Fault handling method, apparatus, device, medium, and program product

Abstract

This invention discloses a fault handling method, apparatus, device, medium, and program product. It includes: acquiring original fault source data and determining a valid association dataset based on the original fault source data; determining a set of similar cases from a dynamic knowledge base based on the valid association dataset; determining core fault features based on the valid association dataset and the set of similar cases, and determining the root cause of the fault based on the core fault features, the valid association dataset, and a set of candidate models; determining a target repair scheme based on the root cause and historical fault cases; and executing the target repair scheme to handle the fault source when the validity of the rules corresponding to the target repair scheme meets a preset feasibility threshold. This method better meets the fault source repair needs and ensures the effectiveness of the target repair scheme in repairing the fault source, avoiding the decrease in decision accuracy caused by a long-term static knowledge system that cannot adapt to complex fault scenarios.

Description

Technical Field

[0001] This invention relates to the field of computer operation and maintenance technology, and in particular to a fault handling method, apparatus, equipment, medium and program product. Background Technology

[0002] With the rapid development of computer technology, maintaining stable system operation often requires comprehensive analysis of alarm information from different modules or sources to achieve intelligent fault management of computer systems. In intelligent alarm and fault handling based on intelligent agents and multi-model collaboration, the number of alarms to be processed is often reduced by performing preliminary aggregation, noise reduction, and redundancy filtering, thereby improving operational efficiency.

[0003] The system typically performs structured parsing on the collected raw alarms to extract core attributes, laying the foundation for subsequent processing. Then, it employs traditional clustering algorithms such as K-Means or grouping measurements based on manually preset rules to merge similar alarm events, enabling batch processing of similar alarms. For alarm noise reduction, a combination of static threshold filtering and manually labeled rules is usually used to evaluate non-critical alarms to avoid interfering with operations and maintenance personnel.

[0004] However, the above-mentioned operation and maintenance procedures for computer systems all rely on manually configured rules and fixed algorithm parameters, which are difficult to adapt to the dynamic alarm mode under the rapid iteration of business. They also have limited ability to handle complex correlation alarms across types and levels, making it difficult to meet the increasingly complex alarm and fault handling needs of computer systems. Summary of the Invention

[0005] This invention provides a fault handling method, apparatus, device, medium, and program product that associates collected multi-type fault source data with operation and maintenance requirements, determines the root cause of the fault based on a dynamically updated knowledge base, and determines a repair plan based on the determined root cause. By executing the repair plan, the fault source is processed. By fully combining the correlation between different data, the decision-making accuracy and processing capability for complex fault scenarios are improved, and the alarm fault handling needs of complex computer systems are better met.

[0006] In a first aspect, embodiments of the present invention provide a fault handling method, including: Obtain the original fault source data and determine the valid associated dataset based on the original fault source data; The set of similar cases is determined from the dynamic knowledge base based on the effective association dataset; The core fault characteristics are determined based on the effective association dataset and the set of similar cases, and the root cause of the fault is determined based on the core fault characteristics, the effective association dataset, and the set of candidate models. The target repair plan is determined based on the root cause of the fault and historical fault cases. When the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold, the target repair plan is executed to deal with the fault source.

[0007] Secondly, embodiments of the present invention also provide a fault handling device, comprising: The dataset determination module is used to acquire the original fault source data and determine the valid associated datasets based on the original fault source data. The similarity set determination module is used to determine the set of similar cases from the dynamic knowledge base based on the effective association dataset; The root cause determination module is used to determine the core fault features based on the effective association dataset and the set of similar cases, and to determine the root cause of the fault based on the core fault features, the effective association dataset and the set of candidate models. The fault handling module is used to determine the target repair plan based on the root cause of the fault and historical fault cases, and execute the target repair plan to handle the fault source when the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold.

[0008] Thirdly, embodiments of the present invention also provide a fault handling device, comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to implement the fault handling method of any embodiment of the present invention.

[0009] Fourthly, embodiments of the present invention also provide a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the fault handling method of any embodiment of the present invention.

[0010] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program, which, when executed by a processor, is used to perform the fault handling method of any embodiment of the present invention.

[0011] This invention provides a fault handling method, apparatus, device, medium, and program product. The method involves acquiring original fault source data and determining a valid association dataset based on this data; determining a set of similar cases from a dynamic knowledge base based on the valid association dataset; determining core fault features based on the valid association dataset and the set of similar cases; determining the root cause of the fault based on the core fault features, the valid association dataset, and a set of candidate models; determining a target repair plan based on the root cause and historical fault cases; and executing the target repair plan to process the fault source when the validity of the rules corresponding to the target repair plan meets a preset feasibility threshold. By employing the above technical solution, when multiple types of original fault source data are acquired, the association relationships between various types of original fault source data are first determined. Based on these association relationships, valid data is determined to construct a valid association dataset. Using this valid association dataset as a basis, combined with a dynamically updated dynamic knowledge base, the set of similar cases and the root cause corresponding to the fault source are determined. Finally, the fault source is repaired using a target repair plan determined based on the root cause and historical fault cases that meets the fault source repair requirements and has effective execution. Since the determination of the root cause of the fault and the repair plan are based on a valid association dataset that links various original fault source data and ensures its effectiveness, it can eliminate the situation where the root cause is not accurately determined due to interference from false associations when directly using fault data. At the same time, based on a dynamically updated dynamic knowledge base, the knowledge in the dynamic knowledge base and various reasoning data used in the fault handling process can be continuously updated, avoiding the decrease in decision accuracy caused by the knowledge system being static for a long time and unable to adapt to complex fault scenarios, thus better meeting the fault handling needs for alarms of complex computer systems.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 A flowchart of a fault handling method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of a fault handling method provided in Embodiment 2 of the present invention; Figure 3This is a schematic diagram of the structure of a fault handling device provided in Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of a fault handling device provided in Embodiment 4 of the present invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0016] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0017] Example 1 Figure 1 This is a flowchart illustrating a fault handling method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations involving root cause determination and fault repair for complex, cross-level, and cross-type correlated alarms in computer systems. The method can be executed by a fault handling device, which can be implemented in software and / or hardware and can be configured within a fault handling equipment. Optionally, the fault handling equipment can be an intelligent agent, laptop, desktop computer, or smart tablet, etc., and this embodiment of the present invention does not impose any limitations on this.

[0018] like Figure 1 As shown in the figure, the fault handling method provided by the embodiment of the present invention specifically includes the following steps: S101. Obtain the original fault source data and determine the effective associated dataset based on the original fault source data.

[0019] In this embodiment, the raw fault source data can be specifically understood as the raw data directly collected from the point of failure in the computer system. It is understood that the raw fault source data can be presented in different forms depending on the data collection method and type. For example, the raw fault source data may include text data, time-series data, topology data, and visual data, etc.; wherein, text data may include service names, error logs with error codes, and operation records, etc.; time-series data may include timestamped Central Processing Unit (CPU) utilization and response time, etc.; topology data may include link diagrams recording service dependencies, etc.; visual data may include screenshots of error interfaces and operation and maintenance videos, etc., and this embodiment of the invention does not impose limitations on these aspects.

[0020] In this embodiment, the effective association dataset can be specifically understood as a set of data obtained after cleaning the original fault source data, associating it with the fault-causing entities, and verifying the association, and which is determined to have a strong association with each other and can be used for subsequent fault root cause localization.

[0021] Specifically, when a fault alarm occurs in a computer system, to address the system fault promptly and accurately with minimal manual intervention, the first step is to acquire fault-related data from the location of the fault, using this data as the original fault source data. Furthermore, to break down the isolation between different types of original fault source data, effectively combine information for fault analysis, and eliminate potentially erroneous information, different types of original fault source data can be correlated. Only the data with strong correlation and causality, correctly pointing to the fault, can be extracted as the effective correlated dataset.

[0022] S102. Determine the set of similar cases from the dynamic knowledge base based on the effective association dataset.

[0023] In this embodiment, the dynamic knowledge base can be specifically understood as a vector database that stores information such as historical fault cases, solutions, and knowledge chains composed of historical entities and related relationships, and can be updated and adjusted in real time based on newly discovered faults during use. Optionally, the dynamic knowledge base can exist as a historical knowledge storage module for the intelligent agent and serve as the basis for providing knowledge retrieval capabilities.

[0024] In this embodiment, the set of similar cases can be specifically understood as a set of historical fault cases and related information that are similar to the faults corresponding to the effective associated dataset, extracted from the dynamic knowledge base.

[0025] Specifically, features are extracted from the data contained in the effective associated dataset to construct retrieval vectors that can be used for retrieval in the dynamic knowledge base. The retrieval vectors are then used to retrieve knowledge vectors in the dynamic knowledge base that contain information such as historical failure cases, root causes, solutions, and historical entities. The set of multiple knowledge vectors with high similarity that meet the output requirements is determined as the set of similar cases identified in the dynamic knowledge base.

[0026] S103. Determine the core fault characteristics based on the effective association dataset and the set of similar cases, and determine the root cause of the fault based on the core fault characteristics, the effective association dataset and the set of candidate models.

[0027] In this embodiment, the core fault features can be specifically understood as features obtained by extracting core information related to fault determination from the effective associated dataset and similar case set. The core fault features may include information related to fault type, services involved, and abnormal values ​​of indicators.

[0028] In this embodiment, the candidate model set can be understood as a set of specialized models that may be used for analyzing and reasoning about fault information, tailored to different types of data. For example, the candidate model set may include topology thrust models, log analysis models, indicator anomaly models, and visual processing models, etc., and this embodiment of the invention does not impose any limitations on this.

[0029] In this embodiment, the root cause of the fault can be specifically understood as the fundamental cause of the fault by combining historical fault knowledge and the characteristics of the current fault.

[0030] Specifically, based on the fault-related information contained in the effective associated dataset and the set of similar cases, feature information is extracted to obtain core fault features. Based on the core fault features, a model that can be used to determine the root cause of this fault is selected from the set of candidate models that can be supported by fault handling. The core fault features and the effective associated dataset are combined as the input of the selected model. The output of each model is analyzed to determine the root cause of this fault.

[0031] S104. Determine the target repair plan based on the root cause of the fault and historical fault cases, and execute the target repair plan to handle the fault source when the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold.

[0032] In this embodiment, historical failure cases can be specifically understood as failure cases obtained from a dynamic knowledge base that correspond to the root cause of the failure and contain solutions to the failure caused by the root cause in historical situations.

[0033] In this embodiment, the target repair scheme can be specifically understood as the scheme that is most capable of repairing the fault caused by the root cause, determined by comprehensively analyzing the degree of matching between different schemes in the root cause of the fault and the handling of the fault caused by the root cause in historical fault cases.

[0034] In this embodiment, rule validity can be specifically understood as the ability score of the system to correctly execute the converted execution rule after the target repair plan is converted into a system-executable rule. The preset feasibility threshold can be specifically understood as a feasibility value pre-set according to actual conditions to determine whether the generated rule can be correctly executed in the computer system.

[0035] Specifically, based on the matching degree between solutions and root causes of historical failures, target repair solutions that can be used to resolve failures are determined. These target repair solutions are then converted into rules that can be executed by the computer system. The validity of the rules corresponding to the target repair solutions in the system is then determined. When the validity of the determined rules meets a preset feasibility threshold, the target repair solution can be considered to be applicable to the computer system to resolve the failure corresponding to the original failure source data. At this point, the target repair solution can be executed to process the failure source corresponding to the original failure source data, thus completing the repair of the failure source.

[0036] The technical solution of this embodiment involves acquiring original fault source data and determining a valid association dataset based on it; determining a set of similar cases from a dynamic knowledge base based on the valid association dataset; determining core fault features based on the valid association dataset and the set of similar cases; determining the root cause of the fault based on the core fault features, the valid association dataset, and a set of candidate models; determining a target repair plan based on the root cause and historical fault cases; and executing the target repair plan to process the fault source when the validity of the rules corresponding to the target repair plan meets a preset feasibility threshold. By adopting the above technical solution, when multiple types of original fault source data are acquired, the association relationships between various types of original fault source data are first determined, and a valid association dataset is constructed based on the association relationships to determine the valid data. Based on the valid association dataset, and combined with a dynamically updated dynamic knowledge base, the set of similar cases and the root cause corresponding to the fault source are determined. Finally, the fault source is repaired using a target repair plan determined based on the root cause and historical fault cases that meets the fault source repair requirements and has execution effectiveness. Since the determination of the root cause of the fault and the repair plan are based on a valid association dataset that links various original fault source data and ensures its effectiveness, it can eliminate the situation where the root cause is not accurately determined due to interference from false associations when directly using fault data. At the same time, based on a dynamically updated dynamic knowledge base, the knowledge in the dynamic knowledge base and various reasoning data used in the fault handling process can be continuously updated, avoiding the decrease in decision accuracy caused by the knowledge system being static for a long time and unable to adapt to complex fault scenarios, thus better meeting the fault handling needs for alarms of complex computer systems.

[0037] Example 2 Figure 2This is a flowchart of a fault handling method provided in Embodiment 2 of the present invention. The technical solution of this embodiment further optimizes the above-mentioned optional technical solutions. Based on the entity labels of various types of data in the original fault source data, it completes the association of these data types, constructing an associated dataset with entity labels as the core. Then, by performing causal correlation, completeness, and basic decision-making judgments on the data in the associated dataset, a valid associated dataset that can be used as the basis for determining subsequent fault handling solutions is determined. Furthermore, by extracting features from the various types of data contained in the valid associated dataset, a retrieval vector for searching in a dynamic knowledge base is constructed based on the extracted feature vectors. Based on the cosine similarity between the retrieval vector and each knowledge vector in the dynamic knowledge base, a set of similar cases is obtained by filtering from the dynamic knowledge base. Subsequently, based on the core fault features identified from the effective correlation dataset and similar case set, a collaborative model combination suitable for fault root cause determination is selected from the candidate model set. Weights are assigned to each collaborative model within the combination. Based on each collaborative model, a candidate root cause set is determined according to the core fault features and effective correlation data. Furthermore, depending on the scenario adaptability between the collaborative model and the scenario corresponding to the core fault features, the most likely fault root cause is identified from among the candidate root causes. The target remediation plan based on the determined fault root cause then addresses the fault source. By fully integrating the correlations between different data sets, the decision-making accuracy and processing capabilities for complex fault scenarios are improved, better meeting the alarm fault handling needs of complex computer systems.

[0038] like Figure 2 As shown, the fault handling method provided in Embodiment 2 of the present invention specifically includes the following steps: S201. Obtain the original fault source data.

[0039] Understandably, after obtaining the original fault source data, data cleaning can be performed on the original fault source data to remove obvious abnormal and noisy data, thereby improving the accuracy of subsequent data processing.

[0040] S202. Based on the entity labels of various types of data in the original fault source data, construct an association dataset with entity labels as the core.

[0041] In this embodiment, the entity tag can be specifically understood as an identifier used to identify the object that generates various types of data in the original fault source data. For example, the entity tag may include service name, error code, fault instance identifier, and timestamp, etc., and this embodiment of the invention does not impose any limitations on this.

[0042] Specifically, since the original fault source data may contain fault data from various sources and of different types, and each type of fault data corresponds to a different generating object and has different entity labels, common entity labels can be extracted from different data. These common entity labels can then be aggregated to link different types of data with the same entity label, resulting in a related dataset centered on entity labels.

[0043] S203. When the data alignment of the associated dataset meets the preset alignment threshold, determine the strongly causal data in the associated dataset based on the causal strength of each pair of associated data in the associated dataset, and conduct an integrity assessment of the associated dataset to determine the integrity score of the associated dataset.

[0044] In this embodiment, data alignment can be specifically understood as an indicator of the degree of matching and association of various fault data in the associated dataset on the dimension with entity label as the core. It can be used to determine whether various types of data in the same associated dataset really point to the same fault, or an anomaly generated at the same time or by the same service.

[0045] In this embodiment, the preset alignment threshold can be understood as a threshold set in advance according to the actual situation, used to determine the index threshold of various types of data in the associated dataset that point to the same fault, or the same time or the same service.

[0046] In this embodiment, causal strength can be specifically understood as the indicator data used to determine whether the association between different types of data is caused by anomalies.

[0047] In this embodiment, integrity assessment can be specifically understood as an evaluation of the degree to which the data types contained in the associated dataset cover the data types contained in the original fault source data. Integrity score can be specifically understood as a score obtained through the integrity assessment of the associated dataset, used to evaluate the degree to which the data types contained in the associated dataset cover the data types in the original fault source data.

[0048] Specifically, a comprehensive data alignment calculation is performed on all types of data included in the correlated dataset. The calculated data alignment is then compared with a preset alignment threshold. If the data alignment is greater than or equal to the preset alignment threshold, the various types of data in the correlated dataset are considered successfully correlated. Effective data alignment requires proceeding to the stage of verifying the correlation between different types of data in the correlated dataset. At this point, two types of data with a correlation relationship in the correlated dataset are identified as a pair of correlated data. The causal strength of each pair of correlated data is calculated, and each pair is filtered using a preset causal strength threshold. Strong causal correlation data with a strong causal relationship is selected as the basis for subsequent fault location processing. Simultaneously, to ensure the comprehensiveness of the selected data in covering the scenario, a completeness assessment of the correlated dataset is performed, and the result of the completeness assessment is determined as the completeness score of the correlated dataset.

[0049] In some examples, to associate datasets Taking the associated entity label as L, and the associated dataset containing at least text, time series, topology, and visual data types as an example, the method for calculating the data alignment of various types of data in the associated dataset can be as follows: ,in, For indicator functions (i.e., data types x exist in...) If the value is 1, it is 0 otherwise. The data alignment value range is [0,1]. Taking a preset alignment threshold of 0.75 (i.e., at least 3 types of data are successfully associated) as an example, in... When the association is successful, it can be considered that the various types of data in the associated dataset are successfully associated. However, the association of the associated dataset needs to be verified.

[0050] Following the example above, possible associations within the associated dataset include: associations between text data and time-series data, associations between time-series data and topological data, and associations between topological data and visual data. Each of these associations can constitute a pair of associated data. Taking the pair of associated data consisting of time-series data and topological data as an example for calculating causal strength, the calculation method can be expressed as follows: ,in, Indicates abnormal events in time-series indicators. This indicates that the two services have a topological dependency. This indicates no topological dependency; P(a|b) is the conditional probability (i.e., the probability of a occurring given that b has occurred). The causal strength ranges from [0,1], with a larger value indicating stronger causality in the associated data. Optionally, a causal strength threshold of 0.6 can be assumed, in which case data with a causal strength greater than or equal to 0.6 in the associated dataset can be identified as strongly causally associated data.

[0051] Following the example above, to ensure comprehensive fault coverage of the data used for subsequent root cause analysis and solution decision-making, the integrity of the associated dataset needs to be evaluated. Taking the original fault source data as containing the four types of data (text, metric, topology, and visual) as an example, the integrity score of the associated dataset can be calculated as follows: Where E represents the fault event object corresponding to the associated dataset, The integrity value is 1 when the data type is x (i.e., the value is 1 when the data exists and 0 when it is missing).

[0052] S204. Extract error log features, time series features, and topological features from the data with strong causal relationships, and determine the comprehensive decision score based on the error log features, time series features, and topological features.

[0053] In this embodiment, error log features can be specifically understood as features used to indicate the severity of error codes in the error log. For example, error log features can be represented as follows: This can include a fatal error "E100" corresponding to 0.9, a warning "W200" corresponding to 0.4, etc., with a value range of [0,1].

[0054] In this embodiment, a time series diagram can be specifically understood as a feature used to indicate the comprehensive degree of anomalies in indicators. For example, a time series diagram can be represented as... The calculation formula can be "abnormal duration (minutes) × index exceeding threshold multiple ÷ 10", such as "response time exceeding threshold by 2 times and lasting for 5 minutes" corresponds to 2×5÷10=1.0, with a value range of [0,1].

[0055] In this embodiment, topological features can be specifically understood as the sum of weights of service-dependent links. For example, topological features can be represented as follows: Assuming the service dependency link is svc-A→svc-B→svc-C, the sum of the weights of each node in the link can be used as the topological feature of the service. The value range of the topological feature is [0,1].

[0056] Specifically, based on the content corresponding to various types of data in the strongly causal data, error log features, time series features, and topological features are extracted from them. These features are then substituted into a pre-constructed formula for calculating the comprehensive decision score, thereby obtaining the comprehensive decision score for the strongly causal data.

[0057] For example, the formula for calculating the comprehensive decision score can be expressed as: The weights of each feature can be determined based on the historical decision accuracy and can be adjusted according to the actual situation. As shown in the formula above, the error log feature, i.e. the text type feature, can be considered to have the strongest directionality, so the weight set is the highest.

[0058] S205. The associated datasets whose integrity scores meet the preset integrity threshold and whose comprehensive decision scores meet the preset decision threshold are determined as valid associated datasets.

[0059] In this embodiment, the preset integrity threshold can be understood as a threshold set in advance according to the actual situation to determine whether the comprehensiveness of the data coverage contained in the associated dataset meets the requirements. For example, the preset integrity threshold can be 0.6.

[0060] In this embodiment, the preset decision threshold can be understood as a scoring threshold set in advance according to the actual situation to determine whether the selected strong causal correlation data can accurately determine the fault. For example, the preset decision threshold can be 0.7, and when the comprehensive decision score does not meet the preset decision threshold, it can be considered that there is missing data in the correlation dataset. At this time, S201 can be returned to supplement the original fault source data and subsequent processing can be performed in sequence.

[0061] Specifically, when the integrity score meets the preset integrity threshold and the comprehensive decision score meets the preset decision threshold, the associated dataset can be considered to meet the requirements for both the coverage integrity and fault location accuracy of the fault, and is considered valid data that can be used for subsequent processing. At this time, the associated dataset that meets the above two conditions can be determined as a valid associated dataset.

[0062] S206. Extract features from each type of data included in the effective associated dataset, and construct a retrieval vector based on the feature vectors of each type of data.

[0063] In this embodiment, the retrieval vector can be specifically understood as a feature vector that is consistent with the knowledge data storage format in the dynamic knowledge base and can be used to retrieve data from the dynamic knowledge base.

[0064] Specifically, for each type of data included in the effective associated dataset, a feature extraction model suitable for each type of data representation is used to extract features, resulting in feature vectors corresponding to each type of data. These feature vectors are then integrated into a form that conforms to the knowledge storage format in the dynamic knowledge base, serving as retrieval vectors.

[0065] It is understandable that different methods will be used for feature extraction for different types of data. For example, for text-type data, which can be understood as text log data, semantics can be encoded through a bidirectional Transformer model to extract entity and relation features, and then the corresponding feature vector can be obtained by linear mapping to a 512-dimensional text feature vector. For topological data, the graph structure (such as node, edge, and weight information) can be analyzed, and then the structural features can be learned through a graph neural network to generate a 512-dimensional topological feature vector as the corresponding feature vector. For visual data, such as operation videos, segments can be extracted from the operation video according to a preset extraction frequency, and the visual features of each frame can be extracted through a convolutional neural network. After processing by a time-series model such as a Long Short-Term Memory network model, they can be integrated into a 512-dimensional video feature vector as the corresponding feature vector. The above are only some feature extraction methods, and the embodiments of this invention do not limit the feature extraction methods for various types of data.

[0066] Optionally, in order to enable the dynamic knowledge base used for storing indication information to be dynamically updated in real time during fault handling, the following steps are included before constructing the retrieval vector based on the feature vectors of various types of data: The 512-dimensional feature vectors obtained by extracting features from each type of data included in the effective associated dataset are stored in a dynamic knowledge base. Optionally, the dynamic knowledge base can provide feedback upon completion of storage; if the feedback fails, the required feature vectors can be stored repeatedly. This embodiment of the invention does not impose any limitations on this.

[0067] Optionally, in order to enable the dynamic knowledge base used for storing indication information to be dynamically updated in real time during fault handling, the following steps are included before constructing the retrieval vector based on the feature vectors of various types of data: Obtain valid original fault source data corresponding to the valid associated dataset, and extract entity features from the valid original fault source data to determine the entity feature vector; The similarity between the entity feature vector and each knowledge vector in the dynamic knowledge base is determined by matching the similarity between the entity feature vector and each knowledge vector. New knowledge vectors are constructed based on knowledge vectors and entity feature vectors whose similarity exceeds a preset similarity threshold, and the new knowledge vectors are stored in a dynamic knowledge base.

[0068] In this embodiment, valid original fault source data can be specifically understood as data in the original fault source data that corresponds to the data type in the valid associated dataset. The preset similarity threshold can be specifically understood as a threshold pre-set according to actual conditions to indicate a match or association between entity feature vectors and knowledge vectors in the dynamic knowledge base.

[0069] Specifically, after identifying the valid associated dataset, data corresponding to the data type of the valid associated dataset is extracted from the original fault source data as valid original fault source data. Features of core entities (such as fault type, involved services, and key indicators) in the valid original fault source data are extracted to obtain entity feature vectors corresponding to the valid original fault source data. The similarity of these entity feature vectors is calculated and compared with the knowledge vectors already stored in the dynamic knowledge base. When the similarity exceeds a preset similarity threshold, the entity feature vector is considered to match the knowledge vectors in the dynamic knowledge base. At this point, based on the knowledge vectors and entity feature vectors exceeding the preset similarity threshold, a new knowledge vector containing information related to the entity feature vector is constructed, and this new knowledge vector is stored in the dynamic knowledge base to dynamically update and enrich the dynamic knowledge base.

[0070] For example, the similarity between entity feature vectors and each knowledge vector can be determined as follows: ,in, For entity feature vectors, The knowledge vectors are stored in the dynamic knowledge base. In the above formula, the numerator is the dot product of the two vectors, the denominator is the product of the final fields of the two vectors, and the similarity value ranges from [0,1].

[0071] Optionally, assuming a preset similarity threshold of 0.8, when a knowledge vector with a similarity greater than or equal to 0.8 is determined, the historical entities and related relationships ("fault-root cause" and "root cause-solution") corresponding to the knowledge vector can be extracted from the dynamic knowledge base. Then, the fault corresponding to the entity feature vector is associated with the aforementioned historical entities and related relationships to construct a new knowledge vector of "new fault-root cause-solution," and this new knowledge vector is stored in the dynamic knowledge base to complete the dynamic update and enrichment of the dynamic knowledge base. Optionally, the dynamic knowledge base can provide feedback upon completion of storage. If the feedback fails, the required new knowledge vector can be repeatedly stored. This embodiment of the invention does not impose any limitations on this.

[0072] S207. Based on the cosine similarity between the retrieval vector and each knowledge vector in the dynamic knowledge base, determine the candidate knowledge vector.

[0073] Specifically, the cosine similarity between the retrieved vector and each knowledge vector in the dynamic knowledge base is calculated sequentially, and the knowledge vectors with the highest cosine similarity ranking are selected as candidate knowledge vectors for subsequent screening and application. For example, the top 20 knowledge vectors with the highest cosine similarity ranking can be selected as candidate knowledge vectors.

[0074] It is understandable that the method for calculating cosine similarity in this step is consistent with the method for determining the similarity between entity feature vectors and knowledge vectors, and will not be repeated here.

[0075] S208. The candidate knowledge vectors are weighted and sorted according to business type and time decay. Based on the sorting results, a preset number of candidate knowledge vectors are selected from each candidate knowledge vector to construct a set of similar cases.

[0076] Specifically, the selection of retrieval results is influenced by factors such as whether the business corresponding to the knowledge vector belongs to the core business and the distance between the time of the fault occurrence in the knowledge vector and the current time. Therefore, after identifying multiple candidate knowledge vectors, they can be sorted according to their business type and time decay. A predetermined number of candidate knowledge vectors with the highest ranking are selected as the knowledge vectors with the highest relevance to the retrieval vector and can be extracted. The fault cases corresponding to these vectors are then used as similar cases to the fault corresponding to the retrieval vector, thus constructing a set of similar cases.

[0077] For example, this section provides a method for calculating the weighted score of each candidate knowledge vector based on business type and time decay. The specific calculation method is as follows: ,in, Based on similarity, The weight is the business domain weight (e.g., 0.2 for core business and -0.1 for non-core business). The time decay weight is used (e.g., 0.3 for the last three months and -0.2 for more than one year).

[0078] In this embodiment of the invention, by adopting the above-mentioned retrieval method, the retrieval response time can be less than one second, and the knowledge reuse rate in the dynamic knowledge base can be improved, making the set of similar cases provided by the dynamic knowledge base for root cause localization more accurate.

[0079] S209. Extract and normalize the core features of the effective associated dataset and the set of similar cases to determine the core fault features.

[0080] Specifically, the effective associated dataset and the set of similar cases corresponding to the effective associated dataset are treated as a whole to extract the core features of the core entities (such as fault type, design service and abnormal indicator value), and the extracted features of each dimension are normalized to obtain 512-dimensional core fault features.

[0081] For example, the feature vector corresponding to the core fault features can be represented as: ,in, is the normalized value of the k-th dimension feature.

[0082] S210. Based on the matching degree between the core fault characteristics and each candidate model in the candidate model set, determine the collaborative model combination from the candidate model set, and initialize the weight of each collaborative model in the collaborative model combination.

[0083] Specifically, to ensure the accuracy of root cause determination, a suitable model needs to be selected from multiple candidate model sets based on the information contained in the core fault features for root cause calculation. First, the matching degree between the core fault features and each candidate model in the set is calculated. Then, based on the matching degree, the candidate models are filtered, retaining only those with high matching degrees as models suitable for root cause determination of the core fault features. The final combination of selected candidate models is defined as the collaborative model combination. Simultaneously, the weights of each collaborative model can be initialized based on their accuracy in historical root cause determination processes.

[0084] For example, the core fault feature F and different candidate models in the candidate model set... The method for calculating the matching degree between pairs can be expressed as: ,in, Candidate models The input weight vector, This is a bias term, and the matching degree ranges from [0,1].

[0085] For example, the initial weights of each collaborative model can be expressed as: ,in, This is the weight scaling factor, and when initializing the weights for each collaborative model, all initial weights will be normalized to ensure that the sum of the weights of each collaborative model is 1.

[0086] S211. Input the core fault features and effective correlation datasets into each collaborative model in the collaborative model combination to determine the candidate root cause set.

[0087] Specifically, the core fault features are input into the corresponding data contained in the effective association dataset, along with the input requirements of each collaborative model in the collaborative model combination. The output results of each collaborative model are then used as candidate root causes. Since each collaborative model can output multiple candidate root causes, the set of these candidate root causes can be defined as the candidate root cause set.

[0088] In some examples, taking a collaborative model combination including a topology inference model, a log analysis model, and a metrics anomaly model as an example, core fault characteristics and topology data (such as service dependency graphs from the effective association dataset) can be sent to the topology inference model; core fault characteristics and raw logs (such as error stacks and operation records from the effective association dataset) can be sent to the log analysis model; and core fault characteristics and time-series metrics (such as CPU utilization and response time from the effective association dataset) can be sent to the metrics anomaly model.

[0089] In some examples, the topology inference model can identify fault propagation paths based on topology data, output candidate root causes (such as "Service A's connection pool exhaustion caused Service B to time out"), and the confidence level of the candidate root cause. , where j is the j-th candidate output by the model, with a value of [0,1].

[0090] In some examples, log analysis models can extract error codes and stack traces from raw logs, combine them with root cause scenarios from a set of similar cases, and output candidate root causes along with their confidence levels. .

[0091] In some examples, the indicator anomaly model can analyze abrupt changes in time-series indicators, combine root cause scenarios from a set of similar cases, and output candidate root causes along with their confidence levels. .

[0092] By combining the candidate root causes output by the various collaborative models and their corresponding confidence levels, a candidate root cause set can be obtained. Each candidate root cause in the set can be represented as follows: , where R is the candidate root cause, i is the model number, and j is the j-th candidate output by the model.

[0093] S212. Update the weights of each collaborative model based on the scenario adaptability of each collaborative model to the scenario corresponding to the core fault characteristics.

[0094] Specifically, to more accurately select precise root causes from the candidate root causes output by each collaborative model, the scenario fit between each collaborative model and the scenario corresponding to the core fault features can be considered. This gives higher confidence to the candidate root causes output by collaborative models with higher scenario fit. Therefore, after determining the set of candidate root causes, the scenario fit between each collaborative model and the scenario corresponding to the core fault features can be calculated, and the scenario fit can be combined with the weights of each collaborative model at initialization to determine the updated weights of each collaborative model.

[0095] In some examples, the scenario fit for each collaborative model and the corresponding scenario of the core fault features is determined as follows: ,in, and For the model The mean and standard deviation of the k-th dimension feature in the training data can be understood as follows: the smaller the scenario fit, the more suitable the collaborative model is for the scenario corresponding to the core fault features.

[0096] Following the example above, after determining the scene adaptability, the updated weights of each collaborative model can be determined based on their initial weights. The specific weight update method can be as follows: ,in, For the model Updated weights This is to prevent the denominator from reaching a minimum value of zero. Understandably, the weights of each collaborative model need to be normalized after updating.

[0097] S213. Based on the updated weights of each collaborative model, determine the overall confidence level of each candidate root cause in the candidate root cause set, and identify the candidate root cause with the highest overall confidence level as the root cause of the failure.

[0098] Specifically, for each collaborative model, the overall confidence level of its output candidate root causes can be determined based on its updated weights. After determining the overall confidence level of each candidate root cause, the candidate root cause with the highest overall confidence level can be identified as the root cause most likely to cause the failure, and it can be used as the root cause of the failure corresponding to the original failure source data.

[0099] For example, the overall confidence level of each candidate root cause R can be determined as follows: ,in, For the model Confidence level of candidate root cause R.

[0100] S214. Determine the target repair plan based on the root cause of the fault and historical fault cases, and execute the target repair plan to handle the fault source when the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold.

[0101] In some examples, solutions from historical failure cases that address the root cause of the failure can be comprehensively evaluated, and the solution with the highest score can be designated as the target repair solution S. This comprehensive evaluation can be conducted as follows: ,in, These are historical failure cases. This represents the case matching degree.

[0102] Following the example above, after determining the target repair plan based on the root cause of the fault and historical fault cases, the steps of plan S can be parsed and converted into executable rules (Rules) for the intelligent agent. These rules may include triggering conditions, execution actions (such as calling APIs and sending notifications), and expected results. The intelligent agent will score the validity of the rules and execute the rules corresponding to the target repair plan when the calculated rule validity meets a preset feasibility threshold, thereby addressing the fault source corresponding to the original fault source data.

[0103] Optionally, the intelligent agent can also complete the execution by issuing executable rules to the execution engine. The execution engine will monitor real-time indicators according to the trigger conditions in the rules, and automatically complete the execution of the actions in the rules when the conditions are met.

[0104] Optionally, when implementing the target repair plan to address the source of the fault, the following may also be included: Obtain the post-repair metrics when the target remediation plan is executed, and determine the remediation result based on the post-repair metrics; A knowledge vector to be added to the database is constructed based on the target repair plan, the root cause of the fault, and the repair results, and the confidence level of the knowledge vector to be added to the database is determined based on the repair results. Store the knowledge vectors to be added to the dynamic knowledge base.

[0105] Specifically, to better monitor the fault repair status and effectiveness, and to fully update the dynamic knowledge base, post-repair indicators can be acquired during the execution of the target repair plan to address the fault source. These indicators are then compared with normal threshold values ​​to determine the repair result. Furthermore, the root cause of the fault identified by the target repair plan used in this repair can be decomposed and combined with the final determined repair result to form a knowledge vector to be added to the database, consisting of a triple of "root cause-solution-effect". The confidence level of the knowledge vector to be added is determined based on the repair result and the confidence level of historical similar knowledge vectors. Finally, the confidence level of the knowledge vector to be added is combined with the knowledge vector itself and stored in the dynamic knowledge base.

[0106] In some examples, the repair result can be determined as follows: It is understandable that the closer the repaired indicators are to the normal threshold, the shorter the recovery time, and the higher the repair result score. When the repair result score exceeds the preset repair score threshold (such as 0.8), the repair can be judged as successful; otherwise, the suboptimal repair solution can be returned to be executed.

[0107] Following the example above, the confidence score of the knowledge vector to be added to the database can be calculated as follows: .

[0108] Optionally, the agent can also send root cause localization bias data to the agent's central processing unit to adjust the parameters of the corresponding model in the candidate model set, so as to provide better model support for subsequent root cause determination.

[0109] The technical solution of this embodiment establishes a relational dataset centered on entity labels within the original fault source data. This dataset is then used to determine causal relationships, completeness, and basic decision-making processes. Effective relational datasets suitable for subsequent fault handling solutions are identified. Furthermore, features are extracted from the data in the effective relational datasets. Retrieval vectors for searching in a dynamic knowledge base are constructed based on the extracted feature vectors. A set of similar cases is obtained from the dynamic knowledge base based on the cosine similarity between the retrieval vectors and the knowledge vectors in the dynamic knowledge base. Following this, based on the core fault features determined from the effective relational datasets and the set of similar cases, a collaborative model combination suitable for fault root cause determination is selected from the candidate model set. Weights are assigned to each collaborative model within the combination. Each collaborative model determines a candidate root cause set based on the core fault features and the effective relational data. The most likely root cause of the fault is determined from among the candidate root causes, and a target repair solution based on the determined root cause is used to address the fault source. By fully integrating the correlations between different data, the accuracy of decision-making and processing capabilities for complex fault scenarios are improved, better meeting the alarm and fault handling needs of complex computer systems.

[0110] Example 3 Figure 3 This is a schematic diagram of the structure of a fault handling device provided in Embodiment 3 of the present invention, as shown below. Figure 3 As shown, the fault handling device includes a dataset determination module 31, a similarity set determination module 32, a root cause determination module 33, and a fault handling module 34.

[0111] The system includes a dataset determination module 31, which acquires the original fault source data and determines the effective associated dataset based on the original fault source data; a similarity set determination module 32, which determines the set of similar cases from the dynamic knowledge base based on the effective associated dataset; a root cause determination module 33, which determines the core fault features based on the effective associated dataset and the set of similar cases, and determines the root cause of the fault based on the core fault features, the effective associated dataset, and the set of candidate models; and a fault handling module 34, which determines the target repair plan based on the root cause of the fault and historical fault cases, and executes the target repair plan to handle the fault source when the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold.

[0112] The technical solution of this invention, when acquiring multiple types of original fault source data, first determines the correlation between various types of original fault source data, and constructs a valid correlation dataset based on the correlation to identify valid data. Then, based on this valid correlation dataset, and combined with a dynamically updated dynamic knowledge base, it determines the set of similar cases and the root cause of the fault. Finally, it completes the repair of the fault source by using a target repair plan determined based on the root cause and historical fault cases, which meets the fault source repair requirements and is effective in execution. Since the determination of the root cause and repair plan is based on a valid correlation dataset that correlates various types of original fault source data and ensures its effectiveness, it eliminates the possibility of inaccurate root cause determination due to false correlations when directly using fault data. Simultaneously, the dynamically updated dynamic knowledge base ensures that the knowledge in the dynamic knowledge base and the various inference data used in the fault handling process are continuously updated, avoiding a decrease in decision accuracy due to the knowledge system being static and unable to adapt to complex fault scenarios, thus better meeting the fault handling needs for alarms in complex computer systems.

[0113] Optionally, the dataset determination module 31 is specifically used for: Based on the entity labels of various types of data in the original fault source data, construct an associated dataset with entity labels as the core; When the data alignment of the associated dataset meets the preset alignment threshold, the strong causal association data in the associated dataset is determined according to the causal strength of each pair of associated data in the associated dataset, and the integrity of the associated dataset is evaluated to determine the integrity score of the associated dataset. Error log features, time series features, and topological features are extracted from data with strong causal relationships, and a comprehensive decision score is determined based on these features. A valid associated dataset is defined as an associated dataset whose integrity score meets a preset integrity threshold and whose overall decision score meets a preset decision threshold.

[0114] Optional, the similarity set determination module 32 is specifically used for: Features are extracted from each type of data included in the effective associated dataset, and retrieval vectors are constructed based on the feature vectors of each type of data. Candidate knowledge vectors are determined based on the cosine similarity between the retrieval vector and each knowledge vector in the dynamic knowledge base; Each candidate knowledge vector is weighted and sorted according to business type and time decay. Based on the sorting results, a preset number of candidate knowledge vectors are selected from each candidate knowledge vector to construct a set of similar cases.

[0115] Optionally, before constructing the retrieval vector based on the feature vectors of various types of data, the following steps are also included: Obtain valid original fault source data corresponding to the valid associated dataset, and extract entity features from the valid original fault source data to determine the entity feature vector; The similarity between the entity feature vector and each knowledge vector in the dynamic knowledge base is determined by matching the similarity between the entity feature vector and each knowledge vector. New knowledge vectors are constructed based on knowledge vectors and entity feature vectors whose similarity exceeds a preset similarity threshold, and the new knowledge vectors are stored in a dynamic knowledge base.

[0116] Optional, root cause determination module 33, specifically used for: Core features are extracted and normalized from effective associated datasets and similar case sets to determine core fault features; Based on the matching degree between the core fault characteristics and each candidate model in the candidate model set, the collaborative model combination is determined from the candidate model set, and the weights of each collaborative model in the collaborative model combination are initialized. The core fault features and effective correlation datasets are respectively input into each collaborative model in the collaborative model combination to determine the candidate root cause set; The weights of each collaborative model are updated based on the scenario adaptability of each collaborative model to the corresponding scenario of the core fault characteristics. Based on the updated weights of each collaborative model, the overall confidence level of each candidate root cause in the candidate root cause set is determined, and the candidate root cause with the highest overall confidence level is identified as the root cause of the failure.

[0117] Optionally, when implementing the target repair plan to address the source of the fault, the following may also be included: Obtain the post-repair metrics when the target remediation plan is executed, and determine the remediation result based on the post-repair metrics; A knowledge vector to be added to the database is constructed based on the target repair plan, the root cause of the fault, and the repair results, and the confidence level of the knowledge vector to be added to the database is determined based on the repair results. Store the knowledge vectors to be added to the dynamic knowledge base.

[0118] The fault handling device provided in the embodiments of the present invention can execute the fault handling method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0119] Example 4 Figure 4This is a schematic diagram of a fault handling device according to Embodiment 4 of the present invention. The fault handling device 40 can represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The fault handling device 40 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0120] like Figure 4 As shown, the fault handling device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded from storage unit 48 into the RAM 43. The RAM 43 may also store various programs and data required for the operation of the fault handling device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0121] Multiple components in the fault handling device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, optical disk, etc.; and a communication unit 49, such as a network card, modem, wireless transceiver, etc. The communication unit 49 allows the fault handling device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0122] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as fault handling methods.

[0123] In some embodiments, the fault handling method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the fault handling device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the fault handling method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to execute the fault handling method by any other suitable means (e.g., by means of firmware).

[0124] Optionally, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the fault handling method provided in any embodiment of the present invention.

[0125] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0126] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0127] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0128] To provide interaction with the user, the systems and techniques described herein can be implemented on a fault handling device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the fault handling device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0129] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0130] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0131] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0132] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A fault handling method, characterized in that, include: Obtain the original fault source data, and determine the valid associated dataset based on the original fault source data; A set of similar cases is determined from the dynamic knowledge base based on the effective association dataset; The core fault features are determined based on the effective association dataset and the set of similar cases, and the root cause of the fault is determined based on the core fault features, the effective association dataset, and the set of candidate models. The target repair plan is determined based on the root cause of the fault and historical fault cases. When the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold, the target repair plan is executed to process the fault source.

2. The fault handling method according to claim 1, characterized in that, The step of determining the valid associated dataset based on the original fault source data includes: Based on the entity labels of various types of data in the original fault source data, construct an associated dataset with the entity labels as the core; When the data alignment of the associated dataset meets the preset alignment threshold, based on the causal strength of each pair of associated data in the associated dataset, the strongly causal associated data in the associated dataset is determined, and the integrity of the associated dataset is evaluated to determine the integrity score of the associated dataset. Error log features, time series features, and topological features are extracted from the strongly causal data, and a comprehensive decision score is determined based on the error log features, the time series features, and the topological features. The associated datasets whose integrity scores meet a preset integrity threshold and whose comprehensive decision scores meet a preset decision threshold are identified as valid associated datasets.

3. The fault handling method according to claim 1, characterized in that, The step of determining a set of similar cases from the dynamic knowledge base based on the effective association dataset includes: Feature extraction is performed on each type of data included in the effective associated dataset, and a retrieval vector is constructed based on the feature vectors of each type of data; Candidate knowledge vectors are determined based on the cosine similarity between the retrieved vector and each knowledge vector in the dynamic knowledge base; The candidate knowledge vectors are weighted and sorted according to business type and time decay. Based on the sorting results, a preset number of candidate knowledge vectors are selected from each candidate knowledge vector to construct a set of similar cases.

4. The fault handling method according to claim 3, characterized in that, Before constructing the retrieval vector based on the feature vectors of various types of data, the following is also included: Obtain valid original fault source data corresponding to the valid associated dataset, and extract entity features from the valid original fault source data to determine the entity feature vector; The entity feature vector is matched with each knowledge vector in the dynamic knowledge base to determine the similarity between the entity feature vector and each knowledge vector. A new knowledge vector is constructed based on the knowledge vector whose similarity exceeds a preset similarity threshold and the entity feature vector, and the new knowledge vector is stored in the dynamic knowledge base.

5. The fault handling method according to claim 1, characterized in that, The step of determining core fault features based on the effective association dataset and the set of similar cases, and determining the root cause of the fault based on the core fault features, the effective association dataset, and the set of candidate models, includes: Core features are extracted and normalized from the effective associated dataset and the set of similar cases to determine the core fault features; Based on the matching degree between the core fault characteristics and each candidate model in the candidate model set, a collaborative model combination is determined from the candidate model set, and the weights of each collaborative model in the collaborative model combination are initialized. The core fault features and the effective correlation dataset are respectively input into each collaborative model in the collaborative model combination to determine the candidate root cause set; The weights of each collaborative model are updated based on the scenario adaptability of each collaborative model to the scenario corresponding to the core fault characteristics. Based on the updated weights of each collaborative model, the overall confidence level of each candidate root cause in the candidate root cause set is determined, and the candidate root cause with the highest overall confidence level is determined as the root cause of the failure.

6. The fault handling method according to claim 1, characterized in that, When executing the target repair plan to address the fault source, the method further includes: Obtain the post-repair indicators when the target repair plan is executed, and determine the repair result based on the post-repair indicators; A knowledge vector to be added to the database is constructed based on the target repair plan, the root cause of the fault, and the repair result, and the confidence level of the knowledge vector to be added to the database is determined based on the repair result. The knowledge vectors to be added to the database are stored in the dynamic knowledge base.

7. A fault handling device, characterized in that, include: The dataset determination module is used to acquire the original fault source data and determine the valid associated dataset based on the original fault source data. The similarity set determination module is used to determine a set of similar cases from the dynamic knowledge base based on the effective association dataset; The root cause determination module is used to determine core fault features based on the effective association dataset and the set of similar cases, and to determine the root cause of the fault based on the core fault features, the effective association dataset and the set of candidate models. The fault handling module is used to determine the target repair plan based on the root cause of the fault and historical fault cases, and execute the target repair plan to handle the fault source when the validity of the rule corresponding to the target repair plan meets the preset feasibility threshold.

8. A fault handling device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the fault handling method according to any one of claims 1-6.

9. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the fault handling method as claimed in any one of claims 1-6.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the fault handling method as described in any one of claims 1-6.

Images