Root cause determination method, system and equipment based on causal analysis

Abstract

The invention provides a root cause determination method, system and equipment based on causal analysis, and the method is applied to an edge node, and comprises the steps: carrying out the preprocessing of original data collected from an edge terminal, obtaining a structured data block, distributing a logic sequence number for the structured data block, and when a preset causal relationship generation condition is satisfied, carrying out the processing of the structured data block; selecting a preset number of structured data blocks based on the logic sequence number, generating a local causal graph, determining a first causal relationship index corresponding to the local causal graph based on a causal relationship between variables in the local causal graph, and uploading the first causal relationship index to a center node; updating the local causal graph according to a correction factor generated and issued by a central node; and after it is detected that abnormal data exist in the edge terminal, determining target data corresponding to the abnormal data based on the updated local cause and effect graph. Through the method, a dynamic learning loop is formed between the edge node and the center node, and real-time, accurate and integrated causal attribution is realized.

Description

Technical Field

[0001] This application relates to the field of server monitoring, and in particular to a root cause determination method, system, and device based on causal analysis. Background Technology

[0002] In the field of causal analysis, traditional data analysis and machine learning models can typically only identify correlations between variables, but struggle to discern the true causes of changes in outcomes from complex observational data. With the widespread adoption of IoT and big data technologies, the demand for rapid response to system anomalies is increasing in scenarios such as industrial manufacturing and network maintenance, necessitating technical means to achieve accurate causal attribution. Traditional methods relying on expert experience or statistical correlation generally suffer from weak interpretability, insufficient reliability, and inadequate real-time response capabilities when dealing with complex, high-dimensional, multivariate, and dynamically evolving systems.

[0003] To address these challenges, the combination of causal inference and machine learning has become a research hotspot, giving rise to causal analysis solutions based on centralized architectures. These existing technologies typically rely on cloud servers or data centers to aggregate large-scale data from edge devices and employ tools such as structural equation modeling, causal Bayesian networks, or the DoWhy framework for causal analysis to perform offline, batch causal relationship modeling and inference. While these solutions possess certain global analysis capabilities, they still have significant drawbacks in practical applications: centralized architectures employ batch processing, resulting in lengthy data processing chains and high overall latency, failing to meet the requirements for real-time root cause localization and prolonging the overall response time from problem discovery to resolution; simultaneously, the remote transmission of massive amounts of raw data consumes significant bandwidth, and centralized cloud computing can easily become a performance bottleneck. Summary of the Invention

[0004] This application provides a root cause determination system, method, electronic device, and storage medium based on causal analysis. The method not only ensures the real-time response and autonomy of the system at the edge, but also maximizes privacy and security through localized data processing, achieving efficient and accurate distributed root cause localization.

[0005] In a first aspect, embodiments of this application propose a root cause determination system based on causal analysis, including edge nodes and central nodes, wherein:

[0006] The edge node is used to preprocess the raw data collected from the edge terminal to obtain structured data blocks, and then assign logical numbers to the structured data blocks; after satisfying preset causal relationship generation conditions, it selects a preset number of structured data blocks based on the logical numbers, and generates a local causal graph based on the structured data blocks, and determines a first causal relationship index corresponding to the local causal graph based on the causal relationships between various variables in the local causal graph; it uploads the local causal graph and the first causal relationship index to the central node, and updates the local causal graph according to the correction factor issued by the central node, wherein the correction factor is generated by the central node based on the local causal graph and the first causal relationship index; after detecting abnormal data in the edge terminal, it determines the target data corresponding to the abnormal data based on the updated local causal graph;

[0007] The central node is configured to receive local causal graphs and corresponding first causal relationship indicators uploaded by each edge node; fuse the local causal graphs based on the first causal relationship indicators to generate a global causal graph; and determine a second causal relationship indicator corresponding to the global causal graph based on the causal relationships between variables in the global causal graph; compare the second causal relationship indicator with each of the first causal relationship indicators respectively, and generate a correction factor for each edge node based on the comparison results; and distribute the correction factor to each edge node to instruct the edge node to update the local causal graph based on the correction factor, and, upon detecting abnormal data in the edge terminal, determine the target data corresponding to the abnormal data based on the updated local causal graph.

[0008] Secondly, embodiments of this application propose a root cause determination method based on causal analysis, applied to edge nodes, including:

[0009] After preprocessing the raw data collected from the edge terminal to obtain structured data blocks, logical sequence numbers are assigned to the structured data blocks;

[0010] After satisfying the preset causal relationship generation conditions, a preset number of structured data blocks are selected based on the logical sequence number, and a local causal graph is generated based on the structured data blocks. Based on the causal relationship between each variable in the local causal graph, the first causal relationship index corresponding to the local causal graph is determined.

[0011] The local causal graph and the first causal relationship index are uploaded to the central node, and the local causal graph is updated according to the correction factor issued by the central node, wherein the correction factor is generated by the central node based on the local causal graph and the first causal relationship index.

[0012] After detecting abnormal data in the edge terminal, the target data corresponding to the abnormal data is determined based on the updated local causal graph.

[0013] In some possible embodiments, the method further includes:

[0014] After satisfying the preset causal relationship update conditions, a preset number of structured data blocks are selected based on the logical sequence number, and the local causal graph is updated based on the structured data blocks;

[0015] Based on the causal relationships between variables in the updated local causal graph, the first causal relationship index is updated.

[0016] The updated local causal graph and the updated first causal relationship index are uploaded to the central node, and the local causal graph is updated according to the correction factor issued by the central node.

[0017] In some possible embodiments, the method further includes:

[0018] The local causal graph and the first causal relationship index are input into a pre-trained semantic model and converted into natural language text output.

[0019] Based on the output natural language text, a corresponding visualization report is generated. The visualization report includes some or all of the predefined key causal relationships, first causal relationship indicators, and the changing trends of the local causal graph.

[0020] In some possible embodiments, the method further includes:

[0021] When abnormal data is detected in the edge terminal and the target data corresponding to the abnormal data cannot be determined based on the updated local causal graph, the abnormal data is uploaded to the central node so that the central node can determine the target data corresponding to the abnormal data based on the global causal graph generated by fusing the local causal graph using the first causal relationship index.

[0022] Thirdly, embodiments of this application propose a root cause determination method based on causal analysis, applied to a central node, including:

[0023] Receive the local causal graphs uploaded by each edge node and the first causal relationship index corresponding to the local causal graphs;

[0024] The local causal graph is fused based on the first causal relationship index to generate a global causal graph, and the second causal relationship index corresponding to the global causal graph is determined based on the causal relationship between each variable in the global causal graph.

[0025] The second causal relationship index is compared with each of the first causal relationship indices, and a correction factor for each edge node is generated based on the comparison results.

[0026] The correction factor is distributed to each edge node to instruct the edge node to update the local causal graph based on the correction factor, and after detecting abnormal data in the edge terminal, the target data corresponding to the abnormal data is determined based on the updated local causal graph.

[0027] In some possible embodiments, the method further includes:

[0028] Receive the updated local causal graph and the updated first causal relationship index uploaded by each edge node;

[0029] Based on the updated local causal graph and the updated first causal relationship index, the global causal graph is updated, and based on the causal relationships between variables in the updated global causal graph, the second causal relationship index is updated.

[0030] The updated second causal relationship index is compared with each of the first causal relationship indices, and a correction factor for each edge node is generated based on the comparison results.

[0031] The correction factor is distributed to each edge node to instruct the edge node to update the local causal graph based on the correction factor.

[0032] In some possible embodiments, the method further includes:

[0033] The global causal graph and the second causal relationship index are input into a pre-trained semantic model and converted into natural language text output.

[0034] Based on the output natural language text, a corresponding visualization report is generated. The visualization report includes some or all of the predefined key causal relationships, second causal relationship indicators, and the changing trends of the global causal graph.

[0035] In some possible embodiments, the method further includes:

[0036] The system receives abnormal data uploaded by each edge node when it detects abnormal data in the edge terminal and fails to determine the target data corresponding to the abnormal data based on the updated local causal graph, and determines the target data corresponding to the abnormal data based on the global causal graph.

[0037] Fourthly, embodiments of this application provide an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform steps in a root cause determination method based on causal analysis as described in any of the first or second aspects of the above embodiments.

[0038] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a computer, cause the computer to perform a root cause determination method based on causal analysis as described in any of the second or third aspects discussed above.

[0039] The present application describes a root cause determination system, method, electronic device, and storage medium based on causal analysis. The system includes edge nodes and a central node. Each edge node generates and updates a local causal graph in real time based on data collected from local edge terminal devices, achieving low-latency inference and autonomous response, while reducing bandwidth consumption and privacy risks caused by data uploading to the cloud. The central node integrates the lightweight causal information from each edge node to construct and optimize a global causal graph, thereby ensuring real-time performance while obtaining system-level stable insights and collaborative decision-making capabilities.

[0040] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a schematic diagram of a root cause determination system based on causal analysis in an embodiment of this application;

[0043] Figure 2 This is a schematic diagram of the structure of an edge node in an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the structure of a central node in an embodiment of this application;

[0045] Figure 4 This is a schematic diagram of another central node structure in an embodiment of this application;

[0046] Figure 5 This is a schematic diagram of another root cause determination system structure based on causal analysis in an embodiment of this application;

[0047] Figure 6 This is a flowchart illustrating the updating of a local cause-effect graph and a global cause-effect graph in an embodiment of this application;

[0048] Figure 7 This is a flowchart of a method applied to edge nodes in an embodiment of this application;

[0049] Figure 8 This is a flowchart of a method applied to a central node in an embodiment of this application;

[0050] Figure 9 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0051] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods.

[0052] In the field of causal analysis, traditional data analysis and machine learning models can typically only identify correlations between variables, but struggle to discern the true causes of changes in outcomes from complex observational data. With the widespread adoption of IoT and big data technologies, the demand for rapid response to system anomalies is increasing in scenarios such as industrial manufacturing and network maintenance, creating an urgent need for technical means to achieve accurate causal attribution.

[0053] Traditional methods relying on expert experience or statistical correlation generally suffer from weak interpretability, insufficient reliability, and inadequate real-time response capabilities when dealing with complex systems that are high-dimensional, multivariate, and dynamically evolving. Therefore, this paper proposes a causal attribution technique that, by introducing causal inference theory and structural modeling methods, identifies the true causes of anomalous events from complex data, providing a more interpretable and reliable basis for decision-making.

[0054] To address these challenges, the combination of causal inference and machine learning has become a research hotspot, giving rise to causal analysis solutions based on centralized architectures. These existing technologies typically rely on cloud servers or data centers to aggregate large-scale data from edge devices and employ tools such as structural equation modeling, causal Bayesian networks, or the DoWhy causal analysis framework for offline, batch causal relationship modeling and inference. Compared to traditional pure correlation analysis, causal inference can infer more reliable cause-and-effect relationships based on data, providing more interpretable and transferable insights and possessing a certain degree of global analytical capability. However, it still has significant drawbacks in practical applications: centralized architectures use batch processing, resulting in lengthy data processing chains and high overall latency, failing to meet the requirements for real-time root cause localization and prolonging the overall response time from problem discovery to resolution; simultaneously, the remote transmission of massive amounts of raw data consumes significant bandwidth, and centralized cloud computing can easily become a performance bottleneck.

[0055] Given that the centralized architecture of existing attribution analysis technologies cannot meet the low-latency processing requirements in real-time response scenarios, and is prone to performance bottlenecks during large-scale streaming data processing, thus failing to meet the technical needs of real-time attribution services, this application proposes a root cause determination system based on causal analysis, such as... Figure 1 As shown, it includes at least one edge node 101 and a center node 102, wherein:

[0056] Each edge node 101 is used to preprocess the raw data collected from the edge terminal to obtain structured data blocks, and then assign logical serial numbers to the structured data blocks; after satisfying the preset causal relationship generation conditions, it selects a preset number of structured data blocks based on the logical serial numbers, and generates a local causal graph based on the structured data blocks, and determines the first causal relationship index corresponding to the local causal graph based on the causal relationships between the variables in the local causal graph; it uploads the local causal graph and the first causal relationship index to the central node, and updates the local causal graph according to the correction factor issued by the central node; after detecting abnormal data in the edge terminal, it determines the target data corresponding to the abnormal data based on the updated local causal graph;

[0057] The central node 102 is configured to receive local causal graphs and corresponding first causal relationship indicators uploaded by each edge node; fuse the local causal graphs based on the first causal relationship indicators to generate a global causal graph; and determine the corresponding second causal relationship indicator based on the causal relationships between variables in the global causal graph; compare the second causal relationship indicator with each of the first causal relationship indicators respectively, and generate a correction factor for each edge node based on the comparison results; and distribute the correction factor to each edge node to instruct the edge node to update the local causal graph based on the correction factor.

[0058] In this embodiment, at the edge nodes, online incremental learning is performed on the local data stream to update causal relationships in real time and autonomously construct local causal graphs. This fundamentally reduces the amount of data that needs to be uploaded to the central node. Edge nodes only need to upload highly compressed model updates or causal structure difference information to the central node, without uploading the original data stream, thereby significantly reducing bandwidth consumption, communication latency, and the computational load on the central node. Simultaneously, the central node performs information fusion and global analysis based on the compressed information received from each edge node to determine the root cause of the system.

[0059] The aforementioned root cause determination system based on causal analysis not only ensures the system's real-time response and autonomy at the edge, but also maximizes privacy and security through localized data processing, achieving efficient and accurate distributed root cause localization.

[0060] In some possible embodiments, the edge node, such as Figure 2 As shown, it includes at least one of the following modules:

[0061] The data stream access module 201 is used to preprocess the raw data collected from the edge terminal to obtain structured data blocks, and then assign logical sequence numbers to the structured data blocks.

[0062] The local causal discovery module 202 is used to select a preset number of structured data blocks based on the logical sequence number after the preset causal relationship generation conditions are met, generate a local causal graph based on the structured data blocks, and determine the first causal relationship index corresponding to the local causal graph based on the causal relationship between each variable in the local causal graph.

[0063] Edge intelligence engine 203 is used to upload the local causal graph and the first causal relationship index to the central node, and update the local causal graph according to the correction factor issued by the central node, wherein the correction factor is generated by the central node based on the local causal graph and the first causal relationship index.

[0064] The first root cause determination module 204 is used to determine the target data corresponding to the abnormal data based on the updated local causal graph after detecting abnormal data in the edge terminal.

[0065] In some possible embodiments, the central node, such as Figure 3 As shown, it includes at least one of the following modules:

[0066] The federated collaboration module 301 is used to receive the local causal graph and the first causal relationship index corresponding to the local causal graph uploaded by each edge node; and to send the correction factor to each edge node to instruct the edge node to update the local causal graph based on the correction factor.

[0067] The central knowledge engine 302 is used to fuse the local causal graph based on the first causal relationship index to generate a global causal graph, and to determine the second causal relationship index corresponding to the global causal graph based on the causal relationship between each variable in the global causal graph; to compare the second causal relationship index with each of the first causal relationship indices respectively, and to generate correction factors for each edge node based on the comparison results.

[0068] In this embodiment of the application, the data stream access module of the aforementioned edge node is directly connected to at least one edge terminal, the edge terminal including but not limited to sensors, devices or business systems, and the raw data including but not limited to multi-dimensional data streams such as sensor data, device basic attribute data or calculated index data.

[0069] In some possible embodiments, the data stream access module described above preprocesses the raw data by performing streaming data cleaning, including at least one of the following steps:

[0070] The data stream is smoothed and noise filtered in real time using a moving average algorithm.

[0071] The data is synchronized to a unified timeline by timestamp alignment, thus completing the time sequence alignment.

[0072] For any missing data, K-nearest neighbor imputation or predictive imputation based on long short-term memory networks is used to fill in the missing data.

[0073] Among them, differentiated cleaning strategies are adopted for data streams of different dimensions. For example, environmental data such as temperature and humidity focus on outlier filtering and smoothing, while discrete data such as equipment fault alarms focus on deduplication and format standardization.

[0074] In this embodiment of the application, a hierarchical schema registration mechanism is implemented to perform unified semantic annotation and structured governance on the above-mentioned data streams of different dimensions. The data output after semantic annotation and structured governance is converted into standardized structured data blocks, and logical sequence numbers are assigned to the structured data blocks.

[0075] In some possible embodiments, the structured data blocks are stored in a database including a sliding data window, and logical sequence numbers are assigned to the structured data blocks in the database according to the chronological order in which they were stored in the database.

[0076] When the local causal discovery module determines that the system has been running normally for 1 hour or has stored 2000 structured data blocks, it determines that the preset causal relationship generation conditions are met, and selects a preset number of structured data blocks based on the logical sequence number. The preset number can be set according to the actual data flow volume, and should include existing stored structured data blocks as much as possible.

[0077] In some possible embodiments, the local causal discovery module is specifically used to: generate variable nodes with a corresponding number of semantics based on the structured data block labeled with semantics, including but not limited to "temperature", "pressure", "equipment speed", etc.; and generate a directed acyclic graph as the local causal graph based on each variable node, including variable nodes and causal edges connecting each variable node, wherein the causal edges represent the causal dependencies between variable nodes and their directions.

[0078] In this embodiment, the above-mentioned directed acyclic graph generated based on each variable node is generated using the traditional PC (Peter-Clark algorithm). The main steps to construct a local causal graph are as follows: First, based on the above-mentioned variable nodes, a completely undirected graph is assumed. Then, based on statistical tests, edges that do not have conditional independence between variable nodes are gradually removed. Finally, the direction of the remaining edges is determined to form a directed acyclic graph.

[0079] In some possible embodiments, the first causal relationship index includes, but is not limited to, a causal effect weight matrix, the confidence level of the causal path, and its stability. The matrix elements characterize the strength of the causal relationship between the corresponding variables. The confidence level is calculated by comprehensively testing the conditional probability product of each causal edge on the path, and is used to characterize the statistical reliability of the corresponding causal relationship. The stability level is used to characterize the statistical robustness of the corresponding causal relationship. Generating the above-mentioned first causal relationship index based on the causal relationships between the variables in the local causal graph includes:

[0080] Based on the causal relationships between variables in the local causal graph, the causal effect of each causal edge is calculated, and the causal effect weight matrix is ​​constructed based on the causal effect.

[0081] Based on the quantified causal effects, the confidence and stability of each causal path are evaluated and generated.

[0082] In some possible embodiments, the causal effect includes the average treatment effect and the conditional average treatment effect. The calculation method for calculating the causal effect of each causal variable is the same as that in the prior art and is not specifically limited in the embodiments of this application.

[0083] To reduce the cost of cross-network node transmission, the edge intelligence engine of the edge node is further configured to compress the aforementioned local causal graph and the first causal relationship index according to a corresponding compression algorithm before uploading them to the central node. Specifically, the edge intelligence engine is configured to:

[0084] The local causal graph and the first causal relationship index generated by the aforementioned local causal discovery module are obtained.

[0085] The local causal graph is encoded according to its structure, and the current causal graph structure is described using graph hashing, adjacency matrix compression, or edge list encoding.

[0086] The causal effect weight matrix in the first causal relationship is compressed using a low-rank matrix and Top-K edge weight selection to generate a compact edge weight representation;

[0087] The confidence and stability of the causal path in the first causal relationship are encapsulated using Protobuf format or floating-point compression.

[0088] The compressed data is then packaged into a summary and uploaded to the central node.

[0089] In this embodiment of the application, the edge intelligent engine is the core of realizing the autonomy and robustness of edge nodes. The engine has the ability to compress locally and continuously update itself through a lightweight learning mechanism. Even when the connection with the central node network is lost, the engine can still run independently based on local cache, ensuring that critical services are uninterrupted, thereby significantly enhancing the reliability and real-time response capability in complex edge environments.

[0090] In this embodiment, a local causal discovery module and an edge intelligence engine are deployed for each edge node, enabling the data cleaning process to be completed in real time at the edge. Compared with the existing centralized cloud cleaning solution, it is not necessary to upload all the original data to the cloud, thereby effectively reducing network transmission pressure and latency.

[0091] Correspondingly, the federated collaboration module in the central node receives the local causal graphs and the first causal relationship indexes corresponding to the local causal graphs uploaded by each edge node, and performs global aggregation and consistency correction on the summary information uploaded by each edge node at the central node. Specifically, it decompresses the summary information from different edge nodes, performs time-series alignment and standardization processing, and ensures that the data is subsequently fused under a unified time benchmark and measurement standard.

[0092] In this embodiment, the central knowledge engine processes the summary information based on the aforementioned federated collaboration module, and then fuses the multiple sets of first causal relationship indicators and the local causal graph to generate a global causal graph. Specifically, the central knowledge engine uses existing graph alignment and fusion algorithms to generate the global causal graph, which will not be elaborated further here.

[0093] In some possible embodiments, the central knowledge engine is further configured to determine a second causal relationship index corresponding to the global causal graph based on the causal relationships between variables in the global causal graph, compare the second causal relationship index with each of the first causal relationship indices, and generate correction factors for each edge node based on the comparison results. The correction factors include a causal graph structure template and edge weight correction factors. The causal graph structure template is used to characterize a stable causal skeleton shared by multiple edge nodes, and the edge weight correction factors are used to standardize and correct the bias of the first causal relationship indices of local causality for each edge node. In this embodiment, the method for generating correction factors for each edge node based on the comparison results is the same as existing algorithms for generating correction factors and is not specifically limited here.

[0094] The aforementioned central knowledge engine is responsible for global knowledge management and collaborative optimization. Its core responsibility is to construct a unified global causal knowledge graph based on graph alignment and fusion algorithms, and to generate structural templates and edge weight correction factors by analyzing the fused global causal graph in order to optimize the structure of each local causal graph and ensure the stability and consistency of the global graph.

[0095] In this embodiment of the application, the federated collaboration module in the central node is further configured to distribute the correction factor to each edge node, so as to instruct the edge node to update the local causal graph based on the correction factor.

[0096] The federated collaboration module distributes the correction factors output by the central knowledge engine back to each edge node in a unified protocol, achieving consistency across multiple edge nodes. Correspondingly, the local causal discovery modules in each edge node are also used to update the local causal graph based on the correction factors distributed by the central node.

[0097] Optionally, the method by which the local causal discovery module updates the local causal graph based on the correction factor is the same as the method in the prior art, and will not be described again here.

[0098] In terms of data security and privacy, the centralized model of raw data aggregation, transmission, and storage significantly increases the risk of data leakage and misuse, and is also difficult to meet the stringent compliance requirements of various industries and regions for data localization and privacy protection. However, in this embodiment, each edge node only needs to upload highly abstract summary information (such as compressed local causal graph structures and metrics) to the central node, without uploading any raw data. This fundamentally eliminates the risk of leakage and misuse of raw data during transmission and centralized storage, while naturally meeting data localization regulatory requirements, providing a compliant and secure technical foundation for cross-industry and cross-regional collaborative analysis.

[0099] In complex systems, the causal relationships between variables evolve dynamically with time and environment. Traditional offline modeling methods struggle to capture such changes in a timely manner, often leading to delayed or invalid inference results. To overcome the technical problem of delayed inference results caused by the dynamic evolution of causal relationships with time and environment, the local causal discovery module in the edge node is further configured to: after satisfying the preset causal relationship update conditions, select a preset number of structured data blocks based on the logical sequence number, and update the local causal graph based on the structured data blocks; and update the first causal relationship index based on the causal relationships between variables in the updated local causal graph.

[0100] In this embodiment, the structured data blocks are stored in a database including a sliding data window. During the data block storage process, the sliding data window continuously slides to ensure that the latest structured data blocks are included in the data window in real time.

[0101] Optionally, in this embodiment, the preset causal relationship update conditions include, but are not limited to, conditions such as the system running normally for a preset duration after the last generation of the local causal graph, or storing a preset number of structured data blocks after the last generation of the local causal graph, or the data window sliding by a preset length. In this case, the aforementioned local causal graph needs to be updated in real time based on the newly collected structured data blocks.

[0102] In some possible embodiments, local conditional independence is only performed on newly added data within the aforementioned data window to reduce computational load. Specifically, an improved incremental PC-Lite algorithm is used to construct a CPDAG (Completed Partially Directed Acyclic Graph). The improved incremental PC-Lite algorithm is existing technology and will not be described in detail here.

[0103] In this embodiment, the local causality discovery module is further configured to recalculate the corresponding first causality index based on the updated local causality graph. Here, the first causality index further includes a drift coefficient, used to characterize the degree of stability decay of the current local causality model relative to the historical baseline state, wherein it is determined by at least one of the following methods:

[0104] Drift detection based on graph structure differences: By calculating the graph edit distance between the updated local causal graph and the historical local causal graph, the structural changes such as the addition, deletion, and reversal of causal edges are quantified to obtain the drift coefficient;

[0105] Drift detection based on distribution differences: By monitoring the KL divergence of the conditional probability distributions between variables, the statistical characteristics of local correlations are identified, thereby obtaining the drift coefficient.

[0106] In some possible embodiments, when the confidence and stability of the causal path decrease, local reconstruction and parameter regression are triggered. Specifically, when the change in the confidence and stability of the causal path is detected to be higher than a first preset threshold, or the confidence and stability of the causal path is lower than a second preset threshold, the subgraph involved in the path is relearned, for example, by deleting low-confidence edges and adding new potential related edges.

[0107] The corresponding edge intelligence engine is also used to upload the updated local causal graph and the updated first causal relationship index to the central node. The edge intelligence engine performs incremental update processing on the received updated local causal graph and the corresponding first causal relationship index, and compresses them through a high compression algorithm to obtain updated summary information. This avoids the repeated transmission of the original data and is a key technical link in building a low-latency, high-efficiency edge collaborative system.

[0108] Furthermore, after receiving the updated local causal graph and the updated first causal relationship index uploaded by each edge node, the central node is also used to update the global causal graph based on the updated local causal graph and the updated first causal relationship index, update the second causal relationship index based on the causal relationship between each variable in the updated global causal graph, compare the updated second causal relationship index with each of the first causal relationship indices respectively, generate a correction factor for each edge node based on the comparison result, and send the correction factor to each edge node to instruct the edge node to update the local causal graph based on the correction factor.

[0109] The process of updating the global causal graph based on the updated local causal graph and the updated first causal relationship index is the same as the process of generating the global causal graph. Both require the collaboration of the federated collaboration module and the central knowledge engine, and will not be elaborated further here.

[0110] Similarly, the steps for each edge node to update the local causal graph based on the correction factor issued by the central node are the same as the steps for updating the local causal graph described above, and will not be repeated here.

[0111] This application effectively overcomes the limitations of existing technologies where edge devices can only passively collect data and lack intelligent analysis capabilities by endowing edge nodes with autonomous causal computation and optimization capabilities. By deploying an edge intelligence engine on the edge side, edge nodes are equipped with local data processing, causal structure learning, and adaptive optimization capabilities, thereby fully utilizing the computing resources at the edge and significantly improving the overall autonomy, real-time performance, and response efficiency of the system.

[0112] In this embodiment, the edge node further includes a first root cause determination module, which is used to determine the target data corresponding to the abnormal data based on the updated local causal graph after detecting abnormal data in the edge terminal.

[0113] Optionally, determining the target data corresponding to the abnormal data based on the updated local causal graph includes:

[0114] Locate the variable node corresponding to the abnormal data in the local cause-effect graph;

[0115] Backtrack along the upstream path of the variable node in the local causal graph to identify variable nodes that have a significant causal impact on it;

[0116] Based on the first causal relationship index, one or more root cause data that caused the abnormal data are identified from the upstream variable nodes as target data.

[0117] Through the first root cause determination module of the aforementioned edge nodes, the entire process from data cleaning and causal analysis to root cause localization is completed on the edge side close to the data source, thereby significantly reducing the dependence on the cloud center and data transmission, and improving the system's real-time performance, autonomy, and privacy security.

[0118] In some possible embodiments, the first root cause determination module is further configured to upload the abnormal data to the central node when abnormal data is detected in the edge terminal and the target data corresponding to the abnormal data is not determined based on the updated local causal graph, so that the central node can determine the target data corresponding to the abnormal data based on the global causal graph generated by fusing the local causal graph by the first causal relationship index.

[0119] Correspondingly, the central node, such as Figure 4As shown, it also includes a second root cause determination module 303, which is used to receive abnormal data uploaded by each edge node when it detects abnormal data in the edge terminal and fails to determine the target data corresponding to the abnormal data based on the updated local causal graph, and to determine the target data corresponding to the abnormal data based on the global causal graph.

[0120] The second root cause determination module described above in this application effectively solves the problem of local root cause location failure caused by the limited information of edge nodes (such as systemic failures across devices or regions), thereby ensuring the completeness and reliability of root cause analysis in complex failure scenarios.

[0121] In some possible embodiments, the system, such as Figure 5 As shown, it also includes a result interpretation and enhancement module 103, used for:

[0122] The local causal graph and the first causal relationship index are input into a pre-trained semantic model and transformed into natural language text output; and based on the output natural language text, a corresponding visualization report is generated, the visualization report including some or all of the predefined key causal relationships, the first causal relationship index, and the changing trend of the local causal graph.

[0123] The global causal graph and the second causal relationship index are input into a pre-trained semantic model and transformed into natural language text output; and based on the output natural language text, a corresponding visualization report is generated, which includes some or all of the predefined key causal relationships, the second causal relationship index, and the changing trend of the global causal graph.

[0124] Furthermore, the result interpretation and enhancement module 103 is also used to respond to user feedback information, obtain user intent based on the built-in semantic extraction model, and send the user intent to the central node, so that the central knowledge engine of the central node updates the current global causal graph based on the user intent, generates correction factors for each edge node, and distributes the correction factors to each edge node, so that the edge node updates the local causal graph based on the correction factors.

[0125] Through the result interpretation and enhancement module and the central knowledge engine of the central node, this feedback information is transformed into executable correction factors, enabling multi-dimensional adaptive fine-tuning and continuous optimization of the global causal graph, thereby achieving dynamic alignment between the causal model and the real business logic.

[0126] The following describes a process for updating the local and global causal graphs based on the causal analysis-based root cause determination system after satisfying preset causal relationship update conditions. Figure 6 As shown, it includes:

[0127] Step S601: After preprocessing the raw data collected from the edge terminal to obtain structured data blocks through the data stream access module of the edge node, a logical sequence number is assigned to the structured data blocks.

[0128] Step S602: Through the local causal discovery module of the edge node, after satisfying the preset causal relationship update conditions, a preset number of structured data blocks are selected based on the logical sequence number, and the local causal graph is updated based on the structured data blocks; based on the causal relationship between each variable in the updated local causal graph, the first causal relationship index is updated.

[0129] Step S603: Upload the updated local causal graph and the updated first causal relationship index to the central node through the edge intelligence engine of the edge node;

[0130] Step S604: Receive the updated local causal graph and the updated first causal relationship index uploaded by each edge node through the federated collaboration module of the central node.

[0131] Step S605: Through the central knowledge engine of the central node, based on the updated local causal graph and the updated first causal relationship index, update the global causal graph, and based on the causal relationship between each variable in the updated global causal graph, update the second causal relationship index, and compare the updated second causal relationship index with each of the first causal relationship indices respectively, and generate correction factors for each edge node based on the comparison results.

[0132] Step S606: The correction factor is distributed to each edge node through the federated collaboration module of the central node, so as to instruct the edge nodes to update the local causal graph based on the correction factor.

[0133] Step S607: The local causal graph is updated by the edge intelligence engine of the edge node according to the correction factor issued by the federated collaboration module of the central node.

[0134] The root cause determination system based on causal analysis described in this application embodiment establishes a two-layer collaborative architecture of an "edge intelligence engine" and a "central knowledge engine," organically combining distributed causal attribution with global self-learning optimization. It employs an event-driven incremental causal evolution mechanism, enabling real-time adjustment of local and / or global causal graphs based on drift coefficient detection, ensuring model timeliness. Furthermore, a federated collaboration module and a central knowledge engine are deployed at the central node, balancing global consistency and local autonomy when aggregating heterogeneous causal models across nodes. By uploading only summary parameters, bandwidth consumption is reduced while ensuring local data security. Simultaneously, a result interpretation and enhancement module is deployed at the central node, capable of outputting visual reports and transforming user feedback into actionable correction factors for continuous optimization.

[0135] Based on the same inventive concept, embodiments of this application propose a root cause determination method based on causal analysis, applied to the aforementioned edge nodes, such as... Figure 7 As shown, it includes:

[0136] Step S701: After preprocessing the raw data collected from the edge terminal to obtain structured data blocks, a logical sequence number is assigned to the structured data blocks.

[0137] Step S702: After satisfying the preset causal relationship generation conditions, a preset number of structured data blocks are selected based on the logical sequence number, and a local causal graph is generated based on the structured data blocks. Based on the causal relationship between each variable in the local causal graph, the first causal relationship index corresponding to the local causal graph is determined.

[0138] Step S703: Upload the local causal graph and the first causal relationship index to the central node, and update the local causal graph according to the correction factor issued by the central node, wherein the correction factor is generated by the central node based on the local causal graph and the first causal relationship index.

[0139] Step S704: After detecting abnormal data in the edge terminal, determine the target data corresponding to the abnormal data based on the updated local causal graph.

[0140] In some possible embodiments, the method further includes:

[0141] After satisfying the preset causal relationship update conditions, a preset number of structured data blocks are selected based on the logical sequence number, and the local causal graph is updated based on the structured data blocks;

[0142] Based on the causal relationships between variables in the updated local causal graph, the first causal relationship index is updated.

[0143] The updated local causal graph and the updated first causal relationship index are uploaded to the central node, and the local causal graph is updated according to the correction factor issued by the central node.

[0144] In some possible embodiments, the method further includes:

[0145] The local causal graph and the first causal relationship index are input into a pre-trained semantic model and converted into natural language text output.

[0146] Based on the output natural language text, a corresponding visualization report is generated. The visualization report includes some or all of the predefined key causal relationships, first causal relationship indicators, and the changing trends of the local causal graph.

[0147] In some possible embodiments, the method further includes:

[0148] When abnormal data is detected in the edge terminal and the target data corresponding to the abnormal data cannot be determined based on the updated local causal graph, the abnormal data is uploaded to the central node so that the central node can determine the target data corresponding to the abnormal data based on the global causal graph generated by fusing the local causal graph using the first causal relationship index.

[0149] Based on the same inventive concept, embodiments of this application propose a root cause determination method based on causal analysis, applied to the aforementioned central node, such as... Figure 8 As shown, it includes:

[0150] Step S801: Receive the local causal graph uploaded by each edge node and the first causal relationship index corresponding to the local causal graph;

[0151] Step S802: Based on the first causal relationship index, the local causal graph is fused to generate a global causal graph, and based on the causal relationship between each variable in the global causal graph, the second causal relationship index corresponding to the global causal graph is determined.

[0152] Step S803: Compare the second causal relationship index with each of the first causal relationship indices respectively, and generate a correction factor for each edge node based on the comparison results.

[0153] Step S804: The correction factor is sent to each edge node to instruct the edge node to update the local causal graph based on the correction factor, and after detecting abnormal data in the edge terminal, the target data corresponding to the abnormal data is determined based on the updated local causal graph.

[0154] In some possible embodiments, the method further includes:

[0155] Receive the updated local causal graph and the updated first causal relationship index uploaded by each edge node;

[0156] Based on the updated local causal graph and the updated first causal relationship index, the global causal graph is updated, and based on the causal relationships between variables in the updated global causal graph, the second causal relationship index is updated.

[0157] The updated second causal relationship index is compared with each of the first causal relationship indices, and a correction factor for each edge node is generated based on the comparison results.

[0158] The correction factor is distributed to each edge node to instruct the edge node to update the local causal graph based on the correction factor.

[0159] In some possible embodiments, the method further includes:

[0160] The global causal graph and the second causal relationship index are input into a pre-trained semantic model and converted into natural language text output.

[0161] Based on the output natural language text, a corresponding visualization report is generated. The visualization report includes some or all of the predefined key causal relationships, second causal relationship indicators, and the changing trends of the global causal graph.

[0162] In some possible embodiments, the method further includes:

[0163] The system receives abnormal data uploaded by each edge node when it detects abnormal data in the edge terminal and fails to determine the target data corresponding to the abnormal data based on the updated local causal graph, and determines the target data corresponding to the abnormal data based on the global causal graph.

[0164] The root cause determination method based on causal analysis described above in the embodiments of this application significantly improves the real-time performance, accuracy, and interpretability of causal analysis in complex dynamic scenarios.

[0165] Based on the same inventive concept, embodiments of this application propose an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform a root cause determination method based on causal analysis as described in any of the second or third aspects of the above embodiments.

[0166] The following reference Figure 9This application describes an electronic device 900 according to one embodiment of the present application. Figure 9 The device 900 shown is merely an example and should not be construed as limiting the functionality or scope of the embodiments in this application.

[0167] like Figure 9 As shown, an electronic device 900 is presented in the form of a general-purpose electronic device. The components of an electronic device 900 may include, but are not limited to: at least one processor 901, at least one memory 902, and a bus 903 connecting different system components (including memory 902 and processor 901).

[0168] Bus 903 represents one or more of several bus architectures, including a memory bus or memory controller, peripheral bus, processor, or local bus using any of the various bus architectures.

[0169] The memory 902 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 9021 and / or cache memory 9022, and may further include read-only memory (ROM) 9023.

[0170] The memory 902 may also include a program / utility 9025 having a set (at least one) of program modules 9024, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0171] An electronic device 900 can also communicate with one or more external devices 904 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with the electronic device 900, and / or with any device that enables the electronic device 900 to communicate with one or more other electronic devices (e.g., router, modem, etc.). This communication can be performed via an input / output (I / O) interface 905. Furthermore, the electronic device 900 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via a network adapter 906. As shown, the network adapter 906 communicates with other modules used in the smart whiteboard 900 via a bus 903. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the smart whiteboard 900, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0172] Based on the same inventive concept, embodiments of this application provide a computer-readable storage medium storing a computer program. The computer program includes program instructions, which, when executed by a computer, cause the computer to perform a root cause determination method based on causal analysis as described in any of the second or third aspects discussed above. Since the principle by which the above-described computer-readable storage medium solves the problem is similar to the root cause determination method based on causal analysis described in any of the second or third aspects of the above embodiments, the implementation of the above-described computer-readable storage medium can refer to the implementation of the method; repeated details will not be elaborated further.

[0173] The root cause determination system, method, electronic device, and storage medium based on causal analysis described in this application not only ensure the system's real-time response and autonomy at the edge, but also maximize privacy and security through localized data processing, achieving efficient and accurate distributed root cause localization.

[0174] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0175] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0176] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0177] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0178] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A root cause determination method based on causal analysis, characterized in that, Applied to edge nodes, including: After preprocessing the raw data collected from the edge terminal to obtain structured data blocks, logical sequence numbers are assigned to the structured data blocks; After satisfying the preset causal relationship generation conditions, a preset number of structured data blocks are selected based on the logical sequence number, and a local causal graph is generated based on the structured data blocks. Based on the causal relationship between each variable in the local causal graph, the first causal relationship index corresponding to the local causal graph is determined. The local causal graph and the first causal relationship index are uploaded to the central node, and the local causal graph is updated according to the correction factor issued by the central node, wherein the correction factor is generated by the central node based on the local causal graph and the first causal relationship index. After detecting abnormal data in the edge terminal, the target data corresponding to the abnormal data is determined based on the updated local causal graph.

2. The method according to claim 1, characterized in that, The method further includes: After satisfying the preset causal relationship update conditions, a preset number of structured data blocks are selected based on the logical sequence number, and the local causal graph is updated based on the structured data blocks; Based on the causal relationships between variables in the updated local causal graph, the first causal relationship index is updated. The updated local causal graph and the updated first causal relationship index are uploaded to the central node, and the local causal graph is updated according to the correction factor issued by the central node.

3. The method according to claim 1, characterized in that, The method further includes: The local causal graph and the first causal relationship index are input into a pre-trained semantic model and converted into natural language text output. Based on the output natural language text, a corresponding visualization report is generated. The visualization report includes some or all of the predefined key causal relationships, first causal relationship indicators, and the changing trends of the local causal graph.

4. The method according to claim 1, characterized in that, The method further includes: When abnormal data is detected in the edge terminal and the target data corresponding to the abnormal data cannot be determined based on the updated local causal graph, the abnormal data is uploaded to the central node so that the central node can determine the target data corresponding to the abnormal data based on the global causal graph generated by fusing the local causal graph using the first causal relationship index.

5. A root cause determination method based on causal analysis, characterized in that, Applied to the central node, including: Receive the local causal graphs uploaded by each edge node and the first causal relationship index corresponding to the local causal graphs; The local causal graph is fused based on the first causal relationship index to generate a global causal graph, and the second causal relationship index corresponding to the global causal graph is determined based on the causal relationship between each variable in the global causal graph. The second causal relationship index is compared with each of the first causal relationship indices, and a correction factor for each edge node is generated based on the comparison results. The correction factor is distributed to each edge node to instruct the edge node to update the local causal graph based on the correction factor, and after detecting abnormal data in the edge terminal, the target data corresponding to the abnormal data is determined based on the updated local causal graph.

6. The method according to claim 5, characterized in that, The method further includes: Receive the updated local causal graph and the updated first causal relationship index uploaded by each edge node; Based on the updated local causal graph and the updated first causal relationship index, the global causal graph is updated, and based on the causal relationships between variables in the updated global causal graph, the second causal relationship index is updated. The updated second causal relationship index is compared with each of the first causal relationship indices, and a correction factor for each edge node is generated based on the comparison results. The correction factor is distributed to each edge node to instruct the edge node to update the local causal graph based on the correction factor.

7. The method according to claim 5, characterized in that, The method further includes: The global causal graph and the second causal relationship index are input into a pre-trained semantic model and converted into natural language text output. Based on the output natural language text, a corresponding visualization report is generated. The visualization report includes some or all of the predefined key causal relationships, second causal relationship indicators, and the changing trends of the global causal graph.

8. The method according to claim 5, characterized in that, The method further includes: The system receives abnormal data uploaded by each edge node when it detects abnormal data in the edge terminal and fails to determine the target data corresponding to the abnormal data based on the updated local causal graph, and determines the target data corresponding to the abnormal data based on the global causal graph.

9. A root cause determination system based on causal analysis, characterized in that, Including edge nodes and center nodes, where: The edge node is used to preprocess the raw data collected from the edge terminal to obtain structured data blocks, and then assign logical numbers to the structured data blocks; after satisfying preset causal relationship generation conditions, it selects a preset number of structured data blocks based on the logical numbers, and generates a local causal graph based on the structured data blocks, and determines a first causal relationship index corresponding to the local causal graph based on the causal relationships between various variables in the local causal graph; it uploads the local causal graph and the first causal relationship index to the central node, and updates the local causal graph according to the correction factor issued by the central node, wherein the correction factor is generated by the central node based on the local causal graph and the first causal relationship index; after detecting abnormal data in the edge terminal, it determines the target data corresponding to the abnormal data based on the updated local causal graph; The central node is configured to receive local causal graphs and corresponding first causal relationship indicators uploaded by each edge node; fuse the local causal graphs based on the first causal relationship indicators to generate a global causal graph; and determine a second causal relationship indicator corresponding to the global causal graph based on the causal relationships between variables in the global causal graph; compare the second causal relationship indicator with each of the first causal relationship indicators respectively, and generate a correction factor for each edge node based on the comparison results; and distribute the correction factor to each edge node to instruct the edge node to update the local causal graph based on the correction factor, and, upon detecting abnormal data in the edge terminal, determine the target data corresponding to the abnormal data based on the updated local causal graph.

10. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps in a root cause determination method based on causal analysis as described in any one of claims 1 to 4 or claims 5 to 8.

Images