Internet of Things instruction fault positioning method and system

Abstract

The invention relates to the field of Internet of Things operation and maintenance, and provides an Internet of Things instruction fault positioning method and system. The method comprises the steps of performing semantic analysis on log data generated by a plurality of nodes in an Internet of Things system, extracting instruction feature parameters, converting the instruction feature parameters into a standardized instruction word sequence, and generating an instruction word set; according to instruction relevance between upstream and downstream nodes in the time window, an instruction conversion relation model is established, and a rule knowledge base is obtained; performing statistical quantization on the instruction word set based on the global vocabulary, and performing normalization processing to generate an actual vector representing a plurality of node instruction distribution characteristics; inputting the actual vector of the upstream node and the rule knowledge base into a dynamic frequency correction algorithm, and calculating to obtain an expected vector of the downstream node; and calculating the similarity between the expected vectors and the actual vectors of the plurality of nodes, and when the similarity is lower than a preset threshold, determining an abnormal link in combination with a system topological relation, and positioning a fault node. The positioning efficiency is improved, and implementation is convenient.

Description

Technical Field

[0001] This invention belongs to the field of IoT operation and maintenance technology, and in particular relates to a method and system for locating IoT command faults. Background Technology

[0002] With the rapid development and widespread application of IoT technology, IoT platforms generally adopt a microservice architecture to implement device control and data management. In a typical IoT system, a device control command, from user initiation to final arrival at the device, requires the collaborative processing of multiple microservice nodes, including business services, command components, message queues, and gateway services. The entire command delivery chain is long, involves many stages, and has a complex architecture. During transmission, commands often undergo various transformations such as format conversion, parameter escaping, command splitting, and broadcast transmission. For example, platform commands need to be converted into device commands, decimal parameters need to be escaped into hexadecimal format, and a single command may be split into multiple sub-commands. This complex multi-node collaborative processing mechanism places extremely high demands on the system's reliability and maintainability.

[0003] In existing technologies, fault location in IoT systems primarily relies on traditional TraceID tracing schemes and manual log inspection methods. The TraceID scheme requires pre-embedding tracing identifiers in the business code and cannot effectively handle scenarios where command content changes. When commands undergo format conversion or splitting, TraceID often fails to continue tracing, leading to tracing chain interruptions and creating tracing blind spots. Manual log inspection methods require operations personnel to check logs at each service node layer by layer, resulting in extremely low efficiency and heavy reliance on the experience of senior operations personnel, with average fault location time often reaching hours. More seriously, existing log analysis tools generally lack semantic association capabilities, failing to automatically identify and understand the conversion rules of commands between different nodes, making it difficult to detect hidden faults such as silent command failures, and hindering accurate fault location from the service level to the link level. Summary of the Invention

[0004] In view of the shortcomings of the prior art, the purpose of the invention is to provide a method and system for locating IoT command faults.

[0005] This invention provides a method for locating IoT command faults, comprising:

[0006] S1: Perform semantic parsing on log data generated by multiple nodes in the IoT system, extract instruction feature parameters, convert them into standardized instruction word sequences, and generate an instruction word set;

[0007] S2: Based on the instruction correlation between upstream and downstream nodes within the time window, establish an instruction conversion relationship model and obtain a rule knowledge base describing the instruction conversion rules between nodes;

[0008] S3: Statistically quantify the instruction word set based on the global vocabulary, and generate an actual vector representing the distribution characteristics of multiple node instructions through normalization processing;

[0009] S4: Input the actual vector of the upstream node and the rule knowledge base into the dynamic frequency correction algorithm to calculate the expected vector of the downstream node;

[0010] S5: Calculate the similarity between the expected vectors and actual vectors of multiple nodes. When the similarity is lower than a preset threshold, determine the abnormal link and locate the faulty node by combining the system topology relationship.

[0011] According to the IoT command fault location method provided by the present invention, step S1 further includes:

[0012] S11: Extract tenant and device identifiers from the collected log data to form instruction identity information;

[0013] S12: Parse the command action and command parameters from the log data, wherein the command parameters are represented in key-value pairs;

[0014] S13: Combine the instruction identity information, the instruction action, and the instruction parameters into an instruction word sequence, and multiple instruction word sequences constitute the instruction word set of the corresponding node.

[0015] According to the IoT command fault location method provided by the present invention, step S2 further includes:

[0016] S21: For each input instruction of the input node, collect all output instructions of the output node within a preset time window;

[0017] S22: Based on the frequency statistics of input and output instructions within a preset time window, construct frequency vectors for upstream and downstream instructions. Through device identifier matching, parameter matching, similarity calculation, and frequency vector correlation analysis, determine the degree of correlation between output and input instructions.

[0018] S23: Identify the instruction relationship based on the degree of association and frequency vector mapping relationship;

[0019] S24: Store the identified instruction relationships in the rule knowledge base and mark the root identifier of the original instruction in the derived instructions.

[0020] According to the IoT command fault location method provided by the present invention, step S23 specifically includes:

[0021] When the key parameters of the output command differ from those of the input command in terms of format or numerical expression, they are identified as parameter escaping relationships, and the mapping rules before and after escaping are recorded.

[0022] When the parameters of an input instruction are split into multiple output instructions, the splitting relationship is identified and the splitting ratio coefficient is recorded.

[0023] According to the IoT command fault location method provided by the present invention, step S3 further includes:

[0024] S31: Construct a global vocabulary containing all instruction words and assign a unique index to each instruction word;

[0025] S32: For a set of instruction words from multiple nodes within a specified time window, create an initial vector of the same length as the global vocabulary;

[0026] S33: Traverse multiple instruction words in the instruction word set, and accumulate the count value at the corresponding position of the initial vector according to the unique index to obtain the accumulated vector;

[0027] S34: Perform L2 norm normalization on the accumulated vector to obtain the actual vector of each node.

[0028] According to the IoT command fault location method provided by the present invention, step S4 further includes:

[0029] S41: Extract instruction conversion rules from upstream nodes to downstream nodes from the rule knowledge base, wherein the instruction conversion rules include condition information and scaling factor;

[0030] S42: Based on the dynamic frequency correction algorithm, the vector dimension values ​​corresponding to the instruction words that meet the conditions are selected from the actual vector of the upstream node according to the condition information. The selected dimension values ​​are multiplied by the scaling factor to obtain the value of the corresponding part in the expected vector of the downstream node.

[0031] S43: Based on the parameter escaping relationship in the rule knowledge base, map the dimension value corresponding to the source parameter in the actual vector of the upstream node to the dimension corresponding to the target parameter in the expected vector of the downstream node, and set the dimension value corresponding to the source parameter to 0 at the same time.

[0032] S44: Integrate the results of all transformation rules, perform L2 norm normalization on the expected vector of downstream nodes, and generate the final expected vector.

[0033] According to the IoT command fault location method provided by the present invention, the scaling factor in step S41 is determined according to the command conversion type, specifically including:

[0034] When the conversion type is instruction splitting, the scaling factor is the ratio of the number of instructions after splitting to the number of instructions before splitting;

[0035] When the conversion type is command broadcast, the scaling factor is the number of target devices for the broadcast;

[0036] When the conversion type is instruction aggregation, the scaling factor is the reciprocal of the ratio of the number of instructions before aggregation to the number of instructions after aggregation.

[0037] According to the IoT command fault location method provided by the present invention, step S5 further includes:

[0038] S51: The cosine similarity algorithm is used to calculate the similarity value between the expected vector and the actual vector of multiple nodes;

[0039] S52: Starting from the starting node of the system topology, check multiple links sequentially along the instruction flow. Based on the actual vector of the upstream node, generate the expected vector of the downstream node through a dynamic frequency correction algorithm, compare the expected vector with the actual vector of the downstream node, calculate the similarity value of the link, and identify the first link with a similarity value lower than the preset threshold as an abnormal link.

[0040] S53: Determine whether the upstream node of the abnormal link is healthy. If the similarity value of the upstream node is higher than the preset threshold, it is determined that the fault occurred in the output stage of the upstream node or the transmission link between the upstream and downstream nodes. If the similarity value of the upstream node is lower than the preset threshold, continue to trace upstream of the topology until the link with healthy upstream and abnormal downstream is located and determined as the faulty link.

[0041] According to the IoT command fault location method provided by the present invention, after step S53, the method further includes:

[0042] A diagnostic report is generated, which includes fault link identifier, fault node identifier, similarity value supporting the conclusion, identifier of the instruction root involved, time window information, and confidence score calculated based on the degree of similarity deviation.

[0043] The present invention also provides an Internet of Things (IoT) command fault location system, comprising:

[0044] Parsing module: Used to perform semantic parsing on log data generated by multiple nodes in the IoT system, extract instruction feature parameters and convert them into standardized instruction word sequences to generate instruction word sets;

[0045] The module is used to establish an instruction conversion relationship model based on the instruction correlation between upstream and downstream nodes within a time window, and to obtain a rule knowledge base describing the instruction conversion rules between nodes.

[0046] Quantization module: used to perform statistical quantization on the instruction word set based on the global vocabulary, and generate an actual vector representing the distribution characteristics of instructions from multiple nodes through normalization processing;

[0047] Correction module: used to dynamically correct the actual vector of the upstream node with the rule knowledge base, and calculate the expected vector of the downstream node;

[0048] The localization module is used to calculate the similarity between the expected vectors and the actual vectors of multiple nodes. When the similarity is lower than a preset threshold, it determines the abnormal link and locates the faulty node by combining the system topology.

[0049] A third aspect of the present invention also provides an Internet of Things (IoT) command fault location device, wherein the computer device includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement an IoT command fault location method as described in any of the above claims.

[0050] A fourth aspect of the present invention also provides a readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, implement an Internet of Things instruction fault location method as described in any of the preceding claims.

[0051] This invention first performs semantic parsing and instruction wordization on multi-node log data in an IoT system. It then establishes a conversion rule model based on instruction correlation analysis within a time window, generates normalized actual vectors based on a global vocabulary, calculates the expected vector using a dynamic frequency correction algorithm, and finally achieves fault location through vector similarity comparison and topological relationship analysis. This completely eliminates the dependence on TraceID and can be implemented without modifying any business code. It solves the problem of tracing link interruption that occurs when traditional tracing solutions involve changes in instruction content such as conversion, splitting, and escaping, achieving full-coverage monitoring of any technology stack system, including legacy systems. This invention automatically identifies conversion rules such as instruction splitting, broadcasting, and escaping, and quantifies these rules into scaling factors and mapping relationships stored in a rule knowledge base. This gives the system self-learning and reasoning capabilities, enabling it to automatically understand complex business logic and discover hidden faults such as silent instruction failures that traditional manual troubleshooting methods cannot detect. This upgrades the operation and maintenance mode from manual, layer-by-layer troubleshooting to intelligent automatic diagnosis. Especially in the context of command broadcasting in mesh networks, traditional tracing methods are difficult to apply because broadcast commands pass through multiple nodes and have unpredictable paths. This invention, however, establishes a vector space mathematical model of expected and actual behavior. By comparing the model deviations, it can intelligently infer the node range or path range where the fault is most likely to occur, greatly improving the efficiency of fault diagnosis in complex network topologies. Simultaneously, this invention improves fault location accuracy from fuzzy service-level precision to specific node or link level, clearly distinguishing whether the fault occurs in the output stage of a node or in the transmission link between nodes. It can even determine whether it is "not sent" or "not received," directly guiding maintenance personnel to perform targeted repairs. This reduces the average fault location time from hours to minutes, significantly reducing reliance on experienced maintenance personnel, saving enterprises significant manpower and time costs, avoiding economic losses caused by prolonged system downtime, and significantly improving user experience by increasing command issuance success rate and problem response speed. Attached Figure Description

[0052] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. It is obvious that the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings.

[0053] Figure 1 This is a schematic flowchart of an IoT command fault location method provided in an embodiment of the present invention;

[0054] Figure 2 This is a schematic diagram of an IoT command fault location system provided in an embodiment of the present invention. Detailed Implementation

[0055] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0056] Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts disclosed in this invention.

[0057] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0058] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of methods and systems consistent with some aspects of the invention as detailed in the appended claims.

[0059] To better understand this invention, the technical terms appearing in the embodiments of this invention will be explained in detail below.

[0060] Command tokenization: refers to the standard process of parsing and extracting unstructured log data generated by each node during the issuance of IoT commands into [key name: key value] pairs with a uniform format. For example, the JSON log {"method":"setBrightness", "params":{"highBright":80}} is extracted into [method:setBrightness, highBright:80].

[0061] Command conversion rules refer to the business logic followed when the content, quantity, or form of a command changes between nodes during the command issuance process. This includes, but is not limited to, splitting (one command becomes multiple commands), broadcasting (one command is sent to multiple devices), and escaping (parameters change from 80 to 0x50).

[0062] Dynamic Frequency Correction (DFC) algorithm: This is the core algorithm of this invention. It refers to a method that uses existing instruction conversion rules to convert the instruction feature vector of the upstream node into the expected instruction feature vector of the downstream node, thereby eliminating systematic deviations caused by normal business logic.

[0063] Instruction Actual Vector: This refers to a numerical vector that quantifies the characteristic distribution of instructions processed by a node within a time window. Each dimension of the vector represents the frequency of occurrence of a specific instruction word (usually after normalization).

[0064] Expected vector (V_expected) and actual vector (V_actual): V_actual refers to the feature vector generated by the actual instructions processed by the statistical node; V_expected refers to the feature vector that the node "should" exhibit under normal circumstances, calculated by the DFC algorithm.

[0065] The embodiments of the present invention are described below with reference to the figures.

[0066] like Figure 1 As shown, the present invention provides a method for locating IoT command faults, comprising:

[0067] S1: Perform semantic parsing on log data generated by multiple nodes in the IoT system, extract instruction feature parameters, convert them into standardized instruction word sequences, and generate an instruction word set.

[0068] Step S1 further includes:

[0069] S11: Extract tenant and device identifiers from the collected log data to form instruction identity information.

[0070] In step S11, the present invention first parses standard JSON format log data collected from the IoT platform. This log data contains various fields describing the instruction transmission process. The present invention locates the tenant identifier and device identifier fields by parsing the JSON structure. Specifically, the present invention extracts the "tenantId" field value from the log as the tenant identifier and the "deviceId" field value as the device identifier. The two identifiers together constitute the instruction identity information, used to uniquely identify the tenant to which the instruction belongs and the target device. Finally, the instruction identity information obtained in step S11 establishes the association between the instruction and the specific business entity, providing basic data support for subsequent instruction association analysis.

[0071] S12: Parse the instruction action and instruction parameters from the log data, wherein the instruction parameters are represented in key-value pairs.

[0072] In step S12, the present invention continues to extract the functional information of the instruction from the same log data. Specifically, it first locates the "method" field, which describes the specific action to be performed by the instruction. For example, "setBrightness" indicates the action of setting brightness, and "getSetting" indicates the action of obtaining settings. Subsequently, the present invention parses the "params" field or other fields containing parameters to extract all parameter information carried by the instruction. Each parameter exists in the form of a key-value pair, where the key name indicates the parameter type and the key value indicates the specific value of the parameter. The present invention maintains the original format of the parameter key-value pairs to ensure the integrity and accuracy of the parameter information.

[0073] S13: Combine the instruction identity information, the instruction action, and the instruction parameters into an instruction word sequence, and multiple instruction word sequences constitute the instruction word set of the corresponding node.

[0074] Specifically, in step S13, the present invention concatenates the tenant identifier and device identifier obtained in step S11, and the instruction action and instruction parameters obtained in step S12, according to the standard format of "[key name:key value]" to form an instruction word sequence. For multiple instructions processed by the same node within a specific time period, the present invention summarizes the instruction word sequence corresponding to each instruction to form the instruction word set of that node.

[0075] Before executing step S2, there is also an instruction lifecycle analysis step. Specifically, the final node log of the instruction is queried according to the root identifier of the instruction to determine whether the instruction is completed; if the instruction is not completed and the difference between the timestamp of the first instruction and the current timestamp exceeds the preset timeout time, the instruction is determined to have timed out; when the instruction is completed or timed out, all node logs associated with the root identifier are extracted, and the spatiotemporal association relationship of the instruction in each node is established according to the node topology relationship.

[0076] S2: Based on the instruction correlation between upstream and downstream nodes within the time window, establish an instruction conversion relationship model and obtain a rule knowledge base describing the instruction conversion rules between nodes.

[0077] Step S2 further includes:

[0078] S21: For each input instruction of the input node, collect all output instructions of the output node within a preset time window.

[0079] In step S21, the present invention aims to establish an input-output relationship for each node pair in the instruction transmission link. Specifically, for each input instruction processed by the upstream node acting as an input node, the present invention records the timestamp of the instruction. Subsequently, within a preset time window after the timestamp, such as a 5-second time window, it continuously monitors all log data generated by the downstream node acting as an output node. Following this, the present invention extracts the instruction word sequence of all output instructions from the downstream node logs to form a candidate output instruction set. The time window setting is based on the typical delay of instruction transmission between nodes, ensuring that all derived output instructions generated by the input instruction can be captured.

[0080] S22: Based on the frequency statistics of input and output instructions within a preset time window, construct frequency vectors for upstream and downstream instructions. Through device identifier matching, parameter matching, similarity calculation, and frequency vector correlation analysis, determine the degree of correlation between output and input instructions.

[0081] Furthermore, in step S22, this invention introduces word frequency statistics and frequency vector analysis within a time window to address the matching failure problem caused by changes in upstream and downstream command words and parameter formats. Specifically, this invention first performs word frequency statistics on input commands at input nodes and output commands at output nodes within a preset time window, converting the statistical results into a standardized frequency vector. This vector accurately represents the distribution characteristics and association tendencies of commands within the time dimension. Subsequently, through frequency vector correlation analysis, the limitations of differences in the literal form of commands can be overcome. For example, when the upstream issues multiple "scan" commands (parameter 0001), and the downstream issues multiple "startScan" commands (parameter 1), the frequency vectors of the two within the time window show a significant mapping pattern. Combined with device identifier matching, parameter matching, and similarity calculation results, the degree of association between the two can be accurately quantified, avoiding misjudgments of association caused by changes in command naming and parameter formats, and providing a reliable basis for subsequent command relationship identification.

[0082] S23: Identify instruction relationships based on the degree of association and frequency vector mapping relationship.

[0083] Specifically, step S23 includes:

[0084] When the key parameters of the output command differ from those of the input command in terms of format or numerical expression, it is identified as a parameter escaping relationship, and the mapping rules before and after escaping are recorded; when the parameters of the input command are split into multiple output commands, it is identified as a command splitting relationship, and the splitting ratio coefficient is recorded.

[0085] In step S23, the present invention classifies and identifies instruction relationships based on the correlation degree calculated in step S22. When the device identifiers of the output instruction and the input instruction completely match and the parameters have different formats, for example, the input instruction parameter is "highBright:80" and the output instruction parameter is "brightness:0x50", the present invention identifies the hexadecimal representation of the value 80 as 0x50, determines that there is a decimal to hexadecimal escape relationship between the two, and records the mapping rule from "highBright:80" to "brightness:0x50"; when the input instruction contains multiple parameters, and multiple output instructions each contain only part of the parameters of the input instruction, the present invention identifies it as an instruction splitting relationship, and calculates the ratio of the number of output instructions to the number of input instructions as the splitting ratio coefficient; when a single input instruction corresponds to the output instructions of multiple different devices, the present invention identifies it as an instruction broadcasting relationship, and records the number of broadcast target devices as the broadcasting coefficient.

[0086] Furthermore, in step S23, based on the correlation assessment, this invention also combines frequency vector mapping to complete instruction relationship identification, especially adapting to correlation determination in scenarios with changes in instruction words and parameter formats. When there are naming differences between upstream and downstream instructions (such as "scan" and "startScan") or parameter format / value conversions (such as parameter 0001 and 1), if the frequency vectors of the two show a strong correlation within the time window, and the consistency of their attribution is verified through device identification and parameter features, then it can be determined that there is a valid instruction association between the two, and then the parameter change features are combined to identify it as a parameter escaping relationship. For instruction pairs without obvious literal association but with highly consistent frequency distributions, the frequency vector mapping relationship can be used to explore their potential derived associations, ensuring the comprehensiveness and accuracy of instruction relationship identification, while accumulating non-mechanical matching instruction conversion rules for the rule knowledge base, improving the adaptability of subsequent fault location.

[0087] S24: Store the identified instruction relationships in the rule knowledge base and mark the root identifier of the original instruction in the derived instructions.

[0088] Furthermore, this invention stores the various instruction relationships identified in step S23 in a structured manner. For parameter escaping relationships, this invention creates escaping rule entries in the rule knowledge base, recording source parameter key-value pairs, target parameter key-value pairs, and escaping type identifiers; for instruction splitting relationships, this invention creates splitting rule entries, recording splitting conditions, splitting ratio coefficients, and splitting type identifiers. Simultaneously, this invention assigns a unique root identifier to each original input instruction and adds a "cmd_root_id" field to the logs of all output instructions derived from this input instruction. The value of this field points to the root identifier of the original input instruction, establishing the lineage relationship between derived instructions and original instructions. The final rule knowledge base is stored in a key-value pair structure, where the key is the node pair identifier of "upstream node - downstream node," and the value is the set of all conversion rules between that node pair.

[0089] S3: Statistically quantify the set of instruction words based on the global vocabulary, and generate an actual vector representing the distribution characteristics of multiple node instructions through normalization processing.

[0090] Step S3 further includes:

[0091] S31: Construct a global vocabulary containing all instruction words and assign a unique index to each instruction word.

[0092] In step S31, the present invention iterates through all instruction word sequences generated by all nodes within the analysis time period, extracts all unique instruction words that have appeared, and constructs a global vocabulary. The global vocabulary is stored in a list structure, with each instruction word occupying a position in the list. The present invention assigns a unique index to each instruction word based on its position index in the list. For example, if the global vocabulary is ["tenantId:2000306358","method:setBrightness","highBright:80","method:getSetting","area:0033"], then the unique index of "method:setBrightness" is 1, and the unique index of "highBright:80" is 2. The final global vocabulary determines the number of dimensions in the vector space, with each dimension corresponding to a specific instruction word.

[0093] S32: For a set of instruction words for multiple nodes within a specified time window, create an initial vector of the same length as the global vocabulary.

[0094] Furthermore, in step S32, the present invention first determines the time window range for analysis, such as the time span of the most recent 1 hour or the most recent 1000 instructions; then, the present invention filters instructions whose timestamps fall within the time window and have valid root identifiers from the log data of the node, excluding irrelevant logs such as heartbeat logs and status query logs generated spontaneously by the node; subsequently, the present invention creates a numerical vector with a length equal to the length of the global vocabulary, with the initial value of each position in the vector set to 0, and each position of the initial vector corresponds one-to-one with the instruction word of the corresponding index in the global vocabulary, which is used to subsequently count the number of times the instruction word appears in the node.

[0095] S33: Traverse multiple instruction words in the instruction word set, and accumulate the count value at the corresponding position of the initial vector according to the unique index to obtain the accumulated vector.

[0096] In step S33, the present invention iterates through all the valid instructions obtained from the filtering process and parses the instruction word sequence of each instruction. For each instruction word in the instruction word sequence, the present invention searches for the unique index value of the instruction word in the global vocabulary. Then, it locates the position corresponding to the index value in the initial vector and increments the value of that position by 1. By iterating through all the instruction words of all instructions, the present invention completes the cumulative count of all positions in the initial vector. For example, if a node processes 100 instructions containing "method:setBrightness" and the index of this instruction word is 1, then the value of the first position in the cumulative vector is 100. The vector obtained after accumulation is called the cumulative vector, and the value of each position in the cumulative vector represents the number of times the corresponding instruction word appears in that node within that time window.

[0097] S34: Perform L2 norm normalization on the accumulated vector to obtain the actual vector of each node.

[0098] Furthermore, in step S34, the present invention performs L2 norm normalization on the accumulated vector to eliminate the influence of differences in instruction processing volume between different nodes. First, the L2 norm of the accumulated vector is calculated, i.e., the square root of the sum of the squares of all elements in the vector is taken. Then, each element in the accumulated vector is divided by this L2 norm value to obtain the normalized actual vector. Through L2 normalization, the vectors of different nodes are comparable; the value of each dimension in the vector no longer represents the absolute frequency of occurrence, but rather the relative weight of the instruction word in the node's instruction distribution. Finally, the present invention generates a normalized actual vector for each node, which quantifies the instruction processing characteristic distribution of that node.

[0099] S4: Input the actual vector of the upstream node and the rule knowledge base into the dynamic frequency correction algorithm to calculate the expected vector of the downstream node.

[0100] In step S4, the present invention relies on the Dynamic Frequency Correction (DFC) algorithm to generate the expected vector of downstream nodes through scaling and mapping operations, and accurately eliminates the systematic deviation caused by normal business logic such as instruction splitting, broadcasting, and escaping.

[0101] Among them, the scaling operation is for scenarios where the number of instructions changes (such as splitting, broadcasting, and aggregation). It corrects the difference in the number of instructions by using the scaling coefficient in the rule base to ensure that the expected vector can reflect the total number of instructions that the downstream node should process. The mapping operation is for scenarios where the content of instructions changes (such as parameter escaping and field reconstruction). It solves the problem of inconsistent semantic expression of upstream and downstream instructions by accurately mapping the source parameters and target parameters.

[0102] Step S4 further includes:

[0103] S41: Extract instruction conversion rules from upstream nodes to downstream nodes from the rule knowledge base. The instruction conversion rules include condition information and scaling factors.

[0104] The scaling factor in step S41 is determined according to the instruction conversion type, specifically including:

[0105] When the conversion type is instruction splitting, the scaling factor is the ratio of the number of instructions after splitting to the number of instructions before splitting; when the conversion type is instruction broadcasting, the scaling factor is the number of broadcast target devices; when the conversion type is instruction aggregation, the scaling factor is the reciprocal of the ratio of the number of instructions before aggregation to the number of instructions after aggregation.

[0106] In step S41, the present invention retrieves the corresponding set of transformation rules from the rule knowledge base based on the node pair relationship to be analyzed. Specifically, the present invention uses "upstream node identifier - downstream node identifier" as the search key to extract all identified instruction transformation rules between the node pair from the rule knowledge base, wherein each transformation rule contains two core elements: condition information and scaling factor.

[0107] Specifically, the condition information describes the prerequisites for a rule to take effect. For example, "parameter area=0033" means that the rule takes effect only if the instruction contains this parameter, and "parameter highBright=80" means that the rule takes effect only if the instruction contains this specific parameter value.

[0108] The scaling factor quantifies the percentage change in the number of instructions, and its determination depends on the conversion type. When the conversion type is instruction splitting, this invention calculates the ratio of the number of instructions generated after splitting to the number of instructions before splitting, using the ratio as the scaling factor. For example, when one instruction is split into two, the scaling factor is 2. When the conversion type is instruction broadcasting, this invention calculates the number of target devices to which the broadcast instruction is sent, and this number is directly used as the scaling factor. For example, when broadcasting to 100 devices, the scaling factor is 100. When the conversion type is instruction aggregation, this invention calculates the reciprocal of the ratio of the number of instructions before aggregation to the number of instructions after aggregation as the scaling factor. For example, when two instructions are aggregated into one, the scaling factor is 1 / 2, or 0.5.

[0109] S42: Based on the dynamic frequency correction algorithm, the vector dimension values ​​corresponding to the instruction words that meet the conditions are selected from the actual vectors of the upstream nodes according to the condition information. The selected dimension values ​​are multiplied by the scaling factor to obtain the value of the corresponding part in the expected vector of the downstream nodes.

[0110] In step S42, the present invention performs a scaling operation to handle changes in the number of instructions for each extracted transformation rule. Specifically, the present invention first parses the condition information in the rule to determine the instruction words involved in the condition, for example, the condition "area=0033" corresponds to the instruction word "area:0033". Then, the present invention searches for the unique index of this instruction word in the global vocabulary, locates the dimension position corresponding to the index in the actual vector of the upstream node, and extracts the dimension value at that position. When the condition information involves multiple instruction words, the present invention extracts the values ​​of all relevant dimensions and sums them to obtain the total weight of the instruction words that satisfy the condition. Next, the present invention multiplies the extracted dimension value by the scaling factor of the rule to obtain the expected value of the corresponding part in the expected vector of the downstream node. For example, if the dimension value corresponding to "area:0033" in the actual vector of the upstream node is 0.3, and the scaling factor of the rule is 2, then the value derived from this part in the expected vector of the downstream node is 0.3×2=0.6. Finally, the present invention temporarily stores the calculated value, preparing to integrate it into the expected vector of the downstream node later.

[0111] S43: Based on the parameter escaping relationship in the rule knowledge base, map the dimension value corresponding to the source parameter in the actual vector of the upstream node to the dimension corresponding to the target parameter in the expected vector of the downstream node, and set the dimension value corresponding to the source parameter to 0.

[0112] In step S43, the present invention performs a mapping operation to process the change of instruction content for parameter escaping relationships in the rule knowledge base. The parameter escaping relationships are stored in the form of a mapping between source parameter key-value pairs and target parameter key-value pairs, for example, "highBright:80" is mapped to "brightness:0x50".

[0113] Specifically, this invention first searches for the unique index of the instruction word corresponding to the source parameter in the global vocabulary, locates the index position in the actual vector of the upstream node, and extracts the dimension value at that position as the source dimension value. Then, this invention searches for the unique index of the instruction word corresponding to the target parameter in the global vocabulary, and locates the index position in the expected vector of the downstream node being constructed. This invention multiplies the source dimension value by the corresponding scaling factor and assigns the result to the dimension position corresponding to the target parameter. For example, if the dimension value of "highBright:80" in the actual vector of the upstream node is 0.25 and the scaling factor is 2, then the dimension value of "brightness:0x50" in the expected vector of the downstream node is set to 0.25 × 2 = 0.5. Simultaneously, this invention sets the dimension value corresponding to the source parameter "highBright:80" to 0 in the expected vector of the downstream node, because after escaping, this parameter form no longer appears in the downstream node.

[0114] S44: Integrate the results of all transformation rules, perform L2 norm normalization on the expected vector of downstream nodes, and generate the final expected vector.

[0115] Furthermore, in step S44, the present invention initializes a zero vector with a length equal to the length of the global vocabulary as the initial state of the expected vector of the downstream node. Subsequently, the present invention traverses all transformation rules extracted from the rule knowledge base, and sequentially accumulates the scaling operation result calculated in step S42 and the mapping operation result calculated in step S43 to the corresponding dimension positions of the expected vector.

[0116] For instruction words that exist in the actual vector of the upstream node but for which no transformation rule is defined in the rule knowledge base, this invention processes them according to the default rule, that is, it assumes that these instruction words are not passed to the downstream node and that the corresponding dimension in the expected vector remains 0.

[0117] After accumulation, this invention performs L2 norm normalization on the expected vector of downstream nodes. Specifically, this invention calculates the square root of the sum of squares of all elements in the expected vector to obtain the L2 norm value, and then divides each element in the expected vector by this L2 norm value to obtain the normalized final expected vector. In step S44, the normalization process performed by this invention ensures that the expected vector and the actual vector are on the same scale and dimension, satisfying the prerequisite for subsequent similarity calculation.

[0118] S5: Calculate the similarity between the expected vectors and actual vectors of multiple nodes. When the similarity is lower than a preset threshold, determine the abnormal link and locate the faulty node by combining the system topology relationship.

[0119] Step S5 further includes:

[0120] S51: The cosine similarity algorithm is used to calculate the similarity value between the expected vector and the actual vector of multiple nodes.

[0121] In step S51, the present invention calculates the similarity value between the expected vector and the actual vector for each downstream node. The cosine similarity algorithm quantifies the similarity of vectors by calculating the cosine value of the angle between the two vectors. The calculation process includes first calculating the dot product of the two vectors, then calculating the magnitude of the two vectors respectively, and finally dividing the dot product by the product of the two magnitudes.

[0122] Since steps S34 and S44 have already performed L2 norm normalization on the actual and expected vectors, the magnitudes of both vectors are 1. Therefore, the cosine similarity value is equal to the dot product of the two vectors. This invention multiplies the corresponding elements of the expected and actual vectors one by one and then sums the results; the sum is the similarity value. The similarity value ranges from -1 to 1. A similarity value close to 1 indicates that the two vectors are highly similar, while a similarity value far from 1 indicates that the vectors are significantly different. Finally, this invention calculates a similarity value for each node in the system, forming a set of node similarity values.

[0123] S52: Starting from the initial node of the system topology, multiple links are checked sequentially along the instruction flow. Based on the actual vector of the upstream node, a dynamic frequency correction algorithm is used to generate the expected vector of the downstream node. The expected vector is compared with the actual vector of the downstream node to calculate the similarity value of the link. The first link with a similarity value lower than a preset threshold is identified as an abnormal link. Further, in step S52, the present invention establishes the node traversal order according to the topology of the IoT system. The system topology defines the transmission path of the instruction from the initial node to the final node, such as "business service → instruction component → message queue → gateway service → device".

[0124] This invention starts from the initial node of the topology and sequentially examines each link connecting upstream and downstream nodes according to the instruction flow order. For each link, this invention obtains the actual vector of the upstream node, combines it with the instruction conversion rules in the rule knowledge base, and calculates the expected vector of the downstream node in real time using the DFC algorithm. Then, it compares the similarity between the expected vector and the actual vector generated by the downstream node.

[0125] This invention checks sequentially along the topological path. Once it finds that the similarity value of a downstream node of a certain link does not match the expected vector, it immediately marks the link as an abnormal link and terminates the continued inspection. The first link marked as abnormal is the link in the instruction flow where the deviation first occurs, and this position is a key clue for fault location.

[0126] In step S52, the present invention believes that the expected vector of the downstream node is a theoretical behavioral feature derived from the actual behavior of the upstream node and the inherent conversion rules of the system. Therefore, in the inspection, the present invention first generates the expected vector through the DFC algorithm, and then makes an effective comparison with the actual behavioral features (actual vector) of the downstream node, so as to accurately determine whether there is an anomaly in the link.

[0127] S53: Determine whether the upstream node of the abnormal link is healthy. If the similarity value of the upstream node is higher than the preset threshold, it is determined that the fault occurred in the output stage of the upstream node or the transmission link between the upstream and downstream nodes. If the similarity value of the upstream node is lower than the preset threshold, continue to trace upstream of the topology until the link with healthy upstream and abnormal downstream is located and determined as the faulty link.

[0128] In step S53, the present invention aims to perform root cause reasoning on the identified abnormal links to determine the location of the fault.

[0129] Specifically, this invention first extracts the similarity value of upstream nodes in the abnormal link and compares this value with a preset threshold to determine the health status of the upstream nodes. When the similarity value of an upstream node is higher than the preset threshold, the upstream node is determined to be healthy. In this case, this invention infers that the fault occurred in the instruction output stage of the upstream node or in the network transmission link between the upstream node and the downstream node. Specifically, the upstream node successfully processed the instruction but failed to send it to the downstream node, or the sent instruction was lost during transmission. This invention records this abnormal link as a faulty link and records the upstream node identifier and the downstream node identifier as the fault location result.

[0130] When the similarity value of an upstream node is lower than a preset threshold, the upstream node is determined to be abnormal. At this time, the abnormality of the current link is a chain reaction caused by a failure further upstream. This invention traces back to the input link of the upstream node in the topology and continues to execute the inspection process in step S52, tracing upstream along the topology until the link where the upstream node is healthy but the downstream node is abnormal is located. This link is the real faulty link.

[0131] The process includes the following after step S53:

[0132] A diagnostic report is generated, which includes fault link identifier, fault node identifier, similarity value supporting the conclusion, identifier of the instruction root involved, time window information, and confidence score calculated based on the degree of similarity deviation.

[0133] After identifying the faulty link, this invention also generates a structured diagnostic report. The diagnostic report includes a faulty link identifier, which is represented by a combination of the upstream and downstream node names, such as "Instruction Component → Message Queue". Secondly, the diagnostic report also includes a faulty node identifier, indicating the specific node most likely to have failed, such as "Instruction Component Service". Furthermore, the diagnostic report includes similarity values ​​supporting the conclusions, recording the similarity values ​​of downstream nodes and upstream nodes in the abnormal link, such as "Downstream node similarity 0.15, upstream node similarity 0.92". Additionally, the diagnostic report includes information related to... The report lists the command root identifiers, including the cmd_root_id values ​​of the commands affected within the analysis time window, facilitating the tracing of specific command instances. The diagnostic report also includes time window information, recording the start and end timestamps of the analysis. Furthermore, the report contains a confidence score. This invention calculates the confidence score based on the deviation between the similarity value and the threshold; the greater the deviation, the higher the confidence score. The calculation method involves normalizing the absolute value of the difference between the similarity value and the threshold to a range of 0 to 1. For example, a similarity of 0.15 and a threshold of 0.85 have a difference of 0.7, resulting in a normalized confidence score of 0.82, indicating a high confidence level.

[0134] like Figure 2 As shown, the present invention also provides an Internet of Things (IoT) command fault location system, comprising:

[0135] Parsing module 100: Used to perform semantic parsing on log data generated by multiple nodes in the Internet of Things system, extract instruction feature parameters and convert them into standardized instruction word sequences to generate an instruction word set;

[0136] Module 200: This module is used to establish an instruction conversion relationship model based on the instruction correlation between upstream and downstream nodes within a time window, and to obtain a rule knowledge base describing the instruction conversion rules between nodes.

[0137] Quantization module 300: used to perform statistical quantization on the instruction word set based on the global vocabulary, and generate an actual vector representing the distribution characteristics of multiple node instructions through normalization processing;

[0138] Correction module 400: used to dynamically correct the actual vector of the upstream node with the rule knowledge base, and calculate the expected vector of the downstream node;

[0139] Location module 500: It is used to calculate the similarity between the expected vector and the actual vector of multiple nodes. When the similarity is lower than the preset threshold, it determines the abnormal link and locates the faulty node by combining the system topology relationship.

[0140] This invention aims to provide a non-intrusive, intelligent, and high-precision method and system for locating IoT command faults. Firstly, it offers a zero-intrusion solution that eliminates the need for pre-configured TraceIDs, achieving full-coverage tracing solely through analysis of the system's inherent logs. Secondly, the method enables the system to automatically learn the complex transformation rules during command flow and possess reasoning capabilities, thereby discovering unknown faults, including silent failures. Thirdly, it elevates fault location from service-level to link-level, accurately pinpointing the specific node or transmission link where the fault occurs and outputting actionable diagnostic reports. Finally, it reduces the mean time to localization (MTTR) from hours to minutes, significantly reducing reliance on experienced maintenance personnel and saving enterprise labor costs.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. An Internet of Things instruction fault localization method, characterized in that, include: S1: Perform semantic parsing on log data generated by multiple nodes in the IoT system, extract instruction feature parameters, convert them into standardized instruction word sequences, and generate an instruction word set; S2: Based on the instruction correlation between upstream and downstream nodes within the time window, establish an instruction conversion relationship model and obtain a rule knowledge base describing the instruction conversion rules between nodes; S3: Statistically quantify the instruction word set based on the global vocabulary, and generate an actual vector representing the distribution characteristics of multiple node instructions through normalization processing; S4: Input the actual vector of the upstream node and the rule knowledge base into the dynamic frequency correction algorithm to calculate the expected vector of the downstream node; S5: Calculate the similarity between the expected vectors and actual vectors of multiple nodes. When the similarity is lower than a preset threshold, determine the abnormal link and locate the faulty node by combining the system topology relationship.

2. The method of claim 1, wherein, Step S1 further includes: S11: Extract tenant and device identifiers from the collected log data to form instruction identity information; S12: Parse the command action and command parameters from the log data, wherein the command parameters are represented in key-value pairs; S13: Combine the instruction identity information, the instruction action, and the instruction parameters into an instruction word sequence, and multiple instruction word sequences constitute the instruction word set of the corresponding node.

3. The method of claim 1, wherein, Step S2 further includes: S21: For each input instruction of the input node, collect all output instructions of the output node within a preset time window; S22: Based on the frequency statistics of input and output instructions within a preset time window, construct frequency vectors for upstream and downstream instructions. Through device identifier matching, parameter matching, similarity calculation, and frequency vector correlation analysis, determine the degree of correlation between output and input instructions. S23: Identify instruction relationships based on the degree of association and frequency vector mapping relationship; S24: Store the identified instruction relationships in the rule knowledge base and mark the root identifier of the original instruction in the derived instructions.

4. The method of claim 3, wherein, Step S23 specifically includes: When the key parameters of the output command differ from those of the input command in terms of format or numerical expression, they are identified as parameter escaping relationships, and the mapping rules before and after escaping are recorded. When the parameters of an input instruction are split into multiple output instructions, the splitting relationship is identified and the splitting ratio coefficient is recorded.

5. The method of claim 1, wherein, Step S3 further includes: S31: Construct a global vocabulary containing all instruction words and assign a unique index to each instruction word; S32: For a set of instruction words from multiple nodes within a specified time window, create an initial vector of the same length as the global vocabulary; S33: Traverse multiple instruction words in the instruction word set, and accumulate the count value at the corresponding position of the initial vector according to the unique index to obtain the accumulated vector; S34: Perform L2 norm normalization on the accumulated vector to obtain the actual vector of each node.

6. The method of claim 1, wherein, Step S4 further includes: S41: Extract instruction conversion rules from upstream nodes to downstream nodes from the rule knowledge base, wherein the instruction conversion rules include condition information and scaling factor; S42: Based on the dynamic frequency correction algorithm, the vector dimension values ​​corresponding to the instruction words that meet the conditions are selected from the actual vector of the upstream node according to the condition information. The selected dimension values ​​are multiplied by the scaling factor to obtain the value of the corresponding part in the expected vector of the downstream node. S43: Based on the parameter escaping relationship in the rule knowledge base, map the dimension value corresponding to the source parameter in the actual vector of the upstream node to the dimension corresponding to the target parameter in the expected vector of the downstream node, and set the dimension value corresponding to the source parameter to 0 at the same time. S44: Integrate the results of all transformation rules, perform L2 norm normalization on the expected vector of downstream nodes, and generate the final expected vector.

7. The method of claim 6, wherein, The scaling factor in step S41 is determined according to the instruction conversion type, specifically including: When the conversion type is instruction splitting, the scaling factor is the ratio of the number of instructions after splitting to the number of instructions before splitting; When the conversion type is command broadcast, the scaling factor is the number of target devices for the broadcast; When the conversion type is instruction aggregation, the scaling factor is the reciprocal of the ratio of the number of instructions before aggregation to the number of instructions after aggregation.

8. The method of claim 1, wherein, Step S5 further includes: S51: The cosine similarity algorithm is used to calculate the similarity value between the expected vector and the actual vector of multiple nodes; S52: Starting from the starting node of the system topology, check multiple links sequentially along the instruction flow. Based on the actual vector of the upstream node, generate the expected vector of the downstream node through a dynamic frequency correction algorithm, compare the expected vector with the actual vector of the downstream node, calculate the similarity value of the link, and identify the first link with a similarity value lower than the preset threshold as an abnormal link. S53: Determine whether the upstream node of the abnormal link is healthy. If the similarity value of the upstream node is higher than the preset threshold, it is determined that the fault occurred in the output stage of the upstream node or the transmission link between the upstream and downstream nodes. If the similarity value of the upstream node is lower than the preset threshold, continue to trace upstream of the topology until the link with healthy upstream and abnormal downstream is located and determined as the faulty link.

9. The method for locating IoT command faults according to claim 8, characterized in that, The process after step S53 also includes: A diagnostic report is generated, which includes fault link identifier, fault node identifier, similarity value supporting the conclusion, identifier of the instruction root involved, time window information, and confidence score calculated based on the degree of similarity deviation.

10. An Internet of Things (IoT) command fault location system, characterized in that, include: Parsing module: Used to perform semantic parsing on log data generated by multiple nodes in the IoT system, extract instruction feature parameters and convert them into standardized instruction word sequences to generate instruction word sets; The module is used to establish an instruction conversion relationship model based on the instruction correlation between upstream and downstream nodes within a time window, and to obtain a rule knowledge base describing the instruction conversion rules between nodes. Quantization module: used to perform statistical quantization on the instruction word set based on the global vocabulary, and generate an actual vector representing the distribution characteristics of instructions from multiple nodes through normalization processing; Correction module: used to dynamically correct the actual vector of the upstream node with the rule knowledge base, and calculate the expected vector of the downstream node; The localization module is used to calculate the similarity between the expected vectors and the actual vectors of multiple nodes. When the similarity is lower than a preset threshold, it determines the abnormal link and locates the faulty node by combining the system topology.

Images