Causal diagram recovery and root cause positioning method for cloud-native intelligent operation and maintenance system

Abstract

The application relates to a cause-and-effect diagram recovery and root cause positioning method for a cloud-native intelligent operation and maintenance system. The method comprises the following steps: determining a set of observation variables containing service levels and index levels, configuring the text description and value range thereof, and constructing an observation data set; constructing a natural language scene template for a candidate variable pair, generating a baseline and a single-variable intervention scene, calling a large language model to obtain a numerical prediction, and calculating a side-level causal effect estimation value through multiple contexts. A three-layer interface is constructed according to the value: a soft skeleton weight matrix and a candidate parent set, a multi-task causal effect signature vector and a path type label; the local edge strength is calculated, and the global topology sequence is obtained by summarizing. The above results are injected into a traditional causal structure learning algorithm as a soft constraint, the causal graph adjacency matrix is optimized under the non-loop constraint, the threshold is obtained after thresholding, and the causal directed acyclic graph is obtained. Based on the graph, fault propagation analysis and root cause positioning are realized. The method can quickly realize fault propagation analysis and root cause positioning.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a cause-effect graph recovery and root cause localization method for cloud-native intelligent operation and maintenance systems. Background Technology

[0002] Causal directed acyclic graphs (DAGs) are a core tool for characterizing causal dependencies between variables. Their accurate reconstruction is a crucial prerequisite for root cause analysis (RCA) and fault propagation analysis in cloud-native / microservice AIOps (intelligent operations and maintenance systems). Traditional causal structure learning methods mainly include the PC / FCI series based on conditional independence tests, the GES algorithm based on score search, and NOTEARS-type methods based on continuous optimization. These methods all rely on sufficient observation data and low variable dimensionality, completing the search and construction of the DAG through numerous conditional independence tests or score evaluations, and demonstrating mature application results in scenarios with a good data foundation.

[0003] In the core application domain of cloud-native / microservice AIOps, traditional causal structure learning methods face insurmountable structural contradictions. RCA in microservice systems requires recovering the causal relationships of fault propagation from massive amounts of observable telemetry data (metrics / logs / traces). Its variable system encompasses multiple types of nodes at both the service level (service availability, call relationships, scaling status, etc.) and the metric level (p95 / p99 latency, QPS, error rate, CPU / memory utilization, etc.), with variable dimensions often reaching hundreds or thousands. This leads to a super-exponential growth of the DAG search space, making it prone to getting trapped in local optima even with heuristic search. Conditional independence checks in PC / GES and continuous optimization in NOTEARS both face problems of soaring computational costs and a sharp drop in algorithm stability. Furthermore, microservice systems... The failures in the system are characterized by small sample sizes and rapid distribution drift. The effective observation sample size of a single failure is far smaller than the number of variables, making the statistical power of conditional independence tests insufficient. This easily leads to a large number of false causal edges and missed edges, making it impossible to accurately reconstruct the true path of failure propagation. In addition, the AIOps field has accumulated a massive amount of textual mechanistic knowledge and expert experience, such as architecture diagrams, SRE operation manuals, incident debriefing reports, alarm semantic descriptions, and service dependency documents. However, existing methods only support knowledge injection methods that allow experts to directly provide sets of parent nodes or hard constraint graph structures. They cannot transform such textual knowledge into constraints that can be used by algorithms in a low-cost and structured manner, resulting in a waste of domain knowledge.

[0004] In recent years, large-scale pre-trained large language models (LLMs), with their powerful world knowledge reserves and complex reasoning capabilities, have been explored for applications in assisting causal discovery and AIOps root cause localization tasks. Existing techniques include some approaches that directly query the LLM to determine whether a causal relationship exists between variables and the causal order, and then using this determination as a priori constraint to learn the causal structure. Other research applies LLMs to temporal causal reasoning and semantic enhancement in microservice RCA, attempting to leverage the text understanding capabilities of LLMs to compensate for the shortcomings of traditional methods. However, these solutions all have significant technical shortcomings: First, the output information is limited in dimension, only providing qualitative conclusions such as "whether there is a causal edge" or a rough causal order, failing to quantify the LLM inference results into numerical information such as edge strength and path type that can be used for algorithm optimization, making it difficult to directly connect with the optimization framework of traditional causal structure learning; Second, they lack formal counterfactual semantic support, mostly directly asking "who caused whom," without measuring causal effects through controlled counterfactual intervention in specific application scenarios, resulting in a weak connection with the formal inference framework of structural causal models, and failing to transform textual knowledge such as SRE operation manuals into computable causal effects in AIOps scenarios; Third, they lack a systematic analysis and error propagation control mechanism for LLM response noise. First, the output noise of LLM is easily transmitted directly to DAG structure errors and causal effect estimation errors, resulting in insufficient stability in scenarios with high accuracy requirements, such as microservice faults. Second, existing research on introducing LLM into RCA generally lacks a unified framework for transforming LLM outputs into engineering-ready classical causal learning algorithms, making it impossible to effectively integrate soft constraints and ensuring the interpretability and auditability of the algorithm while improving DAG recovery performance. Third, existing methods can only achieve basic judgments on the presence or absence of causal edges, and cannot distinguish the types of causal paths. In AIOps scenarios, it is difficult to distinguish between shortcut edges caused by shared upstream, monitoring sampling deviations, and cascading alarms and real fault propagation mechanism edges, which can easily lead to misjudgments in root cause localization.

[0005] Meanwhile, it can explain the "causal concept effect" and "order fidelity" theories proposed in the field of machine learning, and verify that the approximation method based on counterfactual difference can be consistent with the real causal effect at the ordering level, providing theoretical support for using LLM to estimate causal effects. However, existing research only focuses on the problem of "explaining a given model", assuming that the task-level causal structure is known, and only estimates the causal effect from concept to output. It does not attempt to recover the causal graph at the variable level from scratch, and cannot meet the requirements of AIOps root cause localization for constructing a complete fault propagation causal graph.

[0006] In summary, there is currently a lack of a systematic method for inferring causal directed acyclic graph structures that can effectively adapt to the needs of cloud-native / microservice AIOps and similar small-sample, high-dimensional, knowledge-intensive domains. It cannot transform the counterfactual reasoning capabilities of LLM and textual domain knowledge into computable and optimizable quantitative causal information, nor has it formed an effective fusion framework between LLM and classic causal structure learning algorithms such as PC / GES / NOTEARS. It is difficult to achieve accurate and interpretable recovery of fault propagation causal graphs while overcoming the limitations of sample size and variable dimensionality, and it cannot meet the core requirements of AIOps root cause localization for auditable and counterfactual inference of causal graphs. Summary of the Invention

[0007] Therefore, it is necessary to provide a cause-effect graph recovery and root cause localization method for cloud-native intelligent operation and maintenance systems that can quickly realize fault propagation analysis and root cause localization, addressing the aforementioned technical problems.

[0008] A cause-effect graph recovery and root cause localization method for cloud-native intelligent operation and maintenance systems, the method comprising: Determine the set of observation variables in the cloud-native / microservice AIOps scenario, configure natural language description fragments and value ranges for each observation variable, and build an observation dataset for the scenario. The observation variables include service-level variables and metric-level variables. For any candidate variable pair, a unified natural language scene template is constructed. Based on the natural language scene template, a baseline scene and an intervention scene with only a single candidate cause variable value change are generated. The pre-trained large language model is called to output the numerical prediction of the target variable in the two scenes respectively. After repeated calculation in multiple contexts, the marginal causal effect estimate is obtained. The marginal causal effect estimate of all candidate variable pairs is used as the input for the subsequent three-layer interface construction. After taking the absolute value of the edge-level causal effect estimate, the soft skeleton weight matrix is ​​obtained by scaling function mapping. Then, based on the preset edge threshold, the candidate parent set of each node is extracted from the soft skeleton weight matrix to complete the construction of the first layer soft skeleton weight matrix interface. Based on the edge-level causal effect estimates, multiple AIOps downstream tasks based on natural language definitions are configured for each variable. The edge-level causal effect estimates of each variable on each downstream task are extracted and concatenated into a vector to obtain the multi-task causal effect signature vector. The construction of the second-layer multi-task causal effect signature vector interface is completed, which is used to identify upstream key variables and causal module structure. Based on the edge-level causal effect estimates, counterfactual experiments on total effect and direct effect are designed to obtain total effect estimates and direct effect estimates. The relative difference ratio between the two is calculated. According to the ratio and the changes in the mediating variable, each candidate edge is assigned a path type label to complete the construction of the third-level path type label interface, which is used to distinguish between mechanism paths, shortcut paths and hybrid paths. The absolute value of the effect of each candidate edge is calculated as the local edge strength based on the edge-level causal effect estimate. The local partial order relationship is summarized by voting or counting to obtain the global topological order estimation result. The soft skeleton weight matrix, candidate parent set, multi-task causal effect signature vector, path type label and global topological order are used as soft constraints and injected into the traditional causal structure learning algorithm. Under the acyclic constraint, the adjacency matrix of the causal graph is jointly optimized to obtain the optimized adjacency matrix. Thresholding is applied to the adjacency matrix to obtain a causal directed acyclic graph in the cloud-native / microservice AIOps scenario. Fault propagation analysis and root cause localization are then performed based on the causal directed acyclic graph in the cloud-native / microservice AIOps scenario.

[0009] The aforementioned causal graph recovery and root cause localization method for cloud-native intelligent operation and maintenance systems firstly establishes a foundation for LLM counterfactual reasoning adapted to AIOps scenarios by determining service-level and indicator-level observation variables and configuring natural language descriptions and value ranges. Simultaneously, the constructed observation dataset retains the real operational characteristics of the system, balancing domain textual knowledge with actual data. Secondly, a unified natural language scenario template is constructed to generate baselines and univariate intervention scenarios. Through LLM numerical prediction and multi-context computation, edge-level causal effect estimates are obtained. This method abandons the existing direct question-and-answer format of LLM, achieving quantitative estimation of causal effects through a variable-pair level counterfactual experiment interface. It extends the causal concept effect to the variable-variable level in AIOps scenarios, resulting in estimates with clear causal meaning that can be directly converted into edge weights and skeleton constraints, solving the problem that LLM output cannot be quantified into algorithmically optimizable values. Secondly, the three-layer interface constructed based on the edge-level causal effect estimation addresses the core technical challenges in the scenario layer by layer: The first layer, the soft skeleton weight matrix and candidate parent set, maps the absolute value of the effect to weights and filters candidate parent nodes, compressing the search space of high-dimensional variables into a sparse set, solving the problems of search space explosion and soaring computational costs caused by high dimensionality; The second layer, the multi-task causal effect signature vector, configures multiple downstream tasks for the AIOps scenario and concatenates the effects into a signature vector, realizing the identification of upstream key variables and causal module clustering, solving the problem of difficulty in locating root causes and distinguishing variable levels under small sample conditions, and also making up for the deficiency of existing methods in being unable to identify upstream core variables; The third layer, the path type label, assigns edge type labels based on the difference ratio between the total effect and the counterfactual experiment of the direct effect, realizing the upgrade from "with or without edges" to "edge type", which can effectively identify shortcut paths formed by shared upstream and monitoring bias in the AIOps scenario, solving the problems of traditional methods being prone to generating false edges and having a high misjudgment rate in root cause location. Furthermore, by estimating the edge-level causal effects, the local edge strength is obtained and summarized into a global topological order, providing a clear order constraint for causal structure learning. Then, the three-layer interface and the global topological order are injected as soft constraints into the traditional causal structure learning algorithm. Under the acyclic constraint, the adjacency matrix is ​​optimized and thresholded to obtain a causal directed acyclic graph. This not only realizes the structured and engineered injection of LLM textual domain knowledge, but also makes up for the problem of insufficient statistical power under small sample conditions. Finally, based on the accurate causal directed acyclic graph, fault propagation analysis and root cause localization are realized, solving the problems of low accuracy of causal graph recovery, uninterpretable results, and inability to meet the requirements of AIOps auditing and counterfactual inference in existing methods. Attached Figure Description

[0010] Figure 1 This is a flowchart illustrating a cause-effect graph recovery and root cause localization method for a cloud-native intelligent operation and maintenance system in one embodiment. Figure 2This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0012] In one embodiment, such as Figure 1 As shown, a cause-effect graph recovery and root cause localization method for cloud-native intelligent operation and maintenance systems is provided, including the following steps: Step 102: Determine the set of observation variables in the cloud-native / microservice AIOps scenario, configure natural language description fragments and value ranges for each observation variable, and construct the observation dataset for the scenario. The observation variables include service-level variables and indicator-level variables.

[0013] The set of observed variables is represented as a random vector: The unknown true cause-effect graph is represented as: The set of nodes is: edge set From directed edge The dataset consists of elements that satisfy the condition that no undirected closed loop exists. The observed dataset is denoted as: ,in For the first Sample.

[0014] The set of observed variables consists of random vectors characterizing the operational state of cloud-native / microservice systems. Service-level variables describe the operational state, lifecycle, and call relationships of microservice instances themselves. Specifically, these can include service availability and health status (e.g., service availability or SLO achievement rate, Kubernetes readiness status, liveness probe results); lifecycle and change event variables (e.g., service or container restart count, Pod's current and expected replica counts, rolling update status); call and dependency variables (e.g., upstream dependent services and downstream calling services list, circuit breaker status, retries per unit time); and resource scheduling and constraint variables (e.g., CPU and memory limits, stress type of the node). Metric-level variables are fine-grained quantitative monitoring metrics, typically from monitoring systems like Prometheus, reflecting service performance and resource usage details. Performance and throughput metrics include 99th and 95th percentile request latency, average latency, requests per second, and QPS for successful and failed requests. Error and exception metrics include error rate, HTTP status code percentage, number of application-layer exceptions thrown, and number of request timeouts. Resource usage metrics include CPU and memory utilization percentages, disk I / O utilization, and network byte transmission / reception rate. Middleware and storage metrics include the number of active and maximum connections in the database connection pool, message queue depth, and consumption latency. These observed variables collectively constitute a complete variable system characterizing the operational status of cloud-native / microservice systems, providing foundational data support for subsequent LLM counterfactual reasoning and causal structure learning.

[0015] The range of values ​​clarifies the effective value boundaries of the variables. The observation dataset is the actual set of observed samples of each variable in this scenario, which serves as the basic data support for subsequent causal structure learning. The output of this step is the set of observed variables labeled with natural language descriptions and value ranges, and the corresponding observation dataset, which serves as the input for constructing counterfactual scenarios.

[0016] Step 104: Construct a unified natural language scene template for any candidate variable pair. Generate a baseline scene and an intervention scene with only a single candidate cause variable value change based on the natural language scene template. Call the pre-trained large language model to output the numerical prediction of the target variable in the two scenes respectively. After repeated calculation in multiple contexts, obtain the marginal causal effect estimate. Use the marginal causal effect estimate of all candidate variable pairs as the input for the subsequent three-layer interface construction.

[0017] Natural language scenario templates are standardized frameworks that transform variable values ​​into text descriptions that large language models can understand. They can incorporate scenario information such as system background, SLO requirements, and call chain relationships in cloud-native / microservice AIOps. The baseline scenario is the original text scenario where variables take reference values, while the intervention scenario is the text scenario where only the value of a single candidate cause variable is changed, and the remaining variables remain unchanged according to a preset strategy or the mediating / confounding variables are locked. By using a pre-trained large language model to make numerical predictions on the two types of scenarios, the difference in variable effects under a single context can be obtained. Repeated calculations in multiple contexts can reduce the noise impact of the large language model output. The edge-level causal effect estimate represents the incremental causal influence of the candidate cause variable on the target variable and is the core quantitative basis for constructing the three-layer interface.

[0018] Step 106: After taking the absolute value of the edge-level causal effect estimate, the soft skeleton weight matrix is ​​obtained by scaling function mapping. Then, based on the preset edge threshold, the candidate parent set of each node is extracted from the soft skeleton weight matrix to complete the construction of the first layer soft skeleton weight matrix interface.

[0019] The absolute value of the estimated edge causal effect reflects the effect strength of the causal edge. The scaling function maps the effect strength to weight values ​​that meet the algorithm optimization requirements. Each element in the soft skeleton weight matrix represents the causal confidence of the corresponding candidate causal edge; the larger the value, the higher the probability that the edge is a substantial causal edge. The preset edge threshold is the criterion for selecting effective causal edges. The candidate parent set extracted based on this threshold can reduce the original size of the edge to the order of magnitude of the edge. The potential edge set is compressed into a sparse set, where The total number of variables; the soft skeleton weight matrix interface is the core link that transforms the counterfactual reasoning results of large language models into soft constraints that can be used by the algorithm, which can effectively reduce the search space and computational cost of subsequent causal structure learning.

[0020] Step 108: Based on the edge-level causal effect estimates, configure multiple AIOps downstream tasks based on natural language definitions for each variable, extract the edge-level causal effect estimates of each variable on each downstream task and concatenate them into a vector to obtain the multi-task causal effect signature vector. This completes the construction of the second-layer multi-task causal effect signature vector interface, which is used to identify upstream key variables and causal module structures.

[0021] Downstream tasks in AIOps encompass various business and operational tasks in cloud-native / microservice scenarios, including user-side experience metric monitoring, business-side transaction metric statistics, and operational-side fault loss assessment. The multi-task causal effect signature vector integrates the causal effect information of a single variable on multiple downstream tasks, serving as a characteristic representation of the causal effect of variables. Upstream key variables typically exhibit significant causal effects across multiple downstream tasks, with their signature vector norms, mean absolute values, and other statistical measures significantly higher than other variables. Furthermore, variables within a causal module exhibit similar causal action patterns on each downstream task, resulting in high levels of Euclidean distance or cosine similarity in their signature vectors. This interface enables the identification of root cause candidates and module clustering at the variable level, providing direct quantitative evidence for root cause localization.

[0022] Step 110: Based on the edge-level causal effect estimates, design counterfactual experiments on the total effect and the direct effect respectively to obtain the total effect estimates and the direct effect estimates. Calculate the relative difference ratio between the two. Assign a path type label to each candidate edge according to the ratio and the changes in the mediating variable, and complete the construction of the third-level path type label interface to distinguish between mechanism paths, shortcut paths, and hybrid paths.

[0023] The total effect counterfactual experiment is a counterfactual experiment that does not restrict the mediating variable and allows the intervention effect of the candidate causal variable to freely propagate through the mediator. The total effect estimate obtained reflects the comprehensive causal effect of the candidate causal variable on the target variable. The direct effect counterfactual experiment is a counterfactual experiment that explicitly locks the mediating variable and some confounding variables and only allows the candidate causal variable to directly act on the target variable. The direct effect estimate obtained reflects the direct causal effect of the candidate causal variable on the target variable. The relative difference ratio between the two quantifies the contribution of the mediating variable to the causal effect. Combining the changes of the mediating variable in the two types of experiments, the types of causal paths can be effectively distinguished. The mechanism path is the real direct causal path, the shortcut path is the spurious causal path formed by factors such as data bias and shared upstream, and the mixed path is the causal path that has both direct and mediating effects. This interface realizes the upgrade from "whether there is a causal edge" to "edge type", which can eliminate spurious causal edges and restore the real fault propagation mechanism.

[0024] Step 112: Calculate the absolute value of the effect of each candidate edge as the local edge strength based on the edge-level causal effect estimate. Summarize the local partial order relationship by voting sorting or counting to obtain the global topological order estimation result.

[0025] Local edge strength reflects the strength of the local causal effect of a single candidate cause variable on the target variable. Based on local edge strength, the causal partial order relationship of each candidate parent variable under the same target node can be obtained. Voting sorting or Borda counting can summarize the local partial order relationship of each node into a global topological order. The global topological order represents the upstream and downstream position of each variable in the causal structure. The smaller the value, the closer the variable is to the upstream of the causal chain, which is an important basis for root cause localization.

[0026] Step 114: The soft skeleton weight matrix, candidate parent set, multi-task causal effect signature vector, path type label, and global topological order are used as soft constraints and injected into the traditional causal structure learning algorithm. Under the acyclic constraint, the adjacency matrix of the causal graph is jointly optimized to obtain the optimized adjacency matrix.

[0027] Traditional causal structure learning algorithms include PC series algorithms based on conditional independence tests, GES algorithms based on score search, and NOTEARS-type methods based on continuous optimization. Each type of algorithm has a mature optimization framework and acyclic constraint strategy. Injecting information such as the soft skeleton weight matrix and candidate parent set obtained from counterfactual reasoning of large language models as soft constraints into the algorithm can transform domain knowledge and textual expert experience into quantitative basis for algorithm optimization, making up for the insufficient statistical power of observation data in small sample and high-dimensional scenarios. Acyclic constraint is the core property of causal directed acyclic graphs. The acyclic constraint function can ensure that the optimized adjacency matrix is ​​free of closed loops. Each element in the adjacency matrix represents whether there is a causal edge between corresponding variables, which is a digital representation of the causal graph.

[0028] Step 116: Threshold the adjacency matrix to obtain a causal directed acyclic graph in the cloud-native / microservice AIOps scenario. Based on the causal directed acyclic graph in the cloud-native / microservice AIOps scenario, implement fault propagation analysis and root cause localization.

[0029] Thresholding is the process of transforming a continuous adjacency matrix into a 0 / 1 discrete adjacency matrix. 0 indicates that there is no causal edge between variables, and 1 indicates that there is a causal edge between variables. The discrete adjacency matrix can be directly transformed into a visualized causal directed acyclic graph, which depicts the real causal dependencies and fault propagation links between variables in cloud-native / microservice systems. Fault propagation analysis based on causal directed acyclic graphs can reconstruct the transmission path of faults from the root cause variable to each influencing variable. Root cause localization can be achieved by identifying the upstream variable in the causal chain and combining multi-task causal effect signature vectors and path type labels.

[0030] The aforementioned method for causal graph recovery and root cause localization in cloud-native intelligent operation and maintenance systems effectively solves the problems of low accuracy in causal graph recovery and high misjudgment rate in root cause localization caused by small sample size, high dimensionality, and knowledge density in cloud-native / microservice AIOps scenarios. It constructs a three-layer interface and injects it as a soft constraint into the traditional causal structure learning algorithm by using a pre-trained large language model as a noisy counterfactual causal expert. It achieves accurate recovery of causal graphs and efficient localization of fault root causes, while ensuring the interpretability and auditability of the results.

[0031] In one embodiment, service-level variables include microservice availability, call relationships, restart status, and scaling status; metric-level variables include p95 / p99 latency, QPS, error rate, CPU utilization, memory utilization, GC frequency, queue length, database connection count, and network RT; fault propagation analysis and root cause localization are implemented based on a causal directed acyclic graph in a cloud-native / microservice AIOps scenario, including: Variables with large multi-task causal effect signature vector norms and consistent effects across tasks are identified as root cause variables. The upstream node in the fault propagation chain is identified as the root cause of the fault. At the same time, shortcut paths in the fault propagation chain are eliminated based on path type labels to restore the true fault mechanism propagation path.

[0032] Specifically, service-level variables are core component attributes of cloud-native / microservice systems, directly reflecting the operational status and relationships of microservices. Indicator-level variables are refined and quantitative monitoring metrics during system operation, capable of representing real-time performance changes. These two types of variables together constitute a complete variable system characterizing the system's operational status, covering full-dimensional monitoring information from the service layer to the indicator layer. In root cause localization, variables with large multi-task causal effect signature vector norms and consistent cross-task effects have global and significant causal effects, serving as the core driving factors for fault occurrence—the root cause variables. Combined with the global topological order of the causal directed acyclic graph, the upstream node in the fault propagation chain is the starting point of the fault, providing direct evidence for determining the root cause. Path type labels can effectively identify shortcut paths formed by shared upstream components, monitoring sampling bias, cascading alarms, etc. After eliminating these false paths, the remaining mechanism paths are the true fault propagation chains, accurately reconstructing the transmission process of the fault from the root cause to each affected node. This implementation method clarifies the scope of the variable system in cloud-native / microservice AIOps scenarios, provides a feasible and quantifiable method for root cause localization and fault propagation analysis, effectively reduces the false positive rate of root cause localization, and improves the accuracy of fault propagation analysis.

[0033] In one embodiment, a baseline scenario and an intervention scenario with only a single candidate causal variable changing are generated based on a natural language scene template. A pre-trained large language model is invoked to output numerical predictions of the target variable in the two scenarios. After repeated calculations across multiple contexts, the marginal causal effect estimate is obtained, including: For any pair of candidate variables Construct a unified scene template and assign values ​​to a set of variables. Rendered as scene text description: For example, "a patient's age, symptoms, and laboratory test results," etc. Regarding variables... Choose two values and The original scene and the intervention scene are constructed in the same context respectively. and ,in, and Only in the The values ​​of each component are different, while the remaining variables remain unchanged according to the preset strategy or lock the intermediate and mixed variables according to the settings. In the In this context, the large language model outputs the target variable in two scenarios respectively. or downstream task output Numerical prediction of target variable in two scenarios The numerical predictions are as follows: ; ; in, This represents the numerical function extracted from the model response after being constrained by prompt words; After repeated computation across multiple contexts, the estimated value of the side-level causal effect is: ; in, For variables i to variable j Empirical estimates of causal effects in the side-level large model. K For the total number of contexts, k For the first k A context, For the first k The target variable output by the large language model in a contextual intervention scenario j Numerical prediction values, For the first k The target variable output by the large language model in a contextual baseline scenario j Numerical predicted values.

[0034] Specifically, this quantity can be understood as the variable within the implicit "world model" of the large language model. When changing from a reference value to an intervention value, The average increment of the task output is an approximation of the true edge-level causal effect. Theoretically, under the condition that counterfactual generation is approximately unbiased, such scores based on output differences can maintain the same order as the true causal effect at the ranking level, thus providing a basis for subsequent order constraints. This implementation provides a standardized calculation method for edge-level causal effect estimates. Through controlled counterfactual intervention and multi-context averaging, it ensures the causal validity and stability of the estimates, realizing the transformation of text inference results from large language models into quantitative causal effect indicators, providing core data support for the construction of the subsequent three-layer interface.

[0035] In one embodiment, the absolute value of the edge-level causal effect estimate is taken and then mapped using a scaling function to obtain the soft skeleton weight matrix. Then, based on a preset edge threshold, a candidate parent set for each node is extracted from the soft skeleton weight matrix, including: After taking the absolute value of the estimates of the marginal causal effects, the soft skeleton weight matrix is ​​obtained by scaling the values ​​using a scaling function: ; in, The scaling function For variables i to variable j Empirical estimates of causal effects in a large-scale side-level model; Based on a preset edge threshold, the candidate parent set for each node is extracted from the soft skeleton weight matrix as follows: ; in, For the preset edge threshold, For nodes The set of candidate parents.

[0036] Specifically, the absolute value is taken for the estimate of the boundary-level causal effect because this method only focuses on the strength of the causal effect rather than its direction, and the scaling function g( The weight matrix is ​​a monotonically increasing function. It can be mapped using identity mapping, logarithmic mapping, or sigmoid mapping, etc. Its function is to map the absolute value of the effect to a weight range that meets the requirements of subsequent algorithm optimization, ensuring the rationality and comparability of the weight values; the soft skeleton weight matrix... for d×d The matrix, where d For the total number of variables, each element Characteristic variables i to variable j The soft skeleton weights of causal edges; larger values ​​indicate that the large language model supports the edge as a substantial causal edge; preset edge thresholds. The threshold values ​​are set based on actual business scenarios and algorithm requirements to filter out candidate edges and nodes with significant causal effects. j candidate parent set For all j A set of candidate causal variables with significant causal effects. A standardized construction method for the soft skeleton weight matrix and candidate parent set is provided. Through scaling function mapping and threshold filtering, the estimated edge-level causal effects are transformed into a sparse candidate parent set, effectively expanding the search space for causal structure learning from... Compression into sparse sets reduces the computational cost of subsequent algorithms, while transforming the counterfactual reasoning results of large language models into soft skeleton constraints that can be injected into engineering.

[0037] In one embodiment, the edge-level causal effect estimates of each variable on each downstream task are extracted and concatenated into a vector to obtain a multi-task causal effect signature vector, including: Extract the edge-level causal effect estimates for each variable across all downstream tasks and concatenate them into a vector to obtain the multi-task causal effect signature vector: ; in, For variables Multi-task causal effect signature vector For variables To the k downstream tasks The estimated value of the marginal causal effect. K This represents the total number of downstream tasks. Key upstream variables are identified based on the norm, mean absolute value, or ordinal statistics of multi-task causal effect signature vectors, and the causal module structure is identified by clustering based on Euclidean distance or cosine similarity between multi-task causal effect signature vectors.

[0038] Specifically, multi-task causal effect signature vector for K A multidimensional vector, with dimensions matching the number of downstream tasks, where each dimension represents an estimate of the marginal causal effect of the corresponding downstream task. This vector fully represents the variables. The causal action pattern of all downstream tasks; the upstream key variable, i.e. the root cause variable, shows a significant causal effect on multiple downstream tasks. Therefore, the norm, mean absolute value and other statistics of its signature vector will be significantly higher than those of other variables. By sorting these statistics, the upstream key variable can be quickly identified; the causal module is a cluster of variables with similar causal action patterns. The causal effect of variables in the same module on each downstream task changes in a consistent trend. Therefore, the Euclidean distance or cosine similarity between their signature vectors is small. By clustering the signature vectors using a clustering algorithm, the structure of the causal module can be identified.

[0039] For the first time in a cloud-native / microservice AIOps scenario, the concept of multi-task causal effect signature vectors is proposed. It provides a standardized construction method and variable identification and module clustering strategies, enabling rapid identification of root cause candidates and clustering of causal modules at the variable level. This provides a quantitative basis for root cause localization and system-level causal structure analysis. At the same time, it transforms the counterfactual reasoning results of large language models into signature vector constraints that can be injected into engineering.

[0040] In one embodiment, to distinguish between the "true mechanism path" and the "shortcut path formed by the model utilizing data bias," this application designed paired total effect experiments and direct effect experiments. In the total effect experiment, the variable... Interventions are allowed to be freely transmitted through mediating variables: only changes in the cue words The relevant description does not impose additional constraints on other relevant variables, allowing the large language model to adjust the description of mediating variables based on its world knowledge. The total effect estimate is , is the variable in the counterfactual experiment of the total effect. i to variable j The estimated causal effect; In direct-effect experiments, the cue words explicitly lock in the descriptions of mediating and some confounding variables, for example, explicitly stating "except for the specified variable, all other conditions remain exactly the same as the baseline," allowing only... Changes occurred; the estimated direct effect value was , as variables in a direct effect counterfactual experiment i to variable j The estimated causal effect; The relative difference ratio between the two is calculated using the following formula: ; in, For variables i to variable j The ratio of the relative difference between the total effect and the direct effect. To prevent small constants with a denominator of zero, This represents the absolute value of the difference between the total effect estimate and the direct effect estimate. The maximum value between the absolute value of the total effect estimate and the small constant ε; Path type label is These correspond to the mechanism path, shortcut path, and hybrid path, respectively.

[0041] Specifically, the rule for determining the path type label is: when When the mediating variable is small and its changes are not significant in both types of experiments, it is labeled as a mechanism path, representing a candidate edge as a true path with direct causal effect; when When the mediating variable is large and changes significantly, the candidate edge mainly functions through the mediating path. If the direct effect and the total effect are unstable in different contexts, they are labeled as shortcut paths, and the candidate edge is a spurious causal path. In other cases, they are labeled as mixed paths, and the candidate edge has both direct and mediating causal effects. This implementation provides a standardized construction and determination method for path type labels, realizing an upgrade from "whether there is a causal edge" to "edge type". It can effectively identify shortcut paths in cloud-native / microservice AIOps scenarios, eliminate spurious causal edges, restore the real fault mechanism propagation path, and transform the counterfactual reasoning results of large language models into path type constraints that can be injected into engineering.

[0042] In one embodiment, the transition from local edge effects to global topological order applies to the same target node. The strength of the side effect can be compared among different candidate parent variables as follows: ; in, For variables i to variable j Local edge strength, For variables i to variable j The absolute value of the marginal causal effect estimate; In most contexts and tasks Then it can be considered that in the world model of the large language model, "variables" Comparison variables More likely "Upstream reasons" for all target nodes. Summarizing this local partial order relation, and using a method similar to voting sorting or Borda counting, the overall topological order estimate is defined as follows: express, For a set of nodes, The total number of variables. The smaller the value, the more likely it is to be a node i The further upstream in the causal structure.

[0043] If a true causal graph exists for evaluation, a topological divergence metric can be defined to measure the consistency between the estimated order and the true direction: ; in This is an indicator function used to count the number of edges where the estimated order violates the true causal direction.

[0044] Specifically, this embodiment provides a standardized calculation method for local edge strength and global topological order, realizing the summarization from local partial order relations to global topological order, providing clear order constraints for causal structure learning, and providing quantitative basis for upstream and downstream positions for root cause localization, effectively improving the accuracy of causal graph recovery and the efficiency of root cause localization.

[0045] In one embodiment, conventional causal structure learning algorithms include PC series algorithms based on conditional independence tests, GES algorithms based on score search, or NOTEARS-type algorithms based on continuous optimization. This is injected as a soft constraint into the classic causal structure learning algorithm. Let the adjacency matrix be: ; in, Indicates the existence of an edge Otherwise, it is zero, and The acyclic constraint must be satisfied.

[0046] When performing joint optimization on the adjacency matrix of a cause-effect graph, the overall score function is defined as: ; in, It is a causal graph adjacency matrix. For the total score function, To score data items, log-likelihood or BIC scoring based on structural equation modeling is used. For the observation dataset, , , These are the weighting coefficients for each soft constraint term. Scoring the edge items, This is the soft skeleton weight matrix. Rate the ordinal items. This is the result of global topological order estimation. Rate the path type item. This is a path type label.

[0047] Specifically, this embodiment proposes to inject the three-layer interface and global topological order obtained by counterfactual reasoning of a large language model as soft constraints into the unified total score function of the traditional causal structure learning algorithm. This realizes the fusion and optimization of observation data with textual domain knowledge and expert experience, effectively solves the problem of insufficient statistical power caused by small samples and high dimensions in cloud-native / microservice AIOps scenarios, and improves the accuracy of causal graph recovery.

[0048] In one embodiment, the edge item score, sequence item score, and path type item score are calculated using the following formulas: ; ; ; in, variables in the adjacency matrix i to variable j The element value, =1 indicates that an edge exists. i → j Otherwise, it is 0; Variables in the soft skeleton weight matrix i to variable j The weight value; The weight function is assigned to the path type, giving reward weights to mechanism paths and penalty or low weights to shortcut paths.

[0049] Specifically, this embodiment provides a standardized calculation method for the scores of each soft constraint item, transforming the soft skeleton weight matrix, global topological order, and path type labels into quantifiable scoring indicators. This realizes the engineering injection of various soft constraints into the traditional causal structure learning algorithm, ensuring the rationality and computability of the optimization objective.

[0050] In one embodiment, when using NOTEARS-type algorithms for joint optimization, the adjacency matrix is ​​guaranteed to be acyclic by the following acyclic constraint function: ; in, For acyclic constraint functions, tr( ) is the trace of the matrix, exp( ) represents matrix exponentiation. For Hadamard's element-wise product, The total number of variables; exist Maximize the total score function under the constraint of 0 This yields an approximately optimal continuous adjacency matrix, which is then thresholded to obtain a 0 / 1 discrete adjacency matrix.

[0051] Specifically, this implementation provides a standardized method for injecting soft constraints into NOTEARS-type continuous optimization algorithms. Through joint optimization of acyclic constraint functions and total score functions, it enables the rapid learning of accurate, acyclic causal graph adjacency matrices in continuous space, effectively improving the optimization efficiency and accuracy of causal graph recovery, while also ensuring compatibility with traditional algorithms.

[0052] In GES-like methods based on score search, when performing "add edge" and "delete edge" operations, the operable edges can be restricted to the candidate parent set, and when selecting edge directions, priority can be given to directions with order compatibility and large skeleton weights, thereby reducing search branches and improving the global score.

[0053] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0054] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 2 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a causal graph recovery and root cause localization method for a cloud-native intelligent operation and maintenance system. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0055] Those skilled in the art will understand that Figure 2The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0056] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0057] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0058] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A cause-effect graph recovery and root cause localization method for cloud-native intelligent operation and maintenance systems, characterized in that, The method includes: Determine the set of observation variables in the cloud-native / microservice AIOps scenario, configure natural language description fragments and value ranges for each observation variable, and construct the observation dataset for the scenario. The observation variables include service-level variables and indicator-level variables. For any candidate variable pair, a unified natural language scene template is constructed. Based on the natural language scene template, a baseline scene and an intervention scene with only a single candidate cause variable value change are generated. The pre-trained large language model is called to output the numerical prediction of the target variable in the two scenes respectively. After repeated calculation in multiple contexts, the marginal causal effect estimate is obtained. The marginal causal effect estimate of all candidate variable pairs is used as the input for the subsequent three-layer interface construction. After taking the absolute value of the estimated edge causal effect, the soft skeleton weight matrix is ​​obtained by scaling function mapping. Then, based on the preset edge threshold, the candidate parent set of each node is extracted from the soft skeleton weight matrix to complete the construction of the first layer soft skeleton weight matrix interface. Based on the estimated edge causal effects, multiple AIOps downstream tasks based on natural language definitions are configured for each variable. The estimated edge causal effects of each variable on each downstream task are extracted and concatenated into a vector to obtain a multi-task causal effect signature vector. The construction of the second-layer multi-task causal effect signature vector interface is completed, which is used to identify upstream key variables and causal module structure. Based on the estimated edge-level causal effects, counterfactual experiments on total effects and direct effects are designed to obtain estimated total effects and estimated direct effects. The relative difference ratio between the two is calculated. Based on the ratio and the changes in the mediating variables, a path type label is assigned to each candidate edge to complete the construction of the third-layer path type label interface, which is used to distinguish between mechanism paths, shortcut paths and hybrid paths. The absolute value of the effect of each candidate edge is calculated as the local edge strength based on the edge-level causal effect estimate. The local partial order relationship is summarized by voting sorting or counting to obtain the global topological order estimation result. The soft skeleton weight matrix, candidate parent set, multi-task causal effect signature vector, path type label, and global topological order are used as soft constraints and injected into the traditional causal structure learning algorithm. Under the acyclic constraint, the causal graph adjacency matrix is ​​jointly optimized to obtain the optimized adjacency matrix. Thresholding is applied to the adjacency matrix to obtain a causal directed acyclic graph in the cloud-native / microservice AIOps scenario. Fault propagation analysis and root cause localization are then performed based on the causal directed acyclic graph in the cloud-native / microservice AIOps scenario.

2. The method according to claim 1, characterized in that, The service-level variables include microservice availability, call relationships, restart status, and scaling status; the metric-level variables include p95 / p99 latency, QPS, error rate, CPU utilization, memory utilization, GC frequency, queue length, database connection count, and network RT. Based on the causal directed acyclic graph in the cloud-native / microservice AIOps scenario, fault propagation analysis and root cause localization are implemented, including: Variables with large multi-task causal effect signature vector norms and consistent effects across tasks are identified as root cause variables. The upstream node in the fault propagation chain is identified as the root cause of the fault. At the same time, shortcut paths in the fault propagation chain are eliminated based on path type labels to restore the true fault mechanism propagation path.

3. The method according to claim 1, characterized in that, Based on the natural language scene template, a baseline scene and an intervention scene with only a single candidate cause variable changing are generated. A pre-trained large language model is invoked to output numerical predictions of the target variable in both scenes. After repeated calculations across multiple contexts, the marginal causal effect estimates are obtained, including: For variables Choose two values and The original scene and the intervention scene are constructed in the same context respectively. and ,in, and Only in the The values ​​of each component are different, while the remaining variables remain unchanged according to the preset strategy or lock the intermediate and mixed variables according to the settings. In the In this context, the large language model outputs the target variable in two scenarios respectively. or downstream task output Numerical prediction of target variable in two scenarios The numerical predictions are as follows: in, This represents the numerical function extracted from the model response after being constrained by prompt words; After repeated computation across multiple contexts, the estimated value of the side-level causal effect is: in, For variables i to variable j Empirical estimates of causal effects in the side-level large model. K For the total number of contexts, k For the first k A context, For the first k The target variable output by the large language model in a contextual intervention scenario j Numerical prediction values, For the first k The target variable output by the large language model in a contextual baseline scenario j Numerical predicted values.

4. The method according to claim 1, characterized in that, After taking the absolute value of the estimated edge-level causal effects, a soft skeleton weight matrix is ​​obtained through scaling function mapping. Then, based on a preset edge threshold, a candidate parent set for each node is extracted from the soft skeleton weight matrix, including: The soft skeleton weight matrix is ​​obtained by taking the absolute value of the estimated edge causal effects and mapping it through a scaling function: in, The scaling function For variables i to variable j Empirical estimates of causal effects in a large-scale side-level model; Based on a preset edge threshold, the candidate parent set for each node is extracted from the soft skeleton weight matrix as follows: in, For the preset edge threshold, For nodes The set of candidate parents.

5. The method according to claim 1, characterized in that, Extract the edge-level causal effect estimates for each variable across all downstream tasks and concatenate them into a vector to obtain the multi-task causal effect signature vector, including: Extract the edge-level causal effect estimates for each variable across all downstream tasks and concatenate them into a vector to obtain the multi-task causal effect signature vector: in, For variables Multi-task causal effect signature vector For variables To the k downstream tasks The estimated value of the marginal causal effect. K This represents the total number of downstream tasks. Upstream key variables are identified based on the norm, mean absolute value, or ranking statistics of the multi-task causal effect signature vectors, and the causal module structure is identified by clustering based on the Euclidean distance or cosine similarity between the multi-task causal effect signature vectors.

6. The method according to claim 1, characterized in that, The estimated total effect value is , is the variable in the counterfactual experiment of the total effect. i to variable j The causal effect estimate; the direct effect estimate. , as variables in a direct effect counterfactual experiment i to variable j The estimated causal effect; The relative difference ratio between the two is calculated using the following formula: in, For variables i to variable j The ratio of the relative difference between the total effect and the direct effect. To prevent small constants with a denominator of zero, This represents the absolute value of the difference between the total effect estimate and the direct effect estimate. The maximum value between the absolute value of the total effect estimate and the small constant ε; The path type label is These correspond to the mechanism path, shortcut path, and hybrid path, respectively.

7. The method according to claim 1, characterized in that, The local edge strength is: in, For variables i to variable j Local edge strength, For variables i to variable j The absolute value of the marginal causal effect estimate; The global topology order estimation result is obtained through express, For a set of nodes, The total number of variables. The smaller the value, the more likely it is to be a node i The further upstream in the causal structure.

8. The method according to claim 1, characterized in that, The traditional causal structure learning algorithms include PC series algorithms based on conditional independence test, GES algorithm based on score search, or NOTEARS class algorithms based on continuous optimization. When performing joint optimization on the adjacency matrix of a cause-effect graph, the overall score function is defined as: in, It is a causal graph adjacency matrix. For the total score function, To score data items, log-likelihood or BIC scoring based on structural equation modeling is used. For the observation dataset, , , These are the weighting coefficients for each soft constraint term. Scoring the edge items, This is the soft skeleton weight matrix. Rate the ordinal items. This is the result of global topological order estimation. Rate the path type item. This is a path type label.

9. The method according to claim 8, characterized in that, The edge item score, sequence item score, and path type item score are calculated using the following formulas: in, variables in the adjacency matrix i to variable j The element value, =1 indicates that an edge exists. i → j Otherwise, it is 0; Variables in the soft skeleton weight matrix i to variable j The weight value; The weight function is assigned to the path type, giving reward weights to mechanism paths and penalty or low weights to shortcut paths.

10. The method according to claim 8, characterized in that, When using NOTEARS-type algorithms for joint optimization, the adjacency matrix is ​​guaranteed to be acyclic through the following acyclic constraint function: in, For acyclic constraint functions, tr( ) is the trace of the matrix, exp( ) represents matrix exponentiation. For Hadamard's element-wise product, The total number of variables; exist Maximize the total score function under the constraint of 0 This yields an approximately optimal continuous adjacency matrix, which is then thresholded to obtain a 0 / 1 discrete adjacency matrix.

Images