Fault root cause positioning method, device and medium
By constructing a fault causal graph and executing a confidence propagation algorithm, the problems of opaque decision-making and high resource consumption in operation and maintenance fault diagnosis are solved. This achieves transparent and quantifiable automated root cause localization and provides highly reliable and interpretable fault root cause analysis.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA UNITED NETWORK COMM GRP CO LTD
- Filing Date
- 2026-04-28
- Publication Date
- 2026-07-21
AI Technical Summary
Existing technologies for fault diagnosis in operation and maintenance suffer from problems such as opaque decision-making processes, questionable reliability of results, and excessive resource consumption. In particular, solutions that rely on large language models are difficult to achieve transparent, quantifiable, and automated root cause localization.
Construct a fault causal logic graph G = (V, E, W, D), obtain the fault causal propagation chain by reverse traversal, and use confidence weights and dynamic adjustment factors to calculate confidence and locate the root cause of the fault, avoiding reliance on the reasoning ability of large language models.
It achieves automated root cause localization with transparent decision-making process, quantifiable and verifiable results, and high resource efficiency, solving the problems of "black box" and excessive resource consumption of large language models, and providing highly reliable and interpretable root cause localization results.
Smart Images
Figure CN122431930A_ABST
Abstract
Description
Technical Field
[0001] This application relates at least to the field of operation and maintenance technology, and in particular to a method, device and medium for locating the root cause of a fault. Background Technology
[0002] The troubleshooting of enterprise IT systems is currently evolving from reliance on human experience to intelligent solutions. Existing technical solutions are primarily based on a "retrieval-enhanced generation" (RAG) architecture, combined with Large Language Models (LLM), to output root cause diagnosis results and solutions. This type of solution leverages the generalization and understanding capabilities of LLM to automate fault analysis to a certain extent.
[0003] However, its fundamental technical path is "information retrieval → context construction → LLM decision-making," and the core and endpoint of the entire reasoning process rely on a large language model. Its drawbacks include:
[0004] 1. The decision-making process is not interpretable: The "black box" nature of the large language model makes its root cause analysis decision-making process opaque, making it difficult for operation and maintenance personnel to understand and trust its output results, and making it impossible to effectively verify and trace them.
[0005] 2. The reliability of the results is questionable: LLM may produce "illusions" and output fictitious content that is not actually true or irrelevant to the current context, which poses a risk of misjudgment in rigorous operation and maintenance scenarios.
[0006] 3. High resource consumption and dependence: Frequent calls to large-scale LLMs for inference computation incur high resource overhead, potentially resulting in high response latency, and the system performance is highly dependent on the performance of the selected LLM and the training data. Summary of the Invention
[0007] To address the aforementioned shortcomings, this application provides a method, apparatus, and medium for fault root cause localization, thereby solving the following technical problem: how to achieve automated root cause localization with transparent decision-making processes, quantifiable and verifiable results, and high resource efficiency.
[0008] In a first aspect, this application provides a method for locating the root cause of a fault, the method comprising:
[0009] Obtain the fault causal graph G = (V, E, W, D) of the operation and maintenance system. V includes several nodes v, v represents the fault event of the operation and maintenance system. E includes several directed edges e = (v_i, v_j), e represents the causal relationship from node v_i to node v_j. W includes a confidence weight w(e) associated with each edge e. D includes a dynamic adjustment factor d(vt) for whether each node v has an anomaly.
[0010] Obtain the node vp corresponding to a certain fault event p in the operation and maintenance system in G. Starting from vp, traverse G backwards to obtain all possible fault causal propagation chains {Path_k, k=1, ..., K} that caused p. Obtain the confidence Conf(Path_k) of each Path_k causing p based on w(e) and d(vt). Obtain the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value as the root cause of the fault that caused p.
[0011] Furthermore, obtain the fault causal graph G = (V, E, W, D) of the operation and maintenance system, specifically including:
[0012] Based on the expert knowledge of the operation and maintenance system, a basic fault causal relationship graph G1 = (V, E, W) is constructed, where V is the set of fault events of the operation and maintenance system, and W is assigned a value based on the statistical frequency of historical faults or expert experience.
[0013] Obtain real-time monitoring data from the operation and maintenance system. Based on the real-time monitoring data, obtain real-time abnormal evidence or real-time non-abnormal evidence for each fault event. If real-time abnormal evidence exists, obtain the dynamic adjustment factor d(vt)=a for the corresponding node at the corresponding time. If real-time non-abnormal evidence exists, obtain the dynamic adjustment factor d(vt)=b for the corresponding node at the corresponding time, where a is greater than b.
[0014] Furthermore, among which:
[0015] The value of w(e) is a real number in the interval (0, 1], a is a real number in the interval (1, 2), and b is a real number in the interval (0, 1).
[0016] Furthermore, after determining that the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is the root cause of the fault p, the method further includes:
[0017] Obtain feedback from operations and maintenance experts on whether the root cause of the fault p is correct. If the feedback is correct, increase the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value. Otherwise, decrease the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value to update the basic fault causal event graph G1 = (V, E, W).
[0018] Furthermore, obtain the node vp corresponding to a specific fault event p in the operation and maintenance system in G, specifically including:
[0019] Receive fault descriptions input by users in natural language, extract keywords from the fault descriptions and match them with a pre-set semantic mapping table to obtain a specific fault event p and its fault time t1 of the operation and maintenance system queried by the user;
[0020] Obtain d(vt1) of each node v corresponding to the fault time t1, and add d(vt1) of each node v to the basic fault causal logic graph G1 to obtain the fault causal logic graph G2 = (V, E, W, {d(vt1)}) at t1.
[0021] Obtain the node vp in the fault causal graph G2 at time t1 that represents a certain fault event p.
[0022] Furthermore, starting from vp, traverse G backwards to obtain all possible causal propagation chains {Path_k, k=1, ..., K} that could cause p to fail, specifically including:
[0023] Starting with vp, perform a breadth-first or depth-first traversal along all incoming edges in G2 until all paths reach a node without incoming edges. The node without incoming edges that is reached is the root cause candidate node.
[0024] Output the set of paths from each root cause candidate node vc_k to the starting node vp: {Path_k, k=1, ..., K}.
[0025] Furthermore, based on w(e) and d(vt), the confidence Conf(Path_k) that each Path_k triggers p is obtained, specifically including:
[0026] Get the edge {e_n, n=1, ..., N} on each Path_k, and get the confidence weight w(e_n) of each e_n;
[0027] Get the ingress node {v_n, n=1, ..., N} of each e_n on each Path_k, and get the dynamic adjustment factor d(v_nt1) of each v_n at t1;
[0028] Calculate the confidence score Conf(Path_k) for each Path_k triggering p = ∏ n=1, ..., N (w(e_n)×d(v_nt1)).
[0029] Furthermore, the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is identified as the root cause of the fault p, specifically including:
[0030] Get the Conf(Path_kmax) with the largest Conf(Path_k) value, get the complete node and edge sequence on Path_kmax corresponding to Conf(Path_kmax), get the root node vc_kmax of Path_kmax, and output vc_kmax, Path_kmax and Conf(Path_kmax) in a structured manner.
[0031] Secondly, this application provides a fault root cause location device, the device comprising:
[0032] The event graph module is used to obtain the event graph G = (V, E, W, D) of the failure cause and effect of the operation and maintenance system. V includes several nodes v, v represents the failure event of the operation and maintenance system. E includes several directed edges e = (v_i, v_j), e represents the causal relationship from node v_i to node v_j. W includes a confidence weight w(e) associated with each edge e. D includes a dynamic adjustment factor d(vt) for whether each node v has an anomaly.
[0033] The root cause localization module, connected to the event graph module, is used to obtain the node vp corresponding to a certain fault event p in the operation and maintenance system in G. Starting from vp, it traverses G backward to obtain all possible fault causal propagation chains {Path_k, k=1, ..., K} that caused p. Based on w(e) and d(vt), it obtains the confidence Conf(Path_k) of each Path_k causing p. The root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is the root cause of the fault that caused p.
[0034] Thirdly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the fault root cause localization method as described above.
[0035] This application provides a method, apparatus, and medium for fault root cause localization. By constructing a dedicated causal graph model (fault causal event graph) and executing a defined confidence propagation algorithm, the causal relationships of fault events are constructed in the causal graph model, and confidence weights are set for edges. Additionally, abnormal node information is collected, and dynamic adjustment factors for nodes are set. When analyzing the root cause of a fault event, the corresponding node is obtained in the graph, and the fault causal propagation chain is traced backward. Confidence is calculated using confidence weights and dynamic adjustment factors to locate the root cause of a fault event. This achieves automated root cause localization with transparent decision-making processes, quantifiable and verifiable results, and high resource efficiency. Attached Figure Description
[0036] Figure 1 This is a flowchart of a fault root cause localization method according to an embodiment of this application;
[0037] Figure 2 This is a fragment example diagram of a fault cause-effect diagram according to an embodiment of this application;
[0038] Figure 3 This is a flowchart of an adaptive learning mechanism according to an embodiment of this application;
[0039] Figure 4 This is a flowchart of another fault root cause localization method according to an embodiment of this application;
[0040] Figure 5 This is a schematic diagram of the structure of a fault root cause location device according to an embodiment of this application;
[0041] Figure 6 This is a schematic diagram of the structure of a computer-readable storage medium according to an embodiment of this application;
[0042] Figure 7 This is a schematic diagram of the structure of a computer device according to an embodiment of this application. Detailed Implementation
[0043] To enable those skilled in the art to better understand the technical solution of this application, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.
[0044] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining this application and are not intended to limit this application.
[0045] It is understood that, without conflict, the various embodiments and features in the embodiments of this application can be combined with each other.
[0046] It is understood that, for ease of description, only the parts relevant to this application are shown in the accompanying drawings, while parts unrelated to this application are not shown in the drawings.
[0047] It is understood that each module or unit involved in the embodiments of this application may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple modules or units may be integrated into one entity structure.
[0048] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this application may occur in a different order than that marked in the accompanying drawings.
[0049] It is understood that the flowcharts and block diagrams of this application illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, unit, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagrams and flowcharts may be implemented using a hardware-based device to implement the specified function, or using a combination of hardware and computer instructions.
[0050] It is understood that the modules and units involved in the embodiments of this application can be implemented by software or by hardware. For example, the modules and units can be located in the processor.
[0051] Example 1:
[0052] like Figure 1 As shown, this application provides a method for locating the root cause of a fault, the method comprising:
[0053] S1. Obtain the fault causal relationship graph G = (V, E, W, D) of the operation and maintenance system. V includes several nodes v, v represents the fault event of the operation and maintenance system. E includes several directed edges e = (v_i, v_j), e represents the causal relationship from node v_i to node v_j. W includes a confidence weight w(e) associated with each edge e. D includes a dynamic adjustment factor d(vt) for whether each node v has an anomaly.
[0054] S2. Obtain the node vp corresponding to a certain fault event p in the operation and maintenance system in G. Starting from vp, traverse G in reverse to obtain all possible fault causal propagation chains {Path_k, k=1, ..., K} that caused p. Obtain the confidence Conf(Path_k) of each Path_k that caused p based on w(e) and d(vt). Obtain the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value as the root cause of the fault that caused p.
[0055] In this embodiment, the provided method constructs a dedicated causal graph model (fault causal event graph) and executes a defined confidence propagation algorithm. It establishes causal relationships between fault events within the causal graph model, sets confidence weights for edges, and collects abnormal node information to set dynamic adjustment factors for nodes. When analyzing the root cause of a fault event, it obtains the corresponding node in the graph and traces the fault causal propagation chain backward. Confidence is calculated using confidence weights and dynamic adjustment factors to locate the root cause of the fault event. This achieves automated root cause localization with a transparent decision-making process, quantifiable and verifiable results, and high resource efficiency.
[0056] Specifically, this embodiment provides a method for locating the root cause of operational failures based on the confidence propagation of the event graph. This method does not rely on the reasoning ability of a large language model. Instead, it constructs a dedicated causal graph model and executes a set of deterministic algorithms to achieve automated root cause location with transparent decision-making process, quantifiable and verifiable results, and high resource efficiency. Its core lies in the construction of the event graph and the confidence propagation algorithm.
[0057] In one embodiment, obtaining the fault causal path graph G = (V, E, W, D) of the operation and maintenance system specifically includes:
[0058] Based on the expert knowledge of the operation and maintenance system, a basic fault causal relationship graph G1 = (V, E, W) is constructed, where V is the set of fault events of the operation and maintenance system, and W is assigned a value based on the statistical frequency of historical faults or expert experience.
[0059] Obtain real-time monitoring data from the operation and maintenance system. Based on the real-time monitoring data, obtain real-time abnormal evidence or real-time non-abnormal evidence for each fault event. If real-time abnormal evidence exists, obtain the dynamic adjustment factor d(vt)=a for the corresponding node at the corresponding time. If real-time non-abnormal evidence exists, obtain the dynamic adjustment factor d(vt)=b for the corresponding node at the corresponding time, where a is greater than b.
[0060] In this embodiment, the construction concept and specific definition of the event graph model are as follows:
[0061] 1. Model building concept:
[0062] The knowledge base of this embodiment is a reasoning graph specifically designed for causal reasoning. Unlike traditional knowledge graphs, which serve as "fact databases," reasoning graphs are "causal rule bases." Their core idea is to formally model the causal logic knowledge of operations and maintenance experts through a graph structure, providing a foundation for subsequent automated algorithm reasoning.
[0063] 2. Specific model and parameters:
[0064] The fundamental principle graph is a directed graph, formally defined as G = (V, E, W).
[0065] Node set (V): Represents an event or state in the operations and maintenance domain. Each node has a unique identifier and type attribute (e.g., v_id: "FIREWALL_OVERLOAD", v_type: "System state").
[0066] Edge set (E): A directed edge e = (v_i, v_j) uniquely represents a causal relationship from node v_i to node v_j (e.g., v_i “leads” v_j). Relation type attributes can be defined on the edge (e.g., relation_type: "leads_to").
[0067] Weight set (W): Each edge e is associated with a confidence weight w(e), the value of which is a real number in the interval (0, 1]. This weight is an initializeable model parameter, and its physical meaning is the degree of confidence that the causal relationship holds.
[0068] Initialization: w(e) can be directly assigned a value based on the statistical frequency of historical cases and the experience of domain experts (for example, experts set the weight of [malicious scanning] -> [surge in session count] to 0.9 based on historical experience).
[0069] Storage: This weight is stored as an attribute of the edge in the graph database along with the graph.
[0070] Based on the basic event graph, a timed event graph is constructed for the occurrence time of specific failure events, thereby integrating real-time evidence into the confidence assessment. A dynamic adjustment factor set D based on real-time monitoring data is introduced. Each node v is associated with a real-time dynamic adjustment factor d(vt). The weight of each edge e can be added to the d(vt) of its input node (the node connected in the starting direction of the edge), resulting in w'(e) = w(e) × d(vt). Alternatively, the confidence calculation formula can be modified to: Conf(Path_k) = [∏_(e ∈ Path_k) w(e)] × D(Evk), where D(Evk) is a calculation factor based on whether there is supporting evidence for the node on path k in the current dynamic situation. The value of d(vt) is as follows: 1.1 if the node has real-time anomalous evidence, 0.9 if it has real-time non-anomalous evidence, and 1 otherwise (this value can be left unset for that node).
[0071] In one embodiment, wherein:
[0072] The value of w(e) is a real number in the interval (0, 1], a is a real number in the interval (1, 2), and b is a real number in the interval (0, 1).
[0073] In this embodiment, the "slow application access" fault is used as an example to illustrate the solution. It is assumed that the event graph has been pre-constructed, and its relevant fragments are as follows: Figure 2 As shown in the figure (weights are marked, and the weights include real-time adjustment factors):
[0074] Step 301: Enter "Slow application access" to locate node H.
[0075] Step 302: Traverse backwards from H, and find two paths:
[0076] Path_1: A -> B -> C -> E -> H
[0077] Path_2: F -> G -> E -> H
[0078] Step 303: Calculate path confidence:
[0079] Conf(Path_1) = 0.9×0.95×0.99×0.99 ≈ 0.84
[0080] Conf(Path_2) = 0.7×0.8×0.99 ≈ 0.55
[0081] Step 304: Conf(Path_1) > Conf(Path_2), therefore the root cause is determined to be "malicious scanning", and the complete causal chain is output: malicious scanning -> surge in session count -> firewall overload -> TCP retransmission -> slow application access and confidence level 0.84.
[0082] In one embodiment, after determining the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value as the root cause of the fault p, the method further includes:
[0083] Obtain feedback from operations and maintenance experts on whether the root cause of the fault p is correct. If the feedback is correct, increase the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value. Otherwise, decrease the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value to update the basic fault causal event graph G1 = (V, E, W).
[0084] In this embodiment, an optional enhancement scheme—an adaptive learning mechanism—is set up to introduce a feedback loop to reflect the system's evolutionary capabilities, becoming a typical human-machine collaborative closed-loop feedback system. Its workflow is as follows: Figure 3 As shown:
[0085] 1. Input: The operations and maintenance expert verifies the root cause analysis results output by the system and provides a confirmation signal of "correct" or "incorrect". This is the starting point and driving force of the entire cycle.
[0086] 2. Decision-making and execution: Based on the confirmation signal, the system executes different weight adjustment strategies:
[0087] If the result is correct, the system will appropriately increase the confidence weight of all edges that make up the causal chain. For example, the formula w(e)_new = w(e)_old + α (where α is a small positive number, such as 0.01) is used to indicate reinforcement.
[0088] If the result is incorrect, the system will appropriately reduce the weight of the relevant edge, for example, w(e)_new = w(e)_old - β, as a penalty.
[0089] This is a heuristic parameter fine-tuning method, rather than machine learning training.
[0090] 3. Update and Storage: The adjusted new weights are written into the knowledge graph, completing the real-time update of the knowledge base.
[0091] 4. Effects and Cycles: The updated knowledge base (graph) is used for subsequent fault location reasoning, making the system's judgments increasingly accurate with the accumulation of experience. This forms a virtuous cycle of "practice -> verification -> learning -> further practice," truly bringing the system to life.
[0092] In one implementation, obtaining the node vp corresponding to a certain fault event p in the operation and maintenance system in G specifically includes:
[0093] Receive fault descriptions input by users in natural language, extract keywords from the fault descriptions and match them with a pre-set semantic mapping table to obtain a specific fault event p and its fault time t1 of the operation and maintenance system queried by the user;
[0094] Obtain d(vt1) of each node v corresponding to the fault time t1, and add d(vt1) of each node v to the basic fault causal logic graph G1 to obtain the fault causal logic graph G2 = (V, E, W, {d(vt1)}) at t1.
[0095] Obtain the node vp in the fault causal graph G2 at time t1 that represents a certain fault event p.
[0096] In this embodiment, the method is generally used to analyze the root cause of real-time fault events, but it does not exclude the possibility of tracing back the root cause of historical faults at a specified fault time.
[0097] In one implementation, G is traversed backwards from vp to obtain all possible causal propagation chains {Path_k, k=1, ..., K} that caused p to fail, specifically including:
[0098] Starting with vp, perform a breadth-first or depth-first traversal along all incoming edges in G2 until all paths reach a node without incoming edges. The node without incoming edges that is reached is the root cause candidate node.
[0099] Output the set of paths from each root cause candidate node vc_k to the starting node vp: {Path_k, k=1, ..., K}.
[0100] In this embodiment, the path is traced back to the nodes with no incoming edges, following the direction of the edge arrows. These nodes are potential root causes, such as... Figure 2 Malicious scanning and configuration errors.
[0101] In one implementation, the confidence Conf(Path_k) that each Path_k triggers p is obtained based on w(e) and d(vt), specifically including:
[0102] Get the edge {e_n, n=1, ..., N} on each Path_k, and get the confidence weight w(e_n) of each e_n;
[0103] Get the ingress node {v_n, n=1, ..., N} of each e_n on each Path_k, and get the dynamic adjustment factor d(v_nt1) of each v_n at t1;
[0104] Calculate the confidence score Conf(Path_k) for each Path_k triggering p = ∏ n=1, ..., N (w(e_n)×d(v_nt1)).
[0105] In this embodiment, the confidence level of each edge is represented by the product of the adjustment factor of the incoming node and the weight of the edge, and the confidence level of the entire path is represented by the product of all edges on the path.
[0106] In one implementation, the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is identified as the root cause of the fault p, specifically including:
[0107] Get the Conf(Path_kmax) with the largest Conf(Path_k) value, get the complete node and edge sequence on Path_kmax corresponding to Conf(Path_kmax), get the root node vc_kmax of Path_kmax, and output vc_kmax, Path_kmax and Conf(Path_kmax) in a structured manner.
[0108] In this embodiment, a method for locating the root cause of operational and maintenance failures is provided. The reasoning and decision-making process of the method is completed by a deterministic algorithm, without relying on large language models or data-driven deep learning models for core reasoning. The method includes the following steps:
[0109] Receive fault information;
[0110] Starting from the aforementioned fault phenomenon, a reverse traversal is performed in the pre-constructed event graph. The edges of the event graph represent the causal relationship between events or states and are assigned confidence weights. The edges of the event graph are uniquely used to represent causal relationships, and the values of the confidence weights are real numbers in the interval (0, 1).
[0111] During the traversal, for each path from the candidate root cause node to the starting point, the path confidence is obtained by multiplying the confidence weights of all edges on the path.
[0112] Based on the path confidence, the root cause is finally located from the candidate root cause nodes, and the root cause and the corresponding causal chain are output. The output results include the finally located root cause, the complete causal chain, and the path confidence of the causal chain.
[0113] Receive maintenance feedback information regarding the output results;
[0114] Based on the operation and maintenance feedback information, the confidence weights of relevant edges in the event graph are dynamically adjusted.
[0115] More specifically, the principles and steps of the root cause localization algorithm are as follows: Figure 4 As shown, its input is the fault phenomenon, and the output is the causal chain with the highest confidence. The specific algorithm steps are as follows:
[0116] Step 401: Fault Phenomenon Reception and Map Location
[0117] Input: The system receives a natural language description of the fault phenomenon P (e.g., "slow application access").
[0118] Processing: P is mapped to the corresponding node P in the event graph G through a pre-defined semantic mapping table or simple keyword matching.
[0119] Step 402: Reverse traversal based on causal logic
[0120] Operation: Starting from node P, perform a breadth-first or depth-first traversal of the graph G along all incoming edges (i.e., the reverse of causal relationships).
[0121] Termination condition: The traversal continues until all paths reach a node with no incoming edges (a root cause candidate node).
[0122] Output: This step outputs a set of paths from each root cause candidate node C_k to the starting node P: {Path_1, Path_2, ..., Path_K}.
[0123] Step 403: Calculation of path confidence (core algorithm)
[0124] Principle: This invention follows the principle that "the overall confidence of a causal chain is equal to the product of the confidence of each link in the chain." For each path Path_k = (e_1, e_2, ..., e_N), the formula for calculating its path confidence Conf(Path_k) is:
[0125] Conf(Path_k) = w(e_1)×w(e_2)×...×w(e_N)
[0126] Where w(e_n) is the weight of edge e_n. This calculation is deterministic and does not involve any probabilistic model training.
[0127] Step 404: Root Cause Determination and Result Output
[0128] Operation: Compare the Conf(Path_k) values of all paths in the set.
[0129] Decision: The starting node C_kmax corresponding to the path with the largest Conf(Path_k) value is determined as the root cause of the final location.
[0130] Output: The system outputs a structured result, including:
[0131] 1. Root cause node: C_kmax.
[0132] 2. Evidence causal chain: The complete sequence of nodes and edges from C_kmax to P.
[0133] 3. Overall confidence level: The value of Conf(Path_kmax).
[0134] The core intelligent analysis engine formed by the method in this embodiment can be integrated into an intelligent operation and maintenance platform. Its event graph can be initialized after systematic sorting based on existing knowledge bases and fault case databases. Its core algorithm is lightweight, efficient, and deterministic, and can be implemented based on mature graph databases (such as Neo4j) and their query languages (such as Cypher), without relying on expensive GPU computing power, and the technology stack is mature and reliable.
[0135] The beneficial effects of the method in this embodiment include:
[0136] 1. The core of this embodiment is the "model reasoning" paradigm, whose decision-making is completed by a deterministic, dedicated algorithm (performing reverse traversal and confidence propagation calculation on the reasoning graph), without relying on the reasoning ability of a large language model.
[0137] 2. The “Event Graph” in this embodiment is a causal rule base. Its edges are specifically and uniquely used to represent the causal relationship between events or states, and are accompanied by quantified confidence weights. It is the model foundation that drives the algorithm reasoning.
[0138] 3. This embodiment outputs a complete causal chain with quantified confidence, clearly demonstrating the complete evidence path from the root cause to the failure phenomenon, and the decision-making process is completely transparent and traceable.
[0139] 4. This embodiment avoids the large language model, fundamentally solving its inherent "black box" and "illusion" problems, and focuses on providing highly reliable, highly interpretable and resource-efficient root cause localization results.
[0140] Example 2:
[0141] like Figure 5 As shown, this application provides a fault root cause location device, the device comprising:
[0142] The event graph module 1 is used to obtain the event graph G = (V, E, W, D) of the failure cause and effect of the operation and maintenance system. V includes several nodes v, v represents the failure event of the operation and maintenance system, E includes several directed edges e = (v_i, v_j), e represents the causal relationship from node v_i to node v_j, W includes a confidence weight w(e) associated with each edge e, and D includes a dynamic adjustment factor d(vt) for whether each node v has an anomaly.
[0143] The root cause localization module 2, connected to the event graph module 1, is used to obtain the node vp corresponding to a certain fault event p in the operation and maintenance system in G. Starting from vp, it traverses G backward to obtain all possible fault causal propagation chains {Path_k, k=1, ..., K} that caused p. Based on w(e) and d(vt), it obtains the confidence Conf(Path_k) of each Path_k that caused p. The root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is the root cause of the fault that caused p.
[0144] In one embodiment, the event graph module 1 specifically includes:
[0145] The basic graph unit is used to construct a basic fault causal graph G1 = (V, E, W) based on the expert knowledge of the operation and maintenance system. V is the set of fault events of the operation and maintenance system, and W is assigned a value based on the statistical frequency of historical faults or expert experience.
[0146] The dynamic adjustment unit, connected to the basic graph unit, is used to acquire real-time monitoring data of the operation and maintenance system. Based on the real-time monitoring data, it acquires real-time abnormal evidence or real-time non-abnormal evidence of each fault event. If real-time abnormal evidence exists, it acquires the dynamic adjustment factor d(vt)=a of the corresponding node at the corresponding time. If real-time non-abnormal evidence exists, it acquires the dynamic adjustment factor d(vt)=b of the corresponding node at the corresponding time, where a is greater than b.
[0147] In one embodiment, wherein:
[0148] The value of w(e) is a real number in the interval (0, 1], a is a real number in the interval (1, 2), and b is a real number in the interval (0, 1).
[0149] In one embodiment, the apparatus further includes:
[0150] The adaptive learning module, connected to the event graph module 1 and the root cause localization module 2, is used to obtain feedback from the operation and maintenance experts on whether the root cause of the fault p is correct. If the feedback is correct, the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is increased; otherwise, the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is decreased, so as to update the basic fault causal event graph G1 = (V, E, W).
[0151] In one embodiment, the root cause localization module 2 specifically includes:
[0152] The description unit is used to receive the fault description input by the user in natural language, extract the keywords in the fault description and match them with a preset semantic mapping table to obtain a certain fault event p and its fault time t1 of the operation and maintenance system queried by the user.
[0153] The timing graph unit, connected to the description unit, is used to obtain d(vt1) of each node v corresponding to the fault time t1, and add d(vt1) of each node v to the basic fault causal logic graph G1 to obtain the fault causal logic graph G2 = (V,E, W, {d(vt1)}) at t1.
[0154] The node localization unit, connected to the timing graph unit, is used to obtain the node vp in the fault causal event graph G2 at time t1 that corresponds to a certain fault event p.
[0155] In one embodiment, the root cause localization module 2 specifically includes:
[0156] The root cause candidate unit, connected to the node location unit, is used to perform a breadth-first or depth-first traversal in G2 along all incoming edges, starting from vp, until all paths reach a node without incoming edges, and the node without incoming edges reached is the root cause candidate node.
[0157] The candidate path unit, connected to the root cause candidate unit, is used to output the set of paths {Path_k, k=1, ..., K} from each root cause candidate node vc_k to the starting node vp.
[0158] In one embodiment, the root cause localization module 2 specifically includes:
[0159] The path weight unit, connected to the candidate path unit, is used to obtain the edge {e_n, n=1,..., N} on each Path_k and to obtain the confidence weight w(e_n) of each e_n;
[0160] The path factor unit, connected to the path weight unit, is used to obtain the ingress node {v_n, n=1, ..., N} of each e_n on each Path_k, and to obtain the dynamic adjustment factor d(v_nt1) of each v_n at t1;
[0161] The path confidence unit, connected to the path factor unit, is used to calculate the confidence score Conf(Path_k) = ∏ for each Path_k causing p. n=1, ..., N (w(e_n)×d(v_nt1)).
[0162] In one embodiment, the root cause localization module 2 specifically includes:
[0163] The root cause output unit, connected to the path confidence unit, is used to obtain the Conf(Path_kmax) with the largest Conf(Path_k) value, obtain the complete node and edge sequence on Path_kmax corresponding to Conf(Path_kmax), obtain the root cause node vc_kmax of Path_kmax, and output vc_kmax, Path_kmax, and Conf(Path_kmax) in a structured manner.
[0164] Example 3:
[0165] like Figure 6 As shown, Embodiment 3 of this application provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it implements the fault root cause localization method as described in Embodiment 1.
[0166] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program units, or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.
[0167] like Figure 7As shown, this application can also provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the fault root cause localization method as described in Embodiment 1. This computer device can be the fault root cause localization device as described in Embodiment 2.
[0168] The memory is connected to the processor. The memory can be flash memory, read-only memory or other types of memory. The processor can be a central processing unit or a microcontroller.
[0169] Embodiments 1-3 of this application provide a method, apparatus, and medium for fault root cause localization. By constructing a dedicated causal graph model (fault causal event graph) and executing a defined confidence propagation algorithm, the causal relationship of fault events is constructed in the causal graph model, and the confidence weights of the edges are set. Additionally, abnormal node information is collected, and dynamic adjustment factors for the nodes are set. When analyzing the root cause of a fault event, the corresponding node is obtained in the graph, and the fault causal propagation chain is traced backward. The confidence is calculated using the confidence weights and dynamic adjustment factors to locate the root cause of the fault event. This achieves automated root cause localization with a transparent decision-making process, quantifiable and verifiable results, and high resource efficiency.
[0170] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of this application, and this application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this application, and these modifications and improvements are also considered to be within the scope of protection of this application.
Claims
1. A method for locating the root cause of a fault, characterized in that, The method includes: Obtain the fault causal graph G = (V, E, W, D) of the operation and maintenance system. V includes several nodes v, v represents the fault event of the operation and maintenance system. E includes several directed edges e = (v_i, v_j), e represents the causal relationship from node v_i to node v_j. W includes a confidence weight w(e) associated with each edge e. D includes a dynamic adjustment factor d(vt) for whether each node v has an anomaly. Obtain the node vp corresponding to a certain fault event p in the operation and maintenance system in G. Starting from vp, traverse G backwards to obtain all possible fault causal propagation chains {Path_k, k=1, ..., K} that caused p. Obtain the confidence Conf(Path_k) of each Path_k causing p based on w(e) and d(vt). Obtain the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value as the root cause of the fault that caused p.
2. The method according to claim 1, characterized in that, Obtain the fault causal graph G = (V, E, W, D) of the operation and maintenance system, specifically including: Based on the expert knowledge of the operation and maintenance system, a basic fault causal relationship graph G1 = (V, E, W) is constructed, where V is the set of fault events of the operation and maintenance system, and W is assigned a value based on the statistical frequency of historical faults or expert experience. Obtain real-time monitoring data from the operation and maintenance system. Based on the real-time monitoring data, obtain real-time abnormal evidence or real-time non-abnormal evidence for each fault event. If real-time abnormal evidence exists, obtain the dynamic adjustment factor d(vt)=a for the corresponding node at the corresponding time. If real-time non-abnormal evidence exists, obtain the dynamic adjustment factor d(vt)=b for the corresponding node at the corresponding time, where a is greater than b.
3. The method according to claim 2, characterized in that, in: The value of w(e) is a real number in the interval (0, 1], a is a real number in the interval (1, 2), and b is a real number in the interval (0, 1).
4. The method according to claim 2, characterized in that, After determining that the root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is the root cause of the fault p, the method further includes: Obtain feedback from operations and maintenance experts on whether the root cause of the fault p is correct. If the feedback is correct, increase the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value. Otherwise, decrease the value of w(e) corresponding to the fault causal propagation chain with the largest Conf(Path_k) value to update the basic fault causal event graph G1 = (V, E, W).
5. The method according to any one of claims 2-4, characterized in that, Retrieve the node vp in G corresponding to a specific fault event p in the operation and maintenance system, including: Receive fault descriptions input by users in natural language, extract keywords from the fault descriptions and match them with a pre-set semantic mapping table to obtain a specific fault event p and its fault time t1 of the operation and maintenance system queried by the user; Obtain d(vt1) of each node v corresponding to the fault time t1, and add d(vt1) of each node v to the basic fault causal logic graph G1 to obtain the fault causal logic graph G2 = (V, E, W, {d(vt1)}) at t1. Obtain the node vp in the fault causal graph G2 at time t1 that represents a certain fault event p.
6. The method according to claim 5, characterized in that, Starting from vp, traverse G backwards to obtain all possible causal propagation chains {Path_k, k=1, ..., K} that caused p to fail, specifically including: Starting with vp, perform a breadth-first or depth-first traversal along all incoming edges in G2 until all paths reach a node without incoming edges. The node without incoming edges that is reached is the root cause candidate node. Output the set of paths from each root cause candidate node vc_k to the starting node vp: {Path_k, k=1, ..., K}.
7. The method according to claim 6, characterized in that, Based on w(e) and d(vt), obtain the confidence Conf(Path_k) that each Path_k triggers p, specifically including: Get the edge {e_n, n=1, ..., N} on each Path_k, and get the confidence weight w(e_n) of each e_n; Get the ingress node {v_n, n=1, ..., N} of each e_n on each Path_k, and get the dynamic adjustment factor d(v_nt1) of each v_n at t1; Calculate the confidence score Conf(Path_k) for each Path_k triggering p = ∏ n=1, ..., N (w(e_n)×d(v_nt1)).
8. The method according to claim 7, characterized in that, The root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is the root cause of the fault p, specifically including: Get the Conf(Path_kmax) with the largest Conf(Path_k) value, get the complete node and edge sequence on Path_kmax corresponding to Conf(Path_kmax), get the root node vc_kmax of Path_kmax, and output vc_kmax, Path_kmax and Conf(Path_kmax) in a structured manner.
9. A fault root cause location device, characterized in that, The device includes: The event graph module is used to obtain the event graph G = (V, E, W, D) of the failure cause and effect of the operation and maintenance system. V includes several nodes v, v represents the failure event of the operation and maintenance system. E includes several directed edges e = (v_i, v_j), e represents the causal relationship from node v_i to node v_j. W includes a confidence weight w(e) associated with each edge e. D includes a dynamic adjustment factor d(vt) for whether each node v has an anomaly. The root cause localization module, connected to the event graph module, is used to obtain the node vp corresponding to a certain fault event p in the operation and maintenance system in G. Starting from vp, it traverses G backward to obtain all possible fault causal propagation chains {Path_k, k=1,..., K} that caused p. Based on w(e) and d(vt), it obtains the confidence Conf(Path_k) of each Path_k causing p. The root node corresponding to the fault causal propagation chain with the largest Conf(Path_k) value is the root cause of the fault that caused p.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the fault root cause localization method as described in any one of claims 1-8.