Multi-source event timeline reconstruction and evidence chain generation method, equipment and medium

Abstract

The invention discloses a multisource event timeline reconstruction and evidence chain generation method and device, and a medium, and the method comprises the steps: carrying out the unified abstract modeling of a heterogeneous monitoring data source based on a predefined evidence source registry, and collecting original evidence data in parallel according to an input target entity and time window parameters; based on the collected original data, estimating coarse-grained time migration by identifying a global anchor point event, solving absolute time lag of each data source by adopting a maximum likelihood joint time lag discovery method, and correcting timestamps of all evidence data to a unified global time axis; performing event extraction, performing association analysis based on a causal rule base and a statistical causal discovery algorithm, and constructing a preliminary causal evidence chain with confidence; and packaging the causal evidence chain, the supporting original data fragment and the generation process metadata into a structured evidence chain packet, calculating a cryptographic hash value of the structured evidence chain packet to generate a digital fingerprint, and outputting a complete evidence chain packet.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent operation and maintenance, and in particular to a multi-source event timeline reconstruction and evidence chain generation method, device and medium. BACKGROUND

[0002] With the wide application of cloud computing, microservices and distributed architecture, the complexity and dynamics of modern software systems grow exponentially. Observability has become a core capability to ensure system stability, quickly locate faults and conduct resilience assessment. It achieves in-depth insight into the internal state of the system by collecting multi-dimensional data such as indicators, logs and traces.

[0003] However, the current mainstream observability technology has significant limitations: first, data islands are serious, and different data sources have different collection agents, storage systems and data models. Operation and maintenance personnel need to manually compare across platforms, which is inefficient. Second, the timeline is fragmented, and there are differences in clock synchronization accuracy, transmission delay, etc. among different data sources, resulting in timestamp drift and inability to restore the real timeline of fault propagation. Third, there is information overload and reliance on human experience to filter and reason with experts, which is subjective and difficult to reproduce. Fourth, the degree of automation of causal inference is low, relying mainly on simple matching, lacking quantitative support, and the analysis conclusion is not scientific enough.

[0004] Traditional observability practice only stays at the data collection and display stage, and cannot realize the automatic conversion of multi-source data into a reliable evidence chain, making it difficult to meet the emerging needs of chaos engineering, AIOps and compliance auditing. Therefore, there is an urgent need for a multi-source event timeline reconstruction and evidence chain generation strategy for observability. SUMMARY

[0005] The present application provides a multi-source event timeline reconstruction and evidence chain generation method, device and medium to solve the above problems.

[0006] In one aspect, the present application provides a multi-source event timeline reconstruction and evidence chain generation method, which comprises the following steps: Step S1: uniformly abstract modeling of heterogeneous monitoring data sources based on a predefined evidence source registry, and collecting raw evidence data in parallel according to the input target entity and time window parameters; Step S2: based on the collected raw data, estimating the coarse-grained time offset by identifying global anchor events, and solving the absolute time lag of each data source using the maximum likelihood joint time lag discovery method, and correcting the timestamps of all evidence data to a unified global time axis; Step S3: event extraction of the aligned data on the unified time axis, and correlation analysis based on a causal rule base and a statistical causal discovery algorithm to construct a preliminary causal evidence chain with confidence. Step S4: encapsulating the causal evidence chain, supporting original data fragments and generation process metadata into a structured evidence chain package, and calculating a cryptographic hash value thereof to generate a digital fingerprint, and outputting the complete evidence chain package.

[0007] In an implementation form of the present application, the step S1 specifically comprises: constructing an evidence source uniform descriptor model based on the evidence source registry, and generating a standardized evidence source descriptor set; automatically generating standard query statements for each data source according to the evidence source descriptor set, the target entity and the time window, and optimizing and generating a parallel collection task set through a query planner; based on the collection task set, concurrently invoking each data source interface using asynchronous I / O and connection pool multiplexing technology, and converting heterogeneous response data into a unified intermediate representation format, and outputting a standardized original evidence data set.

[0008] In an implementation form of the present application, in the step S2, the maximum likelihood joint time lag discovery method obtains the absolute time lag vector of each data source by constructing and solving the following global optimization model The joint optimization objective is to minimize the sum of squares of time residuals of all anchor event pairs:

[0009] wherein, is the set of anchor events, n is the number of data sources, is the absolute time offset of the i-th data source, is the theoretical time delay of the anchor event pair.

[0010] In an implementation form of the present application, the step S3 specifically comprises: extracting structured event objects from the time-aligned data through event pattern rules and anomaly detection algorithms, and injecting a semantic feature vector and a context resource snapshot for each event, and outputting a structured event set; taking the structured event set and the system topology graph as inputs, performing representation learning based on a temporal knowledge graph embedding model, calculating the causal correlation confidence between event pairs, and outputting a causal edge set with confidence; taking the causal edge set, the event set and the system topology graph as inputs, calculating the root cause score of each entity based on a causal field strength propagation model, and outputting a root cause list and a topologically verified causal graph.

[0011] In an implementation form of the application, in the step S4, the structured evidence chain package is packaged in a JSON-LD format and contains metadata, data provenance information, a global timeline event sequence, a causal graph structure, root cause ranking, supporting evidence references, and integrity verification information.

[0012] In an implementation form of the application, the method further comprises receiving an externally inputted evidence chain package to be verified, recalculating its cryptographic hash value and comparing it with the original digital fingerprint stored in the package to verify the integrity and non-tampering of the evidence chain.

[0013] In an implementation form of the application, in solving the global optimization model of the absolute time lag vector, a Huber loss function or a Tukey loss function capable of reducing the influence of anchor point events on the overall optimization result is used as a robust loss function.

[0014] In an implementation form of the application, after the step S2, a time alignment quality evaluation step is further included, specifically: calculating time residual statistics, anchor point consistency metrics, and source-level time offset distribution, and generating a time alignment quality report containing the quality indicators.

[0015] Secondly, the application also provides a multi-source event timeline reconstruction and evidence chain generation device, which comprises at least one processor and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to complete the multi-source event timeline reconstruction and evidence chain generation method.

[0016] Finally, a non-volatile computer storage medium for multi-source event timeline reconstruction and evidence chain generation is also provided, which stores computer executable instructions, and the computer executable instructions are executed by a processor to implement the multi-source event timeline reconstruction and evidence chain generation method.

[0017] The multi-source event timeline reconstruction and evidence chain generation method, device and medium provided by the application have the following beneficial effects: 1. End-to-end automation of operation and maintenance analysis is realized, and efficiency is revolutionarily improved: the application completely subverts the traditional operation and maintenance expert manual screening, comparison and reasoning mode among multiple platforms by a complete and automatic pipeline from automatic collection of multi-source data, joint time alignment based on MLE-JLDA algorithm to intelligent causal correlation, shortens the fault root cause positioning and evidence chain sorting time from hours to minutes in the traditional way, and realizes a magnitude improvement in operation and maintenance response efficiency and diagnostic automation level.

[0018] 2. Ensures millisecond-level precision and high reliability of cross-platform event timeline: By introducing a multi-scale time alignment method combining "anchor event-based coarse-grained calibration" and "maximum likelihood estimation (MLE-JLDA) based joint time delay discovery", the serious time distortion problem caused by clock drift, transmission delay and sampling asynchronization of multi-source data is fundamentally solved, and the reconstructed global event timeline has millisecond-level precision and significantly enhanced reliability, laying an indisputable time sequence foundation for subsequent accurate causal analysis.

[0019] 3. Provides deep causal insights with data-driven and knowledge-guided: By combining fast matching based on explicit rules and generalized causal discovery based on temporal knowledge graph embedding (TKGE-CI), the invention not only can handle known failure modes, but also can automatically derive potential and complex causal hypotheses from data and give quantitative confidence. This overcomes the limitations of traditional methods (such as simply relying on temporal proximity or keyword matching), making the analysis conclusion have breadth, depth and scientificity.

[0020] 4. Generates auditable and verifiable evidence package with legal-level credibility: The final evidence chain package (ECP) is structurally complete and self-contained, and innovatively integrates cryptographic hash value (or digital signature) as digital fingerprint, ensuring the integrity and non-tamperability of the data from generation to presentation, perfectly meeting the stringent requirements of evidence authenticity and reliability in failure review, compliance audit, judicial evidence and other scenarios.

[0021] 5. Has excellent platform compatibility and wide scene applicability: By designing a general evidence source unified abstraction model, the invention realizes decoupling with specific data source technologies, and can flexibly and seamlessly adapt to Prometheus, Loki, Jaeger, Zabbix and other mainstream and China's own monitoring components, with application scope far beyond chaos engineering experiment analysis, and can be widely applied to daily fault diagnosis, performance bottleneck analysis, security event investigation, system resilience evaluation and other scenarios, showing high practical value and promotion potential. BRIEF DESCRIPTION OF DRAWINGS

[0022] The drawings described herein are used to provide further understanding of the present application, and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A multi-source event timeline reconstruction and evidence chain generation method flowchart is provided for the embodiments of the present application; Figure 2 A multi-source event timeline reconstruction and evidence chain generation device schematic diagram is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0023] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0024] The embodiments of the present application provide a multi-source event timeline reconstruction and evidence chain generation method, device and medium. By introducing core mechanisms such as uniform modeling of evidence sources, multi-scale time alignment (based on maximum likelihood joint time alignment algorithm MLE-JLDA), intelligent causal correlation (based on temporal knowledge graph causal reasoning algorithm TKGE-CI and causal field strength root cause positioning algorithm CFS-RLA) and verifiable packaging, automatic collection, accurate time synchronization, correlation screening and causal chain construction of multi-source heterogeneous data such as indicators, logs and traces are realized, and a structured, tamper-proof and auditable evidence chain package is generated. Thus, the passive mode of "multi-platform manual assembly" is changed to the active mode of "one-stop automated intelligent generation" for fault diagnosis and system analysis, and efficient, reliable and credible evidence support is provided for operation and maintenance decision, resilience evaluation and compliance audit. The technical solutions proposed in the embodiments of the present application will be described in detail below with reference to the drawings.

[0025] Figure 1 A multi-source event timeline reconstruction and evidence chain generation method flowchart is provided for the embodiments of the present application. As shown in Figure 1 The method mainly includes the following steps: Step S1: based on a pre-defined evidence source registry, heterogeneous monitoring data sources are uniformly abstracted and modeled, and according to input target entities and time window parameters, raw evidence data is collected in parallel; Step S2: based on the collected raw data, coarse-grained time offset is estimated by identifying global anchor events, and the absolute time lag of each data source is solved by using a maximum likelihood joint time lag discovery method, and the timestamps of all evidence data are corrected to a unified global time axis; Step S3: on the unified time axis, the aligned data is eventized and extracted, and based on a causal rule base and a statistical causal discovery algorithm, correlation analysis is performed to construct a preliminary causal evidence chain with confidence; Step S4: the causal evidence chain, supporting raw data segments and generation process metadata are packaged into a structured evidence chain package, and a cryptographic hash value is calculated to generate a digital fingerprint, and the complete evidence chain package is output.

[0026] In this application, firstly, based on a predefined evidence source registry, indicators, logs, tracking and event data sources are uniformly abstracted and modeled; the modeling process configures the type, endpoint, authentication information and time characteristic parameters of each data source; according to the input investigation time window and target entity, the standardized interfaces of each data source are called in parallel to collect raw evidence data.

[0027] Specifically, the steps are as follows: (1) Based on the predefined evidence source registry configuration, construct a tuple-based unified descriptor model for evidence sources, clarify the type, endpoint, authentication information and time characteristic parameters of the data source, and adopt a central registry mechanism for unified management to generate a standardized set of evidence source descriptors, providing a structured access specification for subsequent data collection; (2) Based on the set of evidence source descriptors generated in step (1), and combined with the input target entity and time window parameters, standard query statements for each data source are automatically generated, and a set of parallel acquisition tasks is generated through the query planner to provide an execution blueprint for efficient data acquisition. (3) Based on the collection task set output in step (2), asynchronous I / O and connection pool reuse technology are used to concurrently call the interfaces of each data source, and the heterogeneous response data is converted into a unified intermediate representation format through the parser, and finally the original evidence data set after standardization is output.

[0028] Furthermore, based on the collected raw data, coarse-grained time offset estimation is first performed by identifying global anchor point events; then, cross-correlation analysis in signal processing is used to calculate the cross-correlation coefficients of different source data sequences within a sliding time window, and the offset when the correlation coefficient reaches its maximum value is used as the fine-grained adjustment amount; the timestamps of all evidence data are corrected to a unified global time axis.

[0029] Specifically, it is based on the joint time delay solution of maximum likelihood estimation (MLE-JLDA).

[0030] Anchor event set for output We employ a joint time delay discovery method based on maximum likelihood estimation (MLE-JLDA) to construct a global optimization model to solve for the absolute time delay vectors of each data source relative to a unified time base.

[0031] Where N is the number of data sources. This represents the absolute time offset of the i-th data source.

[0032] The joint optimization objective is to minimize the sum of squared time residuals for all anchor event pairs:

[0033] To improve robustness to noise and abnormal anchor events, the objective function can preferably be replaced with a robust loss function such as Huber loss or Tukey loss to reduce the impact of incorrectly matched anchors on the overall optimization results.

[0034] To eliminate the invariance of the objective function with respect to global translation, preferably, one of the following constraints can be added to ensure the uniqueness of the solution: Select a reference data source ,constraint Or add normalization constraints. .

[0035] By solving the above optimization model, the globally optimal absolute time delay vectors for each data source can be obtained:

[0036] Then, a unified timeline is constructed and the mapping is corrected.

[0037] Based on the absolute time delay vector of the output Linear correction is performed on all timestamps of the original evidence data to construct a unified global timeline. Specifically: For any record from source i, its original timestamp t raw Transformed into aligned timestamps:

[0038] Through the above mapping, all cross-source monitoring records are normalized to the same time base, ensuring the temporal consistency between subsequent event sequence reconstruction and causal inference.

[0039] Preferably, to improve computational efficiency in large-scale data scenarios, batch transformation, SIMD vectorization processing, or hierarchical alignment strategies can be adopted.

[0040] Then, the time alignment quality is assessed and the alignment results are persisted. Based on the obtained alignment results, quality indicators such as time residual statistics, anchor consistency measures, and source-level time offset distribution are calculated, and a time alignment quality report is generated. This report includes, but is not limited to: Mean, variance, and distribution of anchor event residuals; absolute offset of the data source. The credibility of the data; the overlap of cross-source events on the timeline after alignment; and the identification and marking information of abnormal anchor points.

[0041] Finally, the aligned evidence data D aligned With time offset vector They are stored together for subsequent causal relationship analysis and evidence chain generation stages, providing a reliable data foundation for building a high-quality causal evidence chain.

[0042] Furthermore, on a unified timeline, the aligned data is subjected to event-based extraction and feature enhancement; based on a predefined causal rule base and statistical causal discovery algorithm, the event sequence is subjected to correlation analysis to generate causal hypotheses with confidence levels; and the system topology graph is used to constrain the propagation path and construct a preliminary causal evidence chain.

[0043] The specific implementation steps are as follows: First, event-based extraction and semantic enrichment are achieved using the time-aligned evidence dataset D based on the output. aligned Structured event objects are extracted from the raw data using predefined event pattern rules and anomaly detection algorithms (such as CUSUM-based mutation point detection). Each event is represented as a tuple. , where t i For global timestamps, type i For event type, type i Severity i For the identification of associated entities, This generates semantic feature vectors based on pre-trained models (such as BERT). Simultaneously, it injects snapshots of the context resources (such as CPU and memory metrics) at the time of the event's occurrence, outputting an enriched structured event set. .

[0044] Then, causal discovery based on temporal knowledge graph (TKGE-CI).

[0045] The set of output events and system topology diagram G topology Using the input, a temporal knowledge graph is constructed. An improved RotatE model is employed, mapping events and entities to a complex vector space for representation learning. Its scoring function is defined as:

[0046] in, These are vector representations of the head entity, tail entity, and relation, respectively. This represents element-wise multiplication. The goal is to minimize the score of the true triple (h, r, t) through optimization. For any event pair (e... i e j The confidence level of causal association is calculated by plotting the causal relationship vector. The score obtained is:

[0047] Preferably, a hybrid reasoning strategy combining a rule engine and TKGE-CI is adopted. The rule engine handles highly deterministic causality, while TKGE-CI is responsible for uncovering potential complex patterns, ultimately outputting a set of causal edges with confidence levels. .

[0048] Then, Root Cause Localization (CFS-RLA) based on causal field strength.

[0049] The causal edge set G output in step S32 edges Event set EEE and system topology diagram G topology As input, perform causal field strength propagation calculations. Treat each anomalous event as a field source, with its strength S... i Quantified by the degree of anomaly (e.g., the number of standard deviations from the baseline). The causal field strength of node j at node i is:

[0050] in This represents the shortest path distance between two nodes in the topology graph. For the time difference of the event, The attenuation coefficient is given. The root cause score of entity j is the sum of all causal field strengths it receives:

[0051] Preferably, the attenuation coefficient It can learn and optimize through historical fault data, and finally output a root cause list sorted in descending order of root cause score and a cause-effect graph G that has been topologically validated. causal .

[0052] Furthermore, the generated causal evidence chain, supporting original data fragments, and metadata of the generation process are encapsulated into a structured evidence chain package; cryptographic hash values ​​are calculated for all contents of the evidence chain package to generate unique digital fingerprints; finally, a complete evidence chain package containing a visual view and verifiable hash values ​​is output.

[0053] The specific implementation steps are as follows: The output causal graph G causal Root cause list, output time-aligned data D aligned The generated event set E is input to construct an Evidence Chain Package (ECP) conforming to the W3C Provenance standard. The ECP is encapsulated in JSON-LD format and includes the following core modules: metadata (scene ID, time window, algorithm version, etc.); proofance (data traceability information, recording the applied time offset). Algorithm parameters, etc.; global_timeline: a sequence of ordered events on a globally unified timeline; causal_graph: a causal graph structure G with confidence levels. causal, root_cause_ranking: a list of root cause scores; supporting_evidence: references to key raw data fragments (such as log fragments, metric curves); integrity: integrity verification information.

[0054] Then, perform digital fingerprint generation and signing. Protect the integrity of the generated ECP structure: calculate the cryptographic hash of the structured data: hash = SHA-256(Canonicalize(ECP)), where Canonicalize ensures JSON serialization standardization. (Optional) Digitally sign the hash value using the platform's private key: , hash value (and signature) Write to the integrity field of the ECP.

[0055] Then, visualization and output are performed to generate multimodal outputs to meet different usage scenarios: (1) Machine-readable output: Output a complete ECP JSON-LD file for subsequent system access and analysis. (2) Human-readable report: Generate an interactive visualization timeline (D3.js / Vega); draw the causal graph topology structure and highlight high-confidence paths; generate a root cause ranking list and key indicator snapshots; output a complete audit report in PDF format; (3) Audit interface: Provide an ECP verification interface to support third parties to verify hash values. Confirm the integrity of the chain of evidence.

[0056] The above describes a method for reconstructing a timeline of multiple events and generating a chain of evidence, as provided in this application. Based on the same inventive concept, this application also provides a device for reconstructing a timeline of multiple events and generating a chain of evidence. Figure 2 A schematic diagram of a multi-source event timeline reconstruction and evidence chain generation device provided in this application embodiment is shown below. Figure 2 As shown, the device mainly includes: at least one processor 201; and a memory 202 communicatively connected to the at least one processor; wherein the memory 202 stores instructions that can be executed by the at least one processor 201, and the instructions are executed by the at least one processor 201 to enable the at least one processor 201 to complete the aforementioned method for multi-source event timeline reconstruction and evidence chain generation.

[0057] In addition, embodiments of this application also provide a non-volatile computer storage medium for multi-source event timeline reconstruction and evidence chain generation, which stores computer-executable instructions, which are executed by a processor to implement the aforementioned method for multi-source event timeline reconstruction and evidence chain generation.

[0058] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0059] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0060] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0061] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0062] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0063] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0064] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for reconstructing a timeline of multi-source events and generating a chain of evidence, characterized in that, The method includes the following steps: Step S1: Based on the predefined evidence source registry, perform unified abstract modeling of heterogeneous monitoring data sources, and collect raw evidence data in parallel according to the input target entity and time window parameters; Step S2: Based on the collected raw data, estimate the coarse-grained time offset by identifying global anchor events, and use the maximum likelihood joint time delay discovery method to solve the absolute time delay of each data source, and correct the timestamps of all evidence data to a unified global time axis. Step S3: Extract events from the aligned data on a unified timeline, and perform correlation analysis based on the causal rule base and statistical causal discovery algorithm to construct a preliminary causal evidence chain with confidence. Step S4: Encapsulate the causal evidence chain, supporting original data fragments, and generation process metadata into a structured evidence chain package, calculate its cryptographic hash value to generate a digital fingerprint, and output the complete evidence chain package.

2. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 1, characterized in that, Step S1 specifically includes: A unified descriptor model for evidence sources is constructed based on the evidence source registry, generating a standardized set of evidence source descriptors. Based on the set of evidence source descriptors, target entities, and time windows, standard query statements for each data source are automatically generated, and a set of parallel acquisition tasks is generated through a query planner. Based on the collection task set, asynchronous I / O and connection pool multiplexing technology are used to concurrently call the interfaces of each data source, and heterogeneous response data are converted into a unified intermediate representation format to output a standardized set of original evidence data.

3. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 1, characterized in that, In step S2, the maximum likelihood joint time delay discovery method obtains the absolute time delay vectors of each data source by constructing and solving the following global optimization model. The joint optimization objective is to minimize the sum of squared time residuals for all anchor event pairs: in, Let n be the set of anchor events, and n be the number of data sources. Let i be the absolute time offset of the i-th data source. This represents the theoretical time delay for the anchor event pair.

4. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 1, characterized in that, Step S3 specifically includes: Structured event objects are extracted from time-aligned data using event pattern rules and anomaly detection algorithms. Semantic feature vectors and context resource snapshots are injected into each event, and a set of structured events is output. Using the structured event set and system topology graph as input, representation learning is performed based on the temporal knowledge graph embedding model to calculate the causal association confidence between event pairs and output a set of causal edges with confidence. Using the set of causal edges, the set of events, and the system topology graph as input, the root cause score of each entity is calculated based on the causal field strength propagation model, and the root cause list and the topology-validated causal graph are output.

5. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 1, characterized in that, In step S4, the structured evidence chain package is encapsulated in JSON-LD format and includes metadata, data tracing information, global timeline event sequence, cause-effect graph structure, root cause ranking, supporting evidence citations, and integrity verification information.

6. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 1, characterized in that, The method further includes: receiving an externally input evidence chain packet to be verified, recalculating its cryptographic hash value and comparing it with the original digital fingerprint stored in the packet to verify the integrity and tamper-proof nature of the evidence chain.

7. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 3, characterized in that, In the global optimization model for solving the absolute time delay vector, the Huber loss function or Tukey loss function, which can reduce the impact of mismatched anchor events on the overall optimization result, is used as the robust loss function.

8. The method for reconstructing a multi-source event timeline and generating a chain of evidence according to claim 1, characterized in that, Following step S2, a time alignment quality assessment step is also included, specifically: calculating the time residual statistics, anchor consistency measure, and source-level time offset distribution, and generating a time alignment quality report containing quality indicators.

9. A device for reconstructing a timeline of multi-source events and generating a chain of evidence, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the multi-source event timeline reconstruction and evidence chain generation method according to any one of claims 1-8.

10. A non-volatile computer storage medium for multi-source event timeline reconstruction and evidence chain generation, storing computer-executable instructions, characterized in that, The computer-executable instructions are executed by a processor to implement a method for reconstructing a multi-source event timeline and generating a chain of evidence as described in any one of claims 1-8.

Images