Method and device for determining fault self-healing operation, electronic equipment, medium and product

Abstract

The embodiment of the invention discloses a fault self-healing operation determination method and device, electronic equipment, a medium and a product. The method comprises the following steps: acquiring alarm monitoring data of a target service, and constructing a knowledge graph based on the alarm monitoring data; wherein the knowledge graph comprises entity nodes, relation edges, weights of the relation edges and feature vectors of the entity nodes; performing fault root cause node positioning processing on the knowledge graph to obtain a fault root cause node corresponding to the target service; wherein the fault root cause node is used for indicating an entity node which is easy to cause a cascading fault in the target service; determining a self-healing operation set corresponding to the fault root cause node; wherein the success rate of the self-healing operation in the self-healing operation set is greater than a preset success rate threshold; and determining the action value of each self-healing operation in the self-healing operation set, and determining the self-healing operation with the maximum action value as the target self-healing operation of the fault root cause node.

Description

Technical Field

[0001] This disclosure generally relates to the field of data processing technology, and more particularly to a method, apparatus, electronic device, medium, and product for determining fault self-healing operation. Background Technology

[0002] Fault self-healing technology (i.e., automated operation and maintenance technology) is a core driving force of modern IT operation and maintenance management, and is gradually changing the way enterprise IT systems are operated and maintained. This technology can greatly simplify a series of complex operation and maintenance tasks such as automated monitoring, deployment, configuration, optimization, fault location and fault self-healing of software application systems through advanced automation tools, scripts, frameworks and platforms, and improve the efficiency of system operation.

[0003] Currently, self-healing operations determined by maintenance personnel based on experience are typically converted into automated scripts. These scripts are then associated with abnormal alarm events (i.e., fault events) and entered into an automated policy management system for subsequent self-healing operations when faults occur. However, this approach primarily relies on rule-based configuration by operations personnel, making it difficult to dynamically update the fault self-healing decision base in a timely and effective manner. Therefore, it suffers from problems such as passive fault self-healing operations, simplistic automation technology, limited application scenarios, reliance on rules, and the inability to perform simple operations like alarm self-healing without a clear understanding of the concept of fault self-healing. Summary of the Invention

[0004] This disclosure addresses some deficiencies mentioned in the background art by providing a method, apparatus, electronic device, medium, and product for determining fault self-healing operations.

[0005] In a first aspect, embodiments of this disclosure provide a method for determining a fault self-healing operation, comprising: Acquire alarm monitoring data of the target business, and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of the relationship edges, and the feature vectors of the entity nodes; The knowledge graph is processed to locate the root cause of the fault, thereby obtaining the root cause of the fault corresponding to the target service; wherein, the root cause of the fault is used to indicate the entity nodes in the target service that are prone to triggering a chain of faults. Determine the set of self-healing operations corresponding to the root cause node of the fault; wherein the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold. Determine the action value of each self-healing operation in the set of self-healing operations, and identify the self-healing operation with the highest action value as the target self-healing operation for the root cause node of the fault.

[0006] In one embodiment of the first aspect, constructing a knowledge graph based on the alarm monitoring data includes: Entity extraction is performed on the alarm monitoring data to obtain entity nodes; Determine the association relationships between each of the entity nodes, and define the association relationships as the relationship edges; Based on the association relationships between the entity nodes, the weight of the relationship edge corresponding to the entity node is determined based on the association relationships; Feature extraction is performed on the entity node to obtain the feature vector of the entity node; The entity node, the relation edge, the weight of the relation edge, and the feature vector of the entity node are determined as the knowledge graph.

[0007] In one embodiment of the first aspect, determining the weight of the relation edge corresponding to the entity node based on the association relationship between the entity nodes includes: Determine the number of times the entity node appears and the number of alarms in the alarm monitoring data; The importance coefficient of the entity node is determined based on the occurrence frequency and alarm frequency. Determine the influence factor between entity nodes associated with the entity node corresponding to the importance coefficient; wherein the influence factor is used to indicate the proportion of influence of the entity node relative to the associated entity nodes; Based on the aforementioned influence factor, the weights of the relation edges corresponding to the entity nodes are determined.

[0008] In one embodiment of the first aspect, the step of performing fault root cause node localization processing on the knowledge graph to obtain the fault root cause node corresponding to the target service includes: Based on the knowledge graph, the influence weights between adjacent entity nodes are determined; Based on the influence weights, time-series feature determination processing is performed to obtain the failure probability of the entity node; Based on the failure probability and the influence weight, the failure initiation probability of the entity node is determined; wherein, the failure initiation probability is used to indicate the probability that the entity node causes other entity nodes to fail.

[0009] In one embodiment of the first aspect, the step of determining the failure probability of the entity node based on the temporal feature determination of the influence weight includes: The influence weights are activated using an activation function to obtain the fault association information of the entity node. Temporal feature extraction of the fault association information is performed using a convolution function to obtain the temporal feature values ​​of the entity nodes; The failure probability of the entity node is obtained by processing the temporal feature value through an activation function.

[0010] In one embodiment of the first aspect, determining the action value of each self-healing operation in the set of self-healing operations, and identifying the self-healing operation with the highest action value as the target self-healing operation for the root cause node of the fault, includes: Encode the feature vector corresponding to the root cause node of the fault to obtain the state vector of the root cause node of the fault. The action value of each self-healing operation is determined based on the state vector. The causal loss and safety level of each self-healing operation are determined based on the state vector; wherein the causal loss is used to indicate the difference between the action value of the self-healing operation and the historical success rate of the self-healing operation. Based on the causal loss and the safety level, it is determined whether the self-healing operation with the highest action value meets the preset safety conditions, and if the self-healing operation with the highest action value meets the preset safety conditions, the self-healing operation is determined as the target self-healing operation.

[0011] In a second aspect, embodiments of this disclosure provide an apparatus for determining a fault self-healing operation, comprising: A construction unit is used to acquire alarm monitoring data of the target business and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of the relationship edges, and the feature vectors of the entity nodes; The positioning unit is used to perform fault root cause node positioning processing on the knowledge graph to obtain the fault root cause node corresponding to the target service; wherein, the fault root cause node is used to indicate the entity node in the target service that is prone to triggering a chain of faults. The first determining unit is used to determine the set of self-healing operations corresponding to the root cause node of the fault; wherein the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold. The second determining unit is used to determine the action value of each self-healing operation in the self-healing operation set, and to determine the self-healing operation with the highest action value as the target self-healing operation of the root cause node of the fault.

[0012] In a third aspect, an electronic device is provided, comprising: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is in operation, the processor communicates with the memory via the bus, and the machine-readable instructions, when executed by the processor, perform the steps of the first aspect above, or any possible implementation of the first aspect.

[0013] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, performs the steps of the first aspect or any possible implementation thereof.

[0014] In a fifth aspect, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the steps of the method described in the preceding aspects.

[0015] As will be described in detail below, a method, apparatus, electronic device, medium, and product for determining fault self-healing operations are disclosed according to embodiments of the present disclosure. By constructing a knowledge graph containing entity nodes, relation edges, and features based on alarm monitoring data, and replacing traditional manual rule configuration, it can dynamically integrate fault association information of target services, avoiding the shortcomings of rule-based configuration in terms of limited scenarios and inability to adapt to complex business links.

[0016] By leveraging knowledge graphs to pinpoint root cause nodes, the system accurately identifies core nodes prone to triggering cascading failures, overcoming the limitations of traditional methods that rely solely on simple actions triggered by alarm events. Furthermore, by filtering high-success-rate self-healing operations based on root cause nodes and selecting the optimal operation through action value, the system achieves dynamic adaptation of the self-healing decision library (matching root cause types without manual intervention). This avoids the passive and technically simplistic nature of self-healing operations, improving the accuracy and automation of self-healing for target business failures. Attached Figure Description

[0017] Figure 1 A flowchart illustrating a method for determining a fault self-healing operation as provided in this embodiment of the disclosure; Figure 2 An architecture diagram of a fault self-healing operation determination system provided in this embodiment of the disclosure; Figure 3 A schematic diagram of a fault self-healing operation determination device provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0018] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present disclosure and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the present disclosure are shown in the drawings, not the entire structure.

[0019] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0020] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0021] Research has revealed that fault self-healing technology (i.e., automated operations and maintenance technology), as a core driving force of modern IT operations and maintenance management, is gradually changing the way enterprise IT systems are operated and maintained. This technology can greatly simplify a series of complex operations and maintenance tasks such as automated monitoring, deployment, configuration, optimization, fault location, and fault self-healing of software application systems through advanced automation tools, scripts, frameworks, and platforms, and improve the efficiency of system operation.

[0022] Currently, self-healing operations determined by maintenance personnel based on experience are typically converted into automated scripts. These scripts are then associated with abnormal alarm events (i.e., fault events) and entered into an automated policy management system for subsequent self-healing operations when faults occur. However, this approach primarily relies on rule-based configuration by operations personnel, making it difficult to dynamically update the fault self-healing decision base in a timely and effective manner. Therefore, it suffers from problems such as passive fault self-healing operations, simplistic automation technology, limited application scenarios, reliance on rules, and the inability to perform simple operations like alarm self-healing without a clear understanding of the concept of fault self-healing.

[0023] Based on the above research, this disclosure provides a method for determining fault self-healing operations. By constructing a knowledge graph containing entity nodes, relationship edges and features based on alarm monitoring data, it replaces the traditional manual rule configuration and can dynamically integrate fault association information of target business, avoiding the shortcomings of rule-based configuration scenarios being too limited and unable to adapt to complex business links.

[0024] By leveraging knowledge graphs to pinpoint root cause nodes, the system accurately identifies core nodes prone to triggering cascading failures, overcoming the limitations of traditional methods that rely solely on simple actions triggered by alarm events. Furthermore, by filtering high-success-rate self-healing operations based on root cause nodes and selecting the optimal operation through action value, the system achieves dynamic adaptation of the self-healing decision library (matching root cause types without manual intervention). This avoids the passive and technically simplistic nature of self-healing operations, improving the accuracy and automation of self-healing for target business failures.

[0025] To facilitate understanding of this embodiment, a method for determining a fault self-healing operation disclosed in this disclosure will first be described in detail. The execution subject of this method is generally a computer device with certain computing capabilities, such as a terminal device, a server, or other processing devices. In some possible implementations, this method for determining the fault self-healing operation can be implemented by a processor calling computer-readable instructions stored in memory.

[0026] See Figure 1 The diagram shows a flowchart of a method for determining a fault self-healing operation provided in an embodiment of this disclosure. The method includes steps S101 to S104, wherein: S101. Obtain alarm monitoring data of the target business and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of relationship edges, and the feature vectors of entity nodes.

[0027] In the embodiments of this disclosure, historical monitoring data of the target service can be determined. This historical monitoring data includes at least one of the following: text, logs, and metrics, etc.

[0028] After determining the historical monitoring data, alarm monitoring data can be identified from the historical monitoring data, that is, historical monitoring data with alarm descriptions.

[0029] Here, the alarm monitoring data includes alarm information for alarm events related to the target service. This alarm information includes alarm descriptions, log error codes, and anomaly indicators.

[0030] The alarm description includes: the title, level, device name, target IP, and business system of the alarm event. Anomaly indicators include: CPU anomaly rate, memory usage anomaly rate, and network anomaly rate.

[0031] Then, the alarm monitoring data can be processed to build a knowledge graph corresponding to the target business.

[0032] S102. Perform fault root cause node localization processing on the knowledge graph to obtain the fault root cause node corresponding to the target business; wherein, the fault root cause node is used to indicate the entity node in the target business that is prone to triggering chain failures.

[0033] In the embodiments of this disclosure, T-GNN (emporal graph neural network) can be used to perform fault root cause node localization processing based on knowledge graphs to obtain the fault root cause node corresponding to the target service.

[0034] Here, T-GNN can be used to accurately locate the source of a chain of failures in complex cloud-native pipelines, and obtain the root cause node of the failure in the target business.

[0035] Here, the influence weights of the core equipment of the target business can be introduced into the graph attention layer of T-GNN, the temporal features within the sliding window can be extracted into the temporal convolutional layer, and the dependency relationships between the entity nodes in the knowledge graph can be introduced into the root cause localization output layer to achieve fault root cause node localization.

[0036] Here, T-GNN can be used to determine the probability of failure events caused by mutual faults between entity nodes in the knowledge graph. Then, the entity node with the highest failure probability can be identified as the root cause node of the failure.

[0037] Here, the entity node with the highest probability of failure is also the entity node that is most likely to cause failures in other entity nodes in the knowledge graph.

[0038] S103. Determine the set of self-healing operations corresponding to the root cause node of the fault; wherein, the success rate of the self-healing operations in the set of self-healing operations is greater than the preset success rate threshold.

[0039] In the embodiments of this disclosure, firstly, the self-healing operation corresponding to the fault event caused by the root cause node can be determined based on historical monitoring data.

[0040] Next, the success probability of each self-healing operation can be determined. Finally, the self-healing operations with a success probability greater than a preset success probability threshold are added to the blank set to obtain the self-healing operation set.

[0041] Those skilled in the art can set preset success probability thresholds based on actual needs, which will not be elaborated here.

[0042] S104. Determine the action value of each self-healing operation in the set of self-healing operations, and determine the self-healing operation with the highest action value as the target self-healing operation of the root cause node of the fault.

[0043] In embodiments of this disclosure, the action value of each healing operation in the self-healing operation set can be determined using the DQN (Deep Q-Network) algorithm.

[0044] Here, after determining the action value of each self-healing operation, the loss value of a self-healing operation that satisfies a preset value condition can be determined. The loss value is used to indicate the risk of the self-healing operation.

[0045] Then, the self-healing operation with the minimum loss value can be identified as the target self-healing operation for the root cause node of the failure.

[0046] Among them, the preset value condition can be understood as a self-healing operation where the value of the action is greater than the preset value threshold.

[0047] Here, a weighted summation can be performed based on the action value and risk of each operation to obtain the usability coefficient of each operation.

[0048] Next, the self-healing operation with the highest usability coefficient can be identified as the target self-healing operation. Here, the self-healing operation with the highest usability coefficient is the one with a high success rate and low risk.

[0049] In the embodiments of this disclosure, firstly, alarm monitoring data of the target service is acquired, and a knowledge graph is constructed based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relation edges, the weights of relation edges, and feature vectors of entity nodes; secondly, fault root cause node localization processing is performed on the knowledge graph to obtain the fault root cause node corresponding to the target service; wherein, the fault root cause node is used to indicate entity nodes in the target service that are prone to causing chain failures; thirdly, a set of self-healing operations corresponding to the fault root cause node is determined; wherein, the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold; finally, the action value of each self-healing operation in the set of self-healing operations is determined, and the self-healing operation with the highest action value is determined as the target self-healing operation of the fault root cause node.

[0050] In the above implementation, a knowledge graph containing entity nodes, relationship edges and features is constructed based on alarm monitoring data to replace traditional manual rule configuration. This can dynamically integrate fault association information of target business and avoid the shortcomings of rule-based configuration, which is limited to a single scenario and cannot adapt to complex business links.

[0051] By leveraging knowledge graphs to pinpoint root cause nodes, the system accurately identifies core nodes prone to triggering cascading failures, overcoming the limitations of traditional methods that rely solely on simple actions triggered by alarm events. Furthermore, by filtering high-success-rate self-healing operations based on root cause nodes and selecting the optimal operation through action value, the system achieves dynamic adaptation of the self-healing decision library (matching root cause types without manual intervention). This avoids the passive and technically simplistic nature of self-healing operations, improving the accuracy and automation of self-healing for target business failures.

[0052] In an optional embodiment, a knowledge graph is constructed based on alarm monitoring data, specifically including the following steps: First, entity extraction is performed on the alarm monitoring data to obtain entity nodes; Secondly, determine the relationships between each entity node and define these relationships as relationship edges. Secondly, based on the association relationships between each entity node, the weight of the relationship edge corresponding to that entity node is determined. Secondly, feature extraction is performed on the entity nodes to obtain the feature vectors of the entity nodes; Finally, the entity nodes, relation edges, the weights of relation edges, and the feature vectors of entity nodes are determined as the knowledge graph.

[0053] In the embodiments of this disclosure, the entity nodes in the knowledge graph include, but are not limited to: the device name of the target service, the object IP, and the service system; the relationship edges in the knowledge graph include, but are not limited to: the physical connection and service dependency between entity nodes; the weight of the relationship edges in the knowledge graph is used to indicate the fault propagation strength between the entity nodes connected by the relationship edge.

[0054] Here, entity nodes can be extracted from alarm monitoring data using a Named Entity Recognition (BERT-BiLSTM-CRF) model. These entity nodes can be device entities, business entities, or fault entities.

[0055] Here, the physical connection relationship or business dependency relationship between each entity node can also be extracted from the alarm monitoring data of the Named Entity Recognition Model (BERT-BiLSTM-CRF), and the above physical connection relationship or business dependency relationship can be identified as relationship edge.

[0056] Here, the weights of relation edges can be dynamically calculated using the TF-IDF (Term Frequency-Inverse Document Frequency) algorithm.

[0057] Here, feature extraction algorithms can be used to extract features from entity nodes, obtaining their feature vectors. For example, the feature vector of the i-th entity node in the target business is xi = [xi1, xi1, ..., xid], where xi1 - xi1... n This represents the metrics for the target entity, where abnormal metrics are assigned a value of 1, and non-abnormal metrics are assigned a value of 0. xi n+1 -xi d This is a BERT (Bidirectional Encoder Representations from Transformers) text embedding vector.

[0058] The feature vector of the entity node has a vector dimension of 768, that is, d=786.

[0059] In an optional embodiment, the weight of the relation edge corresponding to each entity node is determined based on the association relationship between the entity nodes, specifically including the following steps: First, determine the number of times the entity node appears in the alarm monitoring data and the number of alarms; Secondly, the importance coefficient of the entity node is determined based on the number of occurrences and the number of alarms; Secondly, determine the influence factor between the entity nodes associated with the entity node corresponding to the importance coefficient; whereby the influence factor is used to indicate the proportion of influence of an entity node relative to its associated entity nodes. Finally, based on the influence factor, the weights of the relation edges corresponding to the entity nodes are determined.

[0060] In the embodiments of this disclosure, the number of times an entity node appears in the alarm monitoring data and the number of alarms can be determined by searching the alarm monitoring data.

[0061] Here, it is also necessary to determine the total number of words in the alarm monitoring data (i.e., the number of entity nodes) and the total number of alarms (i.e., the number of failures in the target business).

[0062] Then, the importance coefficient of the entity node can be determined based on the number of times the entity node appears in the alarm monitoring data, the number of alarms, the total number of words in the alarm monitoring data, and the total number of alarms.

[0063] The importance coefficient BusinessCriticality(j) of the j-th entity node satisfies the following condition: BusinessCriticality(j)=(cj / c)×log(g / gj); Where cj is the number of times the j-th entity node appears, gj is the number of alarms for the entity node, c is the total number of words, and g is the total number of alarms.

[0064] After determining the importance coefficients of the entity nodes, the first learning parameter, the second learning parameter, and the third learning parameter can be determined.

[0065] Next, the frequency of co-occurrence between entity nodes that are associated with the aforementioned entity node and that entity node can be determined. Furthermore, the influence factor between entity nodes associated with the entity node corresponding to the importance coefficient can be determined.

[0066] Then, based on the parameters determined above, the weights of the relationship edges between entity nodes that are associated with the aforementioned entity nodes are calculated.

[0067] The weight wjk of the relationship edge between the j-th entity node and the k-th entity node that has an association with it satisfies the following condition: Wjk=α×CoOccur(j,k)+β×HistoryRoot(j,k)+γ×BusinessCriticality(j); Where α is the first learning parameter, β is the second learning parameter, γ is the third learning parameter, CoOccur(j,k) is the normalized value of the frequency of the j-th entity node and the k-th entity node appearing together in the alarm monitoring data, and HistoryRoot(j,k) is the proportion of the k-th entity node affected by the j-th entity node when the j-th entity node is the root cause node of the fault.

[0068] In the above implementation, since fault monitoring data shows that entities that frequently co-occur historically often have strong fault correlations, the impact of faults on some core business systems will be greater than that on non-core systems. Core business processes often include keywords such as activation, order processing, complaints, customer acquisition, and installation. Therefore, the importance coefficient of a business system can be dynamically calculated using the TF-IDF algorithm based on these core business keywords.

[0069] In an optional embodiment, the knowledge graph is processed to locate the root cause node of the fault to obtain the root cause node corresponding to the target service. The specific steps include the following: First, based on the knowledge graph, the influence weights between adjacent entity nodes are determined; Secondly, based on the influence weights, time-series feature determination processing is performed to obtain the failure probability of entity nodes; Finally, based on the failure probability and the impact weight, the failure initiation probability of an entity node is determined; whereby the failure initiation probability is used to indicate the probability that an entity node will cause other entity nodes to fail.

[0070] In embodiments of this disclosure, the knowledge graph can be input into the input layer of a T-GNN (emporal graph neural network).

[0071] Then, the influence weights between adjacent entity nodes can be determined through the graph attention layer of T-GNN (emporal graph neural network).

[0072] Here, for the graph attention layer, because the fault propagation range of the core device is large, it is necessary to quantify the influence weight of neighboring entity nodes on the current entity node.

[0073] The influence weight of the j-th entity node relative to its neighboring k-th entity node (i.e., the influence weight of the k-th entity node on the j-th entity node) αjk satisfies the following condition: αjk=(exp(ejk)) / (∑ (f∈N(j)) [exp(ejf)]); Where ejk is the feature matching degree between the j-th entity node and the k-th entity node, ejf is the feature matching degree between the j-th entity node and the f-th entity node, f∈N(j), and N(j) is the set of all neighboring nodes corresponding to the j-th entity node.

[0074] The feature matching degree ejk between the j-th entity node and the k-th entity node satisfies the following condition: eij=LeakyReLU(a T [Wxj||Wxk]); Where LeakyReLU() is the activation function, a is the attention vector, W is the trainable weight matrix, xj is the feature vector of the j-th entity node, xk is the feature vector of the k-th entity node, and || is the vector concatenation operation.

[0075] Here, after determining the influence weight of neighboring entity nodes on the current entity node, the influence weight can be input into the temporal convolutional layer of T-GNN (emporal graph neural network) for temporal feature determination processing to obtain the failure probability of the entity node.

[0076] After determining the failure probability of an entity node, the failure probability can be input into the root cause localization output layer of T-GNN (emporal graph neural network) for processing to determine the probability of failure initiation of the entity node.

[0077] Among them, the probability Ri of the failure of the j-th entity node caused by the failure of the k-th entity node that is related to it is... k Meets the following conditions: Ri k =sj+p∑ j∈Children(k) (Rk×Wjk); Where sj is the failure probability of the j-th entity node, Children(k) are the direct downstream entity nodes in the knowledge graph affected by the k-th entity node, Rk is the failure initiation probability of the k-th entity node, Wjk is the weight of the relationship edge between the j-th and k-th entity nodes, and p is the decay factor. Where p=0.8.

[0078] In the above implementation, the root cause node can be selected by calculating the probability of fault occurrence between each pair of entity nodes and selecting the entity node with the highest probability of fault occurrence as the root cause node of the target service.

[0079] In an optional embodiment, the failure probability of an entity node is obtained by determining the temporal features based on the influence weights, specifically including the following steps: First, the influence weights are activated using an activation function to obtain the fault association information of the entity nodes; Secondly, the temporal features of the fault association information are extracted by using a convolution function to obtain the temporal feature values ​​of the entity nodes; Finally, the temporal feature values ​​are processed by an activation function to obtain the failure probability of the entity node.

[0080] In the embodiments of this disclosure, the influence weights can be activated using the sigmoid activation function to obtain the fault association information of the entity nodes.

[0081] Among them, the fault association information hj of the j-th entity node meets the following conditions: hj=r[∑ k∈N(j) (αjk×Wxk)]; Where r is the normalized activation function, αjk is the influence weight of the j-th entity node relative to the adjacent k-th entity node, W is the learnable feature matrix, and xk is the feature vector of the k-th entity feature.

[0082] Subsequently, the temporal features of fault association information can be extracted through a temporal convolutional layer (i.e., one-dimensional convolution) to obtain the temporal feature values ​​of entity nodes.

[0083] Wherein, the temporal feature value h of the j-th entity node final j Meets the following conditions: h final j =TCN(hj(t-1), hj(t), hj(t+1)).

[0084] Next, the time-series feature values ​​can be activated to obtain the anomaly score of the entity node, i.e., the failure probability of the entity node. The failure probability sj of the j-th entity node satisfies the following condition: sj=q(u T ×h final j ), where q() is the activation function, sj∈[0,1], and the closer the failure probability is to 1, the higher the probability that the entity node will fail.

[0085] In the above implementation, since abnormal indicators may suddenly drop or increase within a certain period of time, it is necessary to extract the temporal features within the sliding window in order to capture the changing trend of abnormal indicators over time.

[0086] In an optional embodiment, determining the action value of each self-healing operation in the set of self-healing operations, and identifying the self-healing operation with the highest action value as the target self-healing operation for the root cause node of the fault, includes: First, the feature vectors corresponding to the root cause nodes of the faults are encoded to obtain the state vectors of the root cause nodes of the faults. Secondly, the action value of each operation is determined based on the state vector; Secondly, the causal loss and safety level of each self-healing operation are determined based on the state vector; whereby the causal loss is used to indicate the difference between the action value of the self-healing operation and the historical success rate of the self-healing operation. Finally, based on causal loss and safety level, it is determined whether the self-healing operation with the highest action value meets the preset safety conditions, and if the self-healing operation with the highest action value meets the preset safety conditions, the self-healing operation is identified as the target self-healing operation.

[0087] In the embodiments of this disclosure, the feature vector of the root cause node can be encoded by an MLP state encoder to obtain the state vector of the root cause node.

[0088] Wherein, the state vector S of the root cause node is... h Meets the following conditions: S h =MLP([xroot;NeighborStats;SLOStatus]); Where MLP() is the MLP state encoder function, xroot is the feature vector of the root cause node, NeighborStats is the average anomaly score of neighbor nodes in T-GNN, and SLOStatus is the SLO satisfaction of the target service.

[0089] Next, the type of the root cause node can be determined. This can be done through fault monitoring data. After determining the type of the root cause node, the self-healing operations under that type can be retrieved from the fault monitoring data to obtain the set of self-healing operations.

[0090] Then, the action value of each self-healing operation can be determined using the DQN algorithm. Specifically, the action value Q(S) corresponding to the a-th self-healing operation in the set of self-healing operations is... h a) Meets the following conditions: Q(S) h a) = W T a (s h )+ba; Among them, W a The learnable weight matrix corresponding to the self-healing operation 'a', (sh ) for s h The feature map is , where ba is the bias term of the self-healing operation a.

[0091] Then, based on the action value corresponding to each healing operation, the self-healing operation with the highest action value can be selected. For example, the self-healing operation with the highest action value, 'at', meets the following conditions: at=argmax a∈Avalid Q(S) h ,a); where argmax is the maximum value determination function and Avalid is the self-healing operation set.

[0092] After identifying the self-healing action with the highest value, a loss function for that action's value can be calculated. This loss function consists of causal loss and the degree of safety.

[0093] The loss function L of the action value total Meets the following conditions: L total =∑ a L causal +L safe ; Among them, L causal For the causal loss corresponding to this self-healing operation, L safe This represents the safety level corresponding to the self-healing operation.

[0094] Wherein, the causal loss L corresponding to this self-healing operation causal Meets the following conditions: L causal =∑ a ||Q DQN (s, a)-Q Prior (s, a)|| 2 ; Among them, Q DQN (s, a) represents the action value corresponding to the modified self-healing operation output by the DQN algorithm (i.e., the aforementioned Q(S)). h ,a)). Where, Q Prior (s, a) satisfies the following conditions: Q Prior (s, a) = Reward expected ×P(a works|RootType); Among them, Reward expected The historical average reward is given, and P(a works|RootType) is the probability of executing the self-healing operation corresponding to the type of the root cause node.

[0095] Here, the safety level L of this self-healing operation safe Meets the following conditions: Lsafe =∑ a∈Arisk (u×exp(Q(s,a))); in, Arisk This is a library of dangerous actions, where u is the penalty intensity coefficient. The penalty intensity coefficient is set to 10 by default, i.e., u = 10.

[0096] After determining the loss function of the self-healing operation with the highest action value, the safety level of the self-healing operation can be determined based on the loss function.

[0097] If the safety level is determined to be greater than the preset safety level threshold, the self-healing operation is determined to meet the preset safety conditions and is identified as the target self-healing operation; otherwise, a designated self-healing operation with an action value second only to the self-healing operation is identified, and the safety level of the designated self-healing operation is determined, until a target self-healing operation that meets the preset safety conditions is identified.

[0098] In the above implementation, by determining the safety level of the self-healing operation, high-risk, high-reward self-healing operations are avoided.

[0099] Based on the same inventive concept, this disclosure also provides a fault self-healing operation determination system corresponding to the fault self-healing operation determination method. Since the problem-solving principle of the system in this disclosure is similar to the fault self-healing operation determination method described above in this disclosure, the implementation of the system can refer to the implementation of the method, and the repeated parts will not be described again.

[0100] Reference Figure 2 The diagram shown is an architecture diagram of a fault self-healing operation determination system provided in this embodiment of the disclosure, including: a knowledge graph construction module, a root cause localization module, and a decision module; The knowledge graph construction module includes: a dependency extraction submodule, a weight calculation submodule, and a feature vector determination submodule.

[0101] The root cause localization module includes a fault root cause node localization submodule.

[0102] The decision-making module includes a self-healing operation selection submodule and a decision output submodule.

[0103] Here, the dependency extraction submodule is used to extract entities from alarm monitoring data to obtain entity nodes; determine the association relationships between each entity node, and define the association relationships as relationship edges. The weight calculation submodule is used to determine the weight of the relation edge corresponding to each entity node based on the association relationship between each entity node.

[0104] The feature vector determination submodule is used to extract features from entity nodes and obtain the feature vectors of the entity nodes.

[0105] The root cause node localization submodule is used to perform root cause node localization processing on the knowledge graph to obtain the root cause node corresponding to the target business.

[0106] The self-healing operation selection submodule is used to determine the action value of each self-healing operation in the self-healing operation set, and to determine the self-healing operation with the highest action value.

[0107] The decision output submodule is used to determine that if the safety level is greater than the preset safety level threshold, the self-healing operation meets the preset safety conditions and is identified as the target self-healing operation; otherwise, it determines the specified self-healing operation whose action value is second only to the self-healing operation and determines the safety level of the specified self-healing operation, until a target self-healing operation that meets the preset safety conditions is identified.

[0108] In actual operation, this embodiment has the following technical effects: reducing the workload of operation and maintenance personnel and promoting the development of a new "lights-out" operation and maintenance model. Compared with existing technologies, it is not limited to the deployment form of the software system. Whether it is a traditional virtual machine deployment or a containerized deployment under a cloud-native architecture, for repair operations such as middleware connection pools and configuration hot updates, as long as the corresponding fault monitoring data is supported as input, this embodiment can be used to determine the target self-healing operation.

[0109] Based on the same inventive concept, this disclosure also provides a fault self-healing operation determination device corresponding to the fault self-healing operation determination method. Since the principle of the device in this disclosure for solving the problem is similar to the fault self-healing operation determination method described above in this disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0110] Reference Figure 3 The diagram shown is a schematic of a fault self-healing operation determination device provided in an embodiment of this disclosure. The device includes: a construction unit 31, a positioning unit 32, a first determination unit 33, and a second determination unit 34; wherein: The construction unit 31 is used to acquire alarm monitoring data of the target business and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of the relationship edges, and the feature vectors of the entity nodes; The positioning unit 32 is used to perform fault root cause node positioning processing on the knowledge graph to obtain the fault root cause node corresponding to the target service; wherein, the fault root cause node is used to indicate the entity node in the target service that is prone to triggering a chain of faults. The first determining unit 33 is used to determine the set of self-healing operations corresponding to the root cause node of the fault; wherein the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold. The second determining unit 34 is used to determine the action value of each self-healing operation in the self-healing operation set, and to determine the self-healing operation with the highest action value as the target self-healing operation of the root cause node of the fault.

[0111] This embodiment constructs a knowledge graph containing entity nodes, relationship edges, and features based on alarm monitoring data, replacing traditional manual rule configuration. It can dynamically integrate fault association information of target business and avoid the shortcomings of rule-based configuration, which is limited to a single scenario and cannot adapt to complex business links.

[0112] By leveraging knowledge graphs to pinpoint root cause nodes, the system accurately identifies core nodes prone to triggering cascading failures, overcoming the limitations of traditional methods that rely solely on simple actions triggered by alarm events. Furthermore, by filtering high-success-rate self-healing operations based on root cause nodes and selecting the optimal operation through action value, the system achieves dynamic adaptation of the self-healing decision library (matching root cause types without manual intervention). This avoids the passive and technically simplistic nature of self-healing operations, improving the accuracy and automation of self-healing for target business failures.

[0113] The processing flow of each module in the device and the interaction flow between each module can be referred to the relevant descriptions in the above method embodiments, and will not be detailed here.

[0114] Corresponding to Figure 1 The present disclosure also provides an electronic device 400, such as a method for determining the fault self-healing operation. Figure 4 The diagram shown is a structural schematic of an electronic device 400 provided in an embodiment of this disclosure, including: The system includes a processor 41, a memory 42, and a bus 43. The memory 42 stores execution instructions and includes main memory 421 and external memory 422. The main memory 421, also called internal memory, temporarily stores the computational data in the processor 41, as well as data exchanged with external memory such as a hard disk. The processor 41 exchanges data with the external memory 422 through the main memory 421. When the electronic device 400 is running, the processor 41 communicates with the memory 42 through the bus 43, causing the processor 41 to execute the following instructions: Acquire alarm monitoring data of the target business, and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of the relationship edges, and the feature vectors of the entity nodes; The knowledge graph is processed to locate the root cause of the fault, thereby obtaining the root cause of the fault corresponding to the target service; wherein, the root cause of the fault is used to indicate the entity nodes in the target service that are prone to triggering a chain of faults. Determine the set of self-healing operations corresponding to the root cause node of the fault; wherein the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold. Determine the action value of each self-healing operation in the set of self-healing operations, and identify the self-healing operation with the highest action value as the target self-healing operation for the root cause node of the fault.

[0115] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0116] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0117] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0118] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0119] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0120] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0121] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for determining a fault self-healing operation, characterized in that, include: Acquire alarm monitoring data of the target business, and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of the relationship edges, and the feature vectors of the entity nodes; The knowledge graph is processed to locate the root cause of the fault, thereby obtaining the root cause of the fault corresponding to the target service; wherein, the root cause of the fault is used to indicate the entity nodes in the target service that are prone to triggering a chain of faults. Determine the set of self-healing operations corresponding to the root cause node of the fault; wherein the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold. Determine the action value of each self-healing operation in the set of self-healing operations, and identify the self-healing operation with the highest action value as the target self-healing operation for the root cause node of the fault.

2. The method as described in claim 1, characterized in that, The construction of the knowledge graph based on the alarm monitoring data includes: Entity extraction is performed on the alarm monitoring data to obtain entity nodes; Determine the association relationships between each of the entity nodes, and define the association relationships as the relationship edges; Based on the association relationships between the entity nodes, the weight of the relationship edge corresponding to the entity node is determined based on the association relationships; Feature extraction is performed on the entity node to obtain the feature vector of the entity node; The entity node, the relation edge, the weight of the relation edge, and the feature vector of the entity node are determined as the knowledge graph.

3. The method as described in claim 2, characterized in that, The step of determining the weight of the relation edge corresponding to each entity node based on the association relationship between the entity nodes includes: Determine the number of times the entity node appears and the number of alarms in the alarm monitoring data; The importance coefficient of the entity node is determined based on the occurrence frequency and alarm frequency. Determine the influence factor between entity nodes associated with the entity node corresponding to the importance coefficient; wherein the influence factor is used to indicate the proportion of influence of the entity node relative to the associated entity nodes; Based on the aforementioned influence factor, the weights of the relation edges corresponding to the entity nodes are determined.

4. The method as described in claim 1, characterized in that, The step of performing fault root cause node localization processing on the knowledge graph to obtain the fault root cause node corresponding to the target service includes: Based on the knowledge graph, the influence weights between adjacent entity nodes are determined; Based on the influence weights, time-series feature determination processing is performed to obtain the failure probability of the entity node; Based on the failure probability and the influence weight, the failure initiation probability of the entity node is determined; wherein, the failure initiation probability is used to indicate the probability that the entity node causes other entity nodes to fail.

5. The method as described in claim 4, characterized in that, The process of determining the failure probability of the entity node based on the influence weights and time-series features includes: The influence weights are activated using an activation function to obtain the fault association information of the entity node. Temporal feature extraction of the fault association information is performed using a convolution function to obtain the temporal feature values ​​of the entity nodes; The failure probability of the entity node is obtained by processing the temporal feature value through an activation function.

6. The method as described in claim 1, characterized in that, The step of determining the action value of each self-healing operation in the self-healing operation set, and identifying the self-healing operation with the highest action value as the target self-healing operation for the root cause node of the fault, includes: Encode the feature vector corresponding to the root cause node of the fault to obtain the state vector of the root cause node of the fault. The action value of each self-healing operation is determined based on the state vector. The causal loss and safety level of each self-healing operation are determined based on the state vector; wherein the causal loss is used to indicate the difference between the action value of the self-healing operation and the historical success rate of the self-healing operation. Based on the causal loss and the safety level, it is determined whether the self-healing operation with the highest action value meets the preset safety conditions, and if the self-healing operation with the highest action value meets the preset safety conditions, the self-healing operation is determined as the target self-healing operation.

7. A device for determining self-healing operation, characterized in that, include: A construction unit is used to acquire alarm monitoring data of the target business and construct a knowledge graph based on the alarm monitoring data; wherein, the knowledge graph includes entity nodes, relationship edges, the weights of the relationship edges, and the feature vectors of the entity nodes; The positioning unit is used to perform fault root cause node positioning processing on the knowledge graph to obtain the fault root cause node corresponding to the target service; wherein, the fault root cause node is used to indicate the entity node in the target service that is prone to triggering a chain of faults. The first determining unit is used to determine the set of self-healing operations corresponding to the root cause node of the fault; wherein the success rate of the self-healing operations in the set of self-healing operations is greater than a preset success rate threshold. The second determining unit is used to determine the action value of each self-healing operation in the self-healing operation set, and to determine the self-healing operation with the highest action value as the target self-healing operation of the root cause node of the fault.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method for determining the fault self-healing operation according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the method for determining the fault self-healing operation as described in any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the method for determining the fault self-healing operation as described in any one of claims 1 to 6.

Images