A fault automatic positioning method and system based on historical fault semantic learning

Abstract

The application relates to the technical field of network operation and intelligent fault diagnosis, and particularly discloses a fault automatic positioning method and system based on historical fault semantic learning, historical fault cases containing log original texts and root cause descriptions are collected, variable desensitization is performed on the log original texts, log templates are extracted through template generalization, multi-layer index paths are constructed, and fault representation sentences associated with root causes are screened; the fault representation sentences are converted into semantic feature vectors, are stored in association with the index paths and the templates, and form a historical fault semantic feature library; current fault logs are acquired, log templates thereof are also extracted, index paths are determined, and current semantic feature vectors are converted, similarity degrees with the vectors in the library are calculated, and the historical root cause with the highest similarity degree is output as a positioning result; and the application realizes automation and semantic matching of fault positioning.

Description

Technical Field

[0001] This invention relates to the field of network operation and maintenance and intelligent fault diagnosis technology, specifically to an automatic fault location method and system based on historical fault semantic learning. Background Technology

[0002] Currently, fault location in network operations and maintenance (O&M) primarily relies on manual analysis of historical fault logs and root cause relationships by O&M personnel. This process is time-consuming, involves a lot of repetitive work, and the quality of fault location is highly dependent on individual experience. Existing auxiliary analysis methods, whether based on fixed matching rules or clustering statistics based on log templates, are insufficient to address the continuous evolution of network device log formats, the heterogeneity of logs from different vendors, and the diverse semantic expressions of the same fault. This results in low accuracy and poor generalization ability in fault location.

[0003] The technical problem this invention aims to solve is how to construct a set of fault semantic features that can autonomously extract and solidify generalizable fault semantic features from the direct correspondence between historical fault logs and root causes, and use these features to automatically and interpretably locate newly occurring fault logs, thereby eliminating the dependence on manual rule writing and template maintenance. Summary of the Invention

[0004] The purpose of this invention is to provide an automatic fault location method and system based on historical fault semantic learning to solve the problems mentioned above.

[0005] The objective of this invention can be achieved through the following technical solutions: An automatic fault localization method based on historical fault semantic learning includes the following steps: S1: Collect historical failure cases. Each historical failure case includes the original log text generated when the failure occurred and a description of the root cause of the failure annotated afterward. S2: Perform variable desensitization and message template generalization on the original log text to extract the log template. Construct a multi-level index path based on the category attributes of the log template. Based on the semantic content of the root cause description, filter out the fault characterization statements that are causally related to the root cause from the log template. S3: Convert the fault characterization statement into a semantic feature vector, and associate and store the semantic feature vector with the corresponding multi-level index path and the log template to form a historical fault semantic feature library; S4: Obtain the current fault log to be located, perform variable desensitization and message template generalization on the current fault log to extract its log template and determine its index path, and then convert the log template of the current fault log into the current semantic feature vector. S5: Calculate the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library, and select the root cause description corresponding to the historical fault case with the highest similarity as the output of the current fault location result.

[0006] As a further aspect of the present invention: the construction of the multi-level index path specifically includes: Extract the device type identifier and log mnemonic identifier from the fixed header of the log template; Set the device type identifier as the first-level index and the log mnemonic identifier as the second-level index; Calculate the hash sum of all nonvariable strings in the log template, set the hash sum as the third-level index, and mount it under the second-level index.

[0007] As a further aspect of the present invention: the step of filtering out fault characterization statements from the log template that are causally related to the root cause specifically includes: The root cause description is broken down into multiple causal links, each of which contains the triggering action and the object affected. Extract the predicate verb-object structure from the log template one by one and compare it semantically with the triggering action in the causal chain; Log templates with consistent semantic matching are selected as fault characterization statements, while log templates that do not match any causal chain are removed.

[0008] As a further aspect of the present invention: S3 specifically includes: The fault description statement is divided into multiple minimal semantic segments according to punctuation, and each segment retains the subject and predicate; For each segment, calculate its fixed-length binary hash fingerprint, and sum the binary hash fingerprints of all segments bit by bit to generate an aggregated feature vector; The aggregated feature vector, the end node value of the multi-level index path, and the original compressed string of the log template are written together into a storage record, and the full path string of the multi-level index path is used as the retrieval key of the corresponding record.

[0009] As a further aspect of the present invention: the process of generating the aggregated feature vector is as follows: Apply a set of independent hash maps to each minimal semantic fragment, and output a binary string of a specified length for each fragment; Based on the order in which each segment appears in the original fault characterization statement, each bit in the corresponding binary string is assigned a decay weight that decreases sequentially. Multiply the values ​​at the same position in all binary strings by their respective decay weights and sum them up to obtain the aggregated integer value at the corresponding position; All aggregated integer values ​​are concatenated in positional order to form an aggregated feature vector.

[0010] As a further aspect of the present invention: the step of converting the current fault log template into a current semantic feature vector specifically includes: Extract fixed-length device code segments and mnemonic code segments sequentially from the header of the current fault log template, and use them as the first-level index and the second-level index, respectively. Concatenate all constant characters in the log template except for variable placeholders in order, and calculate the length of the concatenated string and take the modulo value as the third-level index. Each character in the concatenated string is converted into a binary value, and the binary values ​​are accumulated in character order and then divided by the length of the concatenated string to generate a fixed-length array as the current semantic feature vector.

[0011] As a further aspect of the present invention: the calculation of the modulo value of the length of the spliced ​​string specifically includes: Extract the standard stroke count of each constant character in the concatenated string one by one, and sum all the stroke counts to obtain the stroke count sum; After converting the accumulated stroke value into a binary bit string, the lowest two bits are truncated to obtain an offset between 0 and 3; The prime number at the corresponding position is taken from a pre-stored sequence of five prime numbers based on the offset and used as the dynamic modulus; Calculate the remainder after dividing the length of the concatenated string by the dynamic modulus, and use the remainder as the third-level index.

[0012] As a further aspect of the present invention: S5 specifically includes: The current semantic feature vector is split into a positive and negative sign sequence and a numerical sequence, and only candidate vectors whose sign sequence is exactly the same as any vector sign sequence in the historical fault semantic feature library are retained. For each candidate vector's numerical sequence and the current numerical sequence, calculate the absolute value of the difference bit by bit, sum all the absolute values ​​of the bit differences, and take the reciprocal as the initial matching value; Extract the length value of the log template corresponding to each candidate vector, use the logarithm of the corresponding length value as an adjustment coefficient, and multiply it with the preliminary matching value to obtain the final matching value; The root cause description associated with the candidate vector with the largest final matching value is selected as the output of the current fault location result.

[0013] An automatic fault localization system based on historical fault semantic learning includes: The historical case collection module is used to collect historical failure cases. Each historical failure case includes the original log text generated when the failure occurred and a description of the root cause of the failure annotated afterward. The log template and index building module performs variable desensitization and message template generalization on the original log text to extract the log template. It builds a multi-level index path based on the category attributes of the log template and filters out fault characterization statements that are causally related to the root cause from the log template based on the semantic content of the root cause description. The feature library module converts fault characterization statements into semantic feature vectors, and associates and stores the semantic feature vectors with the corresponding multi-level index paths and the log templates to form a historical fault semantic feature library. The current log transformation module is used to obtain the current fault log to be located, perform variable desensitization and message template generalization on the current fault log to extract its log template and determine its index path, and then convert the log template of the current fault log into the current semantic feature vector. The matching and localization output module is used to calculate the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library, and selects the root cause description corresponding to the historical fault case with the highest similarity as the localization result of the current fault.

[0014] The beneficial effects of this invention are: (1) This solution automatically extracts log templates from historical cases and builds multi-level indexes by using variable desensitization, template generalization, and filtering fault characterization statements based on root cause semantics, without the need for manual writing or updating of matching rules. When network equipment is upgraded or the log format changes, the system can automatically adapt by collecting new historical cases, avoiding the manpower overhead of frequently maintaining the rule base in traditional methods.

[0015] (2) This scheme breaks down the fault characterization statement into the smallest semantic fragments and generates a binary hash fingerprint aggregation vector with decay weights. During matching, it combines the bit-by-bit comparison of the symbol sequence with the log template length adjustment, which can tolerate changes in the position of variables, wording differences and format fine-tuning in the log. Even if the logs generated by the same fault at different times or on different devices have semantic differences, it can still stably match the correct historical root cause, reducing the probability of missed matches and false matches. Attached Figure Description

[0016] The invention will now be further described with reference to the accompanying drawings.

[0017] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system block diagram of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 As shown, this invention is an automatic fault localization method based on historical fault semantic learning, comprising the following steps: S1: Collect historical failure cases. Each historical failure case includes the original log text generated when the failure occurred and a description of the root cause of the failure annotated afterward. S2: Perform variable desensitization and message template generalization on the original log text to extract the log template. Construct a multi-level index path based on the category attributes of the log template. Based on the semantic content of the root cause description, filter out the fault characterization statements that are causally related to the root cause from the log template. S3: Convert the fault characterization statement into a semantic feature vector, and associate and store the semantic feature vector with the corresponding multi-level index path and the log template to form a historical fault semantic feature library; S4: Obtain the current fault log to be located, perform variable desensitization and message template generalization on the current fault log to extract its log template and determine its index path, and then convert the log template of the current fault log into the current semantic feature vector. S5: Calculate the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library, and select the root cause description corresponding to the historical fault case with the highest similarity as the output of the current fault location result.

[0020] In S1, historical fault cases are collected. Each historical fault case includes the original log text generated when the fault occurred and a description of the root cause of the fault annotated afterward, specifically including: When collecting historical fault cases, closed-loop processed historical fault records are extracted from the network device operation and maintenance log database and fault ticket management system. Each historical fault case consists of two parts: the first part is the original log text generated when the fault occurred, which comes from at least one of the following: system logs output by the device itself, diagnostic command echoes, alarm information, or configuration change records; the second part is a post-fault root cause description, which is filled in by the operation and maintenance personnel in natural language text form into the root cause field of the fault ticket after the fault is resolved. The collection process is executed on a weekly cycle. Each time, the above two parts are assembled into a historical fault case according to a one-to-one correspondence and assigned a unique fault identification number. All historical fault cases are stored in a relational database in tabular form. The original log text field retains the original line breaks and timestamps, and the root cause description field retains the complete Chinese description without any truncation or preprocessing.

[0021] In S2, variable anonymization and message template generalization are performed on the original log text to extract log templates. A multi-level index path is constructed based on the category attributes of the log templates. Based on the semantic content of the root cause description, fault characterization statements that are causally related to the root cause are selected from the log templates, specifically including: For each historical fault case log file collected, variable anonymization is first performed. The specific method for variable anonymization is as follows: scan the log file for numeric strings, hexadecimal values, timestamp fields, and variable identifiers, and replace all variable content with asterisk placeholders. After anonymization, message template generalization is performed on the anonymized log text. The generalization method is as follows: combine multiple consecutive asterisk placeholders into a single generalization marker, while retaining fixed strings, keywords, and punctuation marks from the original log file. The extracted result is the log template.

[0022] From the fixed header of the extracted log template, the field between the start position and the first space is extracted as the device type identifier, and this identifier is set as the first-level index. Subsequently, after the device type identifier, the log mnemonic field is located. This field is usually located after square brackets or a percent sign and contains the module name and log level code. This log mnemonic identifier is set as the second-level index.

[0023] Concatenate all non-variable strings in the log template, excluding asterisk placeholders, into a long string in their original order of appearance. For each character in this long string, extract its corresponding standard numeric code. Concatenate all the numeric codes byte-by-byte, and use the lower eight bits of the concatenation result as the initial hash value. Then, multiply the initial hash value by a pre-stored fixed prime number, and take the lower sixteen bits of the product to obtain the final hash concatenation value. Set this hash concatenation value as the third-level index and mount it in a tree structure under the node containing the second-level index.

[0024] The root cause descriptions marked in historical failure cases are treated as complete natural language sentences and segmented using commas, periods, and semicolons to obtain multiple shorter sentences. For each short sentence, a subject-verb-object triple extraction method is used to identify the triggering action words and the affected object words. Each pair of triggering action and affected object is combined into a causal chain. A root cause description may be broken down into multiple causal chains, arranged sequentially according to their order of appearance in the original text.

[0025] For each log template, the predicate verb and its direct object are extracted to form a predicate-verb-object structure. If a log template contains multiple predicate-verb-object structures, all of them are extracted sequentially. Each extracted predicate-verb-object structure is then semantically compared with the triggering actions in the causal chains obtained in the fourth paragraph. The semantic comparison method is as follows: calculate the length of the longest common substring between the verb stem and the triggering action stem in each predicate-verb-object structure, and then divide it by the total length of the verb stems. If the ratio exceeds 60%, it is considered semantically consistent.

[0026] A log template is selected as a fault description statement when at least one predicate verb-object structure in it matches the semantics of a triggering action in a causal chain. If none of the predicate verb-object structures in a log template match the triggering actions in any causal chain with a match ratio of more than 60%, the log template is discarded and not proceeded to the next processing step. After the above filtering is completed, the remaining fault description statements are considered to have a causal relationship with the root cause.

[0027] In S3, fault characterization statements are converted into semantic feature vectors, and these semantic feature vectors are associated with and stored along with the corresponding multi-level index paths and the log templates to form a historical fault semantic feature library, specifically including: The selected fault-characterizing statements are obtained and treated as a complete natural language string. Using periods, semicolons, commas, and exclamation marks as delimiters, the string is segmented into multiple substrings, each called a minimal semantic segment. For each minimal semantic segment, dependency parsing is used to identify the core predicate verb and its subject noun, removing objects and modifiers, retaining only the subject-predicate tuple. If a segment does not contain a clear subject, only the predicate verb is retained. After this processing, each minimal semantic segment corresponds to a brief core semantic unit.

[0028] For each minimal semantic segment retaining the subject and predicate, calculate its fixed-length 256-bit binary hash fingerprint. The calculation method is as follows: First, convert all characters in the segment into their corresponding numerical sequences using a unified character encoding, processing each number sequentially from left to right. Set up an initial 256-bit all-zero binary register. For the first digit in the segment, multiply it by a preset fixed-size prime number, convert the product to binary, and then perform a bitwise XOR operation with the current value in the register. Then, circularly shift the entire register one bit to the left. For each subsequent digit, repeat the above multiplication, XOR, and circular shift operations, but each time the shift increments by one bit; that is, shift two bits after the second character, three bits after the third character, and so on, until all characters in the segment have been processed. The final 256-bit binary value stored in the register is the binary hash fingerprint of the segment.

[0029] Based on the order in which each minimal semantic fragment appears in the original fault representation statement, a decay weight is assigned to each fragment. The order of appearance starts from 1, with smaller numbers indicating earlier semantic positions and thus larger weights. The formula for calculating the decay weight is as follows: ;in, This represents the sequential number of the smallest semantic segment in the original fault representation statement, and its value ranges from positive integers starting from 1; Indicates the first The decay weights corresponding to each segment decrease exponentially as the segment number increases. For example, the weight of the first segment is 1, the weight of the second segment is 0.5, the weight of the third segment is 0.25, and so on.

[0030] The 256-bit binary hash fingerprint of each minimal semantic fragment is considered to consist of 256 independent bits, each bit being either 0 or 1. A weighted summation operation is performed at the same position across all fragments. Define the... Aggregate integer value at bit position The calculation formula is: ;in, This represents the total number of the smallest semantic segments; Number the segments sequentially, from 1 to... ; Indicates the first In the binary hash fingerprint of the fragment, the first... The value of the bit position (which can be 0 or 1); For the first Individual segment decay weights; For the first The accumulated result at each position is no longer limited to 0 or 1; it can be any non-negative real number. Calculate sequentially according to the formula above. For each position from 1 to 256, 256 aggregated integer values ​​are obtained.

[0031] The 256 aggregated integer values ​​obtained are arranged in ascending order of position, with the value at the first position as the first component of the vector, the value at the second position as the second component, and so on, until the value at the 256th position is the last component. These components together form an aggregated feature vector of dimension 256. Each component in this vector is a real number, preserving the positional information and weight differences of the original semantic segments.

[0032] Extract the full path string of the multi-level index path, which is formed by connecting the first, second, and third level indices with underscores. Simultaneously, compress the original log template string by removing all consecutive repeating spaces and replacing newlines with single spaces, resulting in the compressed original log template string. Write the aggregated feature vector, the terminal node values ​​of the multi-level index path, and the compressed original log template string into a single record in the relational database. Use the full path string as the retrieval key for this record to ensure quick location of the corresponding feature vector via the index path. Repeat the above process for all historical fault cases to ultimately form a historical fault semantic feature library.

[0033] One embodiment of step S3 specifically includes: taking a single-board reset failure occurring in a live data communication network as an example, the original log of this failure contains 16 system log entries and 3 diagnostic command echoes, with the root cause described as "a soft failure of the TCAM chip caused an entry read error, triggering a single-board reset." Following the method in step S3, four minimal semantic segments are extracted from the fault characterization statement of this case: "TCAM chip soft failure," "entry read error," "triggered single-board reset," and "reset reason record." After calculating a 256-bit binary hash fingerprint for each segment, attenuation weights are assigned sequentially based on their order of appearance as 1, 0.5, 0.25, and 0.125, respectively. These weighted sums are then accumulated bit-by-bit to obtain a 256-dimensional aggregated feature vector.

[0034] In the above aggregated feature vector, the values ​​of the first five components are 1.875, 0.625, 0.375, 1.125, and 0.875, respectively, while the values ​​of the remaining components are distributed between 0 and 2. The multi-level index path corresponding to this case is "NE40E_M2K |01TCAM_3_HW_FAIL | hash superposition value 39871", and the full path string is "NE40E_M2K_01TCAM_3_HW_FAIL_39871". The aggregated feature vector, the terminal node value 39871, and the compressed string of the original log template are stored in a relational database, using the full path string as the retrieval key. The above operation is repeated for the 1247 closed-loop fault cases accumulated in the historical fault database to form a historical fault semantic feature database.

[0035] In S4, the current fault log to be located is obtained. Variable desensitization and message template generalization are performed on the current fault log to extract its log template and determine its index path. Then, the log template of the current fault log is converted into a current semantic feature vector, specifically including: The system retrieves the current fault log to be located. This log originates from the real-time system log stream output by network devices or log files manually uploaded by maintenance personnel. The system performs the same variable anonymization process as historical logs on the current fault log: identifying numeric strings, hexadecimal values, timestamps, and variable identifiers in the log, and uniformly replacing these variable contents with asterisk placeholders. Subsequently, message template generalization is performed, merging multiple consecutive asterisk placeholders into a single generalized marker, while retaining fixed strings, keywords, and punctuation marks from the original log text. The extracted result is the log template for the current fault log.

[0036] Starting from the header of the extracted current fault log template, the fields before the first space are sequentially located as device code segments. The first 8 characters of a fixed length are extracted from this segment, padded with asterisks if less than 8 characters. This result is set as the first-level index. After the first-level index, the log mnemonic code segment is located. This segment usually appears after the percent sign or within square brackets and contains the module name and log level code. The first 12 characters of a fixed length are extracted from this segment, padded with asterisks if less than 12 characters. This result is set as the second-level index.

[0037] From the current fault log template, identify all variable positions replaced by asterisk placeholders. After excluding these positions, extract each remaining constant character in its original order. Constant characters include Chinese characters, English letters, punctuation marks, and fixed separators. Concatenate all extracted constant characters end-to-end sequentially without inserting any extra symbols to form a continuous string, called the concatenation string. Record the total length of this concatenation string.

[0038] Obtain the standard stroke count for each constant character in the concatenated string. For Chinese characters, look up their stroke count according to the national standard Chinese character stroke dictionary; for English letters and numbers, set the stroke count to 1 for each character; for punctuation marks, set the stroke count to 1 for each character. Add up the stroke counts of all characters in the concatenated string to obtain an integer, called the stroke accumulation value. Convert this stroke accumulation value into a binary bit string by continuously dividing it by 2 and taking the remainders until the quotient is 0. Reverse the remainders to obtain the binary bit string. Starting from the rightmost (least significant) bit of this binary bit string, extract the two least significant bits. Convert the binary number formed by these two bits into a decimal value, which ranges from 0 to 3, and is called the offset.

[0039] A sequence of prime numbers is pre-stored, containing five prime numbers in the order 2, 3, 5, 7, and 11. Based on the calculated offsets, the prime number at the corresponding position in this sequence is extracted: offset 0 yields the first prime number (2), offset 1 yields the second prime number (3), offset 2 yields the third prime number (5), and offset 3 yields the fourth prime number (7). This extracted prime number is then used as the dynamic modulus. The remainder is calculated by dividing the total length of the concatenated string by the dynamic modulus, using integer division, where the remainder is a non-negative integer less than the dynamic modulus. This remainder is then set as the third-level index.

[0040] Each constant character in the concatenated string is converted to its corresponding binary value. For Chinese characters, their hexadecimal code value from the national standard encoding table is taken and then converted to binary; for English letters and numbers, their standard character encoding binary values ​​are directly taken. Following the original order of the characters in the concatenated string, the binary values ​​of each character are accumulated into an accumulator initially set to 0, using a bit-by-bit addition method without carry-over. After accumulating all characters, a sum array is obtained. Each component value in this sum array is divided by the total length of the characters in the concatenated string, with the division result rounded to 6 decimal places. Finally, a fixed-length array with the same dimensions as the sum array is obtained; this array is the current semantic feature vector.

[0041] In S5, the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library is calculated. The root cause description corresponding to the historical fault case with the highest similarity is selected as the localization result of the current fault. Specifically, this includes: The current semantic feature vector corresponding to the current fault log is obtained from the aforementioned steps. This vector is a fixed-length array, where each component is a real number. Simultaneously, a pre-built historical fault semantic feature library is read. This library contains multiple records, each storing a historical semantic feature vector, the corresponding multi-level index path, the compressed original log template string, and the associated root cause description.

[0042] Each component in the current semantic feature vector is split into two parts based on its numerical sign: if the component's value is greater than or equal to zero, its sign is positive; if the component's value is less than zero, its sign is negative. The signs of all components are then arranged in their original order to form a sign sequence. Simultaneously, the absolute values ​​of each component are extracted and arranged in their original order to form a numerical sequence. The same sign sequence splitting operation is performed on each historical semantic feature vector in the historical fault semantic feature database.

[0043] The symbol sequence of the current semantic feature vector is compared bit-by-bit with the symbol sequence of each historical semantic feature vector in the historical fault semantic feature database. Only when the symbols in both sequences are completely identical at every position is the historical semantic feature vector retained as a candidate vector. If the symbols at at least one position are different, the historical semantic feature vector is directly discarded and not included in any subsequent calculations. After this screening process, several candidate vectors are obtained.

[0044] For each candidate vector, its numerical sequence is compared bit-by-bit with the numerical sequence of the current semantic feature vector. At each corresponding position in the numerical sequence, the difference between the absolute value of the candidate vector's component and the absolute value of the current vector's component is calculated, and the absolute value of this difference is taken. The absolute values ​​of the differences at all positions are summed to obtain a cumulative sum. Then, the reciprocal of this cumulative sum is calculated, i.e., 1 is divided by the cumulative sum, and the result is used as the initial matching value of the candidate vector. If the cumulative sum is zero, the initial matching value is set to 1.

[0045] Extract the compressed string of the original log template associated with each candidate vector and calculate the total character length of the compressed string. Use the common logarithm of this length value as an adjustment factor, i.e., calculate the base-10 logarithm of this length value. Multiply the preliminary matching value obtained from the fourth segment by this adjustment factor, and the product is the final matching value of the candidate vector. By multiplying by the logarithmic adjustment factor, the matching value of candidate vectors with appropriate log template lengths is appropriately scaled.

[0046] Compare the final matching values ​​of all candidate vectors and find the candidate vector corresponding to the maximum matching value. Read the complete text from the root cause description field associated with that candidate vector and output that root cause description as the current fault location result. If multiple candidate vectors have the same maximum matching value, select one and output its root cause description. After completing the above steps, the system has successfully matched the most similar root cause from historical fault cases for current fault location.

[0047] Please see Figure 2 As shown, an automatic fault localization system based on historical fault semantic learning includes: The historical case collection module is used to collect historical failure cases. Each historical failure case includes the original log text generated when the failure occurred and a description of the root cause of the failure annotated afterward. The log template and index building module performs variable desensitization and message template generalization on the original log text to extract the log template. It builds a multi-level index path based on the category attributes of the log template and filters out fault characterization statements that are causally related to the root cause from the log template based on the semantic content of the root cause description. The feature library module converts fault characterization statements into semantic feature vectors, and associates and stores the semantic feature vectors with the corresponding multi-level index paths and the log templates to form a historical fault semantic feature library. The current log transformation module is used to obtain the current fault log to be located, perform variable desensitization and message template generalization on the current fault log to extract its log template and determine its index path, and then convert the log template of the current fault log into the current semantic feature vector. The matching and localization output module is used to calculate the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library, and selects the root cause description corresponding to the historical fault case with the highest similarity as the localization result of the current fault.

[0048] The working principle of this invention is as follows: Historical fault cases containing original log text and root cause descriptions are collected. The original log text undergoes variable anonymization and message template generalization to extract log templates. Multi-level index paths are constructed based on template categories, and fault characterization statements with causal relationships are selected based on the semantic content of the root cause descriptions. These fault characterization statements are converted into semantic feature vectors and then associated with the index paths and log templates to form a historical fault semantic feature library. The current fault log is obtained, and its log template is extracted, the index path is determined, and it is converted into a current semantic feature vector. By comparing the similarity between the current semantic feature vector and each historical semantic feature vector in the library, the root cause description corresponding to the historical case with the highest similarity is selected as the current fault location result output.

[0049] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A method for automatic fault localization based on historical fault semantic learning, characterized in that, Includes the following steps: S1: Collect historical failure cases. Each historical failure case includes the original log text generated when the failure occurred and a description of the root cause of the failure annotated afterward. S2: Perform variable desensitization and message template generalization on the original log text to extract the log template. Construct a multi-level index path based on the category attributes of the log template. Based on the semantic content of the root cause description, filter out the fault characterization statements that are causally related to the root cause from the log template. S3: Convert the fault characterization statement into a semantic feature vector, and associate and store the semantic feature vector with the corresponding multi-level index path and the log template to form a historical fault semantic feature library; S4: Obtain the current fault log to be located, perform variable desensitization and message template generalization on the current fault log to extract its log template and determine its index path, and then convert the log template of the current fault log into the current semantic feature vector. S5: Calculate the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library, and select the root cause description corresponding to the historical fault case with the highest similarity as the output of the current fault location result.

2. The automatic fault location method based on historical fault semantic learning according to claim 1, characterized in that, The construction of the multi-level index path specifically includes: Extract the device type identifier and log mnemonic identifier from the fixed header of the log template; Set the device type identifier as the first-level index and the log mnemonic identifier as the second-level index; Calculate the hash sum of all nonvariable strings in the log template, set the hash sum as the third-level index, and mount it under the second-level index.

3. The automatic fault location method based on historical fault semantic learning according to claim 1, characterized in that, The step of filtering out fault description statements from the log template that are causally related to the root cause specifically includes: The root cause description is broken down into multiple causal links, each of which contains the triggering action and the object affected. Extract the predicate verb-object structure from the log template one by one and compare it semantically with the triggering action in the causal chain; Log templates with consistent semantic matching are selected as fault characterization statements, while log templates that do not match any causal chain are removed.

4. The automatic fault location method based on historical fault semantic learning according to claim 1, characterized in that, S3 specifically includes: The fault description statement is divided into multiple minimal semantic segments according to punctuation, and each segment retains the subject and predicate; For each segment, calculate its fixed-length binary hash fingerprint, and sum the binary hash fingerprints of all segments bit by bit to generate an aggregated feature vector; The aggregated feature vector, the end node value of the multi-level index path, and the original compressed string of the log template are written together into a storage record, and the full path string of the multi-level index path is used as the retrieval key of the corresponding record.

5. The automatic fault localization method based on historical fault semantic learning according to claim 4, characterized in that, The process of generating the aggregated feature vector is as follows: Apply a set of independent hash maps to each minimal semantic fragment, and output a binary string of a specified length for each fragment; Based on the order in which each segment appears in the original fault characterization statement, each bit in the corresponding binary string is assigned a decay weight that decreases sequentially. Multiply the values ​​at the same position in all binary strings by their respective decay weights and sum them up to obtain the aggregated integer value at the corresponding position; All aggregated integer values ​​are concatenated in positional order to form an aggregated feature vector.

6. The automatic fault localization method based on historical fault semantic learning according to claim 1, characterized in that, The step of converting the current fault log template into the current semantic feature vector specifically includes: Extract fixed-length device code segments and mnemonic code segments sequentially from the header of the current fault log template, and use them as the first-level index and the second-level index, respectively. Concatenate all constant characters in the log template except for variable placeholders in order, and calculate the length of the concatenated string and take the modulo value as the third-level index. Each character in the concatenated string is converted into a binary value, and the binary values ​​are accumulated in character order and then divided by the length of the concatenated string to generate a fixed-length array as the current semantic feature vector.

7. The automatic fault localization method based on historical fault semantic learning according to claim 6, characterized in that, The calculation of the modulo value of the length of the concatenated string specifically includes: Extract the standard stroke count of each constant character in the concatenated string one by one, and sum all the stroke counts to obtain the stroke count sum; After converting the accumulated stroke value into a binary bit string, the lowest two bits are truncated to obtain an offset between 0 and 3; The prime number at the corresponding position is taken from a pre-stored sequence of five prime numbers based on the offset and used as the dynamic modulus; Calculate the remainder after dividing the length of the concatenated string by the dynamic modulus, and use the remainder as the third-level index.

8. The automatic fault location method based on historical fault semantic learning according to claim 1, characterized in that, S5 specifically includes: The current semantic feature vector is split into a positive and negative sign sequence and a numerical sequence, and only candidate vectors whose sign sequence is exactly the same as any vector sign sequence in the historical fault semantic feature library are retained. For each candidate vector's numerical sequence and the current numerical sequence, calculate the absolute value of the difference bit by bit, sum all the absolute values ​​of the bit differences, and take the reciprocal as the initial matching value; Extract the length value of the log template corresponding to each candidate vector, use the logarithm of the corresponding length value as an adjustment coefficient, and multiply it with the preliminary matching value to obtain the final matching value; The root cause description associated with the candidate vector with the largest final matching value is selected as the output of the current fault location result.

9. An automatic fault location system based on historical fault semantic learning, characterized in that, A method for automatically locating faults based on historical fault semantic learning as described in any one of claims 1-8, comprising: The historical case collection module is used to collect historical failure cases. Each historical failure case includes the original log text generated when the failure occurred and a description of the root cause of the failure annotated afterward. The log template and index building module performs variable desensitization and message template generalization on the original log text to extract the log template. It builds a multi-level index path based on the category attributes of the log template and filters out fault characterization statements that are causally related to the root cause from the log template based on the semantic content of the root cause description. The feature library module converts fault characterization statements into semantic feature vectors, and associates and stores the semantic feature vectors with the corresponding multi-level index paths and the log templates to form a historical fault semantic feature library. The current log transformation module is used to obtain the current fault log to be located, perform variable desensitization and message template generalization on the current fault log to extract its log template and determine its index path, and then convert the log template of the current fault log into the current semantic feature vector. The matching and localization output module is used to calculate the similarity between the current semantic feature vector and each semantic feature vector in the historical fault semantic feature library, and selects the root cause description corresponding to the historical fault case with the highest similarity as the localization result of the current fault.

Images