A network fault analysis method, device, equipment and medium

Abstract

This application discloses a network fault analysis method, apparatus, device, and medium, relating to the field of computer technology. The method includes: selecting candidate paths starting from alarm nodes using an intelligent agent, determining the target path where the fault is located by combining path probability with configuration change correlation scores, locating the root cause of the fault based on the probability of fault propagation along the path and the impact of configuration changes on alarms, thereby improving the accuracy and efficiency of root cause location; simultaneously, using a deep learning model and graph attention network to fuse and encode historical alarm time series sequences and dynamic knowledge graphs, predicting the probability of fault propagation within future time windows, and achieving proactive early warning of anomalies to detect potential risks in advance.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for network fault analysis. Background Technology

[0002] In related technologies, network fault diagnosis relies on manually maintained rule bases. However, in scenarios where network devices are often deployed from multiple vendors, the rule base coverage is often insufficient, making it impossible to detect network faults in a timely and accurate manner. Furthermore, it is impossible to accurately locate the root cause of the fault and predict the propagation of the fault between devices. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a network fault analysis method, apparatus, device, and storage medium capable of accurately locating the root cause of a fault and predicting the probability of fault propagation. The specific solution is as follows: Firstly, this application discloses a network fault analysis method, including: The system acquires target information corresponding to network devices, preprocesses the target information, and dynamically updates the knowledge graph based on the processed target information. The target information includes network device information, alarm information, configuration change information, link information, and service information. The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes. The preprocessing of alarm information includes: encoding the fields to be converted in the alarm information into semantic vectors using a language model, and calculating the similarity between the vectors and the semantic vectors of standard fields in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, the field to be converted is replaced with the standard field corresponding to the maximum similarity. Based on the knowledge graph, an agent selects candidate paths starting from alarm nodes, and determines the target path based on the path probability and configuration change relevance score of the candidate paths. The root cause of network failure is then determined based on the target path. The path probability represents the probability of a failure propagating along the candidate path, and the configuration change relevance score represents the degree of correlation between the alarm and the configuration change. The configuration change relevance score is the highest score among all relevance scores of configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm. The relevance score is determined based on the time decay factor, configuration change weight, and configuration change impact score. Based on the knowledge graph and historical alarm time series, a deep learning model and a graph attention network are used to predict the probability of fault propagation within a future preset time window. The deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

[0004] Optionally, the step of encoding the fields to be converted in the alarm information into semantic vectors using a language model and calculating their similarity with the semantic vectors of standard fields in a pre-constructed unified semantic ontology includes: The fields to be converted in the alarm information are encoded into semantic vectors using a language model finely tuned on a network device document corpus. Calculate the cosine similarity between the semantic vector and the semantic vector of a standard field in a pre-constructed unified semantic ontology; If the maximum similarity is less than a preset threshold, a prompt will be generated.

[0005] Optionally, the preprocessing of the configuration change information includes: Calculate the hash value of the configuration snapshot in the configuration change information; The configuration change weight is determined based on the configuration change type corresponding to the configuration change information. Based on the configuration change information, the impact score of the configuration change is predicted using a failure rate regression model. Accordingly, the knowledge graph is dynamically updated based on the processed target information, including: Based on the hash value, the configuration change weight, and the impact score of the configuration change, a configuration change node is generated and added to the knowledge graph.

[0006] Optionally, before determining the target path based on the path probability and configuration change relevance score of candidate paths, the following steps are also included: A graph attention network is used to determine the attention weight corresponding to each edge in each candidate path; the attention weight represents the fault propagation strength between the two nodes connected by the edge. The path probability of a candidate path is obtained based on the attention weights of all edges in the candidate path.

[0007] Optionally, before determining the target path based on the path probability and configuration change relevance score of candidate paths, the following steps are also included: Based on the knowledge graph, query the configuration change nodes associated with the device corresponding to the endpoint of the candidate path within a preset time window; the configuration change nodes include configuration change weight and configuration change impact score; The time decay factor is determined based on the time difference between the first time corresponding to the configuration change node and the second time corresponding to the alarm node; Based on the time decay factor, the configuration change weight, and the configuration change impact score, a relevance score is calculated for each configuration change node using the relevance score calculation formula; wherein, the relevance score calculation formula is: C_change=exp(-|Δt| / τ) impact_score type_weight; where Δt is the time difference, τ is the preset time window, type_weight is the configuration change weight, and impact_score is the impact score; The highest relevance score will be used as the configuration change relevance score for the candidate path.

[0008] Optionally, determining the target path based on the path probability and configuration change relevance score of the candidate paths includes: Based on the path probability and configuration change relevance score corresponding to the candidate path, a comprehensive score of the candidate path is calculated by weighted summation; A predetermined number of candidate paths are selected from the highest to the lowest comprehensive scores and used as the target paths.

[0009] Optionally, selecting candidate paths starting from alarm nodes includes: Starting from the alarm node in the knowledge graph, the candidate path is obtained by traversing the target backwards by the number of hops and performing a depth-first search along the relationship edges between nodes. After determining the target path based on the path probability and configuration change relevance score of the candidate paths, the process also includes: If the number of target paths is less than the preset number, and / or the highest comprehensive score of the target path is less than the preset score, then the number of hops for the reverse traversal of the target is increased and the search is restarted.

[0010] Optionally, after determining the root cause of the network failure based on the target path, the method further includes: Based on the nodes contained in the target path, a root cause explanation text in the target format is generated using a large language model, along with the scope of the fault impact, the confidence level corresponding to the explanation text, and the rollback script.

[0011] Optionally, the network fault analysis method further includes: The model gradient of the joint model of the deep learning model and the graph attention network is uploaded to the aggregation server after adding differential privacy noise. Receive global model parameters returned by the aggregation server; the global model parameters are obtained based on multiple model gradients; Update the local joint model based on the global model parameters.

[0012] Optionally, the joint loss function is: L = L_root + γ·L_prop; where L_root is the root cause localization loss, L_prop is the propagation prediction loss, and γ is the balance coefficient.

[0013] Optionally, the step of predicting the probability of fault propagation within a preset time window based on the knowledge graph and historical alarm time series using a deep learning model and graph attention network includes: Obtain the historical alarm timing sequence within the sliding time window; Historical alarm time-series sequences are encoded using a deep learning model based on an attention mechanism to obtain time-series embedding vectors; The knowledge graph is encoded using a graph attention network to obtain the node embedding vector of the target node; the target node is the endpoint node of the edge to be predicted. The temporal embedding vector is concatenated with the node embedding vector to obtain the fused feature; Based on the fusion features, predict the probability of fault propagation of the edge to be predicted in the knowledge graph within a future preset time window.

[0014] Optionally, the deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

[0015] Optionally, the step of encoding the knowledge graph using a graph attention network to obtain the node embedding vector of the target node includes: Obtain the temporal weights of the edges in the knowledge graph; the temporal weights are determined based on time decay. Traverse the target nodes in the knowledge graph and use a graph attention network to calculate the attention weights of the edges between the current node and its neighboring nodes; the attention weights characterize the degree of influence of the neighboring nodes on the current node; Based on the node features of the current node, the node features of the neighboring nodes, and the edge features, temporal weights, and attention weights of the edges corresponding to the current node, the node embedding vector of the current node is obtained through weighted aggregation.

[0016] Secondly, this application discloses a network fault analysis device, comprising: The knowledge graph update module is used to acquire target information corresponding to network devices, preprocess the target information, and dynamically update the knowledge graph based on the processed target information. The target information includes network device information, alarm information, configuration change information, link information, and service information. The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes. The preprocessing of alarm information includes: encoding the fields to be converted in the alarm information into semantic vectors using a language model, and calculating the similarity between the vectors and the semantic vectors of standard fields in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, the field to be converted is replaced with the standard field corresponding to the maximum similarity. The fault root cause determination module is used to select candidate paths starting from alarm nodes using an intelligent agent based on the knowledge graph, and determine the target path based on the path probability and configuration change relevance score of the candidate paths, and determine the network fault root cause based on the target path; the path probability represents the probability of the fault propagating along the candidate path, the configuration change relevance score represents the degree of correlation between the alarm and the configuration change, the configuration change relevance score is the highest score among all the relevance scores of the configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm, and the relevance score is determined based on the time decay factor, configuration change weight, and configuration change impact score; The fault propagation prediction module is used to predict the probability of fault propagation within a preset time window based on the knowledge graph and historical alarm time series, using a deep learning model and a graph attention network. The deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

[0017] Thirdly, this application discloses an electronic device, including: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned network fault analysis method.

[0018] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned network fault analysis method.

[0019] In this application, target information corresponding to network devices is obtained, the target information is preprocessed, and a knowledge graph is dynamically updated based on the processed target information. The target information includes network device information, alarm information, configuration change information, link information, and service information. The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes. The preprocessing of alarm information includes: encoding the fields to be converted in the alarm information into semantic vectors using a language model, and calculating the similarity between these vectors and the semantic vectors of standard fields in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, the field to be converted is replaced with the standard field corresponding to the maximum similarity; based on the knowledge graph, an agent selects candidate paths starting from the alarm nodes, and evaluates the path probability and configuration change relevance of the candidate paths. The target path is determined, and the root cause of the network failure is determined based on the target path. The path probability represents the probability of the failure propagating along the candidate path. The configuration change correlation score represents the degree of correlation between the alarm and the configuration change. The configuration change correlation score is the highest score among all the correlation scores of the configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm. The correlation score is determined based on the time decay factor, configuration change weight, and configuration change impact score. Based on the knowledge graph and historical alarm time series, a deep learning model and a graph attention network are used to predict the probability of failure propagation within a preset time window in the future. The deep learning model and the graph attention network are obtained by end-to-end joint training through a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

[0020] As can be seen, by selecting candidate paths starting from alarm nodes using an intelligent agent, and comprehensively considering path probability and configuration change relevance scores, the target path where the fault is located is determined. The root cause of the fault is located based on the probability of fault propagation along the path and the impact of configuration changes on alarms, improving the accuracy and efficiency of root cause localization. Simultaneously, a deep learning model and graph attention network are used to fuse and encode historical alarm time series and dynamic knowledge graphs to predict the probability of fault propagation within future time windows, enabling proactive early warning of anomalies and early detection of potential risks. Furthermore, by calculating relevance scores, the correlation between the most relevant configuration change of the candidate path's endpoint device within the pre-alarm window and the current alarm is quantified. By using a joint loss function to simultaneously optimize both root cause localization and propagation prediction tasks, the shared graph attention network embedding can balance fault root cause tracing and impact prediction. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0022] Figure 1 A flowchart of a network fault analysis method provided in this application; Figure 2 This application provides a specific network fault analysis architecture diagram; Figure 3 This application provides a specific flowchart for determining the target path; Figure 4 A schematic diagram of a network fault analysis device provided in this application; Figure 5 This application provides a structural diagram of an electronic device. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] In related technologies, network fault diagnosis relies on manually maintained rule bases. However, in scenarios where network devices are typically deployed from multiple vendors, the rule base coverage is often insufficient, leading to the inability to detect network faults in a timely and accurate manner. Furthermore, it is impossible to accurately locate the root cause of the fault or predict the propagation probability of the fault between devices. To overcome these technical problems, this application proposes a network fault analysis method that can accurately locate the root cause of the fault and predict the probability of fault propagation.

[0025] This application discloses a network fault analysis method. See also Figure 1 As shown, the method may include the following steps: Step S11: Obtain the target information corresponding to the network device, preprocess the target information, and dynamically update the knowledge graph based on the processed target information.

[0026] The target information includes network device information, alarm information, configuration change information, link information, and service information; the knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes.

[0027] First, target information such as alarm information, configuration change information, and topology information for each network device from different manufacturers within the monitoring area is collected. Specifically, the target information may include one or more of the following: network device information, alarm information, configuration change information, link information, and service information. Specifically, multi-protocol acquisition adapters can be pre-deployed to adapt to network devices using different protocols; simultaneously, network topology discovery technology is used to obtain the topological relationships between devices.

[0028] Then, a knowledge graph is dynamically constructed or updated based on the target information. The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes. Each device, alarm, configuration change, link, and service in the knowledge graph corresponds to a node, and nodes are connected by dependency edges. Specifically, a device node represents a network device, and the node can include information such as device name, manufacturer, and location; an alarm node represents a specific alarm triggering event, and the node can include information such as device name, alarm time, and alarm level; a configuration change node represents a specific configuration change operation, such as modifying a device's configuration at a certain time, and the node can include the device name, configuration time, and hash of the configuration snapshot; a link node represents the connection relationship between devices, such as the communication connection between port A of device 1 and port B of device 2, and the node can include information such as the link bandwidth; a service node is associated with a device node or link node, representing the specific business service it provides. For example, when a switch generates a processor overload alarm, a new alarm node is added to the knowledge graph and associated with the switch's device node.

[0029] The preprocessing of the alarm information includes: encoding the field to be converted in the alarm information into a semantic vector using a language model, and calculating the similarity between the vector and the semantic vector of a standard field in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, then the field to be converted is replaced with the standard field corresponding to the maximum similarity. Specifically, it includes the following steps: S201: Encode the fields to be converted in the alarm information into semantic vectors using a language model, and calculate the similarity between the semantic vectors and the semantic vectors of standard fields in a pre-constructed unified semantic ontology.

[0030] In real-world applications, network devices are typically deployed across multiple vendors. Because each vendor uses proprietary data formats (e.g., Huawei devices use the iFlow protocol, H3C devices use the NetStream v9 protocol, and Ruijie devices use the Syslog RFC5424 protocol), it's difficult to uniformly analyze network faults. Therefore, after collecting raw alarm information from network devices, data standardization is necessary. To this end, this embodiment pre-constructs a unified semantic ontology containing multiple standard alarm fields. After collecting raw alarms, a domain-BERT language model, finely tuned based on the network device manual corpus, is used to encode the descriptive text of the fields to be converted in the alarm information into semantic vectors.

[0031] S202: If there is a similarity greater than or equal to a preset threshold, the field to be converted is replaced with the standard field corresponding to the maximum similarity to obtain the converted alarm data. Based on the converted alarm data, an alarm node is generated and added to the knowledge graph.

[0032] The cosine similarity of the encoded semantic vector with the semantic vectors of each standard field in the unified semantic ontology is calculated one by one. The similarity between the semantic vector and different standard fields is obtained. If the maximum similarity is greater than a preset threshold, the standard field corresponding to the maximum similarity is used to replace the field to be converted; preferably, the preset threshold θ∈[0.80,0.85]. For example, if the device uses the Syslog protocol, the generated alarm contains the field to be converted: Interface GigabitEthernet0 / 1 has been shutdown. Using a domain-BERT language model fine-tuned on the network device manual corpus, the similarity between this field to be converted and the standard field "port closed" is 0.94, so this standard field is used for replacement. Based on the converted data, a corresponding alarm node is generated in the knowledge graph. This node contains attributes such as the converted alarm data, device identifier, and timestamp. The alarm node is added to the knowledge graph and associated with the corresponding device node.

[0033] S203: If the similarity scores are all less than the preset threshold, a prompt will be generated.

[0034] Understandably, if the similarity between the field to be converted and all standard fields is lower than the preset threshold, it may be that the alarm type is not defined in the ontology. In this case, the system will generate a prompt message to trigger manual intervention, so that network engineers can manually annotate the misaligned field after receiving the prompt and determine whether it is necessary to add an ontology type or classify the field into an existing category, thereby ensuring the continuous improvement of heterogeneous data alignment.

[0035] The preprocessing of the aforementioned configuration change information includes the following steps: S301: Calculate the hash value of the configuration snapshot in the configuration change information.

[0036] When a network device undergoes a configuration change, the system retrieves the configuration change information, which includes a snapshot of the device's configuration file after the change. The hash value of this snapshot is then calculated. For example, if an aggregation switch performs a configuration modification, a snapshot of the changed configuration is collected, and the resulting SHA-256 hash value is used as a unique identifier for the change. This hash value can subsequently be used to verify configuration integrity and support one-click rollback.

[0037] S302: Determine the configuration change weight based on the configuration change type corresponding to the configuration change information.

[0038] The weight of a configuration change is determined based on its type. Specifically, different weights for different configuration change operations can be predefined. For example, a MODIFY operation has a weight of 1.0, an ADD operation has a weight of 0.8, a DELETE operation has a weight of 1.2, and a ROLLBACK operation has a weight of 0.5.

[0039] like Figure 2 The network fault analysis architecture shown in the figure first collects data, obtains network topology and standardizes data in the data fusion layer, generates or updates knowledge graphs based on the processed data, so as to perform fault root cause reasoning and fault probability prediction based on knowledge graphs, and finally outputs reports, etc.

[0040] S303: Based on the configuration change information, the impact score of the configuration change is predicted using a failure rate regression model.

[0041] Simultaneously, a failure rate regression model is used to predict the impact score of this configuration change. This model is trained based on historical data, taking into account parameters such as change type, changed equipment, and change content characteristics, and outputs an impact score that characterizes the degree of impact of the change on future failures. A higher score indicates a higher risk of subsequent network failures.

[0042] S304: Generate a configuration change node based on the hash value, the configuration change weight, and the impact score of the configuration change, and add it to the knowledge graph.

[0043] Based on the hash value, configuration change weight, and impact score mentioned above, a configuration change node is generated. This node can specifically include attributes such as change type, timestamp, hash value, weight, and impact score, and is added to the knowledge graph, associating it with other corresponding nodes. During subsequent root cause reasoning, the agent can query this configuration change node to obtain its weight and impact score, which are then used to calculate the change relevance score.

[0044] As can be seen, by introducing configuration change information, root cause localization no longer relies solely on topology propagation paths, but can also identify faults caused by configuration modifications. When the endpoint of the candidate path corresponding to the alarm has been recently changed, the change relevance score can improve the overall score of the path, thereby accurately locating the source of the fault caused by human or automatic changes and avoiding misjudgment.

[0045] Step S12: Based on the knowledge graph, the agent selects candidate paths starting from alarm nodes, and determines the target path based on the path probability and configuration change relevance score of the candidate paths, and determines the root cause of network failure based on the target path.

[0046] The path probability represents the probability of a fault propagating along the candidate path, and the configuration change correlation score represents the degree of correlation between the alarm and the configuration change. The configuration change correlation score is the highest score among all correlation scores corresponding to configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm. The correlation score is determined based on a time decay factor, configuration change weight, and configuration change impact score. Therefore, by using the configuration change correlation score, the correlation between the most relevant configuration change of the endpoint device of the candidate path within the pre-alarm window and the current alarm is quantified.

[0047] In this embodiment, the agent starts from the alarm node and traverses upstream along the dependency edges in the knowledge graph, i.e., traverses towards the device nodes, generating multiple candidate propagation paths. For example, starting from the delay alarm node of wireless AP1, it traverses upstream to the access switch, aggregation switch, and finally to the core device, forming multiple candidate paths; Candidate path 1: wireless AP1, switch 1, aggregation switch 1, core switch 1; Candidate path 2: wireless AP1, switch 1, aggregation switch 1; Candidate path 3: wireless AP1, switch 1; Candidate path 4: wireless AP1.

[0048] Specifically, the root cause localization operation can be triggered after adding an alarm node to the knowledge graph, or it can be performed after the knowledge graph is built for the first time. For each candidate path, its path probability and configuration change relevance score are calculated. The path probability is determined using a graph attention network (GAT) based on the attention weights of each edge on the path, representing the likelihood of the fault propagating along that path. The configuration change relevance score is calculated based on the information in the configuration change nodes associated with the device nodes in the candidate path, reflecting the degree of association between the alarm and the configuration change. The agent combines the path probability and the configuration change relevance score, and determines the path with the highest comprehensive score as the target path. The endpoint device and associated configuration change nodes of the target path are the root causes of the fault.

[0049] Specifically, the above-mentioned selection of candidate paths starting from alarm nodes includes: starting from alarm nodes in the knowledge graph, performing a depth-first search (DFS) along the relationship edges between nodes, and traversing backwards by the target number of hops to obtain candidate paths. The agent, starting from an alarm node, performs a depth-first search (DFS) along the relationship edges between nodes, traversing backwards by the preset target number of hops (e.g., 6 hops), to generate a set of candidate paths. Taking a university campus network as an example, if the alarm node is a latency alarm from a wireless access point, the agent starts from this alarm node and extends the search upstream level by level along the dependency relationship edges between the alarm-generating device and its upstream dependent devices until the preset maximum traversal hop count is reached. Each extension generates a new candidate path, with path lengths ranging from 1 hop (i.e., the alarm node itself) to the maximum number of hops. This results in a set containing multiple candidate paths of different lengths, with each path's endpoint corresponding to a potential root cause device. These paths will then be scored to determine the final root cause of the fault.

[0050] In a preferred implementation, before determining the target path based on the path probability and configuration change relevance score of the candidate paths, the method further includes: using a graph attention network to determine the attention weight corresponding to each edge in each candidate path; the attention weight characterizes the fault propagation strength between the two nodes connected by the edge; and obtaining the path probability of the candidate path based on the attention weights of all edges in the candidate path.

[0051] For example Figure 3The specific target path determination process is shown below. It's understandable that before the agent determines the target path based on path probability and configuration change relevance scores, the path probability of each candidate path needs to be calculated first. Specifically, a pre-trained graph attention network (GAT) can be used to process the knowledge graph. The GAT employs an 8-head attention mechanism, with an output dimension of 128 and a total of 2 layers. For each edge in the knowledge graph, GAT calculates an attention weight, which represents the fault propagation strength between the two nodes connected by the edge. For example, if historically, core switch CPU overload frequently leads to increased latency in aggregation switches, the attention weight of the edge between these two nodes will be high; conversely, if there is almost no statistical correlation of fault propagation between the two nodes, the attention weight will be low. Then, for each candidate path, the system obtains the attention weights corresponding to each edge contained in the path and multiplies these weights to obtain the path probability of the candidate path. Taking the candidate path: Aggregation Switch 1, Access Switch 2, AP3 as an example, assuming that GAT calculates the attention weight of the edge between Aggregation Switch 1 and Access Switch 2 to be 0.90, and the attention weight of the edge between Access Switch 2 and AP3 to be 0.85, then the path probability of this candidate path is 0.90 × 0.85 = 0.765. This probability represents the likelihood that a fault will propagate from the Aggregation Switch to the wireless AP along this path, which is 76.5%.

[0052] In a preferred implementation, before determining the target path based on the path probability and configuration change relevance score of the candidate path, the method further includes: querying the configuration change nodes associated with the device corresponding to the endpoint of the candidate path within a preset time window based on the knowledge graph; the configuration change nodes include configuration change weights and configuration change impact scores; determining a time decay factor based on the time difference between the first time corresponding to the configuration change node and the second time corresponding to the alarm node; calculating the relevance score of each configuration change node based on the time decay factor, the configuration change weights, and the configuration change impact scores; and using the highest relevance score as the configuration change relevance score of the candidate path.

[0053] Similarly, before the agent determines the target path based on the path probability and configuration change relevance score, it is necessary to calculate the configuration change relevance score for each candidate path. First, for each candidate path, query all configuration change nodes associated with the endpoint device within a preset time window to obtain one or more related configuration change records. The preset time window is preferably 72 hours before the alarm occurs. The configuration change nodes also store change type weights and impact scores. Then, based on the first time corresponding to the configuration change node (i.e., the time of the configuration change) and the second time corresponding to the alarm node (i.e., the time of the alarm occurrence), calculate the time difference between the two times, and use a time decay function to calculate the time decay factor. Preferably, the time decay function can use exponential decay: exp(-|Δt| / τ), where Δt is the time difference and τ is the preset time window. The units of the time difference and the preset time window need to be consistent, such as hours. Finally, based on the time decay factor, configuration change weight, and impact score, calculate the relevance score of the configuration change node; specifically, the product of the above parameters can be used as the relevance score; that is, the formula for calculating the relevance score of the configuration change node is: C_change=exp(-|Δt| / τ) impact_score type_weight; where Δt is the time difference, || represents taking the absolute value, τ is the preset time window, type_weight represents the weight of configuration changes, and impact_score represents the impact on the score.

[0054] If the destination device has multiple configuration change records within a preset time window, the system calculates the relevance score for each record and takes the highest value as the configuration change relevance score for the candidate path. This score will be used as part of the overall score, weighted and summed with the path probability, for subsequent target path selection. If the destination device has no configuration change records within the preset time window, the configuration change relevance score for the candidate path can use a lower preset value.

[0055] In a specific embodiment, determining the target path based on the path probability and configuration change relevance score of the candidate paths includes: calculating a comprehensive score for the candidate paths by weighted summation based on the path probability and configuration change relevance score corresponding to the candidate paths; and selecting a predetermined number of candidate paths as the target paths in descending order of the comprehensive score. After calculating the path probability and configuration change relevance score for each candidate path, the target path, i.e., the path where the root cause of the fault is located, needs to be comprehensively determined. That is, the comprehensive score is calculated by weighted summation, and the formula for the comprehensive score can be: Score=α×P_GAT+β×C_change, where P_GAT is the path probability, C_change is the configuration change relevance score, α and β are weight coefficients, and α+β=1. Preferably, α is 0.7 and β is 0.3, that is, the weight of the path probability is higher than that of the configuration change relevance score, i.e., fault propagation is dominant. Then, all candidate paths are sorted in descending order of comprehensive score, and the predetermined number is preferably 3, that is, the top three candidate paths are selected as the target paths. In subsequent processing, the endpoint of the target path with the highest overall score is identified as the root cause of the failure. Simultaneously, selecting multiple target paths provides a ranking of potential root causes for maintenance personnel to consider. For example, if the confidence level of the highest-scoring path does not reach the system's preset confidence threshold, the next highest-scoring path can be examined as an alternative root cause hypothesis.

[0056] Furthermore, after determining the target path based on the path probability and configuration change relevance score of the candidate paths, the process also includes: if the number of target paths is less than a preset number, and / or the highest comprehensive score of the target path is less than a preset score, then the target reverse traversal hop count is increased and the search is restarted. After the agent determines the target path based on the comprehensive score, the system needs to determine whether the current search results meet the quality requirements. If not, a rollback mechanism is triggered. The check includes two conditions: first, whether the number of target paths is less than a preset number, preferably 3; second, whether the highest comprehensive score in the target path is less than a preset score. If either of the above conditions is met, the rollback mechanism is triggered. That is, assuming the agent performs a depth-first search with an initial reverse traversal hop count (maximum hop count set to 6) to generate a candidate path set. After the comprehensive score is calculated, the rollback mechanism is triggered, and the reverse traversal hop count is automatically increased, specifically according to a preset increase margin. For example, if the preset increase margin is 2 hops, then the new maximum hop count is set to 8 hops. Then, a depth-first search is performed again with the increased hop count upper limit, starting from the alarm node and traversing upstream to more distant nodes to generate a longer candidate path set. For example, the original search scope only reached the aggregation switch layer, but after increasing the hop count, it may extend to the core switch layer or even the egress router layer. After re-searching, the system recalculates the path probability and configuration change relevance score of each candidate path and redetermines the target path. If the conditions are still not met after increasing the hop count, the system triggers a manual intervention alarm, notifying network engineers to conduct manual troubleshooting. This allows for dynamic adjustment of the search scope, avoiding excessive searching and wasted computation during simple faults, while automatically expanding the scope during complex faults to ensure root cause coverage, thereby improving the adaptability and robustness of the solution.

[0057] In some embodiments, after determining the root cause of the network failure based on the target path, the method further includes: generating a root cause explanation text in a target format, along with the failure impact range, the confidence level corresponding to the explanation text, and a rollback script, based on the nodes included in the target path using a large language model. That is, the target path can also be passed as input to the large language model to generate a natural language explanation text containing the root cause device, propagation path, and remediation suggestions. The large language model can adopt the Qwen2.5-7B architecture, fine-tuned on the network operation and maintenance corpus, and has the ability to understand network topology, configuration changes, and failure propagation semantics. The input received by the model includes: root cause device identifier, change node information (change type, occurrence time, impact score), a list of intermediate devices on the path, alarm node information, and other structured data. The root cause explanation text output according to the target format can be: [Root cause device] caused [alarm type] due to [change type], propagated to [faulty terminal] via [device link list]. It also outputs the confidence level, rollback script, and / or estimated number of affected users. By generating root cause explanation text in the target format, along with information such as confidence level and rollback scripts, administrators can easily view and understand the information, thereby shortening the fault repair time.

[0058] Step S13: Based on the knowledge graph and historical alarm time sequence, use a deep learning model and graph attention network to predict the probability of fault propagation within a future preset time window.

[0059] The deep learning model and the graph attention network are jointly trained end-to-end using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss. This joint loss function simultaneously optimizes both root cause localization and propagation prediction tasks, enabling the shared graph attention network embedding to handle both fault root cause tracing and impact prediction.

[0060] Simultaneously or subsequently with root cause localization, a historical alarm time-series sequence within a preset time window is acquired. This sequence includes not only alarms occurring within this period but also the temporal order of different alarms. This time-series sequence is encoded using an attention-based deep learning model to extract temporal context embedding vectors. Simultaneously, a graph attention network is used to encode the current knowledge graph, obtaining embedding vectors for each node. Then, the temporal embedding vectors are fused with the node embedding vectors in the knowledge graph. Based on the fused features, the probability of fault propagation along edges in the knowledge graph within a future timeframe is predicted. A prediction result is generated based on this prediction; for example, a CPU overload alarm from the current core switch is predicted to propagate to adjacent routers with a probability of 0.83 within the next 10 minutes, and then to the downstream wireless AP cluster with a probability of 0.65. Furthermore, based on the predicted fault propagation probability and a preset propagation probability threshold, it can be determined whether the prevention triggering conditions are met. If so, a preset prevention strategy is automatically executed.

[0061] Through the above steps, automatic location of root causes of cross-device faults and proactive prediction of anomaly propagation are achieved in multi-vendor network environments. The intelligent agent combines path probability and configuration change correlation scores for root cause location, eliminating the need for manual rules and improving the accuracy and interpretability of root cause location. By integrating historical time series and graph structure for propagation prediction, network operation and maintenance are transformed from passive response to proactive early warning, improving operation and maintenance efficiency and capabilities.

[0062] In some embodiments, the step of predicting the probability of fault propagation within a future preset time window based on the knowledge graph and historical alarm time series includes the following steps: S401: Obtain the historical alarm timing sequence within the sliding time window.

[0063] S402: Encode the historical alarm time series using a deep learning model based on the attention mechanism to obtain the time series embedding vector.

[0064] The system acquires historical alarm time-series sequences within a sliding time window. For example, in a university campus network, alarm events within the past 30 minutes are collected. This time-series sequence is then encoded using a deep learning model based on an attention mechanism, such as the Transformer encoder. The Transformer encoder contains six self-attention layers, each with eight attention heads, and a feedforward network dimension of 512. After encoding, a time-series embedding vector Ht is extracted, with a dimension of 128. This vector represents the dynamic pattern of alarm events evolving over time.

[0065] S403: Encode the knowledge graph using a graph attention network to obtain the node embedding vector of the target node; the target node is the endpoint node of the edge to be predicted.

[0066] A graph attention network (GAT) is used to encode the knowledge graph, obtaining the node embedding vectors of the endpoint nodes of the edges to be predicted. GAT employs an 8-head attention mechanism, with an output dimension of 128 dimensions and a two-layer network, resulting in a 128-dimensional node embedding vector, Zupdated. The node embedding vector is generated by aggregating the features of the target node itself, the features of its neighboring nodes, and the features of the connecting edges, thus integrating node attribute information, topological structure information, and edge relationship information into the vector representation.

[0067] It should be noted that the prediction can be a global prediction based on the knowledge graph, that is, all nodes in the knowledge graph are the target nodes mentioned above, and the failure propagation probability of each edge in the knowledge graph is predicted subsequently; or it can be based on the alarm nodes to extract a part from the knowledge graph to obtain a sub-knowledge graph, and the nodes in the sub-knowledge graph are encoded, that is, the failure propagation probability of each edge in the sub-knowledge graph is predicted.

[0068] S404: Concatenate the temporal embedding vector with the node embedding vector to obtain the fused feature.

[0069] Then, the temporal embedding vector is concatenated with the embedding vector of the target node to obtain the fused feature. Specifically, the system concatenates the temporal embedding vector Ht with the embeddings of the two nodes Zupdated to obtain the fused feature, which simultaneously contains the dynamic information of the historical time series and the static dependency information of the graph structure.

[0070] S405: Based on the fusion features, predict the probability of fault propagation of the edge to be predicted in the knowledge graph within a future preset time window.

[0071] Finally, the failure propagation probability of the edge to be predicted within a preset time window is predicted based on the fused features. The preset time window is preferably 10 minutes. The system inputs the fused features into an edge-level probability predictor, such as a multilayer perceptron with a sigmoid activation function, and outputs a probability value between 0 and 1.

[0072] In a preferred embodiment, the deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss. That is, the deep learning model and the graph attention network are not simply concatenated after independent training, but are jointly trained end-to-end using a joint loss function, allowing the two models to optimize together during training. The joint loss function can be: L = L_root + γ × L_prop, where L_root is the root cause localization loss, L_prop is the propagation prediction loss, and γ is a balance coefficient, preferably γ ∈ [0.3, 0.5], γ = 0.4.

[0073] The root cause localization loss employs the cross-entropy loss function to measure the difference between the model-predicted root cause and the manually labeled true root cause. During training, for each training sample (i.e., each alarm event), the model outputs the probability distribution of each candidate path becoming the root cause, while the manually labeled root cause serves as the true label. The propagation prediction loss can use a binary classification cross-entropy loss function to measure the difference between the model-predicted propagation probability of each edge and the true propagation label. For each edge in the knowledge graph, the model outputs a propagation probability between 0 and 1, representing the likelihood of the fault propagating along that edge within a future time window. The true propagation label is automatically generated based on the historical alarm sequence.

[0074] During training, the two models are interconnected through a shared GAT embedding layer. Specifically, during forward propagation, the historical alarm time-series sequence is input into the Transformer encoder to obtain the temporal embedding Ht, and the knowledge graph is input into the GAT to obtain the node embedding Z. After fusion, the two are used for root cause classification and propagation prediction. After calculating L_root and L_prop respectively, they are weighted and summed to obtain the joint loss L_total. During backpropagation, the gradient flows to both the Transformer and GAT, updating the parameters of both models. This allows the GAT to consider both the optimization objective of root cause localization (making the attention weight of the path between the root cause node and the alarm node higher) and the optimization objective of propagation prediction (making the predicted probability of the edge that actually propagates closer to 1) when updating the node embedding.

[0075] In a preferred embodiment, encoding the knowledge graph using a graph attention network to obtain the node embedding vector of the target node includes: obtaining the temporal weights of the edges in the knowledge graph; the temporal weights are determined based on time decay; traversing the target nodes in the knowledge graph, and using the graph attention network to calculate the attention weights of the edges between the current node and its neighboring nodes; the attention weights characterize the degree of influence of the neighboring nodes on the current node; and obtaining the node embedding vector of the current node through weighted aggregation based on the node features of the current node, the node features of the neighboring nodes, and the edge features, temporal weights, and attention weights of the edges corresponding to the current node. During the process of encoding the knowledge graph using the graph attention network, it is necessary to generate an embedding vector for each node that integrates topological structure, temporal information, and edge features.

[0076] Specifically, we first obtain the temporal weights of the edges in the knowledge graph. These temporal weights are determined based on a time decay function, specifically: w_t = exp(-λ × Δt), where Δt is the time difference between the current moment and the last update time of the edge, and λ is the decay coefficient, which can be set to 0.1. The smaller the time difference, the higher the weight. Temporal weights ensure that recently occurring associations receive higher importance, while the influence of historical associations gradually diminishes.

[0077] Then, a graph attention network is used to calculate the attention weights between the current node and each of its neighboring nodes. The graph attention network first performs a linear transformation on the feature vectors of the current node and its neighboring nodes using a learnable weight matrix, then calculates the attention coefficients, and obtains the attention weights after Softmax normalization. These attention weights characterize the degree of influence of neighboring nodes on the current node; the higher the degree of mutual influence between two nodes, the higher the attention weight of the edge between them.

[0078] Finally, based on the node features of the current node, the node features of its neighbors, and the edge features, temporal weights, and attention weights of the connecting edges, a weighted aggregation is performed to obtain the node embedding vector of the current node. Edge features can include parameters such as bandwidth and latency. Specifically, for each neighbor node, its node features are concatenated with the edge features of its connecting edges, multiplied by the temporal weights and attention weights, and then the weighted features of all neighbor nodes are summed. Finally, an activation function is applied to obtain the updated embedding vector of the current node. Taking aggregation switch 1 as an example, its neighbor nodes include core switch 01 and access switch 02. The attention weight of core switch 01 is 0.7, and the temporal weight is 0.905; the attention weight of access switch 02 is 0.2, and the temporal weight is 0.950. Therefore, the node embedding vector of aggregation switch 1 will include more features from core switch 01 and its connecting edges, in addition to its own features. This embedding vector is subsequently used for path probability calculation in root cause localization and edge-level probability prediction in propagation prediction.

[0079] As can be seen from the above, in this embodiment, the agent selects candidate paths starting from the alarm node, and determines the target path where the fault is located by combining the path probability and the correlation score of configuration change. The root cause of the fault is located based on the probability of the fault propagating along the path and the impact of configuration change on the alarm, thereby improving the accuracy and efficiency of the root cause of the fault. At the same time, the deep learning model and graph attention network are used to fuse and encode the historical alarm time series and dynamic knowledge graph to predict the probability of fault propagation within the future time window, thereby realizing proactive early warning of anomalies and discovering potential risks in advance.

[0080] Taking a university dormitory as an example, 500 users in Building A of a university dormitory reported network latency. The Zabbix monitoring system generated a high latency alarm for the Ruijie wireless AP cluster, with the alarm code RUIJIE-WLAN-LATENCY-HIGH and a severity level of P2. After obtaining the alarm information, the Ruijie private alarm code is first standardized using a pre-built unified semantic ontology. Through similarity calculation, the semantic similarity between this alarm code and the standard field NET.WIRELESS.LATENCY.HIGH is 0.94, which is greater than the preset threshold of 0.82. Therefore, it is successfully mapped to the standard alarm type, and a standardized alarm node is generated and added to the knowledge graph. Then, the agent performs a reverse depth-first traversal starting from this alarm node; through graph query, the fault propagation path is obtained: Ruijie AP cluster, access switch HW-ACC-B3, aggregation switch H3C-AGG-01. During the traversal, the agent discovered that the aggregation switch H3C-AGG-01 had a BGP policy change record 63 minutes before the alarm occurred. The configuration snapshot hash value of this configuration change node is f3a2c1d9, the change type is MODIFY (weight 1.0), and the impact score predicted by the failure rate regression model is 0.81. Further, the agent calculates the path probability and configuration change relevance score for each candidate path. For the above path, the path probability P_GAT is calculated to be 0.891 using GAT; the change relevance score is calculated based on the time decay function: C_change=exp(-63 / 24)×0.81×1.0≈0.882. The comprehensive score is then calculated: Score=0.7×0.891+0.3×0.882≈0.888. This path has the highest score among all candidate paths and is identified as the target path. Finally, the agent inputs the target path node sequence into the large language model to generate the root cause explanation text: "The H3C-AGG-01 aggregation switch underwent a BGP community attribute modification at 14:23 (Change ID: CHG-20240115-0847), resulting in a change in uplink routing priority. This caused the latency from the dormitory AP cluster to the core route to rise to 87ms (P99), affecting 498 user terminals (Dormitory Building A, SLA-S2). Recommendation: Execute the configuration rollback script [rollback-f3a2c1d9.sh]..."

[0081] Taking cross-vendor anomaly propagation prediction as an example, an H3C-CORE-01 core switch generates a CPU utilization alarm with the alarm code NET.CPU.HIGH.UTIL, indicating a current CPU utilization of 78%. First, the system acquires a historical alarm time series within a sliding time window (30 minutes, 60 time steps), containing four records of CPU utilization fluctuations for the switch. A Transformer encoder is used to encode this time series, extracting the temporal context embedding vector. Then, a graph attention network is used to encode the knowledge graph, obtaining the node embedding vector for each node. For the link to be predicted, the temporal embedding vector is concatenated with the node embedding vectors of the nodes at both ends of the link to obtain a fused feature. Based on this fused feature, the probability of fault propagation for each link within the next 10 minutes is predicted. The predicted results are as follows: the propagation probability from H3C-CORE-01 to HW-ROUTER-01 is 0.83, which is greater than the preset threshold of 0.5; the propagation probability from HW-ROUTER-01 to RUIJIE-AP-Building B is 0.65, which is also greater than the threshold; the propagation probability from HW-ROUTER-01 to RUIJIE-AP-Teaching Building is 0.33, which is less than the threshold, so no warning is triggered. Because the propagation probability from H3C-CORE-01 to HW-ROUTER-01 exceeds the threshold, the system automatically triggers preventative strategies; for example, 30% of the traffic is rerouted from H3C-CORE-01 to the backup core switch H3C-CORE-02 to reduce the load on the main equipment. Actual monitoring shows that after 10 minutes, the CPU utilization of H3C-CORE-01 dropped to 62%, consistent with the predicted propagation results. Due to the advance traffic rerouting, users were completely unaware of the network interruption, and the interruption time was 0 seconds.

[0082] In some embodiments, the deep learning model and the graph attention network can be trained using a federated learning approach. This involves adding differential privacy noise to the gradients of the joint model of the deep learning model and the graph attention network, then uploading it to an aggregation server; receiving global model parameters returned by the aggregation server; these global model parameters being derived from multiple model gradients; and updating the local joint model based on these global model parameters. Through differential privacy federated learning, knowledge transfer and local model updates across multiple regions can be achieved without sharing original operational data, improving training efficiency and simplifying training complexity.

[0083] In practical applications, deep learning models and graph attention networks can be trained through federated learning. For example, in a certain regional network, universities A, B, and C have completed the deployment of their systems and accumulated sufficient historical data. Now, university D has been added. This university has new Huawei Wi-Fi 7AP devices, but only about 800 historical alarm data points, a small sample size, making it difficult to independently train a high-performance model. First, universities A, B, and C calculate the gradients of their respective GAT models locally. To protect data privacy, each university adds Gaussian noise before uploading the gradients. The noise parameters are set as follows: standard deviation σ = 0.01, gradient clipping norm c = 1.0. The calculated privacy budget ε = 0.8, which is less than the preset threshold of 1.0, meeting the differential privacy protection requirements. Each university then uploads the noisy gradients to the federated aggregation server.

[0084] Then, the federated aggregation server executes the FedAvg aggregation algorithm to perform a weighted average of the gradients uploaded by each university: ,in Let N be the number of samples from the k-th university, and N be the total number of samples. This represents the gradient uploaded by the k-th university; after aggregation, the global model parameters are obtained. Next, the server distributes the aggregated global model to University D. University D, based on this global model, performs local fine-tuning using approximately 800 new device samples to adapt the model to its own network environment characteristics. Finally, University D deploys the fine-tuned model for root cause analysis, achieving a cross-vendor fault root cause accuracy of 87.3%, approaching the average accuracy of 91.5% for universities A, B, and C. Through federated learning and joint model training, knowledge transfer and privacy protection are achieved across multiple universities.

[0085] Accordingly, this application also discloses a network fault analysis device, see [link to relevant documentation]. Figure 4 As shown, the device includes: The knowledge graph update module 11 is used to acquire target information corresponding to network devices, preprocess the target information, and dynamically update the knowledge graph based on the processed target information. The target information includes network device information, alarm information, configuration change information, link information, and service information. The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes. The preprocessing of the alarm information includes: encoding the fields to be converted in the alarm information into semantic vectors using a language model, and calculating the similarity between the vectors and the semantic vectors of standard fields in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, the field to be converted is replaced with the standard field corresponding to the maximum similarity. The fault root cause determination module 12 is used to select candidate paths starting from alarm nodes using an intelligent agent based on the knowledge graph, and determine the target path based on the path probability and configuration change relevance score of the candidate paths, and determine the network fault root cause based on the target path; the path probability represents the probability of the fault propagating along the candidate path, the configuration change relevance score represents the degree of correlation between the alarm and the configuration change, the configuration change relevance score is the highest score among all the relevance scores of the configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm, and the relevance score is determined based on the time decay factor, configuration change weight and configuration change impact score; The fault propagation prediction module 13 is used to predict the probability of fault propagation within a future preset time window based on the knowledge graph and historical alarm time sequence using a deep learning model and a graph attention network; the deep learning model and the graph attention network are obtained by end-to-end joint training through a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

[0086] As can be seen from the above, by using an intelligent agent to select candidate paths starting from alarm nodes and combining path probability with configuration change correlation scores to determine the target path where the fault is located, the root cause of the fault is located based on the probability of the fault propagating along the path and the impact of configuration changes on alarms, thereby improving the accuracy and efficiency of fault root cause location. At the same time, by using deep learning models and graph attention networks to fuse and encode historical alarm time series sequences and dynamic knowledge graphs, the probability of fault propagation within future time windows is predicted, thereby achieving proactive early warning of anomalies and enabling the early detection of potential risks.

[0087] In some specific embodiments, the knowledge graph update module 11 can be used to encode the fields to be converted in the alarm information into semantic vectors using a language model finely tuned on the network device document corpus; calculate the cosine similarity between the semantic vector and the semantic vector of the standard field in the pre-constructed unified semantic ontology; and generate a prompt if the maximum similarity is less than a preset threshold.

[0088] In some specific embodiments, the knowledge graph update module 11 can be used to calculate the hash value of the configuration snapshot in the configuration change information; determine the configuration change weight according to the configuration change type corresponding to the configuration change information; predict the configuration change impact score using a failure rate regression model based on the configuration change information; generate a configuration change node based on the hash value, the configuration change weight, and the configuration change impact score, and add it to the knowledge graph.

[0089] In some specific embodiments, the fault root cause determination module 12 may specifically include: The path probability calculation unit is used to determine the attention weight corresponding to each edge in each candidate path using a graph attention network before determining the target path based on the path probability of the candidate paths and the configuration change relevance score; the attention weight represents the fault propagation strength between the two nodes connected by the edge; and the path probability of the candidate path is obtained based on the attention weights of all edges in the candidate path.

[0090] In some specific embodiments, the fault root cause determination module 12 may specifically include: A configuration change relevance score calculation unit is used to query, based on the knowledge graph, the configuration change nodes associated with the device corresponding to the endpoint of the candidate path within a preset time window before determining the target path based on the path probability and configuration change relevance score of the candidate path; the configuration change node includes a configuration change weight and a configuration change impact score; a time decay factor is determined based on the time difference between the first time corresponding to the configuration change node and the second time corresponding to the alarm node; the relevance score of each configuration change node is calculated using the relevance score calculation formula based on the time decay factor, the configuration change weight, and the configuration change impact score; the highest relevance score is taken as the configuration change relevance score of the candidate path; The formula for calculating the relevance score is as follows: C_change=exp(-|Δt| / τ) impact_score type_weight; where Δt is the time difference, τ is the preset time window, type_weight is the configuration change weight, and impact_score is the impact score.

[0091] In some specific embodiments, the fault root cause determination module 12 may specifically include: The comprehensive scoring calculation unit is used to calculate the comprehensive score of the candidate path by weighted summation based on the path probability and configuration change relevance score corresponding to the candidate path. The target path determination unit is used to select a preset number of candidate paths in descending order of comprehensive score as the target path.

[0092] In some specific embodiments, the fault root cause determination module 12 may specifically include: The candidate path search unit is used to perform a depth-first search along the relationship edges between nodes, starting from the alarm node in the knowledge graph and traversing the target backwards by the number of hops; The device may further include: The re-search unit is used to re-search after determining the target path based on the path probability and configuration change relevance score of the candidate path, if the number of target paths is less than a preset number and / or the highest comprehensive score of the target path is less than a preset score, then increase the number of hops for the target reverse traversal and search again.

[0093] In some specific embodiments, the device may specifically include: The root cause explanation text generation unit is used to generate a root cause explanation text in a target format, along with the scope of the fault, the confidence level corresponding to the explanation text, and a rollback script, based on the nodes contained in the target path after determining the root cause of the network fault based on the target path and using a large language model.

[0094] In some specific embodiments, the device further includes: The model update unit is used to add differential privacy noise to the model gradient of the joint model of the deep learning model and the graph attention network and upload it to the aggregation server; receive the global model parameters returned by the aggregation server; the global model parameters are obtained based on multiple model gradients; and update the local joint model based on the global model parameters.

[0095] In some specific embodiments, the joint loss function is: L = L_root + γ·L_prop; where L_root is the root cause localization loss, L_prop is the propagation prediction loss, and γ is the balance coefficient.

[0096] In some specific embodiments, the fault propagation prediction module 13 may specifically include: The alarm acquisition unit is used to acquire the historical alarm timing sequence within the sliding time window; The first encoding unit is used to encode the historical alarm time sequence using a deep learning model based on an attention mechanism to obtain a time-series embedding vector. The second encoding unit is used to encode the knowledge graph using a graph attention network to obtain the node embedding vector of the target node; the target node is the endpoint node of the edge to be predicted. The feature concatenation unit is used to concatenate the temporal embedding vector with the node embedding vector to obtain fused features; The fault propagation probability prediction unit is used to predict the fault propagation probability of the edge to be predicted in the knowledge graph within a future preset time window based on the fusion features.

[0097] In some specific embodiments, the deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

[0098] In some specific embodiments, the second encoding unit is used to obtain the temporal weights of the edges in the knowledge graph; the temporal weights are determined based on time decay; traverse the target nodes in the knowledge graph, and use a graph attention network to calculate the attention weights of the edges between the current node and its neighboring nodes; the attention weights characterize the degree of influence of the neighboring nodes on the current node; based on the node features of the current node, the node features of the neighboring nodes, and the edge features, temporal weights, and attention weights of the edges corresponding to the current node, the node embedding vector of the current node is obtained by weighted aggregation.

[0099] Furthermore, this application also discloses an electronic device, see [link to relevant documentation]. Figure 5 As shown, the content in the figure should not be considered as any limitation on the scope of use of this application.

[0100] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network fault analysis method disclosed in any of the foregoing embodiments.

[0101] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0102] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored on it include operating system 221, computer program 222 and data 223 including knowledge graph, etc., and the storage method can be temporary storage or permanent storage.

[0103] The operating system 221 manages and controls the various hardware devices on the electronic device 20 and the computer program 222 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the network fault analysis method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0104] Furthermore, this application also discloses a computer storage medium storing computer-executable instructions. When the computer-executable instructions are loaded and executed by a processor, they implement the network fault analysis method steps disclosed in any of the foregoing embodiments.

[0105] Furthermore, embodiments of this application also disclose a computer program product, including a computer program that, when executed by a processor, implements the network fault analysis method steps disclosed in any of the foregoing embodiments.

[0106] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0107] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0108] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0109] The foregoing has provided a detailed description of the network fault analysis method, apparatus, device, and storage medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A network fault analysis method, characterized in that, include: Obtain target information corresponding to network devices, preprocess the target information, and dynamically update the knowledge graph based on the processed target information; The target information includes network device information, alarm information, configuration change information, link information, and service information; The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes; wherein, the preprocessing of the alarm information includes: using a language model to encode the fields to be converted in the alarm information into semantic vectors, and calculating the similarity with the semantic vectors of standard fields in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, the fields to be converted are replaced with the standard fields corresponding to the maximum similarity. Based on the knowledge graph, an agent selects candidate paths starting from alarm nodes, and determines the target path based on the path probability and configuration change relevance score of the candidate paths. The root cause of network failure is then determined based on the target path. The path probability represents the probability of a failure propagating along the candidate path, and the configuration change relevance score represents the degree of correlation between the alarm and the configuration change. The configuration change relevance score is the highest score among all relevance scores of configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm. The relevance score is determined based on the time decay factor, configuration change weight, and configuration change impact score. Based on the knowledge graph and historical alarm time series, a deep learning model and a graph attention network are used to predict the probability of fault propagation within a future preset time window. The deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

2. The network fault analysis method according to claim 1, characterized in that, The step of encoding the fields to be converted in the alarm information into semantic vectors using a language model and calculating their similarity with the semantic vectors of standard fields in a pre-constructed unified semantic ontology includes: The fields to be converted in the alarm information are encoded into semantic vectors using a language model finely tuned on a network device document corpus. Calculate the cosine similarity between the semantic vector and the semantic vector of a standard field in a pre-constructed unified semantic ontology; If the maximum similarity is less than a preset threshold, a prompt will be generated.

3. The network fault analysis method according to claim 1, characterized in that, The preprocessing of the configuration change information includes: Calculate the hash value of the configuration snapshot in the configuration change information; The configuration change weight is determined based on the configuration change type corresponding to the configuration change information. Based on the configuration change information, the impact score of the configuration change is predicted using a failure rate regression model. Accordingly, the knowledge graph is dynamically updated based on the processed target information, including: Based on the hash value, the configuration change weight, and the impact score of the configuration change, a configuration change node is generated and added to the knowledge graph.

4. The network fault analysis method according to claim 1, characterized in that, Before determining the target path based on the path probability and configuration change relevance score of candidate paths, the following steps are also included: A graph attention network is used to determine the attention weight corresponding to each edge in each candidate path; the attention weight represents the fault propagation strength between the two nodes connected by the edge. The path probability of a candidate path is obtained based on the attention weights of all edges in the candidate path.

5. The network fault analysis method according to claim 1, characterized in that, Before determining the target path based on the path probability and configuration change relevance score of candidate paths, the following steps are also included: Based on the knowledge graph, query the configuration change nodes associated with the device corresponding to the endpoint of the candidate path within a preset time window; the configuration change nodes include configuration change weight and configuration change impact score; The time decay factor is determined based on the time difference between the first time corresponding to the configuration change node and the second time corresponding to the alarm node; Based on the time decay factor, the configuration change weight, and the configuration change impact score, a relevance score is calculated for each configuration change node using the relevance score calculation formula; wherein, the relevance score calculation formula is: C_change=exp(-|Δt| / τ) impact_score type_weight; where Δt is the time difference, τ is the preset time window, type_weight is the configuration change weight, and impact_score is the impact score; The highest relevance score will be used as the configuration change relevance score for the candidate path.

6. The network fault analysis method according to claim 1, characterized in that, The process of determining the target path based on the path probability and configuration change relevance score of candidate paths includes: Based on the path probability and configuration change relevance score corresponding to the candidate path, a comprehensive score of the candidate path is calculated by weighted summation; A predetermined number of candidate paths are selected from the highest to the lowest comprehensive scores and used as the target paths.

7. The network fault analysis method according to claim 1, characterized in that, The process of selecting candidate paths starting from alarm nodes includes: Starting from the alarm node in the knowledge graph, the candidate path is obtained by traversing the target backwards by the number of hops and performing a depth-first search along the relationship edges between nodes. After determining the target path based on the path probability and configuration change relevance score of the candidate paths, the process also includes: If the number of target paths is less than the preset number, and / or the highest comprehensive score of the target path is less than the preset score, then the number of hops for the reverse traversal of the target is increased and the search is restarted.

8. The network fault analysis method according to claim 1, characterized in that, After determining the root cause of the network failure based on the target path, the process further includes: Based on the nodes contained in the target path, a root cause explanation text in the target format is generated using a large language model, along with the scope of the fault impact, the confidence level corresponding to the explanation text, and the rollback script.

9. The network fault analysis method according to claim 1, characterized in that, Also includes: The model gradient of the joint model of the deep learning model and the graph attention network is uploaded to the aggregation server after adding differential privacy noise. Receive global model parameters returned by the aggregation server; the global model parameters are obtained based on multiple model gradients; Update the local joint model based on the global model parameters.

10. The network fault analysis method according to claim 1, characterized in that, The joint loss function is: L = L_root + γ·L_prop; where L_root is the root cause localization loss, L_prop is the propagation prediction loss, and γ is the balance coefficient.

11. The network fault analysis method according to any one of claims 1 to 10, characterized in that, The step of predicting the probability of fault propagation within a preset time window based on the knowledge graph and historical alarm time series, using a deep learning model and graph attention network, includes: Obtain the historical alarm timing sequence within the sliding time window; Historical alarm time-series sequences are encoded using a deep learning model based on an attention mechanism to obtain time-series embedding vectors; The knowledge graph is encoded using a graph attention network to obtain the node embedding vector of the target node; the target node is the endpoint node of the edge to be predicted. The temporal embedding vector is concatenated with the node embedding vector to obtain the fused feature; Based on the fusion features, predict the probability of fault propagation of the edge to be predicted in the knowledge graph within a future preset time window.

12. The network fault analysis method according to claim 11, characterized in that, The process of encoding the knowledge graph using a graph attention network to obtain the node embedding vector of the target node includes: Obtain the temporal weights of the edges in the knowledge graph; the temporal weights are determined based on time decay. Traverse the target nodes in the knowledge graph and use a graph attention network to calculate the attention weights of the edges between the current node and its neighboring nodes; the attention weights characterize the degree of influence of the neighboring nodes on the current node; Based on the node features of the current node, the node features of the neighboring nodes, and the edge features, temporal weights, and attention weights of the edges corresponding to the current node, the node embedding vector of the current node is obtained through weighted aggregation.

13. A network fault analysis device, characterized in that, include: The knowledge graph update module is used to obtain target information corresponding to network devices, preprocess the target information, and dynamically update the knowledge graph based on the processed target information. The target information includes network device information, alarm information, configuration change information, link information, and service information; The knowledge graph includes device nodes, alarm nodes, configuration change nodes, link nodes, and service nodes; wherein, the preprocessing of the alarm information includes: using a language model to encode the fields to be converted in the alarm information into semantic vectors, and calculating the similarity with the semantic vectors of standard fields in a pre-constructed unified semantic ontology; if the maximum similarity is not less than a preset threshold, the fields to be converted are replaced with the standard fields corresponding to the maximum similarity. The fault root cause determination module is used to select candidate paths starting from alarm nodes using an intelligent agent based on the knowledge graph, and determine the target path based on the path probability and configuration change relevance score of the candidate paths, and determine the network fault root cause based on the target path; the path probability represents the probability of the fault propagating along the candidate path, the configuration change relevance score represents the degree of correlation between the alarm and the configuration change, the configuration change relevance score is the highest score among all the relevance scores of the configuration change nodes associated with the endpoint device of the candidate path within a preset time window before the alarm, and the relevance score is determined based on the time decay factor, configuration change weight, and configuration change impact score; The fault propagation prediction module is used to predict the probability of fault propagation within a preset time window based on the knowledge graph and historical alarm time series, using a deep learning model and a graph attention network. The deep learning model and the graph attention network are obtained through end-to-end joint training using a joint loss function, which is a weighted sum of root cause localization loss and propagation prediction loss.

14. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the network fault analysis method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein the computer programs, when executed by a processor, implement the network fault analysis method as described in any one of claims 1 to 12.

Images