Communication network data anomaly root cause reasoning method, device and equipment and storage medium

Abstract

This application provides a method, apparatus, device, and storage medium for root cause reasoning of communication network data anomalies, relating to the field of communication network operation and maintenance technology. It utilizes a tool pool to perform feature representation processing on time-series data to obtain statistical summary data and session embedding vectors. Based on the session embedding vectors, it performs similarity retrieval on historical fault causal chains in a historical case library to obtain a retrieval similarity score. Based on the retrieval similarity score, it selects multiple candidate fault causal chains. Based on a knowledge base containing structured constraints in the communication domain, it performs causal verification on each causal edge according to the statistical summary data to obtain a chain-level causal verification score corresponding to each candidate fault causal chain. A brain module determines the target causal chain based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain. The root cause diagnosis result is determined based on the target causal chain. Describing the fault evolution path based on the target causal chain significantly enhances the interpretability of the root cause diagnosis result.

Description

Technical Field

[0001] This application relates to the field of communication network operation and maintenance technology, and in particular to methods, apparatus, devices and storage media for root cause reasoning of communication network data anomalies. Background Technology

[0002] Maintaining a high quality of experience (QoE) is a core objective of modern radio access networks (RANs). With the rapid expansion of mobile networks and the explosive growth in the number of user sessions, the automated detection of QoE degradation and the intelligent diagnosis of its causes have become critical requirements.

[0003] Related technologies use deep neural networks to directly map Key Performance Indicator (KPI) data to root cause categories, which is an end-to-end black-box classification model. However, the output of this model is only a classification label and cannot provide the causal propagation path of the fault from the root cause to the QoE degradation manifestation. This makes it difficult for operations and maintenance personnel to understand and verify the diagnostic conclusions, which is not conducive to guiding subsequent network optimization operations. Summary of the Invention

[0004] The main objective of this application is to propose a method, apparatus, device, and storage medium for inferring the root causes of communication network data anomalies, thereby improving the accuracy and interpretability of the root cause results of deteriorated user experience quality.

[0005] To achieve the above objectives, a first aspect of this application proposes a method for inferring the root causes of communication network data anomalies. This method is implemented based on a large language model-driven intelligent agent system, which includes at least a brain module, a tool pool, a knowledge base, and a historical case database. The method includes: The time-series data of the current session is obtained, and the time-series data is processed by the tool pool to obtain statistical summary data and session embedding vector. The time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data and packet data convergence protocol layer data. Based on the session embedding vector, a similarity retrieval is performed on the historical fault causal chains in the historical case library to obtain a retrieval similarity score, and multiple candidate fault causal chains are selected based on the retrieval similarity score, wherein each candidate fault causal chain consists of at least one directed causal edge. Based on the knowledge base containing structured constraints in the field of communication, causal verification is performed on each causal edge according to the statistical summary data to obtain the chain-level causal verification score corresponding to each candidate fault causal chain; The brain module determines the target causal chain based on the retrieval similarity score and the chain-level causal verification score corresponding to each candidate fault causal chain, and determines the root cause diagnosis result based on the target causal chain.

[0006] In some embodiments, the knowledge base includes a global causal graph, which consists of fault atoms and directed causal edges connecting adjacent fault atoms. Each causal edge includes an upstream fault atom and a downstream fault atom. Based on the knowledge base containing structured constraints in the communication domain, causal verification is performed on each causal edge according to the statistical summary data to obtain a chain-level causal verification score corresponding to each candidate fault causal chain, including: Based on the global causal graph, the premise for the establishment of the upstream fault atom corresponding to the causal edge to be verified and the expected evidence corresponding to the downstream fault atom are determined. The expected evidence includes a list of key signal performance indicators and the expected performance indicator behavior and trend corresponding to the indicators in the list of key signal performance indicators. In response to the premise of the upstream fault atom, a valid data time window for the current session is determined. Within the valid data time window, measured observations corresponding to all expected key signals that match the list of key signal performance indicators are extracted from the statistical summary data. The measured observation value of each expected key signal is matched with the corresponding expected performance index behavior and trend to generate the evidence classification signal corresponding to the causal edge to be verified. Based on the evidence classification signals corresponding to all causal edges within the candidate fault causal chain, the chain-level causal verification score of the candidate fault causal chain is obtained according to the evidence classification signals.

[0007] In some embodiments, the step of matching the measured observations of each expected key signal with the corresponding expected performance indicator behavior and trend to generate the evidence classification signal corresponding to the causal edge to be verified includes: If the measured observations conform to the expected performance index behavior and trend, a supporting evidence classification signal is generated. If the measured observations are contrary to the expected performance index behavior and trend, an opposing evidence classification signal is generated. If the measured observations are unavailable or do not show a clear matching trend, a missing evidence classification signal is generated.

[0008] In some embodiments, obtaining the chain-level causal verification score of the candidate fault causal chain based on the evidence classification signal includes: Preset weighted scores are assigned to the supporting evidence classification signals, the opposing evidence classification signals, and the missing evidence classification signals, respectively. The consistency score of the causal edge is obtained by weighting the weighted scores of the evidence classification signals corresponding to all the expected key signals of the causal edge. The consistency scores of all causal edges within each candidate fault causal chain are aggregated to calculate the chain-level causal verification score.

[0009] In some embodiments, determining the target causal chain through the brain module based on the retrieval similarity score and the chain-level causal verification score corresponding to each candidate fault causal chain includes: Obtain the first discriminative strength of the retrieval similarity score for all the candidate fault causal chains, and the second discriminative strength of the chain-level causal verification score for all the candidate fault causal chains; Assign a first fusion weight to the retrieval similarity score and a second fusion weight to the chain-level causal verification score, wherein the sum of the second fusion weight and the first fusion weight is one; If the first discriminative strength is higher than the second discriminative strength, increase the first fusion weight; otherwise, decrease the first fusion weight. Based on the adjusted first fusion weight and second fusion weight, the retrieval similarity score and the chain-level causal verification score are weighted and calculated to obtain the comprehensive ranking weight; The candidate fault causal chains are sorted based on the comprehensive ranking weight, and the candidate fault causal chain with the largest comprehensive ranking weight in the ranking result is determined as the target causal chain.

[0010] In some embodiments, the intelligent agent system further includes a reporting module, wherein determining the root cause diagnosis result based on the target causal chain includes: A predetermined number of candidate fault causal chains, excluding the target causal chain, are selected from the sorting results as reference causal chains; The starting fault atom of the target causal chain is identified as the target root cause, and the root cause category label corresponding to the target root cause is obtained through the mapping relationship between fault atoms and root cause categories pre-stored in the knowledge base. The reporting module calls the brain module to perform natural language generation processing on the target causal chain, the reference causal chain, the root cause category label, and the evidence classification signal corresponding to the target causal chain, to obtain a structured diagnostic report containing anomaly diagnostic analysis description and / or network optimization suggestions, and outputs the structured diagnostic report as the root cause diagnosis result.

[0011] In some embodiments, the step of performing feature characterization processing on the time series data through the tool pool to obtain statistical summary data and session embedding vectors includes: The time series data is normalized and missing value interpolation is performed using the data preprocessing tools in the tool pool to obtain standardized time series data. The standardized time-series data is statistically analyzed using the data statistical analysis tools in the tool pool to generate statistical summary data containing at least one of quantile statistics, peak and valley statistics, trend direction indicators, and volatility indicators. The standardized time-series data is input into a pre-trained shared representation encoder for latent space mapping to obtain the session embedding vector.

[0012] To achieve the above objectives, a second aspect of this application proposes a communication network data anomaly root cause reasoning device. The device is implemented based on a large language model-driven intelligent agent system, which includes at least a brain module, a tool pool, a knowledge base, and a historical case database. The device comprises: Data processing module: used to acquire time-series data of the current session, and perform feature representation processing on the time-series data through the tool pool to obtain statistical summary data and session embedding vector, wherein the time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data and packet data convergence protocol layer data; Similarity retrieval module: used to perform similarity retrieval on historical fault causal chains in the historical case library based on the session embedding vector, obtain retrieval similarity score, and select multiple candidate fault causal chains based on the retrieval similarity score, wherein each candidate fault causal chain consists of at least one directed causal edge; Causal verification module: Based on the knowledge base containing structured constraints in the communication domain, it performs causal verification on each causal edge according to the statistical summary data to obtain the chain-level causal verification score corresponding to each candidate fault causal chain; Diagnosis generation module: used by the brain module to determine the target causal chain based on the retrieval similarity score and the chain-level causal verification score corresponding to each candidate fault causal chain, and to determine the root cause diagnosis result based on the target causal chain.

[0013] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0014] To achieve the above objectives, a fourth aspect of the present application provides a storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0015] The communication network data anomaly root cause reasoning method, apparatus, device, and storage medium proposed in this application are implemented through an intelligent agent system driven by a large language model. The intelligent agent system includes at least a brain module, a tool pool, a knowledge base, and a historical case library. The method includes: acquiring time-series data of the current session; performing feature representation processing on the time-series data through the tool pool to obtain statistical summary data and session embedding vectors, wherein the time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data, and packet data convergence protocol layer data; performing similarity retrieval on historical fault causal chains in the historical case library based on the session embedding vectors to obtain retrieval similarity scores, and selecting multiple candidate fault causal chains based on the retrieval similarity scores, wherein each candidate fault causal chain consists of at least one directed causal edge; performing causal verification on each causal edge based on the statistical summary data according to the knowledge base containing structured constraints in the communication domain to obtain a chain-level causal verification score corresponding to each candidate fault causal chain; determining the target causal chain through the brain module based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain, and determining the root cause diagnosis result based on the target causal chain. This embodiment transforms cross-protocol time-series data into session embedding vectors using a tool pool, and performs similarity retrieval in a historical case library based on these vectors. By using real historical fault causal chains, the root cause search space is effectively narrowed, suppressing factual bias caused by open reasoning in large language models. During inference, a knowledge base containing structured constraints from the communication domain is introduced, and current statistical summary data is used to perform edge-by-edge causal verification of candidate fault causal chains. The "brain module" ultimately calculates the causal chain by fusing the retrieval similarity score and the chain-level causal verification score, using data features and underlying rules for dual verification. This ensures that the final target causal chain conforms to both the statistical regularities of the actual network environment and the physical operational logic of the communication protocol, thereby improving the accuracy of root cause diagnosis results. Furthermore, during the causal verification stage, each causal edge is independently verified, and evidence classification signals are generated to obtain a target causal chain composed of directed causal edges, indicating the data evidence upon which each causal transformation depends. The target causal chain can fully describe the evolution path of a fault propagating layer by layer across protocols from its source, ultimately leading to a deterioration in user experience quality, thus significantly enhancing the interpretability of root cause diagnosis results. Attached Figure Description

[0016] Figure 1 This is a flowchart of the communication network data anomaly root cause reasoning method provided in the embodiments of this application.

[0017] Figure 2 This is a flowchart provided in this application embodiment for performing feature characterization processing on time series data through a tool pool to obtain statistical summary data and session embedding vectors.

[0018] Figure 3 This is a schematic diagram of the global cause-effect graph provided in the embodiments of this application.

[0019] Figure 4 This is a flowchart provided in this application embodiment, which describes how a knowledge base containing structured constraints in the field of communication is used to perform causal verification on each causal edge based on statistical summary data, and obtains the chain-level causal verification score corresponding to each candidate fault causal chain.

[0020] Figure 5 This is a flowchart provided in this application embodiment that matches the measured observation value of each expected key signal with the corresponding expected performance index behavior and trend to generate the evidence classification signal corresponding to the causal edge to be verified.

[0021] Figure 6 This is a flowchart of obtaining the chain-level causal verification score of the candidate fault causal chain based on the evidence classification signal, provided in an embodiment of this application.

[0022] Figure 7 This is a flowchart provided in an embodiment of the present application, which describes how a target causal chain is determined using a brain module based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain.

[0023] Figure 8 This is a flowchart of the root cause diagnosis result determination based on the target causal chain provided in the embodiments of this application.

[0024] Figure 9 This is a schematic diagram of the root cause diagnosis result report provided in the embodiments of this application.

[0025] Figure 10 This is a schematic diagram of the overall framework of the communication network data anomaly root cause reasoning method provided in the embodiments of this application.

[0026] Figure 11 This is a schematic diagram comparing the multi-task performance of the communication network data anomaly root cause reasoning method provided in this application embodiment on real operational network data.

[0027] Figure 12 This is a schematic diagram comparing the system operation time and the expert manual analysis time of the communication network data anomaly root cause reasoning method provided in the embodiments of this application.

[0028] Figure 13 This is a structural block diagram of a communication network data anomaly root cause inference device provided in another embodiment of this application.

[0029] Figure 14 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0031] It should be noted that although functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0033] Artificial Intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0034] Maintaining a high quality of experience (QoE) is a core objective of modern radio access networks (RANs). With the rapid expansion of mobile networks and the explosive growth in the number of user sessions, the automated detection of QoE degradation and the intelligent diagnosis of its causes have become critical requirements.

[0035] In related technologies, technical experts typically start with symptoms perceived by users (such as increased latency and reduced loading speed) and infer root causes such as interference, weak coverage, or cell overload by observing high-dimensional, time-varying, cross-layer Key Performance Indicator (KPI) data, thereby designing targeted optimization measures. However, the troubleshooting process by human experts is extremely time-consuming and labor-intensive. Therefore, deep neural networks can be used to directly map KPI data to root cause categories, which is an end-to-end black-box classification model. However, the output of this model is only a classification label and cannot provide the causal propagation path of the fault from the root cause to the QoE degradation symptoms. It is difficult for maintenance personnel to understand and verify the diagnostic conclusions, which is not conducive to guiding subsequent network optimization operations. In addition, this deep learning method lacks structured constraints at the communication protocol level and relies solely on data-driven feature mapping, which cannot guarantee that the diagnostic conclusions conform to the causal propagation laws between protocol layers, seriously affecting the reliability of the diagnosis. Mobile communication network faults often recur through similar cross-layer causal structures. However, general large language models do not include a historical case library to provide structured priors for fault diagnosis, resulting in open reasoning from scratch in each diagnosis, leading to low reasoning efficiency and an excessively large search space.

[0036] Based on this, embodiments of this application provide a method, apparatus, device, and storage medium for root cause reasoning of communication network data anomalies. It transforms cross-protocol layer time-series data into session embedding vectors using a tool pool, and performs similarity retrieval in a historical case library based on these session embedding vectors. This effectively narrows the root cause search space by using real historical fault causal chains, suppressing factual biases caused by open reasoning in large language models. During reasoning, a knowledge base containing structured constraints from the communication domain is introduced, and current statistical summary data is further combined to perform edge-by-edge causal verification of candidate fault causal chains. The "brain module" ultimately performs a fusion calculation based on the retrieved similarity score and the chain-level causal verification score, using data features and underlying rules for dual verification. This ensures that the final determined target causal chain conforms to both the statistical regularities of the actual network environment and the physical operational logic of the communication protocol, thereby improving the accuracy of root cause diagnosis results. Furthermore, during the causal verification phase, each causal edge is independently verified and an evidence classification signal is generated to obtain a target causal chain composed of directed causal edges, which indicates the data evidence on which each causal transformation depends. Based on the target causal chain, the evolution path of the fault can be fully described from the source to the layer-by-layer cross-protocol propagation and ultimately lead to the deterioration of user experience quality, thereby significantly enhancing the interpretability of the root cause diagnosis results.

[0037] This application provides a method, apparatus, device, and storage medium for inferring the root causes of communication network data anomalies. The specific details are illustrated in the following embodiments. First, the method for inferring the root causes of communication network data anomalies in this application is described.

[0038] This application's embodiments can acquire and process relevant data based on artificial intelligence (AI) technology. AI is the theory, methods, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can react in a way similar to human intelligence. AI also studies the design principles and implementation methods of various intelligent machines, enabling them to possess perception, reasoning, and decision-making capabilities.

[0039] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0040] The communication network data anomaly root cause reasoning method provided in this application relates to the field of communication network operation and maintenance technology. This method can be applied to a terminal, a server, or a computer program running on either the terminal or the server. For example, the computer program can be a native program or software module in an operating system; it can be a native application (APP), i.e., a program that needs to be installed in the operating system to run, such as a client supporting communication network data anomaly root cause reasoning, i.e., a program that only needs to be downloaded to a browser environment to run; or it can be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be any form of application, module, or plugin. The terminal communicates with the server through a network. This communication network data anomaly root cause reasoning method can be executed by the terminal or the server, or by the terminal and the server working together.

[0041] In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, or smartwatch, etc. The server can be a standalone server, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms; it can also be a service node in a blockchain system, where the service nodes form a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). The terminal and server can connect via Bluetooth, Universal Serial Bus (USB), or a network, etc., and this embodiment does not impose any limitations.

[0042] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0043] First, the intelligent agent system driven by the Large Language Model (LLM) in the embodiments of this application is described.

[0044] In one embodiment, the intelligent agent system based on a large language model includes core components: a brain module, a tool pool, a knowledge base, a historical case library, and a reporting module.

[0045] In one embodiment, the brain module is an inference engine centered around an LLM, responsible for coordinating the information flow between modules and driving the diagnostic reasoning process. The brain module drives the diagnostic process using the ReAct (Reasoning + Acting) paradigm. ReAct is a control mechanism that alternates natural language reasoning with tool invocation actions. That is to say, the working mode of the brain module is similar to the thinking process of an experienced network operation and maintenance engineer: first observe the existing diagnostic evidence, then think in natural language about what to do next, then select a specific diagnostic operation to execute, and finally observe the execution result. This "think-act-observe" cycle iterates continuously until the brain module determines that the diagnostic process for abnormal root cause reasoning has ended.

[0046] Furthermore, the shared diagnostic state is the core data structure maintained by the brain module for passing information between diagnostic modules. This state is organized in the form of a dictionary (JSON object) and is updated after each tool invocation. Its structural schematic is as follows: json{ "messages": {"role":"system","content":"You are a communication network QoE diagnostic agent..."}, {"role":"assistant","content":"Thought: The current state is empty, and KPI data needs to be obtained first..."}, {"role":"tool","name":"extract_kpi_by_filename","content":"Successfully loaded session data..."}, "kpi_data":{ "selected_file":"0_1_223.csv", "df":"<DataFrame: 60 rows × 37 columns KPI time series>"}, "rca_result":{ "root_cause":"uplink_interference_high", "probabilities":{"uplink_interference_high":0.65,"uplink_weak_coverage":0.20} ... }, The messages field records the complete dialogue history, including every step of thought in the brain module, tool call requests, and tool return results; kpi_data stores the data and file paths related to the loaded raw key signal performance indicators; and rca_result stores the prediction results of the root cause classification deep learning model, etc.

[0047] In one embodiment, a tool pool provides deterministic analysis capabilities, including data preprocessing tools, data statistical analysis tools, feature selection tools, and pre-trained anomaly detection models and root cause classification deep learning models. A knowledge base encodes structured constraint knowledge in the communication domain, including hierarchical fault atom definitions, global causal graphs, and edge-level causal constraints. A historical case library stores historical fault causal chains verified by technical experts and their corresponding historical session embedding vectors. The reporting module integrates diagnostic information received from the brain module, integrating the diagnostic results into a natural language diagnostic report based on a large language model.

[0048] The following describes the root cause reasoning method for communication network data anomalies in the embodiments of this application based on the above-mentioned intelligent agent system, which is applicable to QoE degradation scenarios in mobile communication wireless access networks.

[0049] Figure 1 This is an optional flowchart of the communication network data anomaly root cause reasoning method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps 110 to 140. It is also understood that this embodiment... Figure 1 The order of steps 110 to 140 is not specifically limited. The order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0050] Step 110: Obtain the time series data of the current session, and perform feature representation processing on the time series data through the tool pool to obtain statistical summary data and session embedding vector.

[0051] In one embodiment, time-series data refers to raw data related to key signal performance indicators. In actual mobile communication network operation and maintenance scenarios, when a user experience quality degradation is detected in the communication network, the system will collect and extract multivariate time-series data for the current QoE degradation session. ,in, For the number of timestamps, This refers to the number of dimensions for key performance indicators. To ensure the completeness and traceability of root cause diagnosis at the protocol stack level, the time series data in this embodiment includes data from various data layers of the communication protocol, such as at least one of the following: Physical Layer (PHY) data, Media Access Control (MAC) data, Radio Link Control (RLC) data, and Packet Data Convergence Protocol (PDCP) data.

[0052] In one embodiment, referring to Table 1 below, Table 1 is a schematic diagram of key performance indicators in time series data.

[0053]

[0054] Table 1 is a schematic table of key performance indicators in time series data. It is understandable that Table 1 only illustrates the key performance indicators and does not imply any limitations on them.

[0055] In one embodiment, the tool pool is a skill set that provides deterministic analytical capabilities through well-defined interfaces, including: data preprocessing tools, data statistical analysis tools, and root cause classification deep learning models. To enable efficient and accurate understanding of these high-dimensional underlying time series sequences in subsequent inference processes, this embodiment uses the tool pool to invoke specialized tools for feature representation processing of the aforementioned time series data matrix. (Refer to...) Figure 2 , Figure 2 This is a flowchart provided in this application embodiment for performing feature representation processing on time series data using a tool pool to obtain statistical summary data and session embedding vectors, specifically including the following steps: Step 210: Use the data preprocessing tools in the tool pool to normalize the time series data and interpolate missing values ​​to obtain standardized time series data.

[0056] In one embodiment, because the time-series data packets collected across protocol layers contain multidimensional indicators with vastly different dimensions and orders of magnitude, direct processing would lead to numerical biases in the model. Therefore, the data preprocessing tool uses a normalization algorithm to unify all key performance indicators to the same numerical scale. Furthermore, considering the unavoidable signaling loss or probe acquisition failures in mobile communication networks, which may result in data gaps in the time-series data, the data preprocessing tool further employs an interpolation algorithm to fill in missing values, thereby generating continuous, regular, and standardized time-series data.

[0057] Step 220: Using the data statistical analysis tools in the tool pool, extract statistical features from the standardized time series data to generate statistical summary data containing at least one of quantile statistics, peak and trough statistics, trend direction indicators, and volatility indicators.

[0058] In one embodiment, high-dimensional, fine-grained standardized time-series data is dimensionality-reduced using data statistical analysis tools to extract features that intuitively reflect network degradation. Specifically, quantile statistics effectively filter transient noise and reflect long-tail degradation experiences; peak-valley statistics capture extreme moments of performance degradation during a session; trend direction indicators characterize whether performance is in a state of continuous deterioration or abrupt change, such as the slope of linear regression; and volatility indicators measure the stability of the network state, such as variance or standard deviation. These four dimensions of statistical features obtained from the standardized time-series data through data statistical analysis tools collectively constitute the statistical summary data. It is understood that the standardized time-series data contains multiple different key performance indicators, and the data statistical analysis tools contain the statistical features corresponding to each key performance indicator across these four dimensions.

[0059] Step 230: Input the standardized time series data into the pre-trained shared representation encoder for latent space mapping to obtain the session embedding vector.

[0060] In one embodiment, a pre-trained root cause classification deep learning model is configured in the tool pool. This model is a multi-class neural network structure that outputs the probability distribution of each root cause category corresponding to the current session during forward propagation, thus providing data-driven prior references for subsequent causal chain inference. Here, the root cause categories can be weak uplink coverage, downlink interference, etc. This embodiment reuses the underlying encoder of the root cause classification deep learning model as a shared representation encoder, mapping standardized time-series data to a latent space aligned with root cause semantics to support subsequent similarity retrieval. This is because the shared representation encoder has undergone rigorous model iteration during the pre-training phase with the goal of accurately classifying fault root causes as optimization, and its mapped latent space has a high degree of alignment with root cause semantics. Session embedding vectors generated from network degradation session data caused by the same or similar underlying physical fault root causes will exhibit a clustered distribution in the latent space. Therefore, retrieval based on session embedding vectors in the historical case library can accurately recall candidate fault causal chains with the same fault propagation mechanism, thereby significantly improving the hit rate of similarity retrieval and the execution efficiency of subsequent causal verification.

[0061] In one embodiment, a shared representation encoder The session embedding vector z obtained by mapping standardized time-series data X to the latent space is represented as:

[0062] Step 120: Based on the session embedding vector, perform similarity retrieval on the historical fault causal chains in the historical case library to obtain the retrieval similarity score, and select multiple candidate fault causal chains based on the retrieval similarity score.

[0063] In one embodiment, even though the key performance indicators in different instances of mobile communication network failures may exhibit significant numerical fluctuations or differences, these failures often recur through similar cross-protocol layer causal structures. Therefore, this embodiment utilizes domain experts to validate these historical case data, providing valuable structured priors to supplement the deficiencies in domain knowledge of the general large language model. Each historical case in the historical case library is treated as an independent structured data set, including case metadata, validated historical failure causal chains, and historical session embedding vectors. The case metadata is the original time-series data at the time the historical network degradation session occurred, containing the lowest-level physical and protocol information. The historical failure causal chain is a complete failure causal propagation chain validated by technical experts, with each historical failure causal chain containing at least one directed causal edge. The historical session embedding vector is the representation vector generated in the latent space after the original time-series data of the historical case is mapped by the encoder of the root cause classification deep learning model in the tool pool.

[0064] When performing similarity retrieval, the similarity between the current session's session embedding vector and the historical session embedding vectors of each record in the historical case library is calculated. For example, the cosine similarity is calculated to obtain the retrieval similarity score between the current session and each historical case.

[0065] The query process is represented as follows:

[0066] in, The session embedding vector representing the current session embedding vector of the j-th historical session in the historical case library The search similarity score.

[0067] Subsequently, the historical case data are sorted in descending order of similarity scores, and the top-ranked historical case data are selected to obtain the historical fault causal chains of these historical case data as candidate fault causal chains for the current session. For example, n historical case data are selected as candidate fault causal chains for the current session to form a candidate set. Output the set of candidate fault causal chains and their corresponding retrieval similarity scores. ,in , represents the index of the k-th candidate fault causal chain.

[0068] Since each historical fault causal chain contains at least one directed causal edge, each candidate fault causal chain consists of at least one directed causal edge. For each candidate fault causal chain... Decompose it into Causal edge: Each causal edge is divided according to its direction, including upstream faulty atoms and downstream faulty atoms.

[0069] Step 130: Based on a knowledge base containing structured constraints in the field of communication, perform causal verification on each causal edge according to statistical summary data to obtain the chain-level causal verification score corresponding to each candidate fault causal chain.

[0070] In one embodiment, a knowledge base containing structured constraints in the communication domain is pre-constructed. This knowledge base formalizes root cause diagnosis knowledge into a set of executable structured domain constraints, including hierarchical fault atoms, global causal graphs, and edge-level causal constraints.

[0071] The fault atoms are categorized into different levels: symptom-level fault atoms, mechanism-level fault atoms, and root-cause-level fault atoms. Symptom-level fault atoms characterize the most intuitively perceived degradation by the user or system, such as high downlink latency (downlink_delay_high). Mechanism-level fault atoms characterize implicit abnormal actions at intermediate protocol layers, such as increased downlink radio link control (RLC) auto-retransmission requests (dl_rlc_arq_retransmission) and high downlink RLC latency (dl_rlc_delay_high). Root-cause-level fault atoms characterize the initial physical or resource-level causes of network degradation, such as high downlink interference (downlink_interference_high) and weak uplink coverage (uplink_weak_coverage). Table 2 below illustrates the fault atoms in the knowledge base, covering the complete fault propagation semantics from root cause to symptom.

[0072]

[0073] Table 2 is a schematic diagram of faulty atoms in the knowledge base. It is understandable that Table 2 only illustrates faulty atoms and does not imply any limitation on them.

[0074] The global causal graph, maintained by the knowledge base on top of fault atoms, consists of fault atoms at various levels and directed causal edges connecting adjacent fault atoms. It encodes legitimate cross-layer causal transitions and protocol-consistent fault propagation patterns. For example, a typical directed connected path can be described as: high downlink interference (root cause layer fault atom) -> increased downlink ARQ retransmissions (mechanism layer fault atom) -> increased downlink RLC layer latency (mechanism layer fault atom) -> high downlink latency (symptom layer fault atom). During retrieval and reasoning in the intelligent agent system, the selected candidate fault causal chains must strictly adhere to the directed connectivity constraints of the global causal graph, thus limiting the open reasoning of the large language model to a structurally valid and physically logically consistent path space.

[0075] The subsequent edge-level causal constraints are domain knowledge annotations of the directed causal edges of each valid faulty atom in the global causal graph. These annotations describe the expected performance behavior and trends of the key performance indicators of the transformation. Edge-level causal constraints can also be called communication protocol propagation constraint knowledge, which includes propagation mechanisms, key signals, and verification logic.

[0076] In one embodiment, reference is made to Figure 3 , Figure 3 This is a schematic diagram of the global cause-effect graph provided in the embodiments of this application.

[0077] The global causal graph of the knowledge base in the diagram consists of multiple fault atoms and directed causal edges indicating the direction of fault propagation. When performing root cause reasoning, the subsequent intelligent agent system must strictly adhere to the directed connectivity topology defined in this global causal graph. Taking a causal chain marked by a solid arrow in the diagram as an example, this propagation path originates from the fault atom of high downlink interference (downlink_interference_high) at the root cause layer. After the interference problem propagates upwards, it connects to the fault atom of ARQ retransmission (dl_rlc_arq_retransmission) at the downlink radio link control layer of the mechanism layer. The high-frequency retransmission further connects to the fault atom of high delay (dl_rlc_delay_high) at the downlink radio link control layer of the upstream mechanism layer. Finally, at the symptom layer, it manifests as the fault atom of high downlink delay (downlink_delay_high) directly perceived by the user equipment. Its propagation path is represented as follows: downlink_interference_high->dl_rlc_arq_retransmission->dl_rlc_delay_high->downlink_delay_high Furthermore, the right side of the diagram illustrates the edge-level causal constraints corresponding to faulty atoms and causal edges. For the causal edge corresponding to dl_rlc_arq_retransmission->dl_rlc_delay_high, the underlying communication mechanism of its edge-level causal constraints is described as follows: frequent ARQ retransmissions and reorderings cause service data units to remain in the RLC buffer for a longer time, thereby directly increasing RLC queuing and reordering latency. Therefore, the corresponding propagation mechanism is: frequent ARQ retransmissions and reorderings cause SDUs to remain in the RLC buffer for a longer time, directly increasing RLC queuing and reordering latency; the key signals are: DL_RLC_ARQ_RETRANSMISS ION_COUNT (downlink RLC layer ARQ retransmission count) should increase; DL_RLC_AVG_DELAY_SUM (downlink RLC layer average latency sum) should increase; DL_RLC_DELAY_IN_0_5MS_COUNT (downlink RLC layer 0-5ms latency bucket count) should decrease. The corresponding verification logic is that if an increase in the retransmission count and a deterioration in the latency index are observed, then the causal edge evidence is considered to be supported.

[0078] In one embodiment, reference is made to Figure 4 , Figure 4 This application provides a flowchart illustrating how a knowledge base containing structured constraints in the communication domain performs causal verification on each causal edge based on statistical summary data to obtain a chain-level causal verification score for each candidate fault causal chain. The flowchart specifically includes the following steps: Step 410: Based on the global causal graph, determine the premise for the validity of the upstream faulty atom corresponding to the causal edge to be verified and the expected evidence corresponding to the downstream faulty atom.

[0079] In one embodiment, since the candidate fault causal chain is a sequence of multiple directed causal edges, the intelligent agent system adopts an edge-by-edge verification strategy during verification. For any causal edge to be verified, the brain module first queries the knowledge base to obtain the edge-level causal constraints corresponding to that edge. The premise for the upstream fault atom to be established is equivalent to the triggering condition for this causal transformation. This triggering condition is determined based on the actual communication scenario. If the triggering condition is met, the knowledge base outputs the expected evidence corresponding to the downstream fault atom. The expected evidence can be structured as a list of key signal performance indicators and the expected performance indicator behaviors and trends corresponding to the indicators in the list.

[0080] In one embodiment, reference is made to Figure 3Suppose the current causal edge to be verified is dl_rlc_arq_retransmission->dl_rlc_delay_high, with its upstream fault atom being dl_rlc_arq_retransmission and its downstream fault atom being dl_rlc_delay_high. If the premise for the upstream fault atom to be valid is met, the list of key signal performance indicators in the expected evidence corresponding to the downstream fault atom includes three expected key signals: DL_RLC_ARQ_RETRANSMISSION_COUNT, DL_RLC_AVG_DELAY_SUM, and DL_RLC_DELAY_IN_0_5MS_COUNT. The expected performance indicator behaviors and trends are as follows: DL_RLC_ARQ_RETRANSMISSION_COUNT increases significantly, DL_RLC_AVG_DELAY_SUM increases significantly, and DL_RLC_DELAY_IN_0_5MS_COUNT decreases significantly.

[0081] Step 420: In response to the premise of the upstream fault atom, determine the effective data time window of the current session. Within the effective data time window, extract the measured observations corresponding to all expected key signals that match the list of key signal performance indicators from the statistical summary data.

[0082] In one embodiment, physical faults in the communication network that cause upper-layer protocol anomalies have strict time-dependent and lagging characteristics. Therefore, this embodiment does not blindly compare data throughout the entire session cycle. Instead, it uses the time point when the upstream fault atom is determined to be valid as a benchmark to define a specific length of effective data time window. This time window is determined based on the actual communication scenario. Subsequently, the brain module calls the data interaction-related interfaces in the tool pool to extract data segments falling within this effective data time window from the statistical summary data generated in the previous process, and extracts the measured observation values ​​of various physical or logical indicators that match the list of key signal performance indicators.

[0083] Step 430: Match the measured values ​​of each expected key signal with the corresponding expected performance index behavior and trend to generate the evidence classification signal corresponding to the causal edge to be verified.

[0084] In one embodiment, the brain module can act as an adjudicator, comparing the data characteristics exhibited by measured observations with the expected behaviors defined by the knowledge base one by one, and then outputting discrete evidence classification signals. (Refer to...) Figure 5 , Figure 5This application provides a flowchart for generating evidence classification signals corresponding to causal edges to be verified by matching the measured observations of each expected key signal with the corresponding expected performance index behavior and trends. The flowchart specifically includes the following steps: Step 510: If the measured observations meet the expected performance index behavior and trend, generate supporting evidence classification signals.

[0085] Step 520: If the measured observations are contrary to the expected performance index behavior and trend, generate an opposing evidence classification signal.

[0086] Step 530: If the measured observations are unavailable or do not show a clear matching trend, generate a missing evidence classification signal.

[0087] In one embodiment, if the measured observations match the expected performance indicator behavior and trend, the current causal transformation is deemed to be supported at the data level. For example, if a certain indicator is expected to rise significantly, and the measured value of that indicator also rises significantly, a supporting evidence classification signal is generated. If the measured observations contradict the expected performance indicator behavior and trend, for example, if an increase is expected but the measured value drops significantly or remains stable, the fault propagation path is deemed invalid in the current session, and an opposing evidence classification signal is generated. If, due to objective reasons such as network signaling acquisition interruption or probe packet loss, the measured observations are unavailable or fail to show a clear matching trend, in order to ensure the robustness and fault tolerance of the system, they are not used as opposing evidence, but rather a missing evidence classification signal is generated.

[0088] Step 440: Based on the evidence classification signals corresponding to all causal edges within the candidate fault causal chain, obtain the chain-level causal verification score of the candidate fault causal chain.

[0089] In one embodiment, after verifying each causal edge, the system needs to perform a quantitative evaluation of the entire candidate fault causal chain. (Refer to...) Figure 6 , Figure 6 This is a flowchart of obtaining the chain-level causal verification score of the candidate fault causal chain based on the evidence classification signal, provided in an embodiment of this application. The flowchart specifically includes the following steps: Step 610: Assign preset weighted scores to the supporting evidence classification signals, opposing evidence classification signals, and missing evidence classification signals, respectively.

[0090] In one embodiment, to achieve refined measurement of various types of evidence classification signals, weight mapping rules are pre-configured in the knowledge base or brain module. For example, supporting evidence classification signals are assigned a higher weighting score, such as 1.0, to characterize that the specific causal transformation has solid data support, while missing evidence classification signals are assigned a lower weighting score, such as 0.5. This aims to tolerate data interruptions caused by objective factors such as probe acquisition anomalies or signaling parsing failures in actual mobile communication networks, avoiding excessive punishment of the causal chain due to non-logical data loss, and improving the robustness of the diagnostic architecture. Simultaneously, opposing evidence classification signals are assigned a negative weighting score, such as -0.5. This refined weighting score setting can characterize the importance of different types of evidence classification signals. It is understood that the preset weighting scores here can be set according to actual conditions; this is only for illustrative purposes.

[0091] Step 620: Calculate the weighted scores of the evidence classification signals corresponding to all expected key signals of the causal edge to obtain the consistency score of the causal edge.

[0092] In one embodiment, since a single causal edge may contain multiple expected key signals, it is necessary to perform weighted fusion calculation on the corresponding multiple evidence classification signals according to the weighted scores to obtain a consistency score that represents the causal edge.

[0093] Step 630: Aggregate the consistency scores of all causal edges within each candidate fault causal chain to calculate the chain-level causal verification score.

[0094] In one embodiment, after calculating the consistency score for each causal edge in the candidate fault causal chain, the brain module performs a global aggregation operation on the consistency scores of all causal edges contained within the chain along the directed topological path of the candidate fault causal chain. This aggregation operation can be performed by cumulative calculation, ultimately outputting the chain-level causal verification score corresponding to the candidate fault causal chain.

[0095] The chain-level causal verification score for candidate fault causal chains is calculated as follows:

[0096] in, This represents the chain-level causal verification score of the k-th candidate fault causal chain. This represents the consistency score of the i-th causal edge in the candidate fault causal chain. This indicates the number of causal edges in the candidate fault causal chain.

[0097] Finally, the chain-level causal verification scores of the n candidate fault causal chains are obtained. .

[0098] Step 140: Using the brain module, determine the target causal chain based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain, and determine the root cause diagnosis result based on the target causal chain.

[0099] In one embodiment, for each candidate fault causal chain, a comprehensive ranking weight can be obtained by weighting according to a pre-defined weighting rule, expressed as:

[0100] in, This represents the comprehensive ranking weight of the causal chain of the k-th candidate fault. Indicates weight, , This represents the corresponding retrieval similarity score and chain-level causal verification score.

[0101] In one embodiment, the weights can be adaptively adjusted, referring to... Figure 7 , Figure 7 This application provides a flowchart illustrating how a target causal chain is determined using a brain module based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain. The flowchart specifically includes the following steps: Step 710: Obtain the first discriminative strength of the retrieval similarity score for all candidate fault causal chains, and the second discriminative strength of the chain-level causal verification score for all candidate fault causal chains.

[0102] In one embodiment, each candidate fault causal chain set in the current candidate fault causal chain set has a corresponding retrieval similarity score and chain-level causal verification score. The retrieval similarity scores form a sequence, and the chain-level causal verification scores also form a sequence. Statistical evaluation is performed on these two sequences, such as calculating score variance or information entropy, to obtain the first discriminative strength of the retrieval similarity score for all candidate fault causal chains, and the second discriminative strength of the chain-level causal verification score for all candidate fault causal chains. Here, discriminative strength refers to the significance of the retrieval similarity score or the chain-level causal verification score within the current candidate fault causal chain set.

[0103] Step 720: Assign a first fusion weight to the retrieval similarity score and a second fusion weight to the chain-level causal verification score.

[0104] In one embodiment, the sum of the second fusion weight and the first fusion weight is one, therefore the first fusion weight is assigned to the retrieval similarity score. Assign a second fusion weight to the chain-level causal verification score. .

[0105] Step 730: If the first discriminative strength is higher than the second discriminative strength, increase the first fusion weight; otherwise, decrease the first fusion weight.

[0106] In one embodiment, when the first distinguishability strength is higher than the second distinguishability strength, it indicates that the retrieval similarity score has a higher distinguishability to the candidate fault causal chain, and therefore its corresponding first fusion weight is increased; conversely, when the chain-level causal verification score is more discriminative, the first fusion weight is decreased to increase the corresponding second fusion weight.

[0107] Step 740: Based on the adjusted first fusion weight and second fusion weight, perform a weighted calculation on the retrieval similarity score and the chain-level causal verification score to obtain the comprehensive ranking weight.

[0108] In one embodiment, after determining the first fusion weight and the second fusion weight that conform to the characteristics of the current session, the brain module performs a linear weighted summation operation to obtain the comprehensive ranking weight.

[0109] Step 750: Sort the candidate fault causal chains based on the comprehensive ranking weight, and determine the candidate fault causal chain with the largest comprehensive ranking weight in the ranking results as the target causal chain.

[0110] In one embodiment, the brain module performs a descending sort based on a comprehensive ranking weight, selecting the top-ranked candidate fault causal chain as the target causal chain. This target causal chain constitutes the core of the system's output diagnostic conclusion. Its first upstream fault atom directly represents the root cause location ultimately inferred by the system, while its subsequent sequence nodes reproduce the complete propagation evolution path of this root cause leading to the degradation of user experience quality. It is evident that the reasoning process of the target causal chain aims to explain, in an evidence-driven manner, how potential root causes propagate through the protocol layer and ultimately lead to the observed QoE degradation. This embodiment models the fault chain construction as a structured reasoning process, integrating feature-based historical case retrieval and evidence-based edge-by-edge verification, ultimately outputting an ordered causal sequence.

[0111] In one embodiment, the intelligent agent system further includes a reporting module, referring to Figure 8 , Figure 8 This is a flowchart of the process for determining root cause diagnostic results based on the target causal chain, provided in an embodiment of this application. The flowchart specifically includes the following steps: Step 810: Select a preset number of candidate fault causal chains from the sorting results, excluding the target causal chain, as reference causal chains.

[0112] In one embodiment, considering the complexity of mobile communication networks, selecting only a single optimal solution might lead to biases in certain fault scenarios. Therefore, the "brain module" does not directly discard other candidate results. Instead, it extracts a predetermined number of candidate fault causal chains from the aforementioned descending sorted results based on comprehensive ranking weights, placing them immediately after the target causal chain. This predetermined number can be around 3-5, and these retained chains are defined as reference causal chains. Retaining reference causal chains provides maintenance experts with a suboptimal space of alternative fault hypotheses, supporting multi-dimensional cross-validation during manual review, thereby further improving the system's fault tolerance and engineering practicality.

[0113] Step 820: Determine the starting fault atom of the target causal chain as the target root cause, and obtain the root cause category label corresponding to the target root cause through the mapping relationship between fault atoms and root cause categories pre-stored in the knowledge base.

[0114] In one embodiment, after determining the target causal chain, root cause information is extracted. Since the target causal chain is a directed path, its topological starting point represents the origin of the fault. Therefore, the brain module directly extracts this initial fault atom as the target root cause. Subsequently, the system accesses the knowledge base and uses a pre-configured static dictionary or mapping table to map this microscopic fault atom upwards to a macroscopic root cause category label. For example, "extremely high PRB utilization in a specific sector" is mapped to "cell uplink overload," thereby obtaining the corresponding root cause category label. It can be understood that the pre-stored mapping relationship between fault atoms and root cause categories can be pre-processed by a root cause classification deep learning model.

[0115] Step 830: The report module calls the brain module to perform natural language generation processing on the target causal chain, reference causal chain, root cause category label, and evidence classification signal corresponding to the target causal chain to obtain a structured diagnostic report containing anomaly diagnostic analysis description and / or network optimization suggestions, and outputs the structured diagnostic report as the root cause diagnosis result.

[0116] In one embodiment, the reporting module serves as the external interaction interface of the intelligent agent system. It generates reports by invoking the intent understanding and text generation functions of the large language model within the brain module. Specifically, all multimodal diagnostic state data collected in the aforementioned steps, including but not limited to the target causal chain, reference causal chain, root cause category label, and evidence classification signal corresponding to the target causal chain, are input into the large model as contextual cues. The large language model summarizes and integrates the accumulated diagnostic states based on these factual anchors, ultimately outputting a structured diagnostic report with a fixed paradigm.

[0117] The structured diagnostic report includes anomaly diagnostic analysis descriptions and / or network optimization suggestions. The anomaly diagnostic analysis descriptions are generated by a large language model that uses natural language to reconstruct the temporal causal relationship of fault evolution based on the directed propagation sequence of the target causal chain and corresponding evidence classification signals. For example, "Due to external interference, a surge in retransmissions at the lower layer of a certain base station occurred. This measured observation highly matches expectations, ultimately propagating upwards and causing application layer latency degradation," thus ensuring the interpretability of the reasoning process. The network optimization suggestions are based on the inferred root cause of the target problem, combined with the large language model's inherent knowledge base in the communication domain, proposing targeted network parameter adjustments or operational suggestions. For example, suggestions might include adjusting antenna downtilt angle, initiating interference investigation, or triggering load balancing. Ultimately, the structured diagnostic report is output as a root cause diagnosis result for operations and maintenance personnel, replacing the traditional troubleshooting analysis process that heavily relies on manual experience.

[0118] In one embodiment, reference is made to Figure 9 , Figure 9 This is a schematic diagram of the root cause diagnosis result report provided in the embodiments of this application. It includes the diagnostic conclusion and fault chain analysis. The corresponding diagnostic conclusion is: "A high-confidence anomaly (0.9424) was detected. The most likely root cause is uplink interference, which, by inducing downlink bit errors and ARQ retransmissions, further increases downlink RLC latency. However, due to the lack of key interference and latency KPIs, the overall evidence is of moderate confidence." The relevant content regarding the target causal chain in the fault chain analysis includes: Target root cause: uplink_interference The propagation path of the target causal chain is as follows: increased uplink interference -> increased downlink bit error rate -> increased downlink ARQ retransmissions -> increased downlink RLC latency. Confidence level: 0.45 - Moderate; Key evidence: Downlink bit error: The downlink_ibler shows a non-zero peak value, peak=0.39 (valley=0), indicating that a downlink decoding error has occurred; HARQ / ARQ: downlink_mac_consecutive_harq_error_max_countpeak=3; downlink_rlc_arq_retrans_count has multiple non-zero spikes (26 / 38 / 68); Uplink signal quality: uplink_wb_pre_sinr_dbvalley=-0.42dB.peak=8.33dB, uplink_dmrs_sinr_dbvalley=24.95dB, peak=27.83dB (overall high, weakening the directness of "strong uplink interference").

[0119] As can be seen, the intelligent agent system in this embodiment can summarize diagnostic evidence into a complete diagnostic report that includes natural language analysis reports and network optimization suggestions, thereby achieving end-to-end automation from raw data input to a readable diagnostic report.

[0120] In one embodiment, the target causal chain, reference causal chain, root cause category label, and evidence classification signal corresponding to the root cause diagnosis result verified by experts can also be written back to the historical case library to complete the incremental update of the historical case library.

[0121] In one embodiment, reference is made to Figure 10 , Figure 10 This is a schematic diagram of the overall framework of the communication network data anomaly root cause reasoning method provided in the embodiments of this application. For example... Figure 10 As shown, the overall model framework enables end-to-end automation from input of raw multivariate time series data to output of readable diagnostic reports. The core of this framework is an intelligent agent system built on a large language model. This system, with a brain module at its core, utilizes a tool pool, knowledge base, and historical case database to jointly complete the reasoning process.

[0122] In the specific data processing, the first step is the historical case retrieval stage. In this stage, the system first acquires the time-series data of the current experience quality degradation. Then, it utilizes data preprocessing tools, data statistical analysis tools, and a pre-trained root cause classification deep learning model from the right-hand tool pool to perform feature representation processing on the time-series data and map it to the latent space, obtaining the session embedding vector of the current session. Based on this session embedding vector, the brain module performs embedding comparison and candidate chain selection in the historical case library, ultimately calculating and outputting multiple candidate fault causal chains containing corresponding retrieval similarity scores. The Chain1:0.92 shown in the figure is the retrieval similarity score.

[0123] The next stage is the causal verification phase. In this phase, the brain module rigorously verifies the candidate fault causal chains obtained in the first phase using pre-configured structured domain constraints in the knowledge base. Specifically, this phase performs edge-by-edge verification based on a large language model and calculates aggregated scores. That is, it uses the statistical summary data extracted within the effective data time window as described above as measured observations, compares them with the expected constraint knowledge to generate evidence classification signals, and finally outputs the chain-level causal verification score corresponding to each candidate fault causal chain.

[0124] Finally, in the adaptive causal chain ranking stage, the brain module receives the retrieval similarity score from the first stage and the chain-level causal verification score from the second stage, and performs adaptive fusion and final ranking. The fusion weight is adjusted by dynamically comparing the discriminative strength of the two scores, and a comprehensive ranking weight is calculated to select the top-ranked final link as the target causal chain. After determining the target causal chain, the intelligent agent system triggers and calls the reporting module. Based on the inferred target causal chain, the extracted target root cause, and its underlying evidence classification signals, the large language model performs natural language integration processing, ultimately generating a structured diagnostic report for network operations personnel, containing diagnostic conclusions, fault chain analysis, and network optimization suggestions. This report serves as the final root cause diagnosis result output, completing the automated diagnostic process for communication network fault detection.

[0125] In one embodiment, reference is made to Figure 11 , Figure 11 This is a schematic diagram comparing the multi-task performance of the communication network data anomaly root cause inference method provided in this application embodiment on real operational network data. For example... Figure 11 As shown, the communication network data anomaly root cause inference method proposed in this embodiment is denoted as QoEReasoner. At the same time, it selects the baseline method from a variety of related technologies. The performance evaluation indicators include: node precision (node_p), node recall (node_r), causal edge precision (edge_p), and whole chain exact matching rate (chain_em).

[0126] Through analysis Figure 11The table data shows that heuristic rules and pure deep learning paradigms (such as TSTCC and CATCC) cannot perform this type of causal chain construction task due to their lack of generative structured reasoning capabilities. When using native large language models (LLM) or general obstacle-detecting agents (RCA-Agent) for reasoning, although they can achieve certain scores in node precision and node recall, they perform very poorly in causal edge precision, which reflects strict temporal logic, and all score 0.0000 in whole-chain exact matching rate, which measures the accuracy of the entire link. This indicates that general large models, when lacking domain-specific knowledge constraints, will produce serious logical illusions and cannot generate a correct link that fully conforms to the physical mechanism of communication from beginning to end. In contrast, the method in this embodiment, due to the introduction of the aforementioned knowledge-based edge-by-edge causal verification and dynamic fusion mechanism, achieves whole-chain exact matching rates of 0.2857, 0.4000, and 0.3000 on all backbone networks. Furthermore, regardless of whether DeepSeek-V3.2, GPT-5.2, or Qwen3-14 are used as the backbone of a large language model, the method in this embodiment consistently achieves leading performance across the corresponding base groupings. For example, with the GPT-5.2 backbone, the node accuracy of this embodiment reaches 0.5414, and the whole-chain exact match rate reaches 0.4000. Therefore, the communication network data anomaly root cause inference method proposed in this embodiment comprehensively surpasses various baseline methods across multiple diagnostic tasks and demonstrates stable and excellent diagnostic performance on large language model backbones of different series and scales.

[0127] In one embodiment, reference is made to Figure 12 , Figure 12 This is a schematic diagram comparing the system operation time and expert manual analysis time of the communication network data anomaly root cause inference method provided in this application embodiment. According to... Figure 12 As can be seen, the method in this embodiment reduces the diagnostic time for each session from approximately 30-60 minutes, which is required for human expert analysis, to approximately 3 minutes.

[0128] The technical solution provided in this application involves acquiring time-series data of the current session, performing feature representation processing on the time-series data using a tool pool to obtain statistical summary data and session embedding vectors. The time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data, and packet data convergence protocol layer data. Based on the session embedding vectors, a similarity retrieval is performed on historical fault causal chains in a historical case library to obtain a retrieval similarity score. Multiple candidate fault causal chains are selected based on the retrieval similarity score, where each candidate fault causal chain consists of at least one directed causal edge. Based on a knowledge base containing structured constraints in the communication domain, causal verification is performed on each causal edge according to the statistical summary data to obtain a chain-level causal verification score corresponding to each candidate fault causal chain. Through a brain module, a target causal chain is determined based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain, and a root cause diagnosis result is determined based on the target causal chain. This embodiment transforms cross-protocol time-series data into session embedding vectors using a tool pool, and performs similarity retrieval in a historical case library based on these vectors. By using real historical fault causal chains, the root cause search space is effectively narrowed, suppressing factual bias caused by open reasoning in large language models. During inference, a knowledge base containing structured constraints from the communication domain is introduced, and current statistical summary data is used to perform edge-by-edge causal verification of candidate fault causal chains. The "brain module" ultimately calculates the causal chain by fusing the retrieval similarity score and the chain-level causal verification score, using data features and underlying rules for dual verification. This ensures that the final target causal chain conforms to both the statistical regularities of the actual network environment and the physical operational logic of the communication protocol, thereby improving the accuracy of root cause diagnosis results. Furthermore, during the causal verification stage, each causal edge is independently verified, and evidence classification signals are generated to obtain a target causal chain composed of directed causal edges, indicating the data evidence upon which each causal transformation depends. The target causal chain can fully describe the evolution path of a fault propagating layer by layer across protocols from its source, ultimately leading to a deterioration in user experience quality, thus significantly enhancing the interpretability of root cause diagnosis results.

[0129] This application embodiment also provides a communication network data anomaly root cause inference device, which can implement the above-described communication network data anomaly root cause inference method, refer to Figure 13 The device includes: Data processing module 1310: used to acquire time-series data of the current session, perform feature representation processing on the time-series data through a tool pool, and obtain statistical summary data and session embedding vector, wherein the time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data and packet data convergence protocol layer data.

[0130] Similarity retrieval module 1320: It is used to perform similarity retrieval on historical fault causal chains in the historical case library based on the session embedding vector, obtain the retrieval similarity score, and select multiple candidate fault causal chains based on the retrieval similarity score, wherein each candidate fault causal chain consists of at least one directed causal edge.

[0131] Causal verification module 1330: Based on a knowledge base containing structured constraints in the communication domain, it performs causal verification on each causal edge according to statistical summary data, and obtains the chain-level causal verification score corresponding to each candidate fault causal chain.

[0132] Diagnosis generation module 1340: Used by the brain module to determine the target causal chain based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain, and to determine the root cause diagnosis result based on the target causal chain.

[0133] The specific implementation of the communication network data anomaly root cause reasoning device in this embodiment is basically the same as the specific implementation of the communication network data anomaly root cause reasoning method described above, and will not be repeated here.

[0134] This application also provides an electronic device, including: At least one memory; At least one processor; At least one program; The program is stored in a memory, and the processor executes the at least one program to implement the communication network data anomaly root cause reasoning method described above. The electronic device can be any smart terminal, including mobile phones, tablets, personal digital assistants (PDAs), and in-vehicle computers.

[0135] Please see Figure 14 , Figure 14 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 1401 can be implemented using a general-purpose central processing unit (CPU), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 1402 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1402 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1402 and is called and executed by the processor 1401 to execute the communication network data anomaly root cause reasoning method of the embodiments of this application. The input / output interface 1403 is used to implement information input and output; The communication interface 1404 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 1405 transmits information between various components of the device (e.g., processor 1401, memory 1402, input / output interface 1403, and communication interface 1404); The processor 1401, memory 1402, input / output interface 1403 and communication interface 1404 are connected to each other within the device via bus 1405.

[0136] This application embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the above-described communication network data anomaly root cause reasoning method.

[0137] Memory, as a non-transitory storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0138] The communication network data anomaly root cause reasoning method, apparatus, device, and storage medium proposed in this application are implemented through an intelligent agent system driven by a large language model. The intelligent agent system includes at least a brain module, a tool pool, a knowledge base, and a historical case library. The method includes: acquiring time-series data of the current session; performing feature representation processing on the time-series data through the tool pool to obtain statistical summary data and session embedding vectors, wherein the time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data, and packet data convergence protocol layer data; performing similarity retrieval on historical fault causal chains in the historical case library based on the session embedding vectors to obtain retrieval similarity scores, and selecting multiple candidate fault causal chains based on the retrieval similarity scores, wherein each candidate fault causal chain consists of at least one directed causal edge; performing causal verification on each causal edge based on the statistical summary data according to the knowledge base containing structured constraints in the communication domain to obtain a chain-level causal verification score corresponding to each candidate fault causal chain; determining the target causal chain through the brain module based on the retrieval similarity score and chain-level causal verification score corresponding to each candidate fault causal chain, and determining the root cause diagnosis result based on the target causal chain. This embodiment transforms cross-protocol time-series data into session embedding vectors using a tool pool, and performs similarity retrieval in a historical case library based on these vectors. By using real historical fault causal chains, the root cause search space is effectively narrowed, suppressing factual bias caused by open reasoning in large language models. During inference, a knowledge base containing structured constraints from the communication domain is introduced, and current statistical summary data is used to perform edge-by-edge causal verification of candidate fault causal chains. The "brain module" ultimately calculates the causal chain by fusing the retrieval similarity score and the chain-level causal verification score, using data features and underlying rules for dual verification. This ensures that the final target causal chain conforms to both the statistical regularities of the actual network environment and the physical operational logic of the communication protocol, thereby improving the accuracy of root cause diagnosis results. Furthermore, during the causal verification stage, each causal edge is independently verified, and evidence classification signals are generated to obtain a target causal chain composed of directed causal edges, indicating the data evidence upon which each causal transformation depends. The target causal chain can fully describe the evolution path of a fault propagating layer by layer across protocols from its source, ultimately leading to a deterioration in user experience quality, thus significantly enhancing the interpretability of root cause diagnosis results.

[0139] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0140] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0141] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0143] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0144] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0146] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0149] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for inferring the root causes of data anomalies in communication networks, characterized in that, The method is implemented based on a large language model-driven intelligent agent system, which includes at least a brain module, a tool pool, a knowledge base, and a historical case database. The method includes: The time-series data of the current session is obtained, and the time-series data is processed by the tool pool to obtain statistical summary data and session embedding vector. The time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data and packet data convergence protocol layer data. Based on the session embedding vector, a similarity retrieval is performed on the historical fault causal chains in the historical case library to obtain a retrieval similarity score, and multiple candidate fault causal chains are selected based on the retrieval similarity score, wherein each candidate fault causal chain consists of at least one directed causal edge. Based on the knowledge base containing structured constraints in the field of communication, causal verification is performed on each causal edge according to the statistical summary data to obtain the chain-level causal verification score corresponding to each candidate fault causal chain; The brain module determines the target causal chain based on the retrieval similarity score and the chain-level causal verification score corresponding to each candidate fault causal chain, and determines the root cause diagnosis result based on the target causal chain.

2. The communication network data anomaly root cause reasoning method according to claim 1, characterized in that, The knowledge base includes a global causal graph, which consists of fault atoms and directed causal edges connecting adjacent fault atoms. Each causal edge includes an upstream fault atom and a downstream fault atom. Based on the knowledge base containing structured constraints in the communication domain, causal verification is performed on each causal edge according to the statistical summary data to obtain a chain-level causal verification score corresponding to each candidate fault causal chain, including: Based on the global causal graph, the premise for the establishment of the upstream fault atom corresponding to the causal edge to be verified and the expected evidence corresponding to the downstream fault atom are determined. The expected evidence includes a list of key signal performance indicators and the expected performance indicator behavior and trend corresponding to the indicators in the list of key signal performance indicators. In response to the premise of the upstream fault atom, a valid data time window for the current session is determined. Within the valid data time window, measured observations corresponding to all expected key signals that match the list of key signal performance indicators are extracted from the statistical summary data. The measured observation value of each expected key signal is matched with the corresponding expected performance index behavior and trend to generate the evidence classification signal corresponding to the causal edge to be verified. Based on the evidence classification signals corresponding to all causal edges within the candidate fault causal chain, the chain-level causal verification score of the candidate fault causal chain is obtained according to the evidence classification signals.

3. The communication network data anomaly root cause reasoning method according to claim 2, characterized in that, The step of matching the measured observations of each expected key signal with the corresponding expected performance index behavior and trend to generate the evidence classification signal corresponding to the causal edge to be verified includes: If the measured observations conform to the expected performance index behavior and trend, a supporting evidence classification signal is generated. If the measured observations are contrary to the expected performance index behavior and trend, an opposing evidence classification signal is generated. If the measured observations are unavailable or do not show a clear matching trend, a missing evidence classification signal is generated.

4. The communication network data anomaly root cause reasoning method according to claim 3, characterized in that, The step of obtaining the chain-level causal verification score of the candidate fault causal chain based on the evidence classification signal includes: Preset weighted scores are assigned to the supporting evidence classification signals, the opposing evidence classification signals, and the missing evidence classification signals, respectively. The consistency score of the causal edge is obtained by weighting the weighted scores of the evidence classification signals corresponding to all the expected key signals of the causal edge. The consistency scores of all causal edges within each candidate fault causal chain are aggregated to calculate the chain-level causal verification score.

5. The communication network data anomaly root cause reasoning method according to claim 2, characterized in that, The step of determining the target causal chain through the brain module based on the retrieval similarity score and the chain-level causal verification score corresponding to each candidate fault causal chain includes: Obtain the first discriminative strength of the retrieval similarity score for all the candidate fault causal chains, and the second discriminative strength of the chain-level causal verification score for all the candidate fault causal chains; Assign a first fusion weight to the retrieval similarity score and a second fusion weight to the chain-level causal verification score, wherein the sum of the second fusion weight and the first fusion weight is one; If the first discriminative strength is higher than the second discriminative strength, increase the first fusion weight; otherwise, decrease the first fusion weight. Based on the adjusted first fusion weight and second fusion weight, the retrieval similarity score and the chain-level causal verification score are weighted and calculated to obtain the comprehensive ranking weight; The candidate fault causal chains are sorted based on the comprehensive ranking weight, and the candidate fault causal chain with the largest comprehensive ranking weight in the ranking result is determined as the target causal chain.

6. The communication network data anomaly root cause reasoning method according to claim 5, characterized in that, The intelligent agent system further includes a reporting module, wherein determining the root cause diagnosis result based on the target causal chain includes: A predetermined number of candidate fault causal chains, excluding the target causal chain, are selected from the sorting results as reference causal chains; The starting fault atom of the target causal chain is identified as the target root cause, and the root cause category label corresponding to the target root cause is obtained through the mapping relationship between fault atoms and root cause categories pre-stored in the knowledge base. The reporting module calls the brain module to perform natural language generation processing on the target causal chain, the reference causal chain, the root cause category label, and the evidence classification signal corresponding to the target causal chain, to obtain a structured diagnostic report containing anomaly diagnostic analysis description and / or network optimization suggestions, and outputs the structured diagnostic report as the root cause diagnosis result.

7. The communication network data anomaly root cause reasoning method according to any one of claims 1 to 6, characterized in that, The step of performing feature representation processing on the time series data through the tool pool to obtain statistical summary data and session embedding vectors includes: The time series data is normalized and missing value interpolation is performed using the data preprocessing tools in the tool pool to obtain standardized time series data. The standardized time-series data is statistically analyzed using the data statistical analysis tools in the tool pool to generate statistical summary data containing at least one of quantile statistics, peak and valley statistics, trend direction indicators, and volatility indicators. The standardized time-series data is input into a pre-trained shared representation encoder for latent space mapping to obtain the session embedding vector.

8. A root cause inference device for abnormal data in a communication network, characterized in that, The device is implemented based on a large language model-driven intelligent agent system, which includes at least a brain module, a tool pool, a knowledge base, and a historical case database. The device includes: Data processing module: used to acquire time-series data of the current session, and perform feature representation processing on the time-series data through the tool pool to obtain statistical summary data and session embedding vector, wherein the time-series data includes at least one of physical layer data, media access control layer data, radio link control layer data and packet data convergence protocol layer data; Similarity retrieval module: used to perform similarity retrieval on historical fault causal chains in the historical case library based on the session embedding vector, obtain retrieval similarity score, and select multiple candidate fault causal chains based on the retrieval similarity score, wherein each candidate fault causal chain consists of at least one directed causal edge; Causal verification module: Based on the knowledge base containing structured constraints in the communication domain, it performs causal verification on each causal edge according to the statistical summary data to obtain the chain-level causal verification score corresponding to each candidate fault causal chain; Diagnosis generation module: used by the brain module to determine the target causal chain based on the retrieval similarity score and the chain-level causal verification score corresponding to each candidate fault causal chain, and to determine the root cause diagnosis result based on the target causal chain.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the communication network data anomaly root cause reasoning method according to any one of claims 1 to 7.

10. A storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the communication network data anomaly root cause reasoning method as described in any one of claims 1 to 7.

Images