph. Background Technology

[0002] In the wave of digitalization, the log data generated by system operation contains key information such as system status, faults, and security threats. Converting logs into a graph structure can intuitively present the relationships between log elements in the form of nodes and edges, providing a new perspective for data analysis. Among them, the path graph, as a special form of graph structure, has strict linear order and directionality, and information propagates bidirectionally along the path.

[0003] In related technologies, graph neural network (GNN) models such as graph convolutional networks (GCN) and graph attention networks (GAT) are commonly used for graph structure analysis. These models are designed for graphs with arbitrary topologies, such as social networks and knowledge graphs. The core operation is to aggregate all neighbor information of the target node in order to capture the node association features and realize the understanding and analysis of graph data.

[0004] However, the applicant recognizes that the relevant technology has at least the following technical problems: For path graph nodes generated from log data with sparse neighbors, the powerful aggregation function of general GNN is prone to overfitting, and its attention mechanism may assign meaningless weights to sparse neighbors, introducing noise. At the same time, in fault and attack pattern analysis, general GNN models have difficulty capturing local features and perceiving the global situation, resulting in a lack of global context and making it difficult to accurately diagnose network faults. Summary of the Invention

[0005] In view of this, this application provides a network fault diagnosis method, device, electronic device and storage medium based on path graph. The main purpose is to solve the problem that the current general GNN model is difficult to capture local features and perceive the global situation at the same time, and has the problem of missing global context, which makes it difficult to achieve accurate diagnosis of network faults.

[0006] According to a first aspect of this application, a network fault diagnosis method based on path graphs is provided, the method comprising: The path graph to be diagnosed in the network is determined. Based on the local feature extraction layer in the pre-trained path graph analysis model, a corresponding local feature vector is generated for each graph node in the path graph, so as to obtain multiple local feature vectors corresponding to the multiple graph nodes. The global feature extraction layer in the path analysis model performs global pooling on the multiple local feature vectors to obtain the global feature vector corresponding to the path graph. The classification layer in the path graph analysis model is used to evaluate the anomalies of the multiple local feature vectors to obtain local anomaly summary vectors. A joint feature vector is constructed using the global feature vector and the local anomaly summary vector. The classification layer in the path graph analysis model is then used to analyze the global feature vector and the joint feature vector to obtain the fault diagnosis result of the path graph.

[0007] According to a second aspect of this application, a network fault diagnosis device based on a path graph is provided, the device comprising: The local feature vector generation module is used to determine the path graph to be diagnosed in the network. Based on the local feature extraction layer in the pre-trained path graph analysis model, it generates a corresponding local feature vector for each of the multiple graph nodes included in the path graph, thereby obtaining multiple local feature vectors corresponding to the multiple graph nodes. The global feature vector generation module is used to perform global pooling processing on the multiple local feature vectors through the global feature extraction layer in the path analysis model to obtain the global feature vector corresponding to the path graph. The analysis module is used to perform anomaly assessment on the multiple local feature vectors using the classification layer in the path graph analysis model to obtain local anomaly summary vectors, and to construct a joint feature vector using the global feature vector and the local anomaly summary vectors. The classification layer in the path graph analysis model is then used to analyze the global feature vector and the joint feature vector to obtain the fault diagnosis result of the path graph.

[0008] According to a third aspect of this application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any of the first aspects above.

[0009] According to a fourth aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects above.

[0010] By employing the above technical solutions, this application provides a network fault diagnosis method, apparatus, electronic device, and storage medium based on path graphs. This application determines the path graph to be diagnosed in the network fault diagnosis process. Based on the local feature extraction layer in a pre-trained path graph analysis model, it generates corresponding local feature vectors for each of the multiple graph nodes included in the path graph, resulting in multiple local feature vectors corresponding to multiple graph nodes. Through the global feature extraction layer in the path analysis model, it performs global pooling on the multiple local feature vectors to obtain the global feature vector corresponding to the path graph. Using the classification layer in the path graph analysis model, it performs anomaly evaluation on the multiple local feature vectors to obtain local anomaly summary vectors. Furthermore, it constructs a joint feature vector using the global feature vector and the local anomaly summary vector, and uses the classification layer in the path graph analysis model to analyze the global feature vector and the joint feature vector to obtain the fault diagnosis result of the path graph. Through a three-stage design of local convolution, global attention pooling, and feature fusion, it simultaneously captures subtle local anomalies and macroscopic global features in the path graph, avoiding the problem of missing global context and improving the accuracy of network fault diagnosis.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This paper illustrates a schematic flowchart of a network fault diagnosis method based on a path graph, as provided in an embodiment of this application. Figure 2 This illustration shows a schematic diagram of an initial analysis model architecture provided in an embodiment of this application; Figure 3 This diagram illustrates how the receptive field of a node expands with increasing convolutional layer number, as provided in an embodiment of this application. Figure 4 This paper illustrates a schematic flowchart of another network fault diagnosis method based on a path graph provided in an embodiment of this application. Figure 5 This illustration shows a schematic diagram of a network fault diagnosis device based on a path graph according to an embodiment of this application. Figure 6A schematic diagram of the device structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0013] Exemplary embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0014] This application provides a network fault diagnosis method based on path graphs, such as... Figure 1 As shown, the method includes: S10: Determine the path graph for network fault diagnosis, and generate a corresponding local feature vector for each graph node in the path graph based on the local feature extraction layer in the pre-trained path graph analysis model, thereby obtaining multiple local feature vectors corresponding to multiple graph nodes.

[0015] This application embodiment can be applied to a fault diagnosis system. The fault diagnosis system determines the path graph to be diagnosed in the network, analyzes the path graph, and obtains the fault diagnosis result of the path graph. The path graph is constructed by a path graph construction system that interfaces with the fault diagnosis system. The path graph includes multiple graph nodes, each corresponding to a log entry instance. Directed edges exist between the graph nodes to indicate the chronological order of log entry instances. Each directed edge is assigned a dynamically calculated edge weight based on factors such as the time interval between adjacent logs and semantic relevance. This ensures that the path graph preserves the chronological order of events in the logs and indicates the causal logic between events.

[0016] After determining the path graph for network fault diagnosis, the fault diagnosis system generates a corresponding local feature vector for each graph node in the path graph based on the local feature extraction layer in the pre-trained path graph analysis model, resulting in multiple local feature vectors for multiple graph nodes. Specifically, when extracting local feature vectors, the local feature extraction layer aggregates the left and right features along the path of each graph node. Information on all graph nodes within the step range is used to expand the receptive field and effectively capture mid-range dependency patterns.

[0017] In this way, by analyzing the information-rich path graph and generating local feature vectors using the local feature extraction layer, the information of local areas in the path graph can be fully explored. This considers the contextual information within a certain range around the graph nodes, which helps to discover subtle local anomalies and lays the foundation for accurate network fault diagnosis. For example, in a power grid system, when a local line fault occurs, a series of related log entries are generated, such as equipment status change logs and protection device action logs. The path graph construction system maps these log entry instances to graph nodes, constructs directed edges according to the chronological order of the log entries, and calculates the edge weights to generate the path graph. When analyzing this path graph, the local feature extraction layer in the pre-trained path graph analysis model generates a local feature vector for each graph node by combining information from graph nodes within a certain range around it. For example, a graph node showing a change in the status of a certain switching device will combine information from graph nodes showing changes in the status of other related nearby devices, thus more accurately reflecting the characteristics of the local fault.

[0018] In order to analyze the path graph, a path graph analysis model needs to be trained in advance. The training process includes the following steps one through four: Step 1: Obtain the sample path graph dataset.

[0019] The sample path graph dataset includes multiple sample path graphs, and each sample path graph corresponds to a real graph anomaly label. Each sample graph node in each sample path graph corresponds to a real node anomaly label.

[0020] In practical applications, each sample path graph is a graph structure. ,in, Represents the set of graph nodes in a path graph; This represents the set of directed edges between graph nodes, used to indicate the order in which log entry instances occur. Each directed edge is assigned a weight that is dynamically calculated based on factors such as the time interval between adjacent logs and semantic relevance. Represents the set of node features; The labels represent graph-level anomalies, i.e., real graph anomaly labels, which can be represented as "normal" or various types of "attacks". At the same time, it is also necessary to set corresponding real node anomaly labels for each sample graph node in the sample path graph, which can also be "normal" or various types of "attacks". Multiple such sample path graphs are integrated together to form a sample path graph dataset.

[0021] In this way, by constructing a sample path graph dataset containing abundant normal and abnormal samples, and assigning accurate labels to both the graph and nodes, a sufficient and representative data foundation is provided for subsequent model training. This helps the model learn network characteristics under different scenarios, thereby more accurately identifying network faults. For example, in a power grid system, power grid operation data from different time periods and regions is collected, including equipment status logs and power transmission logs. Based on this data, a sample path graph is constructed. For instance, a sample path graph constructed from the operation data of a power grid in a certain region when it is supplying power normally has the real graph anomaly label "normal"; while a sample path graph constructed from the operation data when a line fault occurs in that region, causing power outages for some users, has the real graph anomaly label "line fault attack". Simultaneously, for each node in the path graph, such as a node representing a switching device, a corresponding real node anomaly label is assigned: "normal" if the switching device is working normally, and "switching device malfunction attack" if a malfunction occurs.

[0022] Step 2: Construct the initial analysis model architecture.

[0023] The initial analysis model architecture includes a local feature extraction layer, a global feature extraction layer, and a classification layer for training. The local feature extraction layers are stacked. Layers are used to enable the processing of vectors corresponding to each graph node. The convolution operation generates local feature vectors for each graph node, which are then aggregated along the left and right sides of the path containing that graph node. The system extracts information from all graph nodes within the path range to expand the receptive field and effectively capture mid-range dependency patterns. A global feature extraction layer performs global pooling on multiple local feature vectors, integrating scattered local features into a single global feature vector to reflect the overall characteristics of the path graph. A classification layer performs fault prediction based on the input vector, thereby achieving fault diagnosis and obtaining the fault diagnosis result.

[0024] The initial analysis model architecture was designed to consider feature extraction and analysis from local to global perspectives. The local feature extraction layer captures subtle local anomalies in the path graph, while the global feature extraction layer grasps the overall macroscopic features. The classification layer combines both for fault diagnosis. This design helps to consider both local and global information simultaneously, improving the accuracy of fault diagnosis. In practical applications, such as... Figure 2 As shown, the initial analysis model architecture may also include an input layer to receive the path diagram for diagnostic analysis based on the input layer.

[0025] Step 3: Input the sample path graph dataset into the initial analysis model architecture so that the initial analysis model architecture can perform fault prediction for each sample path graph and obtain the prediction graph anomaly label and multiple prediction node anomaly labels for each sample path graph.

[0026] In this embodiment, the acquired sample path graph dataset is input into the constructed initial analysis model architecture. The initial analysis model architecture processes each sample path graph. First, a local feature extraction layer generates local feature vectors for each sample graph node. Then, a global feature extraction layer performs global pooling on these local feature vectors to obtain a global feature vector. Based on the global feature vector and the local feature vectors of each node, the classification layer predicts the anomaly label for each sample path graph and the anomaly labels for multiple predicted nodes. Thus, by having the initial analysis model architecture perform fault prediction on the sample path graph dataset, the performance of the model under the current parameters can be verified, and the difference between the predicted results and the true labels can be obtained, providing a basis for subsequent model parameter optimization. Step 4: Based on the anomaly labels of the predicted graph and multiple anomaly labels of the predicted nodes corresponding to each sample path graph, calculate the corresponding total loss value for each sample path graph. Then, use the total loss value corresponding to each sample path graph to optimize the model parameters of the initial analysis model architecture. Finally, re-input the sample path graph dataset into the optimized initial analysis model architecture for fault prediction, total loss value calculation, and model parameter optimization until the calculated total loss value corresponding to each sample path graph reaches the convergence condition. This completes the training of the initial analysis model architecture and yields the path graph analysis model.

[0027] In calculating the total loss, for each sample path graph, firstly, a corresponding predicted node anomaly label is determined for each sample graph node. Then, using the true node anomaly label and the predicted node anomaly label for each sample graph node, the corresponding node classification loss is calculated. Both the true node anomaly label and the predicted node anomaly label cover "normal" and various "attack" scenarios. A specific loss function, such as the cross-entropy loss function, is used to quantify the degree of difference between the true node anomaly label and the predicted node anomaly label. This quantified result is the node classification loss for each sample graph node. Each node will derive an independent node classification loss value based on the difference between its true and predicted labels.

[0028] Simultaneously, the initial analysis model architecture also provides predicted graph anomaly labels for the entire sample path graph. Therefore, it is necessary to calculate the graph classification loss for the sample path graph using both the ground truth graph anomaly labels and the predicted graph anomaly labels. Similarly, a suitable loss function, such as the cross-entropy loss function, can be used to calculate the difference between the two, thus obtaining the graph classification loss corresponding to the sample path graph. This graph classification loss reflects the accuracy of predicting anomalies across the entire path graph.

[0029] Then, the preset node loss weights are determined. Using these weights, the graph classification loss and the corresponding node classification loss for each sample graph node are weighted and summed. The resulting calculation is used as the total loss value for the sample path graph. The node loss weights are determined by considering various factors such as actual business needs, data characteristics, and model training objectives. They serve to balance the proportions of node classification loss and graph classification loss in the total loss value. Specifically, the weighted summation can be performed using the following formula 1: Formula 1:

[0030] in, This represents the total loss value. Represents the graph classification loss. This represents the sum of the classification losses for each node. This represents the node loss weight.

[0031] After obtaining the total loss, gradient descent algorithms (such as Adam) and backpropagation mechanisms can be used to optimize and adjust the model parameters of the initial analysis model architecture based on the total loss value corresponding to each sample path graph. After optimization, the sample path graph dataset is re-input into the optimized initial analysis model architecture, and the series of operations of fault prediction, total loss calculation, and model parameter optimization are performed again. This process is repeated iteratively until the calculated total loss value corresponding to each sample path graph reaches the convergence condition. In practical applications, to accurately evaluate the model training, a validation set can be set, and the accuracy and AUROC of the optimized initial analysis model architecture on the validation set can be monitored. By observing the changes in these indicators, it can be determined whether the model has been trained adequately, and finally, the training of the initial analysis model architecture is completed, resulting in a high-performance path graph analysis model. In addition, during model training, graph classification loss can be mainly used to optimize model parameters, while node classification loss serves as an auxiliary task. The auxiliary task acts as a regularization, forcing the model to better learn low-level local features, thereby improving the performance of the main task. In this way, a path graph analysis model can be obtained through end-to-end supervised learning training, which can specifically be the PathGNN model.

[0032] After training the path graph analysis model through the above process, the path graph analysis model can be applied to subsequent path graph analysis processes. In step S10, which is based on the local feature extraction layer in the pre-trained path graph analysis model, a corresponding local feature vector is generated for each of the multiple graph nodes included in the path graph, resulting in multiple local feature vectors corresponding to multiple graph nodes, including: S11: Determine multiple graph nodes in the path graph, and extract the original node feature vector corresponding to each graph node in the path graph.

[0033] In the established path graph for network fault diagnosis, the first step is to identify multiple graph nodes and extract the original node feature vector for each node. The original node feature vector is obtained by transforming multiple key fields corresponding to the log entry instance indicated by the corresponding graph node into data feature vectors. It retains the original information of the log entry instance, which is organized and stored in vector form. This ensures the model can perform in-depth analysis based on the original information of specific nodes, helping to accurately capture the characteristics and states of nodes. S12: Perform linear transformation or multilayer perceptron projection processing on the original node feature vector corresponding to each graph node to obtain the optimized node feature vector for each graph node.

[0034] In this process, the original node feature vector corresponding to each graph node undergoes a linear transformation or is projected using a multilayer perceptron (MLP). A multilayer perceptron is a feedforward artificial neural network model that maps the input original node feature vector to a hidden space more suitable for graph neural network (GNN) processing. For example, the original node feature vector may be high-dimensional and complexly distributed; through the nonlinear transformation of the multilayer perceptron, it is transformed into a new feature space, resulting in optimized node feature vectors. This process not only reduces the dimensionality of the data and removes redundant information but also unifies the distribution of different feature scales, making subsequent model processing more efficient and accurate, and helping to better extract useful information from node features. S13: The optimized node feature vector corresponding to each graph node is input into the path graph analysis model, so that the local feature extraction layer in the path graph analysis model performs multi-layer convolution operations on the optimized node feature vector corresponding to each graph node, generating a corresponding local feature vector for each graph node, resulting in multiple local feature vectors.

[0035] In this embodiment, the optimized node feature vector corresponding to each graph node is input into the path graph analysis model. This allows the local feature extraction layer in the path graph analysis model to perform multi-layer convolution operations on the optimized node feature vector corresponding to each graph node, generating a corresponding local feature vector for each graph node, resulting in multiple local feature vectors. Each convolution operation in the multi-layer convolution operation performs a lightweight, orientation-aware convolution operation, with the first layer performing the most significant convolution operation. Taking layer convolution as an example, its calculation formula is shown in Formula 2 below. Formula 2:

[0036] in, Indicates the path graph of the first The first graph node needs to be entered into the... Feature vectors from convolutional layers This represents a non-linear activation function and can be either ReLU or LeakyReLU. Indicates the first Convolutional operations are used to process trainable weight matrices that contain information about the graph nodes themselves. Indicates the path graph of the first The graph node is input to the first... Feature vectors from convolutional layers Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the left of each graph node. Indicates the first The graph node adjacent to the left of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the left of each graph node. Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the right of a graph node. Indicates the first The graph node adjacent to the right of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the right of each graph node. Indicates the first The bias vector corresponding to the layer convolution operation.

[0037] In convolution operations, , and These are three independent trainable weight matrices. Unlike traditional standard GCNs that use a single weight matrix, using three independent trainable weight matrices allows the model to differentially learn information from itself, its predecessor nodes, and its successor nodes. The information from the node itself represents the node's inherent attributes, while the information from its predecessor and successor nodes reflects the relationships between nodes within the graph structure. This differential learning enables the model to more accurately capture the characteristics of information from different sources, significantly enhancing its expressive power. This represents the degree of the node, which can be 1 or 2. During training, it plays a role in symmetric normalization, stabilizing the training process and preventing instability caused by differences in data scale. Thus, through... The convolution operation of the layer aggregates the local feature vectors corresponding to each graph node from the left and right sides of the path. Information about all nodes within the step range, for example, see [link to previous page] Figure 3 ,when When the value is 3, the central node V4 can "see" the information of its three left neighbor nodes V1, V2, and V3, and its three right neighbor nodes V5, V6, and V7. Compared to... Figure 3 The single-layer convolution operation shown can only see the information of one neighbor node on each side, and the double-layer convolution operation can only see the information of 22 neighbor nodes on each side. This can effectively capture mid-range dependency patterns, enabling the model to have a more comprehensive understanding of local relationships and dependencies in the graph structure, thereby improving the model's performance in related tasks.

[0038] S20: Through the global feature extraction layer in the path analysis model, multiple local feature vectors are globally pooled to obtain the global feature vector corresponding to the path graph.

[0039] In this embodiment, the fault diagnosis system performs global pooling on multiple local feature vectors through the global feature extraction layer in the path analysis model. Global pooling is an operation that integrates and summarizes local feature vectors. It does not consider the specific location information of local feature vectors, but analyzes and refines all local feature vectors as a whole, ultimately obtaining the global feature vector corresponding to the path map. The global feature vector can reflect the overall characteristics and macroscopic information of the path map.

[0040] In this way, global pooling can integrate scattered local feature vectors into a single global feature vector, extracting the macroscopic features of the path graph. This avoids focusing only on the local while ignoring the overall picture, helping to grasp the overall characteristics of network faults from a macroscopic perspective. This complements local features and improves the comprehensiveness of fault diagnosis. For example, in power grid fault diagnosis, multiple local feature vectors may reflect the local fault characteristics of different lines and equipment. Through global pooling, these local feature vectors are integrated into a global feature vector, which can comprehensively reflect the overall operational status changes of the entire power grid region at the time of the fault, such as voltage fluctuation range and load change trends, providing a basis for comprehensive power grid fault diagnosis.

[0041] In step S20, that is, by using the global feature extraction layer in the path analysis model to perform global pooling on the multiple local feature vectors to obtain the global feature vector corresponding to the path graph, the following steps are taken: S21: Input multiple local feature vectors into the global feature extraction layer in the path analysis model so that the global feature extraction layer can perform attention weight transformation on multiple local feature vectors to obtain multiple local feature attention weights.

[0042] In this process, after inputting multiple local feature vectors into the global feature extraction layer in the path analysis model, the global feature extraction layer introduces learnable parameters. and The attention weights for multiple local feature vectors are then transformed using the following formula 3: Formula 3:

[0043] in, Indicates the path graph of the first The local feature attention weight corresponding to the graph node, this weight represents the th . The contribution or anomaly of a graph node to the sequence state in the entire path graph is used to measure the importance of the graph node in the whole, so that the path analysis model can focus on the most relevant and most abnormal graph nodes. Indicates the path graph of the first The local feature vectors corresponding to each graph node.

[0044] S22: The multiple local feature vectors and the multiple local feature attention weights are subjected to global pooling using the following formula 3 to obtain the global feature vector.

[0045] Formula 3:

[0046] in, This represents the global feature vector. This indicates the number of graph nodes included in the path graph. Indicates the path graph of the first Local feature attention weights corresponding to each graph node Indicates the path graph of the first The local feature vectors corresponding to each graph node.

[0047] In this way, the global feature vector generated through the above process can automatically ignore irrelevant background events and generate a global representation with extremely high information density.

[0048] S30: Using the classification layer in the path graph analysis model, anomaly assessment is performed on multiple local feature vectors to obtain local anomaly summary vectors. A joint feature vector is constructed using the global feature vector and the local anomaly summary vector. The classification layer in the path graph analysis model is then used to analyze the global feature vector and the joint feature vector to obtain the fault diagnosis results of the path graph.

[0049] In this embodiment, firstly, the fault diagnosis system utilizes the classification layer in the path graph analysis model to evaluate anomalies in multiple local feature vectors, calculates an anomaly score for each graph node, and obtains a local anomaly summary vector by summarizing these scores. This local anomaly summary vector reflects the degree of anomaly in local areas of the path graph. Then, a joint feature vector is constructed using the global feature vector and the local anomaly summary vector, integrating local and global feature information from the path graph. Finally, the classification layer in the path graph analysis model analyzes the global and joint feature vectors, and the fault diagnosis result of the path graph is obtained based on the analysis results.

[0050] This three-stage design (local convolution, global attention pooling, and feature fusion) captures both subtle local anomalies and macroscopic global features in the path graph. It avoids focusing solely on the global picture while ignoring local details or vice versa, thus effectively improving the accuracy of network fault diagnosis. For example, in power grid fault diagnosis, anomaly assessment of local feature vectors can reveal abnormal operation of specific equipment, such as a high anomaly score for a graph node corresponding to an abnormal temperature rise in a transformer. After summarizing this information, the local anomaly summary vector is combined with the global feature vector reflecting the overall power grid operation to construct a joint feature vector. Analyzing this joint feature vector allows for accurate determination of whether a local equipment failure caused an abnormal operation of the entire power grid, or whether a problem with the entire power grid caused the local equipment failure, thus providing an accurate power grid fault diagnosis result.

[0051] In step S30, which involves using the classification layer in the path graph analysis model to evaluate multiple local feature vectors for anomalies, obtaining local anomaly summary vectors, and constructing a joint feature vector using the global feature vector and the local anomaly summary vectors, the process includes: S31: Input multiple local feature vectors into the classification layer in the path graph analysis model so that the classification layer can evaluate the anomalies of each local feature vector and obtain multiple anomaly scores corresponding to the multiple local feature vectors.

[0052] In this model, multiple local feature vectors are input into the classification layer. The classification layer is capable of anomaly assessment of the input features. It performs a detailed analysis of each input local feature vector, generating a corresponding anomaly score for each. This anomaly score reflects the probability that the log instance entry represented by that local feature vector is abnormal; a higher score indicates a greater probability of an anomaly.

[0053] In this way, by evaluating the anomalies of each local feature vector through the classification layer and obtaining anomaly scores, we can accurately locate the possible anomalies of each graph node, providing basic data for subsequent comprehensive analysis of the anomalies of the entire path graph and helping to discover subtle local anomalies.

[0054] S32: Using a preset aggregation function, multiple anomaly scores are aggregated and vectorized to obtain a local anomaly summary vector.

[0055] After obtaining multiple anomaly scores, these scores are processed using a preset aggregation function. The aggregation function can be either mean or max. If the mean function is selected, all anomaly scores are summed and averaged to obtain a comprehensive anomaly index. If the max function is selected, the maximum value among all anomaly scores is chosen, representing the most prominent anomaly among all local anomalies. Through such aggregation and vector transformation operations, multiple anomaly scores are integrated into a local anomaly summary vector. This vector can summarize the overall situation of local anomalies in the entire path graph, so as to integrate scattered local anomaly information into a concise and representative vector, which is convenient for subsequent fusion analysis with other feature vectors to comprehensively reflect the anomaly state of the path graph. S33: The global feature vector and the local anomaly summary vector are concatenated or weighted and summed, and the result is used as a joint feature vector.

[0056] This process requires concatenating the global feature vector and the local anomaly summary vector, or performing a weighted summation. Concatenation involves joining the elements of the two vectors sequentially to form a longer joint feature vector. Weighted summation, on the other hand, involves weighting the elements of both the global and local anomaly summary vectors according to pre-defined weights and then summing them to obtain the joint feature vector. Taking concatenation as an example, assuming the global feature vector has m elements and the local anomaly summary vector has n elements, the resulting joint feature vector will have m + n elements. This joint feature vector integrates the global and local anomaly features of the path graph, achieving an organic combination of global and local features. This allows the model to consider both macroscopic global features and subtle local anomalies simultaneously, avoiding the problem of missing global context and thus improving the accuracy of network fault diagnosis.

[0057] In step S30, the classification layer in the path graph analysis model is used to analyze the global feature vector and joint feature vector to obtain the fault diagnosis results of the path graph, including: S34: Input the global feature vector into the classification layer in the path graph analysis model so that the classification layer can perform fault prediction based on the global feature vector and obtain the initial prediction result.

[0058] This process involves inputting the global feature vector into the classification layer of the path graph analysis model. The classification layer is a crucial part of the model for fault prediction, containing a series of pre-defined algorithms and parameters. Once the global feature vector enters the classification layer, it analyzes and processes it based on these algorithms and parameters. The global feature vector contains macroscopic feature information about the entire path graph, such as the overall operating status of the power grid and the interrelationships between different regions. By interpreting this macroscopic information and employing its internal logical judgment mechanism, the classification layer performs fault prediction based on the global feature vector, thus deriving an initial prediction result. This initial prediction result provides a preliminary fault assessment of the entire network based on global features, offering a macroscopic view of the overall power grid operation and providing a foundation for subsequent comprehensive judgments. It also helps in identifying global fault trends and problems.

[0059] S35: Input the joint feature vector into the classification layer in the path graph analysis model so that the classification layer can perform fault prediction based on the joint feature vector and obtain the final prediction result.

[0060] The constructed joint feature vector is then input into the classification layer of the path graph analysis model. This joint feature vector integrates global feature vectors and local anomaly summary vectors, encompassing both global characteristics of the power grid network and reflecting anomalies in local devices or nodes. Once the joint feature vector enters the classification layer, it undergoes in-depth analysis using its internal algorithms and parameters, comprehensively considering both global and local information to make a more accurate judgment on the fault status of the power grid network. For example, by combining the overall operating status of the power grid with the anomaly score of a key device, the classification layer can more accurately determine whether an anomaly in that device will lead to a fault in the entire power grid, thus performing fault prediction based on the joint feature vector and obtaining the final prediction result.

[0061] In this way, by performing fault prediction on the joint feature vector to obtain the final prediction result, we can make full use of global and local information, which can more accurately diagnose the fault status of the power grid network, avoid misjudgment caused by considering only one aspect of information, and improve the accuracy of fault diagnosis. S36: Use the initial prediction result and the final prediction result as the fault diagnosis result.

[0062] In this process, the initial prediction result obtained by the classification layer based on the global feature vector and the final prediction result obtained based on the joint feature vector are used together as the fault diagnosis result. The initial prediction result provides a macroscopic view of the potential faults in the power grid network, while the final prediction result is a more accurate judgment after comprehensively considering global and local information. Combining the two can comprehensively and accurately reflect the fault status of the power grid network. For example, the initial prediction result may indicate that there is a voltage fluctuation problem in the overall power grid, while the final prediction result can further clarify which area's equipment malfunction caused this voltage fluctuation.

[0063] Using both the initial and final prediction results as fault diagnosis results can fully leverage the advantages of both, providing more comprehensive and accurate fault diagnosis information. This helps maintenance personnel to handle power grid faults in a timely and effective manner, ensuring the stable operation of the power grid.

[0064] In practical applications, if the fault diagnosis result indicates an attack or fault, the fault diagnosis system will immediately trigger an alarm mechanism, notifying relevant personnel in a prominent manner (such as sound prompts, interface pop-ups, etc.). Simultaneously, the abnormal path diagram will be submitted to a security analyst for review. The security analyst can leverage their professional knowledge and experience to conduct in-depth analysis of the abnormal path diagram, ensuring the accuracy of the model's diagnostic results and avoiding misjudgments or omissions. Furthermore, as shown in the above process, multiple local feature attention weights are calculated. These weights represent the contribution or anomaly degree of each node in the path diagram to the overall sequence state. Therefore, the most critical graph nodes can be highlighted using local feature attention weights. In other words, in visualization, the corresponding graph nodes can be highlighted with different colors and brightness levels based on the magnitude of the local feature attention weight. For example, nodes with larger local feature attention weight values ​​indicate a greater impact on the overall path diagram state and may exhibit serious anomalies; these nodes will be highlighted in a prominent color such as red.

[0065] Thus, through the aforementioned alarm mechanism, for the automatic response of the fault diagnosis system, once the model diagnoses an attack or fault and triggers an alarm, it can promptly notify relevant personnel to take measures, reducing the impact of abnormal situations on the network (such as the power grid) and ensuring the stable operation of the network. For security analysts' review, the highlighting of key graph nodes by local feature attention weights greatly assists root cause analysis. Security analysts do not need to check through large amounts of log data one by one; instead, they can directly focus on the highlighted key nodes, quickly locating the root cause of the problem, improving the efficiency of fault diagnosis and repair, and reducing operation and maintenance costs. For example, in power grid fault diagnosis, it can more quickly determine which device or area's anomaly caused the entire power grid's fault, thus enabling targeted repair and handling.

[0066] In summary, the logical process of the technical solution in this application is summarized as follows: See Figure 4 The system acquires the original log sequence, converts it into a path graph, and analyzes the path graph using a pre-trained PathGNN model (i.e., a path graph analysis model) to determine if any anomalies exist. If an anomaly is detected, a security alarm is generated; otherwise, the system is considered to be operating normally. Thus, the technical solution of this embodiment constructs a complete technical closed loop from data acquisition to decision-making using a path graph, demonstrating significant benefits in multiple aspects. In terms of efficiency, the model exhibits extremely high efficiency, with its complexity linearly related to the sequence length n (O(n)). This allows the model to perform inference very quickly when processing data, effectively meeting real-time requirements and rapidly analyzing input data to provide results. Regarding diagnostic accuracy, through a unique local-global hierarchical perception mechanism, the model can simultaneously and keenly capture subtle local anomalies as well as macroscopic global patterns. With this comprehensive perception capability, the model achieves high accuracy and a high AUROC value during the diagnostic process, effectively improving the accuracy of network fault or attack diagnosis. From an interpretability perspective, the attention mechanism in global pooling plays a crucial role. It naturally generates interpretations of key log entries, clearly answering the question, "Why does the model consider this an attack?" This characteristic compensates for the interpretability shortcomings of many deep learning models, making the model's results more credible and understandable. Furthermore, the entire system achieves end-to-end automated learning from raw logs to final diagnosis. This process reduces information loss and error accumulation that can occur in multiple stages of traditional analysis pipelines, ensuring the integrity and accuracy of data analysis and providing more reliable technical support for network fault diagnosis and attack detection.

[0067] The method provided in this application determines the path graph to be diagnosed in the network. Based on the local feature extraction layer in the pre-trained path graph analysis model, a corresponding local feature vector is generated for each graph node in the path graph. Multiple local feature vectors are obtained for multiple graph nodes. The global feature extraction layer in the path analysis model performs global pooling on the multiple local feature vectors to obtain the global feature vector corresponding to the path graph. The classification layer in the path graph analysis model performs anomaly evaluation on the multiple local feature vectors to obtain local anomaly summary vectors. A joint feature vector is constructed using the global feature vector and the local anomaly summary vector. The classification layer in the path graph analysis model analyzes the global feature vector and the joint feature vector to obtain the fault diagnosis result of the path graph. Through a three-stage design of local convolution, global attention pooling, and feature fusion, subtle local anomalies and macro-global features in the path graph are captured simultaneously, avoiding the problem of missing global context and improving the accuracy of network fault diagnosis.

[0068] Furthermore, as Figure 1 To specifically implement the method, this application provides a network fault diagnosis device based on a path graph, such as... Figure 5 As shown, the device includes: a local feature vector generation module 501, a global feature vector generation module 502, and an analysis module 503.

[0069] The local feature vector generation module 501 is used to determine the path graph to be diagnosed in the network fault. Based on the local feature extraction layer in the pre-trained path graph analysis model, it generates a corresponding local feature vector for each graph node in the path graph, thereby obtaining multiple local feature vectors corresponding to the multiple graph nodes. The global feature vector generation module 502 is used to perform global pooling processing on the multiple local feature vectors through the global feature extraction layer in the path analysis model to obtain the global feature vector corresponding to the path graph. Analysis module 503 is used to perform anomaly evaluation on the multiple local feature vectors using the classification layer in the path graph analysis model to obtain local anomaly summary vectors, and to construct a joint feature vector using the global feature vector and the local anomaly summary vectors, and to analyze the global feature vector and the joint feature vector using the classification layer in the path graph analysis model to obtain the fault diagnosis result of the path graph.

[0070] In specific application scenarios, the device further includes: The model training module is used to acquire a sample path graph dataset, wherein the sample path graph dataset includes multiple sample path graphs, and each sample path graph corresponds to a real graph anomaly label, and each sample graph node included in each sample path graph corresponds to a real node anomaly label; construct an initial analysis model architecture, wherein the initial analysis model architecture includes a local feature extraction layer, a global feature extraction layer, and a classification layer to be trained; input the sample path graph dataset into the initial analysis model architecture, so that the initial analysis model architecture performs fault prediction on each sample path graph, and obtains the predicted graph anomaly corresponding to each sample path graph. The system generates labels and multiple prediction node anomaly labels. Based on the prediction graph anomaly labels and multiple prediction node anomaly labels corresponding to each sample path graph, it calculates the corresponding total loss value for each sample path graph. Using the total loss value corresponding to each sample path graph, it optimizes the model parameters of the initial analysis model architecture. The sample path graph dataset is then re-inputted into the optimized initial analysis model architecture for fault prediction, total loss value calculation, and model parameter optimization until the calculated total loss value corresponding to each sample path graph reaches the convergence condition. This completes the training of the initial analysis model architecture and yields the path graph analysis model.

[0071] In specific application scenarios, the model training module is used to determine a corresponding predicted node anomaly label for each sample graph node in the sample path graph for each sample graph, and calculate the corresponding node classification loss for each sample graph node using the corresponding real node anomaly label and the predicted node anomaly label; calculate the graph classification loss for the sample path graph using the corresponding real graph anomaly label and the predicted graph anomaly label; determine a preset node loss weight, and use the node loss weight to perform a weighted summation of the graph classification loss and the corresponding node classification loss calculated for each sample graph node, and use the calculated result as the total loss value corresponding to the sample path graph.

[0072] In a specific application scenario, the local feature vector generation module 501 is used to determine the plurality of graph nodes in the path graph, and to extract the original node feature vector corresponding to each graph node in the path graph; to perform linear transformation or multilayer perceptron projection processing on the original node feature vector corresponding to each graph node to obtain the optimized node feature vector corresponding to each graph node; and to input the optimized node feature vector corresponding to each graph node into the path graph analysis model, so that the local feature extraction layer in the path graph analysis model performs multilayer convolution operation on the optimized node feature vector corresponding to each graph node to generate a corresponding local feature vector for each graph node, thereby obtaining the plurality of local feature vectors, wherein the first of the multilayer convolution operation is... The formula for calculating the layer convolution operation is as follows:

[0073] in, Indicates the path graph of the first The first graph node needs to be entered into the... Feature vectors from convolutional layers Represents a non-linear activation function. Indicates the first Convolutional operations are used to process trainable weight matrices that contain information about the graph nodes themselves. Indicates the path graph of the first The graph node is input to the first... Feature vectors from convolutional layers Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the left of each graph node. Indicates the first The graph node adjacent to the left of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the left of each graph node. Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the right of a graph node. Indicates the first The graph node adjacent to the right of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the right of each graph node. Indicates the first The bias vector corresponding to the layer convolution operation.

[0074] In a specific application scenario, the global feature vector generation module 502 is used to input the multiple local feature vectors into the global feature extraction layer in the path analysis model, so that the global feature extraction layer performs attention weight transformation on the multiple local feature vectors to obtain multiple local feature attention weights; the multiple local feature vectors and the multiple local feature attention weights are then subjected to global pooling processing using the following formula to obtain the global feature vector.

[0075] in, This represents the global feature vector. This indicates the number of graph nodes included in the path graph. Indicates the path graph of the first Local feature attention weights corresponding to each graph node Indicates the path graph of the first The local feature vectors corresponding to each graph node.

[0076] In a specific application scenario, the analysis module 503 is used to input the multiple local feature vectors into the classification layer of the path graph analysis model, so that the classification layer performs anomaly evaluation on each local feature vector to obtain multiple anomaly scores corresponding to the multiple local feature vectors; using a preset aggregation function, the multiple anomaly scores are aggregated and vector transformed to obtain the local anomaly summary vector; the global feature vector and the local anomaly summary vector are concatenated or weighted and summed, and the result is used as the joint feature vector.

[0077] In a specific application scenario, the analysis module 503 is used to input the global feature vector into the classification layer of the path graph analysis model, so that the classification layer performs fault prediction based on the global feature vector to obtain an initial prediction result; input the joint feature vector into the classification layer of the path graph analysis model, so that the classification layer performs fault prediction based on the joint feature vector to obtain a final prediction result; and use the initial prediction result and the final prediction result as the fault diagnosis result.

[0078] The apparatus provided in this application determines a path graph for network fault diagnosis. Based on the local feature extraction layer in a pre-trained path graph analysis model, it generates a corresponding local feature vector for each graph node in the path graph, resulting in multiple local feature vectors corresponding to multiple graph nodes. Through the global feature extraction layer in the path analysis model, it performs global pooling on the multiple local feature vectors to obtain a global feature vector corresponding to the path graph. Using the classification layer in the path graph analysis model, it performs anomaly evaluation on the multiple local feature vectors to obtain a local anomaly summary vector. It also constructs a joint feature vector using the global feature vector and the local anomaly summary vector. Finally, it uses the classification layer in the path graph analysis model to analyze the global feature vector and the joint feature vector to obtain the fault diagnosis result of the path graph. Through a three-stage design of local convolution, global attention pooling, and feature fusion, it simultaneously captures subtle local anomalies and macro-global features in the path graph, avoiding the problem of missing global context and improving the accuracy of network fault diagnosis.

[0079] It should be noted that other corresponding descriptions of the functional units involved in the network fault diagnosis device based on path graph provided in this application embodiment can be found in the following references. Figures 1 to 4 The corresponding descriptions in [the document] will not be repeated here.

[0080] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0081] The above embodiments and the technical features in the embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0082] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

[0083] In an exemplary embodiment, see Figure 6Furthermore, an electronic device is provided, comprising a bus, a processor, a memory, and a communication interface. It may also include input / output interfaces and a display device, wherein the various functional units can communicate with each other via the bus. The memory stores a computer program, and the processor executes the program stored in the memory to perform the path graph-based network fault diagnosis method described in the above embodiments.

[0084] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the path graph-based network fault diagnosis method.

[0085] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented in hardware or by using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) and includes several instructions to cause an electronic device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0086] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing this application.

[0087] Those skilled in the art will understand that the modules in the apparatus of the implementation scenario can be distributed within the apparatus of the implementation scenario as described, or they can be located in one or more apparatuses different from this implementation scenario, with corresponding changes. The modules of the above-described implementation scenario can be combined into one module, or they can be further divided into multiple sub-modules.

[0088] The serial numbers in this application are for descriptive purposes only and do not represent the superiority or inferiority of the implementation scenario.

[0089] The above disclosures are only a few specific implementation scenarios of this application. However, this application is not limited to these. Any variations that can be conceived by those skilled in the art should fall within the protection scope of this application.

Claims

1. A network fault diagnosis method based on path graphs, characterized in that, include: The path graph to be diagnosed in the network is determined. Based on the local feature extraction layer in the pre-trained path graph analysis model, a corresponding local feature vector is generated for each graph node in the path graph, so as to obtain multiple local feature vectors corresponding to the multiple graph nodes. The global feature extraction layer in the path graph analysis model is used to perform global pooling on the multiple local feature vectors to obtain the global feature vector corresponding to the path graph. Using the classification layer in the path graph analysis model, anomaly assessment is performed on the multiple local feature vectors to obtain local anomaly summary vectors. A joint feature vector is constructed using the global feature vector and the local anomaly summary vectors. The classification layer in the path graph analysis model is then used to analyze the global feature vector and the joint feature vector to obtain the fault diagnosis result of the path graph. The local feature extraction layer in the pre-trained path graph analysis model generates a corresponding local feature vector for each of the multiple graph nodes included in the path graph, resulting in multiple local feature vectors corresponding to the multiple graph nodes, including: The plurality of graph nodes are determined in the path graph, and the original node feature vector corresponding to each graph node is extracted in the path graph; Perform linear transformation or multilayer perceptron projection processing on the original node feature vector corresponding to each graph node to obtain the optimized node feature vector corresponding to each graph node. The optimized node feature vector corresponding to each graph node is input into the path graph analysis model, so that the local feature extraction layer in the path graph analysis model performs multi-layer convolution operations on the optimized node feature vector corresponding to each graph node, generating a corresponding local feature vector for each graph node, thus obtaining the plurality of local feature vectors, wherein the first of the multi-layer convolution operations is... The formula for calculating the layer convolution operation is as follows: in, Indicates the path graph of the first The first graph node needs to be entered into the... Feature vectors from convolutional layers Represents a non-linear activation function. Indicates the first Convolutional operations are used to process trainable weight matrices that contain information about the graph nodes themselves. Indicates the path graph of the first The graph node is input to the first... Feature vectors from convolutional layers Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the left of each graph node. Indicates the first The graph node adjacent to the left of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the left of each graph node. Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the right of a graph node. Indicates the first The graph node adjacent to the right of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the right of each graph node. Indicates the first The bias vector corresponding to the layer convolution operation.

2. The method according to claim 1, characterized in that, Before determining the path graph for network fault diagnosis, and generating a corresponding local feature vector for each graph node in the path graph based on the local feature extraction layer in the pre-trained path graph analysis model, and obtaining the multiple local feature vectors corresponding to the multiple graph nodes, the method further includes: Obtain a sample path graph dataset, wherein the sample path graph dataset includes multiple sample path graphs, and each sample path graph corresponds to a real graph anomaly label, and each sample graph node included in each sample path graph corresponds to a real node anomaly label; Construct an initial analysis model architecture, wherein the initial analysis model architecture includes a local feature extraction layer, a global feature extraction layer, and a classification layer to be trained; The sample path graph dataset is input into the initial analysis model architecture so that the initial analysis model architecture performs fault prediction on each sample path graph, and obtains the prediction graph anomaly label and multiple prediction node anomaly labels corresponding to each sample path graph. Based on the anomaly labels of the predicted graph and multiple anomaly labels of the predicted nodes corresponding to each sample path graph, the total loss value corresponding to each sample path graph is calculated. Using the total loss value corresponding to each sample path graph, the model parameters of the initial analysis model architecture are optimized. The sample path graph dataset is then re-inputted into the optimized initial analysis model architecture for fault prediction, total loss value calculation, and model parameter optimization until the calculated total loss value corresponding to each sample path graph reaches the convergence condition. This completes the training of the initial analysis model architecture and yields the path graph analysis model.

3. The method according to claim 2, characterized in that, The step of calculating the total loss value for each sample path graph based on the prediction graph anomaly label and multiple prediction node anomaly labels for each sample path graph includes: For each of the sample path graphs, a corresponding predicted node anomaly label is determined for each sample graph node in the sample path graph, and the corresponding node classification loss is calculated for each sample graph node using the real node anomaly label and the predicted node anomaly label corresponding to each sample graph node. Using the ground truth graph anomaly labels and the predicted graph anomaly labels corresponding to the sample path graph, calculate the graph classification loss for the sample path graph; Determine the preset node loss weights, and use the node loss weights to perform a weighted summation of the graph classification loss and the corresponding node classification loss for each sample graph node. The calculated result is used as the total loss value corresponding to the sample path graph.

4. The method according to claim 1, characterized in that, The step of performing global pooling on the multiple local feature vectors through the global feature extraction layer in the path graph analysis model to obtain the global feature vector corresponding to the path graph includes: The multiple local feature vectors are input into the global feature extraction layer in the path graph analysis model, so that the global feature extraction layer performs attention weight transformation on the multiple local feature vectors to obtain multiple local feature attention weights; The global feature vector is obtained by performing global pooling on the multiple local feature vectors and the multiple local feature attention weights using the following formula. in, This represents the global feature vector. This indicates the number of graph nodes included in the path graph. Indicates the path graph of the first Local feature attention weights corresponding to each graph node Indicates the path graph of the first The local feature vectors corresponding to each graph node.

5. The method according to claim 1, characterized in that, The step of using the classification layer in the path graph analysis model to perform anomaly evaluation on the multiple local feature vectors to obtain local anomaly summary vectors, and constructing a joint feature vector using the global feature vector and the local anomaly summary vectors, includes: The multiple local feature vectors are input into the classification layer of the path graph analysis model, so that the classification layer performs anomaly evaluation on each local feature vector and obtains multiple anomaly scores corresponding to the multiple local feature vectors. The multiple anomaly scores are aggregated and transformed into vectors using a preset aggregation function to obtain the local anomaly summary vector; The global feature vector and the local anomaly summary vector are concatenated or weighted and summed, and the result is used as the joint feature vector.

6. The method according to claim 1, characterized in that, The step of analyzing the global feature vector and joint feature vector using the classification layer in the path graph analysis model to obtain the fault diagnosis result of the path graph includes: The global feature vector is input into the classification layer of the path graph analysis model so that the classification layer performs fault prediction based on the global feature vector and obtains an initial prediction result. The joint feature vector is input into the classification layer of the path graph analysis model so that the classification layer performs fault prediction based on the joint feature vector and obtains the final prediction result. The initial prediction result and the final prediction result are used as the fault diagnosis result.

7. A network fault diagnosis device based on path graph, characterized in that, include: The local feature vector generation module is used to determine the path graph to be diagnosed in the network. Based on the local feature extraction layer in the pre-trained path graph analysis model, it generates a corresponding local feature vector for each of the multiple graph nodes included in the path graph, thereby obtaining multiple local feature vectors corresponding to the multiple graph nodes. The global feature vector generation module is used to perform global pooling on the multiple local feature vectors through the global feature extraction layer in the path graph analysis model to obtain the global feature vector corresponding to the path graph. The analysis module is used to perform anomaly evaluation on the multiple local feature vectors using the classification layer in the path graph analysis model to obtain local anomaly summary vectors, and to construct a joint feature vector using the global feature vector and the local anomaly summary vectors, and to analyze the global feature vector and the joint feature vector using the classification layer in the path graph analysis model to obtain the fault diagnosis result of the path graph. The local feature vector generation module is configured to: determine the plurality of graph nodes in the path graph; extract the original node feature vector corresponding to each graph node in the path graph; perform linear transformation or multilayer perceptron projection processing on the original node feature vector corresponding to each graph node to obtain the optimized node feature vector corresponding to each graph node; input the optimized node feature vector corresponding to each graph node into the path graph analysis model, so that the local feature extraction layer in the path graph analysis model performs multilayer convolution operations on the optimized node feature vector corresponding to each graph node to generate a corresponding local feature vector for each graph node, thereby obtaining the plurality of local feature vectors, wherein the first of the multilayer convolution operations is... The formula for calculating the layer convolution operation is as follows: in, Indicates the path graph of the first The first graph node needs to be entered into the... Feature vectors from convolutional layers Represents a non-linear activation function. Indicates the first Convolutional operations are used to process trainable weight matrices that contain information about the graph nodes themselves. Indicates the path graph of the first The graph node is input to the first... Feature vectors from convolutional layers Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the left of each graph node. Indicates the first The graph node adjacent to the left of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the left of each graph node. Indicates the first Layer convolution operations are used to process the trainable weight matrix containing information about the graph nodes adjacent to the right of a graph node. Indicates the first The graph node adjacent to the right of the first graph node is input to the second graph node. Feature vectors from convolutional layers Indicates the path graph of the first The degree of the graph node to the right of each graph node. Indicates the first The bias vector corresponding to the layer convolution operation.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images