A multivariate time series abnormal root cause positioning method based on causal structure learning and simulation disturbance verification optimization

Abstract

This invention relates to a multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization, belonging to the field of data science technology. The method includes: preprocessing the original normal data, dividing it into a training subset and a validation subset; calculating the mean and standard deviation based on the training subset; normalizing both the training and validation subsets; performing offline causal modeling on the normalized training subset to construct a global directed causal graph with edge weights and time delay information; constructing simulated perturbation samples on the normalized validation subset, and combining them with normal validation samples without injected perturbations to construct a joint optimization objective function; obtaining the optimal parameter combination through parameter search optimization; and using the global directed causal graph and the optimal parameter combination to locate the anomaly root cause of the test samples and outputting the results. This invention can provide more complete root cause localization results in complex anomaly scenarios and improve the analysis capability for multi-source anomalies.

Description

Technical Field

[0001] This invention belongs to the field of data science technology, specifically relating to a multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization. Background Technology

[0002] With the continuous improvement of informatization, digitalization, and intelligentization, industrial control systems, information systems, cloud platform operation and maintenance systems, business platforms, and other complex business systems continuously collect and generate a large amount of monitoring data, log data, status data, and behavioral data during operation. These data can usually be represented as multivariate time series, and there are often complex temporal dependencies, business coupling relationships, and propagation relationships between different variables.

[0003] In practical applications, system anomalies may originate from various factors such as equipment failure, configuration errors, abnormal operations, malicious attacks, abnormal business processes, abnormal resource scheduling, or abnormal data transmission. These anomalies can then propagate along variable dependencies, ultimately manifesting as a combined anomaly in multiple observed indicators. Therefore, simply identifying "whether it is abnormal" is usually insufficient for practical handling; it is also necessary to further pinpoint the root cause of the anomaly and its propagation path. Most existing anomaly detection methods are based on statistical features, reconstruction errors, or prediction errors. For example, they use models such as autoencoders, recurrent neural networks, or graph neural networks to model multivariate time series data and then identify anomalies based on reconstruction or prediction biases. However, these methods often suffer from the following problems: they focus on anomaly detection itself, lack the ability to model the anomaly propagation mechanism, struggle to identify root cause nodes and propagation paths, and lack interpretability; normal system operation data is often non-stationary, with different time periods potentially corresponding to different business states, operating modes, or working stages. Directly learning a unified dependency structure across all time periods can easily lead to unstable relationships, affecting subsequent anomaly localization results; many methods heavily rely on human experience in parameter settings, such as anomaly thresholds, propagation attenuation parameters, and scoring weights, resulting in poor transferability and insufficient generalization ability; for multi-source anomaly scenarios, existing methods often assume the existence of only a single anomaly source or only output single-node sorting results, making it difficult to adapt to complex real-world scenarios where multiple anomaly sources coexist.

[0004] Therefore, there is a need for a multivariate time series anomaly root cause localization method that can be applied to various complex system scenarios. This method should be able to combine the dependencies between variables, adapt to non-stationary normal states, have structural interpretability, and can adaptively optimize parameters through a verification mechanism, while also supporting multi-source anomaly localization. Summary of the Invention

[0005] The purpose of this invention is to provide a multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization to address the above-mentioned problems. This method involves multi-regime causal structure modeling, anomaly residual construction based on causal relationships, and simulated perturbation verification optimization, thereby achieving accurate localization of complex multi-source anomalies.

[0006] S1. Preprocess the original normal data of multivariate time series, divide the preprocessed normal data into training subset and validation subset, calculate the mean and standard deviation based on the training subset, and normalize the training subset and validation subset.

[0007] S2. Based on multi-regime subsequences and structural prior constraints, offline causal modeling is performed on the normalized training subset to construct a global directed causal graph with edge weights and time delay information; S3. Construct simulated perturbation samples containing univariate perturbations and multivariate joint perturbations on the normalized validation subset, and construct a joint optimization objective function by combining it with normal validation samples without injected perturbations. Optimal parameter combination for online anomaly detection and root cause localization is obtained through parameter search optimization. S4. Using a global directed cause-effect graph and optimal parameter combination, perform abnormal root cause localization on the test samples, and output the candidate root cause ranking results, multi-root cause set localization results, and root cause propagation path results from abnormal nodes.

[0008] Optionally, step S2 includes the following specific steps: S21. Based on the prior structural information of the target system, divide all variables into multiple stage groups or functional groups, establish the mapping relationship between variables and their respective groups, and construct inter-group constraints so that candidate causal connections are only allowed to be established within the same group or between groups with predefined adjacency relationships. S22. Perform change detection on the training subset data to divide the time series into K statistically stable regime subsequences; The change point detection is used to identify time points in the training subset data where statistical characteristics change significantly, dividing the training subset into K sub-intervals with relatively stable statistical characteristics. ; Each sub-interval corresponds to a regime subsequence: ; Where k = 1, 2, ..., K, Let k be the start time of the kth regime subsequence. This represents the end time of the k-th regime subsequence; S23. On each regime subsequence that meets the minimum length requirement, perform temporal causal learning based on between-group constraints to obtain the causal strength matrix and significance matrix corresponding to each regime subsequence: ; ; in, Let be the causal strength matrix, representing the causal strength of variable i in the k-th regime subsequence. The causal strength of time on variable j at time t; This is a significance matrix, representing the significance level of corresponding causal relationships. ; S24. Based on the effective length, significant edge density, and causal structure consistency of each regime subsequence, the causal strength matrix and significance matrix of each regime subsequence are weighted and fused to obtain the global causal relationship matrix and the global significance matrix. S25. Based on preset causal strength threshold and saliency threshold, select effective causal edges from the global causal relationship matrix, and construct the global directed causal graph by combining edge weight and time delay information.

[0009] Optionally, in step S21, the prior structural information of the target system includes the target system's operating logic, functional division, business processes, module hierarchy, and technological process information. The stage group or functional group corresponds to different processing units, business links, functional modules or process nodes in the system. The inter-group constraints are specifically: ; in, It is the group of variable i. A group is a set if the group containing variable i and the group containing variable j belong to the set. Only when variable i is allowed to be a candidate causal parent node for variable j.

[0010] Optionally, in step S24, the weight w of the k-th regime subsequence k The calculation formula is: ; in, This represents the length of the k-th regime subsequence; This indicates the proportion of significant causal edges in the subsequence of this regime; This indicates the structural consistency between the learning results of this registrar subsequence and other registrar subsequences. Used to measure the degree of overlap between the causal structure learned by the current registrar subsequence and other registrar subsequences; Let be the weighting coefficient, satisfying ; The formula for calculating the global causal relationship matrix is ​​as follows: ; The significance matrix is ​​weighted and fused using the same method as the causality strength matrix to obtain the global significance matrix. .

[0011] Optionally, step S25 includes the following specific steps: S251. Based on preset causal strength and significance thresholds, select valid causal edges from the global causal relationship matrix. The selection criteria for valid causal edges are as follows: ; ； in, The threshold for causal strength. The significance threshold; S252. Construct a global directed causal graph with edge weights and time delay information. ; in, V For a set of variable nodes, E The selected set of valid causal edges includes information on the causal strength and hysteresis order of each edge.

[0012] Optionally, step S3 includes the following specific steps: S31. Divide the normalized validation subset into multiple validation windows according to the given window length and sliding step size. Inject simulated perturbations into some validation windows to construct simulated perturbation samples, while retaining some validation windows without perturbations as normal validation samples. S32. Based on the global directed causal graph obtained in the offline phase, calculate the causal prediction value for each variable in all validation samples, and use the deviation between the actual observed value and the causal prediction value as the abnormal residual; For the target variable Let its set of parent nodes in the global directed causal graph be . Causal prediction values ​​obtained based on parent node weighted prediction The calculation formula is: ; in, This represents the weight of the causal edge from the parent node to the target node; Indicates the corresponding time delay; The outlier residuals of the target variable are: ; S33. Construct a joint optimization objective function that simultaneously considers root cause ranking accuracy, multi-root cause hit capability, and false alarm rate. Optimize the parameters related to online anomaly detection and root cause localization through a parameter search strategy to obtain the optimal parameter combination. The joint optimization objective function The calculation formula is: ; in, This represents the average accuracy of the top 5 predicted root causes. This represents the mean sorted in descending order. This indicates whether the first 5 results hit the true root cause. This indicates whether at least one true root cause is found in the set of multiple root causes. This indicates the proportion of false alarms occurring on normal validation samples. These are the weighting coefficients for the corresponding indicators; The optimal parameter combination is:

[0013] in, θ The set of parameters to be optimized This represents the set of simulated attack verification samples constructed from the normal verification set.

[0014] Optionally, in step S31, the simulated disturbance includes univariate disturbance and multivariate joint disturbance; The univariate perturbation includes offset, scaling, drift and jamming forms, used to simulate a single anomaly source scenario; The multivariate joint perturbation involves simultaneously injecting different forms of perturbation into two or more variables in the same verification window to simulate multi-source anomalies or multi-root cause anomalies. The normal validation samples are used to evaluate the false alarm rate corresponding to the parameter settings.

[0015] Optionally, step S4 includes the following specific steps: S41. Based on the parent node relationship and corresponding time delay and edge weight in the global directed causal graph, calculate the causal prediction value and abnormal residual for each variable in the test sample, construct the abnormal residual matrix, identify abnormal variables according to the abnormal residual threshold, and extract the abnormal node set in the attack fragment as the abnormal node set to be explained. S42. Based on the causal path enumeration method, obtain all feasible propagation paths between candidate root cause nodes and anomalous nodes, calculate the path propagation strength for each propagation path, and aggregate the propagation strengths of all feasible paths to obtain the total propagation explanatory power of candidate root cause nodes to anomalous nodes. S43 combines the node's own anomaly strength, anomaly timing, propagation interpretability, anomaly coverage ratio, backpropagation penalty, and hub node structure penalty to calculate the comprehensive score of the candidate root cause node: ; Where Self(r) represents the anomaly strength of the candidate node itself, Prop(r) is the propagation term, representing the candidate node's ability to explain the propagation of other anomaly nodes, Coverage(r) represents the proportion of anomaly nodes that the candidate node can cover or explain, Time(r) represents how early the anomaly of the candidate node occurs relative to other anomaly nodes, Reverse(r) represents the penalty term for backpropagation from other anomaly nodes to the candidate node, and Hub(r) represents the structural penalty term for the high-level hub nodes in the graph. These are the weight parameters for each scoring item; S44, based on a comprehensive score, selects and sorts multiple root cause sets by maximizing an objective function that includes coverage gain and redundancy penalty, and outputs the final candidate root cause ranking results, multiple root cause set location results, and root cause propagation path results from root causes to anomalous nodes.

[0016] Optionally, the specific steps of step S42 are as follows: S421. Let the candidate root cause node be r, the anomalous node be v, and the propagation path from r to v be P. Then the formula for calculating the propagation strength S(P) of this path is: ; in, Indicates the upper edge of the path The causal weights, where k represents the path length. The path length decay coefficient is represented by Δt, which represents the actual observation time difference between the root cause node and the target anomaly node. This represents the cumulative theoretical time delay along the path. and These represent the time decay coefficient and the time consistency penalty coefficient, respectively. S422. Define the formula for calculating the total propagation explanatory power S(r→v) of candidate root cause node r to anomalous node v as follows: ; in, This represents the set of feasible propagation paths from r to v; S423. Summarize the total propagation explanation ability of candidate node r for all abnormal nodes to obtain the propagation term Prop(r).

[0017] Optionally, in step S44, the objective function is: ; in, This indicates the ability of the root cause set to add new coverage to the set of abnormal nodes. This represents the redundancy caused by repeated interpretations of the same anomalous node by different root cause nodes, where β and γ represent the coverage gain weight and redundancy penalty weight, respectively.

[0018] As can be seen from the above technical solutions, the present invention has the following advantages: This invention employs causal modeling through structural prior constraints and multi-regime weighted fusion to reduce invalid connections and noisy edges, avoiding causal distortion caused by non-stationary data modeling and constructing a stable and reliable global causal structure. Simultaneously, it constructs simulated perturbation samples based on a normal validation set, using a multi-index joint objective function to achieve automatic parameter optimization, reducing reliance on manual parameter tuning and improving model generalization ability. Anomaly residuals are constructed based on causal parent node prediction, directly linking anomaly detection results to system dependencies, enhancing interpretability. A path integral propagation intensity metric is used to comprehensively characterize the anomaly propagation process across multiple paths, distinguishing between real paths and incidentally related paths, improving the accuracy and robustness of root cause localization. This invention integrates a multi-factor root cause scoring mechanism to achieve more refined root cause ranking and introduces a multi-root cause set optimization method, maximizing anomaly coverage while reducing interpretive redundancy, effectively adapting to complex scenarios with multiple concurrent anomaly sources, and improving the application performance and practicality of the method in complex systems such as industrial control, information systems, and cloud platform operation and maintenance. This invention can provide more complete root cause localization results in complex anomaly scenarios, improving the system's ability to analyze multi-source anomalies and its practical application value. Attached Figure Description

[0019] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization in an embodiment of the present invention. Figure 2 This is a schematic diagram of the overall framework module flow in an embodiment of the present invention. Detailed Implementation

[0021] The various embodiments of the present invention will be described more fully in the detailed steps of the multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization, which will be described in detail below. The present invention may have various embodiments, and adjustments and modifications may be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present invention to the specific embodiments disclosed herein, but rather the present invention should be understood to cover all modifications, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of the present invention.

[0022] To make the objectives, features, and advantages of this invention more apparent and understandable, specific embodiments and accompanying drawings will be used to clearly and completely describe the technical solutions protected by this invention. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0023] Please see Figure 1 The diagram shows a flowchart of a multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization. S1. Preprocess the original normal data of multivariate time series, divide the preprocessed normal data into training subset and validation subset, calculate the mean and standard deviation based on the training subset, and normalize the training subset and validation subset. S2. Based on multi-regime subsequences and structural prior constraints, offline causal modeling is performed on the normalized training subset to construct a global directed causal graph with edge weights and time delay information; S3. Construct simulated perturbation samples containing univariate perturbations and multivariate joint perturbations on the normalized validation subset, and construct a joint optimization objective function by combining it with normal validation samples without injected perturbations. Optimal parameter combination for online anomaly detection and root cause localization is obtained through parameter search optimization. S4. Using a global directed cause-effect graph and optimal parameter combination, perform abnormal root cause localization on the test samples, and output the candidate root cause ranking results, multi-root cause set localization results, and root cause propagation path results from abnormal nodes.

[0024] It should be noted that, in this embodiment of the invention, normal operation data is divided into regions through change point detection, and causal structure learning is performed on each region. A global directed causal graph is constructed by combining system structure prior constraints, thereby improving the stability and accuracy of causal relationship modeling. The system structure prior constraints can be defined as process stage constraints, business process stage constraints, functional module constraints, hierarchical topology constraints, or other dependency constraints that conform to the system operation logic, depending on the specific application scenario. Secondly, based on the causal graph, the causal parent nodes of variables are used to perform weighted prediction, and the deviation between the predicted value and the actual observed value is used as the anomaly residual to achieve anomaly detection with structural interpretability. Furthermore, simulated disturbance samples are constructed on the validation data, and key parameters are optimized by combining multiple evaluation indicators to reduce the dependence on manual parameter tuning. Finally, in the root cause localization stage, the explanatory power of candidate nodes for anomalies is calculated based on the causal propagation path, and combined with a multi-factor scoring mechanism and a multi-root cause set optimization method, accurate localization of complex multi-source anomalies is achieved.

[0025] As a refinement and extension of the specific implementation methods described above, and to fully illustrate the specific implementation process in this embodiment, another multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization is provided. The overall framework module flowchart is shown below. Figure 2 As shown, the method includes the following steps: S1. Preprocess the original normal data of multivariate time series, divide the preprocessed normal data into training subset and validation subset, calculate the mean and standard deviation based on the training subset, and normalize the training subset and validation subset. In this embodiment of the invention, the multivariate time series of the industrial system is assumed to be:

[0026]

[0027] in for The observation value at time T represents the time length, and N represents the number of variables (number of sensors or actuators). In this example, the input data is the time series data SWaT from an industrial water treatment plant. Each element... It is a tuple containing the values ​​of 51 variables, including liquid level and flow rate.

[0028] Normal data is divided into:

[0029] in: ,

[0030] The first 70% of the normal operating data was used as the training subset for subsequent offline causal modeling; the last 30% of the normal operating data was used as the validation subset to construct simulated attack samples and optimize the parameters of the online detection and root cause localization modules.

[0031] To eliminate the influence of differences in units and magnitudes among different variables, the preprocessed training data is normalized:

[0032]

[0033]

[0034] in, and These are the mean and standard deviation, calculated only from the training subset, and subsequently used for standardization of the validation subset and test samples.

[0035] S2. Based on multi-regime subsequences and structural prior constraints, offline causal modeling is performed on the normalized training subset to construct a global directed causal graph with edge weights and time delay information; The specific steps of step S2 include: S21. Based on the prior structural information of the target system, divide all variables into multiple stage groups or functional groups, establish the mapping relationship between variables and their respective groups, and construct inter-group constraints so that candidate causal connections are only allowed to be established within the same group or between groups with predefined adjacency relationships. In step S21, the prior structural information of the target system includes the target system's operating logic, functional division, business processes, module hierarchy, and technological process information. The stage group or functional group corresponds to different processing units, business links, functional modules or process nodes in the system. The inter-group constraints are specifically: ; in, It is the group of variable i. A group is a set if the group containing variable i and the group containing variable j belong to the set. Only when variable i is selected can it be allowed as a candidate causal parent node for variable j. Through these inter-group constraints, invalid connections inconsistent with the system's structural logic are reduced, spurious causal interference in high-dimensional multivariate time-series modeling is mitigated, and the learned causal relationships conform to the dependency transitivity rules in the actual system.

[0036] S22. Perform change point detection on the training subset data to divide the time series into K statistically stable regime subsequences, such as regime1, regime2, and regime3; The change point detection is used to identify time points in the training subset data where statistical characteristics change significantly, dividing the training subset into K sub-intervals with relatively stable statistical characteristics. ; Each sub-interval corresponds to a regime subsequence: ; Where k = 1, 2, ..., K, Let k be the start time of the kth regime subsequence. , where is the end time of the kth regime subsequence; by dividing by regime, we avoid the distortion of causal relationships caused by directly modeling the whole on non-stationary data, and improve the stability and reliability of causal structure learning.

[0037] S23. On each regime subsequence that meets the minimum length requirement, perform temporal causal learning based on between-group constraints to obtain the causal strength matrix and significance matrix corresponding to each regime subsequence: ; ; in, Let be the causal strength matrix, representing the causal strength of variable i in the k-th regime subsequence. The causal strength of time on variable j at time t; This is a significance matrix, representing the significance level of corresponding causal relationships. ; S24. Based on the effective length, significant edge density, and causal structure consistency of each regime subsequence, the causal strength matrix and significance matrix of each regime subsequence are weighted and fused to obtain the global causal relationship matrix and the global significance matrix. In step S24, the weight w of the k-th regime subsequence k The calculation formula is: ; in, This represents the length of the k-th regime subsequence; This indicates the proportion of significant causal edges in the subsequence of this regime; This indicates the structural consistency between the learning results of this registrar subsequence and other registrar subsequences. Used to measure the degree of overlap between the causal structure learned by the current registrar subsequence and other registrar subsequences; Let be the weighting coefficient, satisfying ; The formula for calculating the global causal relationship matrix is ​​as follows: ; The significance matrix is ​​weighted and fused using the same method as the causality strength matrix to obtain the global significance matrix. .

[0038] S25. Based on preset causal strength threshold and saliency threshold, select effective causal edges from the global causal relationship matrix, and construct the global directed causal graph by combining edge weight and time delay information.

[0039] The specific steps of step S25 include: S251. Based on preset causal strength and significance thresholds, select valid causal edges from the global causal relationship matrix. The selection criteria for valid causal edges are as follows: ; ； in, The threshold for causal strength. The significance threshold; S252. Construct a global directed causal graph with edge weights and time delay information. ; in, V For a set of variable nodes, E The resulting set of valid causal edges includes information on causal strength and lag order for each edge. By applying the selection criteria, pseudo-causal edges with low causal strength and poor statistical significance are eliminated, resulting in a concise and reliable global causal structure.

[0040] S3. Construct simulated perturbation samples containing univariate perturbations and multivariate joint perturbations on the normalized validation subset, and construct a joint optimization objective function by combining it with normal validation samples without injected perturbations. Optimal parameter combination for online anomaly detection and root cause localization is obtained through parameter search optimization. The specific steps of step S3 include: S31. Divide the normalized validation subset into multiple validation windows according to the given window length and sliding step size. Inject simulated perturbations into some validation windows to construct simulated perturbation samples, while retaining some validation windows without perturbations as normal validation samples. In step S31, the simulated disturbance includes univariate disturbance and multivariate joint disturbance; The univariate perturbation includes offset, scaling, drift and jamming forms, used to simulate a single anomaly source scenario; The multivariate joint perturbation involves simultaneously injecting different forms of perturbation into two or more variables in the same verification window to simulate multi-source anomalies or multi-root cause anomalies. The normal validation samples are used to evaluate the false alarm rate corresponding to the parameter settings.

[0041] By constructing a validation set that includes simulated perturbation samples and normal validation samples, automatic parameter optimization can be achieved without using test data, thus avoiding the leakage of test information and ensuring the objectivity and credibility of the final evaluation results.

[0042] S32. Based on the global directed causal graph obtained in the offline phase, calculate the causal prediction value for each variable in all validation samples, and use the deviation between the actual observed value and the causal prediction value as the abnormal residual; For the target variable Let its set of parent nodes in the global directed causal graph be . Causal prediction values ​​obtained based on parent node weighted prediction The calculation formula is: ; in, This represents the weight of the causal edge from the parent node to the target node; Indicates the corresponding time delay; The outlier residuals of the target variable are: ; The abnormal residuals are directly derived from the prediction of parent nodes on the causal graph. Compared with the errors of traditional black-box reconstruction models, they have stronger structural interpretability and can establish a direct link between the anomaly detection results and the dependencies between variables.

[0043] S33. Construct a joint optimization objective function that simultaneously considers root cause ranking accuracy, multi-root cause hit capability, and false alarm rate. Optimize the parameters related to online anomaly detection and root cause localization through a parameter search strategy to obtain the optimal parameter combination. The joint optimization objective function The calculation formula is: ; in, This represents the average accuracy of the top 5 predicted root causes. This represents the mean sorted in descending order. This indicates whether the first 5 results hit the true root cause. This indicates whether at least one true root cause is found in the set of multiple root causes. This indicates the proportion of false alarms occurring on normal validation samples. These are the weighting coefficients for the corresponding indicators; The optimal parameter combination is:

[0044] in, θ The set of parameters to be optimized This represents the set of simulated attack verification samples constructed from the normal verification set.

[0045] S4. Using a global directed cause-effect graph and optimal parameter combination, perform abnormal root cause localization on the test samples, and output the candidate root cause ranking results, multi-root cause set localization results, and root cause propagation path results from abnormal nodes.

[0046] The specific steps of step S4 include: S41. Based on the parent node relationship and corresponding time delay and edge weight in the global directed causal graph, calculate the causal prediction value and abnormal residual for each variable in the test sample, construct the abnormal residual matrix, identify abnormal variables according to the abnormal residual threshold, and extract the abnormal node set in the attack fragment as the abnormal node set to be explained. If the abnormal residual of a certain variable at time t is greater than a preset threshold, then the variable is considered to be abnormal at that time.

[0047]

[0048] Based on this, for each attack segment, the set of variable nodes that exhibit abnormalities is extracted as the set of abnormal nodes to be explained.

[0049] S42. Based on the causal path enumeration method, obtain all feasible propagation paths between candidate root cause nodes and anomalous nodes, calculate the path propagation strength for each propagation path, and aggregate the propagation strengths of all feasible paths to obtain the total propagation explanatory power of candidate root cause nodes to anomalous nodes. The specific steps of step S42 are as follows: S421. Let the candidate root cause node be r, the anomalous node be v, and the propagation path from r to v be P. Then the formula for calculating the propagation strength S(P) of this path is: ; in, Indicates the upper edge of the path The causal weights, where k represents the path length. The path length decay coefficient is represented by Δt, which represents the actual observation time difference between the root cause node and the target anomaly node. This represents the cumulative theoretical time delay along the path. and These represent the time decay coefficient and the time consistency penalty coefficient, respectively. S422. Define the formula for calculating the total propagation explanatory power S(r→v) of candidate root cause node r to anomalous node v as follows: ; in, This represents the set of feasible propagation paths from r to v; S423. Summarize the total propagation explanation ability of candidate node r for all abnormal nodes to obtain the propagation term Prop(r).

[0050] The propagation term Prop(r) is used for subsequent comprehensive score calculation; by using the path integral propagation intensity measurement method, the influence of multiple propagation paths is comprehensively considered, which can more accurately characterize the propagation process of anomalies in the dependency structure and effectively distinguish between real propagation paths and accidental related paths.

[0051] S43 combines the node's own anomaly strength, anomaly timing, propagation interpretability, anomaly coverage ratio, backpropagation penalty, and hub node structure penalty to calculate the comprehensive score of the candidate root cause node: ; Where Self(r) represents the anomaly strength of the candidate node itself, Prop(r) is the propagation term, representing the candidate node's ability to explain the propagation of other anomaly nodes, Coverage(r) represents the proportion of anomaly nodes that the candidate node can cover or explain, Time(r) represents how early the anomaly of the candidate node occurs relative to other anomaly nodes, Reverse(r) represents the penalty term for backpropagation from other anomaly nodes to the candidate node, and Hub(r) represents the structural penalty term for the high-level hub nodes in the graph. These are the weight parameters for each scoring item, and they are all included in the optimal parameter combination obtained in step S3. S44, based on a comprehensive score, selects and sorts multiple root cause sets by maximizing an objective function that includes coverage gain and redundancy penalty, and outputs the final candidate root cause ranking results, multiple root cause set location results, and root cause propagation path results from root causes to anomalous nodes.

[0052] In step S44, the objective function is: ; in, This indicates the ability of the root cause set to add new coverage to the set of abnormal nodes. The redundancy caused by repeated interpretations of the same anomalous node by different root cause nodes is represented by β and γ, which represent the coverage gain weight and redundancy penalty weight, respectively, and are both included in the optimal parameter combination obtained in step S3.

[0053] By optimizing the multi-root cause set as described above, we can balance the two objectives of "explaining more abnormal nodes" and "avoiding multiple root causes from repeatedly explaining the same phenomenon" among multiple candidate nodes, thereby obtaining a localization result that is more consistent with the real multi-attack source scenario.

[0054] Finally, the invention outputs the following results on the test sample: 1. The ranking results of candidate root causes for each attack segment; 2. Final root cause set localization results for multi-root cause scenarios; 3. The propagation path from the root cause to the abnormal node.

[0055] By optimizing the multi-root cause set, the anomaly coverage capability and interpretation redundancy of the root cause set are balanced. While maximizing the anomaly interpretation range, duplicate or redundant root cause nodes are avoided in the output, resulting in a localization result that conforms to the real multi-attack source scenario.

[0056] Table 1 shows the anomaly localization results for multivariate time series data, specifically demonstrating the performance comparison between the present invention (CS-SAVRCA) and the existing baseline method (CIRCA) in the multivariate time series anomaly root cause localization task. Compared with the existing technology (CIRCA), the improved causal structure learning, path integral propagation metric, and multi-root cause optimization mechanism of the present invention are more effective, achieving a comprehensive and significant improvement in the ranking quality of root cause localization. In practical applications, users only need to view the first few results to find the root cause of the problem, reducing the troubleshooting cost.

[0057] Table 1. Anomaly localization results in multivariate time series data

[0058] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0059] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization, characterized in that, The method includes the following steps: S1. Preprocess the original normal data of multivariate time series, divide the preprocessed normal data into training subset and validation subset, calculate the mean and standard deviation based on the training subset, and normalize the training subset and validation subset. S2. Based on multi-regime subsequences and structural prior constraints, offline causal modeling is performed on the normalized training subset to construct a global directed causal graph with edge weights and time delay information; S3. Construct simulated perturbation samples containing univariate perturbations and multivariate joint perturbations on the normalized validation subset, and construct a joint optimization objective function by combining it with normal validation samples without injected perturbations. Optimal parameter combination for online anomaly detection and root cause localization is obtained through parameter search optimization. S4. Using a global directed cause-effect graph and optimal parameter combination, perform abnormal root cause localization on the test samples, and output the candidate root cause ranking results, multi-root cause set localization results, and root cause propagation path results from abnormal nodes.

2. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 1, characterized in that, The specific steps of step S2 include: S21. Based on the prior structural information of the target system, divide all variables into multiple stage groups or functional groups, establish the mapping relationship between variables and their respective groups, and construct inter-group constraints so that candidate causal connections are only allowed to be established within the same group or between groups with predefined adjacency relationships. S22. Perform change detection on the training subset data to divide the time series into K statistically stable regime subsequences; The change point detection is used to identify time points in the training subset data where statistical characteristics change significantly, dividing the training subset into K sub-intervals with relatively stable statistical characteristics. ； Each sub-interval corresponds to a regime subsequence: ； Where k = 1, 2, ..., K, Let k be the start time of the kth regime subsequence. This represents the end time of the k-th regime subsequence; S23. On each regime subsequence that meets the minimum length requirement, perform temporal causal learning based on between-group constraints to obtain the causal strength matrix and significance matrix corresponding to each regime subsequence: ； ； in, Let be the causal strength matrix, representing the causal strength of variable i in the k-th regime subsequence. The causal strength of time on variable j at time t; This is a significance matrix, representing the significance level of corresponding causal relationships. ; S24. Based on the effective length, significant edge density, and causal structure consistency of each regime subsequence, the causal strength matrix and significance matrix of each regime subsequence are weighted and fused to obtain the global causal relationship matrix and the global significance matrix. S25. Based on preset causal strength threshold and saliency threshold, select effective causal edges from the global causal relationship matrix, and construct the global directed causal graph by combining edge weight and time delay information.

3. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 2, characterized in that, In step S21, the prior structural information of the target system includes the target system's operating logic, functional division, business processes, module hierarchy, and technological process information. The stage group or functional group corresponds to different processing units, business links, functional modules or process nodes in the system. The inter-group constraints are specifically: ； in, It is the group of variable i. A group is a set if the group containing variable i and the group containing variable j belong to the set. Only when variable i is allowed to be a candidate causal parent node for variable j.

4. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 2, characterized in that, In step S24, the weight w of the k-th regime subsequence k The calculation formula is: ； in, This represents the length of the k-th regime subsequence; This indicates the proportion of significant causal edges in the subsequence of this regime; This indicates the structural consistency between the learning results of this registrar subsequence and other registrar subsequences. Used to measure the degree of overlap between the causal structure learned by the current registrar subsequence and other registrar subsequences; Let be the weighting coefficient, satisfying ; The formula for calculating the global causal relationship matrix is ​​as follows: ； The significance matrix is ​​weighted and fused using the same method as the causality strength matrix to obtain the global significance matrix. .

5. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 2, characterized in that, The specific steps of step S25 include: S251. Based on preset causal strength and significance thresholds, select valid causal edges from the global causal relationship matrix. The selection criteria for valid causal edges are as follows: ； ； in, The threshold for causal strength. The significance threshold; S252. Construct a global directed causal graph with edge weights and time delay information. ; in, V For a set of variable nodes, E The selected set of valid causal edges includes information on the causal strength and hysteresis order of each edge.

6. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 1, characterized in that, The specific steps of step S3 include: S31. Divide the normalized validation subset into multiple validation windows according to the given window length and sliding step size. Inject simulated perturbations into some validation windows to construct simulated perturbation samples, while retaining some validation windows without perturbations as normal validation samples. S32. Based on the global directed causal graph obtained in the offline phase, calculate the causal prediction value for each variable in all validation samples, and use the deviation between the actual observed value and the causal prediction value as the abnormal residual; For the target variable Let its set of parent nodes in the global directed causal graph be . Causal prediction values ​​obtained based on parent node weighted prediction The calculation formula is: ； in, This represents the weight of the causal edge from the parent node to the target node; Indicates the corresponding time delay; The outlier residuals of the target variable are: ； S33. Construct a joint optimization objective function that simultaneously considers root cause ranking accuracy, multi-root cause hit capability, and false alarm rate. Optimize the parameters related to online anomaly detection and root cause localization through a parameter search strategy to obtain the optimal parameter combination. The joint optimization objective function The calculation formula is: ； in, This represents the average accuracy of the top 5 predicted root causes. This represents the mean sorted in descending order. This indicates whether the first 5 results hit the true root cause. This indicates whether at least one true root cause is found in the set of multiple root causes. This indicates the proportion of false alarms occurring on normal validation samples. These are the weighting coefficients for the corresponding indicators; The optimal parameter combination is: in, θ The set of parameters to be optimized This represents the set of simulated attack verification samples constructed from the normal verification set.

7. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 6, characterized in that, In step S31, the simulated disturbance includes univariate disturbance and multivariate joint disturbance; The univariate perturbation includes offset, scaling, drift and jamming forms, used to simulate a single anomaly source scenario; The multivariate joint perturbation involves simultaneously injecting different forms of perturbation into two or more variables in the same verification window to simulate multi-source anomalies or multi-root cause anomalies. The normal validation samples are used to evaluate the false alarm rate corresponding to the parameter settings.

8. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 1, characterized in that, The specific steps of step S4 include: S41. Based on the parent node relationship and corresponding time delay and edge weight in the global directed causal graph, calculate the causal prediction value and abnormal residual for each variable in the test sample, construct the abnormal residual matrix, identify abnormal variables according to the abnormal residual threshold, and extract the abnormal node set in the attack fragment as the abnormal node set to be explained. S42. Based on the causal path enumeration method, obtain all feasible propagation paths between candidate root cause nodes and anomalous nodes, calculate the path propagation strength for each propagation path, and aggregate the propagation strengths of all feasible paths to obtain the total propagation explanatory power of candidate root cause nodes to anomalous nodes. S43 combines the node's own anomaly strength, anomaly timing, propagation interpretability, anomaly coverage ratio, backpropagation penalty, and hub node structure penalty to calculate the comprehensive score of the candidate root cause node: ； Where Self(r) represents the anomaly strength of the candidate node itself, Prop(r) is the propagation term, representing the candidate node's ability to explain the propagation of other anomaly nodes, Coverage(r) represents the proportion of anomaly nodes that the candidate node can cover or explain, Time(r) represents how early the anomaly of the candidate node occurs relative to other anomaly nodes, Reverse(r) represents the penalty term for backpropagation from other anomaly nodes to the candidate node, and Hub(r) represents the structural penalty term for the high-level hub nodes in the graph. These are the weight parameters for each scoring item; S44, based on a comprehensive score, selects and sorts multiple root cause sets by maximizing an objective function that includes coverage gain and redundancy penalty, and outputs the final candidate root cause ranking results, multiple root cause set location results, and root cause propagation path results from root causes to anomalous nodes.

9. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 8, characterized in that, The specific steps of step S42 are as follows: S421. Let the candidate root cause node be r, the anomalous node be v, and the propagation path from r to v be P. Then the formula for calculating the propagation strength S(P) of this path is: ； in, Indicates the upper edge of the path The causal weights, where k represents the path length. The path length decay coefficient is represented by Δt, which represents the actual observation time difference between the root cause node and the target anomaly node. This represents the cumulative theoretical time delay along the path. and These represent the time decay coefficient and the time consistency penalty coefficient, respectively. S422. Define the formula for calculating the total propagation explanatory power S(r→v) of the candidate root cause node r to the anomalous node v as follows: ； in, This represents the set of feasible propagation paths from r to v; S423. Summarize the total propagation explanation ability of candidate node r for all abnormal nodes to obtain the propagation term Prop(r).

10. The multivariate time series anomaly root cause localization method based on causal structure learning and simulated perturbation verification optimization according to claim 8, characterized in that, In step S44, the objective function is: ； in, This indicates the ability of the root cause set to add new coverage to the set of abnormal nodes. This represents the redundancy caused by repeated interpretations of the same anomalous node by different root cause nodes, where β and γ represent the coverage gain weight and redundancy penalty weight, respectively.

Images