Knowledge graph-based base station fault root cause positioning method and system

Abstract

The application belongs to the technical field of communication network operation and maintenance and artificial intelligence, and particularly relates to a base station fault root cause positioning method and system based on a knowledge graph, a communication network knowledge graph carrying a causal direction attribute and a propagation weight is constructed, adaptive space-time clustering convergence is performed on alarm data, alarm events are mapped to a knowledge graph to activate a causal propagation subgraph, a root cause probability score is calculated through multi-hop message passing along a causal relationship edge by a graph attention network to output nodes in a top ranking as root causes, and the graph weight is continuously updated through expert feedback loop, the application reconstructs root cause positioning from a feature classification paradigm to a probability propagation paradigm of a causal relationship graph, the accuracy rate reaches 85%, and the positioning time is shortened to 3 minutes.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of communication network operation and maintenance and artificial intelligence, specifically involving a method and system for locating the root cause of base station failures based on knowledge graphs. Background Technology

[0002] With the large-scale deployment of 5G mobile communication networks, the number of base stations in a single provincial operator has reached hundreds of thousands, generating millions of alarms daily. These massive alarms exhibit complex spatiotemporal correlations and causal propagation relationships; a fault in the same device can spread cascading along the network topology, triggering hundreds of derivative alarms. Faced with this alarm storm, maintenance personnel are forced to rely on manual experience to troubleshoot each alarm individually, with an average fault location time of up to 40 minutes, severely impacting network service quality and user experience.

[0003] Existing root cause localization technologies have mainly developed along two paths. The first path is based on expert rule-based association analysis methods. These methods predefine an alarm association rule base, perform rule matching on received alarms according to time windows and topological distance, and output root cause candidates that best match the fault patterns in the rule base. For example, patent application EP3796176A1 discloses a root cause analysis method that extracts feature vectors from alarm events to characterize the relationships between alarm events, and then determines whether an alarm event is a root cause alarm event based on a pre-defined classification model. This method comprehensively considers three dimensions—time association, topological association, and text similarity—in the alarm aggregation stage, uses a random forest classification algorithm for root cause identification, and continuously trains the classification model using expert-annotated data. However, this method essentially models root cause localization as a feature vector-based classification problem, and its classification results are highly dependent on the quality of feature engineering and the sufficiency of training samples. When alarms have similar characteristics but different causal propagation paths, such as alarms of the same type propagating from two different fault sources to the same aggregation node, this method has difficulty distinguishing the true root cause due to the lack of causal direction information, resulting in unstable localization accuracy.

[0004] The second approach is a network topology-based reasoning method. Patent application US7043661B2 discloses a network fault root cause analysis inference engine based on topology. This method constructs a network topology graph and defines alarm propagation rules on the graph, traversing the topology path to discover root causes. The system clusters incident alarms into alarm groups based on arrival time and topological distance, with each alarm group corresponding to a potential fault event. Then, it traverses the topology graph according to predefined consequence scenarios. This method performs well in transmission networks with well-defined topological relationships, but its reasoning ability heavily relies on manually defined consequence scenario rules. When facing complex multi-layered network fault cascading propagation, the maintenance cost of the rule base increases dramatically, and it struggles to cover novel fault modes. Furthermore, this method does not introduce a quantitative representation of causal relationships; topological edges only represent physical connections without distinguishing causal directions, resulting in a lack of guidance for reasoning direction and an exploding search space in large-scale networks.

[0005] Publication number CN105677759B discloses a method for alarm correlation analysis in information and communication networks. This method mines statistical correlations between alarms by preprocessing alarm data and performing multidimensional correlation analysis. However, this method still relies on statistical frequency-based correlation mining, failing to construct a structured knowledge graph to explicitly represent causal propagation mechanisms, and also failing to introduce graph neural networks to automatically learn deep causal relationships between alarms.

[0006] In summary, existing technologies share a common and deep-seated bottleneck: modeling the root cause localization problem as a classification problem based on alarm features or a rule-based matching problem fails to fully utilize the causal propagation structure information inherent in the communication network itself. Alarm features and statistical correlations can answer which alarms frequently occur together, but they cannot answer where the fault originates, along what path it propagates, or where it is observed. There is an urgent need in this field for an intelligent root cause localization method that can explicitly model the causal propagation structure of the communication network and integrate it into the reasoning process. Summary of the Invention

[0007] To address the technical bottleneck in existing base station alarm root cause localization technologies where alarm feature classification paradigms fail to capture causal propagation direction, leading to unstable localization accuracy, this invention provides a knowledge graph-based base station fault root cause localization method and system. By constructing a communication network knowledge graph carrying causal direction attributes and propagation weights, and using a graph attention network for direction-aware multi-hop message passing along causal relationship edges, under the constraint of massive heterogeneous alarm streams, this invention achieves automated, interpretable, and sustainably evolving fault root cause localization from the causal reasoning level.

[0008] The technical solution of this invention is as follows: The knowledge graph-based base station fault root cause localization method includes the following steps: Constructing a knowledge graph in the communication network domain, modeling base station equipment, network element topology, alarm types, and fault modes as entity nodes, and modeling the physical connections, logical carrying, alarm triggering, and causal propagation between entities as relation edges, each relation edge carrying causal direction attributes and propagation weights; performing spatiotemporal clustering convergence on alarm data received within a preset time window, identifying and aggregating sets of alarms from the same source into alarm events; mapping alarm events to corresponding entity nodes in the knowledge graph, activating the causal propagation subgraph associated with the alarm events; performing multi-hop message passing along the causal relation edges of the causal propagation subgraph using a graph attention network, calculating the probability score of each candidate root cause node; sorting the candidate root cause nodes in descending order according to their probability scores, and outputting the nodes with the highest ranking as the fault root cause localization result.

[0009] This invention also provides a knowledge graph-based base station fault root cause localization system, comprising: a knowledge graph construction module for constructing a knowledge graph in the field of communication networks; an alarm convergence module for performing spatiotemporal clustering convergence on alarm data within a preset time window and aggregating them into alarm events; an alarm mapping module for mapping alarm events to corresponding entity nodes in the knowledge graph and activating a causal propagation subgraph; a root cause reasoning module for performing multi-hop message passing along causal relationship edges through a graph attention network and calculating the probability score of each candidate root cause node; and a result output module for sorting and outputting the fault root cause localization results according to the probability scores.

[0010] The beneficial effects of this invention are as follows: First, this invention reconstructs the alarm root cause localization problem from a feature vector-based classification paradigm to a probabilistic propagation paradigm based on a causal relationship graph by constructing a communication network knowledge graph carrying causal direction attributes and propagation weights. The mechanism lies in the fact that the directional attributes of the causal propagation edges in the knowledge graph explicitly encode the physical mechanism of fault propagation from upstream network elements to downstream network elements along the causal path. When the graph attention network performs multi-hop message passing along the causal direction, it can naturally trace the reverse path of alarm propagation back to the fault source. Compared with feature vector classification methods, the causal propagation probability scoring of this invention does not depend on the quality of alarm feature engineering. When alarm features are similar but causal paths are different, it can still correctly distinguish the root cause source, improving the root cause localization accuracy to 85%.

[0011] Second, the alarm spatiotemporal clustering convergence and causal propagation reasoning of the graph attention network in this invention form a synergistic effect. The mechanism is as follows: alarm clustering convergence compresses massive alarms into a small number of alarm events, reducing the input scale of the graph attention network from tens of thousands of nodes to hundreds of nodes, thus reducing computational complexity by two orders of magnitude. Simultaneously, the clustered alarm events carry the spatiotemporal distribution statistical characteristics of the original alarms. These characteristics serve as components of the initial feature vectors of the graph attention network nodes, integrating spatiotemporal clustering information into the calculation of attention coefficients. Alone, alarm clustering can only reduce the number of alarms but cannot pinpoint the root cause; alone, the graph attention network faces computational bottlenecks due to its large input scale. The synergy between the two enables the system to complete the entire process from millions of alarms to root cause localization within 5 seconds, achieving a system-level acceleration effect greater than the sum of its parts. Compared to manual rule traversal methods, this invention does not require manual maintenance of the consequence scenario rule base and automatically adapts to new fault modes through the end-to-end learning capability of the graph attention network.

[0012] Third, the expert feedback closed-loop mechanism of this invention enables the continuous evolution of the causal relationship weights of the knowledge graph. The mechanism lies in the fact that the confirmation and correction signals from maintenance personnel regarding the reasoning results are directly fed back to the causal propagation relationship edge weights of the knowledge graph, allowing the graph attention network to automatically correct attention allocation in subsequent reasoning. Compared with static statistical association analysis methods, the knowledge graph of this invention is dynamically updated after each feedback, and the positioning accuracy continuously improves with usage time, achieving interpretable reasoning results and evolvable knowledge accumulation. Attached Figure Description

[0013] Figure 1 This is a flowchart illustrating the knowledge graph-based base station fault root cause localization method provided in an embodiment of the present invention.

[0014] Figure 2 This is a schematic diagram of the architecture of a knowledge graph-based base station fault root cause localization system provided in an embodiment of the present invention. Detailed Implementation

[0015] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are used to illustrate the present invention but do not limit the scope of protection of the present invention.

[0016] Reference Figure 1 The knowledge graph-based base station fault root cause localization method provided in this embodiment of the invention includes steps S1 to S5.

[0017] Step S1: Construct a knowledge graph for the communication network domain. The core objective of Step S1 is to organize the device, topology, alarm, and fault information of the communication network into a structured knowledge graph, providing a computable semantic foundation for subsequent causal reasoning.

[0018] In this embodiment, the knowledge graph is represented in the form of quadruples. ,in For a set of entity nodes, Let be the set of relation edges. For entity attribute collection, This is the set of relation edge weights.

[0019] Entity Node It includes four types of entities. The first type is base station equipment entities, representing physical devices in the communication network. Attributes include equipment number, equipment type (e.g., BBU, RRU, antenna, transmission equipment), site, latitude and longitude coordinates, and equipment manufacturer. The second type is network element topology entities, representing logical network elements and their positions in the network layered structure. Attributes include network element identifier, network element level (access layer, aggregation layer, core layer), type of service carried, and capacity level. The third type is alarm type entities, representing standardized alarm classifications in the communication network. Attributes include alarm code, alarm name, alarm level (urgent, important, minor, alert), and the subsystem to which the alarm belongs. The fourth type is fault mode entities, representing known fault scenarios and fault mechanisms. Attributes include fault code, fault description, scope of impact, and recommended handling plan.

[0020] Relationship edge There are four types. The first is the physical connection relationship, which represents the physical link connection between devices. The second is the logical bearer relationship, which represents the logical service bearer relationship between network elements. The third is the alarm triggering relationship, which represents the correspondence between device failures triggering specific alarm types. The fourth is the causal propagation relationship, which represents the causal propagation path of the fault in the network, and is the core relationship type of this invention.

[0021] Causal propagation relationships carry two key attributes: causal direction attribute. and propagation weight Causal direction attribute This is a directed marker; a value of 1 indicates an entity. For upstream causal nodes and entities As a downstream causal node, i.e., the fault originates from... spread to Propagation weight Real numbers between 0 and 1, representing entities The failure caused the entity The conditional probability of an associated failure occurring.

[0022] In this embodiment, the initial construction of the causal propagation relationship edge adopts an alarm suppression relationship reversal strategy. Alarm suppression rules are commonly configured in network management systems of communication networks, automatically masking associated child alarms when a parent alarm occurs. Those skilled in the art typically view alarm suppression as an alarm noise reduction method and filter it in root cause analysis. However, the alarm suppression rule itself carries precise causal direction information: the device corresponding to the parent alarm is the upstream causal node, and the device corresponding to the suppressed child alarm is the downstream causal node. This direction information is reversed and utilized, modeling the directional attribute of the causal propagation relationship edge based on the direction from the parent alarm entity to the child alarm entity, and initializing the propagation weights based on the historical co-occurrence frequency of parent and child alarms.

[0023] The initialization formula for propagation weights is: ,in: For entities To the entity The causal propagation weight is a scalar with a range of values. , dimensionless, obtained through statistical analysis of historical alarm data, characterizes the conditional probability that an upstream failure leads to a downstream related alarm; For entities Alarms and entities The number of times an alarm co-occurs in historical data is a non-negative integer with no dimension. It is obtained by statistically analyzing the co-occurrence pairs of events that satisfy the time window constraint in the historical alarm logs. For entities The total number of alarms in historical data is a positive integer, dimensionless, and is obtained by statistically analyzing historical alarm logs.

[0024] In the actual construction of the knowledge graph, the data sources for entities and relationships cover multiple heterogeneous systems. Attribute data for base station equipment entities is obtained from the configuration management database, which records information such as the model, location, installation date, and maintenance status of all physical devices in the network. Attribute data for network element topology entities is obtained from the topology discovery module of the network management system. This module automatically discovers the connection relationships and hierarchical structure between network elements through link layer discovery protocols and simple network management protocols. Attribute data for alarm type entities is extracted from alarm manuals and alarm databases of various vendors. It should be noted that different vendors may assign different codes and names to alarms with the same physical meaning. Attribute data for fault mode entities is compiled from fault knowledge bases accumulated by operations and maintenance personnel and vendor technical documents. Each fault mode records the triggering conditions, scope of impact, typical symptom alarm set, and recommended handling procedures.

[0025] The data source for physical connection relationship edges is the link table output by the network topology discovery module, with each link corresponding to one physical connection relationship edge. The data source for logical bearer relationship edges is the service configuration system, which records the bearer mapping relationship of upper-layer services on lower-layer network elements. The data source for alarm triggering relationship edges is the alarm mapping table, which defines the set of alarm types that may be triggered by each type of device failure. Causal propagation relationship edges are one of the core innovations of this invention. Their initial construction method has been described above. It should be noted that, in addition to alarm suppression rules, causal propagation relationships can also be supplemented from the following auxiliary data sources: fault propagation paths clearly recorded in historical fault cases marked by maintenance personnel, and statistical causal relationship pairs identified by Granger causality tests from historical alarm time-series data. Through the fusion of multiple data sources, the coverage and accuracy of the initial weights of causal propagation relationship edges in the knowledge graph are both improved.

[0026] In cross-vendor, multi-standard network scenarios, different vendors' network management systems employ different alarm naming and encoding systems for the same fault phenomenon. In the preferred embodiment, cross-vendor alarm semantic alignment is performed before constructing causal propagation relationship edges. Specifically, alarm name, alarm category, and alarm parameter fields are extracted from the alarm data of each vendor's network management system, encoded into semantic vectors using a pre-trained language model, and then aligned in a unified alarm semantic space using a cosine similarity threshold. The semantic equivalence mapping is performed as a criterion. In this embodiment... The preferred value is 0.85. The formula for calculating cosine similarity is: ,in: Let be the cosine similarity between two alarm semantic vectors, where is a scalar and its value ranges from 1 to 10. , dimensionless, is obtained by the ratio of the vector inner product to the modulus, and represents the degree of directional consistency between two alarms in the semantic space; and These are the semantic vectors of the two alarms, respectively. 3D real vector (in this embodiment) Each component is dimensionless and is obtained through the encoder output of a pre-trained language model; For Euclidean norm operators.

[0027] Step S2: Alarm Spatiotemporal Clustering Convergence. The goal of Step S2 is to aggregate the massive amount of alarm data received within a preset time window into a small number of alarm events, achieving alarm dimensionality reduction and providing a controllable input for subsequent graph attention network inference. Step S2 is based on the knowledge graph constructed in Step S1, using the propagation weights of causal propagation relationship edges and the topological distance of network elements in the knowledge graph to determine clustering parameters.

[0028] In this embodiment, the time window employs an adaptive mechanism based on causal propagation delay estimation. The propagation weights of causal propagation relationship edges in the knowledge graph are read. Topology hop count between network element nodes connected by relational edges Estimate the expected value of causal propagation delay and standard deviation Set the time window width to .

[0029] The formula for estimating the expected value of causal propagation delay is: ,in: Let be the expected value of the causal propagation delay, and let be a scalar with a range of values. The unit is s, which is obtained by averaging the time delay estimates of all causal propagation relationship edges in the knowledge graph and is used to determine the center width of the adaptive time window. This is the set of edges representing causal propagation relationships in a knowledge graph. Its base; For network element nodes and The topological hop count between the two is a positive integer, dimensionless, and is obtained by the shortest path length of the physical connection relationship in the knowledge graph; Let $\frac{ ... The unit is s, which is set according to the type of communication network (in this embodiment, the core network is taken as s). s, transmission network s, access network s); Define the causal propagation weights in step S1.

[0030] The formula for calculating the adaptive time window width is: ,in: The adaptive time window width is denoted by , which is a scalar with a range of values. The unit is s, used to define the time boundary of alarm clustering; Here, is the confidence coefficient, and is a scalar with a range of values. Dimensionless, preferred in this embodiment This covers approximately 95.4% of causal propagation events; Let be the standard deviation of the causal propagation delay, a scalar in seconds, calculated by the sample standard deviation of the delay estimates for all causal propagation relationships. In this embodiment, the baseline value of the adaptive time window is approximately 5 minutes (300 seconds).

[0031] After determining the time window width, density-based spatiotemporal clustering is performed on the alarm data falling within the time window. The spatiotemporal distance between alarm samples is defined using the topological distance between the alarm location and the time difference between the alarm occurrence time as metrics. ,in: For warning and The normalized spatiotemporal distance between them is a scalar with a range of values. , dimensionless, is a distance metric used for density clustering; and Alarms and The timestamp generated, in seconds; For adaptive time window width, the definition is the same as above; For warning and The topological hop count between the network element nodes is a non-negative integer and dimensionless. The maximum number of topological hops in the current network topology is a positive integer, dimensionless, used to normalize the topological distance. The weighting coefficient for the time dimension is a scalar, and its value range is... Dimensionless, preferred in this embodiment This allows the weight of temporal proximity to be slightly higher than that of topological proximity.

[0032] In terms of spacetime distance For metric purposes, the DBSCAN density clustering algorithm is used to aggregate alarms with achievable density into the same alarm event. Cluster radius parameter. The value is 0.3, which is the minimum sample size parameter. The value is set to 2. In actual operation, the selection of clustering parameters needs to balance the sufficiency of alarm aggregation and the precision of alarm differentiation. If If the value is too large, it may merge alarm errors from different fault sources into a single alarm event, increasing the ambiguity of candidate root causes in subsequent reasoning; if If the parameter value is too small, derived alarms from the same fault source may be split into multiple alarm events, increasing the computational burden of inference and potentially missing fault propagation correlations across network elements. This embodiment determines the optimal parameter combination by performing a parameter grid search on historical alarm data, using the RAND index as an evaluation metric. , The parameter pair that maximizes the adjustment of the Rand index is selected from the search space.

[0033] The clustering process also requires handling alarm noise points. The DBSCAN algorithm marks low-density alarms that do not belong to any cluster as noise points. In communication network operation and maintenance scenarios, noise points usually correspond to isolated device self-test alarms or environmental interference alarms, which are unrelated to the fault propagation link. The processing strategy for noise points in this embodiment is as follows: noise points are marked separately but not discarded; instead, they are retained as auxiliary observation information in the subgraph activation stage of step S3. If a noise point happens to be within the coverage area of ​​the causal propagation subgraph, its information is included in the initial feature vector of the corresponding node to enhance the information integrity of the inference.

[0034] After clustering, each cluster becomes an alarm event. Each alarm event contains the original alarm set. The alarm event's representative time (earliest alarm time within the cluster), representative location (topological centroid of the set of network elements covered by the alarm within the cluster), and alarm event feature vector. Alarm event feature vector It is composed of a histogram of alarm type distribution, alarm level distribution, alarm time span, and alarm quantity within the cluster, with dimensions of [missing information]. (In this embodiment) ).

[0035] Step S3: Mapping Alarm Events to the Knowledge Graph. Step S3 maps the alarm events output in Step S2 to the knowledge graph constructed in Step S1, activating the causal propagation subgraphs associated with the alarm events. The goal of Step S3 is to locate local subgraphs related to the current fault in the large-scale knowledge graph, narrowing the reasoning scope of the graph attention network.

[0036] Specifically, for each alarm event Extract the set of network elements covered by its representative location. In the knowledge graph, locate the entity nodes corresponding to these network elements. Using these entity nodes as seed nodes, perform a breadth-first search along the reverse direction of the causal propagation edges (from downstream to upstream), with a search depth equal to the preset propagation hops. (In this embodiment) During the search, the algorithm simultaneously expands one hop in the positive direction of the causal propagation edge to include directly affected downstream nodes of the seed node. During the breadth-first search, nodes with propagation weights below a preset minimum weight threshold are considered. (In this embodiment) Pruning is applied to edges related to causal propagation, meaning the search is not extended further along those edges. The physical meaning of this pruning strategy is that when the conditional probability of a causal propagation relationship is extremely low, the contribution of that propagation path to root cause localization can be ignored. Pruning can effectively control the size of the subgraph and reduce the computational burden on subsequent graph attention networks.

[0037] When multiple alarm events occur within the same time window, the causal propagation subgraphs activated by each alarm event may have overlapping regions. In this embodiment, the strategy for handling overlapping regions is to take the union: the node sets and edge sets of multiple subgraphs are respectively merged to form a unified causal propagation subgraph. The initial feature vector of the nodes in the overlapping region is obtained by weighted summation of the feature vectors of multiple alarm events, with the weight being the proportion of alarms in each alarm event. This strategy enables the graph attention network to comprehensively consider the cross-influence of multiple alarm events during inference, resulting in better localization capabilities in scenarios with multiple concurrent faults.

[0038] After the subgraph is activated, each node in the causal propagation subgraph needs to be labeled as a candidate root cause. The labeling rule is: if a node has at least one causal propagation path with an in-degree of zero in the causal propagation subgraph (i.e., the node may be the upstream starting point of a causal propagation link), it is labeled as a candidate root cause node. In actual networks, the number of candidate root cause nodes is usually 10% to 20% of the total number of nodes in the causal propagation subgraph. Only nodes labeled as candidate root causes participate in the probability scoring calculation in step S4, further narrowing the search space.

[0039] All nodes and edges reached by the breadth-first search are combined into a causal propagation subgraph. The initial feature vector of each node in the subgraph is composed of three parts: the node's own attribute vector (encoded from the entity attributes of the knowledge graph, with a dimension of 64), the feature vector of the alarm event associated with that node, and the feature vector of the alarm event associated with that node. (If the node is covered by the current alarm event, use the alarm event feature; otherwise, use the zero vector, with a dimension of 128.) The node's structural feature vector in the graph (including encoding of node degree, betweenness centrality, and PageRank value, with a dimension of 32). The total dimension of the node's initial feature vector is... .

[0040] Step S4: Causal Reasoning via Graph Attention Network. Step S4 is the core reasoning step of this invention. Taking the causal propagation subgraph activated in Step S3 as input, Step S4 performs multi-hop message passing along causal relationship edges using a graph attention network, calculating the probability score of each candidate root cause node. The key innovation of Step S4 lies in integrating causal direction encoding into the calculation process of graph attention coefficients, enabling message passing to have causal direction awareness.

[0041] In the graph attention network Layer, for each causal relationship edge in the causal propagation subgraph The calculation process for the attention coefficient is as follows.

[0042] First, extract the relation edges. Causal direction attribute (A value of 1 indicates forward direction, and a value of -1 indicates reverse direction), encoded as a direction vector. The dimension is 2.

[0043] Secondly, the source node feature vector Target node feature vector and direction vector Concatenation, using a learnable attention parameter vector Calculate the original attention coefficient: ,in: For the first Layer nodes To the node The original attention coefficient is a scalar, taking values ​​in the real number field, dimensionless, and used to measure the attention of nodes. For nodes The importance of the information conveyed; For the first The learnable attention parameter vector of the layer has a dimension of ( In this embodiment, the hidden layer feature dimension is used. Each component is dimensionless and is obtained through end-to-end training. For the first The learnable feature transformation matrix of the layer has a dimension of ( For the first The layer input feature dimension), each element is dimensionless, and is obtained through end-to-end training; For the first Layer nodes The feature vector has a dimension of . Each component is dimensionless; This represents the vector concatenation operator; Indicates vector transpose; The modified linear unit activation function with a negative slope is defined as follows: .

[0044] Then, a causal orientation mask is applied to the original attention coefficients. For message passing in the reverse causal direction (i.e., passing messages from downstream nodes to upstream nodes), the attention coefficients are multiplied by a decay factor. : ,in: The attention coefficients after applying a causal orientation mask have the same meaning as... ; The attenuation factor is the inverse causal factor, which is a scalar with a range of values. Dimensionless, preferred in this embodiment This reduces the intensity of message transmission in the reverse causal direction to 10% of the forward direction, thereby guiding reasoning to proceed preferentially along the causal direction.

[0045] Finally, softmax normalization is performed on the decayed attention coefficients: ,in: The normalized attention coefficient is a scalar with a range of values. Dimensionless, satisfies ; For nodes The set of neighboring nodes in the causal propagation subgraph. The node feature update rule is: ,in: For nodes In the The updated feature vector of the layer has a dimension of ; The ELU activation function is defined as follows: when , when .

[0046] Message passing execution After jumping (in this embodiment) For each node in the causal propagation subgraph The final layer feature vector The probability score is calculated using a linear transformation and a sigmoid activation function. In this embodiment, the graph attention network employs a multi-head attention mechanism to enhance expressive power. Specifically, each layer is executed in parallel. An independent attention head (in this embodiment) Each attention head uses an independent parameter matrix. and attention parameter vector Attention coefficients and node feature updates are calculated. The feature vectors output by each attention head are aggregated using average pooling in the final layer. The multi-head attention mechanism enables the model to focus on different types of propagation patterns in the causal propagation subgraph from different subspaces. For example, one attention head might focus on physical fault propagation paths, while another might focus on logical business impact diffusion paths. The causal direction masks of all attention heads share the same decay factor. This ensures that reasoning in all subspaces follows causal direction constraints.

[0047] The graph attention network is trained using a binary cross-entropy loss function. During the construction of the training data, the causal propagation subgraph for each historical failure case is extracted as training samples. Root cause nodes confirmed by operations personnel are labeled as positive samples (label 1), and the remaining nodes are labeled as negative samples (label 0). Since there are usually only 1 to 2 root cause nodes in the causal propagation subgraph, the positive and negative samples are severely imbalanced. This embodiment uses a focus loss function instead of standard cross-entropy to alleviate the sample imbalance problem, while assigning higher sample weights to positive samples (positive to negative sample weight ratio of 5:1). The optimizer for model training uses the Adam algorithm with an initial learning rate of 0.001. Every 20 training epochs, the learning rate is decayed to 0.5 times the original value, for a total of 100 training epochs. Early stopping is triggered when the accuracy on the validation set does not improve for 10 consecutive epochs.

[0048] The formula for calculating the probability score is: ,in: For nodes The root cause probability score is a scalar with a range of values. , dimensionless, obtained through linear transformation and sigmoid activation, characterizing the posterior probability that the node is the root cause of the fault; The output layer learnable weight vector has a dimension of . Each component is dimensionless; The output layer bias is a scalar, dimensionless quantity. The sigmoid activation function is defined as follows: .

[0049] Step S5: Root Cause Ranking and Result Output. Step S5 sorts the probability scores of each candidate root cause node calculated in Step S4 in descending order and outputs the nodes with the highest ranking as the root cause location results. In this embodiment, the top 3 to top 5 candidate root cause nodes and their probability scores are output.

[0050] For the output root cause localization results, the system extracts the causal propagation paths from the root cause node to each alarm event node from the knowledge graph and renders them as a visual graph of the fault propagation chain. The visual graph labels the alarm time, alarm level, and propagation weight of each path node, providing operations and maintenance personnel with an intuitive panoramic view of fault propagation. The visual graph adopts a directed acyclic graph layout, with the root cause node at the top. Alarm event nodes at each level are arranged from top to bottom according to the causal propagation hierarchy. The line width of the causal propagation relationship edge is proportional to the propagation weight, facilitating quick identification of critical propagation paths by operations and maintenance personnel. The graph also uses color coding to distinguish different alarm levels: red for urgent alarms, orange for important alarms, yellow for minor alarms, and gray for warning alarms. Through this visual graph, operations and maintenance personnel can fully understand the source, propagation path, and scope of impact of a fault in a single interface, without having to repeatedly switch between multiple network management systems to view alarm details.

[0051] Simultaneously, the system queries a pre-set fault handling plan library based on the fault mode attributes of the root cause node, automatically generating a work order containing handling steps and required tools, and dispatching it to the corresponding professional team with one click. The work order content includes a description of the fault root cause, probability score, fault propagation chain summary, recommended handling steps, and estimated repair time. The work order system interfaces with the operator's operation and maintenance management platform through standardized interfaces, supporting work order status tracking and closed-loop management. When the operation and maintenance personnel complete the fault repair and close the work order, the work order status information is synchronously transmitted back to the feedback closed-loop submodule, triggering the automatic update of the knowledge graph weights.

[0052] In a preferred embodiment, step S5 is followed by an expert feedback closed-loop update step. After the maintenance personnel confirm or correct the root cause localization result, the feedback signal flows back to the knowledge graph to update the weights of the causal propagation relationship edges. When a confirmation flag is received, the propagation weights of each relationship edge on the causal propagation path where the confirmed root cause node is located are enhanced according to the following formula: ,in: The updated propagation weights are scalars, with a range of values. Dimensionless; The propagation weight before the update; Here, is the learning rate parameter, and is a scalar with a range of values. Dimensionless, preferred in this embodiment This is used to control the magnitude of the impact of each feedback on the weight, and to avoid over-correction in a single feedback.

[0053] When a correction flag is received, the propagation weight of the path containing the negated root cause node decays according to the following formula: Simultaneously, the propagation weights of the path containing the correct root cause node specified by the operations and maintenance personnel are updated according to the enhancement formula. The updated propagation weights are written back to the knowledge graph for use in calculating the attention coefficients of the graph attention network during subsequent fault root cause localization. Through this closed-loop mechanism, the causal relationship weights of the knowledge graph are continuously corrected after each fault handling, and the localization accuracy steadily improves with the increase of usage time.

[0054] To detect the drift phenomenon of causal relationship weights in knowledge graphs, this embodiment introduces a weight drift monitoring mechanism. A time window is set. (In this embodiment) d) Periodically calculate the rate of change of the edge weights of each causal propagation relationship within the window. .when Exceeding the preset threshold (In this embodiment) When this occurs, a manual review process is triggered, where senior operations and maintenance personnel verify the validity of the causal relationship.

[0055] Reference Figure 2 The knowledge graph-based base station fault root cause localization system provided in this embodiment of the invention includes a knowledge graph construction module 1, an alarm convergence module 2, an alarm mapping module 3, a root cause reasoning module 4, and a result output module 5.

[0056] The knowledge graph construction module 1 is used to execute the function of step S1. The knowledge graph construction module 1 includes an entity modeling submodule, a relation modeling submodule, and a graph storage submodule. The entity modeling submodule collects base station equipment information, network element topology information, alarm type information, and fault mode information from the network management system, configuration management database, and alarm database of the communication network to construct four types of entity nodes. The relation modeling submodule constructs four types of relation edges and calculates causal direction attributes and initial propagation weights based on network topology connection relationships, service carrying relationships, alarm triggering mapping tables, and alarm suppression rules. The relation modeling submodule also includes a cross-vendor alarm semantic alignment unit, used to map heterogeneous alarms to unified standard alarm entities in a multi-vendor network environment. The graph storage submodule uses a graph database to store the knowledge graph, supporting efficient querying and updating of the graph structure. In this embodiment, a native graph database supporting attribute graph models is selected to ensure efficient reading and writing of entity attributes, relation attributes, and propagation weights in the knowledge graph. The graph database is deployed on an independent server cluster and communicates with the alarm convergence module and root cause reasoning module via a high-speed local area network. In this embodiment, the knowledge graph comprises approximately 500,000 entity nodes and 2 million relation edges. The response time for a single subgraph query in the graph database is controlled within 50ms, meeting the latency requirements for real-time inference. The graph database also supports transactional weight update operations, ensuring that concurrent updates of causal propagation relation edge weights by the feedback loop submodule do not lead to data inconsistency.

[0057] Alarm convergence module 2 is used to execute the function of step S2. Alarm convergence module 2 includes an adaptive window calculation submodule and a spatiotemporal clustering submodule. The adaptive window calculation submodule obtains the propagation weights and topological hop counts of causal propagation edges from the knowledge graph construction module 1, calculates the expected value and standard deviation of the causal propagation delay, and determines the width of the adaptive time window. The spatiotemporal clustering submodule performs density clustering using the adaptive time window and spatiotemporal distance metric as parameters, and outputs a set of alarm events.

[0058] The alarm mapping module 3 is used to perform the function of step S3. The alarm mapping module 3 receives the set of alarm events output by the alarm convergence module 2, locates the network element nodes covered by the alarm events in the knowledge graph maintained by the knowledge graph construction module 1, performs multi-hop subgraph activation with these nodes as seeds, and outputs the causal propagation subgraph.

[0059] The root cause reasoning module 4 executes the functions of step S4. Root cause reasoning module 4 is the core computational module of the system, with a built-in graph attention network model. It receives the causal propagation subgraph output by the alarm mapping module 3, performs multi-hop message passing with causal direction awareness, and calculates the probability score of each candidate root cause node. The model parameters of root cause reasoning module 4 are obtained through supervised training on historical fault cases. In the training data, positive samples are confirmed root cause nodes, and negative samples are non-root cause nodes. The training process uses a binary cross-entropy loss function, the optimizer uses the Adam algorithm, the initial learning rate is 0.001, the batch size is 32, the number of training epochs is 100, and an early stopping strategy is used to prevent overfitting. Root cause reasoning module 4 supports GPU-accelerated computation, and can complete the reasoning computation of a causal propagation subgraph containing 5000 nodes within 1.6 minutes on a single GPU. During the deployment phase, Root Cause Inference Module 4 operates in online inference mode, receiving inference requests triggered by real-time alarms and returning root cause localization results. At the same time, it uses newly accumulated fault cases to incrementally update the model parameters periodically in offline training mode.

[0060] The results output module 5 is used to execute the function of step S5. The results output module 5 includes a sorting submodule, a visualization submodule, a work order generation submodule, and a feedback loop submodule. The sorting submodule outputs candidate root cause nodes in descending order of probability scores. The visualization submodule extracts the fault propagation chain from the knowledge graph and renders it as a graph visualization interface. The work order generation submodule queries the fault handling plan library to automatically generate and dispatch work orders. The feedback loop submodule receives confirmation or correction markers from maintenance personnel and sends weight update instructions to the relational modeling submodule of the knowledge graph construction module 1.

[0061] The data flow between the modules forms a closed loop: the output of knowledge graph construction module 1 (knowledge graph) serves as the input basis for alarm convergence module 2 and alarm mapping module 3; the output of alarm convergence module 2 (alarm events) flows into alarm mapping module 3; the output of alarm mapping module 3 (causal propagation subgraph) flows into root cause reasoning module 4; the output of root cause reasoning module 4 (probability score) flows into result output module 5; the output of the feedback closed loop submodule of result output module 5 (weight update instruction) flows back to knowledge graph construction module 1, forming a continuous evolution closed loop of reasoning-feedback-update.

[0062] The effectiveness of the method of this invention was verified in the actual communication network environment of a provincial operator. The test network included approximately 120,000 base stations, 450,000 network elements, and approximately 3 million alarms per day. The test dataset contained 1,860 historical fault cases from January 2024 to June 2024, with root cause annotations confirmed by operations and maintenance personnel covering all cases.

[0063] The method of this invention is compared with three comparative schemes: Comparison Scheme A uses a random forest classification method based on feature vectors, Comparison Scheme B uses a rule-based reasoning method based on topological graph traversal, and Comparison Scheme C uses an alarm correlation analysis method based on statistical frequency. Evaluation metrics include Top-1 root cause localization accuracy, Top-3 root cause localization recall, and average fault location time.

[0064] The experimental results are as follows. The Top-1 root cause localization accuracy of the method of this invention is 85.3%, compared to 68.7% for scheme A, 72.1% for scheme B, and 61.4% for scheme C. The Top-3 root cause localization recall of the method of this invention is 96.2%, compared to 82.5% for scheme A, 85.7% for scheme B, and 74.3% for scheme C. The average fault localization time of the method of this invention is 2.8 min (including approximately 1.2 min for alarm convergence and approximately 1.6 min for graph attention network inference), compared to 5.3 min for scheme A, 8.7 min for scheme B, and 12.4 min for scheme C.

[0065] The differences in location accuracy were analyzed across different fault types. In single-point fault scenarios (i.e., the fault source is only one device), the Top-1 accuracy of the proposed method was 91.2%, significantly higher than that of Comparative Solution A (76.3%) and Comparative Solution B (81.5%). In multi-fault concurrent scenarios (i.e., two or more independent fault sources exist within the same time window), the Top-1 accuracy of the proposed method was 78.4%, while Comparative Solution A dropped to 54.2% and Comparative Solution B to 58.9%. The reason why the proposed method maintains a high accuracy in multi-fault concurrent scenarios is that the union activation strategy of the causal propagation subgraph enables the graph attention network to perform inference on multiple causal links simultaneously, and the causal propagation paths of different fault sources do not interfere with each other on the graph. In cross-level fault propagation scenarios (i.e., the fault propagates from the core layer to the access layer or back), the Top-1 accuracy of the proposed method was 82.7%, while Comparative Solution B, whose rule base mainly covers fault scenarios at the same level, had an accuracy of only 59.6%, demonstrating the value of the cross-level causal modeling capability of knowledge graphs.

[0066] Experimental results show that the method of this invention significantly outperforms existing technologies in both root cause localization accuracy and timeliness, verifying the effectiveness of reconstructing root cause localization from a feature classification paradigm to a causal graph probability propagation paradigm. Further ablation experiments verified the contributions of each core component: removing the alarm suppression relation reversal strategy (i.e., not using alarm suppression rules to construct causal direction attributes), the Top-1 accuracy decreased from 85.3% to 76.8%, indicating that the guiding role of causal direction attributes in inference direction is irreplaceable; removing the causal direction mask (i.e., the attention coefficients of the graph attention network do not distinguish causal direction), the Top-1 accuracy decreased from 85.3% to 79.1%, indicating that the direction-aware message passing mechanism significantly contributes to localization accuracy; replacing the adaptive time window with a fixed 5-minute window, the Top-1 accuracy decreased from 85.3% to 82.7%, indicating that the adaptive window's adaptability in different network scenarios has a positive impact on accuracy but is not a decisive factor.

[0067] Regarding scalability, the method of this invention was tested on networks of varying sizes, ranging from 10,000 to 500,000 network elements. The computation time during the alarm convergence phase increased approximately linearly with the number of alarms, while the computation time during the graph attention network inference phase increased approximately linearly with the number of nodes in the activated subgraph (thanks to the local message passing mechanism on the sparse graph). On a network with 500,000 network elements, the end-to-end processing time for a single root cause localization was still controlled within 3 minutes, meeting the timeliness requirements of telecom operators for fault location.

[0068] The expert feedback closed-loop mechanism continuously improved the positioning accuracy from an initial 78.6% to 85.3% over a 6-month operation period, demonstrating the evolvability of the knowledge graph. During operation, a total of 3247 feedback reports were received from maintenance personnel, of which 82.6% were confirmations and 17.4% were corrections. The weight drift monitoring mechanism detected significant weight drifts in 23 causal relationship edges during operation. Of these, 18 were manually verified as reasonable evolutions caused by network topology changes, and 5 were identified as weight deviations caused by abnormal feedback and were corrected. These results validate the effectiveness of the weight drift monitoring mechanism in preventing knowledge graph degradation.

[0069] The embodiments of the present invention are not limited to the specific embodiments described above. Those skilled in the art can make various equivalent changes or substitutions based on the technical solutions of the present invention, and all such changes or substitutions should be included within the protection scope of the present invention.

Claims

1. A knowledge graph-based method for locating the root cause of base station faults, characterized in that, Includes the following steps: Construct a knowledge graph for the communication network domain, modeling base station equipment, network element topology, alarm types and fault modes as entity nodes, and modeling the physical connections, logical carrying, alarm triggering and causal propagation between entities as relation edges, with each relation edge carrying causal direction attributes and propagation weights; Spatiotemporal clustering convergence is performed on alarm data received within a preset time window to identify alarm sets from the same source and aggregate them into alarm events; The alarm event is mapped to the corresponding entity node in the knowledge graph, and the causal propagation subgraph associated with the alarm event is activated; Multi-hop message passing is performed along the causal relationship edges of the causal propagation subgraph using a graph attention network to calculate the probability score of each candidate root cause node. The attention coefficient calculation of the graph attention network incorporates causal direction encoding, including: extracting the causal direction attribute of each causal relationship edge in the causal propagation subgraph and encoding it as a direction vector; concatenating the direction vector with the source node feature vector and the target node feature vector, and calculating the original attention coefficient using a learnable attention parameter matrix; applying a causal direction mask to the original attention coefficient to attenuate the message passing attention coefficient in the reverse causal direction to a preset attenuation factor; performing normalization processing on the attenuated attention coefficient, and propagating hop-by-hop along the causal direction to update the hidden state representation of each node until a preset number of propagation hops is reached. The candidate root cause nodes are sorted in descending order according to the probability scores, and the nodes with the highest ranking are output as the root cause location results.

2. The method according to claim 1, characterized in that, In constructing the knowledge graph of the communication network domain, alarm suppression relationships are modeled as causal direction inference signals, specifically including: The alarm suppression rules recorded by the network management system in the communication network are collected. The alarm suppression rules indicate the set of child alarms that are automatically blocked when a parent alarm is generated. The direction from the parent alarm entity to the child alarm entity in the alarm suppression rule is modeled as the direction attribute of the causal propagation relationship edge, where the parent alarm entity is labeled as the upstream causal node and the child alarm entity is labeled as the downstream causal node. Based on the historical co-occurrence frequency of parent-child alarm pairs in the alarm suppression rules, the initial propagation weight of the causal propagation relationship edge is calculated.

3. The method according to claim 2, characterized in that, Before modeling the direction from the parent alarm entity to the child alarm entity in the alarm suppression rule as the direction attribute of the causal propagation relationship edge, a cross-vendor alarm semantic alignment step is also included: Extract the alarm name, alarm category, and alarm parameter fields from the alarm data of each vendor's network management system; Construct a unified alarm semantic space and encode heterogeneous alarm texts from various manufacturers into semantic vectors through a pre-trained language model; In the unified alarm semantic space, the cosine similarity threshold is used as the criterion to map semantically equivalent heterogeneous alarms to the same standard alarm entity. The cross-vendor mapping results are written back to the alarm type entity attributes of the knowledge graph.

4. The method according to claim 3, characterized in that, In the process of performing spatiotemporal clustering convergence on the alarm data received within a preset time window, the preset time window is an adaptive window based on causal propagation delay estimation, specifically including: Read the propagation weight of the causal propagation relationship edge in the knowledge graph and the topological hop count between the network element nodes connected by the relationship edge; Estimate the expected value and variance of the causal propagation delay based on the propagation weight and the topology hop count; The width of the time window is set to the sum of the expected value of the causal propagation delay and the standard deviation of a preset multiple; For alarm data falling within the adaptive time window, density clustering is performed using the topological distance between the alarm location and the time difference between the alarm occurrence time as a metric, and alarms with reachable density are aggregated into the same alarm event.

5. The method according to claim 1, characterized in that, After sorting the candidate root cause nodes in descending order according to the probability scores, the method further includes an expert feedback closed-loop update step: Receive confirmation or correction flags from maintenance personnel regarding the root cause location results of the fault; When a confirmation flag is received, the propagation weights of each relation edge on the causal propagation path where the confirmed root cause node is located in the knowledge graph are increased. When a correction flag is received, the propagation weight of each relation edge on the causal propagation path where the denied root cause node is located is reduced, while the propagation weight of each relation edge on the path where the correct root cause node specified by the operations and maintenance personnel is increased. The updated propagation weights are written back to the knowledge graph for use in calculating the attention coefficients of the graph attention network during subsequent root cause localization.

6. The method according to claim 1, characterized in that, After the nodes with the highest output ranking are used as the root cause location results, the following are also included: Extract the causal propagation path from the root cause node corresponding to the fault root cause localization result to each alarm event node from the knowledge graph; The causal propagation path is rendered as a fault propagation link visualization map, in which the alarm time, alarm level and propagation weight of each path node are marked.

7. The method according to claim 1, characterized in that, After the nodes with the highest output ranking are used as the root cause location results, the following are also included: Based on the fault root cause location results, query the preset fault handling plan library to obtain the handling plan that matches the fault mode of the root cause node. Work orders are automatically generated based on the aforementioned handling plan, and these work orders are dispatched to the professional teams corresponding to the root cause nodes.

8. The method according to claim 1, characterized in that, The baseline value of the preset time window is 5 minutes, the preset propagation hop count is 3 to 5 hops, and the output number of the probability score is the first 3 to 5 candidate root cause nodes.

9. A knowledge graph-based base station fault root cause localization system, used to implement the method described in any one of claims 1-8, characterized in that, include: The knowledge graph construction module is used to build a knowledge graph in the field of communication networks. It models base station equipment, network element topology, alarm types and fault modes as entity nodes, and models the physical connections, logical carrying, alarm triggering and causal propagation between entities as relation edges. Each relation edge carries causal direction attributes and propagation weight. The alarm convergence module is used to perform spatiotemporal clustering convergence on alarm data received within a preset time window, identify alarm sets from the same source and aggregate them into alarm events; The alarm mapping module is used to map the alarm event to the corresponding entity node in the knowledge graph and activate the causal propagation subgraph associated with the alarm event. The root cause reasoning module is used to perform multi-hop message passing along the causal relationship edges of the causal propagation subgraph through a graph attention network, calculate the probability score of each candidate root cause node, wherein the attention coefficient calculation of the graph attention network is fused with causal direction encoding, extracts causal direction attributes for each causal relationship edge in the causal propagation subgraph and encodes them into direction vectors to participate in the original attention coefficient calculation, and applies a causal direction mask to the original attention coefficients so that the message passing attention coefficients in the reverse causal direction are attenuated to a preset attenuation factor; The result output module is used to sort the candidate root cause nodes in descending order according to the probability score, and output the nodes with the highest ranking as the root cause location results.

Images