A website multi-dimensional correlation fault diagnosis method and system

Abstract

This invention discloses a method for diagnosing multi-dimensional correlation faults in websites, belonging to the field of computer fault diagnosis technology. It includes acquiring multi-source heterogeneous operational data and performing time-series processing to generate a unified time-series data stream; constructing and continuously updating a dual-channel correlation baseline and comparing it to identify correlation anomalies and mark initial relationship disturbance events; using the initial relationship disturbance event as a starting point, performing reverse analysis on historical time-series data to construct a causal backtracking path, determining the root cause event of the fault, performing root cause verification and matching with repair strategies, and generating a fault diagnosis report. This invention employs a technical solution of constructing a dual-channel correlation baseline for anomaly identification and constructing a causal backtracking path from the initial relationship disturbance event as a starting point, which can quickly and accurately locate multi-dimensional correlation faults in a website system and generate a diagnostic report containing repair strategies.

Description

Technical Field

[0001] This invention relates to the field of computer fault diagnosis technology, and in particular to a method and system for diagnosing multidimensional correlation faults in websites. Background Technology

[0002] With the development of internet technology, modern website systems generally adopt complex distributed, microservice architectures, and their stable operation depends on the collaborative work of numerous service components. To ensure service quality, real-time monitoring of website operation and timely fault diagnosis are crucial. Fault diagnosis technology aims to quickly identify anomalies and pinpoint root causes by analyzing various data generated during system operation, and is a core technical aspect of ensuring high website availability.

[0003] In related technologies, Chinese invention patent CN120639589B discloses a method and system for predicting abnormal states of multi-dimensional time-series equipment, including: collecting a multi-node operating status dataset and communication transmission layer timing offset information of a distributed equipment system; performing jitter and delay correlation processing on the data, and generating a set of communication stability features by quantifying the spatiotemporal correlation between jitter extreme values ​​and delay fluctuations; acquiring physical layer deformation and temperature drift data of communication cables, generating a physical layer disturbance feature sequence based on optical signal feature offset analysis and converting it into channel anomaly intensity features; coupling the communication stability features and channel anomaly intensity features across layers, and predicting the risk of communication node failure or data transmission anomalies based on the coupling result.

[0004] Furthermore, while the aforementioned technical solutions focus on physical and network layer fault prediction, they fail to cover more common upper-layer faults such as those in software and services. Based on correlation rather than causal inference, they struggle to trace the root causes of complex faults. Additionally, feature engineering relies on fixed hardware metrics, making it difficult to adapt to rapidly iterating software systems, and its emphasis on risk warning lacks support for fault diagnosis and repair. Summary of the Invention

[0005] To address the aforementioned issues, this invention provides a method and system for diagnosing multidimensional correlation faults in websites. The method employs a technical solution that involves constructing a dual-channel correlation baseline for anomaly identification and constructing a causal backtracking path from the initial relationship disturbance event. This approach enables rapid and accurate location of multidimensional correlation faults in website systems and generates diagnostic reports containing repair strategies.

[0006] The above objectives can be achieved through the following approach:

[0007] A method and system for diagnosing multi-dimensional correlation faults in websites includes: acquiring multi-source heterogeneous operational data generated during website operation and performing time-series processing to generate a unified time-series data stream; constructing and continuously updating a dual-channel correlation baseline, including a pattern baseline and a prediction baseline, based on the unified time-series data stream; comparing the real-time acquired unified time-series data stream with the dual-channel correlation baseline to identify correlation anomalies and marking the first identified correlation anomaly as an initial relationship disturbance event; acquiring historical time-series data, and performing reverse analysis on the historical time-series data starting from the initial relationship disturbance event to construct a causal backtracking path; determining the root cause event of the fault based on the causal backtracking path, performing root cause verification and matching with repair strategies, and generating a fault diagnosis report.

[0008] Optionally, generating a unified time-series data stream includes: parsing and cleaning the multi-source heterogeneous operating data to obtain multiple standardized events; attaching a source identifier and a precise timestamp to each standardized event to generate a timestamped standardized event; and aligning and aggregating the timestamped standardized events according to preset business logic time window rules to generate a unified time-series data stream.

[0009] Optionally, the construction and continuous updating of the dual-channel correlation baseline, including the pattern baseline and the prediction baseline, includes: performing statistical analysis on the unified time-series data stream to quantify the correlation strength between events from different sources at multiple time granularities, forming a pattern baseline; performing trend extrapolation based on the inherent static correlation patterns between events described in the pattern baseline to obtain the prediction baseline; and, during continuous operation, incrementally learning and dynamically updating the pattern baseline and the prediction baseline based on the new unified time-series data stream.

[0010] Optionally, the trend extrapolation based on the inherent static correlation pattern between events described in the pattern baseline includes: identifying cross-source event combinations according to the inherent static correlation pattern; simulating the collaborative behavior pattern of the cross-source event combinations in historical time series to obtain the linkage evolution trajectory within the future time window; obtaining the context information of the current operating environment, and performing adaptive correction and confidence assessment on the linkage evolution trajectory to generate a prediction baseline.

[0011] Optionally, identifying association anomalies includes: calculating the actual association strength between events in the unified time-series data stream and calculating the matching degree with the corresponding historical association strength pattern in the pattern baseline to obtain a first deviation; performing prediction verification based on the prediction baseline to obtain a second deviation; and marking the time point as an association anomaly when the first deviation or the second deviation exceeds a preset association threshold.

[0012] Optionally, the prediction verification based on the prediction baseline includes: comparing the unified time-series data stream with the linked evolution trajectory in terms of morphology, and extracting the consistency and rhythm deviation of the trajectory morphology; and calculating a second deviation based on the consistency and rhythm deviation.

[0013] Optionally, constructing the causal backtracking path includes: starting from the initial relationship perturbation event, tracing the intensity changes of related events step by step in the reverse direction of time in the historical time series data to obtain the event intensity evolution trajectory; based on the event intensity evolution trajectory, dynamically extracting the perturbation transmission features between each event and its predecessor event to generate a transmission feature sequence; evaluating the causal coherence of the events in the transmission feature sequence, and selecting key transmission events based on the evaluation results for reverse-order concatenation to generate a causal backtracking path.

[0014] Optionally, generating the fault diagnosis report includes: identifying core interference events in the transmission chain based on the causal backtracking path and determining them as root cause events; performing root cause verification and strategy adaptation based on the attributes and transmission path of the root cause events to obtain verification results and adaptation strategies; and structurally integrating the root cause events, the transmission path, the verification results, and the adaptation strategies to generate a fault diagnosis report.

[0015] Optionally, the method further includes: matching the type and attributes of the root cause event with a preset repair strategy library to obtain corresponding repair operation guidance; associating the repair operation guidance with the fault diagnosis report to generate an enhanced diagnosis report containing handling suggestions.

[0016] Based on the same inventive concept, this invention also provides a website multi-dimensional correlation fault diagnosis system, the system comprising: a data temporalization module, used to acquire multi-source heterogeneous operational data generated during website operation and perform temporalization processing to generate a unified temporalized data stream; a baseline construction module, used to construct and continuously update a dual-channel correlation baseline including a pattern baseline and a prediction baseline based on the unified temporalized data stream; an anomaly identification module, used to compare the real-time acquired unified temporalized data stream with the dual-channel correlation baseline, identify correlation anomalies, and mark the first identified correlation anomaly as an initial relationship disturbance event; a causal backtracking module, used to acquire historical time-series data, and starting from the initial relationship disturbance event, perform reverse analysis on the historical time-series data to construct a causal backtracking path; and a root cause diagnosis module, used to determine the root cause event of the fault based on the causal backtracking path, perform root cause verification and repair strategy matching, and generate a fault diagnosis report.

[0017] Compared with the prior art, the present invention has the following advantages:

[0018] 1. By constructing a dual-channel correlation baseline that includes a pattern baseline and a prediction baseline, this invention can not only identify the destruction of the inherent static correlation pattern between various monitoring indicators, but also capture the deviation of the dynamic evolution trend of the system, thereby improving the sensitivity and accuracy of fault detection and enabling the discovery of early and hidden faults that are difficult to detect by traditional single-point threshold monitoring methods.

[0019] 2. This invention proposes a mechanism that starts from an initial relationship disturbance event and performs reverse analysis on historical data to construct a causal backtracking path, thereby automating and intelligently locating the root cause of a fault. This data-driven tracing method eliminates excessive reliance on the prior knowledge and troubleshooting experience of maintenance personnel, shortens the time required for fault diagnosis, and improves the efficiency of root cause location.

[0020] 3. This invention integrates the entire process from data processing, anomaly identification, causal analysis to report generation, ultimately outputting a structured report containing the root cause of the fault, its propagation path, verification results, and remediation strategies. This provides operations and maintenance personnel with a complete view from fault symptoms to solutions, making fault handling more evidence-based, thereby improving decision-making quality and the success rate of fault repair, and enhancing the maintainability and stability of the website.

[0021] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating a website multidimensional correlation fault diagnosis method according to an embodiment of the present invention.

[0024] Figure 2 This is a schematic diagram of dual-channel correlation baseline and anomaly identification in an embodiment of the present invention.

[0025] Figure 3 This is a heatmap of the mode baseline-correlation strength matrix according to an embodiment of the present invention.

[0026] Figure 4 This is a root cause event candidate score histogram according to an embodiment of the present invention.

[0027] Figure 5 This is a schematic diagram of the structure of a website multidimensional correlation fault diagnosis system according to an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Reference Figure 1 One embodiment of the present invention proposes a method for diagnosing multidimensional correlation faults in websites. The method employs a technical solution that uses the construction of a dual-channel correlation baseline for anomaly identification and the reverse construction of a causal backtracking path starting from the initial relationship disturbance event. This method can quickly and accurately locate multidimensional correlation faults in a website system and generate a diagnostic report containing repair strategies.

[0030] The method described in this embodiment specifically includes:

[0031] Optionally, generating a unified time-series data stream includes:

[0032] The multi-source heterogeneous operational data is analyzed and cleaned to obtain multiple standardized events;

[0033] Each standardized event is appended with a source identifier and a precise timestamp to generate a standardized event with a timestamp;

[0034] Based on the preset business logic time window rules, the standardized events with timestamps are aligned and aggregated to generate a unified time-series data stream.

[0035] Specifically, this process consists of three core actions linked together: parsing and cleaning, timestamp and source identification, and alignment and aggregation. The first step is parsing and cleaning. The input is multi-source heterogeneous runtime data, such as web server access logs (e.g., Nginxaccess.log), application server error stack logs, database slow query logs, and operating system-level performance metrics collected through monitoring agents, such as CPU usage and memory consumption. First, data from different sources is processed according to a pre-defined parsing rule base. For example, Nginx logs are segmented using regular expressions, and JSON-formatted application logs are directly extracted using key-value pairs. After processing, the extracted key information is mapped to a unified internal data structure to form standardized events. This structure includes fields such as event type, event level, and key metric values. During the cleaning phase, low-information debug-level logs are filtered out, and key fields are normalized. For example, status codes representing success or failure are uniformly converted to boolean values ​​or specific enumeration values ​​to enhance data consistency. The second step is to attach a source identifier and a precise timestamp to each standardized event. For each standardized event obtained from the previous step, two key metadata fields are added. The first is the source identifier, a unique string clearly indicating the physical or logical source of the event, such as "nginx-server-01-access" or "user-auth-service-error". The second is the precise timestamp, preferentially using the event's own recorded occurrence time and uniformly converting it to a Unix timestamp with millisecond precision. If the original data lacks a precise timestamp, the entry time of the data acquisition into the processing pipeline is used as a substitute, and it is marked as a non-original timestamp to distinguish the precision level. The output of this step is a series of standardized event streams with timestamps, each event being an independent and fully informational data unit. The third step performs alignment and aggregation according to preset business logic time window rules. A fixed time window size can be set; the engineering value range for this parameter is typically between 5 and 60 seconds, depending on the typical response time of business failures. The time axis is divided into continuous time windows, using the time window size as the step size. For all standardized events with timestamps falling within the same time window, they are grouped according to their source identifier and event type. Subsequently, the event sets within each group are categorized and analyzed to generate quantitative metrics for that event type within that window. For example, API error events are typically analyzed using counts, while metrics like CPU utilization are typically analyzed by averaging or maximizing. Finally, at the end of each time window, the aggregated results of all event types are combined into a high-dimensional vector. Each dimension of this vector corresponds to a specific monitoring item. The vectors generated by all time windows are arranged in chronological order to form the final output, i.e., a unified time-series data stream.

[0036] For example, to achieve real-time monitoring of an e-commerce platform, this method first needs to generate a unified time-series data stream. The platform consists of a front-end Nginx server, a back-end user authentication service, and a MySQL database, which respectively generate access logs, application error logs, and slow query logs. The system first parses and cleans these three types of multi-source heterogeneous runtime data. For example, an Nginx access log entry 192.168.1.1--[10 / Apr / XXXX:14:20:05+0800]"GET / api / user / profileHTTP / 1.1"503128, is parsed using regular expressions to extract fields such as time, request method, URL, and status code, discarding routine debugging information with a status code of 200, and converting it into a standardized event. Next, a source identifier and a precise timestamp are appended to each standardized event, generating a standardized event with a timestamp. The aforementioned Nginx error log events will have their source identifier appended as "nginx-server-01", and their log time 10 / Apr / XXXX:14:20:05+0800 will be converted to a millisecond-level Unix precise timestamp. Finally, according to the preset business logic time window rules, the standardized events with timestamps are aligned and aggregated. Assuming the time window size is set to 10 seconds, within the time window from 14:20:00 to 14:20:10, a total of 3 events with status code 503 from "nginx-server-01" and 1 slow query event from "mysql-main-db" are received. These will be counted and analyzed, and at the end of the time window, a high-dimensional vector [nginx_503_count:3,mysql_slow_query_count:1,...] will be generated. This vector represents a slice of the unified time-series data stream at time 14:20:10. By employing a three-step strategy of parsing, labeling, and aggregation, the raw, chaotic, and heterogeneous data is transformed into a vector sequence with a unified structure and time alignment, providing standardized input for all subsequent quantitative analysis and model training.

[0037] Optionally, the construction and continuous updating of the dual-channel correlated baseline, which includes the model baseline and the prediction baseline, includes:

[0038] Statistical analysis is performed on the unified time-series data stream to quantify the correlation strength between events from different sources at multiple time granularities, forming a pattern baseline;

[0039] Based on the inherent static correlation patterns between events described in the pattern baseline, trend extrapolation is performed to obtain the prediction baseline;

[0040] During continuous operation, the pattern baseline and the prediction baseline are incrementally learned and dynamically updated based on the new unified time-series data stream.

[0041] Specifically, the first step is to construct a baseline model by selecting a representative historical time-series data stream, typically spanning multiple business cycles, such as 14 to 30 days. For this data, statistical analysis is performed at several preset time granularities, such as 1 minute, 5 minutes, and 15 minutes. At each time granularity, the correlation strength between any two event sequences is calculated. For continuous metrics, such as CPU utilization and response latency, the correlation strength is quantified using the Pearson correlation coefficient formula. The calculation of correlation strength... ,have:

[0042] ;

[0043] in, , This is the aggregate value of two different event sequences within the i-th time window; , This represents the average of the corresponding event sequence over the entire historical period. This represents the total number of time windows. This calculation yields one or more association strength matrices, where each element... These matrices represent the historical correlation strength between events i and j. Together, they form the pattern baseline, which depicts the inherent static correlation patterns across different time scales. Next, trend extrapolation is performed based on the established pattern baseline to generate the predictive baseline. This extrapolation is performed using a multivariate time series forecasting model, such as a vector autoregressive (VAR) model. This model treats all dimensions in the unified time-series data stream as a vector variable and predicts future values ​​based on their historical values. The pattern baseline plays a crucial guiding role in this process; the model focuses on and learns the linkage patterns between event pairs with high correlation strength in the pattern baseline. For example, if the pattern baseline shows a strong positive correlation between the number of successful user logins and the number of order creations, the model will ensure that the predicted values ​​of these two indicators maintain this coordinated trend during forecasting. The output of this step is the predictive baseline, which is a sequence of predicted values ​​for each monitored indicator within a series of future time windows, constituting the expected evolution trajectory of the system's normal behavior. Figure 2As shown, the gray area represents the "pattern baseline" formed based on historical statistical data, the dashed line is the "prediction baseline" generated based on inherent patterns and trend extrapolation between events, and the real-time data stream is represented by a solid line. When a real-time data point, marked by a circle in the figure, significantly deviates from the predicted trajectory and simultaneously breaks through the boundary of the historical normal range, it is identified as a "correlation anomaly." Finally, to address system behavior drift caused by website architecture iterations or changes in business models, incremental learning and dynamic updates of the dual-channel correlation baseline are necessary. A relatively short update cycle, such as every 24 hours, is used to analyze newly generated, non-anomaly-marked unified time-series data streams. It employs a weighted moving average algorithm with a forgetting factor to update the correlation strength values ​​in the pattern baseline. The updated correlation strength is then calculated. ,have:

[0044] ;

[0045] in, This is the learning rate, typically ranging from 0.05 to 0.2. The association strength is calculated based on the latest data window; This represents the historical correlation strength value. Simultaneously, the predictive model upon which the baseline relies is periodically retrained or its parameters fine-tuned using new data to ensure its predictive ability remains consistent with the current state. For example... Figure 3 As shown in the figure, the shades of gray in each cell represent the correlation strength between two events, such as "API delay" and "DBCPU utilization," in historical data. A coefficient value close to 1 (darker shade) indicates a strong positive correlation, while a value close to -1 indicates a strong negative correlation (represented by a lighter shade in the figure). A value close to 0 indicates no significant correlation.

[0046] For example, after obtaining a unified time-series data stream covering the past 30 days from an e-commerce platform, a dual-channel correlation baseline, including a pattern baseline and a prediction baseline, was constructed and continuously updated. First, two key metrics were selected: X represents "database CPU utilization," and Y represents "average API response latency." Data from four consecutive time windows were selected for analysis at a 15-minute time granularity, where n is the total number of time windows, which is 4 in this case. The data is as follows: the X sequence is [20, 22, 60, 65], and the Y sequence is [100, 110, 500, 520]. First, the mean was calculated; the mean of database CPU utilization is equal to... The average API response latency is equal to After obtaining the average database CPU utilization and API average response latency, the correlation strength is calculated. This is a very strong positive correlation, which is recorded in the pattern baseline. Subsequently, based on the inherent static correlation pattern between events described in the pattern baseline, trend extrapolation is performed. The system uses a VAR model to learn the aforementioned strong positive correlation and generates a predicted sequence of API response latency and database CPU utilization for the next 24 hours, serving as the prediction baseline. Finally, during continuous operation, for example on day 31, the system collects new data and calculates the correlation strength for the most recent 24 hours to be 0.95. A learning rate of 0.1 and a historical correlation strength value of 0.998 are set for dynamic updates. The updated correlation strength... This indicates that the system smoothly absorbs new data patterns. By conducting in-depth statistical analysis of historical data to uncover the inherent connections between different parts of the system as a static benchmark, the baseline failure problem caused by system evolution is reduced.

[0047] Optionally, the trend extrapolation based on the inherent static correlation patterns between events described in the pattern baseline includes:

[0048] Based on the inherent static association pattern, cross-source event combinations are identified;

[0049] Simulations are performed based on the collaborative behavior patterns of the cross-source event combinations in historical time series to obtain the linkage evolution trajectory within future time windows.

[0050] Obtain the context information of the current operating environment, and perform adaptive correction and confidence assessment on the linkage evolution trajectory to generate a prediction baseline.

[0051] Specifically, this process is accomplished by identifying key event combinations, simulating their collaborative behavior, and correcting for real-time context, ensuring the high context-awareness and practicality of the prediction baseline. The first step is to identify cross-source event combinations. First, the correlation strength matrix in the pattern baseline is traversed, and a preset strong correlation threshold is applied, typically set between 0.7 and 0.9, to filter out all event pairs with an absolute correlation strength higher than this threshold. Then, these event pairs are examined, retaining only those combinations whose sources belong to different system modules or services, such as one from front-end monitoring and the other from the back-end database. These selected combinations are cross-source event combinations, representing key characteristics of the interaction between different internal components. The second step is to simulate the historical collaborative behavior patterns of these combinations, generating a linked evolution trajectory. Multivariate time series models, such as Long Short-Term Memory (LSTM) networks, are used to train the historical unified temporal data stream for each cross-source event combination. The goal of model learning is to capture the temporal dependencies and propagation delays between events within the combination; for example, approximately 5 seconds after a rise in user requests, the query pressure on the back-end database will increase synchronously. After training, the latest time-series data is used as input to the model to predict N time steps forward, where N typically ranges from 10 to 30 time windows. The multi-dimensional vector sequence of these N future time points output by the model collectively constitutes the uncorrected trajectory of the linked evolution. The third step involves acquiring contextual information from the current operating environment and adaptively correcting and evaluating the confidence level of the trajectory. Contextual information is actively retrieved from external systems, such as the release system, marketing activity calendar, or configuration center. This information, such as "a version release has just been completed" or "currently during a peak flash sale event," is encoded as event features. The linked evolution trajectory is adjusted using preset correction rules or a trained correction model. For example, if a "version release" event is detected, the upper bound of the tolerance for the predicted application error rate metric is temporarily increased. Simultaneously, a confidence level assessment is performed for each prediction point, generating a confidence score. The calculation of the confidence score... ,have:

[0052] ;

[0053] in, It is the predicted average of a certain indicator at future points in time, while This is the standard deviation of the predicted value. These two parameters can be obtained together during prediction using ensemble learning methods such as Monte Carlo Dropout. The confidence score reflects the stability of the prediction. The larger the value, the higher the uncertainty of the model's prediction results, and the lower the confidence score. Finally, the adaptively corrected trajectory with the added confidence score is officially determined as the prediction baseline for subsequent real-time anomaly detection.

[0054] For example, to generate an accurate predictive baseline from an established pattern baseline, trend extrapolation needs to be performed. The first step is to identify cross-source event combinations based on the inherent static correlation patterns. Traversing the pattern baselines, a strong correlation threshold of 0.8 is set. It is found that the correlation strength between "authentication failure count of the user service module" and "5xx error count of the Nginx front-end server login page" is 0.86, higher than the threshold, and their source identifiers are different; therefore, this event pair is identified as a cross-source event combination. The second step is to simulate the collaborative behavior patterns of the cross-source event combination in historical time series. Using a pre-trained LSTM model, inputting a unified time-series data stream of the combination over the past 60 time windows (e.g., 30 minutes), the model learns that after the authentication failure count increases, approximately two time windows later, i.e., 10 seconds later, the login page 5xx error count will also increase. Based on this pattern, the model predicts the evolution over the next 20 time windows, outputting a sequence containing 20 two-dimensional vectors; this sequence represents the uncorrected, interconnected evolution trajectory. The third step involves obtaining the context information of the current operating environment and performing adaptive correction and confidence assessment on the linked evolution trajectory. The context information "the flash sale will begin at 10:00 AM" is obtained from the marketing calendar. Based on preset correction rules, the predicted value of "authentication failure count" after 10:00 AM in the linked evolution trajectory is temporarily increased by 30% to accommodate the traffic surge brought by the event. Simultaneously, the confidence score of the corrected trajectory is assessed. For example, at 10:01 AM, the model's average prediction for "login page 5xx error count" is 50, and its standard deviation is 5. Therefore, the confidence score for this prediction point is... This context-corrected trajectory, with an added confidence score, ultimately forms the prediction baseline. By selecting key event combinations, simulating their interconnected behaviors using a deep learning model, and incorporating external contextual information for intelligent correction, a highly context-aware dynamic prediction standard is generated, improving the accuracy and reliability of the prediction baseline.

[0055] Optionally, identifying associated anomalies includes:

[0056] Calculate the actual correlation strength between events in the unified time-series data stream, and calculate the matching degree with the corresponding historical correlation strength pattern in the pattern baseline to obtain the first deviation degree;

[0057] Based on the predicted baseline, a prediction verification is performed to obtain the second deviation.

[0058] When the first deviation or the second deviation exceeds the preset association threshold, the time point is marked as an association anomaly.

[0059] Specifically, the identification process first initiates the verification of the first channel, i.e., calculating the first deviation. Within a preset sliding time window, typically 5 to 15 minutes in size, a unified time-series data stream generated in real time is continuously acquired. Within this window, the current actual correlation strength is calculated for any two event sequences. This calculation uses the same quantization method as when constructing the pattern baseline, obtaining a real-time correlation strength value. Subsequently, the historical correlation strength pattern of this pair of events at the same time-series granularity is queried from the pattern baseline. The first deviation is the measure of the difference between these two strength values, typically represented using the normalized absolute difference. The calculation of the first deviation... ,have:

[0060] ;

[0061] in, It is the strength of the association between events calculated within the current sliding window. The historical correlation strength is obtained from the pattern baseline. Simultaneously, a second-channel verification is initiated, i.e., prediction verification based on the prediction baseline, to obtain the second deviation. The form of the real-time acquired unified time-series data stream is compared with the linkage evolution trajectory provided by the prediction baseline. A value representing the degree of dynamic deviation, i.e., the second deviation, is calculated. Finally, a composite trigger condition is used to determine the correlation anomaly. This condition integrates the verification results of the two channels. One or more correlation thresholds are preset. The condition is satisfied when the first and second deviations exceed their corresponding thresholds. In engineering practice, the corresponding thresholds are usually determined based on historical data and acceptable false alarm rates, using statistical methods such as receiver operating characteristic curve analysis, and their values ​​are generally between 0.3 and 0.6. Once the trigger condition is met, the starting time point of the current time window is marked as a correlation anomaly, and the specific event pair that triggered the trigger and the corresponding deviation value are recorded as input for subsequent causal backtracking analysis.

[0062] For example, during the operation of an e-commerce platform, it is necessary to identify correlation anomalies in real time. Assume that dual-channel verification begins at 3:30 PM. First, the actual correlation strength between events in the unified time-series data stream is calculated, and the matching degree is calculated against the pattern baseline to obtain the first deviation. Analyzing the real-time data of "database CPU utilization" and "API average response latency" over the past 10 minutes, the actual correlation strength between them is calculated to be 0.15. This may be because a background data synchronization task unrelated to the API causes an increase in database CPU, but the API latency does not increase accordingly. From the pattern baseline, the historical correlation strength pattern for these two metrics is 0.998. Therefore, the first deviation is calculated. Meanwhile, prediction verification is performed based on the prediction baseline to obtain the second deviation. Comparing the real-time API latency data stream pattern with the correlation evolution trajectory provided by the prediction baseline, it was found that the patterns were basically consistent, and the rhythm showed no significant deviation. The calculated second deviation was 0.12. Finally, a judgment was made. The preset correlation threshold was 0.5. Since the calculated first deviation was 0.85, exceeding the preset correlation threshold of 0.5, even though the second deviation did not exceed the threshold, the composite triggering condition was met. Therefore, the current time point was marked as a correlation anomaly point, and it was recorded that the alarm was triggered by the disruption of the correlation between "database CPU utilization" and "API average response latency". By using two independent verification channels—static pattern matching and dynamic trajectory prediction—to examine the real-time status of the system in parallel, different types of behavioral deviations can be captured, enhancing the sensitivity and coverage of anomaly detection.

[0063] Optionally, the prediction verification based on the prediction baseline includes:

[0064] The unified time-series data stream is compared with the linked evolution trajectory to extract the degree of consistency and rhythm deviation of the trajectory morphology.

[0065] The second deviation is calculated based on the degree of agreement and the rhythm deviation.

[0066] Specifically, the first step in this verification process is to perform morphological comparison and extract the degree of agreement between trajectory morphologies. A recent time window is extracted, such as the past 10 minutes of the unified time-series data stream, and aligned with the corresponding time-segment evolution trajectory in the prediction baseline. The Dynamic Time Warping (DTW) algorithm is used to calculate the similarity between the two multidimensional time series. The DTW algorithm can find the non-linear alignment path between the two series and calculate the minimum cumulative distance. This distance value directly reflects the difference in shape between the two. The calculation of the minimum cumulative distance... ,have:

[0067] ;

[0068] Among them, for It is a time series with a length of As for For another time series, the length is ; Let be the Euclidean distance, representing the local matching cost between the two points; It is a path consisting of several pairs of indices (i,j), where each pair (i,j) represents: aligning the i-th point of A with the j-th point of B; The set of all paths that satisfy the constraint, namely, (1,1) must be the starting point of the path. , The path must be the endpoint, cannot be reversed, and cannot skip points; each step must move at least one sequence index. To obtain a standardized fit, the following transformation is used. For calculating morphological fit... ,have:

[0069] ;

[0070] in, A positive scaling factor is used to adjust the sensitivity of distance to the degree of fit. The degree of fit ranges from 0 to 1; the closer the value is to 1, the better the shape of the real-time trajectory matches the predicted trajectory. The second step in this verification process is to extract the rhythm deviation. A cross-correlation function is used to analyze the two time series. By calculating the correlation between the two series at different time delays, the delay value that maximizes the correlation is found, which is the rhythm deviation. It represents how many time units the real-time data stream needs to be shifted to achieve optimal synchronization with the predicted trajectory. The calculation of the rhythm deviation... ,have:

[0071] ;

[0072] in, The time delay variable represents the number of time units that will shift the predicted trajectory backward. This represents the real-time data stream value at time point t; This represents the predicted baseline trajectory value at time point t+τ; n is the total number of time points within the analysis time window. This represents the value τ that maximizes the sum. A non-zero rhythm deviation indicates a change in the system's response rhythm. Finally, the second deviation is calculated based on the obtained fit and rhythm deviation. Since the fit and rhythm deviation have different dimensions, they cannot be directly arithmetically calculated. First, they are converted into dimensionless deviation components. For calculating the second deviation... ,have:

[0073] ;

[0074] in, It is a deviation of the morphology from the component; This is due to rhythm deviation; This is the total length of the analysis window, i.e., the number of time windows; It is the normalized rhythm deviation component; and These are the weighting coefficients for form and rhythm, respectively. They are both positive numbers and sum to 1. In business scenarios that are particularly sensitive to changes in rhythm, these are important considerations. The weight can be appropriately increased to 0.6 to 0.7. This comprehensively calculated second deviation value, as a value between 0 and 1, fully reflects the degree of deviation between the real-time data stream and the prediction baseline in dynamic behavior.

[0075] For example, suppose we are analyzing the dynamic behavior of the combination of "number of user orders" and "inventory deduction service QPS," with a time window length of 30 minutes containing 60 time points. The first step is to use the most recent 30 minutes of real data as time series A, and the trajectory of the corresponding time period in the predicted baseline as time series B. After calculation using the Dynamic Time Warping (DTW) algorithm, the minimum cumulative distance between the two multidimensional time series is 80. Setting the scaling factor to 0.005, we calculate the morphological fit. The second step is to extract the rhythm deviation. Using a cross-correlation function to analyze sequences A and B, it was found that the correlation between the two sequences reaches its maximum when sequence A is shifted to the right by 2 time units. This means that the actual user ordering behavior lags behind the prediction by 2 time windows, i.e., the rhythm deviation is 2. Finally, based on the consistency and rhythm deviation, a second deviation is calculated. The morphology weight coefficient is set to 0.6, the rhythm weight coefficient to 0.4, and the total length L of the analysis window to 60. The second deviation is then calculated. This value comprehensively reflects the degree to which real-time data deviates from predictions in terms of form and rhythm. By breaking down the elusive "dynamic behavior deviation" into two quantifiable dimensions, "morphological similarity" and "temporal synchronization," and scientifically integrating them into a comprehensive indicator, potential internal processing delays can be revealed.

[0076] Optionally, the construction of the causal backtracking path includes:

[0077] Starting from the initial relationship disturbance event, the intensity changes of related events are gradually traced in the reverse direction of time in the historical time series data to obtain the event intensity evolution trajectory;

[0078] Based on the event intensity evolution trajectory, the perturbation transmission features between each event and its preceding event are dynamically extracted to generate a transmission feature sequence.

[0079] The events in the transmission feature sequence are evaluated for causal coherence, and key transmission events are selected based on the evaluation results and connected in reverse order to generate a causal backtracking path.

[0080] Specifically, the first step involves tracing and generating an event intensity evolution trajectory from the initial relationship disturbance event in historical time-series data. Starting from the occurrence time T0 of the marked initial relationship disturbance event, a backtracking time window Tw is set, its length typically set to 30 to 60 minutes based on the fault propagation speed of the business system. Within this time interval [T0-Tw, T0], based on records in the pattern baseline, all other indicators with strong historical correlations to the indicators in the initial relationship disturbance event are identified (e.g., correlation strength greater than 0.6). Then, the complete data sequences of these identified indicators within this time window are extracted from the historical unified time-series data stream. This collection of data sequences collectively constitutes a multi-dimensional event intensity evolution trajectory. The second step involves dynamically extracting disturbance propagation features based on the event intensity evolution trajectory, generating a propagation feature sequence. For any two event sequences in the event intensity evolution trajectory, the disturbance propagation feature vector between them is calculated. This vector primarily contains two core features. The first is the propagation delay, obtained by calculating the cross-correlation function of two sequences and finding the time delay corresponding to the peak. It represents the time required for a disturbance to propagate from the source event Ei to the target event Ej. For calculating the propagation delay... ,have:

[0081] ;

[0082] in, The value of the source event at time point t; The value of the target event at time point t+τ; This indicates the value t corresponding to the maximum value; the summation range is all time points within the backtracking window. Secondly, it measures the information flow intensity, quantified by calculating the transfer entropy. For calculating from... arrive The transfer entropy ,have:

[0083] ;

[0084] in, for The state at the next moment; and Representing the target event respectively Historical state and source events at the current and k past moments. The historical state at the present and in the past (l moments); The probability of all three occurring simultaneously is obtained by frequency statistics from historical data; Given the historical states of Ej and Ei, let Ej be the probability of Ej taking a value in the next time step. This represents the probability of Ej taking a value at the next time step, given only its own historical state. These features are calculated for all possible event pairs, forming a list containing the source event, the target event, and their transmission features—the transmission feature sequence. The third step involves evaluating the causal coherence of the transmission feature sequence, filtering key transmission events, and connecting them to generate a causal backtracking path. A causal confidence score is calculated for each transmission relationship in the transmission feature sequence. The calculation of the causal confidence score... ,have:

[0085] ;

[0086] in, It is the transition entropy score after max-min normalization; Unit of time; and These are weighting coefficients, and their sum is 1. Weights are typically obtained based on expert experience or through training a machine learning model, for example... The value ranges from 0.6 to 0.8. Starting with the initial relationship disturbance event, at each time step, the upstream event with the highest causal confidence score is selected backward as the preceding node. This process continues until an event with no significant causal input or the starting point of the backtracking window is reached. The resulting sequence of key transmission events, arranged in reverse chronological order, constitutes the final causal backtracking path.

[0087] For example, upon detecting an initial relationship disturbance event at 15:30 consisting of "API response latency spikes" and "high database CPU usage," the process of constructing a causal backtracking path is immediately initiated. Starting from the initial relationship disturbance event, the event intensity evolution trajectory is traced and generated in historical time-series data. 15:30 is set as time point T0, and the backtracking time window is set to 30 minutes. Within the interval from 15:00 to 15:30, based on the pattern baseline, a strong correlation is found between "Redis cache hit rate" and "number of active threads in the order service" and the initial event. Therefore, the complete time-series data of these four indicators within this 30-minute period is extracted to construct the event intensity evolution trajectory. The second step is to analyze the relationship between the decreasing sequence Ei of "Redis cache hit rate" and the increasing sequence Ej of "number of active threads in the order service." It is found that the peak of Ej is delayed by 15 seconds relative to the trough of Ei, therefore the propagation delay is 15 seconds. Next, the transition entropy from Ei to Ej is calculated. Assuming that the probability distribution of the historical states of the two sequences is used to calculate the transition entropy, a value of 0.75 bits is obtained, indicating that the information about the decrease in cache hit rate reduces the uncertainty regarding the increase in the number of order service threads. These features {source event: decrease in cache hit rate, target event: increase in the number of order service threads, propagation delay: 15s, information flow intensity: 0.75} are added to the propagation feature sequence. The third step is to set the weights. It is 0.7. The normalized transition entropy score is 0.8, which is 0.3. Starting from the initial event, a greedy algorithm is used in reverse, selecting the upstream event with the highest causal confidence score at each step. This ultimately yields a reverse-order event chain: "API response latency spikes" precedes "database CPU usage is high," which in turn precedes "increased number of active threads in the order service," which in turn precedes "sharp drop in Redis cache hit rate." This chain constitutes the final causal backtracking path. By quantifying the propagation delay and information flow between events, directional and strong causal relationships are extracted from correlations, and a graph search algorithm is used to construct the most probable fault propagation chain, shortening the fault localization time.

[0088] Optionally, generating the fault diagnosis report includes:

[0089] Based on the causal backtracking path, the core interference events in the transmission chain are identified and determined to be the root cause events of the failure.

[0090] Based on the attributes and propagation path of the fault root cause event, root cause verification and policy adaptation are performed to obtain verification results and adaptation policies.

[0091] The root cause event of the fault, the transmission path, the verification result, and the adaptation strategy are structurally integrated to generate a fault diagnosis report.

[0092] Specifically, the first step involves identifying the core disruptive events in the propagation chain based on the causal backtracking path and determining them as root cause events. A topological analysis is then performed on the causal backtracking path generated in the previous stage. Root cause events typically possess a key characteristic: they are nodes in the propagation chain with an in-degree of zero or a significantly lower in-degree than their out-degree. In other words, they are the primary initiator of the disturbance, not the propagator. The "root cause score" for each event node in the path is then calculated. The calculation of the root cause score... ,have:

[0093] ;

[0094] Where O is the sum of causal confidence in the downstream transmission relationship of the event as the source, i.e., the out-degree; I is the sum of causal confidence in the upstream influence of the event as the target, i.e., the in-degree. It is a very small positive number, for example Select the event with the highest root cause score, or the only event with an in-degree of zero, and officially mark it as the root cause event. For example, in the path where "high database CPU usage" leads to "slow API response," which in turn leads to "increased user access error rate," the root cause score of the "high database CPU usage" event will be much higher than that of other events. Figure 4 As shown in the diagram, root cause scores were calculated for events along the path. The "Sudden Drop in Redis Cache Hit Rate" event had a much higher out-degree than its in-degree, thus receiving the highest root cause score and being identified by the system as the root cause of the failure. The second step involves performing root cause verification and strategy adaptation based on the attributes and propagation path of the root cause event. First, detailed attributes of the root cause event are extracted, such as event type, source, and associated configuration items. Then, an internal knowledge base is queried or an external probe is invoked for proactive verification. For example, if the root cause event is "Memory Leak of a Service Instance," the verification operation might involve connecting to the corresponding server via SSH and executing the `jmap` command to check the JVM heap memory and confirm the presence of a large number of uncollectible objects. Simultaneously, the effect of a repair is simulated based on the propagation path. For instance, simulating whether the downstream API response time will return to normal within a preset time after restarting the service with the memory leak. This simulation can be based on similar scenarios in historical data. The results of this series of operations are recorded as verification results and adaptation strategies. The third step involves structurally integrating the root cause event, propagation path, verification results, and adaptation strategies to generate a fault diagnosis report. A typical fault diagnosis report includes the following core sections: a summary section, which briefly describes the fault phenomenon, its scope of impact, and diagnostic conclusions; a root cause analysis section, which clearly identifies the root cause event and provides its detailed attributes; a propagation path visualization section, which clearly shows the complete propagation chain from the root cause event to the final fault manifestation in the form of a time series diagram or directed acyclic graph; and a verification and recommendation section, which details the root cause verification steps performed, the evidence obtained, and provides clear remedial action recommendations based on the adaptation strategy. All this information is organized into a standardized data object, such as JSON or XML format, or directly rendered into a human-readable HTML page, thereby completing the generation of the fault diagnosis report.

[0095] For example, after generating a causal backtracking path from "API response latency spike" to "Redis cache hit rate plummets," a fault diagnosis report is generated. The first step is to identify the core disruptive events in the transmission chain based on the causal backtracking path, determining them as the root cause events of the fault. Path analysis reveals that the "Redis cache hit rate plummets" event is the starting point of the chain, with a causal confidence score O of 1.3 for its downstream propagation as the source, while the causal confidence score I for events affected by upstream events is 0.05. Pick The root cause score of the event The intermediate node "Increased Number of Active Threads in Order Service" had an O of 0.8 and an I of 0.7, significantly lower than the former. Therefore, "Sudden Drop in Redis Cache Hit Rate" was identified as the root cause event. The second step was to extract the attributes of the root cause event, including the source being "redis-cluster-main". By automatically connecting to the Redis instance using a probe and executing the MONITOR command, a large number of GET requests for non-existent keys were discovered, confirming cache penetration. This was the verification result. Next, a simulation of temporarily blocking the IP addresses initiating these abnormal requests at the firewall level was performed. It was found that the cache hit rate would recover within 1 minute, and the API response latency would return to normal within 3 minutes. This was the adaptation strategy. The third step was to generate a JSON report containing the root cause event "Redis Cache Penetration", visualized data of the propagation path, verification results as log fragments of the MONITOR command, and the adaptation strategy "It is recommended to block the malicious IP list at the WAF layer...". This structured data was finally rendered into an HTML page, which is the fault diagnosis report. By identifying the root cause through topological analysis and quantitative assessment, and then confirming the judgment and providing solutions through proactive verification and simulation, all information is finally integrated into a standardized, user-friendly report.

[0096] Optionally, the method further includes:

[0097] The corresponding repair operation guidance is obtained by matching the type and attributes of the root cause event with the preset repair strategy library.

[0098] The repair operation guidelines are associated with the fault diagnosis report to generate an enhanced diagnosis report containing handling suggestions.

[0099] Specifically, this process mainly includes two core actions: remediation strategy matching and diagnostic report correlation enhancement. First, remediation strategy matching is performed. The input is the root cause event identified in the previous stage, along with its complete type and attribute information. For example, the event type is "slow database query," and the attributes include "database instance ID," "hash value of the involved SQL statement," and "peak business period." A remediation strategy library is pre-maintained; this library is a hierarchical knowledge graph or relational database storing a large number of remediation plans. Each plan is bound to specific event type, service component, error code, and other attributes, and includes detailed remediation operation instructions. The matching process uses multi-level index queries. First, an exact match is performed using the type of the root cause event. If multiple candidate strategies are found, their attribute information, such as the source component and error message keywords, is used for secondary filtering until the unique best strategy is located. If no exact match is found, the process traces upwards to the event's parent category, for example, from "high CPU usage" to "performance bottleneck," to provide a more general and guiding remediation strategy. The output of this step is a structured remediation guide, which may include command-line scripts, configuration change diff files, a sequence of API calls to be executed, or even a preset job template linked to an automated operations and maintenance platform such as Ansible. Next, the acquired remediation guide is correlated with the original fault diagnosis report to generate an enhanced diagnosis report containing remediation recommendations. The remediation guide output from the previous step is injected as a separate data module into the data structure of the previously generated fault diagnosis report. At the report presentation level, a new section titled "Remediation Recommendations" or "Remediation Plan" is added. This section clearly lists the matched remediation guide, including descriptions of the operation steps, expected impact assessments, rollback plans, and contextual parameters required to perform the operation, such as the server IP address or service name automatically extracted and populated from the root cause event attributes. The resulting enhanced diagnosis report not only explains "what" and "why" the fault occurred but also clearly guides "how" to resolve it, improving the efficiency and accuracy of fault handling.

[0100] For example, after generating a fault diagnosis report for a "Redis cache penetration" fault, an enhanced process is further executed. First, the type and attributes of the fault root cause event are matched with a preset repair strategy library to obtain corresponding repair operation guidelines. The type of the fault root cause event is extracted as "cache penetration," and the attribute is component:Redis. The internal repair strategy library is queried, and the "Redis cache penetration" contingency plan node is matched in the knowledge graph. This contingency plan contains repair operation guidelines, the content of which is as follows: First, analyze the attack source and find the client IP with the longest idle connection time. Second, short-term handling: add the identified IP address to the firewall blacklist and provide an Ansible job link. Third, long-term repair: it is recommended to cache the data that is queried but not found at the application code level and set a short expiration time. Next, the repair operation guidelines are associated with the fault diagnosis report to generate an enhanced diagnosis report containing handling suggestions. A new `remediation_plan` field is added to the original JSON report structure, and the structured content of the above repair operation guidelines is filled in. When the report is rendered as an HTML page, a new section titled "Recommended Handling Solution" is generated. This section not only lists the steps, but the commands in Step 1 are copyable with a single click, the Ansible job link in Step 2 is clickable, and the {{ip}} parameter is automatically populated based on the malicious IP address obtained during the root cause analysis phase. This final report is an enhanced diagnostic report containing handling recommendations. By linking the diagnostic results to a standardized, actionable knowledge base, a closed loop for fault handling is achieved.

[0101] Based on the same inventive concept, such as Figure 5 As shown, the present invention also provides a website multi-dimensional correlation fault diagnosis system, the system comprising:

[0102] The data time-series module is used to acquire multi-source heterogeneous operational data generated during website operation and perform time-series processing to generate a unified time-series data stream.

[0103] The baseline construction module is used to construct and continuously update a dual-channel correlated baseline, including a pattern baseline and a prediction baseline, based on the unified time-series data stream.

[0104] An anomaly identification module is used to compare the real-time acquired unified time-series data stream with the dual-channel correlation baseline, identify correlation anomalies, and mark the first identified correlation anomaly as an initial relationship disturbance event.

[0105] The causal backtracking module is used to acquire historical time-series data, and starting from the initial relationship disturbance event, to perform reverse analysis on the historical time-series data to construct a causal backtracking path;

[0106] The root cause diagnosis module is used to determine the root cause event of the fault based on the causal backtracking path, perform root cause verification and match the repair strategy, and generate a fault diagnosis report.

[0107] It should be noted that the electrical connections between the various units described above do not necessarily represent direct or indirect connections. Any indirect connection method can be applied to the embodiments of the present invention as long as it achieves the purpose of the present invention. The above descriptions are merely exemplary embodiments of the present invention and should not be construed as limiting the scope of the present invention.

[0108] All equivalent changes and modifications made in accordance with the teachings of this invention are still within the scope of this invention. Those skilled in the art will readily conceive of other embodiments of this invention upon considering the specification and the disclosure of practical truth. This application is intended to cover any variations, uses, or adaptations of this invention that follow the general principles of this invention and include common knowledge or conventional techniques in the art not described herein.

Claims

1. A method for diagnosing multidimensional correlation faults in websites, characterized in that, The method includes: Acquire multi-source heterogeneous operational data generated during website operation and perform time-series processing to generate a unified time-series data stream; Based on the unified time-series data stream, a dual-channel correlated baseline, including the pattern baseline and the prediction baseline, is constructed and continuously updated; The unified time-series data stream acquired in real time is compared with the dual-channel correlation baseline to identify correlation anomalies, and the first identified correlation anomaly is marked as the initial relationship disturbance event. Historical time-series data is acquired, and starting from the initial relationship disturbance event, reverse analysis is performed on the historical time-series data to construct a causal backtracking path; Based on the causal backtracking path, the root cause event of the failure is identified, and root cause verification and remediation strategy matching are performed to generate a failure diagnosis report.

2. The website multi-dimensional correlation fault diagnosis method according to claim 1, characterized in that, The generation of a unified time-series data stream includes: The multi-source heterogeneous operational data is analyzed and cleaned to obtain multiple standardized events; Each standardized event is appended with a source identifier and a precise timestamp to generate a standardized event with a timestamp; Based on the preset business logic time window rules, the standardized events with timestamps are aligned and aggregated to generate a unified time-series data stream.

3. The website multi-dimensional correlation fault diagnosis method according to claim 1, characterized in that, The construction and continuous updating of the dual-channel correlated baseline, which includes both the model baseline and the prediction baseline, includes: Statistical analysis is performed on the unified time-series data stream to quantify the correlation strength between events from different sources at multiple time granularities, forming a pattern baseline; Based on the inherent static correlation patterns between events described in the pattern baseline, trend extrapolation is performed to obtain the prediction baseline; During continuous operation, the pattern baseline and the prediction baseline are incrementally learned and dynamically updated based on the new unified time-series data stream.

4. The website multidimensional correlation fault diagnosis method according to claim 3, characterized in that, The trend extrapolation based on the inherent static correlation patterns between events described in the pattern baseline includes: Based on the inherent static association pattern, cross-source event combinations are identified; Simulations are performed based on the collaborative behavior patterns of the cross-source event combinations in historical time series to obtain the linkage evolution trajectory within future time windows. Obtain the context information of the current operating environment, and perform adaptive correction and confidence assessment on the linkage evolution trajectory to generate a prediction baseline.

5. The website multi-dimensional correlation fault diagnosis method according to claim 4, characterized in that, The identified associated anomalies include: Calculate the actual correlation strength between events in the unified time-series data stream, and calculate the matching degree with the corresponding historical correlation strength pattern in the pattern baseline to obtain the first deviation degree; Based on the predicted baseline, a prediction verification is performed to obtain the second deviation. When the first deviation or the second deviation exceeds the preset association threshold, the time point is marked as an association anomaly.

6. The website multidimensional correlation fault diagnosis method according to claim 5, characterized in that, The prediction verification based on the prediction baseline includes: The unified time-series data stream is compared with the linked evolution trajectory to extract the degree of consistency and rhythm deviation of the trajectory morphology. The second deviation is calculated based on the degree of agreement and the rhythm deviation.

7. The website multi-dimensional correlation fault diagnosis method according to claim 1, characterized in that, The construction of the causal backtracking path includes: Starting from the initial relationship disturbance event, the intensity changes of related events are gradually traced in the reverse direction of time in the historical time series data to obtain the event intensity evolution trajectory; Based on the event intensity evolution trajectory, the perturbation transmission features between each event and its preceding event are dynamically extracted to generate a transmission feature sequence. The events in the transmission feature sequence are evaluated for causal coherence, and key transmission events are selected based on the evaluation results and connected in reverse order to generate a causal backtracking path.

8. The website multidimensional correlation fault diagnosis method according to claim 1, characterized in that, The generation of the fault diagnosis report includes: Based on the causal backtracking path, the core interference events in the transmission chain are identified and determined to be the root cause events of the failure. Based on the attributes and propagation path of the fault root cause event, root cause verification and policy adaptation are performed to obtain verification results and adaptation policies. The root cause event of the fault, the transmission path, the verification result, and the adaptation strategy are structurally integrated to generate a fault diagnosis report.

9. The website multidimensional correlation fault diagnosis method according to claim 1, characterized in that, The method further includes: The corresponding repair operation guidance is obtained by matching the type and attributes of the root cause event with the preset repair strategy library. The repair operation guidelines are associated with the fault diagnosis report to generate an enhanced diagnosis report containing handling suggestions.

10. A website multidimensional correlation fault diagnosis system, applied to a website multidimensional correlation fault diagnosis method as described in any one of claims 1-9, characterized in that, The system includes: The data time-series module is used to acquire multi-source heterogeneous operational data generated during website operation and perform time-series processing to generate a unified time-series data stream. The baseline construction module is used to construct and continuously update a dual-channel correlated baseline, including a pattern baseline and a prediction baseline, based on the unified time-series data stream. An anomaly identification module is used to compare the real-time acquired unified time-series data stream with the dual-channel correlation baseline, identify correlation anomalies, and mark the first identified correlation anomaly as an initial relationship disturbance event. The causal backtracking module is used to acquire historical time-series data, and starting from the initial relationship disturbance event, to perform reverse analysis on the historical time-series data to construct a causal backtracking path; The root cause diagnosis module is used to determine the root cause event of the fault based on the causal backtracking path, perform root cause verification and match the repair strategy, and generate a fault diagnosis report.

Images