Network card fault diagnosis method and electronic equipment

Abstract

The application discloses a network card fault diagnosis method and electronic equipment, and relates to the technical field of servers, wherein through fusion of multi-dimensional network cards and environment data, a diagnosis engine combining a multi-layer long short-term memory network and a variational autoencoder is used for deep feature analysis and anomaly detection, and root cause positioning is realized through a knowledge graph; an end-to-end diagnosis closed loop from data perception, intelligent analysis to knowledge reasoning is constructed; through introduction of the diagnosis engine combining the multi-layer long short-term memory network encoder and the variational autoencoder, the representation and anomaly detection capability for complex and time-series fault modes are significantly improved; the disadvantage of insufficient flexibility of a traditional threshold method is overcome; in combination with semantic association of the knowledge graph, the automation and precision level of network card fault diagnosis is improved, and the false alarm rate is reduced.

Description

Technical Field

[0001] This application relates to the field of server technology, and in particular to a network card fault diagnosis method and electronic device. Background Technology

[0002] With the development of cloud computing and big data technologies, server network performance has become a core element in ensuring business continuity. As the physical connection between the server and the network, the network interface card (NIC) directly affects data transmission efficiency, service response speed, and overall system reliability. When a NIC fails, it impacts the server's network performance. Current NIC fault diagnosis methods require manual detection and location by maintenance personnel. However, these methods rely on human experience and fixed fault thresholds during manual fault location, leading to a higher false alarm rate. Summary of the Invention

[0003] This application provides a network card fault diagnosis method and electronic device to at least solve the problem of increased false alarm rate in related technologies.

[0004] This application provides a method for diagnosing network interface card (NIC) faults, including:

[0005] Obtain network interface card (NIC) data and environmental status data from multiple dimensions.

[0006] Data processing is performed on network interface card data and environmental status data from multiple dimensions to obtain a multidimensional feature matrix.

[0007] The multidimensional feature matrix is ​​input into the network card diagnostic engine to generate fault feature analysis results in multiple dimensions. The network card diagnostic engine is a diagnostic engine that combines a multilayer long short-time memory network encoder and a variational autoencoder.

[0008] The network interface card's (NIC) anomaly score and fault threshold are calculated based on the fault feature analysis results from multiple dimensions.

[0009] The network card faults are classified according to the network card's anomaly score and fault threshold, and the fault classification results are generated.

[0010] The severity of network card (NIC) faults is assessed based on the fault classification results, and NIC fault assessment information is generated.

[0011] Based on the network card fault assessment information, the knowledge graph is traversed to generate network card fault diagnosis results.

[0012] This application also provides a network card fault diagnosis device, including:

[0013] The first acquisition module is used to acquire network card data and environmental status data from multiple dimensions.

[0014] The data processing module is used to process network card data and environmental status data from multiple dimensions to obtain a multidimensional feature matrix.

[0015] The first generation module is used to input the multi-dimensional feature matrix into the network card diagnostic engine to generate fault feature analysis results in multiple dimensions. The network card diagnostic engine is a diagnostic engine that combines a multi-layer long short-time memory network encoder and a variational autoencoder.

[0016] The calculation module is used to calculate the network card's anomaly score and fault threshold based on the fault feature analysis results from multiple dimensions.

[0017] The fault classification module is used to classify network card faults based on the network card's anomaly score and fault threshold, and generate fault classification results.

[0018] The assessment module is used to assess the severity of network card faults based on the fault classification results and generate network card fault assessment information.

[0019] The second generation module is used to traverse the knowledge graph based on the network card fault assessment information and generate network card fault diagnosis results.

[0020] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described network card fault diagnosis methods.

[0021] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described network card fault diagnosis methods.

[0022] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described network card fault diagnosis methods.

[0023] This application constructs an end-to-end diagnostic closed loop from data perception and intelligent analysis to knowledge reasoning by integrating multi-dimensional network interface card (NIC) and environmental data, utilizing a diagnostic engine combining a multi-layer long short-term memory (LSTM) network and a variational autoencoder (VAE) for deep feature analysis and anomaly detection, and achieving root cause localization through a knowledge graph. By introducing a diagnostic engine combining a multi-layer LSTM network encoder and a variational autoencoder, the application significantly improves the representation and anomaly detection capabilities for complex, temporal fault modes, overcoming the shortcomings of traditional threshold methods in terms of flexibility. Combined with the semantic association of the knowledge graph, the application enhances the automation and accuracy of NIC fault diagnosis and reduces the false alarm rate. Attached Figure Description

[0024] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the system structure of a computer device provided in an embodiment of this application;

[0026] Figure 2 A flowchart illustrating the network card fault diagnosis method provided in this application embodiment. Figure 1 ;

[0027] Figure 3 A flowchart illustrating the network card fault diagnosis method provided in this application embodiment. Figure 2 ;

[0028] Figure 4 A flowchart illustrating the network card fault diagnosis method provided in this application embodiment. Figure 3 ;

[0029] Figure 5 This is a schematic diagram of the network card fault diagnosis device provided in the embodiments of this application;

[0030] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0032] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0033] To address the issue of increased false alarm rates in related technologies, this application proposes the following technical concept: The inventors considered acquiring multi-dimensional network interface card (NIC) data and environmental status data, and combined a long short-term memory (LSTM) network with a variational autoencoder (VAE). They utilized a diagnostic engine combining a multi-layer LSTM network and a VAE to perform deep feature analysis and anomaly detection, and used a knowledge graph to achieve root cause localization, generating NIC fault diagnosis results. This improved the characterization and anomaly detection capabilities for complex, sequential fault modes, thereby reducing the false alarm rate.

[0034] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] The specific application environment architecture or specific hardware architecture on which the network card fault diagnosis method depends is described here.

[0036] refer to Figure 1 , Figure 1 This is a schematic diagram of the system architecture of the computer device provided in an embodiment of this application. Figure 1 As shown, the computer device includes: a receiving device 101, a processing device 102, and a display device 103.

[0037] It is understood that the structure illustrated in the embodiments of this application does not constitute a specific limitation on the network card fault diagnosis method. In other feasible embodiments of this application, the above architecture may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown can be implemented in hardware, software, or a combination of both.

[0038] In the specific implementation process, the receiving device 101 can be an input / output interface or a communication interface, and can acquire network card data and environmental status data in multiple dimensions.

[0039] The processing device 102 can generate network card fault diagnosis results.

[0040] The display device 103 can be used to display the above-mentioned network card fault diagnosis results, etc.

[0041] The display device can also be a touch screen, used to receive user commands while displaying the above content, so as to realize the operation interaction with the user.

[0042] It should be understood that the above-mentioned processing device can be implemented by a processor reading instructions from memory and executing those instructions, or it can be implemented by a chip circuit.

[0043] Furthermore, the network architecture and business scenarios described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0044] Figure 2 A flowchart illustrating the network card fault diagnosis method provided in this application embodiment. Figure 1 ,like Figure 2 As shown, embodiments of this application provide a network card fault diagnosis method, which is described in detail below:

[0045] S201: Obtain network interface card data and environmental status data from multiple dimensions.

[0046] In this embodiment, the acquired data from multiple dimensions includes hardware layer data, driver layer data, system layer data, network layer data, and virtualization layer data.

[0047] The hardware layer collects data according to the set acquisition frequency and sets it to the highest priority. The data collected by the hardware layer includes, but is not limited to, physical layer data, PCIe (Peripheral Component Interconnect Express) bus data, and sensor data.

[0048] Physical layer data includes, but is not limited to, bit error rate, signal-to-noise ratio, link negotiation speed, duplex mode, and auto-negotiation status.

[0049] PCIe bus data includes, but is not limited to, link width, link speed, correctable error count, uncorrectable error count, and PCIe bandwidth utilization.

[0050] Sensor data includes, but is not limited to, core temperature, supply voltage, power consumption, temperature change rate, and voltage stability.

[0051] The driver layer collects data based on the frequency of event-driven and periodic sampling, and is set to medium priority. The data collected by the driver layer includes, but is not limited to, NAPI (New API Scheduling Event) scheduling event data and DMA (Direct Memory Access) and memory data.

[0052] NAPI scheduling event data includes, but is not limited to, NAPI scheduling frequency, average polling time, number of packets handled per interrupt, soft interrupt latency, and backlog queue length.

[0053] DMA and memory data include, but are not limited to, DMA mapping failure rate, SKB (Socket Kernel Buffer) allocation latency, memory fragmentation rate, OOM (Out Of Memory) event count, and cache hit rate.

[0054] The system layer collects data according to the set collection frequency, which is set to medium priority. The data collected by the system layer includes, but is not limited to, CPU and interrupt data and memory and load data.

[0055] CPU and interrupt data include, but are not limited to: interrupt handling CPU usage, interrupt merging efficiency, interrupt latency, context switching frequency, and kernel lock wait time.

[0056] Memory and load data include, but are not limited to, driver memory usage, system load, and page reclamation frequency.

[0057] The network environment data layer collects data via API according to the set collection frequency, which is set to medium priority. The collected data includes, but is not limited to, link status and protocol characteristics.

[0058] Link status includes, but is not limited to, peer port status, link utilization, queue drop rate, CRC (Cyclic Redundancy Check) error synchronization, and QoS (Quality of Service) policy activation flags.

[0059] Protocol characteristics include, but are not limited to, TCP (Transmission Control Protocol) retransmission rate and RTT (Round-Trip Time) jitter coefficient.

[0060] The virtualization state layer collects data based on event-driven polling and a set polling frequency, set to low priority, and collects virtualization state data.

[0061] Virtualization status data includes, but is not limited to, VM (Virtual Machine) migration status, VXLAN tunnel status, VXLAN (Virtual Extensible LAN Tunnel Status) encapsulation overhead, SR-IOV (Single Root I / O Virtualization), VF (Virtual Function) performance isolation, and virtual queue scheduling fairness.

[0062] S202: Perform data processing on network card data and environmental status data from multiple dimensions to obtain a multidimensional feature matrix.

[0063] Specifically, the network card data and environmental status data of multiple dimensions are time-aligned, the time-aligned data are divided into windows using a window segmentation algorithm, data cleaning and normalization operations are performed, and the standardized data is mapped to the feature space to obtain a multi-dimensional feature matrix.

[0064] S203: Input the multi-dimensional feature matrix into the network card diagnostic engine to generate multi-dimensional fault feature analysis results. The network card diagnostic engine is a diagnostic engine that combines a multi-layer long short-time memory network encoder and a variational autoencoder.

[0065] Specifically, the network card diagnostic engine uses a multi-layer long short-term memory network encoder to extract temporal features from the multi-dimensional feature matrix, performs probability distribution parameterization on the abstract features, samples the mean vector and standard deviation vector, and uses a multi-layer long short-term memory network decoder to perform temporal reconstruction on the spatial vector. The weighted reconstruction error between the reconstructed spatial feature matrix and the multi-dimensional feature matrix is ​​calculated to generate fault feature analysis results in multiple dimensions.

[0066] S204: Calculate the network card's anomaly score and fault threshold based on the fault feature analysis results from multiple dimensions.

[0067] Specifically, based on the weighted reconstruction error in the fault feature analysis results of multiple dimensions, the abnormal scores at multiple time points are calculated. The abnormal score sequence is smoothed using an exponentially weighted moving average. Based on the preset false alarm rate tolerance, the parameters of the threshold baseline are adjusted according to the spatial vector and business time period information in the fault feature analysis results of multiple dimensions, and a fault threshold is generated.

[0068] S205: Classify network card faults based on the network card's anomaly score and fault threshold, and generate fault classification results.

[0069] Specifically, based on the network card's abnormal score and fault threshold time period information, the reconstruction error of multiple features within the time period information is aggregated. The error contribution of multiple features is calculated based on the total error of multiple features in the abnormal time period. Based on the preset feature grouping rules and contribution distribution information, feature groups with contribution exceeding the preset threshold are identified, and fault classification results are generated.

[0070] S206: Based on the fault classification results, assess the severity of network card faults and generate network card fault assessment information.

[0071] Specifically, multiple feature data and historical data of the abnormal period are extracted based on the fault classification results. The scores of multiple fault severity scoring items are calculated based on the anomaly assessment basic data. The scores of multiple fault severity scoring items are weighted and calculated to generate a comprehensive severity score of the network card fault. Network card fault assessment information is generated based on the comprehensive severity score and severity level of the network card fault.

[0072] S207: Traverse the knowledge graph based on the network card fault assessment information to generate network card fault diagnosis results.

[0073] Specifically, network card fault assessment information is input into a preset knowledge graph. Starting from an event node, the knowledge graph is traversed according to the connection relationships in the knowledge graph. Propagation chain analysis is performed based on the list of fault source nodes and the performance and alarm events in the knowledge graph. Based on the root cause information of the network card fault, the associated nodes in the knowledge graph are traversed to generate network card fault diagnosis results.

[0074] As can be seen from the above embodiments, by fusing multi-dimensional network interface card (NIC) and environmental data, utilizing a diagnostic engine combining a multi-layer long short-term memory (LSTM) network and a variational autoencoder (VAE) for deep feature analysis and anomaly detection, and achieving root cause localization through a knowledge graph, this application constructs an end-to-end diagnostic closed loop from data perception and intelligent analysis to knowledge reasoning. By introducing a diagnostic engine combining a multi-layer LSTM network encoder and a variational autoencoder, the ability to represent complex, temporal fault modes and detect anomalies is significantly improved, overcoming the shortcomings of insufficient flexibility in traditional threshold methods. Combined with the semantic association of the knowledge graph, the automation and accuracy of NIC fault diagnosis are improved, and the false alarm rate is reduced.

[0075] In one embodiment of this application, step S203 includes:

[0076] S203a: The network card diagnostic engine uses a multi-layer long short-term memory network encoder to extract temporal features from the multi-dimensional feature matrix and generate abstract features.

[0077] For example, the temporal dimension T of the feature matrix is ​​set to 300 time points (5 minutes × 60 seconds) based on a 1-second sampling rate, forming a 300 × 45 matrix, with each time point containing 45 feature state snapshots of the network card at that moment.

[0078] In this embodiment, the network interface card (NIC) diagnostic engine is a diagnostic engine that combines a multilayer long short-time memory network encoder and a variational autoencoder.

[0079] In this embodiment, the encoder of the network card diagnostic engine adopts a cascaded design of a three-layer long short-term memory network.

[0080] The first layer, the Long Short-Term Memory (LSTM) network, consists of 128 units and inputs a feature vector with 45 dimensions. It is used to capture the short-term dependencies and instantaneous interaction patterns between the network interface card (NIC) features.

[0081] The second-layer encoded long short-term memory network consists of 64 units, which receive the 128-dimensional hidden states output from the first layer and are used to learn the mid-term evolution patterns and trend characteristics of the network card state.

[0082] The third-layer coding long short-term memory network consists of 32 units, which receive the 64-dimensional hidden state output from the second layer and are used to extract high-level abstract features and essential laws of the network card's operating state.

[0083] In this embodiment, the output of the variational autoencoder includes 16 dimensions.

[0084] For example, dimensions 1 to 4 represent hardware health; dimensions 5 to 8 represent performance efficiency; dimensions 9 to 12 represent environmental adaptability; and dimensions 13 to 16 represent abnormal modes.

[0085] In this embodiment, the decoder adopts a three-layer long short-term memory network structure that is symmetrical to the encoder.

[0086] The first layer of the decoding long short-term memory network consists of 32 units. The input is a sequence that is repeatedly expanded from a 16-dimensional latent vector to 300 time steps, which is used to initially unfold the abstract latent features into a temporal pattern skeleton.

[0087] The second-layer decoding long short-term memory network comprises 64 units, which are used to enrich the timing details and reconstruct the mid-term evolution trajectory of the network card state.

[0088] The third layer of the decoding long short-term memory network consists of 128 units, which are used to reconstruct the original 45-dimensional feature sequence.

[0089] S203b: Perform probability distribution parameterization on abstract features to generate mean vector and standard deviation vector.

[0090] Specifically, the abstract feature vector output by the encoder is fed into a parallel fully connected layer, which outputs the mean vector and standard deviation vector of the latent space.

[0091] S203c: Samples the mean vector and standard deviation vector to generate a space vector.

[0092] Specifically, a reparameterization technique is used to randomly sample from a defined Gaussian distribution to generate a random noise vector with the same dimension as the mean vector, and a space vector is calculated based on the random noise vector.

[0093] S203d: The network card diagnostic engine uses a multi-layer long short-term memory network decoder to perform temporal reconstruction processing on spatial vectors and generate a reconstructed spatial feature matrix.

[0094] Specifically, the decoder calculates the reconstruction differences of 45 features at each time point, forming a 300×45 error matrix.

[0095] S203e: Calculate the weighted reconstruction error between the reconstructed spatial feature matrix and the multidimensional feature matrix, and generate fault feature analysis results in multiple dimensions.

[0096] In this embodiment, different features have different levels of importance, and weights are set according to their importance.

[0097] Specifically, the element-wise error between the reconstructed spatial feature matrix and the original multidimensional feature matrix within each time window is calculated, and a weight vector is introduced for weighted calculation to generate multidimensional fault feature analysis results.

[0098] As can be seen from the above embodiments, the temporal abstract features are extracted by the Long Short-Term Memory (LSTM) network encoder, the variational autoencoder performs probabilistic modeling and sampling, and then the LSM network decoder reconstructs the data. The weighted reconstruction error is used as the fault analysis result. The temporal modeling capability is combined with the latent space learning capability of the deep generative model. The LSM network is good at capturing time dependencies, and the latent space performance of the variational autoencoder learns the inherent probability distribution of the data. The combination of the two enables the model to not only detect anomalies, but also to analyze the high-dimensional feature change patterns that lead to anomalies, providing richer fault feature information.

[0099] In one embodiment of this application, step S205 includes:

[0100] S205a: Determine abnormal time period information based on the network card's abnormal score and fault threshold.

[0101] Specifically, multiple abnormal scores are compared with fault thresholds, and the start and end time points are determined based on the network card data that exceeds the fault threshold. The abnormal time period information is then determined based on the start and end time points.

[0102] S205b: Calculate the reconstruction error of multiple features based on multiple time points in the abnormal period information, and generate the total error of multiple features in the abnormal period.

[0103] In this embodiment, the formula for calculating the total error during abnormal periods is:

[0104]

[0105] In the formula, This represents the characteristic error at each time point; Indicates the start time of the abnormal period; Indicates the end time of the abnormal period.

[0106] S205c: Calculate the error contribution of multiple features based on the total error of multiple features during the abnormal period, and generate contribution distribution information.

[0107] In this embodiment, the contribution rate is the proportion of the reconstruction error of a certain feature in the total reconstruction error within a specific time window.

[0108] For example, taking a 5-minute anomaly as an example, the method for calculating the contribution of feature i is as follows:

[0109] The characteristic error at each time point is calculated using the following formula: For each time point t (t=1,2,…,300), the characteristic error at each time point is calculated as follows:

[0110]

[0111] In the formula, Represents eigenvalues The weights; Represents eigenvalues The reconstructed value.

[0112] Accumulate the total error during the period of an anomaly, when the anomaly occurs within the time window. When the time period is abnormal, the total error is:

[0113]

[0114] In the formula, This represents the total error during the abnormal period; Indicates the start time of the abnormal period; Indicates the end time of the abnormal period; This represents the characteristic error at each time point.

[0115] Calculate the total error for all features:

[0116]

[0117] In the formula, This represents the total error of all features; j represents the number of features. This represents the j-th feature.

[0118] S205d: Divide multiple features into feature groups according to preset feature grouping rules and contribution distribution information, and calculate the contribution of multiple feature groups.

[0119] In this embodiment, the formula for calculating the percentage of contribution is:

[0120]

[0121] In the formula, This represents the percentage of contribution of feature i; This represents the total error across all features; This represents the total error during the abnormal period.

[0122] S205e: Identify feature groups whose contribution exceeds a preset threshold based on the contribution of multiple feature groups, and generate fault classification results.

[0123] In this embodiment, the fault classification results include, but are not limited to, hardware layer faults, driver layer faults, configuration layer faults, protocol layer faults, and mixed faults.

[0124] Among them, when the contribution of features 1 to 15 is greater than 50%, it is a hardware layer fault. Hardware layer faults include, but are not limited to, temperature-related anomalies (sustained high temperature, abnormal temperature gradient), PCIe link anomalies (width degradation, surge in error count), and physical layer problems (increased bit error rate, decreased signal quality).

[0125] Among them, when the contribution of features 16 to 25 is greater than 50%, it is a driver layer fault. Driver layer faults include, but are not limited to, memory management anomalies (leakage trend, allocation failure), interrupt handling anomalies (storm mode, increased latency), and DMA transfer anomalies (decrease in efficiency, increased timeouts).

[0126] Specifically, when features 34 to 40 contribute more than 50%, it indicates a configuration layer fault, which includes, but is not limited to, packet fragmentation anomalies, priority confusion, and isolation failure. When features 26 to 33 contribute more than 50%, it indicates a protocol layer fault, which includes, but is not limited to, increased retransmission rate, frequent zero-window events, establishment failures, and increased resets.

[0127] Among them, when the contribution of features 41 to 45 is greater than 50%, it is a mixed fault.

[0128] As can be seen from the above embodiments, by aggregating the reconstruction errors of each feature within the abnormal period and calculating the contribution, the main abnormal feature groups can be identified, and the abnormality can be located on the specific feature dimension or feature group that caused the abnormality. This improves the accuracy and operability of fault classification and provides an accurate direction for fault repair.

[0129] In one embodiment of this application, step S206 includes:

[0130] S206a: Extract multiple feature data and historical data for abnormal periods based on the fault classification results to generate basic data for anomaly assessment.

[0131] In this embodiment, the dimensions of severity assessment include, but are not limited to, peak anomaly, duration coefficient, feature impact breadth, and historical recurrence frequency.

[0132] S206b: Calculate scores for multiple fault severity rating items based on anomaly assessment baseline data.

[0133] In this embodiment, the formula for calculating peak anomaly is:

[0134]

[0135] In the formula, Indicates the start time; Indicates the end time; This represents the weighted sum of reconstruction errors.

[0136] Among these steps, the peak outlier needs to be standardized to a score between 0 and 10. The standardization formula is as follows:

[0137]

[0138] In this embodiment, the steps for calculating the duration coefficient are as follows:

[0139] Step 1, calculate the duration of the anomaly:

[0140]

[0141] In the formula, Indicates the duration of the anomaly; Indicates the start time; Indicates the end time.

[0142] Step 2, Logarithmic transformation:

[0143]

[0144] In the formula, Indicates the duration of the anomaly.

[0145] Step 3: Normalize to 0 to 10 minutes. For example, if the shortest anomaly is 0.1 minutes and the longest anomaly is 120 minutes, then the normalization formula is:

[0146]

[0147] In the formula, Indicates the duration of the anomaly.

[0148] In this embodiment, the breadth of feature impact reflects the “systematic” nature of the fault, including single-feature anomalies and multi-feature anomalies.

[0149] The algorithm for determining abnormal features is as follows:

[0150] For each feature i, in the anomaly window Inside:

[0151] Step 1, the instantaneous standardized error of feature i at each time point t is:

[0152]

[0153] In the formula, Represents eigenvalues The weights; Represents eigenvalues The reconstructed value; It represents the standard deviation.

[0154] Step 2, the formula for calculating the time average is:

[0155]

[0156] In the formula, This represents the instantaneous standardized error of feature i at each time point t.

[0157] Step 3, the formula for calculating the significance score is:

[0158]

[0159] In the formula, This represents the average error of feature i during the normal period; This represents the average value over time.

[0160] Step 4: Determine if it is an abnormal feature. If the value is greater than the threshold, then feature i is determined to be an abnormal feature.

[0161] In this embodiment, the formula for calculating the breadth coefficient is:

[0162]

[0163] In this embodiment, the formula for calculating the historical recurrence frequency is as follows:

[0164] Step 1: Query history to find the number of times N of the same type of anomaly occurred on the same network card.

[0165] Step 2, frequency coefficient calculation, the calculation formula is:

[0166]

[0167] S206c: Weighted calculation of scores from multiple fault severity rating items to generate a comprehensive severity score for network card faults.

[0168] In this embodiment, the severity score is calculated using the following formula:

[0169] Severity score = 0.4 × peak anomaly + 0.3 × duration coefficient + 0.2 × feature impact breadth + 0.1 × historical recurrence frequency

[0170] S206d: Based on the preset severity level mapping rules, the comprehensive severity score of the network card failure is mapped to obtain the severity level of the network card failure.

[0171] In this embodiment, the continuous severity score of 0 to 10 is mapped to a discrete level, and the severity level table is as follows:

[0172]

[0173] S206e: Generates network card failure assessment information based on the overall severity score and severity level of the network card failure.

[0174] In this embodiment, the network card fault assessment information records, but is not limited to, event identifiers, timestamp anomaly indicators, deviation from the normal baseline, start time, duration, and associated entities.

[0175] As can be seen from the above embodiments, by comprehensively comparing multiple features with historical data, performing multi-dimensional scoring and weighted calculations, and outputting a comprehensive severity score and level, the impact of the fault is transformed from a qualitative description into a comparable quantitative indicator, providing a decision-making basis for prioritizing fault handling, scheduling resources, and estimating the scope of impact.

[0176] In one embodiment of this application, step S207 includes:

[0177] S207a: Input the network card fault assessment information into the preset knowledge graph to generate event nodes associated with the network card entity.

[0178] Specifically, when network card failure assessment information is generated, the system creates new event nodes through the graph's API. The created nodes record attributes including but not limited to failure time, failure type, severity level, and abnormal period.

[0179] S207b: Starting from an event node, traverse the knowledge graph according to the connection relationships in the knowledge graph to generate a list of fault source nodes.

[0180] Specifically, a breadth-first search is performed along the predefined reasoning path in the graph. Starting from the fault event node, the graph is traversed to find the nearest common node and generate a list of fault source nodes.

[0181] S207c: Performs propagation chain analysis based on the list of fault source nodes and performance and alarm events in the knowledge graph to generate root cause information of network card failures.

[0182] Specifically, starting from the faulty node in the fault source node list, the system traverses upstream along the connection relationship to generate the root cause information of the network card fault.

[0183] S207d: Associates event nodes with log event nodes and performance nodes in the event window of the knowledge graph to generate an exception event context.

[0184] Specifically, based on the timestamp and fault type recorded by the event node, an event window is determined. Then, based on the log event nodes and performance nodes within the event window, a graph query language is used to perform a correlation query to obtain the context of the abnormal event.

[0185] In this embodiment, log event nodes include, but are not limited to, operating system kernel log nodes, network card driver alarm nodes, and application layer timeout event nodes.

[0186] In this embodiment, performance nodes include, but are not limited to, port throughput nodes, packet loss rate nodes, and retransmission rate nodes.

[0187] S207e: Based on the root cause information of the network card failure and the context of the abnormal event, traverse the related nodes in the knowledge graph to generate network card failure diagnosis results.

[0188] Specifically, based on the root cause information of the network card failure, the associated nodes in the knowledge graph are traversed to determine whether there are resolved historical failure case nodes with the same characteristics in the knowledge graph, and relevant failure cases are matched to generate network card failure diagnosis results.

[0189] As can be seen from the above embodiments, by traversing the correlation and propagation chain analysis, the fault source is located and the root cause information is generated. Discrete alarms and performance indicators are linked through graph semantics, simulating the thought process of causal reasoning, and improving the diagnostic depth and accuracy in complex fault scenarios.

[0190] In one embodiment of this application, step S202 includes:

[0191] S202a: Time-aligns network interface card data and environmental status data from multiple dimensions to generate time-aligned data.

[0192] Specifically, a reference time is set, and the collected data is aligned according to a unified time format and precision to generate time-aligned data.

[0193] S202b: Time-aligned data is divided into windows using a window segmentation algorithm to generate window-segmented data.

[0194] Specifically, a sliding time window mechanism is adopted, with a fixed time window length and sliding step size. For continuously arriving time-aligned data streams, the data is truncated according to the step size, and the data points in each time window are encapsulated into independent data segments to generate window-segmented data.

[0195] S202c: Perform data cleaning on the window-segmented data to generate cleaned data.

[0196] Specifically, the missing values ​​are filled in by linear interpolation, outliers are removed, and the stability of the data is verified to generate cleaned data.

[0197] S202d: Normalize the cleaned data to obtain standardized data.

[0198] Specifically, the data is normalized using the min-max normalization method to obtain standardized data.

[0199] S202e: Maps standardized data to the feature space to obtain a multidimensional feature matrix.

[0200] Specifically, principal component analysis is used to map the features of the original dimension to a low-dimensional space, capture the nonlinear relationships between features, and obtain a multidimensional feature matrix.

[0201] As can be seen from the above embodiments, by preprocessing the original data, including time alignment, window segmentation, data cleaning, normalization and feature space mapping operations, the original data is mapped to the feature space, providing standardized input data for the network card diagnostic engine, eliminating noise and dimensional differences in the original data, and improving data reliability.

[0202] In one embodiment of this application, step S204 includes:

[0203] S204a: Calculate the anomaly scores at multiple time points based on the weighted reconstruction error in the fault feature analysis results of multiple dimensions, and generate anomaly score sequence.

[0204] Specifically, the anomaly score is calculated at each time point, and the calculation method is as follows:

[0205] For each time point t, calculate the weighted sum of reconstruction errors for 45 features:

[0206]

[0207] In the formula, Represents eigenvalues The weights; Represents eigenvalues The reconstructed value; This represents the anomaly score at each time point.

[0208] It is through the network card diagnostic engine via raw input The latent distribution is calculated through encoding by an encoding processor. , of which the potential distribution This represents the mean. Variance, latent sampling latent sampling The output is obtained after being processed by the decoder and reconstructed. .

[0209] S204b: Performs smoothing on the abnormal score sequence based on exponentially weighted moving average, and generates a threshold baseline according to the preset false alarm rate tolerance.

[0210] Specifically, the threshold baseline for outlier scores is calculated using an exponentially weighted moving average, as follows:

[0211]

[0212] In the formula, This represents the score of the i-th feature; Indicates the smoothing factor; Represents the eigenvalue.

[0213] In this embodiment, the smoothing factor is sensitive during peak periods and filters noise during trough periods.

[0214] S204c: Based on the spatial vector and business time period information in the fault feature analysis results from multiple dimensions, the parameters of the threshold baseline are adjusted to generate the fault threshold.

[0215] Specifically, the formula for calculating the fault threshold is as follows:

[0216]

[0217] In the formula, represents the standard deviation; k represents the adjustable coefficient.

[0218] In this embodiment, when the number of consecutive false alarms increases, the adjustable coefficient is increased and the sensitivity is decreased; when a missed alarm event occurs, the adjustable coefficient is decreased and the sensitivity is increased.

[0219] In this embodiment, a lenient threshold is used during working periods and a strict threshold is used during maintenance periods, depending on the time context.

[0220] Specifically, the peak detection algorithm is used to find local maxima in the abnormal score sequence, which must meet the following conditions: score(t) > score(t-1) and score(t) > score(t+1) and score(t) > threshold. To avoid transient noise, the peak must last for at least 3 sampling points.

[0221] Specifically, temporal proximity clustering uses an improved density-based clustering algorithm to cluster abnormal peak points. It uses a weighted combination of temporal distance and pattern similarity as a distance metric and dynamically adjusts the clustering radius according to the network card load level to aggregate discrete abnormal points into continuous abnormal event intervals.

[0222] The event boundary determination rules are as follows: the start time is buffered forward by 10 seconds from the earliest point in the cluster, the end time is buffered backward by 30 seconds from the latest point in the cluster, and the peak time is the time point corresponding to the highest anomaly score.

[0223] As can be seen from the above embodiments, by serializing and smoothing the reconstruction error and dynamically adjusting the threshold baseline in combination with business time period information, the threshold of the fault judgment is made dynamic and the scenario is adaptive, which reduces false alarms caused by short-term fluctuations. At the same time, the sensitivity is flexibly adjusted according to different business load cycles, making the anomaly detection closer to the actual operation and maintenance needs.

[0224] Figure 3 A flowchart illustrating the network card fault diagnosis method provided in this application embodiment. Figure 2 ,like Figure 3 As shown, after step S207, the following steps are also included:

[0225] S301: Perform correlation path analysis on the diagnostic conclusions in the network card fault diagnosis results and generate a diagnostic confidence score.

[0226] Specifically, confidence scores are calculated based on the strength and number of associated paths to generate a diagnostic confidence score.

[0227] S302: Visualize and analyze the diagnostic conclusions in the network card fault diagnosis results to generate fault tracing path information.

[0228] Specifically, starting from the root cause node, the system traverses downstream to potentially affected network cards, servers, and upper-layer applications, reverses the source to determine the faulty network card at the underlying level, generates a fault tracing path, and creates a visual view based on the fault tracing path.

[0229] S303: Generate a fault repair strategy by querying scripts in the knowledge graph based on fault tracing path information and diagnostic confidence scores.

[0230] Specifically, using the root cause node as an index, the system queries the knowledge graph for repair scripts and standard operating procedure nodes associated with the root cause node. Based on the diagnostic confidence score, the system selects the appropriate execution strategy and generates a fault repair strategy.

[0231] As can be seen from the above embodiments, by analyzing the diagnostic path to generate a confidence score and providing a visual traceability diagram, and automatically matching the repair script, the transformation from diagnostic conclusion to executable prediction is realized, thus shortening the average fault repair time.

[0232] Figure 4 A flowchart illustrating the network card fault diagnosis method provided in this application embodiment. Figure 3 ,like Figure 4 As shown, after step S207, the following steps are also included:

[0233] S401: Obtain feedback confirmation information for network card fault diagnosis results.

[0234] In this embodiment, the content recorded in the feedback confirmation information includes, but is not limited to, whether the diagnostic results are consistent with the actual situation, the corrected root cause category, and whether the repair operation was successful.

[0235] S402: Update the relation weights of the reasoning paths in the knowledge graph based on the feedback confirmation information, and generate optimized knowledge graph association strength information.

[0236] Specifically, the system analyzes the feedback confirmation information. If it is marked as "diagnosis correct", the weight of the association on the reasoning path is increased; if it is marked as "diagnosis incorrect", the weight of the association on the reasoning path is decreased.

[0237] S403: Update the entity relationships of the knowledge graph based on the feedback confirmation information to generate an expanded knowledge graph.

[0238] Specifically, if the feedback information contains new failure modes and new causal relationships that are not recorded in the knowledge graph, the system will automatically add new entities and relationships to the knowledge graph to generate an expanded knowledge graph.

[0239] S404: Optimize the fault diagnosis reasoning rules based on the optimized knowledge graph association strength information and the expanded knowledge graph to generate optimized fault diagnosis reasoning rules.

[0240] Specifically, based on the optimized knowledge graph association strength information and the expanded knowledge graph, the system retrains or adjusts the path ranking algorithm in the fault diagnosis reasoning module, updates the causal association weights and thresholds in the rule base, and generates optimized fault diagnosis reasoning rules.

[0241] As can be seen from the above embodiments, by collecting feedback on diagnostic results, dynamically updating the relation weights and entity relationships in the knowledge graph, and optimizing the reasoning rules, the diagnostic system's ability to continuously learn and evolve is improved, making subsequent diagnoses more accurate and efficient, and realizing a virtuous cycle and long-term growth of diagnostic intelligence.

[0242] In one embodiment of this application, before step S207a, the following steps are further included:

[0243] S501: Obtain static historical data of the network interface card (NIC) device.

[0244] In this embodiment, the static historical data of the network interface card (NIC) device includes, but is not limited to, the NIC model, server model, and driver version.

[0245] S502: Acquire dynamic alarm events of the network interface card (NIC) device.

[0246] In this embodiment, the dynamic alarm events of the network interface card (NIC) device include, but are not limited to, indicators such as packet loss rate, associated NICs, and fault periods.

[0247] S503: Creates a knowledge graph based on the static historical data of the network interface card (NIC) device and the dynamic alarm events of the NIC device.

[0248] Specifically, graph nodes are created based on static historical data and dynamic alarm events, and node paths are created based on the relationships between the graph nodes to obtain a knowledge graph.

[0249] As can be seen from the above embodiments, by acquiring static historical data and dynamic alarm events of network interface card devices, and combining dynamic data with static data to create a knowledge graph, the accuracy of the knowledge graph in identifying potential risks can be improved.

[0250] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0251] Figure 5 This is a schematic diagram of the network card fault diagnosis device provided in an embodiment of this application. Figure 5 As shown, embodiments of this application also provide a network card fault diagnosis device 50, including: a first acquisition module 501, a data processing module 502, a first generation module 503, a calculation module 504, a fault classification module 505, an evaluation module 506, and a second generation module 507.

[0252] The first acquisition module 501 is used to acquire network card data and environmental status data from multiple dimensions.

[0253] The data processing module 502 is used to process network card data and environmental status data from multiple dimensions to obtain a multi-dimensional feature matrix.

[0254] The first generation module 503 is used to input the multi-dimensional feature matrix into the network card diagnostic engine to generate fault feature analysis results in multiple dimensions. The network card diagnostic engine is a diagnostic engine that combines a multi-layer long short-time memory network encoder and a variational autoencoder.

[0255] The calculation module 504 is used to calculate the anomaly score and fault threshold of the network card based on the fault feature analysis results of multiple dimensions.

[0256] The fault classification module 505 is used to classify network card faults based on the network card's anomaly score and fault threshold, and generate fault classification results.

[0257] The evaluation module 506 is used to assess the severity of network card failures based on the failure classification results and generate network card failure evaluation information.

[0258] The second generation module 507 is used to traverse the knowledge graph based on the network card fault assessment information and generate network card fault diagnosis results.

[0259] In one possible implementation, the first generation module 503 includes:

[0260] The feature extraction unit is used to extract temporal features from the multi-dimensional feature matrix through the multi-layer long short-term memory network encoder of the network card diagnostic engine, and generate abstract features.

[0261] The parameterization unit is used to perform probability distribution parameterization on abstract features, generating mean vector and standard deviation vector.

[0262] The sampling unit is used to sample the mean vector and standard deviation vector to generate a space vector.

[0263] The reconstruction unit is used to perform temporal reconstruction processing on the spatial vector through the multi-layer long short-term memory network decoder of the network card diagnostic engine, and generate a reconstructed spatial feature matrix.

[0264] The first computing unit is used to calculate the weighted reconstruction error of the reconstructed spatial feature matrix and the multidimensional feature matrix, and generate fault feature analysis results in multiple dimensions.

[0265] In one possible implementation, the fault classification module 505 includes:

[0266] The determination unit is used to determine abnormal time period information based on the network card's abnormal score and fault threshold.

[0267] The second calculation unit is used to calculate the reconstruction error of multiple features based on multiple time points in the abnormal period information, and generate the total error of multiple features during the abnormal period.

[0268] The third calculation unit is used to calculate the error contribution of multiple features based on the total error of multiple features during the abnormal period, and generate contribution distribution information.

[0269] The fourth calculation unit is used to divide multiple features into feature groups according to preset feature grouping rules and contribution distribution information, and to calculate the contribution of multiple feature groups.

[0270] The identification unit is used to identify feature groups whose contribution exceeds a preset threshold based on the contribution of multiple feature groups, and generate fault classification results.

[0271] In one possible implementation, the evaluation module 506 includes:

[0272] The first generation unit is used to extract multiple feature data and historical data of the abnormal period based on the fault classification results, and generate basic data for anomaly assessment.

[0273] The fifth calculation unit is used to calculate the scores of multiple fault severity scoring items based on the anomaly assessment baseline data.

[0274] The sixth calculation unit is used to perform weighted calculations on the scores of multiple fault severity rating items to generate a comprehensive severity score for the network card fault.

[0275] The first mapping unit is used to map the overall severity score of the network card failure to a preset severity level mapping rule to obtain the severity level of the network card failure.

[0276] The second generation unit is used to generate network card failure assessment information based on the overall severity score and severity level of the network card failure.

[0277] In one possible implementation, the second generation module 507 includes:

[0278] The third generation unit is used to input network card fault assessment information into a preset knowledge graph and generate event nodes associated with the network card entity.

[0279] The fourth generation unit is used to traverse the knowledge graph based on the connection relationships in the knowledge graph, starting from the event node, and generate a list of fault source nodes.

[0280] The analysis unit is used to perform propagation chain analysis based on the list of fault source nodes and performance and alarm events in the knowledge graph, and generate root cause information of network card failure.

[0281] The association unit is used to associate event nodes with log event nodes and performance nodes in the event window of the knowledge graph to generate an exception event context.

[0282] The traversal unit is used to traverse the associated nodes in the knowledge graph based on the root cause information of the network card failure and the context of the abnormal event, and generate network card failure diagnosis results.

[0283] In one possible implementation, the data processing module 502 includes:

[0284] The time alignment unit is used to time-align network interface card data and environmental status data from multiple dimensions to generate time-aligned data.

[0285] The partitioning unit is used to perform window partitioning on time-aligned data using a window partitioning algorithm, generating window-partitioned data.

[0286] The data cleaning unit is used to clean the window-segmented data and generate cleaned data.

[0287] The normalization unit is used to normalize the cleaned data to obtain standardized data.

[0288] The second mapping unit is used to map standardized data to the feature space to obtain a multidimensional feature matrix.

[0289] In one possible implementation, the computing module 504 includes:

[0290] The second calculation unit is used to calculate the anomaly scores at multiple time points based on the weighted reconstruction error in the fault feature analysis results of multiple dimensions, and generate anomaly score sequences.

[0291] The smoothing unit is used to smooth the abnormal score sequence based on an exponentially weighted moving average and generate a threshold baseline according to a preset false alarm rate tolerance.

[0292] The adjustment unit is used to adjust the parameters of the threshold baseline based on the spatial vector and business time period information in the fault feature analysis results from multiple dimensions, and generate the fault threshold.

[0293] In one possible implementation, the network interface card (NIC) fault diagnosis device 50 further includes:

[0294] The path analysis module is used to perform correlation path analysis on the diagnostic conclusions in the network card fault diagnosis results and generate a diagnostic confidence score.

[0295] The visualization analysis module is used to visualize and analyze the diagnostic conclusions in the network card fault diagnosis results and generate fault tracing path information.

[0296] The query module is used to query scripts in the knowledge graph based on fault tracing path information and diagnostic confidence scores to generate fault repair strategies.

[0297] In one possible implementation, the network interface card (NIC) fault diagnosis device 50 further includes:

[0298] The second acquisition module is used to acquire feedback confirmation information of the network card fault diagnosis results.

[0299] The first update module is used to update the relation weights of the reasoning paths in the knowledge graph based on the feedback confirmation information, and generate optimized knowledge graph association strength information.

[0300] The second update module is used to update the entity relationships of the knowledge graph based on the feedback confirmation information, and generate an expanded knowledge graph.

[0301] The optimization module is used to optimize the fault diagnosis reasoning rules based on the optimized knowledge graph association strength information and the expanded knowledge graph, and generate optimized fault diagnosis reasoning rules.

[0302] For a description of the features in the embodiment of the network card fault diagnosis device, please refer to the relevant description of the embodiment of the network card fault diagnosis method, which will not be repeated here.

[0303] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the electronic device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus.

[0304] In the specific implementation process, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to execute the above-described network card fault diagnosis method embodiment.

[0305] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0306] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0307] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0308] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0309] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the network card fault diagnosis method embodiments described above when running.

[0310] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0311] The embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the network card fault diagnosis method embodiments described above.

[0312] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described network interface card (NIC) fault diagnosis method embodiments.

[0313] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be executed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip (SoC), a complex programmable logic device (CPLD), a microprocessor (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or one or more combinations thereof. The aforementioned computer program (also known as a program, software, software application, app, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0314] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0315] The foregoing has provided a detailed description of a network card fault diagnosis method and electronic device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only intended to help understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for diagnosing network card faults, characterized in that, include: Obtain network interface card (NIC) data and environmental status data from multiple dimensions; Data processing is performed on the network card data and environmental status data of the multiple dimensions to obtain a multidimensional feature matrix; The multidimensional feature matrix is ​​input into the network card diagnostic engine to generate fault feature analysis results in multiple dimensions. The network card diagnostic engine is a diagnostic engine that combines a multilayer long short-time memory network encoder and a variational autoencoder. The network interface card's anomaly score and fault threshold are calculated based on the fault feature analysis results from the multiple dimensions. The network card faults are classified according to the network card's anomaly score and fault threshold, and a fault classification result is generated. Based on the fault classification results, the severity of the network card fault is assessed, and network card fault assessment information is generated. Based on the network card fault assessment information, the knowledge graph is traversed to generate network card fault diagnosis results.

2. The network card fault diagnosis method according to claim 1, characterized in that, The step of inputting the multi-dimensional feature matrix into the network card diagnostic engine to generate multi-dimensional fault feature analysis results includes: The network card diagnostic engine uses a multi-layer long short-term memory network encoder to extract temporal features from the multi-dimensional feature matrix and generate abstract features. The abstract features are subjected to probability distribution parameterization to generate a mean vector and a standard deviation vector; The mean vector and the standard deviation vector are sampled to generate a spatial vector; The spatial vector is temporally reconstructed using the multi-layer long short-term memory network decoder of the network card diagnostic engine to generate a reconstructed spatial feature matrix. The weighted reconstruction error between the reconstructed spatial feature matrix and the multidimensional feature matrix is ​​calculated to generate fault feature analysis results in multiple dimensions.

3. The network card fault diagnosis method according to claim 1, characterized in that, The step of classifying network card faults based on the network card's anomaly score and fault threshold, and generating fault classification results, includes: The abnormal time period information is determined based on the abnormal score and fault threshold of the network card; The reconstruction error of multiple features is calculated based on multiple time points in the abnormal period information, and the total error of multiple features in the abnormal period is generated. The error contribution of the multiple features is calculated based on the total error of the multiple features during the abnormal period, and contribution distribution information is generated. According to the preset feature grouping rules and the contribution distribution information, multiple features are divided into feature groups, and the contribution of multiple feature groups is calculated. Based on the contribution of the multiple feature groups, feature groups whose contribution exceeds a preset threshold are identified, and fault classification results are generated.

4. The network card fault diagnosis method according to claim 1, characterized in that, The step of assessing the severity of network card (NIC) faults based on the fault classification results and generating NIC fault assessment information includes: Based on the fault classification results, extract multiple feature data and historical data for the abnormal period to generate basic data for anomaly assessment; Scores for multiple fault severity rating items are calculated based on the aforementioned anomaly assessment baseline data; The scores of the multiple fault severity scoring items are weighted and calculated to generate a comprehensive severity score for the network card fault. The severity score of the network card failure is mapped according to the preset severity level mapping rule to obtain the severity level of the network card failure. Network card failure assessment information is generated based on the overall severity score and severity level of the network card failure.

5. The network card fault diagnosis method according to claim 1, characterized in that, The step of traversing the knowledge graph based on the network card fault assessment information to generate network card fault diagnosis results includes: The network card fault assessment information is input into a preset knowledge graph to generate event nodes associated with the network card entity; Starting from the event node, the knowledge graph is traversed according to the connection relationship in the knowledge graph to generate a list of fault source nodes; Based on the list of fault source nodes and the performance and alarm events in the knowledge graph, a propagation chain analysis is performed to generate root cause information of network card failures; The event nodes are associated with the log event nodes and performance nodes in the event window of the knowledge graph to generate an abnormal event context; Based on the root cause information of the network card failure and the context of the abnormal event, the associated nodes in the knowledge graph are traversed to generate network card failure diagnosis results.

6. The network card fault diagnosis method according to claim 1, characterized in that, The data processing of the network interface card data and environmental status data from multiple dimensions yields a multi-dimensional feature matrix, including: Time alignment is performed on the network interface card data and environmental status data from the multiple dimensions to generate time-aligned data; The time-aligned data is divided into windows using a window segmentation algorithm to generate window-segmented data. The window-segmented data is cleaned to generate cleaned data; The cleaned data is then normalized to obtain standardized data; The standardized data is mapped to the feature space to obtain a multidimensional feature matrix.

7. The network card fault diagnosis method according to claim 1, characterized in that, The calculation of the network interface card's anomaly score and fault threshold based on the fault feature analysis results from the multiple dimensions includes: Anomaly scores at multiple time points are calculated based on the weighted reconstruction errors in the fault feature analysis results of the multiple dimensions, and anomaly score sequence is generated. The abnormal score sequence is smoothed using an exponentially weighted moving average, and a threshold baseline is generated based on a preset false alarm rate tolerance. Based on the spatial vectors and business time period information in the fault feature analysis results of the multiple dimensions, the parameters of the threshold baseline are adjusted to generate the fault threshold.

8. The network card fault diagnosis method according to claim 1, characterized in that, After generating network card fault diagnosis results by traversing the knowledge graph based on the network card fault assessment information, the process further includes: Perform correlation path analysis on the diagnostic conclusions in the network card fault diagnosis results to generate a diagnostic confidence score; Visual analysis is performed on the diagnostic conclusions in the network card fault diagnosis results to generate fault tracing path information; Based on the fault tracing path information and the script in the knowledge graph query based on the diagnostic confidence score, a fault repair strategy is generated.

9. The network card fault diagnosis method according to any one of claims 1 to 8, characterized in that, After generating network card fault diagnosis results by traversing the knowledge graph based on the network card fault assessment information, the process further includes: Obtain feedback confirmation information for network card fault diagnosis results; Update the relation weights of the reasoning paths in the knowledge graph based on the feedback confirmation information, and generate optimized knowledge graph association strength information; The entity relationships of the knowledge graph are updated based on the feedback confirmation information to generate an expanded knowledge graph; The fault diagnosis reasoning rules are optimized based on the optimized knowledge graph association strength information and the expanded knowledge graph to generate optimized fault diagnosis reasoning rules.

10. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network card fault diagnosis method as described in any one of claims 1 to 9 when executing the computer program.

Images