Machine learning based data center failure detection system

Abstract

This invention relates to the field of data processing technology, specifically a machine learning-based data center fault detection system. The system includes an embedded feature matrix module, a time-series prediction module, a residual connection module, and a fault determination module. Specifically: monitoring point data is used as graph nodes, and the physical connections and preset logical relationships between monitoring points are used as graph edges to generate an embedded feature matrix; attention weights are weighted and summed with historical feature sequences to generate a context feature vector; the current real-time feature is residually connected to the context feature vector, and a dynamically adaptive threshold is applied based on the norm change rate of the residually connected feature in the feature space; when the feature value after residual connection exceeds the adaptive threshold, a fault determination signal is generated, and fault root cause location information is generated based on the monitoring point location corresponding to the graph node with the highest contribution in the embedded feature matrix. This invention can improve the efficiency of data center fault detection.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data center fault detection system based on machine learning. Background Technology

[0002] Existing data center fault detection technologies generally use fixed thresholds for fault determination, which cannot adapt to the time-series dynamic fluctuations of monitoring data and the correlation characteristics between monitoring nodes. This results in low fault identification accuracy and a tendency for false alarms and missed alarms. Traditional detection methods do not integrate the physical and logical connections between monitoring points to build feature models, and feature extraction is limited in scope and insufficient, failing to fully depict the overall operational status of the data center.

[0003] Existing fault detection solutions lack temporal context attention weighting and residual feature analysis mechanisms, failing to accurately quantify the deviation of real-time operational characteristics from historical states, and the fault judgment threshold cannot be dynamically and adaptively adjusted based on data changes. Furthermore, traditional technologies can only provide fault status alarms, lacking the ability to locate fault root causes based on feature contribution, resulting in lengthy fault investigation times and hindering the stable and efficient operation of data centers. Summary of the Invention

[0004] To achieve the above objectives, the present invention provides a data center fault detection system based on machine learning, characterized in that the system includes an embedded feature matrix module, a time series prediction module, a residual connection module, and a fault determination module, wherein: A machine learning-based data center fault detection system, characterized in that the system includes an embedded feature matrix module, a time series prediction module, a residual connection module, and a fault determination module, wherein: The embedded feature matrix module is used to take the data of each monitoring point at each sampling time in the data center as graph nodes, and the physical connection relationship and preset logical association relationship between each monitoring point as graph edges to generate an embedded feature matrix. The time-series prediction module is used to divide the embedded feature matrix into historical features and current real-time features according to a time window, and to perform a weighted summation of the attention weight of the historical features relative to the current real-time features with the historical feature sequence to generate a context feature vector. The residual connection module is used to perform a residual connection between the current real-time feature and the context feature vector, and dynamically adapt the threshold according to the norm change rate of the feature in the feature space after the residual connection. The fault determination module is used to generate a fault determination signal when the feature value after residual connection exceeds the adaptive threshold, and to generate fault root cause location information based on the monitoring point location corresponding to the graph node with the highest contribution in the embedded feature matrix.

[0005] In a preferred embodiment, the embedded feature matrix module, when executing the process of taking the data from each monitoring point at each sampling time in the data center as a graph segment, is specifically used for: Obtain the device identifier and current reading for each monitoring point, bind the device identifier and current reading into a key-value pair to obtain the initial features of the node, and use the initial features of the node as the data content of the graph node.

[0006] In a preferred embodiment, the embedded feature matrix module, when executing the operation of treating the physical connection relationships and preset logical association relationships between monitoring points as graph edges, is specifically used for: Extract the physical connection paths of power supply lines, network data lines, and cooling pipes in the data center to form a set of physical connection edges; Extract the preset alarm linkage rules and business dependencies to form a set of logical connection edges; The physical connection edge set and the logical connection edge set are merged to obtain the edge connection topology used to guide feature aggregation.

[0007] In a preferred embodiment, the embedding feature matrix module, when generating the embedding feature matrix, is specifically used for: For each graph node, determine its neighboring nodes, wherein the neighboring nodes are defined by the direct connections defined by the graph edges; The initial features of each graph node are weighted and merged with the initial features of all its neighbors in a dimension-wise manner to obtain the fused features of each graph node. The fused features of all graph nodes are stacked according to the original arrangement order of each monitoring point at the sampling time to obtain the embedded feature matrix.

[0008] In a preferred embodiment, when the time-series prediction module performs the division of the embedded feature matrix into historical features and current real-time features by time window, it is specifically used for: Obtain the embedded feature matrix at the current sampling time as the current real-time feature; Obtain the sequence of embedded feature matrices from several consecutive sampling times prior to the current sampling time as historical features; The historical features and the current real-time features are stored separately according to their respective time tags to obtain feature pairs.

[0009] In a preferred embodiment, when the time-series prediction module performs a weighted summation of the attention weights of the historical features relative to the current real-time features with the historical feature sequence to generate a context feature vector, it specifically performs the following: Calculate the feature similarity between each historical feature and the current real-time feature, and use the feature similarity as the attention weight corresponding to the historical feature; Each historical feature is multiplied by its corresponding attention weight to obtain a weighted historical feature; All weighted historical features are summed element by element to generate a context feature vector.

[0010] In a preferred embodiment, when the residual connection module performs a residual connection between the current real-time feature and the context feature vector, and dynamically adapts the threshold based on the norm change rate of the feature in the feature space after the residual connection, it is specifically used for: The current real-time features are added element-wise to the context feature vector to obtain the fused features; Subtracting the context feature vector from the fused features yields residual connected features, wherein the residual connected features characterize the degree of deviation of the current real-time features from the historical context.

[0011] In a preferred embodiment, when the residual connection module performs a residual connection between the current real-time feature and the context feature vector, and dynamically adapts the threshold based on the norm change rate of the feature in the feature space after the residual connection, it is specifically used for: Calculate the vector norm of the residual connected features in the feature space at the current sampling time; Obtain the vector norm of the residual concatenated features at the previous sampling time, and calculate the difference between the two vector norms as the norm change rate; The norm change rate is compared with a preset benchmark change range, and the judgment threshold at the current moment is dynamically adjusted based on the comparison result to generate an adaptive threshold.

[0012] In a preferred embodiment, when the fault determination module generates a fault determination signal when the residual connection feature value exceeds the adaptive threshold, it is specifically used for: Obtain the residual post-connection feature value corresponding to each graph node in the embedded feature matrix at the current sampling time, compare the feature value of each graph node with the feature value of the graph node at the previous sampling time, and obtain the feature value increment of each graph node. The graph nodes are sorted from largest to smallest according to their feature value increments. The graph node at the top of the sort is selected as the graph node with the highest contribution. The physical location identifier and device identifier of the graph node with the highest contribution in the data center are extracted, and the physical location identifier and device identifier are packaged into fault root cause location information.

[0013] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention constructs graph nodes from the data of each monitoring point in the data center, integrates the physical connections and logical relationships of the monitoring points to generate an embedded feature matrix, extracts historical context features by combining a temporal attention weighting mechanism, accurately quantifies the deviation of real-time features through residual connections, and then dynamically generates an adaptive judgment threshold based on the feature norm change rate. This effectively improves the accuracy and sensitivity of fault detection, can stably adapt to the dynamic fluctuation characteristics of data center operating data, and makes fault identification more in line with the actual operating state.

[0014] 2. This invention can calculate the feature contribution of each graph node based on the embedded feature matrix, quickly locate the fault root cause node with the highest contribution, identify associated fault nodes and integrate them to generate accurate fault location information, significantly shorten the time spent on fault investigation and location, improve the overall efficiency of fault detection and handling, optimize the response speed of feature aggregation and fault judgment, ensure the continuous and stable operation of the data center, and enhance the practical effectiveness of the fault detection system. Attached Figure Description

[0015] Figure 1 This is a system architecture diagram of a data center fault detection system based on machine learning, provided in an embodiment of the present invention. The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments belong to some, but not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “said” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.

[0018] Depending on the context, the word "if" or "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0019] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0020] In practice, the server-side equipment deployed in a machine learning-based data center fault detection system may consist of one or more devices. This machine learning-based data center fault detection system can be implemented as: a business instance, a virtual machine, or hardware devices. For example, the machine learning-based data center fault detection system can be implemented as a business instance deployed on one or more devices in a cloud node. Simply put, this machine learning-based data center fault detection system can be understood as software deployed on a cloud node to provide machine learning-based data center fault detection to various user terminals. Alternatively, the machine learning-based data center fault detection system can also be implemented as a virtual machine deployed on one or more devices in a cloud node. This virtual machine contains application software for managing various user terminals. Or, the machine learning-based data center fault detection system can also be implemented as a server composed of numerous identical or different types of hardware devices, with one or more hardware devices configured to provide machine learning-based data center fault detection to various user terminals.

[0021] In terms of implementation, the machine learning-based data center fault detection system and the user terminal are mutually adaptable. That is, if the machine learning-based data center fault detection system is implemented as an application installed on a cloud service platform, then the user terminal is implemented as a client that establishes a communication connection with the application; or if the machine learning-based data center fault detection system is implemented as a website, then the user terminal is implemented as a webpage; or if the machine learning-based data center fault detection system is implemented as a cloud service platform, then the user terminal is implemented as a mini-program in an instant messaging application.

[0022] like Figure 1 The figure shown is a system architecture diagram of a data center fault detection system based on machine learning provided in an embodiment of the present invention.

[0023] The machine learning-based data center fault detection system 100 described in this invention can be installed on a cloud server. In terms of implementation, it can be used as one or more service devices, or as an application installed in the cloud (e.g., a mobile service operator's server, server cluster, etc.), or it can be developed as a website. Depending on the functions implemented, the machine learning-based data center fault detection system 100 may include an embedded feature matrix module 101, a time series prediction module 102, a residual connection module 103, and a fault determination module 104. The module described in this invention can also be called a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, stored in the memory of the electronic device.

[0024] In this embodiment of the invention, in the machine learning-based data center fault detection system, each of the above modules can be implemented independently and can call other modules. This "calling" can be understood as one module connecting to multiple modules of another type and providing corresponding services to those connected modules. In the machine learning-based data center fault detection system provided by this embodiment of the invention, the applicability of the machine learning-based data center fault detection system architecture can be adjusted by adding modules and directly calling them without modifying the program code, achieving cluster-based horizontal expansion to quickly and flexibly expand the machine learning-based data center fault detection system. In practical applications, the above modules can be set in the same device or different devices, or they can be set in virtual devices, such as service instances in a cloud server.

[0025] The following describes the components and workflow of a machine learning-based data center fault detection system, using specific examples: The embedded feature matrix module 101 is used to take the data of each monitoring point at each sampling time in the data center as graph nodes, and the physical connection relationship and preset logical association relationship between each monitoring point as graph edges to generate an embedded feature matrix. In this embodiment of the invention, when the embedded feature matrix module performs the operation of taking the data from each monitoring point at each sampling time in the data center as a graph segment, it is specifically used for: Obtain the device identifier and current reading for each monitoring point, bind the device identifier and current reading into a key-value pair to obtain the initial features of the node, and use the initial features of the node as the data content of the graph node.

[0026] When the embedded feature matrix module executes the operation of treating the physical connection relationships and preset logical association relationships between monitoring points as graph edges, it is specifically used for: Extract the physical connection paths of power supply lines, network data lines, and cooling pipes in the data center to form a set of physical connection edges; Extract the preset alarm linkage rules and business dependencies to form a set of logical connection edges; The physical connection edge set and the logical connection edge set are merged to obtain the edge connection topology used to guide feature aggregation.

[0027] The embedded feature matrix module, when generating the embedded feature matrix, is specifically used for: For each graph node, determine its neighboring nodes, wherein the neighboring nodes are defined by the direct connections defined by the graph edges; The initial features of each graph node are weighted and merged with the initial features of all its neighbors in a dimension-wise manner to obtain the fused features of each graph node. The fused features of all graph nodes are stacked according to the original arrangement order of each monitoring point at the sampling time to obtain the embedded feature matrix.

[0028] The system collects the unique device identification information corresponding to each monitoring point within the data center, as well as the current readings recorded in real time during the same sampling period. The device identification information and the current reading information corresponding to each monitoring point are then bound together to form a standard single key-value pair structure. Each key-value pair that has been bound together is uniformly set as the standard initial feature of the node. The formed initial feature of the node directly serves as all the data content stored within the corresponding graph node.

[0029] The system retrieves complete physical connection path information for all power supply lines, network data lines, and cooling pipes within the data center. It then compiles and integrates all physical connection path information for these three types of lines to form a complete and standardized set of physical connection edges.

[0030] Retrieve all alarm linkage rules that have been pre-configured and stored, as well as all established business dependencies in the daily operation of the data center. Collect and integrate these two types of related content in a unified manner, and then summarize them to form a complete and standardized set of logical connection edges.

[0031] The content of the already organized physical connection edge set and the content of the already organized logical connection edge set are directly integrated and merged. All connection-related content within the two edge sets is uniformly collected into the same whole. After integration, an edge connection topology is directly formed for subsequent feature aggregation work.

[0032] Based on the various direct connection relationships clearly marked and recorded in the established edge connection topology, the corresponding associated nodes are matched one by one for each established graph node. The associated node group corresponding to each graph node is strictly defined according to the fixed connection range marked inside the topology, and finally all the neighbor nodes of each graph node are determined.

[0033] For each graph node whose neighbor range has been determined, the initial node feature content of the graph node itself is retrieved, and the initial node feature content of all the graph node whose neighbor nodes have been defined is also retrieved. The initial node feature of the graph node and the initial node feature of all the neighbor nodes are then weighted and merged according to the corresponding dimensions of the feature. The feature content of each dimension is fused. After the processing is completed, each independent graph node will generate its own unique fused feature.

[0034] Collect the fusion feature content generated by all graph nodes, strictly follow the original arrangement order set by each monitoring point at the corresponding sampling time, and sequentially stack and integrate the fusion features of all graph nodes in an orderly manner. After all fusion features are stacked in a fixed order, a complete, standardized, and usable embedding feature matrix is ​​directly generated.

[0035] The beneficial effects of this construction method are that it can fully integrate the basic information of each monitoring point in the data center, accurately bind device identity information with real-time monitoring content, and solidify the data carrying foundation of graph nodes. Simultaneously, it comprehensively encompasses the physical relationships formed by line deployment and the logical relationships formed by business operations, integrating these two types of relationships to build a well-structured edge connection topology. Based on the topology, the scope of relationships between nodes is defined, and the feature content of the nodes themselves and their adjacent nodes is integrated to enrich the feature connotation. Then, it is organized and summarized according to the inherent arrangement rules of the monitoring points. The resulting embedded feature matrix can completely preserve the relationship between monitoring data and points, providing a comprehensive and well-structured foundation for subsequent feature processing and status identification, ensuring the rigor and completeness of the overall operational analysis.

[0036] The time-series prediction module 102 is used to divide the embedded feature matrix into historical features and current real-time features according to a time window, and to perform a weighted summation of the attention weight of the historical features relative to the current real-time features with the historical feature sequence to generate a context feature vector. In this embodiment of the invention, when the time-series prediction module performs the division of the embedded feature matrix into historical features and current real-time features by time window, it is specifically used for: Obtain the embedded feature matrix at the current sampling time as the current real-time feature; Obtain the sequence of embedded feature matrices from several consecutive sampling times prior to the current sampling time as historical features; The historical features and the current real-time features are stored separately according to their respective time tags to obtain feature pairs.

[0037] When the time-series prediction module performs a weighted summation of the attention weights of the historical features relative to the current real-time features with the historical feature sequence to generate a context feature vector, it specifically performs the following: Calculate the feature similarity between each historical feature and the current real-time feature, and use the feature similarity as the attention weight corresponding to the historical feature; Each historical feature is multiplied by its corresponding attention weight to obtain a weighted historical feature; All weighted historical features are summed element by element to generate a context feature vector.

[0038] The time series prediction module directly retrieves the complete embedded feature matrix generated at the corresponding sampling moment of the data acquisition process currently in progress. This complete embedded feature matrix, which accurately corresponds to the real-time sampling time node, is directly determined as the current real-time feature required for subsequent processing.

[0039] The time series prediction module retrieves all embedded feature matrices corresponding to multiple fixed sampling times that are prior to the current sampling time and arranged in a continuous and uninterrupted order. These embedded feature matrices, arranged in chronological order, are uniformly collected and integrated into an ordered matrix sequence. The integrated complete matrix sequence is directly determined as the historical features required for subsequent processing.

[0040] The time series prediction module matches exclusive time tags to the historical features and current real-time features that have been divided. It strictly divides the storage areas according to the exclusive time tags of the two types of features, and places the historical features and current real-time features in independent storage areas that do not interfere with each other to complete the isolation storage operation. After standardized isolation storage processing, it directly forms the corresponding standard feature pairs.

[0041] The time-series prediction module performs a comprehensive feature content matching and comparison work on each independent historical feature content contained within the historical feature sequence and the current real-time feature that has been isolated and stored. It calculates the feature similarity between each historical feature and the current real-time feature one by one. The degree of matching is the cosine similarity / Euclidean distance matching degree of each dimension feature vector of the historical feature and the current real-time feature. The degree of matching is checked by comparing the feature vectors dimension by dimension. After traversing all dimensions of the feature, the dimension matching score is calculated and then weighted and summarized to obtain the overall degree of matching. After each matching and comparison work is completed, a unique feature similarity is generated. The calculated feature similarity value is directly normalized and used as the attention weight of the corresponding historical feature to complete the fixed assignment of the attention weight.

[0042] The time series prediction module performs precise fusion processing on the overall content of each individual historical feature and the attention weight specifically matched to that historical feature, so that all the feature content carried by the historical feature and the corresponding attention weight form a complete binding effect. After each set of historical features and corresponding attention weights have been fully fused, a separate weighted historical feature will be generated.

[0043] The time series prediction module gathers all the weighted historical features that have been completed into the same feature integration processing stage. According to the corresponding position of each basic feature content within each weighted historical feature, it sequentially performs the overlay and summary processing of content at the same position. All basic content at the same position of all weighted historical features is accumulated and integrated one by one. After all the accumulation and integration processes are completed, it directly generates a standard and compliant context feature vector that meets the requirements for subsequent fault detection.

[0044] The beneficial effects of this processing method are that it can reasonably divide the formed embedded feature matrix according to the time dimension, distinguish and isolate real-time state content from past time-series content, and organize it into a time-series corresponding feature pairing structure, fully preserving the inherent correlation of data evolution over time. Based on the degree of content fit between features, corresponding focus is defined, allowing features at different time-series stages to obtain an appropriate correlation ratio. Then, feature fusion and aggregation are used to form a contextual feature vector with temporal background connotations. This method can deeply mine the inherent correlation of monitoring data under the time-series dimension, enrich the time-dimensional information carried by features, and provide complete time-series feature support for subsequent feature comparison deviation identification and fault identification, conforming to the inherent laws of data center operation status evolution over time.

[0045] The residual connection module 103 is used to perform a residual connection between the current real-time feature and the context feature vector, and dynamically adapt the threshold according to the norm change rate of the feature in the feature space after the residual connection. In this embodiment of the invention, when the residual connection module performs a residual connection between the current real-time feature and the context feature vector, and dynamically adapts the threshold based on the norm change rate of the feature in the feature space after the residual connection, it is specifically used for: The current real-time features are added element-wise to the context feature vector to obtain the fused features; Subtracting the context feature vector from the fused features yields residual connected features, wherein the residual connected features characterize the degree of deviation of the current real-time features from the historical context.

[0046] The residual connection module, when performing a residual connection between the current real-time feature and the context feature vector, and dynamically adapting the threshold based on the norm change rate of the feature in the feature space after the residual connection, is specifically used for: Calculate the vector norm of the residual connected features in the feature space at the current sampling time; Obtain the vector norm of the residual concatenated features at the previous sampling time, and calculate the difference between the two vector norms as the norm change rate; The norm change rate is compared with a preset benchmark change range, and the judgment threshold at the current moment is dynamically adjusted based on the comparison result to generate an adaptive threshold.

[0047] The current real-time features output by the time series prediction module and the context feature vector generated by the time series prediction module will be sequentially overlaid and integrated according to the feature content of each corresponding position. Specifically, this includes: arithmetically adding the feature values ​​of the same row and column positions of each weighted historical feature; after all weighted historical feature values ​​of the same corresponding position are accumulated, the final accumulated result of that position is retained as the integrated feature value; once all positions are traversed, the context feature vector is generated; all feature contents of the same arrangement positions within the two types of features are overlaid and merged one-to-one; after all the overlay processes are completed, a complete and standardized fused feature is directly generated.

[0048] The feature content at each corresponding position within the already formed fusion feature is sequentially subjected to positional subtraction processing with the feature content at the same position within the context feature vector. After all the feature content at all positions has completed the corresponding subtraction and integration operations, the residual concatenated feature is directly generated. The formed residual concatenated feature is specifically used to accurately reflect the degree of deviation of the current real-time feature from the overall content formed by the historical context.

[0049] The residual connection module takes the residual connection features formed at the corresponding moment of the current data sampling work as an example. Within the dedicated feature space, it completes the normalization and sorting of the overall vector range of the feature, accurately extracts the fixed vector range content after sorting, and determines the vector norm corresponding to the residual connection features at the current sampling moment.

[0050] Retrieve the vector norm content corresponding to the features of the residual concatenation that is immediately adjacent to the current sampling time in the data sampling time sequence. Perform a position difference check and sorting work between the vector norm content determined at the current sampling time and the vector norm content retained at the previous sampling time. The fixed difference content obtained from the check and sorting of the two vector norms is directly defined as the norm change rate.

[0051] The entire content of the norm change rate that has been calculated is compared and matched with all the contents of the benchmark change range item by item. The item-by-item precise comparison and matching involves comparing and screening the norm change rate value with the multi-level interval thresholds of the benchmark change range one by one; accurately locking the fixed interval position corresponding to the norm change rate in the middle of the benchmark change range, and classifying it into one of the three fixed intervals of the preset normal fluctuation interval, slight deviation interval, and severe deviation interval according to the value.

[0052] The norm change rate is compared with a preset benchmark change range. Based on the comparison result, the current judgment threshold is dynamically adjusted to generate an adaptive threshold. Specifically, this involves comparing the norm change rate with the preset benchmark change range. If the norm change rate falls within the normal range of the benchmark change range, the basic judgment threshold remains unchanged. If it exceeds the upper limit of the benchmark change range, the judgment threshold is linearly increased proportionally. If it falls below the lower limit of the benchmark change range, the judgment threshold is linearly decreased proportionally. Based on the comparison result, the current judgment threshold is dynamically adjusted to generate an adaptive threshold. The adjustment process is as follows: A targeted, dedicated adjustment and standardization process is performed on the basic judgment threshold used for fault determination at the current sampling time. Each comparison and matching result corresponds to a specific threshold adjustment execution standard. For example: if it falls within the normal fluctuation range, the basic threshold remains unchanged at 1.0; if it falls within the slightly deviated range, the basic threshold is decreased by 10%; if it falls within the severely deviated range, the basic threshold is decreased by 25%, completing the targeted, dedicated threshold adjustment and standardization.

[0053] The residual connection module relies entirely on the alignment and subtraction of the feature content itself to complete the core residual connection process. It relies entirely on the difference of vector norm at different sampling times to complete the change statistics. It relies entirely on the comparison and matching of the established benchmark range to complete the threshold orientation adjustment. All processing links are executed sequentially according to a fixed and regular process to ensure that each generated feature content and threshold content conforms to the actual use standards of data center fault detection.

[0054] The beneficial effect is that by using residual connection processing through feature alignment overlay and subtraction, the actual deviation of current real-time features relative to historical context can be accurately extracted, clearly and intuitively reflecting the anomalies in the data center's operating status. Based on the corresponding changes in features after residual connection at different sampling times, operational fluctuation patterns are analyzed, and state comparison matching is completed in conjunction with a preset benchmark change range. Based on this, the threshold used for fault determination is dynamically adjusted. This abandons the traditional fixed threshold mode, allowing for flexible adaptation of judgment standards to the normal operating fluctuations of the data center at different times. It effectively avoids the problems of misjudgment and missed judgment caused by the poor adaptability of fixed thresholds, ensuring that fault determination is based on real-time operating conditions. This provides a reliable and adaptable judgment basis for subsequent accurate fault identification, continuously ensuring the rigor and accuracy of data center fault detection work.

[0055] The fault determination module 104 is used to generate a fault determination signal when the feature value after residual connection exceeds the adaptive threshold, and to generate fault root cause location information according to the monitoring point location corresponding to the graph node with the highest contribution in the embedded feature matrix.

[0056] In this embodiment of the invention, when the fault determination module generates a fault determination signal when the residual connection feature value exceeds the adaptive threshold, it is specifically used for: Obtain the residual post-connection feature value corresponding to each graph node in the embedded feature matrix at the current sampling time, compare the feature value of each graph node with the feature value of the graph node at the previous sampling time, and obtain the feature value increment of each graph node. The graph nodes are sorted from largest to smallest according to their feature value increments. The graph node at the top of the sort is selected as the graph node with the highest contribution. The physical location identifier and device identifier of the graph node with the highest contribution in the data center are extracted, and the physical location identifier and device identifier are packaged into fault root cause location information.

[0057] When the fault determination module generates fault root cause location information based on the monitoring point location corresponding to the highest contribution graph node in the embedded feature matrix, it is specifically used for: Obtain all neighboring graph nodes of the graph node with the highest contribution. The difference between the current feature value of each neighboring graph node and the current feature value of the graph node with the highest contribution is calculated to obtain the feature deviation of each neighboring graph node. Neighbor graph nodes whose feature deviation exceeds a preset deviation threshold are marked as associated fault nodes; The monitoring point locations of the associated fault nodes are merged with the monitoring point locations of the graph nodes with the highest contribution to obtain the fault root cause location information.

[0058] The fault determination module retrieves the corresponding residual concatenation feature value of each graph node in the embedded feature matrix at the current sampling time, and at the same time retrieves the residual concatenation feature values ​​of all graph nodes that were completely retained at the previous sampling time. The residual concatenation feature values ​​of a single graph node at the two sampling times before and after are checked item by item. Each graph node will form a unique feature value increment by comparing and checking the feature values ​​at the two sampling times before and after.

[0059] All graph nodes included in the statistics are uniformly sorted and arranged according to their respective calculated feature value increments. The position arrangement of all graph nodes is completed in strict accordance with the unified sorting standard of feature value increments. The graph node that ranks first in the sorting sequence after the overall sorting is completed is directly selected as the graph node with the highest contribution.

[0060] Retrieve the exclusive physical location identifier and exclusive device identifier of the graph node with the highest contribution registered and filed within the data center. Collect, integrate and package these two types of exclusive identifiers. After the identifiers are packaged and organized, a basic version of the fault root cause location information is directly generated.

[0061] The graph node with the highest contribution is collected and organized, and all directly related graph nodes are connected by edges to form a fixed topological association. All related graph nodes with direct connection relationships are collected and summarized. All related graph nodes after collection are uniformly identified as all neighbor graph nodes corresponding to the graph node with the highest contribution.

[0062] Retrieve the real-time feature value of each neighboring graph node at the current sampling time, and simultaneously retrieve the real-time feature value of the graph node with the highest contribution at the same current sampling time. Perform a comparison and difference analysis on the real-time feature value of each neighboring graph node and the real-time feature value of the graph node with the highest contribution in turn. After each set of comparison and analysis is completed, a unique neighboring graph node feature deviation will be generated.

[0063] The pre-set and fixed deviation threshold standards are retrieved and stored. These standards include: the pre-set deviation threshold is a critical feature difference threshold for determining whether a neighboring node has an abnormal linkage deviation with a core fault node; the threshold is set by: superimposing three times the statistical standard deviation as the basic deviation threshold based on the statistical average of feature deviations of each monitoring point under historical normal operation of the data center, and then fine-tuning it according to different equipment types and service levels; the threshold is the core critical basis for determining fault-related nodes, and if the feature deviation exceeds the threshold, the node is determined to be a fault-related point, directly confirming the scope of the associated fault point. The feature deviation of each neighboring graph node is precisely compared and verified with the pre-set deviation threshold standards. All neighboring graph nodes whose feature deviation exceeds the pre-set deviation threshold are uniformly marked, and all marked neighboring graph nodes are determined to be associated fault nodes.

[0064] Collect complete location information of monitoring points corresponding to all marked associated fault nodes, and collect complete location information of monitoring points corresponding to the graph node with the highest contribution. Comprehensively summarize, merge and organize the two types of monitoring point location information. After the integration and summary of all location information is completed, the final complete and effective fault root cause location information is directly generated.

[0065] The fault determination module obtains various feature values ​​and identification information in accordance with fixed data retrieval specifications throughout the process, strictly follows the established layout and comparison rules to complete the work of graph node screening and node marking, and summarizes various location-related contents in accordance with fixed integration specifications throughout the process. The entire processing flow is stably executed step by step, ensuring the integrity and accuracy of the fault root cause location information generated after the fault determination signal is triggered.

[0066] The beneficial effects include: by comparing the characteristic changes of each graph node at different sampling times, the core node with the most prominent abnormal operation status is accurately selected as the graph node with the highest contribution, quickly locating the core trigger source of the fault. Combining topological relationships to investigate the state deviation of adjacent related nodes, the system accurately marks related fault nodes with linkage anomalies, avoiding the one-sided location problem caused by relying on a single node to determine the fault. Integrating the monitoring location information of the core fault node and related fault nodes forms complete fault root cause location information, which can not only accurately locate the main fault point, but also simultaneously sort out the related points affected by the fault, making the fault determination and triggering process standardized and reliable, and the fault root cause location comprehensive and detailed. This effectively improves the accuracy and efficiency of data center fault diagnosis, facilitates maintenance personnel to quickly carry out fault handling and repair work, and continuously ensures the overall stable operation of the data center.

[0067] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0068] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A data center fault detection system based on machine learning, characterized in that, The system includes an embedded feature matrix module, a time series prediction module, a residual connection module, and a fault determination module, wherein: The embedded feature matrix module is used to take the data of each monitoring point at each sampling time in the data center as graph nodes, and the physical connection relationship and preset logical association relationship between each monitoring point as graph edges to generate an embedded feature matrix. The time-series prediction module is used to divide the embedded feature matrix into historical features and current real-time features according to a time window, and to perform a weighted summation of the attention weight of the historical features relative to the current real-time features with the historical feature sequence to generate a context feature vector. The residual connection module is used to perform a residual connection between the current real-time feature and the context feature vector, and dynamically adapt the threshold according to the norm change rate of the feature in the feature space after the residual connection. The fault determination module is used to generate a fault determination signal when the feature value after residual connection exceeds the adaptive threshold, and to generate fault root cause location information based on the monitoring point location corresponding to the graph node with the highest contribution in the embedded feature matrix.

2. The data center fault detection system based on machine learning as described in claim 1, characterized in that, When the embedded feature matrix module executes the process of taking the data from each monitoring point at each sampling time in the data center as a graph segment, it is specifically used for: Obtain the device identifier and current reading for each monitoring point, bind the device identifier and current reading into a key-value pair to obtain the initial features of the node, and use the initial features of the node as the data content of the graph node.

3. The data center fault detection system based on machine learning as described in claim 2, characterized in that, When the embedded feature matrix module executes the operation of treating the physical connection relationships and preset logical association relationships between monitoring points as graph edges, it is specifically used for: Extract the physical connection paths of power supply lines, network data lines, and cooling pipes in the data center to form a set of physical connection edges; Extract the preset alarm linkage rules and business dependencies to form a set of logical connection edges; The physical connection edge set and the logical connection edge set are merged to obtain the edge connection topology used to guide feature aggregation.

4. The data center fault detection system based on machine learning as described in claim 1, characterized in that, The embedded feature matrix module, when generating the embedded feature matrix, is specifically used for: For each graph node, determine its neighboring nodes, wherein the neighboring nodes are defined by the direct connections defined by the graph edges; The initial features of each graph node are weighted and merged with the initial features of all its neighbors in a dimension-wise manner to obtain the fused features of each graph node. The fused features of all graph nodes are stacked according to the original arrangement order of each monitoring point at the sampling time to obtain the embedded feature matrix.

5. The data center fault detection system based on machine learning as described in claim 1, characterized in that, When the time-series prediction module performs the process of dividing the embedded feature matrix into historical features and current real-time features by time window, it is specifically used for: Obtain the embedded feature matrix at the current sampling time as the current real-time feature; Obtain the sequence of embedded feature matrices from several consecutive sampling times prior to the current sampling time as historical features; The historical features and the current real-time features are stored separately according to their respective time tags to obtain feature pairs.

6. The data center fault detection system based on machine learning as described in claim 5, characterized in that, When the time-series prediction module performs a weighted summation of the attention weights of the historical features relative to the current real-time features with the historical feature sequence to generate a context feature vector, it specifically performs the following: Calculate the feature similarity between each historical feature and the current real-time feature, and use the feature similarity as the attention weight corresponding to the historical feature; Each historical feature is multiplied by its corresponding attention weight to obtain a weighted historical feature; All weighted historical features are summed element by element to generate a context feature vector.

7. The data center fault detection system based on machine learning as described in claim 1, characterized in that, The residual connection module, when performing a residual connection between the current real-time feature and the context feature vector, and dynamically adapting the threshold based on the norm change rate of the feature in the feature space after the residual connection, is specifically used for: The current real-time features are added element-wise to the context feature vector to obtain the fused features; Subtracting the context feature vector from the fused features yields residual connected features, wherein the residual connected features characterize the degree of deviation of the current real-time features from the historical context.

8. The data center fault detection system based on machine learning as described in claim 7, characterized in that, The residual connection module, when performing a residual connection between the current real-time feature and the context feature vector, and dynamically adapting the threshold based on the norm change rate of the feature in the feature space after the residual connection, is specifically used for: Calculate the vector norm of the residual connected features in the feature space at the current sampling time; Obtain the vector norm of the residual concatenated features at the previous sampling time, and calculate the difference between the two vector norms as the norm change rate; The norm change rate is compared with a preset benchmark change range, and the judgment threshold at the current moment is dynamically adjusted based on the comparison result to generate an adaptive threshold.

9. The data center fault detection system based on machine learning as described in claim 8, characterized in that, When the fault determination module generates a fault determination signal when the residual connection feature value exceeds the adaptive threshold, it is specifically used for: Obtain the residual post-connection feature value corresponding to each graph node in the embedded feature matrix at the current sampling time, compare the feature value of each graph node with the feature value of the graph node at the previous sampling time, and obtain the feature value increment of each graph node. The graph nodes are sorted from largest to smallest according to their feature value increments. The graph node at the top of the sort is selected as the graph node with the highest contribution. The physical location identifier and device identifier of the graph node with the highest contribution in the data center are extracted, and the physical location identifier and device identifier are packaged into fault root cause location information.

10. The data center fault detection system based on machine learning as described in claim 9, characterized in that, When the fault determination module generates fault root cause location information based on the monitoring point location corresponding to the highest contribution graph node in the embedded feature matrix, it is specifically used for: Obtain all neighboring graph nodes of the graph node with the highest contribution. The difference between the current feature value of each neighboring graph node and the current feature value of the graph node with the highest contribution is calculated to obtain the feature deviation of each neighboring graph node. Neighbor graph nodes whose feature deviation exceeds a preset deviation threshold are marked as associated fault nodes; The monitoring point locations of the associated fault nodes are merged with the monitoring point locations of the graph nodes with the highest contribution to obtain the fault root cause location information.

Images