Root cause localization methods, apparatus, equipment, storage media, and program products

Abstract

This application relates to the field of computer technology, and provides a root cause localization method, apparatus, device, storage medium, and program product. The method includes: filling a predetermined knowledge graph skeleton based on multimodal data of the communication network within the current time window to generate a current knowledge graph snapshot of the communication network; when the anomaly assessment score of the current knowledge graph snapshot is greater than an anomaly threshold, comparing and analyzing the current knowledge graph snapshot with the previous knowledge graph snapshot to identify mutation nodes and generate a differential knowledge graph; and, guided by the feature changes indicated by the differential knowledge graph, performing a reverse search in the current knowledge graph snapshot, starting from the mutation node, to determine the root cause localization result of the mutation node. The root cause localization method, apparatus, device, storage medium, and program product provided by this application can capture the continuous evolution process of the network state before and after a fault occurs, accurately locate the root cause of the fault, and improve network operation and maintenance efficiency and network reliability.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a root cause localization method, apparatus, device, storage medium, and program product. Background Technology

[0002] Wireless communication networks are characterized by high dynamism, complexity, and heterogeneity. Key performance indicators such as network topology, traffic flow, and channel quality change continuously over extremely short timescales. However, traditional methods, typically based on single data slices and conventional machine learning models, are used for fault diagnosis in wireless communication networks. These approaches struggle to capture the continuous evolution of the network state before and after a fault occurs, easily leading to delayed fault detection, inaccurate root cause localization, and an inability to address challenges such as complex faults. This results in bottlenecks in network operation and maintenance efficiency and network reliability. Summary of the Invention

[0003] This application provides a root cause localization method, apparatus, device, storage medium, and program product to solve the problem in related technologies that it is difficult to capture the continuous evolution process of network status before and after a network failure, which easily leads to untimely fault detection and inaccurate root cause localization, thereby improving network operation and maintenance efficiency and network reliability.

[0004] Firstly, this application provides a root cause localization method, comprising: The framework of the predefined knowledge graph is filled with multimodal data of the communication network within the current time window to generate a snapshot of the current knowledge graph of the communication network; the nodes in the predefined knowledge graph framework are communication network elements, and the directed edges between the nodes are the topological relationships between the communication network elements. When the anomaly assessment score of the current knowledge graph snapshot is greater than the anomaly threshold, the current knowledge graph snapshot and the previous knowledge graph snapshot are compared and analyzed to identify mutation nodes and generate a differential knowledge graph. Among them, the anomaly evaluation score of the current knowledge graph snapshot is proportional to the degree of deviation of the current knowledge graph snapshot from the normal evolution mode of the communication network; mutation nodes are used to represent nodes whose feature changes in the current time window are greater than the mutation threshold compared to the previous time window; differential knowledge graph includes the feature changes of each node in the predetermined knowledge graph skeleton in the current time window compared to the previous time window. Guided by the feature changes indicated by the differential knowledge graph, a reverse search is performed in the current knowledge graph snapshot, starting from the mutation node, to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0005] In one embodiment, the multimodal data includes static textual descriptions of communication network elements and dynamic monitoring data of the communication network elements within the current time window; filling a predetermined knowledge graph skeleton based on the multimodal data of the communication network within the current time window includes: Based on the textual description information of communication network elements, determine the static semantic feature vector of the communication network elements; Based on monitoring data of communication network elements, determine the dynamic temporal feature vector of communication network elements; The static semantic feature vector and the dynamic temporal feature vector are fused to obtain the fused feature vector of the communication network element, and the fused feature vector of the communication network element is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton. The fusion feature vectors of connected nodes are processed based on a predetermined association metric function to determine the association strength weight of the connected nodes, and the association strength weight is determined as the edge attribute of the directed edge corresponding to the connected node in the predetermined knowledge graph skeleton.

[0006] In one embodiment, determining the static semantic feature vector of a communication network element based on its textual description information includes: Construct a structured input sequence from the text description information; Based on a pre-trained word segmenter in the field of communications and a structured input sequence, word representation vectors are generated; Based on word representation vectors and natural language processing models, static semantic feature vectors of communication network elements are determined.

[0007] In one embodiment, the natural language processing model determines attention weights based on domain prior attention bias, which is constructed based on the co-occurrence strength and semantic similarity of communication terms in domain text data.

[0008] In one embodiment, the method further includes: Based on the current knowledge graph snapshot and the target graph encoding model, the hidden representation of the current knowledge graph snapshot is determined; the training process of the target graph encoding model learns the normal evolution mode of the communication network. Decode the hidden representation of the current knowledge graph snapshot to obtain the reconstructed features of the nodes in the current knowledge graph snapshot; Based on the reconstruction error between the original features and reconstructed features of nodes in the current knowledge graph snapshot, an anomaly assessment score for the current knowledge graph snapshot is determined.

[0009] In one embodiment, the target graph encoding model is trained through the following process: The initial graph encoding model is trained based on the knowledge graph snapshot sequence to obtain the target graph encoding model. The knowledge graph snapshot sequence includes multiple historical knowledge graph snapshots arranged in time. The initial graph encoding model extracts the spatial topological dependencies between nodes through spatial aggregation and extracts the evolutionary rules of nodes over time through temporal aggregation.

[0010] In one embodiment, a comparative analysis is performed between the current knowledge graph snapshot and the previous knowledge graph snapshot to determine mutation nodes, including: Based on the difference in the fused feature vectors of each node in the current knowledge graph snapshot and the previous knowledge graph snapshot, the feature change of each node is obtained. The mutation threshold is determined based on the statistical values ​​of the characteristic changes of all nodes. Nodes whose feature changes are greater than the mutation threshold are identified as mutation nodes.

[0011] In one embodiment, generating a differential knowledge graph includes: The feature variation of each node is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton, thus obtaining the intermediate knowledge graph; The feature changes of connected nodes are processed based on a predetermined association metric function to determine the association strength weight of connected nodes. The association strength weight is then determined as the edge attribute of the directed edge corresponding to the connected node in the intermediate knowledge graph, thus obtaining the differential knowledge graph.

[0012] In one embodiment, guided by the feature changes indicated by the differential knowledge graph, a reverse search is performed in the current knowledge graph snapshot, starting from the mutation node, including: Starting from the mutation node, the search proceeds in the reverse direction of the directed edges in the current knowledge graph snapshot until the termination condition is met. The candidate causal transmission path is generated with the currently searched node as the starting point and the mutation node as the ending point. The termination conditions include the feature change of the currently searched node being less than the deviation threshold, or the currently searched node being the source node, or the preset search depth being reached.

[0013] In one embodiment, determining the root cause localization result of the mutation node includes: Based on the feature changes of each node in the differential knowledge graph and the association strength weight of each directed edge in the differential knowledge graph, the path score of each candidate causal transmission path is determined. The starting point of the candidate causal transmission path whose path score meets the first preset condition is determined as the candidate root cause node, and the candidate causal transmission paths associated with the candidate root cause node are aggregated to determine the aggregate score of the candidate root cause node. Candidate root cause nodes whose aggregate scores meet the second preset condition are identified as root cause nodes, and candidate causal transmission paths with the root cause nodes as the starting point and the highest path scores are identified as causal transmission paths, thus obtaining the root cause localization results of mutation nodes.

[0014] Secondly, this application provides a root cause localization device, comprising: The processing unit is used to fill the predetermined knowledge graph skeleton based on the multimodal data of the communication network within the current time window, and generate a current knowledge graph snapshot of the communication network; the nodes in the predetermined knowledge graph skeleton are communication network elements, and the directed edges between the nodes are the topological associations between the communication network elements; The processing unit is also used to compare and analyze the current knowledge graph snapshot and the previous knowledge graph snapshot when the anomaly evaluation score of the current knowledge graph snapshot is greater than the anomaly threshold, determine the mutation node, and generate a differential knowledge graph. Among them, the anomaly evaluation score of the current knowledge graph snapshot is proportional to the degree of deviation of the current knowledge graph snapshot from the normal evolution mode of the communication network; mutation nodes are used to represent nodes whose feature changes in the current time window are greater than the mutation threshold compared to the previous time window; differential knowledge graph includes the feature changes of each node in the predetermined knowledge graph skeleton in the current time window compared to the previous time window. The processing unit is also used to perform a reverse search in the current knowledge graph snapshot, guided by the feature change indicated by the differential knowledge graph, with the mutation node as the search starting point, to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0015] Thirdly, this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the methods described in the first aspect above.

[0016] Fourthly, this application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods described in the first aspect above.

[0017] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements any of the methods described in the first aspect above.

[0018] The root cause localization method, apparatus, device, storage medium, and program products provided in this application can construct a knowledge graph snapshot of the communication network through multimodal feature fusion, achieving a comprehensive and structured state representation of dynamic networks. Furthermore, it can realize anomaly detection and root cause tracing based on evolutionary comparison. Moreover, through a unique differential knowledge graph and a weighted inverse scoring search mechanism, it can accurately eliminate irrelevant feature fluctuations, achieving highly visualized and highly accurate network root cause localization. Therefore, this application can achieve a leap from "correlation" to "change-causation" analysis, adapting to the highly dynamic, complex, and heterogeneous characteristics of wireless communication networks. It avoids the problem that traditional fault diagnosis methods struggle to capture the continuous evolution of network states before and after a fault, supporting timely detection of network faults, thereby improving network operation and maintenance efficiency and network reliability. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is one of the flowcharts illustrating the root cause localization method provided in the embodiments of this application.

[0021] Figure 2 This is the second flowchart of the root cause localization method provided in the embodiments of this application.

[0022] Figure 3 This is the third flowchart of the root cause localization method provided in the embodiments of this application.

[0023] Figure 4 This is the fourth flowchart of the root cause localization method provided in the embodiments of this application.

[0024] Figure 5 This is the fifth flowchart of the root cause localization method provided in the embodiments of this application.

[0025] Figure 6 This is the sixth flowchart of the root cause localization method provided in the embodiments of this application.

[0026] Figure 7 This is the seventh flowchart of the root cause localization method provided in the embodiments of this application.

[0027] Figure 8 This is a schematic diagram of the root cause localization process provided in the embodiments of this application.

[0028] Figure 9This is a schematic diagram of the root cause localization device provided in the embodiments of this application.

[0029] Figure 10 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] The following is combined with Figures 1-8 This application describes the root cause localization method provided in its embodiments.

[0032] Figure 1 This is one of the flowcharts illustrating the root cause localization method provided in the embodiments of this application. For example... Figure 1 As shown, the root cause localization method includes the following: Step 110: Fill the predetermined knowledge graph skeleton with the multimodal data of the communication network within the current time window to generate a snapshot of the current knowledge graph of the communication network.

[0033] In this framework, the nodes in the predefined knowledge graph skeleton represent communication network elements. The directed edges between nodes in the predefined knowledge graph skeleton represent the topological relationships between these communication network elements.

[0034] Communication network elements may include Key Performance Indicators (KPIs), configuration parameters, and network entities. KPIs may include Reference Signal Received Power (RSRP), Signal-to-Interference-plus-Noise Ratio (SINR), Channel Quality Indicator (CQI), Physical Resource Block (PRB) utilization, and throughput. Configuration parameters may include uplink and downlink subcarrier configurations, transmission power configurations, bandwidth configurations, and modulation and coding schemes. Network entities may include User Equipment (UE), base stations, Access and Mobility Management Functions (AMF), Session Management Functions (SMF), and User Plane Functions (UPF).

[0035] The topological relationships between communication network elements can be causal, dependent, or correlated. Causal relationships characterize a strong logical connection between indicators through a causal transmission chain. Examples include the causal relationship between CQI and MCS, and the causal relationship between RSRP and throughput. Dependencies describe the resource or protocol dependencies between indicators, including unidirectional dependencies and bidirectional coupling. Correlations reflect the statistical correlation or spatiotemporal co-occurrence characteristics between indicators.

[0036] In one embodiment, knowledge from experts in the communications field can be used to predefine the types of communication network elements such as key performance indicators, configuration parameters, and network entities, as well as the a priori and stable causal, dependency, or association relationships between these communication network elements, forming a general, non-specific numerical triplet directed graph structure, thereby constructing a static, predetermined knowledge graph skeleton that serves as a template.

[0037] Specifically, the mapping relationships between several core concepts in the knowledge graph skeleton can be clearly defined. Metrics refer to key parameters that measure the status or performance of a communication network, such as RSRP, SINR, CQI, and PRB utilization. Fields refer to specific data elements in the original data source and are the original carriers of metrics. In the communication network knowledge graph, each field is abstracted and modeled as a node or entity, serving as the basic building block of the knowledge graph, thereby standardizing the mapping of heterogeneous fields to unified nodes or entities.

[0038] Furthermore, an entity library can be predefined. The entity library includes attributes that represent the characteristics, features, and parameters that entity objects may possess, such as entity name, type, value, and word length. Attributes describe the entity and represent the mapping relationship between the entity and its attribute values. Attribute values ​​refer to the specific values ​​of specific attributes of an object. For example, an entity can be an RSRP, which can be represented as follows: Entity RSRP: Attribute 1: Entity name; Attribute 1 value: Reference signal received power. Attribute 2: Type, Attribute 2 value: "KPI"; Attribute 3: Physical dimension, Attribute 3 value: "dBm"; Attribute 4: Defines the source; Attribute 4 value: "3GPPTS****"; Attribute 5: Description, Attribute 5 value: "Measures the power level of a specific cell reference signal received by the terminal, and is a key basis for cell selection, reselection and handover decisions."

[0039] Thus, based on the entity-relation-entity triple generation rule, multimodal data can be converted into general entity triples with connection relationships, namely (head, relation, tail), where head is the head entity in the triple, tail is the tail entity, and the head and tail entities in each triple belong to an entity in the entity library, and relation is the relationship between entities. Using the head and tail entities of the triples as nodes of the knowledge graph, the knowledge and rules in the communication expert knowledge base are used to connect all the entity nodes with relationships in a directed manner, forming a general, universal wireless knowledge graph pattern or skeleton without specific numerical values.

[0040] In one embodiment, the multimodal data of the communication network within the current time window may include static textual descriptions of each communication network element, as well as dynamic monitoring data of each communication network element within the current time window. The textual descriptions may be indicator definitions or protocol documents, etc. The monitoring data may be a sequence of indicators continuously sampled from a real network.

[0041] The current time window refers to a time window that ends at the current moment. The duration of this time window can be 1 second or 5 seconds, 1 minute or 5 minutes, or 1 hour or 24 hours, and can be flexibly set according to the actual needs of the communication network.

[0042] In one embodiment, for each node in the predetermined knowledge graph skeleton, a fusion feature vector that comprehensively represents its identity and state can be generated based on the multimodal data of the corresponding communication network elements, and this fusion feature vector is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton. Further, edge weights can be dynamically calculated based on the fusion feature vectors of connected nodes to determine the edge attributes of the corresponding directed edges in the predetermined knowledge graph skeleton, thereby generating a current knowledge graph snapshot, i.e., a knowledge graph snapshot of the communication network in the current time window.

[0043] Step 120: When the anomaly assessment score of the current knowledge graph snapshot is greater than the anomaly threshold, compare and analyze the current knowledge graph snapshot with the previous knowledge graph snapshot, determine the mutation node, and generate a differential knowledge graph.

[0044] The anomaly assessment score of the current knowledge graph snapshot is proportional to the degree of deviation of the current knowledge graph snapshot from the normal evolution pattern of the communication network. Mutant nodes represent nodes whose feature changes in the current time window relative to the previous time window exceed a mutation threshold. The differential knowledge graph includes the feature changes of each node in the predetermined knowledge graph skeleton in the current time window relative to the previous time window.

[0045] In one embodiment, a machine learning model or neural network model that has pre-learned the normal evolutionary pattern of the communication network can be used to determine the degree of deviation of the current knowledge graph snapshot from the normal evolutionary pattern of the communication network. Then, according to the rule that the anomaly evaluation score is proportional to the degree of deviation, an anomaly evaluation score for the current knowledge graph snapshot is determined. This anomaly evaluation score can be used to reflect the degree of deviation of the current knowledge graph snapshot from the normal evolutionary pattern of the communication network. If the anomaly evaluation score of the current knowledge graph snapshot is greater than the anomaly threshold, it can be determined that the current knowledge graph snapshot is abnormal.

[0046] In this scenario, the current knowledge graph snapshot can be marked as an anomalous snapshot, while the previous knowledge graph snapshot can be marked as a reference normal snapshot. A comparative analysis of the current and previous knowledge graph snapshots is then performed to determine the amount of feature change for each node within the current time window relative to the previous time window. Furthermore, nodes with feature changes exceeding a mutation threshold are identified as mutation nodes, and a differential knowledge graph is generated to facilitate root cause analysis based on the spatiotemporal dynamic evolution of the communication network knowledge graph. The previous knowledge graph snapshot refers to the knowledge graph snapshot of the communication network within the previous time window.

[0047] Based on this, abnormal events deviating from the normal evolutionary pattern of communication networks can be detected in real time. Furthermore, by finely comparing the abnormal pattern with the reference normal pattern, the initial changes causing the abnormality can be accurately located.

[0048] Step 130: Guided by the feature changes indicated by the differential knowledge graph, perform a reverse search in the current knowledge graph snapshot, starting from the mutation node, to determine the root cause localization result of the mutation node.

[0049] Among them, the root cause localization results are used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0050] In one embodiment, starting from the most significant mutation node in the current knowledge graph snapshot, a weighted reverse path search is performed based on the directed edges defined in the baseline knowledge graph skeleton. A path score is determined for each backtracking path by calculating the feature changes of all nodes on the backtracking path in the differential knowledge graph and the association strength weights of all edges in the differential knowledge graph, using a path scoring function. The path scoring function is used to evaluate the likelihood that the backtracking path is a true root cause propagation path; for example, it can be used to perform a weighted summation of the feature changes of all nodes on the backtracking path and the association strength weights of all edges.

[0051] Furthermore, the backtracking paths with high search scores can be analyzed to identify the starting nodes that converge the most high-scoring backtracking paths, and these nodes can be selected as candidate root cause nodes. Further, one or more of the most likely candidate root cause nodes can be identified as root cause nodes, and the optimal transmission paths of these root cause nodes can be used as causal transmission paths to obtain root cause localization results, thereby outputting an interpretable diagnostic report.

[0052] Figure 2 This is the second flowchart illustrating the root cause localization method provided in this application embodiment. In step 110 above, i.e., when filling the predetermined knowledge graph skeleton based on multimodal data from the communication network within the current time window, this application embodiment provides an optional implementation method, such as... Figure 2 As shown, it includes the following: Step 210: Determine the static semantic feature vector of the communication network element based on the text description information of the communication network element.

[0053] In one embodiment, a natural language processing model (such as a pre-trained language model based on the Transformer architecture) can be used to encode the static textual description information of communication network elements into high-dimensional static semantic feature vectors.

[0054] Step 220: Based on the monitoring data of the communication network elements, determine the dynamic temporal feature vector of the communication network elements.

[0055] In one embodiment, a sequence data learning model can be used to process dynamic time-series monitoring data related to communication network elements and extract dynamic time-series feature vectors that can reflect their recent fluctuation trends and behavioral patterns.

[0056] Sequence data learning models can be bidirectional long short-term memory (Bi-LSTM) networks. A short sequence can be constructed from several consecutive raw data sampling points of a communication network element prior to the current time step. This short sequence is then input into the sequence data learning model as monitoring data. The hidden states (or the concatenation of forward and backward hidden states) of this short sequence are extracted, which constitute the dynamic temporal feature vector of the communication network element. This vector represents the dynamic behavior pattern of the communication network element at the data level and reflects its recent fluctuation trend.

[0057] Step 230: Fuse the static semantic feature vector and the dynamic temporal feature vector to obtain the fused feature vector of the communication network element, and determine the fused feature vector of the communication network element as the node attribute of the corresponding node in the predetermined knowledge graph skeleton.

[0058] In one embodiment, a multimodal fusion mechanism can be employed to combine the static semantic feature vector with the dynamic temporal feature vector to generate a unified and comprehensive fused feature vector. The multimodal fusion mechanism may include vector concatenation, weighted summation, attention mechanisms, or fusion through a learnable linear or nonlinear mapping layer.

[0059] As an example, concatenation and normalization can be used to fuse the static semantic feature vector and dynamic temporal feature vector of the same communication network element to generate a fused feature vector of the communication network element, as shown below: .

[0060] in, , which is the static semantic feature vector of a communication network element. is the dimension of the static semantic feature vector of a communication network element. This is a layer normalization operation. , which is the dynamic temporal feature vector of a communication network element. is the dimension of the dynamic temporal feature vector of a communication network element. This is the fused feature vector of communication network elements. , where is the learnable weight matrix. This represents the dimension of the fused feature vector of communication network elements. This is the bias vector.

[0061] Step 240: Process the fusion feature vector of connected nodes based on the predetermined association metric function, determine the association strength weight of connected nodes, and determine the association strength weight as the edge attribute of the directed edge corresponding to the connected node in the predetermined knowledge graph skeleton.

[0062] Connected nodes refer to two nodes in the predefined knowledge graph skeleton that are connected.

[0063] In one embodiment, a dynamic association strength calculation module can be used to dynamically calculate the edge weights based on the fusion feature vectors of connected nodes, obtain the association strength weights of connected nodes, and determine the association strength weights as the edge attributes of the directed edges of the predetermined knowledge graph skeleton, thereby generating a snapshot of the current knowledge graph, that is, a snapshot of the knowledge graph of the communication network in the current time window.

[0064] Optionally, the association strength can be determined by a definable association metric, such as cosine similarity, dot product, or a learnable scoring function. This application does not limit this approach.

[0065] As an example, based on a predefined association metric function (such as cosine similarity, dot product, etc.), the fused feature vectors of nodes with connected relationships in a predefined knowledge graph skeleton can be calculated to determine the association strength weight of the connected nodes, and this weight can be determined as the edge attribute of the corresponding directed edge. The relationship type of the directed edge is inherited from the predefined knowledge graph skeleton. In this way, a snapshot of the current knowledge graph that integrates multimodal data can be generated.

[0066] For example, for connected nodes i and j, the cosine similarity of the fused feature vectors of nodes i and j can be calculated, which is the association strength weight of the directed edge e between nodes i and j, as shown below: = .

[0067] in, Let be the fused feature vector of node i. Let be the fused feature vector of node j. Let e ​​be the association strength weight of the directed edge e between node i and node j. This is the function for calculating cosine similarity.

[0068] Figure 3 This is the third flowchart illustrating the root cause localization method provided in this application embodiment. In step 210 above, i.e., when determining the static semantic feature vector of a communication network element based on its textual description information, this application embodiment provides an optional implementation method, such as... Figure 3 As shown, it includes the following: Step 310: Construct the text description information into a structured input sequence.

[0069] In one embodiment, the static text description information of communication network elements can be constructed into a structured three-channel input sequence, including [CLS] field names, [SEP] description text, and [SEP] protocol documents.

[0070] As an example, it can be shown below: [CLS] Field Name: SINR; [SEP] Description text: Signal-to-interference-plus-noise ratio; The [SEP] protocol document, 3GPPTS****, defines it as the ratio of received signal power to interference noise power.

[0071] In the above input sequence, the field names are standardized names, the description text is the physical definition and measurement method of the field extracted from the technical document, and the associated paragraphs of the protocol document are related to the relevant chapters in the standard.

[0072] Step 320: Generate word representation vectors based on a pre-trained word segmenter in the field of communication and a structured input sequence.

[0073] In one embodiment, a pre-trained tokenizer in the communications field (such as SciBERT) can be used to process technical terms and generate token-level embedding vectors. ,in The dimension representing the embedding vector is determined by the pre-trained model used. Furthermore, the dimension of the embedding vector is the same as the dimension of the static semantic feature vector of the communication network element, i.e. equal In this way, each field can generate a corresponding word representation vector.

[0074] Step 330: Determine the static semantic feature vectors of communication network elements based on word representation vectors and natural language processing models.

[0075] In one embodiment, the natural language processing model can be a Transformer model based on the RoBERTa-base architecture, which may include a multi-layer Transformer encoder.

[0076] The input to a natural language processing (NLP) model can include field names, field description text, and word representation vectors of related paragraphs in the protocol document. The output of a NLP model can be static semantic feature vectors of communication network elements. This captures the semantic relationships between fields. For example, the implicit relationship between MCS and throughput. Among these, static semantic feature vectors... It can retrieve the top-level hidden state corresponding to the [CLS] flag, as shown below: .

[0077] in, , which is the static semantic feature vector of a communication network element. is the dimension of the static semantic feature vector of a communication network element. This is a layer normalization operation. This is the hidden state vector output by the 12th layer (i.e., the top layer) of the natural language processing model, corresponding to the classification label [CLS].

[0078] In one embodiment, the natural language processing model determines attention weights based on domain-prior attention biases. These domain-prior attention biases are constructed based on the co-occurrence strength and semantic similarity of communication terms in domain text data. The attention weights incorporating these domain-prior attention biases can be specifically illustrated as follows: ; .

[0079] Where A is the attention weight matrix. Let be an element in the attention weight matrix A, representing the attention weight assigned to field j by field i, i.e., the relative proportion of attention given to field j by field i during the attention calculation process. If field i and field j are different fields, then... This refers to the cross-attention weights between different fields. If field i and field j are the same field, then... This is the self-attention weight for this field. It is a normalized exponential function. For querying the matrix. It is the key matrix. For head dimension. This is a term co-occurrence bias matrix constructed based on the co-occurrence strength and semantic similarity of communication terms in domain text data. For the term co-occurrence bias matrix One element in the matrix represents the normalized prior bias weight assigned to field i by field j. (Attention weight matrix) Co-occurrence bias matrix of terms The total number of elements in the middle is the same, which is . This represents the total number of fields.

[0080] Specifically, in textual data such as protocol documents or log data, the co-occurrence frequency of statistical term pairs—that is, the number of times two communication technology terms appear simultaneously in a given context unit—is used to construct co-occurrence edges. The calculation formula is as follows: .

[0081] in, Let represent the co-occurrence strength of field i and field j. Let i be the number of times field i and field j co-occur. This represents the total number of occurrences of field i. This represents the total number of occurrences of field j. If field i and field j are different fields, then... This represents the cross-occurrence strength between different fields. If field i and field j are the same field, The calculation result is always 1. This represents the self-co-occurrence strength of the field.

[0082] Furthermore, cosine similarity is used to calculate the association strength (i.e., semantic similarity) between field pairs: .

[0083] in, This represents the association strength between field i and field j. If field i and field j are different fields, then... This represents the strength of cross-association between different fields (i.e., cross-semantic similarity). If field i and field j are the same field, then... This represents the self-association strength (i.e., self-semantic similarity) of the field. Let i be the feature vector of field i. The feature vector of field j.

[0084] Furthermore, a similarity matrix correction is performed by introducing co-occurrence statistical information as edge weights to weight the similarity matrix: .

[0085] in, This represents the adjusted association strength between field i and field j. If field i and field j are different fields, then... This represents the adjusted cross-association strength between different fields. If field i and field j are the same field, then... This is the corrected self-association strength for this field. This represents the uncorrected association strength between field i and field j. Let represent the co-occurrence strength of field i and field j.

[0086] Furthermore, the elements in the normalized bias matrix (i.e., the co-occurrence bias matrix) for: .

[0087] in, For the term co-occurrence bias matrix One of the elements is used to represent the normalized prior bias weights assigned to field i by field j. This represents the total number of fields. for The total number of elements in the text. This represents the adjusted association strength between field i and field j. It is the sum of the adjusted association strengths between field i and n fields (including field i itself).

[0088] Figure 4 This is the fourth flowchart illustrating the root cause localization method provided in the embodiments of this application. Figure 4 As shown in the embodiments of this application, the root cause localization method further includes the following: Step 410: Based on the current knowledge graph snapshot and the target graph encoding model, determine the hidden representation of the current knowledge graph snapshot.

[0089] The training process of the target graph encoding model involves learning the normal evolutionary patterns of the communication network. The core capability of the target graph encoding model lies in simultaneously capturing the spatial topological dependencies between nodes within a knowledge graph snapshot, as well as the dynamic patterns of evolution between knowledge graph snapshots over time.

[0090] In one embodiment, the target graph encoding model is trained through the following process: The initial graph encoding model is trained using snapshot sequences of the knowledge graph, and the target graph encoding model is obtained after training convergence. The initial graph encoding model extracts the spatial topological dependencies between nodes through spatial aggregation and extracts the evolutionary patterns of nodes over time through temporal aggregation. In this way, the internal parameters of the target graph encoding model can implicitly represent the normal evolutionary pattern of the communication network.

[0091] In one embodiment, spatial aggregation refers to using a graph attention mechanism (or graph convolution) to aggregate the fused feature vectors of its neighboring nodes for each node in the knowledge graph snapshot, generating an intermediate representation that includes local topological information. Temporal aggregation refers to using a recurrent neural network (such as GRU or LSTM) to aggregate the intermediate representations of each node from the current knowledge graph snapshot and several past historical knowledge graph snapshots. ,..., This generates the final node hiding representation that contains spatiotemporal dynamics. .

[0092] Optionally, the initial graph encoding model can be a learning model capable of handling the spatiotemporal dynamic evolution sequence of wireless knowledge graphs. It can be built based on a spatio-Temporal Graph Neural Network (ST-GNN), a spatio-Temporal Graph Attention Network (ST-GAT), a spatio-Temporal Graph Convolutional Network (ST-GCN), or other networks, without limitation.

[0093] Based on this, by analyzing the evolution of knowledge graph snapshot sequences of communication networks, it is possible to support real-time and accurate detection of whether anomalies occur in communication networks.

[0094] The knowledge graph snapshot sequence comprises multiple historical knowledge graph snapshots arranged chronologically. These historical snapshots may be free of anomalies, meaning they are generated based on data from a normally functioning communication network. For example, a knowledge graph snapshot sequence can be built based on all time-series data from the normal operation of the communication network, facilitating the model's learning of the network's normal evolutionary patterns.

[0095] Optionally, multiple historical knowledge graph snapshots in the knowledge graph snapshot sequence can be arranged in chronological order or in reverse chronological order, without restriction.

[0096] Furthermore, the time referenced when sorting multiple historical knowledge graph snapshots can be the generation time of the multimodal data of the communication network used to construct the historical knowledge graph snapshots. Specifically, each historical knowledge graph snapshot corresponds to a preset time window of multimodal data within the normal operation period of the communication network. For a single piece of multimodal data, its generation time is the corresponding moment when the multimodal data was collected, generated, or reported in the communication network. For a single historical knowledge graph snapshot, the statistical characteristic value of the generation time of all its corresponding multimodal data is used as the time referenced for sorting the historical knowledge graph snapshot. For example, the time referenced for sorting the historical knowledge graph snapshot can be the start time, end time, median, or average of the data generation time of its corresponding time window, etc., without restriction. As an example, all collected time-series data can be sliced ​​according to preset time windows, dividing the normal operation period of the communication network into multiple consecutive time windows, and determining the multimodal data corresponding to each time window. Furthermore, a knowledge graph snapshot index t (t=1,2,...,n) can be defined for each time window. n is the number of consecutive time windows.

[0097] Furthermore, a predefined knowledge graph skeleton can be used as a template. For each entity node in the predefined knowledge graph skeleton, its fused feature vector at the corresponding index is calculated, and this fused feature vector is used as the core attribute of that node in the knowledge graph snapshot Gt. The edge types in the knowledge graph snapshot Gt are inherited from the predefined knowledge graph skeleton. The edge weights are dynamically assigned based on the feature vectors of connected nodes in the knowledge graph snapshot Gt to reflect the real-time correlation strength between nodes. Repeating this process, a knowledge graph snapshot Gt can be generated for each knowledge graph snapshot index t determined for each time window. Finally, these knowledge graph snapshots are arranged in chronological order to form a complete spatiotemporal evolution sequence of the knowledge graph G={G1,G2,...,GT}.

[0098] Step 420: Decode the hidden representation of the current knowledge graph snapshot to obtain the reconstructed features of the nodes in the current knowledge graph snapshot.

[0099] In one embodiment, a decoder can be used to decode the hidden representation of the current knowledge graph snapshot, reconstruct the features of the nodes from the hidden representation of the current knowledge graph snapshot, and obtain the reconstructed features of the nodes in the current knowledge graph snapshot. The decoder can be built based on ST-GNN or Multi-Layer Perceptron (MLP).

[0100] Step 430: Based on the reconstruction error between the original features and reconstructed features of the nodes in the current knowledge graph snapshot, determine the anomaly evaluation score of the current knowledge graph snapshot.

[0101] In one embodiment, the anomaly assessment score of the current knowledge graph snapshot can be defined as the reconstruction error. Specifically, attention is paid to the reconstruction status of KPI nodes and their neighborhoods, as shown below: .

[0102] in, This is the anomaly assessment score for the current knowledge graph snapshot. These are the original features of the KPI nodes in the current knowledge graph snapshot. These are the reconstructed features of KPI nodes in the current knowledge graph snapshot. These are the original features of the neighboring nodes of the KPI node in the current knowledge graph snapshot. This refers to the reconstructed features of the neighboring nodes of the KPI nodes in the current knowledge graph snapshot. It's the weight.

[0103] In one embodiment, a dynamic anomaly threshold determined by statistical methods (such as based on historical data quantiles) can be set. .when > When this happens, it can be determined that the communication network is experiencing an anomaly within the current time window.

[0104] In this way, communication network anomalies can be sensitively detected by a graph anomaly score calculation mechanism that integrates the KPI nodes and their neighborhood states, and the precise location of the anomaly can be pinpointed from when it occurred to where it occurred.

[0105] Figure 5 This is the fifth flowchart illustrating the root cause localization method provided in this application embodiment. In step 120 above, i.e., when comparing and analyzing the current knowledge graph snapshot with the previous knowledge graph snapshot to determine the mutation node, this application embodiment provides an optional implementation method, such as... Figure 5 As shown, it includes the following: Step 510: Based on the difference in feature vectors of each node in the current knowledge graph snapshot and the previous knowledge graph snapshot, obtain the feature change amount of each node.

[0106] In one embodiment, for each node, the difference in its fused feature vector between the anomalous graph and the reference normal graph can be calculated and quantified to obtain the state change score of each node, i.e., the feature change amount. For example, this can be achieved using a dissimilarity metric function (such as cosine distance, Euclidean distance, etc.).

[0107] In one embodiment, for each node that coexists in the current knowledge graph snapshot and the previous knowledge graph snapshot, the change in its fused feature vector is calculated as the feature change. The feature change can be measured using a normalized value of cosine distance or Euclidean distance, as shown below: .

[0108] in, This represents the characteristic change of the node. This is the function for calculating cosine similarity. This is the fusion feature vector of the node in the current knowledge graph snapshot. This is the fused feature vector of the node in the previous knowledge graph snapshot.

[0109] Thus, it is possible to use the characteristic change amount It reflects the overall drastic change in the network indicators corresponding to node v at the moment an anomaly occurs, including numerical fluctuations and trend changes.

[0110] Based on this, when an anomaly is detected, the current knowledge graph snapshot can be extracted and compared with the immediately preceding knowledge graph snapshot. Based on a preset dissimilarity metric function, the difference in the fused feature vector of each node in the two snapshots can be calculated to obtain the feature change of each node.

[0111] Step 520: Determine the mutation threshold based on the statistical values ​​of the feature changes of all nodes.

[0112] In one embodiment, a mutation threshold can be set based on the distribution of characteristic changes across all nodes. For example, the mutation threshold can be calculated using the following formula: = .

[0113] in, This is the mutation threshold. This represents the average value of the feature changes across all nodes. The standard deviation of the characteristic variation for all nodes.

[0114] Step 530: Identify nodes whose feature changes are greater than the mutation threshold as mutation nodes.

[0115] In one embodiment, nodes whose feature changes exceed a mutation threshold can be identified as mutation nodes. Thus, mutation nodes can be used to locate the positions where network state changes most drastically, making them highly suspect for root cause analysis.

[0116] Figure 6 This is the sixth flowchart illustrating the root cause localization method provided in this application embodiment. In step 120 above, i.e., when generating the differential knowledge graph, this application embodiment provides an optional implementation method, such as... Figure 6 As shown, it includes the following: Step 610: Determine the feature change of each node as the node attribute of the corresponding node in the predetermined knowledge graph skeleton to obtain the intermediate knowledge graph.

[0117] Step 620: Process the feature changes of connected nodes based on the predetermined association metric function, determine the association strength weight of connected nodes, and determine the association strength weight as the edge attribute of the directed edge corresponding to the connected node in the intermediate knowledge graph to obtain the differential knowledge graph.

[0118] In one embodiment, the topological structure of the differential knowledge graph is the same as that of a predetermined knowledge graph skeleton, and the attributes of each node can be assigned corresponding feature changes. Specifically, the feature changes of each node can be determined as the node attributes of the corresponding node in the predetermined knowledge graph skeleton to obtain an intermediate knowledge graph. The feature changes of connected nodes are then processed based on a predetermined association metric function to determine the association strength weight of the connected nodes. The association strength weight is then determined as the edge attribute of the directed edge corresponding to the connected node in the intermediate knowledge graph, ultimately generating the differential knowledge graph.

[0119] It should be understood that the specific implementation of step 620 can be understood by referring to the description in step 240 above, and will not be repeated here.

[0120] In this way, by differentially comparing the current knowledge graph snapshot with an anomaly with its immediately preceding knowledge graph snapshot, a differential knowledge graph can be generated, which can intuitively show how the mutation wave of changes when an anomaly occurs is distributed in the network topology, so as to accurately identify the mutation nodes and mutation relationships with drastic state changes.

[0121] Figure 7 This is the seventh flowchart illustrating the root cause localization method provided in this application embodiment. In step 130 above, that is, when performing a reverse search in the current knowledge graph snapshot based on the feature changes indicated by the differential knowledge graph, using the mutation node as the search starting point, to determine the root cause localization result of the mutation node, this application embodiment provides an optional implementation method, such as... Figure 7 As shown, it includes the following: Step 710: Starting from the mutation node, search in the reverse direction of the directed edges in the current knowledge graph snapshot until the termination condition is met. Generate candidate causal transmission paths with the currently searched node as the starting point and the mutation node as the ending point.

[0122] The termination conditions include: the feature change of the currently searched node is less than the deviation threshold, the currently searched node is a source node, or the preset search depth is reached. Thus, when the feature change of a node on a candidate causal propagation path is less than the deviation threshold, it indicates that the influence has weakened, and further exploration of that branch ceases. When a source node without an incoming edge is found (e.g., due to configuration parameters, external interference, etc.), or the preset search depth is reached, it indicates that further searching is not possible, and the search terminates.

[0123] In one embodiment, considering that the mutation node is a KPI node in the current knowledge graph snapshot that contributes significantly to the anomaly assessment score, a weighted reverse search algorithm (such as depth-first search or a Dijkstra-like algorithm) can be used to start the search from the mutation node. The search proceeds in the reverse direction along the directed edges of the differential knowledge graph until a termination condition is met. The currently searched node can be used as the starting point of the path, and the mutation node as the ending point, generating candidate causal transmission paths. For example, from the "throughput" node, a reverse search can be performed to find the "MCS" or "PRB utilization" nodes.

[0124] Step 720: Determine the path score for each candidate causal transmission path based on the feature changes of each node in the differential knowledge graph and the association strength weight of each directed edge in the differential knowledge graph.

[0125] In one embodiment, during the reverse search process, a path score can be dynamically calculated for each potential causal transmission path. A higher path score indicates a greater likelihood that it is a causal transmission path. The path score can be calculated as follows: .

[0126] in, The path score is given to the candidate causal transmission path P. The feature change of node v on the candidate causal transmission path P in the differential knowledge graph reflects its degree of mutation. Let e ​​be the association strength weight of the directed edge e on the candidate causal transmission path P in the differential knowledge graph. and This is a hyperparameter used to balance the importance of node mutations and relationship strength.

[0127] Step 730: Determine the starting point of the candidate causal transmission path whose path score meets the first preset condition as the candidate root cause node, and aggregate the candidate causal transmission paths associated with the candidate root cause node to determine the aggregate score of the candidate root cause node.

[0128] Optionally, the first preset condition may be that the ranking order of the path score is greater than a first preset order threshold. The ranking order of the path score refers to the ranking order of the path scores in a sequence obtained by arranging the path scores in descending order. Alternatively, the first preset condition may be that the path score is greater than a preset path score threshold. This application embodiment does not limit this.

[0129] In one embodiment, aggregating the candidate causal transmission paths associated with the candidate root cause node can be done by counting the number of times the candidate root cause node is the starting point of the candidate causal transmission path whose path score meets the first preset condition, or by accumulating the path scores of the candidate causal transmission paths including the candidate root cause node, thereby obtaining the aggregated score of the candidate root cause node.

[0130] Step 740: Determine the candidate root cause node whose aggregate score meets the second preset condition as the root cause node, and determine the candidate causal transmission path with the root cause node as the starting point and the highest path score as the causal transmission path, so as to obtain the root cause localization result of the mutation node.

[0131] Optionally, the second preset condition may be that the ranking order of the aggregated scores is greater than a second preset order threshold. The ranking order of the aggregated scores refers to their ranking order in the sequence obtained by arranging the aggregated scores in descending order. Alternatively, the second preset condition may be that the aggregated score is greater than a preset aggregated score threshold. This application embodiment does not limit this.

[0132] Based on this, candidate root cause nodes with higher aggregation scores can be used as the final recommended root cause nodes. At the same time, the causal transmission path with the root cause node as the starting point and the highest path score can also be presented to the operation and maintenance personnel, so as to facilitate timely troubleshooting of network faults.

[0133] As an example, the root cause node in the root cause localization results could be RSRP, and could also indicate a sharp drop in RSRP. The causal transmission path in the root cause localization results could be RSRP↓→SINR↓→CQI↓→MCS downgrade→throughput reduction.

[0134] In this way, guided root cause search can be performed on the current knowledge graph snapshot using information provided by the differential knowledge graph. This allows for causal path tracing on the current knowledge graph snapshot where an anomaly occurs, uncovering the most likely initial changes that led to KPI deterioration, and greatly improving the accuracy and interpretability of root cause localization.

[0135] Figure 8 This is a schematic diagram of the root cause localization process provided in an embodiment of this application. For example... Figure 8 As shown, the root cause localization process comprises three stages. First, at the input layer, a knowledge base based on the experience of communication domain experts, multi-source textual descriptions, and time-series monitoring data are input. Next, the knowledge graph snapshot construction stage proceeds, using the knowledge base to build a predetermined knowledge graph skeleton. Simultaneously, semantic modality encoding and temporal modality encoding are performed on the multi-source information. After cross-modal feature fusion, the skeleton is filled in, generating the current knowledge graph snapshot. Finally, in the anomaly detection and root cause localization stage based on graph evolution comparison, anomaly detection based on the target graph encoding model is performed. If anomalies are detected, mutation nodes are identified and a differential knowledge graph is constructed. Through weighted causal transmission path tracing, the root cause is ultimately located.

[0136] Based on this, the root cause localization method provided in this application can construct a snapshot of the communication network knowledge graph through multimodal feature fusion, thereby achieving a comprehensive and structured state representation of the dynamic network. Furthermore, it can effectively learn the spatiotemporal evolution laws of the communication network using spatiotemporal graph networks, enabling anomaly detection and root cause tracing based on evolutionary comparison. Moreover, through a unique differential knowledge graph and a weighted inverse scoring search mechanism, it can accurately eliminate irrelevant feature fluctuations, achieving highly visualized and highly accurate network root cause localization.

[0137] Thus, this application can achieve a leap from "correlation" to "change-causation" analysis, which can adapt to the characteristics of high dynamism, complexity and heterogeneity of wireless communication networks, and avoid the problem that traditional fault diagnosis methods are unable to capture the continuous evolution of network state before and after a fault occurs.

[0138] The root cause localization device provided in the embodiments of this application is described below. The root cause localization device described below can be referred to in correspondence with the root cause localization method described above.

[0139] Figure 9 This is a schematic diagram of the root cause localization device provided in an embodiment of this application. Figure 9 As shown, the root cause localization device provided in this application embodiment includes: Processing unit 910 is used to fill the predetermined knowledge graph skeleton based on the multimodal data of the communication network within the current time window, and generate a current knowledge graph snapshot of the communication network; the nodes in the predetermined knowledge graph skeleton are communication network elements, and the directed edges between the nodes are the topological associations between the communication network elements. The processing unit 910 is also used to compare and analyze the current knowledge graph snapshot and the previous knowledge graph snapshot when the anomaly evaluation score of the current knowledge graph snapshot is greater than the anomaly threshold, determine the mutation node, and generate a differential knowledge graph. Among them, the anomaly evaluation score of the current knowledge graph snapshot is proportional to the degree of deviation of the current knowledge graph snapshot from the normal evolution mode of the communication network; mutation nodes are used to represent nodes whose feature changes in the current time window are greater than the mutation threshold compared to the previous time window; differential knowledge graph includes the feature changes of each node in the predetermined knowledge graph skeleton in the current time window compared to the previous time window. The processing unit 910 is also used to perform a reverse search in the current knowledge graph snapshot, guided by the feature change indicated by the differential knowledge graph, with the mutation node as the search starting point, to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0140] In one embodiment, the multimodal data includes static textual description information of communication network elements and dynamic monitoring data of communication network elements within the current time window; the processing unit 910 is specifically used for: Based on the textual description information of communication network elements, determine the static semantic feature vector of the communication network elements; Based on monitoring data of communication network elements, determine the dynamic temporal feature vector of communication network elements; The static semantic feature vector and the dynamic temporal feature vector are fused to obtain the fused feature vector of the communication network element, and the fused feature vector of the communication network element is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton. The fusion feature vectors of connected nodes are processed based on a predetermined association metric function to determine the association strength weight of the connected nodes, and the association strength weight is determined as the edge attribute of the directed edge corresponding to the connected node in the predetermined knowledge graph skeleton.

[0141] In one embodiment, the processing unit 910 is specifically used for: Construct a structured input sequence from the text description information; Based on a pre-trained word segmenter in the field of communications and a structured input sequence, word representation vectors are generated; Based on word representation vectors and natural language processing models, static semantic feature vectors of communication network elements are determined.

[0142] In one embodiment, the natural language processing model determines attention weights based on domain prior attention bias, which is constructed based on the co-occurrence strength and semantic similarity of communication terms in domain text data.

[0143] In one embodiment, the processing unit 910 is further configured to determine the hidden representation of the current knowledge graph snapshot based on the current knowledge graph snapshot and the target graph encoding model; the training process of the target graph encoding model learns the normal evolution mode of the communication network. The processing unit 910 is also used to decode the hidden representation of the current knowledge graph snapshot to obtain the reconstructed features of the nodes in the current knowledge graph snapshot; The processing unit 910 is also used to determine the anomaly evaluation score of the current knowledge graph snapshot based on the reconstruction error between the original features and the reconstructed features of the nodes in the current knowledge graph snapshot.

[0144] In one embodiment, the target graph encoding model is trained through the following process: The initial graph encoding model is trained based on the knowledge graph snapshot sequence to obtain the target graph encoding model. The knowledge graph snapshot sequence includes multiple historical knowledge graph snapshots arranged in time. The initial graph encoding model extracts the spatial topological dependencies between nodes through spatial aggregation and extracts the evolutionary rules of nodes over time through temporal aggregation.

[0145] In one embodiment, the processing unit 910 is specifically used for: Based on the difference in the fused feature vectors of each node in the current knowledge graph snapshot and the previous knowledge graph snapshot, the feature change of each node is obtained. The mutation threshold is determined based on the statistical values ​​of the characteristic changes of all nodes. Nodes whose feature changes are greater than the mutation threshold are identified as mutation nodes.

[0146] In one embodiment, the processing unit 910 is specifically used for: The feature variation of each node is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton, thus obtaining the intermediate knowledge graph; The feature changes of connected nodes are processed based on a predetermined association metric function to determine the association strength weight of connected nodes. The association strength weight is then determined as the edge attribute of the directed edge corresponding to the connected node in the intermediate knowledge graph, thus obtaining the differential knowledge graph.

[0147] In one embodiment, the processing unit 910 is specifically used for: Starting from the mutation node, the search proceeds in the reverse direction of the directed edges in the current knowledge graph snapshot until the termination condition is met. The candidate causal transmission path is generated with the currently searched node as the starting point and the mutation node as the ending point. The termination conditions include the feature change of the currently searched node being less than the deviation threshold, or the currently searched node being the source node, or the preset search depth being reached.

[0148] In one embodiment, the processing unit 910 is specifically used for: Based on the feature changes of each node in the differential knowledge graph and the association strength weight of each directed edge in the differential knowledge graph, the path score of each candidate causal transmission path is determined. The starting point of the candidate causal transmission path whose path score meets the first preset condition is determined as the candidate root cause node, and the candidate causal transmission paths associated with the candidate root cause node are aggregated to determine the aggregate score of the candidate root cause node. Candidate root cause nodes whose aggregate scores meet the second preset condition are identified as root cause nodes, and candidate causal transmission paths with the root cause nodes as the starting point and the highest path scores are identified as causal transmission paths, thus obtaining the root cause localization results of mutation nodes.

[0149] Figure 10 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 10 As shown, the electronic device may include: a processor 1010, a communications interface 1020, a memory 1030, and a communication bus 1040, wherein the processor 1010, the communications interface 1020, and the memory 1030 communicate with each other via the communication bus 1040. The processor 1010 can call logical instructions in the memory 1030 to execute a root cause localization method, which includes: The framework of a predefined knowledge graph is populated with multimodal data from the communication network within the current time window to generate a snapshot of the current knowledge graph of the communication network. Nodes in the predefined knowledge graph framework represent communication network elements, and directed edges between nodes represent topological relationships between these elements. When the anomaly assessment score of the current knowledge graph snapshot exceeds an anomaly threshold, a comparative analysis is performed between the current and previous knowledge graph snapshots to identify mutation nodes and generate a differential knowledge graph. The anomaly assessment score of the current knowledge graph snapshot is related to the normality of the current knowledge graph snapshot relative to the communication network. The degree of deviation from the evolutionary pattern is proportional; mutation nodes are used to represent nodes whose feature changes in the current time window are greater than the mutation threshold compared to the previous time window; the differential knowledge graph includes the feature changes of each node in the predefined knowledge graph skeleton in the current time window compared to the previous time window; guided by the feature changes indicated by the differential knowledge graph, a reverse search is performed in the current knowledge graph snapshot with the mutation node as the search starting point to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0150] Furthermore, the logical instructions in the aforementioned memory 1030 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to perform the methods provided in the above embodiments, the method including: The framework of a predefined knowledge graph is populated with multimodal data from the communication network within the current time window to generate a snapshot of the current knowledge graph of the communication network. Nodes in the predefined knowledge graph framework represent communication network elements, and directed edges between nodes represent topological relationships between these elements. When the anomaly assessment score of the current knowledge graph snapshot exceeds an anomaly threshold, a comparative analysis is performed between the current and previous knowledge graph snapshots to identify mutation nodes and generate a differential knowledge graph. The anomaly assessment score of the current knowledge graph snapshot is related to the normality of the current knowledge graph snapshot relative to the communication network. The degree of deviation from the evolutionary pattern is proportional; mutation nodes are used to represent nodes whose feature changes in the current time window are greater than the mutation threshold compared to the previous time window; the differential knowledge graph includes the feature changes of each node in the predefined knowledge graph skeleton in the current time window compared to the previous time window; guided by the feature changes indicated by the differential knowledge graph, a reverse search is performed in the current knowledge graph snapshot with the mutation node as the search starting point to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0152] In another aspect, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments, the method comprising: The framework of a predefined knowledge graph is populated with multimodal data from the communication network within the current time window to generate a snapshot of the current knowledge graph of the communication network. Nodes in the predefined knowledge graph framework represent communication network elements, and directed edges between nodes represent topological relationships between these elements. When the anomaly assessment score of the current knowledge graph snapshot exceeds an anomaly threshold, a comparative analysis is performed between the current and previous knowledge graph snapshots to identify mutation nodes and generate a differential knowledge graph. The anomaly assessment score of the current knowledge graph snapshot is related to the normality of the current knowledge graph snapshot relative to the communication network. The degree of deviation from the evolutionary pattern is proportional; mutation nodes are used to represent nodes whose feature changes in the current time window are greater than the mutation threshold compared to the previous time window; the differential knowledge graph includes the feature changes of each node in the predefined knowledge graph skeleton in the current time window compared to the previous time window; guided by the feature changes indicated by the differential knowledge graph, a reverse search is performed in the current knowledge graph snapshot with the mutation node as the search starting point to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

[0153] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0154] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A root cause localization method, characterized in that, include: The framework of the predetermined knowledge graph is filled with multimodal data of the communication network within the current time window to generate a snapshot of the current knowledge graph of the communication network. The nodes in the predetermined knowledge graph skeleton are communication network elements, and the directed edges between nodes are the topological associations between communication network elements. When the anomaly assessment score of the current knowledge graph snapshot is greater than the anomaly threshold, the current knowledge graph snapshot and the previous knowledge graph snapshot are compared and analyzed to determine the mutation node and generate a differential knowledge graph. The anomaly assessment score of the current knowledge graph snapshot is proportional to the degree of deviation of the current knowledge graph snapshot from the normal evolution mode of the communication network; the mutation node is used to represent a node whose feature change in the current time window is greater than the mutation threshold in the previous time window; the differential knowledge graph includes the feature change of each node in the predetermined knowledge graph skeleton in the current time window relative to the previous time window. Guided by the feature changes indicated by the differential knowledge graph, a reverse search is performed in the current knowledge graph snapshot, starting from the mutation node, to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

2. The method according to claim 1, characterized in that, The multimodal data includes static textual descriptions of communication network elements and dynamic monitoring data of communication network elements within the current time window; the process of filling the predetermined knowledge graph skeleton based on the multimodal data of the communication network within the current time window includes: Based on the textual description information of the communication network elements, determine the static semantic feature vector of the communication network elements; Based on the monitoring data of the communication network elements, determine the dynamic temporal feature vector of the communication network elements; The static semantic feature vector and the dynamic temporal feature vector are fused to obtain the fused feature vector of the communication network element, and the fused feature vector of the communication network element is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton. The fusion feature vectors of connected nodes are processed based on a predetermined association metric function to determine the association strength weight of the connected nodes, and the association strength weight is determined as the edge attribute of the directed edge corresponding to the connected node in the predetermined knowledge graph skeleton.

3. The method according to claim 2, characterized in that, The determination of the static semantic feature vector of the communication network element based on the text description information of the communication network element includes: The text description information is constructed into a structured input sequence; Based on a pre-trained word segmenter in the field of communications and the structured input sequence, word representation vectors are generated; Based on the word representation vectors and the natural language processing model, the static semantic feature vectors of communication network elements are determined.

4. The method according to claim 2 or 3, characterized in that, The natural language processing model determines attention weights based on domain prior attention bias, which is constructed based on the co-occurrence strength and semantic similarity of communication terms in domain text data.

5. The method according to claim 1, characterized in that, Also includes: Based on the current knowledge graph snapshot and the target graph encoding model, determine the hidden representation of the current knowledge graph snapshot; The training process of the target graph coding model learns the normal evolution pattern of the communication network; Decode the hidden representation of the current knowledge graph snapshot to obtain the reconstructed features of the nodes in the current knowledge graph snapshot; Based on the reconstruction error between the original features and reconstructed features of the nodes in the current knowledge graph snapshot, the anomaly evaluation score of the current knowledge graph snapshot is determined.

6. The method according to claim 5, characterized in that, The target graph encoding model is trained through the following process: The initial graph encoding model is trained based on the knowledge graph snapshot sequence to obtain the target graph encoding model; the knowledge graph snapshot sequence includes multiple historical knowledge graph snapshots arranged in time; the initial graph encoding model extracts the spatial topological dependencies between nodes through spatial aggregation and extracts the evolutionary rules of nodes over time through temporal aggregation.

7. The method according to claim 2, characterized in that, The step of comparing and analyzing the current knowledge graph snapshot with the previous knowledge graph snapshot to determine mutation nodes includes: Based on the difference in the fused feature vectors of each node in the current knowledge graph snapshot and the previous knowledge graph snapshot, the feature change of each node is obtained; The mutation threshold is determined based on the statistical values ​​of the feature changes of all nodes; Nodes whose feature changes are greater than the mutation threshold are identified as mutation nodes.

8. The method according to claim 7, characterized in that, The generation of the differential knowledge graph includes: The feature change of each node is determined as the node attribute of the corresponding node in the predetermined knowledge graph skeleton to obtain the intermediate knowledge graph; The feature changes of connected nodes are processed based on a predetermined association metric function to determine the association strength weight of the connected nodes. The association strength weight is then determined as the edge attribute of the directed edge corresponding to the connected node in the intermediate knowledge graph, thus obtaining the generated differential knowledge graph.

9. The method according to claim 8, characterized in that, The reverse search in the current knowledge graph snapshot, guided by the feature changes indicated by the differential knowledge graph and starting from the mutation node, includes: Starting from the mutation node, the search proceeds in the reverse direction of the directed edges in the current knowledge graph snapshot until a termination condition is met. A candidate causal transmission path is generated with the currently searched node as the starting point and the mutation node as the ending point. The termination condition includes the feature change of the currently searched node being less than the deviation threshold, or the currently searched node being the source node, or reaching a preset search depth.

10. The method according to claim 9, characterized in that, The determination of the root cause localization result of the mutation node includes: Based on the feature changes of each node in the differential knowledge graph and the association strength weight of each directed edge in the differential knowledge graph, the path score of each candidate causal transmission path is determined. The starting point of the candidate causal transmission path whose path score meets the first preset condition is determined as the candidate root cause node, and the candidate causal transmission paths associated with the candidate root cause node are aggregated to determine the aggregate score of the candidate root cause node. The candidate root cause node whose aggregate score meets the second preset condition is determined as the root cause node, and the candidate causal transmission path with the root cause node as the starting point and the highest path score is determined as the causal transmission path, so as to obtain the root cause localization result of the mutation node.

11. A root cause localization device, characterized in that, include: The processing unit is used to fill the predetermined knowledge graph skeleton based on the multimodal data of the communication network within the current time window, and generate a current knowledge graph snapshot of the communication network; the nodes in the predetermined knowledge graph skeleton are communication network elements, and the directed edges between the nodes are the topological associations between the communication network elements. The processing unit is further configured to, when the anomaly evaluation score of the current knowledge graph snapshot is greater than the anomaly threshold, perform comparative analysis on the current knowledge graph snapshot and the previous knowledge graph snapshot, determine the mutation node, and generate a differential knowledge graph. The anomaly assessment score of the current knowledge graph snapshot is proportional to the degree of deviation of the current knowledge graph snapshot from the normal evolution mode of the communication network; the mutation node is used to represent a node whose feature change in the current time window is greater than the mutation threshold in the previous time window; the differential knowledge graph includes the feature change of each node in the predetermined knowledge graph skeleton in the current time window relative to the previous time window. The processing unit is further configured to perform a reverse search in the current knowledge graph snapshot, guided by the feature change indicated by the differential knowledge graph and starting from the mutation node, to determine the root cause localization result of the mutation node. The root cause localization result is used to indicate the root cause node corresponding to the mutation node, as well as the causal transmission path between the mutation node and the root cause node.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the root cause localization method as described in any one of claims 1 to 10.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the root cause localization method as described in any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the root cause localization method as described in any one of claims 1 to 10.

Images