Cloud edge collaboration-based data center cross-domain monitoring management method and system

Abstract

The application discloses a cloud edge collaborative data center cross-domain monitoring management method and system, which comprises the following steps: uploading a monitoring event set associated with a time credibility vector to a cloud-side monitoring analysis node by an edge monitoring node; constructing a cross-domain monitoring causal semantic graph and calculating an initial time weight of a causal edge by the cloud side; solving an edge node time offset by a global time default function; correcting a monitoring event timestamp and updating a weight; calculating an abnormal propagation probability by combining a network and a scheduling state by the cloud side; forming a probability causal propagation graph; inputting the graph and the corrected timestamp; iteratively performing abnormal propagation path determination, confidence calculation, time offset correction and parameter updating operations until a convergence condition is met. The method realizes cloud edge collaborative cross-domain monitoring management, accurately infers an abnormal propagation path, and improves the accuracy and stability of cross-domain monitoring.

Description

Technical Field

[0001] This application relates to the field of data center monitoring technology, specifically a data center cross-domain monitoring and management method and system based on cloud-edge collaboration. Background Technology

[0002] In a cross-domain architecture consisting of multiple data centers, edge computing nodes, and hybrid clouds, the core requirement for data center monitoring and management is to accurately identify the causal relationships of monitoring events and locate the root causes of anomalies. However, current cross-domain monitoring systems generally suffer from semantic distortion of monitoring causality, which seriously affects the accuracy and reliability of monitoring and management, and has become a technical problem that urgently needs to be solved in the industry.

[0003] Existing cross-domain monitoring solutions mostly implement time synchronization or anomaly root cause localization separately, without establishing a collaborative processing mechanism between the two. This fails to address the complex problem arising from the coupling of time semantic distortion and anomaly propagation semantic distortion. On the one hand, factors such as edge node clock skew, monitoring data queue delays, out-of-order cross-domain transmission, and virtualization scheduling time jitter can easily cause errors in the sequence of monitoring events and disordered causal order of business call chains, leading to time semantic distortion. On the other hand, variable cross-domain network paths, service mesh retries amplifying anomalies, resource contention leading to pseudo-propagation, and asynchronous monitoring sampling creating synchronization illusions can cause oscillations in anomaly root cause localization and misjudgment of propagation paths, resulting in anomaly propagation semantic distortion.

[0004] Meanwhile, existing technologies lack verification and correction mechanisms for cloud-edge collaboration. Pure cloud-side global analysis is susceptible to the aforementioned distortion issues, resulting in unstable analysis results, high false alarm rates, and difficulty in suppressing abnormal storms. Furthermore, some solutions rely on dedicated hardware for time synchronization, which has poor adaptability in edge environments with weak time synchronization and cannot meet the actual engineering needs of cross-domain monitoring. Summary of the Invention

[0005] The purpose of this application is to provide a cloud-edge collaborative data center cross-domain monitoring and management method and system to solve the problems mentioned in the background art.

[0006] According to the first aspect of this application, a cross-domain monitoring and management method for data centers based on cloud-edge collaboration is provided, comprising the following steps: The time reliability vector is associated with the set of monitoring events and then uploaded to the cloud-side monitoring and analysis node. The time reliability vector is constructed based on local clock stability-related data, and the monitoring events are obtained based on the monitoring data and are structured and encapsulated. The monitoring events include at least the original timestamp and node identifier. Based on the set of monitoring events, the cloud-side monitoring and analysis node establishes causal edges according to the correlation between the monitoring events, constructs a cross-domain monitoring causal semantic graph with each monitoring event as a node, and calculates the initial time weight of each causal edge based on the time credibility vector and the original timestamp. Based on the causal time constraint relationship reflected by the causal edges in the cross-domain monitoring causal semantic graph, a global time default function is constructed, and the time offset of each edge monitoring node is obtained by solving the minimum value of the global time default function. The original timestamps of each monitoring event are corrected using the time offset to obtain corrected timestamps, and the initial time weights of each causal edge in the cross-domain monitoring causal semantic graph are updated based on the corrected timestamps. Based on the updated cross-domain monitoring causal semantic graph, the anomaly propagation probability of each causal edge is calculated according to the network state and scheduling state to form a probabilistic causal propagation graph. Using the probabilistic causal propagation graph and the corrected timestamp as input, perform the following operations iteratively until a preset convergence condition is met: determine the abnormal propagation path based on the current corrected timestamp and the probabilistic causal propagation graph, calculate the propagation confidence of each abnormal propagation path, use the propagation path whose propagation confidence meets the preset condition to reverse correct the time offset of each edge monitoring node, and update the corrected timestamp and the abnormal propagation probability of each causal edge in the probabilistic causal propagation graph based on the corrected time offset.

[0007] Preferably, the time reliability vector includes average time offset, offset variance, queue dwell time, and network round-trip latency; the average time offset is the arithmetic mean of the time offset between the local clock of the edge monitoring node and the clock of the network time protocol server within a preset statistical period; the offset variance is the variance of the time offset; the queue dwell time is the average dwell time of monitoring data in the monitoring agent queue; and the network round-trip latency is the average network round-trip latency between the edge monitoring node and the cloud-side monitoring and analysis node.

[0008] Preferably, the step of establishing causal edges based on the correlation between monitoring events specifically includes: for two monitoring events with a direct service call relationship, establishing a one-way causal edge from the call initiating event node to the called response event node; for two monitoring events with data transmission dependencies based on network topology, establishing a one-way causal edge from the data packet generating node to the link transmission node; and for two monitoring events with a resource contention relationship, establishing a bidirectional causal edge.

[0009] Preferably, the step of calculating the initial time weight of each causal edge based on the time credibility vector and the original timestamp specifically involves: determining a first time factor based on the difference in the original timestamps of the monitoring events at both ends of the causal edge; determining a second time factor based on the time credibility vector of the node that generates the monitoring event; and multiplying the first time factor and the second time factor by their respective weight coefficients and then summing them to obtain the initial time weight.

[0010] Preferably, the construction of the global time default function, which obtains the time offset of each edge monitoring node by solving for the minimum value of the global time default function, specifically includes: the global time default function is the sum of the time default values ​​of all monitoring event node pairs with causal edges, where the time default value of each node pair is 0, and the sum of the original timestamp of node i plus the minimum propagation time minus the original timestamp of node j minus the time offset of node j plus the time offset of node i, and the maximum value of the sum of the two values; the belief propagation algorithm is used to solve for the time offset of each edge monitoring node when the global time default function is minimized.

[0011] Preferably, the step of calculating the anomaly propagation probability of each causal edge based on the network state and scheduling state specifically involves: calculating the anomaly propagation probability using a weighted fusion model, wherein the anomaly propagation probability is equal to 1 minus the sum of the network jitter normalized value, the scheduling migration frequency normalized value, and the monitoring sampling period difference normalized value multiplied by their respective fusion weight coefficients.

[0012] Preferably, the step of determining abnormal propagation paths based on the current corrected timestamp and the probabilistic causal propagation graph, and calculating the propagation confidence of each abnormal propagation path, specifically includes: using a path search algorithm to select causal edges with propagation probabilities higher than a preset confidence threshold from the probabilistic causal propagation graph to form candidate propagation paths; for each candidate propagation path, the propagation confidence is obtained by multiplying the product of the propagation probabilities of all causal edges in the path, the temporal consistency score of the path, and the topological rationality score of the path by the corresponding confidence weight coefficients and summing them.

[0013] Preferably, the step of using propagation paths with propagation confidence levels meeting preset conditions to reverse-correct the time offset of each edge monitoring node specifically includes: taking propagation paths with propagation confidence levels higher than a preset high confidence threshold as high confidence propagation paths; constructing a reverse-correction global time default function, wherein the reverse-correction global time default function is the sum of the time default values ​​of node pairs in all high confidence propagation paths, with the time default value of each node pair being 0, and the maximum value between the corrected timestamp of node i plus the minimum propagation time minus the corrected timestamp of node j minus the time offset correction value of node j plus the time offset correction value of node i; solving for the time offset correction value of each edge monitoring node when the reverse-correction global time default function reaches its minimum value, and updating the original time offset to the sum of the original time offset and the time offset correction value.

[0014] Preferably, after satisfying the preset convergence condition, the method further includes: using the corrected timestamp, the propagation confidence in the probabilistic causal propagation graph, and the causal topology as input data, and importing them into a pre-trained temporal graph neural network; the temporal graph neural network sequentially extracts spatial features through a graph convolutional layer, extracts temporal features through a temporal feature extraction layer, and fuses spatial and temporal features through a feature fusion layer, and finally obtains the root cause probability of each monitoring event node, the propagation path stability of each propagation path, and the temporal anomaly probability of each node through the output layer; the cloud-side monitoring and analysis node determines the final root cause node and the abnormal propagation path based on the root cause probability, propagation path stability, and temporal anomaly probability.

[0015] In a second aspect, this application also provides a cloud-edge collaborative data center cross-domain monitoring and management system, comprising: Data acquisition and encapsulation modules deployed at various edge monitoring nodes, and monitoring and analysis nodes deployed on the cloud side; The data acquisition and encapsulation module is used to associate the time reliability vector with the monitoring event set and then upload it to the cloud-side monitoring and analysis node; wherein, the time reliability vector is constructed based on local clock stability related data, the monitoring event is obtained based on monitoring data and structured encapsulation, and the monitoring event at least includes the original timestamp and node identifier. The cloud-side monitoring and analysis node includes: The causal semantic graph construction unit is used to receive the set of monitoring events, establish causal edges according to the correlation between the monitoring events, construct a cross-domain monitoring causal semantic graph with each monitoring event as a node, and calculate the initial time weight of each causal edge based on the time credibility vector and the original timestamp. The time offset calculation unit is used to construct a global time default function based on the causal time constraint relationship reflected by the causal edges in the cross-domain monitoring causal semantic graph, and obtain the time offset of each edge monitoring node by solving for the minimum value of the global time default function. The timestamp correction unit is used to correct the original timestamps of each monitoring event using the time offset to obtain the corrected timestamps, and to update the initial time weights of each causal edge in the cross-domain monitoring causal semantic graph based on the corrected timestamps. The probability propagation graph generation unit is used to calculate the anomaly propagation probability of each causal edge based on the updated cross-domain monitoring causal semantic graph, according to the network state and scheduling state, and form a probability causal propagation graph. The iterative correction unit is used to iteratively perform the following operations with the probabilistic causal propagation graph and the corrected timestamp as input until a preset convergence condition is met: determine the abnormal propagation path based on the current corrected timestamp and the probabilistic causal propagation graph, calculate the propagation confidence of each abnormal propagation path, use the propagation path whose propagation confidence meets the preset condition to reverse correct the time offset of each edge monitoring node, and update the corrected timestamp and the abnormal propagation probability of each causal edge in the probabilistic causal propagation graph based on the corrected time offset.

[0016] This application provides a quantitative representation of time analysis by constructing a time credibility vector, builds a cross-domain monitoring causal semantic graph by combining the causal relationships of monitored events, and accurately solves the time offset based on a global time default function to achieve effective correction of the timestamps of monitored events. The core mechanism utilizes a collaborative iterative mechanism of time correction and anomaly propagation inference, allowing them to constrain each other and converge jointly, effectively avoiding error amplification and inference oscillation problems caused by independent processing. Furthermore, it combines a time-series graph neural network to achieve accurate inference of complex causal relationships, and can further correct analysis results through counterfactual verification via cloud-edge collaboration. This invention is adaptable to edge environments with weak time synchronization, significantly reduces the false alarm rate of cross-domain monitoring, improves the accuracy and stability of anomaly root cause localization, effectively suppresses anomaly storms, accurately restores the true causal relationships of monitored events, and provides a reliable management solution for cross-domain monitoring in multi-data center, edge computing node, and hybrid cloud environments. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 A schematic diagram of a data center cross-domain monitoring and management method based on cloud-edge collaboration provided in this application embodiment; Figure 2 This is a schematic diagram of the time offset calculation process provided in the embodiments of this application; Figure 3 A schematic diagram of the collaborative iterative process for time correction and propagation inference provided in the embodiments of this application; Figure 4 This is a schematic diagram of a time-series graph neural network structure provided in an embodiment of this application; Figure 5 This is a schematic diagram of a data center cross-domain monitoring and management system based on cloud-edge collaboration, provided as an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] The following detailed description, in conjunction with specific embodiments, illustrates the implementation process of the cloud-edge collaborative data center cross-domain monitoring and management method described in this application. It should be noted that this embodiment is merely for explaining this application and not for limiting the scope of protection of this application. Any conventional adjustments or substitutions made by those skilled in the art to the various steps without departing from the concept of this application should be included within the scope of protection of this application.

[0021] This method is applicable to cross-domain monitoring systems in multi-data center, edge computing node, and hybrid cloud environments. It is also suitable for cross-domain monitoring scenarios with heterogeneous virtualization, weak time synchronization, service mesh, and microservices. The execution entity can be an edge monitoring node with a monitoring agent deployed or a cloud-side monitoring and analysis node with cross-domain unified monitoring and analysis. Edge and cloud-side nodes complete data interaction and command transmission through the network. It can be implemented based on existing monitoring agents, log collection components, and analysis platforms.

[0022] like Figure 1 As shown in the diagram, this application discloses a schematic diagram of a cross-domain monitoring and management method for data centers based on cloud-edge collaboration, including the following method steps: S1, after associating the time reliability vector with the set of monitoring events, upload it to the cloud-side monitoring and analysis node; the time reliability vector is constructed based on local clock stability related data, and the monitoring events are obtained based on the monitoring data and are structured and encapsulated. The monitoring events at least include the original timestamp and node identifier. S2, based on the set of monitoring events, the cloud-side monitoring and analysis node establishes causal edges according to the correlation between the monitoring events, constructs a cross-domain monitoring causal semantic graph with each monitoring event as a node, and calculates the initial time weight of each causal edge based on the time credibility vector and the original timestamp. S3. Based on the causal time constraint relationship reflected by the causal edges in the cross-domain monitoring causal semantic graph, a global time default function is constructed, and the time offset of each edge monitoring node is obtained by solving the minimum value of the global time default function. S4, use the time offset to correct the original timestamps of each monitoring event to obtain corrected timestamps, and update the initial time weights of each causal edge in the cross-domain monitoring causal semantic graph based on the corrected timestamps. S5, based on the updated cross-domain monitoring causal semantic graph, calculates the anomaly propagation probability of each causal edge according to the network state and scheduling state, and forms a probabilistic causal propagation graph; S6, taking the probabilistic causal propagation graph and the corrected timestamp as input, iteratively perform the following operations until the preset convergence condition is met: determine the abnormal propagation path based on the current corrected timestamp and the probabilistic causal propagation graph, calculate the propagation confidence of each abnormal propagation path, use the propagation path whose propagation confidence meets the preset condition to reverse correct the time offset of each edge monitoring node, and update the corrected timestamp and the abnormal propagation probability of each causal edge in the probabilistic causal propagation graph based on the corrected time offset.

[0023] In some embodiments, for step S1, the edge monitoring node first performs a monitoring data collection operation. The collection period can be flexibly configured according to the monitoring metric type. For example, hardware performance metrics can be configured for short-cycle collection, and scheduling event data can be configured for long-cycle collection. The data source for collection is the monitoring agent and log collection component deployed locally on the edge monitoring node. The collected monitoring data includes performance metric data, service call logs, network congestion metrics, and container and virtual machine scheduling events. The edge monitoring node performs unified structured encapsulation of the above monitoring data to form standardized monitoring events. Each monitoring event contains at least an original timestamp. and node identifier For example, it may also include an event identifier ID and an indicator vector. Event Type: The edge monitoring node integrates all structured monitoring events to generate a monitoring event set. .

[0024] In generating a collection of monitoring events Subsequently, the edge monitoring nodes construct a time reliability vector based on local clock stability data. The time credibility vector Includes average time offset Deviation Queue dwell time and network round-trip latency The average time offset The arithmetic mean of the time offsets between the local clock of the edge monitoring node and the network time protocol server clock within a preset statistical period is calculated as follows: In the formula The number of times the time offset is sampled within the preset statistical period. For the first The time offset obtained from the second sampling Configurable to a positive integer not less than 10; offset variance The variance of the time offset is calculated as follows: Used to characterize the dispersion of time offset; queue dwell time The average dwell time of monitoring data in the monitoring agent queue is calculated by the edge monitoring node and taking the arithmetic mean of the dwell times of each data in the monitoring agent queue within a preset period; network round-trip latency. This is the average network round-trip latency between the edge monitoring node and the cloud-side monitoring and analysis node, which is measured by the edge monitoring node by sending probe data packets.

[0025] The edge monitoring node will construct the completed time credibility vector With monitoring event collection The monitoring events are correlated so that each monitoring event corresponds to the time reliability information of the node that generated it. The correlated monitoring event set is then... The data is uploaded to the cloud-based monitoring and analysis node, using either real-time or near real-time transmission. Simultaneously, the edge monitoring node retains a local copy, with the retention period configurable to a preset duration. This resolves the time correction bias issue caused by the lack of reliable representation of time data in existing technologies, thus improving the accuracy of time analysis.

[0026] In some embodiments, for step S2, the cloud-side monitoring and analysis node receives the set of monitoring events with associated time reliability vectors uploaded by the edge monitoring node. Then, using each monitoring event as a node, causal edges are established based on the relationships between the monitoring events, thereby constructing a cross-domain monitoring causal semantic graph. .

[0027] When establishing causal edges, for two monitoring events with a direct service call relationship, a one-way causal edge is established from the call initiating event node to the called response event node; for two monitoring events with data transmission dependencies based on network topology, a one-way causal edge is established from the data packet generating node to the link transmission node; and for two monitoring events with a resource contention relationship, a bidirectional causal edge is established.

[0028] After establishing the causal edges, the cloud-side monitoring and analysis nodes are based on the time reliability vector. and original timestamp Calculate the initial time weights of each causal edge. Specifically, the first time factor is determined based on the difference in the original timestamps of the monitored events at both ends of the causal edge. First time factor The calculation formula is In the formula This represents the difference in the original timestamps of the events monitored at both ends of the causal edge. for The absolute value; based on the time reliability vector of the node generated by the monitored event. Determine the second time factor , Specifically, firstly, the time credibility vector The components are normalized to obtain the normalized average time offset. Deviation Queue dwell time and network round-trip latency For example, min-max normalization can be used. ,in and These represent the maximum and minimum average time offsets in historical statistics. Then, the normalized components are comprehensively quantized to obtain... The calculation formula is In the formula , , , These are sub-weight coefficients, and their values ​​range from [value range missing]. And satisfy Its value can be obtained by constructing a simple linear regression model, using the accuracy of historical fault diagnosis or F1-score as the optimization objective, and learning it using optimization algorithms such as gradient descent. Then, it can be further derived from... Calculate the second time factor Then the first time factor Second time factor The initial time weights are obtained by multiplying each weight by its corresponding weighting coefficient and then summing the results. The calculation formula is In the formula , These are weighting coefficients, and their values ​​range from [value range missing]. And satisfy Its value can be calibrated according to the actual application scenario. For example, in a weak time synchronization environment, it can be... Configure to a larger value.

[0029] In this embodiment, the constructed cross-domain monitoring causal semantic graph takes causal relationships as its core, which is different from the traditional connection relationship topology graph. It can solve the problem of inaccurate root cause location caused by the lack of a unified causal relationship representation. The calculation of the initial time weight combines the timestamp difference and time credibility, making the weight more in line with the actual time characteristics.

[0030] In some embodiments, for step S3, the cloud-side monitoring and analysis node is based on the cross-domain monitoring causal semantic graph. By considering the causal-temporal constraints embodied by the causal edges, a global temporal default function is constructed. The time offset of each edge monitoring node is obtained by solving for the minimum value of this function. .

[0031] Please see Figure 2 , Figure 2 This is a schematic diagram of the time offset calculation process provided in an embodiment of this application. In S201, a global time offset function is constructed. To quantify the degree of default, a global time default function is used. This is the sum of the time default values ​​for all monitoring event node pairs with causal edges. For cross-domain monitoring causal semantic graphs... Any monitoring event node pair with causal edges exists in the middle. , Its causal time constraint relationship satisfies In the formula For nodes The original timestamp of the corresponding monitoring event. For nodes The original timestamp of the corresponding monitoring event. For nodes To the node The minimum propagation time is calculated by the cloud-side monitoring and analysis node based on the network topology and node processing capabilities. For example, it is the sum of the minimum network latency between nodes and the minimum processing latency of the node.

[0032] When there is a time offset in the edge monitoring node, the original timestamp will deviate, causing the above-mentioned causal time constraint relationship to be violated. Therefore, this embodiment constructs a global time violation function. To quantify the degree of default, a global time default function is used. The sum of the time default values ​​for all monitoring event node pairs with causal edges is calculated as follows: In the formula This represents all monitoring event node pairs with causal edges. For nodes The corresponding time offset of the edge monitoring node, For nodes The corresponding time offset of the edge monitoring node, Indicates taking 0 and The maximum value in the time constraint is 0 when the causal time constraint is not violated, and the actual time constraint difference when it is violated.

[0033] In S202, the cloud-side monitoring and analysis node uses the belief propagation algorithm to solve for the global time default function. Time offset of each edge monitoring node when taking the minimum value For example, when employing a belief propagation algorithm, cross-domain monitoring of causal semantic graphs is performed. As a factor plot, the time offset As the variables to be solved, the causal time constraint relationship is used as a factor function. The optimal values ​​of each variable are iteratively solved by passing belief information through the factor graph. The iteration terminates when the difference between the global time default function values ​​obtained from two consecutive iterations is less than a preset threshold, which can be configured as a positive number close to 0. The solved time offset is... The data will be stored in a local database on the cloud side, along with the corresponding node identifier. Related.

[0034] In some embodiments, for step S4, the cloud-side monitoring and analysis node uses the time offsets of each edge monitoring node obtained from the solution. For the set of monitoring events Original timestamps of each monitored event Perform correction to obtain the corrected timestamp. The correction formula is: If the time offset A positive value indicates that the local clock of the edge monitoring node is slower than the standard time, and the original timestamp is incremented; if the time offset is... A negative value indicates that the local clock of the edge monitoring node is ahead of the standard time, and the original timestamp is reduced. The cloud-side monitoring and analysis node analyzes the set of monitoring events. Perform the above correction operation on each of the monitored events, and then update the monitored event set after completion. Corrected timestamp Replace the original timestamp .

[0035] After obtaining the corrected timestamp Subsequently, the cloud-based monitoring and analysis nodes use this corrected timestamp as a basis. Update cross-domain monitoring causal semantic graph Initial time weights of each causal edge The update method is consistent with the initial time weight calculation method, only the original timestamp in the calculation process is changed. Replace with corrected timestamp Recalculate the first time factor And combined with the second time factor Obtain the updated initial time weights Subsequently, cross-domain monitoring of causal semantic graphs will be implemented. The initial time weights in the original text are replaced with the updated ones. Complete the update of the cross-domain monitoring causal semantic graph.

[0036] In some embodiments, for step S5, the cloud-side monitoring and analysis node is based on the updated cross-domain monitoring causal semantic graph. Calculate the anomaly propagation probability of each causal edge based on the network state and scheduling state. Based on this anomaly propagation probability, a probabilistic causal propagation graph is formed. .

[0037] Specifically, network status data uses network jitter statistics, and scheduling status data includes scheduling migration frequency and differences in monitoring sampling periods. Both of these data are obtained by cloud-side monitoring and analysis nodes from the monitoring event set. This data is extracted from auxiliary statistical data uploaded by edge monitoring nodes. First, the above data is normalized to obtain the network jitter normalized value. Normalized value of scheduling migration frequency Normalized value of difference between monitoring sampling period Network jitter normalized value The value is obtained by dividing the network jitter statistics by the preset maximum network jitter value, and the range is: Normalized value of scheduling migration frequency It is obtained by dividing the scheduling migration frequency by the preset maximum scheduling migration frequency, and the value range is: ; Normalized value of difference in monitoring sampling period It is obtained by dividing the absolute value of the difference in the monitoring sampling period by the preset maximum difference in the sampling period, and the value range is: The preset maximum network jitter value, preset maximum scheduling migration frequency, and preset maximum sampling period difference can all be obtained from historical monitoring data, and the statistical sample size can be set to no less than 50 groups.

[0038] Subsequently, a weighted fusion model was used to calculate the anomaly propagation probability. The calculation formula is In the formula , , The fusion weighting coefficients all have values ​​ranging from [value range missing]. And satisfy Its value is determined based on the importance of the influencing factors of abnormal propagation. For example, in cross-domain scenarios with unstable network environments, it can be... Configured to a larger value, it can be used in environments with frequent virtualization scheduling. The configuration is set to a large value, and the calibration of the fusion weight coefficient can be achieved by combining regression analysis with historical fault propagation data. The confidence level of the regression analysis is not less than 90%.

[0039] Cloud-based monitoring and analysis nodes on the updated cross-domain monitoring causal semantic graph The probability of anomaly propagation is calculated for each causal edge in the algorithm. The anomaly propagation probability is then used as the weight of the corresponding causal edge, and the cross-domain monitoring causal semantic graph with the anomaly propagation probability added is defined as a probabilistic causal propagation graph. This probability causal propagation diagram Inherited from cross-domain monitoring causal semantic graph The node and causal edge structure adds information about the probability dimension of anomaly propagation.

[0040] By quantitatively analyzing network and scheduling states to calculate the probability of anomaly propagation, quantitative modeling of the uncertainty of anomaly propagation is achieved, solving the problems of root cause localization oscillation and propagation path misjudgment caused by semantic distortion of anomaly propagation.

[0041] In some embodiments, for step S6, the cloud-side monitoring and analysis node uses a probabilistic causal propagation graph. and corrected timestamp As input, iteratively execute operations such as anomaly propagation path determination, propagation confidence calculation, time offset reverse correction, and anomaly propagation probability update until the preset convergence condition is met.

[0042] Please see Figure 3 , Figure 3 This is a schematic diagram of the collaborative iterative process for time correction and propagation inference provided in an embodiment of this application. In S301, the cloud-side monitoring and analysis node calculates the time correction based on the current corrected timestamp. Probability causal propagation graph Determine the anomaly propagation path. Specifically, a path search algorithm can be used to analyze the probabilistic causal propagation graph. Candidate propagation paths are formed by selecting causal edges with a propagation probability higher than a preset confidence threshold. The path search algorithm can be a depth-first search algorithm, a breadth-first search algorithm, or a Dijkstra's algorithm. The preset confidence threshold ranges from [value missing]. The accuracy can be calibrated according to the requirements of fault diagnosis. After screening out candidate propagation paths, the rationality is verified by combining the business scenario of cross-domain monitoring and network topology. Paths that do not conform to the actual propagation rules are eliminated. For example, propagation paths that exist in network isolation but are still screened out are eliminated, and finally several reasonable abnormal propagation paths are obtained.

[0043] In S302, for each reasonable abnormal propagation path, the cloud-side monitoring and analysis node calculates its propagation confidence. The calculation formula is: In the formula This is an abnormal propagation path. Represents all causal edges in the path. For the first in the path The probability of anomalous propagation of a causal edge. It is the product of the anomaly propagation probabilities of all causal edges in the path; The time consistency score for the path is obtained by comparing the corrected timestamp difference between all adjacent monitored event nodes in the path with the minimum propagation time, with a value range of [value missing]. The higher the degree of matching, the better. The closer to 1; The topological rationality score of the path is determined by the degree of matching between the path and the actual network topology and service call topology, with a value range of [value missing]. The higher the degree of matching, the better. The closer to 1; , , This is the confidence weighting coefficient, and its value range is [missing value]. And satisfy Its value can be calibrated according to the actual scenario. For example, in scenarios where temporal semantics plays a key role in propagation inference, it can be... The value is configured to be relatively large. This coefficient can also be obtained through self-learning from the verification results of historical fault propagation paths, and the number of self-learning iterations is not less than 50.

[0044] In S303, the cloud-side monitoring and analysis node identifies propagation paths with a confidence level higher than a preset high-confidence threshold as high-confidence propagation paths. The preset high-confidence threshold has a range of values. Its value is higher than the preset confidence threshold and can be calibrated according to the accuracy requirements of fault diagnosis. Then, the time offset of each edge monitoring node is corrected in reverse using a high-confidence propagation path. First, a reverse correction global time default function is constructed. This function is the sum of the time default values ​​of all node pairs in the high-confidence propagation path, and its calculation formula is: In the formula For all node pairs in the high-confidence propagation path, , They are nodes , The corrected timestamp , They are nodes , The time offset correction value. The same algorithm used to solve the global time default function is employed to solve for the reverse correction of the global time default function. Time offset correction values ​​for each edge monitoring node when the minimum value is taken And update the original time offset to the sum of the original time offset and the time offset correction value, that is... The corrected time offset is obtained. .

[0045] In S304, the cloud-side monitoring and analysis node uses the corrected time offset. Recalculate the corrected timestamps for each monitored event and recalculate the probabilistic causal propagation graph. Anomaly propagation probability of each causal edge The formula for calculating the corrected timestamp of each monitored event is as follows: This completes the update of the corrected timestamp. Simultaneously, based on the updated corrected timestamp... Recalculate the probability causal propagation graph Anomaly propagation probability of each causal edge The update method is consistent with the calculation method of the anomaly propagation probability, only replacing the input time data with the updated corrected timestamp. Furthermore, the anomaly propagation probability is further optimized by incorporating information from high-confidence propagation paths. For causal edges in high-confidence propagation paths, their anomaly propagation probability is increased by a preset percentage; for causal edges in removed low-confidence propagation paths, their anomaly propagation probability is decreased by a preset percentage. The optimized anomaly propagation probability remains at [a certain level]. Within the range of values, for example, the preset ratio can be configured as 5%-10%.

[0046] In S305, the cloud-side monitoring and analysis node determines whether a preset convergence condition is met. The preset convergence condition is that the time offset change is less than a threshold. And the change in propagation probability is below the threshold. The time offset change is the maximum change in the time offset of each node obtained from two consecutive iterations, and the propagation probability change is the maximum change in the anomaly propagation probability of each causal edge obtained from two consecutive iterations. Configurable to milliseconds. It can be configured to a positive number within 0.01, which can be configured according to the accuracy requirements of the actual application scenario. If the convergence condition is not met, the process returns to the above abnormal propagation path determination step to continue iterating; if the convergence condition is met, the iteration terminates, and the final time offset, corrected timestamp, and probabilistic causal propagation graph are obtained.

[0047] In some embodiments, the method may optionally further include, after satisfying a preset convergence condition, the cloud-side monitoring and analysis node performs a validity judgment on the iteration results. If it is determined that the propagation confidence of multiple propagation paths is close or the root cause probability oscillates, a counterfactual verification request is sent to the corresponding edge monitoring node. The criterion for determining that the propagation path confidence is close is the ranking of the top... The absolute values ​​of the propagation confidence differences along the propagation paths are all lower than the preset difference threshold. It can be configured as a positive integer not less than 2, and the difference threshold can be configured as a positive number within 0.1; the criterion for determining root cause probability oscillation is that the absolute value of the probability change of the root cause node obtained in two adjacent iterations is higher than the preset oscillation threshold, and the oscillation threshold can be configured as a positive number within 0.05. All of the above thresholds can be configured according to the actual application scenario.

[0048] The counterfact check request includes the propagation path to be verified, the root cause node to be verified, the verification indicator type, and the verification time range. The verification indicator type is consistent with the indicator type of the monitoring event. The verification time range is a preset duration before and after the occurrence time of the event to be verified. For example, it can be configured to be a certain number of minutes before and after the occurrence time of the event. After receiving the counterfact check request, the edge monitoring node performs local resource contention reconstruction, indicator trend replay, and scheduling behavior correlation analysis based on the locally retained copy of the monitoring event. Local resource contention reconstruction refers to reconstructing the resource contention scenario of the node to be verified based on the resource usage data within the verification time range to determine whether the anomaly is caused by false propagation due to resource contention. Indicator trend replay refers to replaying the trend curve of the indicator to be verified within the verification time range and analyzing the time pattern of the indicator anomaly in combination with the corrected timestamp to determine whether it is false propagation caused by time distortion. Scheduling behavior correlation analysis refers to associating the event to be verified with the scheduling behavior within the verification time range to analyze whether the scheduling behavior is the cause of the abnormal propagation.

[0049] After completing the above verification operations, the edge monitoring node generates a counterfactual verification report. This report includes the verification results, verification basis, and anomaly cause determination. The anomaly cause determination is divided into three categories: true propagation, false propagation caused by time distortion, and pseudo propagation caused by resource competition. The counterfactual verification report is then uploaded to the cloud-side monitoring and analysis node. The cloud-side monitoring and analysis node corrects the results of the collaborative iteration based on the verification report, eliminating false propagation paths and pseudo propagation paths, and re-determining the true anomaly propagation paths and root cause nodes. If the iteration results are found to be incorrect, the collaborative iteration operation is re-executed based on the verification report until accurate analysis results are obtained. This cloud-edge collaborative counterfactual verification mechanism solves the misjudgment problem that easily occurs in pure cloud-side analysis, improving the accuracy of fault diagnosis.

[0050] In some embodiments, further, after completing the correction of the collaborative iteration results, the cloud-side monitoring and analysis node uses the corrected timestamp, the propagation confidence in the probabilistic causal propagation graph, and the causal topology as input data and imports them into a pre-trained time-series graph neural network. By performing causal inference operations, the root cause probability of each monitored event node, the propagation path stability of each propagation path, and the temporal anomaly probability of each node are obtained, thereby determining the final root cause node and the abnormal propagation path.

[0051] Please see Figure 4 , Figure 4 This is a schematic diagram of the temporal graph neural network structure provided in an embodiment of this application. The temporal graph neural network is an end-to-end deep learning architecture that integrates graph neural networks and recurrent neural networks. It includes core modules such as an input layer, a graph convolutional layer, a temporal feature extraction layer, a feature fusion layer, and an output layer. The modules are connected in a fully connected manner, with the output of the previous module serving as the input of the next module.

[0052] The input layer standardizes the input data, using a min-max normalization method to map the data to... Within the range of values, model training bias caused by different data units is avoided; the graph convolutional layer adopts the graph attention convolution algorithm, based on the adjacency matrix of the causal topology, and captures the correlation strength between nodes by assigning attention weights to different causal edges. The attention weights are determined by the propagation confidence, and the output is the spatial feature vector of each monitoring event node. The feature vector dimension can be configured to 64, 128, or 256 dimensions; the temporal feature extraction layer adopts the gated recurrent unit algorithm, taking the corrected time series and spatial feature vector of each node as input, extracting the temporal dimension features, solving the gradient vanishing problem of traditional recurrent neural networks, and outputting the temporal feature vector of each monitoring event node, with the dimension consistent with the spatial feature vector; the feature fusion layer adopts a combination of concatenation fusion and attention fusion, concatenating the spatial feature vector and temporal feature vector, and assigning attention weights to different dimensions through the attention mechanism to highlight key features. The attention weights are obtained by model training self-learning, and the output is the fused feature vector of each node; the output layer adopts a fully connected layer combined with the softmax activation function, containing three output branches, corresponding to the root cause probability, propagation path stability, and temporal anomaly probability, respectively. Each output value is mapped to The range of values.

[0053] In one embodiment, the training data for the time-series graph neural network is historical cross-domain monitoring data, including a set of historical monitoring events, historical time offsets, historical anomaly propagation paths, and historical fault root cause annotations. The training sample size can be set to no less than 1000 groups, covering different cross-domain scenarios and fault types. The model is trained using supervised learning, and the loss function is a weighted sum of the cross-entropy loss function and the mean squared error loss function, calculated as follows: In the formula Cross-entropy loss function, used to measure the deviation between predicted and true values ​​of root cause probability and temporal anomaly probability. The mean squared error loss function measures the deviation between the predicted and actual values ​​of the propagation path stability. This is the loss weighting coefficient, and its value range is... It can be configured according to the actual situation.

[0054] The training optimizer uses an adaptive moment estimation optimizer, and the learning rate adopts a dynamic adjustment strategy. The initial learning rate can be configured to 0.001. When the rate of decrease of the loss function is lower than the preset threshold, the learning rate decays. The number of training iterations is no less than 100 rounds. The iteration terminates when the loss function value tends to stabilize. During the training process, the data is divided into training set and validation set in a 7:3 ratio. The model training is considered complete when the prediction accuracy of the validation set is no less than 90%.

[0055] The cloud-based monitoring and analysis node imports standardized input data into a trained temporal graph neural network. The model then sequentially performs graph convolution, temporal feature extraction, and feature fusion operations, ultimately obtaining the causal inference result through the output layer. The cloud-based monitoring and analysis node post-processes this result, sorting root cause probabilities from high to low and selecting the nodes with the highest probabilities as candidate root cause nodes; sorting propagation path stability from high to low and selecting the path with the highest stability as the optimal anomaly propagation path; and marking nodes with temporal anomaly probabilities higher than a preset temporal anomaly threshold as temporal anomaly nodes. The temporal anomaly threshold ranges from [value missing]. Subsequently, by combining candidate root cause nodes, optimal anomaly propagation paths, and temporal anomaly node markers, the final root cause nodes and anomaly propagation paths are determined, providing a basis for fault handling in cross-domain monitoring. By combining temporal semantics and causal topology with a temporal graph neural network, accurate identification of spurious propagation, temporal out-of-order anomalies, and cascading faults is achieved, solving the problem that traditional algorithms struggle to handle nonlinear causal relationships in complex cross-domain scenarios.

[0056] Therefore, this method achieves causal semantic consistency restoration and anomaly propagation uncertainty suppression in cross-domain monitoring of data centers through cloud-edge collaboration. First, it constructs a time credibility vector to provide credibility representation for time analysis, and builds a cross-domain monitoring causal semantic graph by combining the causal relationships of monitored events. It then uses a global time default function to solve for time offsets and achieves accurate timestamp correction. Second, it calculates the anomaly propagation probability by quantizing network and scheduling states, forming a probabilistic causal propagation graph. The core is the collaborative iteration of time correction and propagation inference, achieving mutual constraints and joint convergence between the two, avoiding error amplification and inference oscillation problems caused by independent processing. Next, it combines an edge counterfactual verification mechanism to correct the iteration results, solving the misjudgment problem of pure cloud-side analysis. Finally, it uses a time-series graph neural network to achieve accurate inference of complex causal relationships, determining the final root cause node and anomaly propagation path. This significantly reduces false alarms in cross-domain monitoring, improves the stability of root cause localization, effectively suppresses anomaly storms, and accurately restores the true causal relationships of monitored events, providing a reliable management solution for cross-domain monitoring in multi-data center, edge computing node, and hybrid cloud environments.

[0057] It should be noted that although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can be performed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0058] Please see Figure 5 , Figure 5This application provides a structural block diagram of a cloud-edge collaborative data center cross-domain monitoring and management system as an embodiment. The system specifically includes: Data acquisition and encapsulation modules deployed at various edge monitoring nodes, and monitoring and analysis nodes deployed on the cloud side; The data acquisition and encapsulation module is used to associate the time reliability vector with the monitoring event set and then upload it to the cloud-side monitoring and analysis node; wherein, the time reliability vector is constructed based on local clock stability related data, the monitoring event is obtained based on monitoring data and structured encapsulation, and the monitoring event at least includes the original timestamp and node identifier. The cloud-side monitoring and analysis node includes: The causal semantic graph construction unit 501 is used to receive the set of monitoring events, establish causal edges according to the correlation between the monitoring events, construct a cross-domain monitoring causal semantic graph with each monitoring event as a node, and calculate the initial time weight of each causal edge based on the time credibility vector and the original timestamp. The time offset calculation unit 502 is used to construct a global time default function based on the causal time constraint relationship reflected by the causal edge in the cross-domain monitoring causal semantic graph, and obtain the time offset of each edge monitoring node by solving the minimum value of the global time default function. The timestamp correction unit 503 is used to correct the original timestamps of each monitoring event using the time offset to obtain the corrected timestamps, and to update the initial time weights of each causal edge in the cross-domain monitoring causal semantic graph based on the corrected timestamps. The probability propagation graph generation unit 504 is used to calculate the anomaly propagation probability of each causal edge based on the updated cross-domain monitoring causal semantic graph, according to the network state and scheduling state, and form a probability causal propagation graph. The iterative correction unit 505 is used to iteratively perform the following operations with the probabilistic causal propagation graph and the corrected timestamp as input until a preset convergence condition is met: determine the abnormal propagation path based on the current corrected timestamp and the probabilistic causal propagation graph, calculate the propagation confidence of each abnormal propagation path, use the propagation path whose propagation confidence meets the preset condition to reverse correct the time offset of each edge monitoring node, and update the corrected timestamp and the abnormal propagation probability of each causal edge in the probabilistic causal propagation graph based on the corrected time offset.

[0059] It should be noted that the working process of each module in the cloud-edge collaborative data center cross-domain monitoring and management system described in this embodiment can refer to the working process of the cloud-edge collaborative data center cross-domain monitoring and management method described in the above embodiments, and the technical effects achieved are the same as those of the cloud-edge collaborative data center cross-domain monitoring and management method described in the above embodiments, so they will not be repeated here.

[0060] The above description represents the preferred embodiments of the present invention. It should be noted that, for those skilled in the art, various improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A cross-domain monitoring and management method for data centers based on cloud-edge collaboration, characterized in that, Includes the following steps: The time reliability vector is associated with the set of monitoring events and then uploaded to the cloud-side monitoring and analysis node. The time reliability vector is constructed based on local clock stability-related data, and the monitoring events are obtained based on the monitoring data and are structured and encapsulated. The monitoring events include at least the original timestamp and node identifier. Based on the set of monitoring events, the cloud-side monitoring and analysis node establishes causal edges according to the correlation between the monitoring events, constructs a cross-domain monitoring causal semantic graph with each monitoring event as a node, and calculates the initial time weight of each causal edge based on the time credibility vector and the original timestamp. Based on the causal time constraint relationship reflected by the causal edges in the cross-domain monitoring causal semantic graph, a global time default function is constructed, and the time offset of each edge monitoring node is obtained by solving for the minimum value of the global time default function. The original timestamps of each monitoring event are corrected using the time offset to obtain corrected timestamps, and the initial time weights of each causal edge in the cross-domain monitoring causal semantic graph are updated based on the corrected timestamps. Based on the updated cross-domain monitoring causal semantic graph, the anomaly propagation probability of each causal edge is calculated according to the network state and scheduling state to form a probabilistic causal propagation graph. Using the probabilistic causal propagation graph and the corrected timestamp as input, perform the following operations iteratively until a preset convergence condition is met: determine the abnormal propagation path based on the current corrected timestamp and the probabilistic causal propagation graph, calculate the propagation confidence of each abnormal propagation path, use the propagation path whose propagation confidence meets the preset condition to reverse correct the time offset of each edge monitoring node, and update the corrected timestamp and the abnormal propagation probability of each causal edge in the probabilistic causal propagation graph based on the corrected time offset.

2. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The time reliability vector includes average time offset, offset variance, queue dwell time, and network round-trip latency. The average time offset is the arithmetic mean of the time offset between the local clock of the edge monitoring node and the clock of the network time protocol server within a preset statistical period. The offset variance is the variance of the time offset. The queue dwell time is the average dwell time of monitoring data in the monitoring agent queue. The network round-trip latency is the average network round-trip latency between the edge monitoring node and the cloud-side monitoring and analysis node.

3. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The establishment of causal edges based on the correlation between monitoring events specifically includes: for two monitoring events with a direct service call relationship, establishing a one-way causal edge from the call initiating event node to the called response event node; for two monitoring events with data transmission dependencies based on network topology, establishing a one-way causal edge from the data packet generating node to the link transmission node; and for two monitoring events with a resource contention relationship, establishing a bidirectional causal edge.

4. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The calculation of the initial time weight of each causal edge based on the time credibility vector and the original timestamp is specifically as follows: a first time factor is determined based on the difference in the original timestamps of the monitoring events at both ends of the causal edge; a second time factor is determined based on the time credibility vector of the node that generates the monitoring event; and the initial time weight is obtained by multiplying the first time factor and the second time factor by their respective weight coefficients and then summing them.

5. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The global time default function is constructed, and the time offset of each edge monitoring node is obtained by solving for the minimum value of the global time default function. The calculation formula is as follows: In the formula This represents all monitoring event node pairs with causal edges. For nodes The corresponding time offset of the edge monitoring node, For nodes The corresponding time offset of the edge monitoring node, Indicates taking 0 and The maximum value in, For nodes The original timestamp corresponding to the monitored event. For nodes The original timestamp corresponding to the monitored event. For nodes To the node The minimum propagation time; the time offset of each edge monitoring node when the global time default function is minimized is solved using the belief propagation algorithm.

6. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The abnormal propagation probability of each causal edge is calculated based on the network state and scheduling state. The calculation formula is: In the formula , , The fusion weighting coefficients have values ​​ranging from [value range missing]. And satisfy in, This represents the normalized value of network jitter. This represents the normalized value of the scheduling migration frequency. This represents the normalized value of the difference in monitoring sampling periods.

7. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The step of determining abnormal propagation paths based on the current corrected timestamp and the probabilistic causal propagation graph, and calculating the propagation confidence of each abnormal propagation path, specifically includes: using a path search algorithm to select causal edges with propagation probabilities higher than a preset confidence threshold from the probabilistic causal propagation graph to form candidate propagation paths; for each candidate propagation path, multiplying the product of the propagation probabilities of all causal edges in the path, the path's time consistency score, and the path's topological rationality score by the corresponding confidence weight coefficients, and then summing them to obtain the propagation confidence. The value range of each confidence weight coefficient is [missing value]. And the sum of the confidence level weight coefficients is 1.

8. The data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, The method of using propagation paths with propagation confidence levels meeting preset conditions to reverse-correct the time offset of each edge monitoring node specifically includes: using propagation paths with propagation confidence levels higher than a preset high confidence threshold as high confidence propagation paths; and constructing a reverse-correction global time default function. The calculation formula is: In the formula, For all node pairs in the high-confidence propagation path, , They are nodes , The corrected timestamp For nodes To the node The minimum propagation time, , They are nodes , The time offset correction value is calculated; the time offset correction value of each edge monitoring node is calculated to make the reverse correction global time default function take the minimum value, and the original time offset is updated to the sum of the original time offset and the time offset correction value.

9. A data center cross-domain monitoring and management method based on cloud-edge collaboration according to claim 1, characterized in that, After the preset convergence conditions are met, the following are also included: The corrected timestamps, propagation confidence in the probabilistic causal propagation graph, and causal topology are used as input data and imported into a pre-trained temporal graph neural network. The temporal graph neural network sequentially extracts spatial features through graph convolutional layers, extracts temporal features through temporal feature extraction layers, and fuses spatial and temporal features through feature fusion layers. Finally, it obtains the root cause probability of each monitored event node, the propagation path stability of each propagation path, and the temporal anomaly probability of each node through the output layer. The cloud-based monitoring and analysis node determines the final root cause node and abnormal propagation path based on the root cause probability, propagation path stability, and time anomaly probability.

10. A data center cross-domain monitoring and management system based on cloud-edge collaboration, characterized in that, include: Data acquisition and encapsulation modules deployed at various edge monitoring nodes, and monitoring and analysis nodes deployed on the cloud side; The data acquisition and encapsulation module is used to associate the time reliability vector with the monitoring event set and then upload it to the cloud-side monitoring and analysis node; wherein, the time reliability vector is constructed based on local clock stability related data, the monitoring event is obtained based on monitoring data and structured encapsulation, and the monitoring event at least includes the original timestamp and node identifier. The cloud-side monitoring and analysis node includes: The causal semantic graph construction unit is used to receive the set of monitoring events, establish causal edges according to the correlation between the monitoring events, construct a cross-domain monitoring causal semantic graph with each monitoring event as a node, and calculate the initial time weight of each causal edge based on the time credibility vector and the original timestamp. The time offset calculation unit is used to construct a global time default function based on the causal time constraint relationship reflected by the causal edges in the cross-domain monitoring causal semantic graph, and obtain the time offset of each edge monitoring node by solving for the minimum value of the global time default function. The timestamp correction unit is used to correct the original timestamps of each monitoring event using the time offset to obtain the corrected timestamps, and to update the initial time weights of each causal edge in the cross-domain monitoring causal semantic graph based on the corrected timestamps. The probability propagation graph generation unit is used to calculate the anomaly propagation probability of each causal edge based on the updated cross-domain monitoring causal semantic graph, according to the network state and scheduling state, and form a probability causal propagation graph. The iterative correction unit is used to iteratively perform the following operations with the probabilistic causal propagation graph and the corrected timestamp as input until a preset convergence condition is met: determine the abnormal propagation path based on the current corrected timestamp and the probabilistic causal propagation graph, calculate the propagation confidence of each abnormal propagation path, use the propagation path whose propagation confidence meets the preset condition to reverse correct the time offset of each edge monitoring node, and update the corrected timestamp and the abnormal propagation probability of each causal edge in the probabilistic causal propagation graph based on the corrected time offset.

Images