Fault root cause positioning method, device, equipment and readable storage medium

Abstract

The application discloses a fault root cause positioning method, device, equipment and readable storage medium, the method comprises determining a plurality of source abnormal characteristics; acquire the field knowledge graph; retrieve analysis basis from the field knowledge graph; utilize the preliminary screening layer, combine the analysis basis to carry out root cause tracing, generate root cause reasoning process and reasoning complexity score; when the reasoning complexity score is lower than the complexity threshold, the conclusion generation layer is utilized to generate the root cause analysis report; when the reasoning complexity score is not lower than the complexity threshold, the deep reasoning layer is called to carry out deep causal reasoning, generate reasoning train of thought and root cause propagation path; the conclusion generation layer is utilized, and the root cause analysis report is generated based on the reasoning train of thought and the root cause propagation path. It can be seen that the application can improve the reasoning efficiency and the fault root cause positioning rate through the hierarchical reasoning architecture and the field knowledge graph, clearly present the reasoning train of thought of different difficulty faults, and improve the credibility and verifiability of various fault root cause positioning conclusions.

Description

Technical Field

[0001] This application relates to the field of fault handling technology, and more specifically, to a fault root cause localization method, apparatus, device, and readable storage medium. Background Technology

[0002] With the rapid development of industrial digitalization and cloud-native IT architecture, industrial equipment is iterating towards larger scale, greater complexity, and higher intelligence, while IT systems are evolving towards microservices, distributed systems, and cloud-edge-device collaboration. Under this trend, equipment and system operation monitoring and root cause analysis have become core components for ensuring production continuity and business stability.

[0003] Currently, root cause analysis primarily employs a combination of manual investigation and large-scale model analysis. However, large-scale models inherently possess black-box reasoning characteristics, leading to a lack of traceability in the root cause analysis process. To avoid delays in fault handling due to root cause localization bias, maintenance personnel must first verify the rationality of the large-scale model's reasoning logic before adopting its output conclusions. This additional verification step significantly reduces the overall efficiency of fault localization. Therefore, how to generate traceable root cause analysis conclusions has become a pressing technical problem for those skilled in the art. Summary of the Invention

[0004] In view of this, this application provides a method, apparatus, device and readable storage medium for locating the root cause of a fault, in order to overcome the lack of traceability in existing root cause analysis techniques.

[0005] To achieve the above objectives, the following solution is proposed:

[0006] A method for locating the root cause of a fault includes:

[0007] Identify the characteristics of multi-source anomalies;

[0008] Acquire a domain knowledge graph and a hierarchical reasoning architecture that includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer;

[0009] Retrieve analytical basis from the domain knowledge graph that matches the multi-source anomaly features;

[0010] Using the preliminary screening layer and the analytical basis, the root causes of the multi-source abnormal features are traced, and the root cause reasoning process and reasoning complexity score are generated.

[0011] When the reasoning complexity score is lower than the preset complexity threshold, the conclusion generation layer is used to combine the root cause reasoning process and the analysis basis to generate a root cause analysis report containing a visualized reasoning logic chain.

[0012] When the reasoning complexity score is not lower than the complexity threshold, the deep reasoning layer is invoked, and deep causal reasoning is performed on the multi-source abnormal features in combination with the root cause reasoning process and the analysis basis to generate reasoning ideas and root cause propagation paths; using the conclusion generation layer, a root cause analysis report containing a visualized reasoning logic chain is generated based on the reasoning ideas and the root cause propagation paths.

[0013] Optionally, obtain the domain knowledge graph, including:

[0014] By combining semantic matching, node mapping, and timestamp matching, data alignment is performed on historical log data, time-series index data, historical fault cases, structured and standardized data, transmission link data, and expanded rare fault data to determine the operational characteristics of nodes in different domains under normal operating conditions, as well as the fault characteristics and handling methods under different fault types.

[0015] For each domain node, based on the operational representation of the domain node and the fault representation and handling methods under different fault types, multiple entities, multiple relationships and multiple attributes matching the domain node are generated; based on each relationship corresponding to each entity and the attribute corresponding to the relationship, multiple analysis triples corresponding to the domain node are constructed.

[0016] Based on each analytical triple, the domain knowledge graph is constructed.

[0017] Optionally, constructing the domain knowledge graph based on each analysis triple includes:

[0018] Each entity and its corresponding relationship are converted into a vector representation, and the corresponding knowledge association information is incorporated to generate a structured triple.

[0019] Based on the contribution of different sources to the root cause localization of the fault, the weight coefficient corresponding to each source is determined.

[0020] Determine the weight coefficients corresponding to each structured triple and each analytical triple, and construct a domain knowledge graph.

[0021] Optionally, the domain knowledge graph contains multiple triples derived from multi-source heterogeneous data, and each triple contains a corresponding entity, a corresponding relation, and corresponding attribute data;

[0022] The analytical basis for retrieving the multi-source anomaly features from the domain knowledge graph includes:

[0023] The multi-source anomaly features are analyzed to generate fault analysis prompts containing fault analysis task requirements and causal reasoning rules.

[0024] Retrieve multiple target triples that match the multi-source anomaly features from the domain knowledge graph;

[0025] The target triples and the fault analysis prompts are cleaned and merged to generate the analysis basis.

[0026] Optionally, the invocation of the deep inference layer, combined with the root cause reasoning process and the analysis basis, to perform deep causal reasoning on the multi-source abnormal features, generating reasoning ideas and root cause propagation paths, includes:

[0027] Based on the inference complexity score and the current remaining computing resources, predict the inference delay for different inference layers of the multi-source anomaly features;

[0028] Based on the response speed requirements of the multi-source anomaly features and the various inference delays, the number of target inference layers corresponding to the multi-source anomaly features is determined.

[0029] Multiple inference layers matching the number of the target inference layers are invoked in the deep inference layer. Combined with the root cause inference process and the analysis basis, deep causal inference is performed on the multi-source abnormal features to generate inference ideas and root cause propagation paths.

[0030] Optionally, the analysis basis includes multiple triplet entities; each triplet entity corresponds to a weight coefficient that characterizes its contribution to fault root cause localization.

[0031] The process involves calling multiple inference layers in the deep inference layer that match the number of target inference layers, combining the root cause reasoning process and the analysis basis, to perform deep causal reasoning on the multi-source anomaly features, generating reasoning ideas and root cause propagation paths, including:

[0032] Multiple inference layers in the deep inference layer that match the number of target inference layers are invoked, and each triplet subject and the multi-source anomaly features are analyzed according to the corresponding weight coefficients from large to small to generate an anomaly subject containing anomaly nodes and / or anomaly types.

[0033] Based on the multi-source anomaly features, combined with the anomaly subject, the analysis basis, and the domain knowledge graph, causal reasoning generates the root cause distribution probability and propagation path;

[0034] Based on the root cause reasoning process, the root cause distribution probability is verified;

[0035] After the verification is passed, the analysis basis, the abnormal subject, the root cause distribution probability and the propagation link are integrated to form the reasoning idea and the root cause propagation path.

[0036] Optionally, the step of using the conclusion generation layer to generate a root cause analysis report containing a visualized reasoning logic chain, based on the reasoning logic and the root cause propagation path, includes:

[0037] The root cause propagation path and reasoning logic are converted into visual graphics;

[0038] Based on the root cause propagation path and the domain knowledge graph, the processing scheme and standard basis are determined;

[0039] The visualization graphics, the processing scheme, and the standard criteria are processed to generate a visualized root cause analysis report.

[0040] A root cause location device for a fault includes:

[0041] The determination module is used to determine the characteristics of multi-source anomalies;

[0042] The acquisition module is used to acquire the domain knowledge graph and the hierarchical reasoning architecture, which includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer.

[0043] The retrieval module is used to retrieve analytical basis that matches the multi-source anomaly features from the domain knowledge graph;

[0044] The generation module is used to use the preliminary screening layer and the analysis basis to trace the root causes of the multi-source abnormal features, generate the root cause reasoning process and reasoning complexity score; when the reasoning complexity score is lower than the preset complexity threshold, the combination module is called; when the reasoning complexity score is not lower than the complexity threshold, the reasoning module is called.

[0045] The module is used to generate a root cause analysis report containing a visualized reasoning logic chain by combining the conclusion generation layer with the root cause reasoning process and the analysis basis.

[0046] The reasoning module is used to call the deep reasoning layer, combine the root cause reasoning process and the analysis basis, perform deep causal reasoning on the multi-source abnormal features, and generate reasoning ideas and root cause propagation paths; using the conclusion generation layer, based on the reasoning ideas and root cause propagation paths, a root cause analysis report containing a visualized reasoning logic chain is generated.

[0047] A fault root cause location device includes a memory and a processor;

[0048] The memory is used to store programs;

[0049] The processor is used to execute the program to implement the various steps of the above-described fault root cause localization method.

[0050] A readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described root cause localization method.

[0051] As can be seen from the above technical solutions, the fault root cause localization method provided in this application can determine multi-source abnormal features; acquire a domain knowledge graph and a hierarchical reasoning architecture including a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer; and retrieve analytical basis matching the multi-source abnormal features from the domain knowledge graph. Therefore, this application can combine a domain knowledge graph and multi-dimensional abnormal signals to avoid the one-sidedness of root cause analysis caused by a single abnormal feature, while quickly finding relevant data, reducing reasoning redundancy, and solving the problem of lacking clear knowledge basis for large model reasoning. This application utilizes the preliminary screening layer, combined with the analytical basis, to determine the root cause of the multi-source abnormal features. The system traces and generates root cause reasoning processes and reasoning complexity scores, enabling rapid root cause localization of simple faults and outputting traceable reasoning processes. Specific scores quantify reasoning difficulty, facilitating tiered fault handling and improving processing efficiency. When the reasoning complexity score is below a preset complexity threshold, the system utilizes the conclusion generation layer, combined with the root cause reasoning process and analytical basis, to generate a root cause analysis report containing a visualized reasoning logic chain. This outputs intuitive and traceable root cause analysis results. Simultaneously, the visualized chain presents the reasoning logic, guiding maintenance personnel to quickly understand and check the reasoning logic without requiring additional, more complex verification, thus improving fault location efficiency and conclusion reliability. This application, when the reasoning complexity score is not lower than the complexity threshold, invokes the deep reasoning layer to perform deep causal reasoning on the multi-source anomaly features, combining the root cause reasoning process and the analysis basis, generating reasoning ideas and root cause propagation paths; using the conclusion generation layer, based on the reasoning ideas and root cause propagation paths, it generates a root cause analysis report containing a visualized reasoning logic chain; it can deeply decompose complex faults, deeply analyze the propagation path and causal relationship of root causes, overcome the limitations of preliminary screening, solve the problem of difficult accurate location of the root cause of complex faults, and ensure the credibility of the root cause analysis of complex faults. It is evident that this application, through a layered reasoning architecture, can achieve rapid location of simple faults and hierarchical control of in-depth analysis of complex faults. Regardless of whether the fault is simple or complex, this application provides reasoning links and analysis basis; thus, while improving reasoning efficiency and fault root cause location speed, it clearly presents the reasoning ideas for faults of different difficulty, facilitating maintenance personnel to trace the entire reasoning process and improving the credibility and verifiability of various fault root cause location conclusions. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0053] Figure 1 This is a flowchart of a fault root cause localization method disclosed in an embodiment of this application;

[0054] Figure 2 This is a structural block diagram of a fault root cause localization device disclosed in an embodiment of this application;

[0055] Figure 3 This is a hardware structure block diagram of a fault root cause localization device disclosed in an embodiment of this application. Detailed Implementation

[0056] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] This application provides a fault root cause localization method, which can be applied to various management systems or maintenance systems, as well as to various computer terminals or smart terminals. The executing entity can be the processor or server of the computer terminal or smart terminal.

[0058] Next, combine Figure 1 The fault root cause localization method of this application is described in detail, including the following steps:

[0059] Step S1: Determine the characteristics of multi-source anomalies.

[0060] Specifically, it can acquire multi-dimensional monitoring data, such as operating parameters, operating logs, network traffic, etc., and perform real-time analysis and comparison of the multi-dimensional monitoring data. Using preset parameter ranges or machine learning algorithms, it can identify abnormal features that deviate from the normal state, integrate all abnormal features, and form multi-source abnormal features.

[0061] Step S2: Obtain the domain knowledge graph and the hierarchical reasoning architecture, which includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer.

[0062] Specifically, a domain knowledge graph can be constructed by collecting multi-source heterogeneous data from the same domain subject, such as equipment manuals, operation and maintenance records, expert experience, historical log data, time series indicator data, historical fault cases, structured and standardized data, transmission link data and rare fault data, and then performing data cleaning, entity recognition and relationship extraction.

[0063] The main entities in this field can be IT systems, cloud-native environments, and industrial systems that require operational monitoring.

[0064] The initial screening layer can be composed of lightweight models such as DistilBERT or lightweight TCN;

[0065] Deep inference layers can be constructed from large models such as the GPT series and multimodal large models;

[0066] The conclusion generation layer can consist of visualization tools and natural language generation models.

[0067] Step S3: Retrieve analytical basis matching the multi-source anomaly features from the domain knowledge graph.

[0068] Specifically, retrieval enhancement techniques can be used to retrieve analytical evidence from the domain knowledge graph that has a similarity to multi-source anomaly features exceeding a preset similarity threshold.

[0069] Step S4: Using the preliminary screening layer and the analysis basis, perform root cause tracing on the multi-source abnormal features to generate a root cause reasoning process and a reasoning complexity score; when the reasoning complexity score is lower than a preset complexity threshold, execute step S5; when the reasoning complexity score is not lower than the complexity threshold, execute step S6.

[0070] Specifically, the analytical basis and multi-source anomaly characteristics can be input into the preliminary screening layer to trace the root causes of the multi-source anomaly characteristics. During the tracing process, the reasoning basis and reasoning steps of each step are recorded to form the root cause reasoning process.

[0071] The preliminary screening layer assesses the complexity of the reasoning process based on factors such as the number of abnormal features involved and the complexity of the reasoning, generating a reasoning complexity score. If the reasoning complexity score is lower than a preset complexity threshold, the fault is relatively simple, and the process can proceed directly to step S5; if the reasoning complexity score is not lower than the preset complexity threshold, the fault is relatively complex, and the process can proceed to step S6.

[0072] For example, if the root cause is located by analyzing obvious threshold breakthroughs in multi-source anomaly features or by analyzing explicit fault keywords in log data from multi-source heterogeneous features, then the reasoning complexity score can be set below the complexity threshold.

[0073] If the fault characteristics caused by multiple faults are obtained by reasoning based on the multi-source anomaly features and analysis, then the reasoning complexity score can be set higher than the complexity threshold.

[0074] Step S5: Using the conclusion generation layer in conjunction with the root cause reasoning process and the analysis basis, generate a root cause analysis report containing a visualized reasoning logic chain.

[0075] Specifically, the reasoning basis and steps of each step in the root cause reasoning process can be organized and combined with the analysis basis to form a logical chain of reasoning;

[0076] Visualization tools can be used to present the reasoning logic in a graphical way, such as drawing flowcharts or cause-and-effect diagrams, making the reasoning process more intuitive and clear.

[0077] By using a natural language generation model, the logical reasoning chain is transformed into a natural language description, which is added next to the visualization graphics to form detailed annotations and generate a root cause analysis report.

[0078] Step S6: Invoke the deep reasoning layer, combine the root cause reasoning process and the analysis basis to perform deep causal reasoning on the multi-source abnormal features, and generate reasoning ideas and root cause propagation paths; use the conclusion generation layer to generate a root cause analysis report containing a visualized reasoning logic link based on the reasoning ideas and the root cause propagation paths.

[0079] Specifically, the root cause reasoning process, multi-source abnormal features, and analytical basis can be input into the deep reasoning layer to deeply mine and analyze the causal relationships between multi-source abnormal features, sort out the causal chain between multi-source abnormal features, and generate root cause propagation paths and reasoning ideas.

[0080] After generating the reasoning logic and root cause propagation path, it is passed to the conclusion generation layer.

[0081] The conclusion generation layer transforms the root cause propagation path into a visual graph. For example, the root cause can be the root node, and other faults involved in the root cause propagation path can be the child nodes. Based on the analysis, the multi-source anomaly characteristics are matched with each node to generate a fault tree. Visual graphs such as indicator trend comparison charts can also be generated.

[0082] Domain knowledge graphs can contain a wealth of professional knowledge and experience. By analyzing the root cause propagation path, the best solution and corresponding standards for the fault can be found in the domain knowledge graph.

[0083] Based on multi-source anomaly features, reasoning logic links, and enhanced feedback data from human-machine collaboration, a closed-loop optimization data is formed, enabling dual iterative optimization of the hierarchical reasoning architecture and the domain knowledge graph. On one hand, the domain knowledge graph is iteratively updated through the knowledge graph update formula, providing more accurate domain knowledge constraints for causal reasoning and the dynamic hierarchical reasoning architecture. On the other hand, based on the optimized multi-source anomaly features and enhanced feedback data, the hierarchical reasoning model is incrementally fine-tuned, iteratively optimizing the parameters of the lightweight and large models, adjusting the weight coefficients of each reasoning layer, and optimizing the RAG retrieval strategy and chained reasoning prompt template. Each round of fault root cause analysis application and model optimization forms a closed-loop iteration, allowing the model to continuously absorb new fault cases and new operation and maintenance specifications in practical applications, gradually improving its performance.

[0084] The formula for updating a knowledge graph can be as follows:

[0085] ;

[0086] In the formula, The state of the domain knowledge graph at time t includes core entities such as devices, components, and faults, as well as their relationships and attribute sets, which can form a complete knowledge chain of device-fault characteristics-root cause-operation and maintenance specifications. For knowledge update actions, this includes adding new entities such as new industrial sensors and cloud-native container components, correcting relationships such as updating the correspondence between new fault types and root causes, and supplementing attributes such as adding equipment fault threshold parameters. The knowledge consistency verification reward function is based on logical constraints and professional knowledge in the field of fault analysis. It verifies the rationality of the updated content, such as avoiding conflicts between fault thresholds and operation and maintenance specifications. If it conforms to the logic, a positive reward is given; otherwise, the update is inhibited. To update the step size, a value of 0.02 to 0.06 is used. To balance the speed and stability of knowledge updates, a value of 0.04 is preferred.

[0087] Enhanced feedback data can include the accuracy, completeness, and rationality assessments of the interpretability of the reasoning results output by the layered reasoning architecture by operations and maintenance personnel, as well as the correction and supplementary operations by operations and maintenance personnel, including root cause localization correction, reasoning logic supplementation, processing suggestion optimization, and standard basis improvement.

[0088] The evaluation will be conducted from the dimensions of root cause identification accuracy, logical reasoning rationality, feasibility of treatment suggestions, and accuracy of normative basis;

[0089] The evaluation and correction information of operation and maintenance personnel can be structured and labeled to form a reinforced feedback dataset that includes model inference results, human evaluation, and human correction results.

[0090] New fault associations, new domain knowledge such as new fault types, fault characteristics of new equipment or components, and new root causes of faults discovered during the model inference process can be combined with reinforcement feedback data verified by operation and maintenance personnel and reward values ​​generated based on the optimization conclusions of reinforcement feedback results to update the domain knowledge graph. This ensures that the updated knowledge conforms to the professional logic of fault analysis and actual operation and maintenance needs, enriches the fault knowledge base, and provides more comprehensive knowledge support for subsequent model training.

[0091] As can be seen from the above technical solutions, the fault root cause localization method provided in this application can determine multi-source abnormal features; acquire a domain knowledge graph and a hierarchical reasoning architecture including a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer; and retrieve analytical basis matching the multi-source abnormal features from the domain knowledge graph. Therefore, this application can combine a domain knowledge graph and multi-dimensional abnormal signals to avoid the one-sidedness of root cause analysis caused by a single abnormal feature, while quickly finding relevant data, reducing reasoning redundancy, and solving the problem of lacking clear knowledge basis for large model reasoning. This application utilizes the preliminary screening layer, combined with the analytical basis, to determine the root cause of the multi-source abnormal features. The system traces and generates root cause reasoning processes and reasoning complexity scores, enabling rapid root cause localization of simple faults and outputting traceable reasoning processes. Specific scores quantify reasoning difficulty, facilitating tiered fault handling and improving processing efficiency. When the reasoning complexity score is below a preset complexity threshold, the system utilizes the conclusion generation layer, combined with the root cause reasoning process and analytical basis, to generate a root cause analysis report containing a visualized reasoning logic chain. This outputs intuitive and traceable root cause analysis results. Simultaneously, the visualized chain presents the reasoning logic, guiding maintenance personnel to quickly understand and check the reasoning logic without requiring additional, more complex verification, thus improving fault location efficiency and conclusion reliability. This application, when the reasoning complexity score is not lower than the complexity threshold, invokes the deep reasoning layer to perform deep causal reasoning on the multi-source anomaly features, combining the root cause reasoning process and the analysis basis, generating reasoning ideas and root cause propagation paths; using the conclusion generation layer, based on the reasoning ideas and root cause propagation paths, it generates a root cause analysis report containing a visualized reasoning logic chain; it can deeply decompose complex faults, deeply analyze the propagation path and causal relationship of root causes, overcome the limitations of preliminary screening, solve the problem of difficult accurate location of the root cause of complex faults, and ensure the credibility of the root cause analysis of complex faults. It is evident that this application, through a layered reasoning architecture, can achieve rapid location of simple faults and hierarchical control of in-depth analysis of complex faults. Regardless of whether the fault is simple or complex, this application provides reasoning links and analysis basis; thus, while improving reasoning efficiency and fault root cause location speed, it clearly presents the reasoning ideas for faults of different difficulty, facilitating maintenance personnel to trace the entire reasoning process and improving the credibility and verifiability of various fault root cause location conclusions.

[0092] In some embodiments of this application, the process of obtaining the domain knowledge graph in step S2 is described in detail, and the steps are as follows:

[0093] S20. Combining semantic matching, node mapping, and timestamp matching, perform data alignment on historical log data, time-series indicator data, historical fault cases, structured and standardized data, transmission link data, and expanded rare fault data to determine the operational characteristics of nodes in different domains under normal operating conditions, and the fault characteristics and handling methods under different fault types.

[0094] Specifically, it can collect full operational data for three consecutive months, including historical log data, time-series indicator data, transmission link data, historical fault cases, structured and standardized data, and expanded rare fault data.

[0095] Historical log data includes application logs of microservice components, system kernel logs, and access logs, all uniformly converted to JSON format. Fields include log timestamp, service name, log level, log content, and host IP.

[0096] The time-series metrics data cover CPU utilization, memory usage, disk I / O, network bandwidth, API call volume, API response time, database connection count, cache hit rate, etc. The data is collected once every 10 seconds and stored in the InfluxDB time-series database in TSDB format.

[0097] Transmission link data can be collected using the SkyWalking link tracing tool, and may include microservice call link data, which includes service call relationships, call time, and call status, in the Neo4j graph data format.

[0098] Structured and standardized data may include cloud-native operation and maintenance specifications and IT system fault judgment standards, and structured extraction of fields such as clause number, fault judgment standards, operation and maintenance requirements, and applicable scenarios;

[0099] Historical failure cases can include historical failure data of the relevant domain subject over the past year, covering various failure types such as service call timeout, database deadlock, network latency, cache breakdown, container escape, and distributed deadlock. Each historical failure data is accompanied by human root cause analysis opinions and failure handling process records.

[0100] It is possible to formulate and implement unified standards for data from multiple disciplines. For example, time-series indicator data can be uniformly formatted as TSDB, with unified timestamps in UTC, indicator precision retained to two decimal places, and missing data marked as NaN;

[0101] Historical log data can be uniformly formatted as JSON, with uniform field naming conventions such as log timestamp (log_time) and service name (service_name), and invalid characters such as special symbols and garbled characters should be removed.

[0102] Transmission link data can uniformly adopt the Neo4j graph data format, with node labels set to Service, Host, and Database; edge labels set to Call and Depend; attributes include call duration and call frequency.

[0103] Structured specification data can be uniformly formatted as CSV, with fields including clause number (clause_id), fault type (fault_type), fault judgment standard (judge_standard), and operation requirement (operation_requirement).

[0104] Historical log data and time series metrics data can be deduplicated according to the format of timestamp + service name + core content; transmission link data can be deduplicated according to the format of caller + callee + timestamp.

[0105] KNN interpolation is used to fill missing values. Missing key fields such as service name and log content in historical log data are directly deleted. The 3σ criterion is used to filter out outliers for data cleaning in time series index data. The keyword matching method is used to filter out abnormal logs in historical log data. The time series index data is standardized using Min-Max, and the values ​​are mapped to the [0,1] interval to ensure that indicators of different magnitudes can be calculated together.

[0106] For 11 rare fault data types, such as distributed deadlock, container escape, and cache breakdown, four data augmentation methods can be used to expand the dataset and solve the problem of small sample training: ① Log semantic augmentation: Using synonym replacement, sentence transformation, and context supplementation, the semantics of fault logs are augmented. For example, "database deadlock caused service unavailability" is augmented to "the database experienced a deadlock exception, unable to process requests normally, resulting in the unavailability of related business services." Each rare fault log is augmented to generate 10 similar logs; ② Metric data interpolation: A combination of linear interpolation and cubic spline interpolation is used. The method involves: ① Interpolating and expanding the time-series indicator data of rare faults. For example, if the indicator data of a rare fault only has 10 time points, it can be interpolated and expanded to 50 time points while preserving the abnormal trend of the indicator; ② Link topology disturbance: On the basis of the original link topology, the link call relationship is slightly adjusted, such as adding secondary call nodes and adjusting the call time, to generate similar link data. Five disturbance links are generated for each rare fault link data; ③ Fault case synthesis: Based on the fault characteristics and root cause correspondence of existing fault cases, generative AI such as DistilGPT-2 is used to synthesize new fault cases.

[0107] Semantic matching, through natural language processing techniques, can analyze the semantic similarity of textual information in a dataset and associate semantically similar information. The dataset consists of historical log data, time-series indicator data, historical fault cases, structured and standardized data, transmission link data, and expanded rare fault data.

[0108] Node mapping, on the other hand, uses node information in a dataset to map nodes representing the same or related entities in different datasets. For example, it maps service names in historical log data to service nodes in transmission link data, allowing for a clear understanding of the service's performance at different data layers.

[0109] Timestamp matching is a chronological method that allows data within the same time frame to be correlated. For example, time-series metrics data from the same moment can be linked with historical log data to provide a comprehensive understanding of the system's operational status at that time.

[0110] Data alignment can determine the operational characteristics of nodes in different domains under normal operating conditions, and also clarify the fault characteristics and handling methods of nodes in different domains under different fault types.

[0111] Different domain entities correspond to different domain nodes. For example, the domain nodes of an IT system can be servers, databases, network devices, etc.; the domain nodes in a cloud-native environment can be containers, Pods, services, etc.

[0112] S21. For each domain node, based on the operational representation of the domain node and the fault representation and handling methods under different fault types, generate multiple entities, multiple relationships and multiple attributes matching the domain node; based on each relationship corresponding to each entity and the attribute corresponding to the relationship, construct multiple analysis triples corresponding to the domain node.

[0113] Specifically, each entity may include fault type, fault characteristics, operation and maintenance specifications, root causes, etc.

[0114] Each relationship may include microservice component - fault characteristics, fault type - root cause, fault - operation and maintenance specification constraints, and fault characteristics - root cause, etc.

[0115] Different entities can correspond to different attributes. For example, the attribute of a fault type is the fault level, the attribute of a fault characteristic can be the indicator threshold, and the attribute of an operation and maintenance specification can be the scope of application and operation steps, etc.

[0116] S22. Construct the domain knowledge graph based on each analysis triple.

[0117] Specifically, the analysis triples corresponding to each domain node can be integrated to form a domain knowledge graph according to the data transmission link.

[0118] As can be seen from the above technical solution, this embodiment provides an optional method for obtaining a domain knowledge graph. Using this method, a comprehensive and accurate structured domain knowledge graph can be constructed using multi-source data.

[0119] In some embodiments of this application, the process of constructing the domain knowledge graph based on each analysis triplet is described in detail, and the steps are as follows:

[0120] S220. Convert each entity and its corresponding relationship into a vector representation, incorporate the corresponding knowledge association information, and generate a structured triplet.

[0121] Specifically, each entity and its corresponding relationship can be converted into a vector representation, and the association knowledge in the corresponding equipment manual, expert experience and structured specification data can be integrated to generate structured triples.

[0122] S221. Based on the contribution of different sources to the root cause localization of the fault, determine the weight coefficient corresponding to each source.

[0123] Specifically, weight coefficients can be determined for dimensions such as fused data, equipment manuals, operation and maintenance records, expert experience, historical log data, time-series indicator data, historical fault cases, structured and standardized data, transmission link data, and rare fault data.

[0124] S222. Determine the weight coefficients corresponding to each structured triple and each analytical triple, and construct a domain knowledge graph.

[0125] Specifically, the target source of each analytical triple can be determined, and the weight coefficient corresponding to that target source can be determined. Based on the weight coefficient of the fused data corresponding to each structured triple, a domain knowledge graph can be constructed.

[0126] The weight coefficient of each structured triple can range from [0.4, 0.6], with 0.6 being the preferred value to balance the fusion ratio of multimodal data features and structured knowledge.

[0127] As can be seen from the above technical solution, this embodiment provides an optional method for constructing the domain knowledge graph based on various analytical triples. Through this method, weight coefficients representing the contribution of each triple to fault root cause localization can be set in the domain knowledge graph, facilitating the clarification of the effectiveness of different triples during the reasoning process. Furthermore, by constructing structured triples, potential correlations between multi-source data can be further mined, accelerating the reasoning process.

[0128] In some embodiments of this application, the process of retrieving the analytical basis matching the multi-source anomaly features from the domain knowledge graph in step S3 is described in detail, and the steps are as follows:

[0129] S30. Perform task analysis on the multi-source anomaly features to generate fault analysis prompt words that include fault analysis task requirements and causal reasoning rules.

[0130] Specifically, multi-source anomaly characteristics can be broken down and analyzed to clarify the specific manifestations of the fault, the time range of the anomaly occurrence, and other information. Based on the specific manifestations of the fault, the time range of the anomaly occurrence, and user needs, fault analysis prompts containing fault analysis task requirements and causal reasoning rules are generated.

[0131] S31. Retrieve multiple target triples that match the multi-source anomaly features from the domain knowledge graph.

[0132] Specifically, multiple target triples matching the multi-source anomaly features can be retrieved from the domain knowledge graph using retrieval enhancement techniques.

[0133] S32. Clean and merge each target triplet and the fault analysis prompt words to generate the analysis basis.

[0134] Specifically, the analysis basis can be obtained by concatenating the triples of each target and the fault analysis prompts.

[0135] As can be seen from the above technical solution, this embodiment provides an optional method for retrieving analytical evidence matching the multi-source anomaly features from the domain knowledge graph. This method can further improve the effectiveness of the analytical evidence and provide reasoning instructions for the hierarchical reasoning architecture.

[0136] In some embodiments of this application, the process of step S6, which involves calling the deep inference layer, combining the root cause reasoning process and the analysis basis, to perform deep causal reasoning on the multi-source anomaly features and generate a reasoning logic and root cause propagation path, is described in detail below:

[0137] S60. Combining the inference complexity score and the current remaining computing resources, predict the inference delay of the different inference layers of the multi-source anomaly features.

[0138] Specifically, the inference latency caused by setting different numbers of inference layers can be calculated based on the input feature dimension of each inference layer, the computation weight of the inference layer, the hardware computing speed determined based on the current remaining computing resources, and the inference complexity score.

[0139] S61. Based on the response speed requirements of the multi-source anomaly features and the various inference delays, determine the number of target inference layers corresponding to the multi-source anomaly features.

[0140] Specifically, the number of target inference layers can be determined based on the response speed requirements corresponding to the multi-source anomaly features and the inference delays of each inference layer.

[0141] The response speed requirements are as follows: the inference latency for a single fault characterization (Tinfer) should not exceed 60 seconds, and the inference latency for batch data of complex faults should not exceed 5 minutes, to meet the efficiency requirements of actual fault handling.

[0142] S62. Call multiple inference layers in the deep inference layer that match the number of target inference layers, and combine the root cause inference process and the analysis basis to perform deep causal inference on the multi-source abnormal features to generate inference ideas and root cause propagation paths.

[0143] Specifically, the first N inference layers in the deep inference layer can be selected, and combined with the root cause inference process and the analysis basis, deep causal inference can be performed on the multi-source abnormal features to generate inference ideas and root cause propagation paths, where N is the number of target inference layers.

[0144] As can be seen from the above technical solution, this embodiment provides an optional method for invoking the deep inference layer, combining the root cause reasoning process and the analysis basis, to perform deep causal reasoning on the multi-source anomaly features, and generate reasoning ideas and root cause propagation paths. Through this method, the reliability of inference can be further improved while ensuring inference speed.

[0145] In some embodiments of this application, the process of step S62, which involves calling multiple inference layers in the deep inference layer that match the number of target inference layers, combining the root cause inference process and the analysis basis, to perform deep causal inference on the multi-source anomaly features and generate inference ideas and root cause propagation paths, is described in detail below:

[0146] S620. Call multiple inference layers in the deep inference layer that match the number of target inference layers, and analyze each triplet subject and the multi-source anomaly features according to the corresponding weight coefficients from large to small, to generate an anomaly subject containing anomaly nodes and / or anomaly types.

[0147] Specifically, multiple inference layers in the deep inference layer that match the number of target inference layers can be invoked. Each triplet subject and the multi-source anomaly features are analyzed according to the corresponding weight coefficients from large to small. Abnormal domain nodes are identified as abnormal nodes, and the corresponding fault types are identified as anomaly types. The identified data is then integrated to generate an abnormal subject.

[0148] S621. Based on the multi-source anomaly features, combined with the anomaly subject, the analysis basis, and the domain knowledge graph, causal reasoning generates the root cause distribution probability and propagation path.

[0149] Specifically, multi-source anomaly features can be compared with the analysis basis and the relevant triples of the anomaly subject in the domain knowledge graph to generate the root cause distribution probability and propagation link through causal reasoning.

[0150] S622. Based on the root cause reasoning process, verify the root cause distribution probability.

[0151] Specifically, the root cause analysis conclusions in the root cause reasoning process can be compared with the root cause distribution probability. If they match, the verification passes; otherwise, the verification fails.

[0152] If the verification fails, the conclusion generation layer can simultaneously output the reasoning ideas output by the deep reasoning layer, the root cause propagation path, and the root cause reasoning process output by the preliminary screening layer.

[0153] S623. After the verification is passed, the analysis basis, the abnormal subject, the root cause distribution probability and the propagation link are integrated to form the reasoning idea and the root cause propagation path.

[0154] Specifically, after the verification is passed, the analytical basis, the abnormal subject, the root cause distribution probability, and the propagation link can be integrated with the step-by-step reasoning results to form the reasoning logic and the root cause propagation path.

[0155] As can be seen from the above technical solution, this embodiment provides an optional method for performing deep causal reasoning on the multi-source abnormal features by utilizing multiple reasoning layers, combining the root cause reasoning process and the analysis basis, and generating reasoning ideas and root cause propagation paths. Through the above method, the reasoning effectiveness of this application can be further improved.

[0156] In some embodiments of this application, step S6, which involves generating a root cause analysis report containing a visualized reasoning logic chain using the conclusion generation layer based on the reasoning logic and the root cause propagation path, is described in detail below:

[0157] S50. Convert the root cause propagation path and reasoning into a visual graphic.

[0158] Specifically, graph visualization tools such as Graphviz and D3.js can be used to visualize the root cause propagation path and reasoning process.

[0159] The reasoning process can be: fault feature extraction - anomaly localization - root cause tracing - conclusion generation.

[0160] Similarly, the root cause reasoning process can be converted into a visual graph.

[0161] S51. Based on the root cause propagation path and the domain knowledge graph, determine the processing scheme and standard basis.

[0162] Specifically, based on the fault types and entities included in the root cause propagation path, solutions and normative basis can be found from the domain knowledge graph.

[0163] Similarly, based on the fault types and entities included in the root cause reasoning process, solutions and normative basis can be found from the domain knowledge graph.

[0164] S52. Process the visualization graphics, the processing scheme, and the standard basis to generate a visualized root cause analysis report.

[0165] Specifically, the visualization graphics, processing solutions, and standard references can be arranged and rendered to obtain a root cause analysis report.

[0166] As can be seen from the above technical solution, this embodiment provides an optional method for generating a root cause analysis report containing a visualized reasoning logic link based on the conclusion generation layer, the reasoning logic, and the root cause propagation path. This method can generate an intuitive and clear root cause analysis report, allowing maintenance personnel to quickly understand the occurrence and propagation process of the fault, and helping to rapidly locate the root cause. At the same time, clear handling solutions and standardized guidelines can guide maintenance personnel to take correct measures to resolve the fault, improving the efficiency and accuracy of fault handling.

[0167] Next, we will combine Figure 2 The fault root cause localization device provided in this application is described in detail. The fault root cause localization device described below can be compared with the fault root cause localization method described above.

[0168] See Figure 2 It can be observed that the root cause localization device may include:

[0169] Module 10 is used to determine the characteristics of multi-source anomalies;

[0170] Module 20 is used to acquire the domain knowledge graph and the hierarchical reasoning architecture that includes a preliminary screening layer, a deep reasoning layer and a conclusion generation layer;

[0171] The retrieval module 30 is used to retrieve analytical basis that matches the multi-source anomaly features from the domain knowledge graph;

[0172] The generation module 40 is used to use the preliminary screening layer and the analysis basis to trace the root causes of the multi-source abnormal features, generate the root cause reasoning process and reasoning complexity score; when the reasoning complexity score is lower than the preset complexity threshold, the combination module 50 is called; when the reasoning complexity score is not lower than the complexity threshold, the reasoning module 60 is called.

[0173] Module 50 is used to generate a root cause analysis report containing a visualized reasoning logic chain by combining the conclusion generation layer with the root cause reasoning process and the analysis basis.

[0174] The reasoning module 60 is used to call the deep reasoning layer, combine the root cause reasoning process and the analysis basis, perform deep causal reasoning on the multi-source abnormal features, generate reasoning ideas and root cause propagation paths; and use the conclusion generation layer to generate a root cause analysis report containing a visualized reasoning logic chain based on the reasoning ideas and the root cause propagation paths.

[0175] Furthermore, the acquisition module 20 may include:

[0176] The data alignment unit is used to combine semantic matching, node mapping and timestamp matching to align historical log data, time series index data, historical fault cases, structured specification data, transmission link data and expanded rare fault data, to determine the operational characteristics of nodes in different domains under normal operating conditions, and the fault characteristics and handling methods under different fault types.

[0177] The analysis triplet construction unit is used to generate multiple entities, multiple relationships, and multiple attributes matching the domain node for each domain node, based on the operational representation of the domain node and the fault representation and handling methods under different fault types; and to construct multiple analysis triples corresponding to the domain node based on each relationship corresponding to each entity and the attribute corresponding to that relationship.

[0178] The domain knowledge graph construction unit is used to construct the domain knowledge graph based on each analysis triple.

[0179] Furthermore, the domain knowledge graph construction unit may include:

[0180] The first domain knowledge graph construction subunit is used to convert each entity and its corresponding relationship into a vector representation, integrate the corresponding knowledge association information, and generate structured triples.

[0181] The second domain knowledge graph construction subunit is used to determine the weight coefficient corresponding to each source based on the contribution of different sources to the location of the root cause of the fault.

[0182] The third domain knowledge graph construction subunit is used to determine the weight coefficients corresponding to each structured triple and each analytical triple, and to construct the domain knowledge graph.

[0183] Furthermore, the retrieval module 30 may include:

[0184] The first retrieval unit, used for retrieving analytical criteria from the domain knowledge graph that match the multi-source anomaly features, includes:

[0185] The second retrieval unit is used to perform task analysis on the multi-source anomaly features and generate fault analysis prompt words that include fault analysis task requirements and causal reasoning rules.

[0186] The third retrieval unit is used to retrieve multiple target triples that match the multi-source anomaly features from the domain knowledge graph;

[0187] The fourth retrieval unit is used to clean and merge each target triplet and the fault analysis prompt words to generate the analysis basis.

[0188] Furthermore, the inference module 60 may include:

[0189] The inference delay prediction unit is used to combine the inference complexity score and the current remaining computing resources to predict the inference delay of different inference layers of the multi-source anomaly features;

[0190] The target inference layer number determination unit is used to determine the target inference layer number corresponding to the multi-source anomaly feature by combining the response speed requirements of the multi-source anomaly feature and each inference delay.

[0191] The reasoning generation unit is used to call multiple reasoning layers in the deep reasoning layer that match the number of target reasoning layers, and combine the root cause reasoning process and the analysis basis to perform deep causal reasoning on the multi-source abnormal features, thereby generating reasoning ideas and root cause propagation paths.

[0192] Furthermore, the reasoning generation unit may include:

[0193] An anomaly subject generation subunit is used to call multiple inference layers in the deep inference layer that match the number of target inference layers, and analyze each triple subject and the multi-source anomaly features according to the corresponding weight coefficients from large to small, to generate an anomaly subject containing anomaly nodes and / or anomaly types.

[0194] The root cause distribution probability determination subunit is used to generate root cause distribution probability and propagation path based on the multi-source anomaly features, combined with the anomaly subject, the analysis basis and the domain knowledge graph, through causal reasoning.

[0195] The root cause distribution probability verification subunit is used to verify the root cause distribution probability based on the root cause reasoning process.

[0196] The reasoning integration subunit is used to integrate the analysis basis, the abnormal subject, the root cause distribution probability, and the propagation link to form the reasoning logic and the root cause propagation path after the verification is passed.

[0197] Furthermore, the reasoning module 60 may also include:

[0198] A visualization graphics generation unit is used to convert the root cause propagation path and reasoning logic into visualization graphics.

[0199] The processing scheme determination unit is used to determine the processing scheme and standard basis based on the root cause propagation path and the domain knowledge graph;

[0200] The standard basis processing unit is used to process the visualization graphics, the processing scheme and the standard basis to generate a visualization root cause analysis report.

[0201] The fault root cause localization device provided in this application embodiment can be applied to fault root cause localization equipment, such as PC terminals, cloud platforms, servers, and server clusters. Optionally, Figure 3 The hardware structure block diagram of the fault root cause localization device is shown. (Refer to...) Figure 3 The hardware structure of the fault root cause localization device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4.

[0202] In this embodiment of the application, the number of processor 1, communication interface 2, memory 3, and communication bus 4 is at least one, and processor 1, communication interface 2, and memory 3 communicate with each other through communication bus 4;

[0203] Processor 1 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.

[0204] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device;

[0205] The memory stores a program, which the processor can call. The program is used for:

[0206] Identify the characteristics of multi-source anomalies;

[0207] Acquire a domain knowledge graph and a hierarchical reasoning architecture that includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer;

[0208] Retrieve analytical basis from the domain knowledge graph that matches the multi-source anomaly features;

[0209] Using the preliminary screening layer and the analytical basis, the root causes of the multi-source abnormal features are traced, and the root cause reasoning process and reasoning complexity score are generated.

[0210] When the reasoning complexity score is lower than the preset complexity threshold, the conclusion generation layer is used to combine the root cause reasoning process and the analysis basis to generate a root cause analysis report containing a visualized reasoning logic chain.

[0211] When the reasoning complexity score is not lower than the complexity threshold, the deep reasoning layer is invoked, and deep causal reasoning is performed on the multi-source abnormal features in combination with the root cause reasoning process and the analysis basis to generate reasoning ideas and root cause propagation paths; using the conclusion generation layer, a root cause analysis report containing a visualized reasoning logic chain is generated based on the reasoning ideas and the root cause propagation paths.

[0212] Optionally, the refined and extended functions of the program can be referred to the above description.

[0213] This application embodiment also provides a readable storage medium that can store a program suitable for execution by a processor, the program being used for:

[0214] Identify the characteristics of multi-source anomalies;

[0215] Acquire a domain knowledge graph and a hierarchical reasoning architecture that includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer;

[0216] Retrieve analytical basis from the domain knowledge graph that matches the multi-source anomaly features;

[0217] Using the preliminary screening layer and the analytical basis, the root causes of the multi-source abnormal features are traced, and the root cause reasoning process and reasoning complexity score are generated.

[0218] When the reasoning complexity score is lower than the preset complexity threshold, the conclusion generation layer is used to combine the root cause reasoning process and the analysis basis to generate a root cause analysis report containing a visualized reasoning logic chain.

[0219] When the reasoning complexity score is not lower than the complexity threshold, the deep reasoning layer is invoked, and deep causal reasoning is performed on the multi-source abnormal features in combination with the root cause reasoning process and the analysis basis to generate reasoning ideas and root cause propagation paths; using the conclusion generation layer, a root cause analysis report containing a visualized reasoning logic chain is generated based on the reasoning ideas and the root cause propagation paths.

[0220] Optionally, the refined and extended functions of the program can be referred to the above description.

[0221] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0222] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0223] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. The various embodiments of this application can be combined with each other. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for locating the root cause of a fault, characterized in that, include: Identify the characteristics of multi-source anomalies; Acquire a domain knowledge graph and a hierarchical reasoning architecture that includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer; The analysis criteria that match the multi-source anomaly features are retrieved from the domain knowledge graph, wherein the analysis criteria include multiple triplet subjects; each triplet subject corresponds to a weight coefficient that characterizes its contribution to the location of the root cause of the fault. Using the preliminary screening layer and the analytical basis, the root causes of the multi-source abnormal features are traced, and the root cause reasoning process and reasoning complexity score are generated. When the reasoning complexity score is lower than the preset complexity threshold, the conclusion generation layer is used to combine the root cause reasoning process and the analysis basis to generate a root cause analysis report containing a visualized reasoning logic chain. When the reasoning complexity score is not lower than the complexity threshold, the reasoning latency of different inference layers for the multi-source anomaly feature is predicted by combining the reasoning complexity score and the current remaining computing resources; the target number of inference layers corresponding to the multi-source anomaly feature is determined by combining the response speed requirements of the multi-source anomaly feature and each inference latency; multiple inference layers in the deep inference layer that match the target number of inference layers are called, and each triple subject and the multi-source anomaly feature are analyzed according to the corresponding weight coefficient from large to small to generate an anomaly subject containing anomaly nodes and / or anomaly types; based on the multi-source anomaly feature, combined with the anomaly subject, the analysis basis, and the domain knowledge graph, causal reasoning generates the root cause distribution probability and propagation path; the root cause distribution probability is verified based on the root cause reasoning process; after verification, the analysis basis, the anomaly subject, the root cause distribution probability, and the propagation path are integrated to form a reasoning idea and a root cause propagation path; using the conclusion generation layer, a root cause analysis report containing a visualized reasoning logic link is generated based on the reasoning idea and the root cause propagation path.

2. The fault root cause localization method according to claim 1, characterized in that, Obtain the domain knowledge graph, including: By combining semantic matching, node mapping, and timestamp matching, data alignment is performed on historical log data, time-series index data, historical fault cases, structured and standardized data, transmission link data, and expanded rare fault data to determine the operational characteristics of nodes in different domains under normal operating conditions, as well as the fault characteristics and handling methods under different fault types. For each domain node, based on the operational representation of the domain node and the fault representation and handling methods under different fault types, multiple entities, multiple relationships and multiple attributes matching the domain node are generated; based on each relationship corresponding to each entity and the attribute corresponding to the relationship, multiple analysis triples corresponding to the domain node are constructed. Based on each analytical triple, the domain knowledge graph is constructed.

3. The fault root cause localization method according to claim 2, characterized in that, The construction of the domain knowledge graph based on each analytical triple includes: Each entity and its corresponding relationship are converted into a vector representation, and the corresponding knowledge association information is incorporated to generate a structured triple. Based on the contribution of different sources to the root cause localization of the fault, the weight coefficient corresponding to each source is determined. Determine the weight coefficients corresponding to each structured triple and each analytical triple, and construct a domain knowledge graph.

4. The fault root cause localization method according to claim 1, characterized in that, The domain knowledge graph contains multiple triples derived from heterogeneous data from multiple sources. Each triple contains a corresponding entity, a corresponding relation, and corresponding attribute data. The analytical basis for retrieving the multi-source anomaly features from the domain knowledge graph includes: The multi-source anomaly features are analyzed to generate fault analysis prompts containing fault analysis task requirements and causal reasoning rules. Retrieve multiple target triples that match the multi-source anomaly features from the domain knowledge graph; The target triples and the fault analysis prompts are cleaned and merged to generate the analysis basis.

5. The fault root cause localization method according to claim 1, characterized in that, The step of using the conclusion generation layer to generate a root cause analysis report containing a visualized logical chain of reasoning, based on the reasoning logic and the root cause propagation path, includes: The root cause propagation path and reasoning logic are converted into visual graphics; Based on the root cause propagation path and the domain knowledge graph, the processing scheme and standard basis are determined; The visualization graphics, the processing scheme, and the standard criteria are processed to generate a visualized root cause analysis report.

6. A fault root cause location device, characterized in that, include: The determination module is used to determine the characteristics of multi-source anomalies; The acquisition module is used to acquire the domain knowledge graph and the hierarchical reasoning architecture, which includes a preliminary screening layer, a deep reasoning layer, and a conclusion generation layer. The retrieval module is used to retrieve analytical criteria that match the multi-source anomaly features from the domain knowledge graph, wherein the analytical criteria include multiple triplet subjects; each triplet subject corresponds to a weight coefficient that characterizes its contribution to the location of the root cause of the fault. The generation module is used to use the preliminary screening layer and the analysis basis to trace the root causes of the multi-source abnormal features, generate the root cause reasoning process and reasoning complexity score; when the reasoning complexity score is lower than the preset complexity threshold, the combination module is called; when the reasoning complexity score is not lower than the complexity threshold, the reasoning module is called. The module is used to generate a root cause analysis report containing a visualized reasoning logic chain by combining the conclusion generation layer with the root cause reasoning process and the analysis basis. The inference module is used to predict the inference latency of different inference layers for the multi-source anomaly features by combining the inference complexity score and the current remaining computing resources; determine the target number of inference layers corresponding to the multi-source anomaly features by combining the response speed requirements of the multi-source anomaly features and each inference latency; call multiple inference layers in the deep inference layer that match the target number of inference layers, and analyze each triple subject with the multi-source anomaly features according to the corresponding weight coefficient from large to small to generate an anomaly subject containing anomaly nodes and / or anomaly types; based on the multi-source anomaly features, combined with the anomaly subject, the analysis basis, and the domain knowledge graph, generate the root cause distribution probability and propagation path through causal inference; verify the root cause distribution probability based on the root cause inference process; after verification, integrate the analysis basis, the anomaly subject, the root cause distribution probability, and the propagation path to form an inference idea and root cause propagation path; and use the conclusion generation layer to generate a root cause analysis report containing a visualized inference logic link based on the inference idea and the root cause propagation path.

7. A fault root cause location device, characterized in that, Including memory and processor; The memory is used to store programs; The processor is configured to execute the program to implement each step of the fault root cause localization method as described in any one of claims 1-5.

8. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements each step of the fault root cause localization method as described in any one of claims 1-5.

Images