System fault analysis and prediction method and device, storage medium and program product

Abstract

The embodiment of the application provides a system fault analysis and prediction method, device, storage medium and program product, and relates to the fields of distributed systems, artificial intelligence and financial technology. The method comprises the following steps: collecting multi-modal data of a system, wherein the multi-modal data comprises text logs, numerical time series data and network request behavior data; performing space-time alignment processing on the multi-modal data according to log events in the text logs to generate time series corresponding to the log events; extracting time series feature vectors and space feature vectors of the time series, fusing the time series feature vectors and the space feature vectors according to the log events to obtain fused feature vectors; and predicting potential fault states of the system according to the fused feature vectors. Through the synergistic effect of multi-modal data fusion and a deep learning model, end-to-end analysis and prediction of system faults are realized. In combination with a space-time alignment framework and a cross-modal attention fusion mechanism, high-precision and high-time-efficiency fault protection capabilities are provided for distributed systems.

Description

Technical Field

[0001] This application relates to the fields of distributed systems, artificial intelligence, and financial technology, and in particular to a system fault analysis and prediction method, apparatus, storage medium, and program product. Background Technology

[0002] With the widespread adoption of cloud computing, microservice architecture, and large-scale data centers, enterprise IT systems face the need for real-time processing of massive amounts of heterogeneous data. Examples include core transaction systems in the financial industry, high-concurrency business systems on internet platforms, and remote monitoring systems for industrial IoT devices. In these scenarios, system failures can lead to business interruptions, data loss, or security vulnerabilities.

[0003] Operations and maintenance (O&M) typically require comprehensive analysis of multiple data sources, including monitoring traffic logs, application logs, and server operational status. Existing O&M methods rely on O&M personnel manually correlating multiple data sources, which is time-consuming and prone to missing key correlations, leading to delayed fault location and low repair efficiency. Furthermore, current O&M monitoring often analyzes the cause of a fault only after it occurs, which can have serious consequences for high-time-efficiency applications, where even a short-term failure can have significant consequences. Summary of the Invention

[0004] This application provides a system fault analysis and prediction method, apparatus, storage medium, and program product to achieve high-precision and high-failure fault protection for distributed systems.

[0005] In a first aspect, embodiments of this application provide a system fault analysis and prediction method, including:

[0006] The system collects multimodal data, which includes text logs, numerical time-series data, and network request behavior data.

[0007] Based on the log events in the text log, perform spatiotemporal alignment processing on the multimodal data to generate time series corresponding to the log events;

[0008] Extract the temporal and spatial feature vectors of the time series, and fuse the temporal and spatial feature vectors based on log events to obtain a fused feature vector;

[0009] Based on the fused feature vectors, the potential fault states of the system are predicted.

[0010] In one possible implementation, multimodal data is spatiotemporally aligned based on log events in the text log to generate time series corresponding to the log events, including:

[0011] Centered on log events in text logs, multimodal data is aggregated using a sliding window to generate time series corresponding to the log events.

[0012] In one possible implementation, the window length and step size of the sliding window are correlated with the rate of change of log event characteristics.

[0013] In one possible implementation, extracting the temporal feature vector and spatial feature vector of the time series includes:

[0014] Feature extraction of text logs from time series data is performed using a convolutional neural network to generate spatial feature vectors.

[0015] Feature extraction is performed on numerical time series data based on long short-term memory networks to generate time series feature vectors.

[0016] In one possible implementation, the temporal feature vector and spatial feature vector are fused based on log events to obtain a fused feature vector, including:

[0017] Based on log events, determine the fusion weights corresponding to the temporal feature vector and the spatial feature vector, respectively.

[0018] Based on their respective fusion weights, the temporal feature vector and the spatial feature vector are fused to obtain the fused feature vector.

[0019] In one possible implementation, the method further includes:

[0020] Based on the relationships between all devices in the system, a device relationship graph is constructed, where nodes represent devices and edges represent dependencies between devices.

[0021] Based on the device relationship diagram, generate the device dependency features;

[0022] Device-dependent features are embedded into the fused feature vector.

[0023] In one possible implementation, the potential fault state includes the fault type and the probability of fault occurrence; predicting the potential fault state of the system based on the fused feature vector includes:

[0024] Multiple consecutive fusion feature vectors are fused to generate an output vector that represents the changes in the state of the system over multiple consecutive time periods;

[0025] Based on the output vector, predict the probability of failure and determine the type of failure.

[0026] Secondly, embodiments of this application provide a system fault analysis and prediction apparatus, the apparatus comprising:

[0027] The data acquisition module is used to collect multimodal data from the system, including text logs, numerical time-series data, and network request behavior data.

[0028] The preprocessing module is used to perform spatiotemporal alignment processing on multimodal data based on log events in the text log, and generate time series corresponding to the log events;

[0029] The feature extraction module is used to extract the temporal feature vector and spatial feature vector of the time series, and to fuse the temporal feature vector and spatial feature vector according to the log events to obtain the fused feature vector;

[0030] The fault prediction module is used to predict the potential fault states of the system based on the fused feature vector.

[0031] Thirdly, embodiments of this application provide a computer device, including: a memory and a processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0032] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0033] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0034] The system fault analysis and prediction method, apparatus, storage medium, and program product provided in this application include: collecting multimodal data from the system, including text logs, numerical time-series data, and network request behavior data; performing spatiotemporal alignment processing on the multimodal data based on log events in the text logs to generate time series corresponding to the log events; extracting temporal feature vectors and spatial feature vectors from the time series, fusing the temporal feature vectors and spatial feature vectors based on the log events to obtain a fused feature vector; and predicting the potential fault state of the system based on the fused feature vector. Through the synergistic effect of multimodal data fusion and deep learning models, end-to-end analysis and prediction of system faults are achieved. This concept breaks through the limitations of multi-source data silos in traditional operations and maintenance, proposing a spatiotemporal alignment framework and a cross-modal attention fusion mechanism to extract key fault features in a unified feature space. Based on this, time-series features are modeled, and fault classification and root cause localization are achieved by combining an operations and maintenance knowledge base, ultimately constructing a high-precision, low-latency intelligent operations and maintenance system. Attached Figure Description

[0035] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0036] Figure 1 Flowchart of the system fault analysis and prediction method provided in this application Figure 1 ;

[0037] Figure 2 Flowchart of the system fault analysis and prediction method provided in this application Figure 2 ;

[0038] Figure 3 Flowchart of the system fault analysis and prediction method provided in this application Figure 3 ;

[0039] Figure 4 A schematic diagram of the system fault analysis and prediction device provided in this application;

[0040] Figure 5 A schematic diagram of the structure of the computer device provided in this application.

[0041] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0042] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0043] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0044] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0045] It should be noted that the system fault analysis and prediction method, device, storage medium and program product provided in this application involve the fields of distributed systems and artificial intelligence, and can be used in the field of financial technology, as well as in any field other than financial technology. This application does not limit the application field of the system fault analysis and prediction method, device, storage medium and program product.

[0046] With the widespread adoption of cloud computing, microservice architecture, and large-scale data centers, enterprise IT systems face the challenge of real-time processing of massive amounts of heterogeneous data. Examples include core transaction systems in the financial industry, high-concurrency business systems on internet platforms, and remote monitoring systems for industrial IoT devices. In these scenarios, system failures can lead to business interruptions, data loss, or security vulnerabilities, and traditional maintenance methods struggle to cope with dynamically changing and complex failure modes. For instance, in a financial transaction system, an abnormal server CPU utilization rate may be related to multiple factors, such as exhaustion of the backend database connection pool, a surge in frontend traffic, or timeouts in third-party application API calls. In industrial IoT scenarios, a sudden temperature rise in device sensors may be linked to fluctuations in power supply, wear and tear on mechanical components, or changes in ambient temperature and humidity.

[0047] Currently, existing system operation and maintenance technologies mainly rely on scripting, tool-based, and platform-based methods, but these have significant limitations:

[0048] Script-based operations and maintenance: This involves automating repetitive tasks such as file uploads and service restarts by writing shell scripts. Its advantage lies in rapid deployment, but the scripts are scattered and lack version control, leading to high maintenance costs and difficulty in tracing operation records. For example, when upgrading a bank's core system, dozens of scripts needed to be executed manually. If an error occurred midway, a manual rollback was required, which was time-consuming and risky.

[0049] Tool-based operations and maintenance: This approach uses tools to manage servers in batches. However, these tools generally have issues such as high learning curves, difficulty in tracking operation records, and inconvenient handover processes. Furthermore, the configuration process for some tools is quite complex, and large-scale deployment is slow.

[0050] Platform-based operations and maintenance: Building a centralized monitoring platform to display metrics such as CPU, memory, and network traffic through a visual interface. However, such platforms can only provide "symptoms" rather than "root causes." For example, a surge in CPU usage may be caused by memory leaks, deadlocks, or external attacks, requiring manual cross-analysis of logs and monitoring data, which is inefficient and prone to missing correlations.

[0051] Operations and maintenance personnel need to manually correlate multiple sources of data, such as traffic logs, application logs, and monitoring metrics. This process is time-consuming and prone to missing key correlations, leading to delays in fault location and low repair efficiency. In addition, traditional operations and maintenance systems are mostly "reactive," relying on manual analysis of historical data to locate the root cause only after a fault occurs. This makes it impossible to predict faults in advance and provide risk warnings, and it is difficult to meet the requirements of high availability scenarios for "zero downtime" or "second-level recovery."

[0052] Furthermore, existing technologies suffer from the following problems in multimodal data fusion: data silos, with traffic logs, application logs, monitoring metrics, and other data sources stored independently, lacking a unified processing framework and making cross-modal correlation analysis difficult; limited feature extraction, as traditional methods often employ rule engines or simple statistical models (such as threshold alarms), failing to uncover semantic patterns in text logs (such as the correlation between "database connection timeout" and "JDBC driver exception") or periodic mutations in time-series data; and insufficient predictive capability, as single-modal models based on LSTM (Long Short-Term Memory) can only process time-series data, underutilizing the semantic information of text logs, resulting in low fault prediction accuracy (typically below 60%) and an inability to provide early warnings of potential risks.

[0053] The system fault analysis and prediction method provided in this application aims to solve the above-mentioned technical problems in the prior art.

[0054] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0055] In one embodiment, such as Figure 1 As shown, the system fault analysis and prediction methods include:

[0056] Step 101: Collect multimodal data from the system. Multimodal data includes text logs, numerical time-series data, and network request behavior data.

[0057] Step 102: Based on the log events in the text log, perform spatiotemporal alignment processing on the multimodal data to generate time series corresponding to the log events;

[0058] Step 103: Extract the temporal feature vector and spatial feature vector of the time series, and fuse the temporal feature vector and spatial feature vector according to the log events to obtain the fused feature vector;

[0059] Step 104: Predict the potential fault state of the system based on the fused feature vector.

[0060] The system in step 101 refers to the monitored system, which is a distributed system, such as the core trading system in the financial industry, the high-concurrency business system of an internet platform, or the remote monitoring system for industrial IoT devices. The system fault analysis and prediction method provided in this application is applied to an operation and maintenance system (O&M system), which is used to perform O&M management on the monitored system. The system fault analysis and prediction method provided in this application is applied to the O&M scenario of a distributed system. In some embodiments, the O&M system may be part of the monitored system, meaning that system O&M management is implemented by the O&M functions of the monitored system itself.

[0061] Multimodal data refers to three heterogeneous data formats collected by the operations and maintenance system from the monitored system: text logs (such as application service logs), numerical time-series data (such as runtime monitoring logs), and network request behavior data (such as traffic logs). Text logs contain error information, numerical time-series data reflects CPU utilization, and network request behavior data records API calls. In distributed system operations and maintenance scenarios, the operations and maintenance system collects multimodal data in real time from servers, network devices, and the application layer, such as traffic logs (e.g., API call records), application service logs (e.g., Java exception stack traces), and runtime monitoring logs (e.g., CPU utilization). Specifically, this can be obtained from servers, network devices, and the application layer through a distributed collection system.

[0062] It should be noted that multimodal data includes text logs (such as system logs and error logs) from different sources, timestamps, and physical locations, as well as other modal data (performance metrics and network traffic). When using multimodal data for system fault analysis and prediction, it is necessary to first align these data in time and space to ensure that all data are labeled with the same tag and describe the state of the same service unit at the same time.

[0063] Since log events in text logs are discrete and non-numerical, while performance metrics and network traffic are numerical and continuous, spatiotemporal alignment can be achieved based on log events. For each log event, related performance metrics and traffic data from the same period can be found, thus forming a unified "data snapshot" that describes the complete state of the system within a short period of time.

[0064] Spatiotemporal alignment includes spatial alignment and event alignment. Spatial alignment refers to alignment at the physical location / service unit level to ensure that the compared data comes from the same "place." For example, ensuring that the error logs of Web server 01 are compared with the CPU metrics of Web server 01, rather than with the CPU metrics of database server 05. This can be achieved by tagging the data, such as host: web-server-01, service: user-service, cluster: cluster-a. Time alignment is used to address the time difference between discrete events and continuous metrics. The occurrence of an error log may have an impact on performance metrics a few seconds before and after.

[0065] In one embodiment, a sliding window is used to achieve time alignment. Accordingly, based on the log events in the text log, the multimodal data is spatiotemporally aligned to generate time series corresponding to the log events, including:

[0066] Centered on log events in text logs, multimodal data is aggregated using a sliding window to generate time series corresponding to the log events.

[0067] For example, using log events as the center, aggregate metric data within 5 seconds before and after the event, aligning discrete events with continuous metrics. For instance, the system detects a critical error log, such as "Database master node crash," with a timestamp of T. A time window is created based on this timestamp: [T – 5s, T + 5s]. All performance metrics (CPU, memory, disk I / O), network traffic metrics, etc., for the same service unit within this time window are aggregated. Specifically, averages and maximum values ​​can be calculated. Finally, a context-rich data object is generated, containing:

[0068] The key event: that error log.

[0069] Event background: The overall performance of the system within 5 seconds before and after the event.

[0070] Result: When analyzing this error log, the operations and maintenance system can not only "see" the error itself, but also "see" whether CPU spiked, network was interrupted, or memory usage was abnormal when the error occurred. This greatly improves the accuracy of root cause localization.

[0071] In the above method, since data aggregation is centered on log events, and different events correspond to different rates of feature change, the window length and step size of the sliding window are related to the rate of feature change of the log events. Therefore, in one embodiment, an adaptive sliding window mechanism is introduced during the spatiotemporal alignment stage to dynamically adjust the window length and step size according to the characteristics of the current log event. For example, for "short-term traffic surge" events (such as distributed denial-of-service attacks), a short window (2s) and a small step size (0.5s) are used to capture instantaneous fluctuations; while for "memory leak" events (such as slow growth of JVM heap memory), a long window (10s) and a large step size (2s) are used to capture long-term trends.

[0072] Specifically, an LSTM-based adaptive controller can be introduced to dynamically calculate the optimal window parameters. The LSTM predicts the rate of change of the current event's characteristics (such as "instantaneous fluctuations" or "long-term trends"), outputting the window length and step size parameters. The length and step size of the sliding window are then adjusted in real time based on the controller's output parameters.

[0073] The above method, through adaptive window optimization, enables the operation and maintenance system to accurately match the feature extraction requirements of different fault types. For example, in a "short-term traffic surge" scenario, the operation and maintenance system can capture the instantaneous traffic peak through a short window, while in a "memory leak" scenario, the system can identify the slow growth trend of memory usage through a long window. This dynamic adaptation capability significantly improves the model's recognition accuracy for "multi-scale faults" (such as mixed scenarios of instantaneous and long-term faults), avoiding the "overfitting" or "underfitting" problems caused by traditional fixed windows.

[0074] In addition, a unified time series can be generated directly through a time window. This involves constructing a well-organized, equally spaced dataset that integrates multimodal data for subsequent fault prediction and detection. Specifically, the system defines a fixed-length window and a step size, such as a 5-second window and a 1-second step. When collecting multimodal data, starting from the beginning of the time frame, the window slides for 1 second (step size), capturing all data from the past 5 seconds. The data from all modalities within this 5-second window is processed, including aggregating numerical metrics (such as averaging, summing, and taking the maximum value) to form a feature vector representing the situation during those 5 seconds. The text logs are quantified, such as counting the number of "ERROR" level logs within those 5 seconds and converting the log text into a numerical vector using natural language processing. Each window outputs a unified data point, which integrates all information from the past 5 seconds, including logs, metrics, and traffic. As the window slides continuously, a completely new, equally spaced (one point per second), multimodal fused time series is generated.

[0075] The method provided in the above embodiments further addresses the issue of inconsistent timestamps from different data sources in traditional operations and maintenance by using a sliding window to align multimodal data over time. For example, in a financial transaction system, if a "database connection timeout" log event and "CPU utilization 95%" monitoring data occur simultaneously at a certain moment, the sliding window will map both to the same time series point, forming fused data. This technique significantly improves the spatiotemporal correlation of multi-source data, providing high-quality input for subsequent feature encoding, thereby enhancing the accuracy of fault feature extraction.

[0076] Temporal feature vectors represent the "temporal features" of a time series, while spatial feature vectors represent the "spatial features" of a time series.

[0077] In one embodiment, extracting the temporal feature vector and spatial feature vector of the time series includes:

[0078] Feature extraction of text logs from time series data is performed using a convolutional neural network to generate spatial feature vectors.

[0079] Feature extraction is performed on numerical time series data based on long short-term memory networks to generate time series feature vectors.

[0080] This method uses convolutional neural networks (CNNs) to capture "spatial features" and extract erroneous keyword combinations and local semantic patterns from log text. The extraction process of a text CNN includes: input, a time series, specifically a log text, is first segmented into words / characters and converted into word vectors; convolution, using kernels of different widths, such as 2-grams and 3-grams, slides across the text to detect local features. For example, a convolution kernel might specifically learn the frequently occurring erroneous phrase "connection timeout"; pooling, extracting the most salient features from all local features, such as max pooling, forms a fixed-length spatial feature vector Fs representing the core information of the entire log text.

[0081] Long Short-Term Memory (LSTM) networks capture "temporal features," learning long-term trends, periodicity, and abrupt changes from continuous data such as performance metrics. The LSTM network's extraction process includes: input (time series); LSTM processing; and LSTM processing. Leveraging its internal "memory cells," the LSTM network can remember important information from previous time steps. It can identify trends such as "CPU utilization has been rising rapidly over the past 5 seconds" or periodic patterns such as "current traffic peaks are similar to those at the same time yesterday," ultimately outputting a temporal feature vector Ft.

[0082] After obtaining the spatial and temporal feature vectors, a cross-modal attention fusion mechanism is used to fuse the two vectors, resulting in a fused feature vector. This fused feature vector is a comprehensive feature vector that reflects both instantaneous anomalies and trend changes. Thus, the system state at each time point or corresponding to each log event is condensed into an information-rich "fused feature vector." All these vectors, arranged chronologically, constitute the input for subsequent fault analysis and prediction.

[0083] In the method provided in the above embodiments, the text CNN extracts local features from the logs through different convolutional kernels, such as the co-occurrence of "error" and "timeout," and uses pooling layers to extract key semantic patterns, such as the association between "JVM memory leak" and "thread deadlock." The temporal LSTM captures long-term trends of monitoring metrics, such as "daily memory reclamation at midnight," and abrupt changes, such as "instant CPU spikes," through a memory gating mechanism. For example, in the "JVM memory leak" scenario, the text CNN extracts the keyword "out-of-memory error," while the LSTM captures the periodic growth trend of memory usage. This technique solves the problem of insufficient utilization of semantic information in text logs by traditional single-modal models (such as LSTM based solely on monitoring metrics), significantly improving the model's ability to identify complex fault modes. For example, it can simultaneously capture the synergistic effect of "short-term traffic surge" and "memory leak," thereby improving the accuracy of fault prediction.

[0084] In one embodiment, such as Figure 2 As shown, the temporal feature vector and spatial feature vector are fused based on log events to obtain a fused feature vector, which includes:

[0085] Step 201: Determine the fusion weights corresponding to the temporal feature vector and the spatial feature vector based on the log events;

[0086] Step 202: Based on their respective fusion weights, the temporal feature vector and the spatial feature vector are fused to obtain the fused feature vector.

[0087] Spatial and temporal characteristics are not equally important in all failures. For example, in scenario A (memory leak), Ft (a trend of continuously rising memory usage) may be more important than any single error log entry Fs. In scenario B (API flooding), Fs (a large number of "illegal request" logs) may be the most critical signal.

[0088] Furthermore, by mapping fault scenarios through log events, the fusion weights of spatial and temporal feature vectors are determined during the fusion process. The attention mechanism acts as a smart weight allocator. Based on the current situation, it automatically learns and assigns appropriate weights (α and β) to Fs and Ft. The formula F_fusion = α·Fs + β·Ft ultimately generates a comprehensive feature vector that reflects both instantaneous anomalies and trend changes.

[0089] Specifically, a dynamic attention weight adjustment mechanism based on a fault type classifier is introduced to predict the fault type based on log events, thereby dynamically adjusting the weight distribution ratio of spatial feature vector (α) and temporal feature vector (β).

[0090] The method provided in the above embodiments uses pre-trained language models such as BERT to perform semantic analysis on log text, outputting fault type labels (such as "external attack," "memory leak," and "hardware aging"), and dynamically adjusts the weight ratio of α and β based on the classification results. For example, in the "external attack" scenario, the weight of traffic logs is α=0.8, and the weight of monitoring metrics is β=0.2; while in the "hardware aging" scenario, the weight of monitoring metrics is β=0.9, and the weight of text logs is α=0.1. This technique solves the "one-size-fits-all" problem caused by traditional fixed weight allocation, enabling the model to adaptively optimize feature weight allocation for different fault scenarios. For example, in the "external attack" scenario, the model will prioritize capturing abnormal patterns in traffic logs (such as a short-term surge in request volume), while in the "hardware aging" scenario, the model will pay more attention to the long-term trend of monitoring metrics (such as the periodic increase in hard disk I / O latency). This adaptive adjustment significantly improves the model's feature capture capability in complex fault scenarios, thereby improving the accuracy of fault prediction and scenario adaptability.

[0091] In one embodiment, the method further includes:

[0092] Based on the relationships between all devices in the system, a device relationship graph is constructed, where nodes represent devices and edges represent dependencies between devices.

[0093] Based on the device relationship diagram, generate the device dependency features;

[0094] Device-dependent features are embedded into the fused feature vector.

[0095] In this context, a device relationship graph is a graph structure where nodes represent devices and edges represent dependencies between devices. For example, the dependency edge between a front-end server and a database server.

[0096] In one embodiment, a graph neural network can be used to model the device relationship graph, generating inter-device dependency features. A graph neural network is a deep learning model used to model graph-structured data. For example, a GCN (Graph Convolutional Network) aggregates features from adjacent devices through a message-passing mechanism.

[0097] After fusing and encoding temporal and spatial feature vectors, a device relationship graph is constructed, such as the dependency relationship between a front-end server and a database server in a financial trading system. A graph neural network is then used to model this graph. For example, GCN aggregates feature information from the front-end server and the database server through a message passing mechanism to generate inter-device dependency features. This process embeds causal relationships between devices into the feature encoding using graph embedding technology, such as "front-end server depends on database server".

[0098] In financial trading systems, front-end servers, database servers, and cache servers have topological dependencies. By constructing a device relationship graph, Generative Neural Networks (GNNs) aggregate feature information from adjacent devices through a message passing mechanism. For example, if the CPU utilization of the database server is abnormal, the GNN will capture its impact on the response time of the front-end server and embed the causal relationships between devices into the encoding of the fused feature vector through graph embedding. This technique solves the problem of traditional models' insufficient ability to identify collaborative failure modes between devices (such as "chain failures"), enabling the model to accurately identify complex failure scenarios such as "database server crash → cache server unable to refresh → front-end server timeout," thereby significantly improving the model's predictive ability for system-level failures.

[0099] In one embodiment, such as Figure 3 As shown, potential fault states include fault types and fault occurrence probabilities; based on the fused feature vectors, the potential fault states of the system are predicted, including:

[0100] Step 301: Fuse multiple consecutive fusion feature vectors to generate an output vector representing the changes in the state of the system over multiple consecutive time periods;

[0101] Step 302: Based on the output vector, predict the probability of failure and determine the type of failure.

[0102] By reading a "system state storyline" composed of multiple consecutive fused feature vectors, the system can predict the outcome of the story (whether a failure will occur). This step can be accomplished using an LSTM model, which takes as input a continuous, time-ordered sequence of fused feature vectors. For example, 60 fused feature vectors from the past 60 time points (i.e., the past 60 seconds). The LSTM model reads each fused feature vector in this sequence sequentially. Leveraging its powerful temporal memory, the LSTM doesn't analyze isolated moments, but rather a dynamic evolutionary process. It can learn a "precursor pattern" before a failure occurs. For example, it might learn that before a database crash, a sequence typically appears: [Error log "Connection pool full" appears] -> [CPU I / O wait time slowly increases] -> [Number of active database connections surges to peak] -> [Error log "Connection timeout" spikes].

[0103] The last output unit of the LSTM model generates an output vector. This vector summarizes the information from the entire sequence. This output vector is fed into a classifier for fault prediction: the model outputs a probability of fault occurrence between 0 and 1 (e.g., 0.85). The higher the probability, the closer the system is to failure. The model can estimate the approximate time until the fault occurs through regression analysis or by analyzing the rising slope of the probability curve, for example, "Based on this trend, it is expected to occur in 2 minutes." The operations team can set a threshold (e.g., 0.7). When the probability exceeds this threshold, the system triggers a pre-fault warning, allowing for intervention before the fault actually occurs.

[0104] The system maintains an operations and maintenance knowledge base, which stores "feature vector fingerprints" corresponding to different fault types, such as "memory leak," "network partition," and "database deadlock." The system performs similarity matching between the currently output vector and the fingerprints in the knowledge base. The system can not only issue alerts but also directly provide: "The current fault may be 'memory leak' (92% confidence level). Suggested solution: Restart the XXX service and check the references to the XXX object."

[0105] The output vectors described above encode various information about the current task (such as fault prediction) from multiple input two-virtual fused feature vectors: such as long-term trends, periodic patterns, key events, dependencies within the sequence, and the "state" of the sequence. Among these, long-term trends indicate whether the system indicators are rising, falling, or remaining stable; periodic patterns indicate whether the current behavior conforms to a known cycle (such as daytime peaks); key events indicate whether significant abnormal peaks or abrupt changes have occurred in the sequence; dependencies within the sequence, such as "after error log A appears, indicator B usually starts to spike," are learned and encoded by the model; and the "state" of the sequence indicates whether the entire system is in a "healthy," "sub-healthy," "endangered," or "collapsed" state.

[0106] LSTM generates this vector through its unique "gating mechanism" (input gate, forget gate, output gate). Specifically:

[0107] Loop reading: The LSTM reads the fused feature vector of each time step in the input sequence from left to right, one after another.

[0108] Selective memory and forgetting: Forgetting gate: determines which irrelevant information to discard from previous memory cells (e.g., normal data points from a week ago). Input gate: determines which new information from the current input to store in the memory cell (e.g., an error log that just appeared).

[0109] Updated State: Combining forgotten old memories with newly added important information to form a new, updated internal state.

[0110] Output generation: At each time step, the LSTM generates an output based on the current input and the current internal state. The output of the last time step is the crucial output vector. Because it is generated after processing all the information in the sequence, it theoretically contains the most comprehensive and representative sequence information.

[0111] Suppose the system input is fused feature data from the past 60 seconds.

[0112] Sequence content: Everything was normal for the first 50 seconds. Starting from the 55th second, the database error log increased, and the application server's response time began to rise slowly.

[0113] LSTM processing: It reads in the first 50 normal fused feature vectors. When it reads the anomalous vector at the 55th second, the input gate considers it important information and adds it to its memory. The forget gate may selectively ignore some earlier, irrelevant normal fluctuations. LSTM learns the transient correlation between "database errors" and "response time increases".

[0114] The meaning of the output vector: After reading the data at the 60th second, the generated output vector encodes the following context: "The system experienced database errors and performance degradation in the last 5 seconds, but the overall system has not yet crashed."

[0115] Fault prediction and classification: When the decision-making layer sees this vector indicating "beginning of degradation," it might output a medium probability value, such as 0.6, and trigger an alert. This vector, when matched with the knowledge base, is likely to be the closest to the feature fingerprint of "database connection pool bottleneck," thus providing specific diagnostic suggestions for operations and maintenance personnel.

[0116] The method provided in the above embodiments combines the temporal modeling capability of the LSTM model with the classification logic of the knowledge base to achieve accurate prediction of faults and automated root cause localization. For example, it can trigger automatic expansion in advance in the scenario of "short-term traffic surge" to avoid server crashes.

[0117] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0118] Based on the same inventive concept, this application also provides a system fault analysis and prediction device. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more system fault analysis and prediction device embodiments provided below can be found in the limitations of the system fault analysis and prediction method above, and will not be repeated here.

[0119] In one embodiment, such as Figure 4 As shown, the system fault analysis and prediction device includes a data acquisition module 401, a preprocessing module 402, a feature extraction module 403, and a fault prediction module 404, wherein:

[0120] The data acquisition module 401 is used to collect multimodal data from the system, including text logs, numerical time-series data, and network request behavior data.

[0121] Preprocessing module 402 is used to perform spatiotemporal alignment processing on multimodal data based on log events in text logs, and generate time series corresponding to log events;

[0122] The feature extraction module 403 is used to extract the temporal feature vector and spatial feature vector of the time series, and to fuse the temporal feature vector and spatial feature vector according to the log events to obtain the fused feature vector;

[0123] The fault prediction module 404 is used to predict the potential fault state of the system based on the fused feature vector.

[0124] In one possible implementation, the preprocessing module 402 is specifically used for:

[0125] Centered on log events in text logs, multimodal data is aggregated using a sliding window to generate time series corresponding to the log events.

[0126] In one possible implementation, the preprocessing module 402 is specifically used to determine the window length of the sliding window and the step size associated with the characteristic change rate of the log event.

[0127] In one possible implementation, the feature extraction module 403 is specifically used for:

[0128] Feature extraction of text logs from time series data is performed using a convolutional neural network to generate spatial feature vectors.

[0129] Feature extraction is performed on numerical time series data based on long short-term memory networks to generate time series feature vectors.

[0130] In one possible implementation, the feature extraction module 403 is specifically used for:

[0131] Based on log events, determine the fusion weights corresponding to the temporal feature vector and the spatial feature vector, respectively.

[0132] Based on their respective fusion weights, the temporal feature vector and the spatial feature vector are fused to obtain the fused feature vector.

[0133] In one possible implementation, the feature extraction module 403 is specifically used for:

[0134] Based on the relationships between all devices in the system, a device relationship graph is constructed, where nodes represent devices and edges represent dependencies between devices.

[0135] Based on the device relationship diagram, generate the device dependency features;

[0136] Device-dependent features are embedded into the fused feature vector.

[0137] In one possible implementation, the potential fault state includes the fault type and the probability of fault occurrence; the fault prediction module 404 is specifically used for:

[0138] Multiple consecutive fusion feature vectors are fused to generate an output vector that represents the changes in the state of the system over multiple consecutive time periods;

[0139] Based on the output vector, predict the probability of failure and determine the type of failure.

[0140] Each module in the aforementioned system fault analysis and prediction device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0141] Figure 5 A schematic diagram of the structure of the computer device provided in this application. Figure 5 As shown, the computer device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0142] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0143] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0144] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0145] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0146] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0147] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0148] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0149] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0150] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0151] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0152] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0153] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0154] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0155] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0156] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A system fault analysis and prediction method, characterized in that, The method includes: The system collects multimodal data, including text logs, numerical time-series data, and network request behavior data. Based on the log events in the text log, the multimodal data is spatiotemporally aligned to generate a time series corresponding to the log events; Extract the temporal feature vector and spatial feature vector of the time series, and fuse the temporal feature vector and spatial feature vector according to the log events to obtain a fused feature vector; Based on the fused feature vector, the potential fault state of the system is predicted.

2. The method according to claim 1, characterized in that, The step of performing spatiotemporal alignment processing on the multimodal data based on the log events in the text log to generate time series corresponding to the log events includes: Centered on the log events in the text log, the multimodal data is aggregated using a sliding window to generate the time series corresponding to the log events.

3. The method according to claim 2, characterized in that, The window length and step size of the sliding window are associated with the characteristic change rate of the log event.

4. The method according to claim 1, characterized in that, The extraction of the temporal feature vector and spatial feature vector of the time series includes: Feature extraction is performed on the text logs in the time series based on a convolutional neural network to generate spatial feature vectors; Feature extraction is performed on the numerical time series data in the time series based on the Long Short-Term Memory network to generate a time series feature vector.

5. The method according to claim 1, characterized in that, The step of fusing the temporal feature vector and the spatial feature vector based on the log events to obtain a fused feature vector includes: Based on the log events, determine the fusion weights corresponding to the temporal feature vector and the spatial feature vector, respectively. Based on their respective fusion weights, the temporal feature vector and the spatial feature vector are fused to obtain a fused feature vector.

6. The method according to claim 5, characterized in that, The method further includes: Based on the relationships between all devices in the system, a device relationship graph is constructed, where nodes represent devices and edges represent dependencies between devices. Based on the device relationship diagram, generate inter-device dependency features; The inter-device dependency features are embedded into the fused feature vector.

7. The method according to claim 1, characterized in that, The potential fault state includes the fault type and the probability of fault occurrence; predicting the potential fault state of the system based on the fused feature vector includes: Multiple consecutive fusion feature vectors are fused to generate an output vector that represents the changes in the state of the system over multiple consecutive time periods; Based on the output vector, the probability of a fault occurring is predicted, and the fault type is determined.

8. A system fault analysis and prediction device, characterized in that, The device includes: The data acquisition module is used to collect multimodal data from the system, including text logs, numerical time-series data, and network request behavior data. The preprocessing module is used to perform spatiotemporal alignment processing on the multimodal data based on the log events in the text log, and generate the time series corresponding to the log events; The feature extraction module is used to extract the temporal feature vector and spatial feature vector of the time series, and fuse the temporal feature vector and spatial feature vector according to the log events to obtain a fused feature vector; The fault prediction module is used to predict the potential fault state of the system based on the fused feature vector.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images