Fault detection method and computing device

Abstract

Embodiments of the present application provide a fault detection method and a computing device. The method comprises: collecting monitoring information of each monitoring item at different time instants at a plurality of monitoring points respectively; performing correlation analysis on the plurality of monitoring items in the time dimension and the space dimension based on the monitoring information to obtain a space-time feature of each monitoring item; and performing fault detection on each monitoring item based on the space-time feature. By comprehensively considering the correlation between the time dimension and the space dimension of each monitoring item at each monitoring point, the fault detection accuracy can be improved.

Description

Technical Field

[0001] This application relates to the field of operation and maintenance technology, and in particular to a fault detection method and computing device. Background Technology

[0002] With the rapid development of information technology, enterprise networks are constantly expanding in scale, becoming increasingly complex in architecture, with a surge in the number of network devices and continuous growth in network traffic. Against this backdrop, network operations and maintenance (O&M) face enormous challenges. How to quickly and accurately detect network faults and pinpoint their root causes has become a critical issue that urgently needs to be addressed in the field of network O&M. Summary of the Invention

[0003] This application provides a fault detection method and computing device, which can improve the accuracy of fault detection by comprehensively considering the correlation between the time and space dimensions of each monitoring point and each monitoring item.

[0004] To achieve the above objectives, the embodiments of this application adopt the following technical solutions: In a first aspect, embodiments of this application provide a fault detection method, which includes: collecting monitoring information of each monitoring item at different times under multiple monitoring points; performing time and space dimension correlation analysis on the multiple monitoring items based on the monitoring information to obtain the spatiotemporal characteristics of each monitoring item; and performing fault detection on each monitoring item based on the spatiotemporal characteristics.

[0005] Based on this solution, firstly, by collecting monitoring information from multiple monitoring points at different times, we can obtain multi-source and multi-dimensional raw data, providing more comprehensive information for subsequent analysis. Secondly, by performing correlation analysis on multiple monitoring items in both time and space dimensions, we can obtain the spatiotemporal characteristics of each monitoring item. This allows us to simultaneously capture the changing patterns of the same monitoring item over time and the propagation dependencies of faults between different monitoring items, overcoming the shortcomings of traditional methods that only analyze single indicators or ignore spatial characteristics. Finally, by performing fault detection based on spatiotemporal characteristics, we can achieve accurate identification of network faults and improve the accuracy of fault detection.

[0006] In one possible implementation, based on monitoring information, a correlation analysis is performed on multiple monitoring items in both time and space dimensions to obtain the spatiotemporal characteristics of each monitoring item. This includes: generating a causal graph indicating the correlation between each monitoring item based on the monitoring information; wherein the nodes of the causal graph are the monitoring items under each monitoring point; extracting the time-series features corresponding to the nodes in the causal graph using a pre-defined time-series analysis network; determining the spatial features corresponding to each node based on the topology information in the monitoring information; and obtaining the spatiotemporal characteristics based on the causal graph, time-series features, and spatial features.

[0007] Based on this scheme, a causal graph is constructed to describe the relationship between monitoring projects, time-series features are extracted to capture dynamic change patterns in the time dimension, spatial features are extracted to aggregate neighbor dependency information in the spatial dimension, and spatiotemporal features are obtained by integrating the above information. This approach can comprehensively utilize multi-dimensional information to provide a feature representation that integrates causal dependency, temporal dynamics, and spatial propagation for subsequent fault detection.

[0008] In one possible implementation, a causal graph indicating the relationships between monitoring items is generated based on monitoring information, including: analyzing at least one of the following: the strength of the relationship between monitoring items, the linear relationship between monitoring items, and the nonlinear relationship between monitoring items, to obtain the monitoring item relationship analysis results; taking the monitoring items as nodes, and determining the edges between nodes and the weights corresponding to the edges based on the monitoring item relationship analysis results; and constructing the causal graph based on the nodes, edges, and the weights corresponding to the edges.

[0009] Based on this scheme, a directed weighted causal graph is constructed by integrating the multi-dimensional analysis results of attention mechanism, linear correlation coefficient and nonlinear mutual information. This graph can accurately capture the causal dependencies between monitored items and provide accurate and reliable input information for subsequent steps.

[0010] In one possible implementation, a pre-defined temporal analysis network is used to extract temporal features corresponding to nodes in the causal graph. This includes: selecting effective temporal nodes whose self-association strength meets the temporal screening criteria based on the self-association strength of each node in the causal graph; using the temporal analysis network to perform temporal modeling on the effective temporal nodes to obtain a temporal model, and extracting temporal change features and temporal statistical features from the temporal model; wherein, the temporal change features and temporal statistical features form the temporal features.

[0011] Based on this scheme, by using LSTM time series modeling and extracting time series change features and statistical features, the dynamic characteristics of each monitored project can be captured, providing a time-dimensional feature representation for subsequent spatiotemporal correlation analysis. Furthermore, by filtering effective time series nodes based on self-correlation strength, computational overhead can be reduced and computational efficiency improved.

[0012] In one possible implementation, the spatial features corresponding to each node are determined based on the topological information in the monitoring information, including: using a graph neural network to determine the network topology graph based on the topological information, and determining the neighboring monitoring points of each monitoring point in the network topology graph; based on the causal graph, determining the association between the monitoring point and the neighboring monitoring points, and determining the effective neighboring monitoring points whose association satisfies the neighboring monitoring point selection criteria; and using graph convolution operations to aggregate the monitoring information of the effective neighboring monitoring points to obtain the spatial features corresponding to the nodes in the causal graph.

[0013] Based on this scheme, by first constructing a physical network topology graph, then filtering effective neighbor monitoring points from the topology graph based on the causal graph, and finally performing graph convolution operation to achieve feature fusion, it can effectively filter out noise introduced by neighbor monitoring points without causal relationship while preserving the physical topology structure of the network, thereby extracting accurate spatial features and providing accurate spatial dimension information for spatiotemporal correlation analysis.

[0014] In one possible implementation, spatiotemporal features are obtained based on causal graphs, temporal features, and spatial features, including: determining the fault propagation path based on the causal graph; associating the fault propagation path with temporal features to obtain the temporal propagation path; associating the fault propagation path with spatial features to obtain the spatial propagation path; and determining the spatiotemporal propagation path based on the temporal propagation path and the spatial propagation path.

[0015] Based on this scheme, by extracting the fault propagation path from the causal graph, and respectively associating temporal and spatial features to obtain the temporal and spatial propagation paths, and finally merging them into a spatiotemporal propagation path, it is possible to depict the temporal propagation sequence and spatial diffusion trajectory of the fault, providing a clear and accurate propagation picture for fault root cause localization.

[0016] In one possible implementation, fault detection is performed on each monitoring item based on spatiotemporal characteristics, including: identifying abnormal nodes among the nodes based on spatiotemporal characteristics; identifying nodes that have a causal relationship with the abnormal nodes based on the cause-effect graph; taking the abnormal nodes and the nodes that have a causal relationship with the abnormal nodes as first suspected root cause nodes, and calculating the first influence score of each first suspected root cause node on other nodes; and identifying the fault root cause node among the first suspected root cause nodes based on the first influence score.

[0017] Based on this solution, from the perspective of monitoring projects, abnormal nodes are identified based on spatiotemporal characteristics, the first suspected root cause node is obtained by tracing back using a causal graph, and the root cause node of the fault is located based on the node influence score of each first suspected root cause node. This can efficiently and accurately locate the root cause of the fault from a complex causal network.

[0018] In one possible implementation, fault detection for each monitoring item based on spatiotemporal features further includes: reconstructing the spatiotemporal features to obtain reconstructed features, and determining whether a monitoring point is abnormal based on the spatiotemporal features and the reconstructed features; for abnormal monitoring points, tracing back along the edges of the causal graph to the second suspected root cause node directly or indirectly pointing to the node under the abnormal monitoring point; calculating the second influence score of each second suspected root cause node on other nodes, and determining the reference root cause node among the second suspected root cause nodes based on the second influence score; and verifying the first fault root cause node based on the reference root cause node.

[0019] Based on this scheme, from the perspective of monitoring points, error detection abnormal nodes are reconstructed, suspected root cause nodes are traced back along the cause-effect graph, and importance analysis is calculated to further accurately locate the root cause node of the fault. This can verify the root cause location results and improve the reliability of fault detection.

[0020] In one possible implementation, after identifying the root cause node in the first suspected root cause node, the method further includes: determining, based on the cause-effect graph, secondary faults caused by the fault triggered by the root cause node during propagation, and disabling alarm triggers for the secondary faults.

[0021] Based on this solution, using cause-effect graphs to distinguish between primary and secondary faults can improve the accuracy of fault analysis; disabling alarm triggers for secondary faults can effectively solve the alarm storm problem caused by fault cascading effects and reduce the alarm handling burden on maintenance personnel.

[0022] In one possible implementation, after collecting monitoring information of each monitoring item at different times under multiple monitoring points, the method further includes: for each monitoring point, encoding the monitoring information of each monitoring item at each time into a vector format, and fusing the monitoring information in vector format corresponding to multiple monitoring items to obtain the fused monitoring information.

[0023] Based on this scheme, multi-dimensional feature encoding and fusion can transform heterogeneous data from multiple sources into a unified feature representation, providing high-quality input data for subsequent fault detection and root cause analysis. Furthermore, by employing various encoding methods (normalization, time encoding, logarithmic transformation, differential encoding, binarization, cumulative encoding, percentage encoding, etc.), the original features of the data can be preserved, improving the accuracy and effectiveness of feature representation.

[0024] In one possible implementation, monitoring information in vector format corresponding to multiple monitoring items is fused to obtain fused monitoring information, including: concatenating monitoring information in vector format corresponding to multiple monitoring items to obtain a concatenated vector; performing a linear transformation on the concatenated vector to map the concatenated vector to the target dimension, and using it as the fused monitoring information.

[0025] Based on this scheme, the dimensional fusion of multi-source monitoring information is achieved through vector concatenation, and the features are then mapped to a unified target dimension through linear transformation. This improves the dimensionality and quality of feature representation, providing a dimensionally consistent and information-complete fused feature representation for subsequent spatiotemporal correlation analysis, thereby improving system performance.

[0026] Secondly, embodiments of this application also provide a fault detection system, which includes: a data acquisition module for acquiring monitoring information of each monitoring item at different times under multiple monitoring points; a fault detection module for performing time and space-dimensional correlation analysis on multiple monitoring items based on the monitoring information to obtain the spatiotemporal characteristics of each monitoring item; and for performing fault detection on each monitoring item based on the spatiotemporal characteristics.

[0027] In one possible implementation, the fault detection module is used to: generate a causal graph indicating the correlation between each monitoring item based on monitoring information; wherein the nodes of the causal graph are the monitoring items under each monitoring point; extract the temporal features corresponding to the nodes in the causal graph using a preset temporal analysis network; determine the spatial features corresponding to each node based on the topology information in the monitoring information; and obtain the spatiotemporal features based on the causal graph, temporal features, and spatial features.

[0028] In one possible implementation, the fault detection module is used to: analyze at least one of the following: the correlation strength between monitoring items, the linear correlation between monitoring items, and the nonlinear correlation between monitoring items, to obtain the correlation analysis results of monitoring items; take the monitoring items as nodes, and determine the edges between nodes and the weights corresponding to the edges based on the correlation analysis results of monitoring items; and construct a causal graph based on the nodes, edges, and the weights corresponding to the edges.

[0029] In one possible implementation, the fault detection module is used to: select time-series valid nodes whose self-association strength meets the time-series screening conditions based on the self-association strength of each node in the causal graph; use a time-series analysis network to perform time-series modeling on the time-series valid nodes to obtain a time-series model, and extract time-series change features and time-series statistical features from the time-series model; wherein, the time-series change features and time-series statistical features form time-series features.

[0030] In one possible implementation, the fault detection module is used to: use a graph neural network to determine the network topology graph based on topology information, and determine the neighbor monitoring points of each monitoring point in the network topology graph; based on the causal graph, determine the association between the monitoring point and the neighbor monitoring points, and determine the effective neighbor monitoring points whose association meets the neighbor monitoring point screening conditions; and use graph convolution operation to aggregate the monitoring information of the effective neighbor monitoring points to obtain the spatial features corresponding to the nodes in the causal graph.

[0031] In one possible implementation, the fault detection module is used to: determine the fault propagation path based on the cause-effect graph; associate the fault propagation path with temporal features to obtain the temporal propagation path; associate the fault propagation path with spatial features to obtain the spatial propagation path; and determine the spatiotemporal propagation path based on the temporal and spatial propagation paths.

[0032] In one possible implementation, the fault detection module is used to: identify abnormal nodes among the nodes based on spatiotemporal characteristics; identify nodes that have a causal relationship with the abnormal nodes based on the causal graph; take the abnormal nodes and the nodes that have a causal relationship with the abnormal nodes as first suspected root cause nodes, and calculate the first influence score of each first suspected root cause node on other nodes; and identify the fault root cause node among the first suspected root cause nodes based on the first influence score.

[0033] In one possible implementation, the fault detection module is used to: reconstruct the spatiotemporal features to obtain reconstructed features, and determine whether the monitoring point is abnormal based on the spatiotemporal features and the reconstructed features; for abnormal monitoring points, trace back along the edges of the causal graph to the second suspected root cause node directly or indirectly pointing to the node under the abnormal monitoring point; calculate the second influence score of each second suspected root cause node on other nodes, and determine the reference root cause node among the second suspected root cause nodes based on the second influence score; and verify the fault root cause node based on the reference root cause node.

[0034] In one possible implementation, the fault detection module is used to: determine, based on the cause-effect graph, the secondary faults caused by the fault at the root node during the propagation process, and disable alarm triggers for the secondary faults.

[0035] In one possible implementation, the system also includes a data preprocessing module, which is used to: encode the monitoring information of each monitoring item at each time point into a vector format for each monitoring point, and fuse the monitoring information in vector format corresponding to multiple monitoring items to obtain the fused monitoring information.

[0036] In one possible implementation, the data preprocessing module is used to: concatenate monitoring information in vector format corresponding to multiple monitoring items to obtain a concatenated vector; perform a linear transformation on the concatenated vector to map the concatenated vector to the target dimension, and use it as the fused monitoring information.

[0037] Thirdly, embodiments of this application also provide a computing device, including: a processor and a memory; the processor and the memory are coupled; the memory is used to store program instructions; the processor is used to execute the program instructions to perform the method as described in any of the first aspects above.

[0038] Fourthly, embodiments of this application provide a chip for performing the methods described in any of the first aspects above.

[0039] Fifthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a computer, implement the method as described in any of the first aspects.

[0040] In a sixth aspect, embodiments of this application provide a program product including a computer program that, when executed by a processor, implements the method as described in any of the first aspects.

[0041] It is understood that the beneficial effects that the technical solutions provided in the second to sixth aspects above can achieve can be referred to the beneficial effects in the first aspect and any of its implementation methods, and will not be repeated here. Attached Figure Description

[0042] Figure 1 This is a schematic diagram illustrating an application scenario of a fault detection method and system provided in an embodiment of this application; Figure 2 This is a flowchart of a fault detection method provided in an embodiment of this application; Figure 3 This is a schematic diagram of monitoring information collection and preprocessing provided in an embodiment of this application; Figure 4 This is a flowchart illustrating the encoding and fusion of monitoring information provided in an embodiment of this application; Figure 5 This is a flowchart illustrating the fusion of monitoring information provided in an embodiment of this application; Figure 6 This is a flowchart of a spatiotemporal correlation analysis provided in an embodiment of this application; Figure 7 This is a schematic diagram illustrating a time analysis, spatial analysis, and spatiotemporal analysis provided in an embodiment of this application; Figure 8 This is a flowchart of constructing a cause-effect graph provided in an embodiment of this application; Figure 9 This is a flowchart of a timing analysis provided in an embodiment of this application; Figure 10 This is a flowchart of a spatial analysis provided in an embodiment of this application; Figure 11 This is a flowchart of a spatiotemporal analysis provided in an embodiment of this application; Figure 12 This is a flowchart illustrating fault detection based on spatiotemporal features, provided in an embodiment of this application. Figure 13 This is a schematic diagram illustrating a fault detection and subsequent analysis provided in an embodiment of this application; Figure 14 This is a flowchart of a fault detection result verification method provided in an embodiment of this application; Figure 15 This is a flowchart of a secondary fault denoising method provided in an embodiment of this application; Figure 16 This is a schematic diagram illustrating the output and utilization of fault detection results provided in an embodiment of this application; Figure 17 This is a system architecture diagram of a fault detection system provided in an embodiment of this application; Figure 18 This is a schematic diagram of a fault detection system provided in an embodiment of this application; Figure 19 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. To facilitate a clear description of the technical solutions of the embodiments of this application, the use of terms such as "first," "second," etc., in the embodiments of this application is for illustrative purposes and to distinguish the objects being described. There is no particular order between them, nor does it indicate a specific limitation on the number of devices in the embodiments of this application, and they do not constitute any limitation on the embodiments of this application.

[0044] The following explanations of the technical terms mentioned in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0045] Root cause node: In a complex system, the initial and most fundamental source of failure that leads to an anomaly or malfunction.

[0046] Cause-effect graph: A graphical structure used to analyze the logical relationship between input and output or to trace the root cause of a problem.

[0047] Pearson correlation coefficient: A core indicator in statistics used to measure the degree of linear correlation between two variables. Its value ranges from -1 to 1, and the larger the absolute value, the stronger the linear relationship.

[0048] Mutual information: a core indicator used to measure the degree of interdependence between two random variables.

[0049] PageRank algorithm: A ranking algorithm commonly used in search engines, which evaluates the ranking of web pages based on the link relationships between them.

[0050] The application scenarios of this application will be explained below.

[0051] As enterprise networks continue to expand and their architectures become increasingly complex, the number of network devices is surging, leading to complex temporal dependencies and spatial propagation relationships between different monitoring points and projects. Traditional fault detection methods struggle to accurately analyze the correlations between multiple indicators, resulting in low fault detection accuracy.

[0052] This application provides a fault detection method, a fault detection system, and a computing device, which can improve the accuracy of fault detection by comprehensively considering the temporal and spatial relationships between various monitoring points and monitoring items, thereby solving the above-mentioned problems.

[0053] Specifically, the following is combined with Figure 1 and Figure 2 The application scenarios and algorithm logic of the embodiments of this application are illustrated by way of example.

[0054] Figure 1 This is a schematic diagram illustrating an application scenario of a fault detection method and system provided in an embodiment of this application.

[0055] Figure 2 This is a flowchart illustrating a fault detection method provided in an embodiment of this application.

[0056] like Figure 1 As shown, a core switch 100 and a server 200 are configured in the data center network environment, with several virtual machines 210 deployed on the server 200. A fault detection system proposed in this embodiment is deployed in the data center network environment. This fault detection system can be deployed on a single computing device or distributed across multiple computing devices. The computing devices can be servers, such as rack servers, AI servers, or full-rack servers, or workstations or terminal devices. Figure 1 In this system, the fault detection system can be distributed across the network management server 400, the data processing server 500, and the AI ​​inference server 600.

[0057] Please see Figure 2 During the fault detection process, the data acquisition module of the fault detection system can execute step S11: collect monitoring information of each monitoring item at each monitoring point at different times. For example... Figure 1 The network management server 400 can collect monitoring information of each monitoring item at different times under each monitoring point in the data center network environment. For example, it can collect monitoring information such as traffic data, latency indicators, packet loss rate and network topology information of core switch 100, server 200 and virtual machine 210, and send the collected monitoring information to data processing server 500.

[0058] In some examples, after step S11 and before step S12, the data processing server 500 can perform preprocessing operations such as data cleaning, format unification, time alignment, and feature extraction on the monitoring information collected by the network management server 400 to obtain structured data, and then send this structured data to the AI ​​inference server 600 as input for step S12. This processing step is in... Figure 2 It is not shown separately in the text.

[0059] In other examples, the network management server 400 may also directly send the collected monitoring information to the AI ​​inference server 600 as input for step S12.

[0060] Please see Figure 2 During the fault detection process, the fault detection module of the fault detection system can execute step S12: based on monitoring information (or the aforementioned structured data), perform correlation analysis on multiple monitoring items in terms of time and space dimensions to obtain the spatiotemporal characteristics of each monitoring item; and step S13: based on the spatiotemporal characteristics, perform fault detection on each monitoring item.

[0061] like Figure 1 The AI ​​inference server 600 can perform temporal and spatial correlation analysis on structured data. Specifically, this includes encoding and fusing structured data, performing correlation analysis, time-series analysis, spatial analysis, and spatiotemporal analysis on multiple monitoring items, ultimately pinpointing the fault location. For example, if structured data detects a network latency increase from the normal 2ms to over 15ms and a packet loss rate increase from 0.01% to over 0.5%, a network fault can be identified. Correlation analysis of multiple monitoring items reveals a strong positive correlation between server network card traffic and virtual machine network traffic. Time-series analysis shows that server network card traffic suddenly drops to 0 at 3:20 PM, identifying 3:20 as the abrupt change point. Combining the aforementioned analysis results with spatial analysis, and further combining the time and spatial analysis results for spatiotemporal correlation analysis, the abnormal monitoring item is determined to be a server network-related monitoring item, and the root cause of the fault is located to the server network card. At this point, the AI ​​inference server 600 can further analyze the fault type and generate handling suggestions, which are then sent to the network management server 400.

[0062] In this way, the network management server 400 can perform corresponding operations based on the processing suggestions generated by the AI ​​inference server 600, such as replacing the faulty port of the core switch or switching to a spare port.

[0063] It should be noted that the embodiments of this application only take the above application scenarios as examples, which does not mean that the methods proposed in the embodiments of this application can only be applied to the above application scenarios.

[0064] The following is combined Figures 3 to 12 The following describes steps S11-S13 in the embodiment of the fault detection method: S11: Collect monitoring information of each monitoring item at multiple monitoring points at different times.

[0065] In step S11, multiple monitoring points are pre-set according to actual detection needs. These monitoring points can be physical devices (such as core switches, servers, etc.) or virtual devices (such as virtual machines, virtual switches, etc.). Some devices can be selected as monitoring points without covering all devices. Subsequently, several monitoring items can be configured for each monitoring point. In this way, the data acquisition module of the fault detection system can collect monitoring information of each monitoring item at different times through network protocols and interfaces, thereby providing raw data input for subsequent steps.

[0066] The following is combined Figure 3 This example illustrates the collection of monitoring information.

[0067] Figure 3 This is a schematic diagram of monitoring information collection and preprocessing provided in an embodiment of this application.

[0068] Please combine Figure 3 In some examples, monitoring items may include performance monitoring items, which can collect relevant monitoring information through protocols such as SNMP (Simple Network Management Protocol), NetFlow, sFlow, Telemetry, ICMP ping, etc.

[0069] Performance monitoring items may include, but are not limited to, specific items such as traffic metrics, latency metrics, packet loss metrics, CPU utilization, and error rate. Traffic metrics may specifically correspond to monitoring information such as inbound traffic, outbound traffic, peak traffic, average traffic, traffic variance, and traffic trend; latency metrics may specifically correspond to monitoring information such as latency, jitter, and latency distribution (P50, P75, P90, P95, P99); packet loss metrics may specifically correspond to monitoring information such as the number of lost packets, packet loss rate, packet loss pattern, and number of packet loss bursts; CPU utilization may specifically correspond to monitoring information such as CPU utilization, 5-second average, 1-minute average, and 5-minute average; and error rate may specifically correspond to monitoring information such as error rate, number of cyclic redundancy check (CRC) errors, number of frame errors, and number of overflow errors.

[0070] In some examples, monitoring items may include basic device information, and the corresponding monitoring information can be collected via SNMP or SSH protocols. For example, SNMP can be used to obtain information such as device description, device name, device location, and device contact person; SSH can be used to obtain system information, hostname, device list, and other information.

[0071] The basic equipment information items may include, but are not limited to, specific items such as equipment information, equipment type, equipment manufacturer, equipment model, and physical location. Specifically, equipment information may correspond to monitoring information such as equipment ID, equipment name, and equipment description; equipment type may correspond to monitoring information such as equipment type identifiers, such as routers, core switches, aggregation switches, access switches, and servers; equipment manufacturer may correspond to monitoring information such as equipment manufacturer identifiers, for example, several mainstream network equipment manufacturers; equipment model may correspond to monitoring information such as equipment model identifiers; and physical location may correspond to monitoring information such as data centers, racks, cabinets, and units.

[0072] In some examples, monitoring items may include network topology items, and the corresponding monitoring information can be collected through LLDP (Link Layer Discovery Protocol) and CDP (Cisco Discovery Protocol) protocols.

[0073] The network topology project may include, but is not limited to, specific items such as topology hierarchy, connected device list, adjacent monitoring points, and topology distance matrix. The topology hierarchy can specifically correspond to topology hierarchy identifier monitoring information, such as core layer, aggregation layer, access layer, and terminal layer; the connected device list can specifically correspond to monitoring information such as device ID, interface ID, connection type, and bandwidth; the adjacent monitoring point list can specifically correspond to monitoring information such as neighbor device ID list and neighbor interface ID list; and the topology distance matrix can specifically correspond to monitoring information such as the topology distance between each monitoring point.

[0074] In some examples, the monitoring items may include basic information about the monitoring points, and the corresponding monitoring information can be collected via SNMP or SSH protocols.

[0075] The basic information items for monitoring points may include, but are not limited to, specific items such as monitoring point information, port type, port speed, port description and address, and network layer configuration parameters. Specifically, monitoring point information may correspond to monitoring information such as monitoring point ID, device ID, and interface ID; port type may correspond to port description and MAC address, and network layer configuration parameters such as uplink port, downlink port, and management port; port speed may correspond to port speed values ​​such as 1Gbps, 10Gbps, 40Gbps, and 100Gbps; port description and address may correspond to port description, MAC address, and IP address; and network layer configuration parameters may correspond to subnet mask, VLAN ID, MTU, and duplex mode.

[0076] It should be noted that the monitoring items and information described above are merely illustrative examples, and the embodiments of this application are not limited thereto. In practical applications, other types of monitoring items can be configured and corresponding monitoring information can be collected according to the specific network environment and fault detection requirements. For example, in a wireless network environment, monitoring information such as the channel utilization, signal-to-noise ratio, and number of connected users of the wireless AP can also be collected; in a storage network environment, monitoring information such as the throughput and latency of the storage device can also be collected.

[0077] In some examples, after the monitoring information is collected through step S11, the data preprocessing module of the fault detection system can also process the raw monitoring information collected by the data acquisition module, including but not limited to filtering noise and unifying the data format, so as to provide high-quality data input for subsequent steps.

[0078] Specifically, the data preprocessing module can clean the raw monitoring information, including but not limited to identifying and removing outliers and filling in missing values. For example, linear interpolation can be used to fill in missing data to ensure data integrity and continuity. The data preprocessing module can also convert monitoring information from different sources and in different formats into a standardized format (such as JSON) and add a unified timestamp to each monitoring message to ensure data temporal consistency. Furthermore, considering that different monitoring information may be collected at different frequencies (e.g., traffic data is collected once per second, CPU utilization data is collected once every 5 seconds), the data preprocessing module can align monitoring information with different collection frequencies to a unified time granularity, ensuring that data at the same point in time can be correlated for analysis. Further, the data preprocessing module can extract statistical features from the raw monitoring information, including but not limited to traffic mean, variance, peak latency, jitter, and packet loss rate, as input for subsequent feature encoding steps.

[0079] It is understandable that the aforementioned monitoring information is usually multi-source and heterogeneous data. In some examples, this monitoring information can be uniformly encoded and processed through feature fusion before subsequent analysis. The following section will combine... Figure 3 and Figure 4 This needs to be explained.

[0080] Figure 4 This is a flowchart of a monitoring information encoding and fusion method provided in an embodiment of this application.

[0081] like Figure 4 As shown, in some implementations, step S11 may be followed by step S14: S14: For each monitoring point, the monitoring information of each monitoring item at each time moment is encoded into a vector format, and the monitoring information in vector format corresponding to multiple monitoring items is merged to obtain the merged monitoring information.

[0082] In step S14, before performing fault detection, the fault detection module of the fault detection system first encodes and fuses monitoring information. Specifically, the data preprocessing unit of the fault detection module encodes and fuses the monitoring information collected by the data acquisition module (or the monitoring information output by the data preprocessing module), converting multi-source heterogeneous data into a unified feature representation, providing high-quality input data for fault detection.

[0083] Please combine Figure 4 In some examples, the aforementioned performance monitoring items can be encoded as 128-dimensional vectors.

[0084] For the monitoring information corresponding to the traffic flow indicators, it can first be normalized to the [0,1] interval to eliminate the influence of different magnitudes. Then, time encoding can be used to add time-encoding features such as daily, weekly, and monthly cycles to capture the periodic changes in traffic flow. In some examples, through the aforementioned normalization and time encoding operations, a 64-dimensional traffic flow indicator feature vector X can be obtained. flow .

[0085] Specifically, for the monitoring information corresponding to the delay index, a logarithmic transformation can first be used to compress the dynamic range of the delay data, making the delay distribution more uniform. Then, differential encoding can be used to calculate first-order, second-order, and sliding window differences to capture the changing trends and fluctuation characteristics of the delay. In some examples, through the aforementioned logarithmic transformation and differential encoding operations, a 32-dimensional delay index feature vector X can be obtained. delay .

[0086] Specifically, for the monitoring information corresponding to the packet loss index, the packet loss data can first be binarized to distinguish between states with and without packet loss. Then, cumulative encoding can be used to calculate sliding window cumulative, exponentially weighted cumulative, and multi-scale cumulative, etc., to capture the cumulative effect and temporal characteristics of packet loss. In some examples, through the aforementioned binarization and cumulative encoding operations, a 16-dimensional packet loss index feature vector X can be obtained. loss .

[0087] For monitoring information related to CPU utilization, a percentage encoding method can be used to directly convert CPU utilization into a percentage value in the [0,1] range, preserving the physical meaning of the original data. In some examples, the aforementioned percentage encoding operation can yield an 8-dimensional CPU utilization feature vector X. cpu .

[0088] Specifically, for the monitoring information corresponding to the error rate, logarithmic transformation encoding can be used. This compression of the dynamic range of the error rate improves the model's sensitivity to small error rates. In some examples, the aforementioned logarithmic encoding operation yields an 8-dimensional error rate feature vector X. error .

[0089] In some examples, the aforementioned device information monitoring items can be encoded as a 36-dimensional vector.

[0090] Specifically, for monitoring information corresponding to device type, one-hot encoding can be used to encode the specific device type identifier (such as routers, core switches, aggregation switches, access switches, etc.) into a 4-dimensional vector. For monitoring information corresponding to device manufacturer, one-hot encoding can be used to encode the specific device manufacturer identifier into an 8-dimensional vector. For monitoring information corresponding to device model, hash encoding can be used to map the specific device model into a 16-dimensional vector. For monitoring information corresponding to physical location encoding, a combination of one-hot encoding and numerical encoding can be used; for example, data centers can be encoded as 4-dimensional vectors, and racks and cabinets can be encoded as 4-dimensional numerical vectors.

[0091] In some examples, the aforementioned topology information monitoring project can be encoded as a 40-dimensional vector.

[0092] For monitoring information corresponding to topology layers, one-hot encoding can be used to encode the topology layers (such as the core layer, aggregation layer, access layer, and terminal layer mentioned above) into a 4-dimensional vector. For monitoring information corresponding to the connected device list, the distribution of connected device types, connection types, and the number of connections can be statistically analyzed and encoded into a 16-dimensional vector. Specifically, the distribution of connected device types (such as routers, core switches, aggregation switches, access switches, servers, and other devices) can be encoded into a 6-dimensional vector, the distribution of connection types (such as direct connections, link aggregation, VLAN connections, routing connections, tunnel connections, and other connections) can be encoded into a 6-dimensional vector, and the number of connections (such as the total number of connected devices, the number of uplink connections, the number of downlink connections, and the number of peer connections) can be encoded into a 4-dimensional vector. For monitoring information corresponding to the topology distance matrix, the minimum, maximum, average, and standard deviation of the topology distance, as well as the 25th, 50th, 75th, and 90th quantiles of the distance distribution, can be calculated and encoded into an 8-dimensional vector. The monitoring information corresponding to the list of adjacent monitoring points can be encoded using statistical coding. This includes the number of adjacent monitoring points, the distribution type of adjacent monitoring points, and the distance distribution between adjacent monitoring points, encoded as a 12-dimensional vector. Specifically, the number of adjacent monitoring points (including the total number of adjacent monitoring points, the number of upstream adjacent monitoring points, the number of downstream adjacent monitoring points, and the number of peer adjacent monitoring points) can be encoded as a 4-dimensional vector. The distribution type of adjacent monitoring points (including the proportion of core layer monitoring points, the proportion of aggregation layer monitoring points, the proportion of access layer monitoring points, and the proportion of terminal layer monitoring points) can be encoded as a 4-dimensional vector. The distance between adjacent monitoring points (including the minimum topology distance, the maximum topology distance, the average topology distance, and the distance standard deviation) can be encoded as a 4-dimensional vector.

[0093] In some examples, the aforementioned monitoring point information items can be encoded as a 39-dimensional vector.

[0094] Specifically, for monitoring information corresponding to port types, one-hot encoding can be used to encode the port type (e.g., uplink port, downlink port, management port) into a 4-dimensional vector. For monitoring information corresponding to port speeds, one-hot encoding can be used to encode the port speed (e.g., 1Gbps, 10Gbps, 40Gbps, 100Gbps) into a 4-dimensional vector. For monitoring information corresponding to port statuses, one-hot encoding can be used to encode the port status (e.g., up, down, admin_down) into a 4-dimensional vector. For monitoring information corresponding to port descriptions, hash encoding can be used to map the port descriptions into an 8-dimensional vector. For monitoring information corresponding to MAC addresses, the MAC address can be converted to an integer, then divided into 8 parts, each encoded as a 6-bit value, normalized to the [0,1] interval, thus encoding an 8-dimensional vector. For monitoring information corresponding to IP addresses, numerical encoding can be used, normalizing the 4 bytes of the IP address to the [0,1] interval, thus encoding a 4-dimensional vector. For monitoring information corresponding to subnet masks, numerical encoding can be used to normalize the subnet mask to the [0,1] interval and encode it as a 1-dimensional vector. For monitoring information corresponding to VLAN IDs, numerical encoding can be used to normalize the VLAN ID to the [0,1] interval and encode it as a 1-dimensional vector. For monitoring information corresponding to MTUs, numerical encoding can be used to encode the current value and normalized value of the MTU into a 2-dimensional vector. For monitoring information corresponding to duplex modes, one-hot encoding can be used to encode the duplex mode (such as full-duplex, half-duplex, and auto-negotiation) into a 3-dimensional vector.

[0095] It should be noted that the above encoding methods and dimensions are merely illustrative examples, and the embodiments of this application are not limited thereto. In practical applications, the encoding methods and dimensions can be flexibly adjusted according to the specific characteristics and data distribution of the monitoring project. For example, when there are a large number of equipment manufacturers, the encoding dimensions corresponding to the equipment manufacturers can be expanded from 8 dimensions to 16 dimensions.

[0096] In this embodiment, step S14, through multi-dimensional feature encoding and fusion, transforms multi-source heterogeneous data into a unified feature representation, providing high-quality input data for subsequent fault detection and root cause analysis. Furthermore, by employing various encoding methods (normalization, time encoding, logarithmic transformation, differential encoding, binarization, cumulative encoding, percentage encoding, etc.), the original features of the data can be preserved, improving the accuracy and effectiveness of the feature representation.

[0097] The following is combined Figure 5 This will further explain the specific process of integrating monitoring information.

[0098] Figure 5 This is a flowchart of a fusion monitoring information provided in an embodiment of this application.

[0099] like Figure 5 As shown, in some implementations, step S14, "merging the monitoring information in vector format corresponding to multiple monitoring items to obtain the merged monitoring information," may also include the following steps S141-S142: S141: Combine monitoring information in vector format corresponding to multiple monitoring items to obtain a combined vector.

[0100] In step S141, for each monitoring point, the encoded feature vectors of various monitoring items are concatenated to form a concatenated vector. For example, the feature vectors can be concatenated end to end in sequence while keeping the dimension of each feature vector unchanged to form a high-dimensional concatenated vector.

[0101] For example, for the performance monitoring project in the previous example, the traffic metric feature vector X can be... flow Delay index eigenvector X delay Packet loss indicator feature vector X loss CPU utilization feature vector X cpu and error rate feature vector X error Concatenating these elements yields a 128-dimensional performance metric feature vector X. perf Similarly, a 36-dimensional device information feature vector X can be obtained by concatenation. device 40-dimensional topological information feature vector X topology and the 39-dimensional feature vector X of monitoring point information mp Then, the four feature vectors can be concatenated again to obtain a 243-dimensional concatenated vector Concat([X... perf X device X topology ,X mp This is to achieve dimensional fusion of monitoring information.

[0102] S142: Perform a linear transformation on the concatenated vector to map it to the target dimension and use it as the fused monitoring information.

[0103] In step S142, the concatenated vector is linearly transformed using a weight matrix to increase its dimension to the target dimension, resulting in a dimension-upgraded fused feature vector. The target dimension can be a power of 2, and it must be greater than or equal to the dimension of the concatenated vector. For example, for the aforementioned 243-dimensional concatenated vector, the target dimension could be 256 or 512, etc.

[0104] For example, the concatenated vector in the example of step S141 above can be linearly transformed using the following formula: X fused = Concat([Xperf X device X topology X mp ]) × W fuse + b fuse .

[0105] In the formula, X fused It is a fused feature vector mapped to the target dimension; W fuse It is a fusion weight matrix, which can be 243×256 dimensional; b fuse This is the fusion bias vector, which can be 256-dimensional. Through a linear transformation, the 243-dimensional concatenated vector can be mapped to 256 dimensions, ultimately outputting a 256-dimensional fusion feature vector. This fused monitoring information serves as input data for subsequent steps.

[0106] Furthermore, in some examples, if the dimension of the concatenated vector is a power of 2, then a linear transformation is no longer necessary. For instance, if the concatenated vector is 256-dimensional, the target dimension can be 512-dimensional, in which case a linear transformation can be used to map the concatenated vector to 512 dimensions; the target dimension can also be 256-dimensional, in which case a linear transformation is no longer necessary, and the 256-dimensional concatenated vector can be directly used as the fused monitoring information.

[0107] In this embodiment of the application, through steps S141-S142, the dimensional fusion of multi-source monitoring information is achieved by vector concatenation, and then the features are mapped to a unified target dimension by linear transformation. This can improve the dimensionality and quality of feature representation, providing a dimensionally consistent and information-complete fused feature representation for subsequent spatiotemporal correlation analysis, thereby improving system performance.

[0108] S12: Based on monitoring information, perform correlation analysis on multiple monitoring items in terms of time and space to obtain the spatiotemporal characteristics of each monitoring item.

[0109] In step S12, the fault detection module performs correlation analysis on the fused feature vector, such as capturing the causal relationship between each monitoring item, the dynamic change pattern in the time dimension, the neighbor dependency feature in the spatial dimension, and the spatiotemporal features formed after the fusion of the above multi-dimensional information.

[0110] The following is combined Figure 6 and Figure 7 This section further details the specific process of obtaining spatiotemporal features through correlation analysis of time and space dimensions.

[0111] Figure 6 This is a flowchart of a spatiotemporal correlation analysis provided in an embodiment of this application.

[0112] Figure 7This is a schematic diagram of time analysis, spatial analysis, and spatiotemporal analysis provided in an embodiment of this application.

[0113] like Figure 6 As shown, in some implementations, step S12 may further include the following steps S121-S124: S121: Based on the monitoring information, generate a cause-effect graph indicating the relationships between each monitoring item; wherein, the nodes of the cause-effect graph are the monitoring items under each monitoring point.

[0114] In step S121, the multi-index correlation analysis unit of the fault detection module receives the fused feature vector output from the preceding steps. By analyzing various relationships between monitoring items, it constructs a graph structure that reflects the causal dependencies between monitoring items. Specifically, the multi-index correlation analysis unit can determine whether there is a causal relationship between different monitoring items and the strength of the causal relationship from at least one of the dimensions such as correlation strength, linear correlation, and nonlinear correlation, and then construct a causal graph.

[0115] It should be noted that the nodes in the cause-effect graph are the monitoring items under each monitoring point. In other words, the nodes in this application refer to the representation of the monitoring items in the cause-effect graph. Each monitoring item (such as the traffic metric of a certain switch) corresponds to a unique node in the cause-effect graph.

[0116] The following is combined Figure 7 and Figure 8 This section further details the specific process of constructing a cause-effect graph.

[0117] Figure 8 This is a flowchart of constructing a causal graph provided in an embodiment of this application.

[0118] like Figure 8 As shown, in some implementations, step S121 may further include the following steps S1211-S1213: S1211: Analyze at least one of the following: the correlation strength between monitoring items, the linear correlation between monitoring items, and the nonlinear correlation between monitoring items, to obtain the correlation analysis results of monitoring items.

[0119] In step S1211, the multi-index correlation analysis unit can employ three different analysis methods to obtain the correlation strength, linear correlation degree, and nonlinear dependency relationship between monitored items, providing multi-dimensional judgment criteria for subsequent determination of causal edges. It should be noted that these three analysis methods can be used independently or in combination.

[0120] In some examples, the multi-index correlation analysis unit in the fault detection module can analyze one or more of the correlation strength, linear correlation, and nonlinear correlation between monitored items to obtain the corresponding correlation analysis results of monitored items.

[0121] For example, the multi-indicator correlation analysis unit can receive the 256-dimensional fused feature vector output from the aforementioned steps. This fused feature vector contains features from multiple dimensions, including performance indicators, basic equipment information, topology information, and basic monitoring point information. Based on this, the multi-indicator correlation analysis unit further performs in-depth correlation analysis on each monitoring item.

[0122] Please combine Figure 7 The multi-indicator correlation analysis unit can capture the correlations between different monitoring items through a multi-head attention mechanism, including but not limited to: temporal correlations, spatial correlations, and cross-item correlations. Temporal correlations refer to the correlation between the same monitoring item at different times, such as the correlation between current traffic and historical traffic. Spatial correlations refer to the correlation between different monitoring points at the same time, such as the correlation between traffic of the core switch and traffic of the aggregation switch. Cross-item correlations refer to the correlation between different monitoring items, such as the negative correlation between traffic and latency, and the positive correlation between packet loss rate and error rate.

[0123] Specifically, the 256-dimensional fused feature vector output from the aforementioned steps can be used as the input feature of the self-attention mechanism. For example, for n monitoring points, an input feature sequence X = [x1, x2, ..., x...] can be formed. n ], where xi represents the 256-dimensional fused feature vector of the i-th monitoring point. Thus, the input feature sequence X is a 256×n dimensional matrix. The attention weights can then be calculated using the following formula: Q = X × W q ; K = X × W k ; V = X × W v ; .

[0124] In the formula, W q W k W v : Learnable weight matrix; Q: Query vector; K: Key vector; V: Value vector; d k : Dimension of the key vector; softmax: Normalization function that ensures the sum of attention weights is 1.

[0125] To capture different types of relationships (such as time dependency, spatial dependency, or cross-project relationships), a multi-head attention mechanism can be used, employing multiple attention heads for parallel computation. Different attention heads can use different weight matrices, and the specific calculation formula is as follows: ; .

[0126] In the formula, h: the number of attention heads (e.g., 8 attention heads); Wo: the output weight matrix; Concat: concatenation operation.

[0127] In the attention matrix, each element represents the correlation strength between different monitored items, such as A[i,j]= This represents the attention weight of monitoring item i on monitoring item j, that is, the degree of influence of monitoring item i on monitoring item j.

[0128] Please combine Figure 7 The multi-indicator correlation analysis unit can analyze the linear correlation between monitoring items using the Pearson correlation coefficient. For example, for two monitoring items X and Y (where X and Y represent monitoring information or feature vectors of the two items at the same time or within the same time window, for example, X could be the traffic indicator feature vector of a switch, and Y could be the latency indicator feature vector of another server), the Pearson correlation coefficient can be calculated using the following formula: .

[0129] In the formula, Cov(X, Y): covariance of X and Y; , : Standard deviations of X and Y.

[0130] Thus, if the Pearson correlation coefficient ρ = 1, then monitoring item X and monitoring item Y can be considered to be perfectly positively correlated; if the Pearson correlation coefficient ρ = -1, then monitoring item X and monitoring item Y can be considered to be perfectly negatively correlated; if the Pearson correlation coefficient ρ = 0, then monitoring item X and monitoring item Y can be considered to be non-correlated.

[0131] Please combine Figure 7 Among them, the multi-indicator correlation analysis unit can analyze the nonlinear correlation between monitoring items through mutual information estimation, capturing complex correlations that Pearson correlation coefficient cannot detect. For example, for two monitoring items X and Y, mutual information can be estimated using the following formula: .

[0132] In the formula, p(x,y) is the joint probability distribution of X and Y; p(x) and p(y) are the marginal probability distributions of X and Y.

[0133] In actual calculations, the k-nearest neighbor estimation method or kernel density estimation method can be used to approximate the mutual information value.

[0134] S1212: Treat the monitored items as nodes, and determine the edges between nodes and their corresponding weights based on the association analysis results of the monitored items.

[0135] In step S1212, the multi-index correlation analysis unit can treat each monitored item as a node in the causal graph, and based on the monitoring item correlation analysis results obtained in step S1211 above (such as attention correlation strength, Pearson correlation coefficient, mutual information), determine whether there are edges between nodes, and assign corresponding weights to the existing edges.

[0136] In some examples, all monitoring items under all monitoring points can be treated as nodes to form a unified cause-effect graph, so as to capture the fault propagation path across monitoring points in subsequent steps.

[0137] For example, all monitored items under all monitoring points can be treated as nodes in a cause-effect graph, forming a node set V. Then, the edges between the nodes are determined according to the following formula, forming an edge set E: .

[0138] In the formula, (i,j): the directed edge from node i to node j; |A ij |: The absolute value of the element in the i-th row and j-th column of the attention weight matrix; Attention weight threshold: In some examples, the value can be 0.2, which can be adjusted according to the number of attention heads and the number of monitoring points, etc. The absolute value of the element in the i-th row and j-th column of the Pearson correlation coefficient; The Pearson correlation coefficient threshold, in some examples, can be set to 0.4. This can be adjusted based on the correlation between monitored items. The values ​​can be different; if the monitored items are highly correlated (e.g., latency-packet loss), then... Increase the value appropriately; if the correlation between monitored items is low (e.g., traffic-CPU), then Adjust the settings appropriately, and the correlation between monitored items can be judged based on historical experience; : Mutual information of the element in the i-th row and j-th column; The mutual information threshold, in some examples, can be set to 0.3. This can be adjusted based on the degree of non-linearity between monitored items. They can be different; for example, if the non-linearity between monitored items is low (such as traffic-latency), then... Adjust the value appropriately; if the nonlinearity between monitored items is high (such as traffic-CPU utilization), then... By appropriately increasing the value, the nonlinear strength between monitored items can be judged based on historical experience. In this way, only when the correlation analysis results of the above three types of monitored items all exceed their respective thresholds is a causal relationship considered to exist, thereby eliminating accidental spurious correlations and improving the credibility of the causal graph.

[0139] It should be noted that the above formula is only an example and can be flexibly adjusted according to specific needs in practical applications. For example, it can be based on... To determine whether edges exist between nodes, one could use only the attention weight matrix and attention weight threshold. Alternatively, one could perform a weighted summation of the three monitoring item correlation analysis results and compare it with a comprehensive threshold to determine whether edges exist between nodes.

[0140] After determining the edges between nodes, the weights of the edges can be determined according to the following formula, forming an edge weight set W: .

[0141] In the formula, The strength of the causal relationship between node i and node j; , , Weighting coefficients can be set according to business needs; Attention weights; The absolute value of the element in the i-th row and j-th column of the Pearson correlation coefficient; Mutual information.

[0142] S1213: Construct a causal graph based on nodes, edges, and their corresponding weights.

[0143] In step S1213, the node set V, edge set E, and edge weight set W are combined to form a directed weighted causal graph G=(V, E, W). In this way, each node in the causal graph represents a specific monitoring item (such as the traffic metric of a switch), each edge represents the influence relationship from cause to effect, and the weight of the edge reflects the intensity of the influence.

[0144] In this embodiment of the application, through steps S1211-S1213, a directed weighted causal graph is constructed by integrating the multi-dimensional analysis results of attention mechanism, linear correlation coefficient and nonlinear mutual information. This graph can accurately capture the causal dependencies between monitored items and provide accurate and reliable input information for subsequent steps.

[0145] S122: Using a pre-defined temporal analysis network, extract the temporal features corresponding to the nodes in the causal graph.

[0146] In step S122, the time-series dependency modeling unit of the fault detection module can perform location encoding on the time-series data formed by sorting the monitoring information (or fused feature vectors) of each node by time, thereby distinguishing data at different times. For example, for the time-series data formed by the core switch traffic data collected every second in the previous 120 seconds, a location encoding vector can be generated using sine and cosine functions and added to the time-series data. In this way, the time-series dependency modeling unit can analyze the time-series data with added location encoding, such as using a preset time-series analysis network, such as a long short-term memory (LSTM) network, to analyze the time-series data with added location encoding, capture the time-series change patterns of each monitoring item in the time dimension, and thus provide time-related feature representations for fault detection.

[0147] The following is combined Figure 7 and Figure 9 This section further details the specific process of time series analysis.

[0148] Figure 9 This is a flowchart of a timing analysis provided in an embodiment of this application.

[0149] like Figure 9 As shown, in some implementations, step S122 may further include the following steps S1221-S1222: S1221: Based on the strength of the self-association relationship between each node in the causal graph and itself, select the effective nodes in the time series whose self-association relationship strength meets the time series screening conditions.

[0150] Please combine Figure 7 In step S1221, considering that the number of nodes in the causal graph may be large, resulting in a large computational overhead, only some nodes in the causal graph can be modeled in a time series, thereby reducing the amount of computation and improving the efficiency of time series modeling.

[0151] It should be noted that during the construction of the cause-effect graph in the aforementioned steps, monitoring items with weak connections to other nodes (e.g., nodes that failed to form causal edges) were removed. Therefore, all nodes in the cause-effect graph have some degree of connection. Based on this, further node filtering can be performed according to the strength of the self-association relationship between each node in the cause-effect graph. The specific filtering formula is as follows: .

[0152] Where V: the set of nodes in the cause-effect graph; The set of nodes that need to be modeled in a time sequence; The strength of the causal relationship between node v and itself; : Autocorrelation strength threshold.

[0153] S1222: Using a time series analysis network, time series modeling is performed on the effective nodes of the time series to obtain a time series model, and time series change features and time series statistical features are extracted from the time series model.

[0154] In step S1222, the time series data of the selected effective time series nodes are input into the LSTM network to obtain a time series model that can fit the time series change pattern of the monitoring information. Then, the time series change features are extracted from the hidden state of the time series model.

[0155] The time-series variation characteristics may include, but are not limited to, trend characteristics (such as linear trend, polynomial trend, moving average, etc.), periodic characteristics (such as daily cycle, weekly cycle, monthly cycle, etc.), and volatility characteristics (such as volatility, volatility amplitude, volatility frequency, etc.). Time-series statistical characteristics include, but are not limited to, mean, variance, skewness, kurtosis, etc.

[0156] Among them, time-series change characteristics and time-series statistical characteristics form time-series characteristics, which provide time-dimensional input for subsequent operation steps.

[0157] Please combine Figure 7 In some examples, time-series data can be analyzed using mutation point detection algorithms (such as PELT, binary segmentation, and sliding window algorithms) to identify mutation points in monitoring information, such as points in time when network status changes significantly. In this way, mutation points can be used to help determine the time window in which a fault occurred.

[0158] This embodiment of the application, through steps S1221-S1222, uses LSTM time series modeling to extract time series change features and statistical features, which can capture the time series dynamic characteristics of each monitored item, providing a time-dimensional feature representation for subsequent spatiotemporal correlation analysis. Based on this, selecting effective time series nodes based on self-correlation strength can reduce computational overhead and improve computational efficiency.

[0159] S123: Based on the topology information in the monitoring information, determine the spatial characteristics corresponding to each node.

[0160] In step S123, the spatial positioning analysis unit of the fault detection module utilizes a graph neural network to capture the spatial relationships between different monitoring points based on the network topology information in the monitoring information and combined with a causal graph. This yields the spatial features of each monitoring item in the spatial dimension, providing a spatial feature representation for subsequent spatiotemporal correlation analysis. It should be noted that since the monitoring items themselves do not have a physical topology, spatial analysis can be based on the topology of the monitoring points. Furthermore, by mapping the spatial relationships between monitoring points and monitoring items, the spatial relationships of the monitoring points can be mapped to the monitoring item level. In some examples, the spatial positioning analysis unit can encode the spatial information of each monitoring point. For instance, by performing topological distance encoding, spatial location encoding, and topological hierarchy encoding, the network topology can be converted into a computable vector representation, providing a foundation for subsequent spatial analysis. Thus, the spatial positioning unit can determine spatial features based on the spatial information encoded vectors of the spatial topology information.

[0161] The following is combined Figure 7 and Figure 10 This will further introduce the specific process of spatial analysis.

[0162] Figure 10 This is a flowchart of a spatial analysis provided in an embodiment of this application.

[0163] like Figure 10 As shown, in some implementations, step S123 may further include the following steps S1231-S1233: S1231: Using a graph neural network, determine the network topology graph based on topology information, and determine the neighbor monitoring points of each monitoring point in the network topology graph.

[0164] In step S1231, the spatial positioning analysis unit of the fault detection module constructs a network topology graph using a graph neural network based on the collected network topology information. In this graph, nodes are monitoring points (such as switches, servers, virtual machines, etc.), and edges represent physical or logical connections between these monitoring points. Then, for each monitoring point in the network topology graph, its neighboring monitoring points are determined. These neighboring monitoring points refer to other monitoring points that have a physical link or logical connection with the current monitoring point. For example, the neighboring monitoring points of a core switch may include aggregation switches connected to the core switch.

[0165] S1232: Based on the cause-effect graph, determine the relationship between the monitoring point and the neighboring monitoring points, and identify the valid neighboring monitoring points whose relationship meets the neighboring monitoring point screening criteria.

[0166] In step S1232, for each monitoring point, it is determined whether there is a directed edge in the cause-effect graph between the monitoring items under that monitoring point and the monitoring items under neighboring monitoring points. If at least one directed edge exists, the neighboring monitoring point is determined as a valid neighbor monitoring point, and further aggregation operations are performed; otherwise, the neighboring monitoring point is determined as an invalid neighbor monitoring point, and no aggregation operation is performed. The specific filtering formula is as follows: .

[0167] Where V: the set of nodes in the cause-effect graph; E: The set of nodes that require spatial analysis; E: The set of edges in the causal graph. Furthermore, the nodes... The corresponding monitoring point is a node. The neighboring monitoring points of the corresponding monitoring point.

[0168] In this way, nodes that participate in at least one causal relationship in the causal graph can be selected. Therefore, by monitoring the causal relationships between projects, we can indirectly determine whether the spatial relationships between monitoring points are effective, thereby integrating the information from the causal graph into the topology graph.

[0169] S1233: Using graph convolution operations, the monitoring information of effective neighbor monitoring points is aggregated to obtain the spatial features corresponding to the nodes in the causal graph.

[0170] Please combine Figure 7 In step S1233, for each node (monitoring item) in the cause-effect graph, the effective neighbor monitoring points of its respective monitoring point are first found. Then, graph convolution operation is used to aggregate the fused feature vectors of all monitoring items under these neighbor monitoring points to obtain the spatial features of the monitoring item that incorporate the information of its surrounding neighbors. In this way, the spatial features can reflect the influence of the monitoring item on its spatial neighbors and can be used for spatiotemporal correlation analysis, determining fault propagation paths, etc.

[0171] The embodiments of this application, through steps S1231-S1233, first construct a physical network topology graph, then filter effective neighbor monitoring points from the topology graph based on the causal graph, and finally perform graph convolution operation to achieve feature fusion. This can effectively filter out noise introduced by neighbor monitoring points without causal relationship while preserving the physical topology structure of the network, thereby extracting accurate spatial features and providing accurate spatial dimension information for spatiotemporal correlation analysis.

[0172] S124: Spatiotemporal features are obtained based on causal graphs, temporal features, and spatial features.

[0173] In step S124, the spatial positioning analysis unit can combine time series information and spatial topology information (such as vectors obtained by spatial information encoding) to determine the fault propagation path, analyze how the fault propagates in the network, and obtain spatiotemporal features containing temporal and spatial correlations, thereby providing feature representations containing multi-dimensional content for subsequent fault detection.

[0174] This application embodiment, through steps S121-S124, constructs a causal graph to describe the relationship between monitoring projects, extracts temporal features to capture dynamic change patterns in the time dimension, extracts spatial features to aggregate neighbor dependency information in the spatial dimension, and integrates the above information to obtain spatiotemporal features. It can comprehensively utilize multi-dimensional information to provide a feature representation that integrates causal dependency, temporal dynamics, and spatial propagation for subsequent fault detection.

[0175] The following is combined Figure 7 and Figure 11 This will further introduce the specific process of spatiotemporal analysis.

[0176] Figure 11 This is a flowchart of a spatiotemporal analysis provided in an embodiment of this application.

[0177] like Figure 11 As shown, in some implementations, step S124 may further include the following steps S1241-S1244: S1241: Determine the fault propagation path based on cause-effect graph.

[0178] In step S1241, the set of abnormal nodes is first determined based on the cause-effect graph and time-series features. Then, starting from the abnormal points, the fault propagation path from the root cause node to each abnormal node is obtained based on the cause-effect graph. In addition, the path weight of the fault propagation path can be obtained based on the weight of the edge in the cause-effect graph.

[0179] S1242: Correlate the fault propagation path and timing characteristics to obtain the time propagation path.

[0180] In step S1242, based on the temporal characteristics of each node on the fault propagation path, the change point time of each abnormal node is extracted, and the time sequence of the fault propagation to each node is determined, thereby obtaining the time propagation path.

[0181] S1243: Correlate the fault propagation path and spatial characteristics to obtain the spatial propagation path.

[0182] In step S1243, the fault propagation path is mapped onto the network topology, and the path of fault spread in space, i.e., the spatial propagation path, is reconstructed by combining the spatial characteristics of each anomaly point.

[0183] S1244: Determine the spatiotemporal propagation path based on the temporal propagation path and the spatial propagation path.

[0184] In step S1244, combining the temporal propagation order and spatial propagation path, the most probable fault propagation path is analyzed from at least one candidate fault propagation path determined in step S1241. Simultaneously, other possible propagation paths are identified to understand the complete picture of fault propagation, ultimately obtaining the spatiotemporal propagation path. Furthermore, in determining the spatiotemporal propagation path, in addition to the temporal and spatial propagation paths, the path weight of the fault propagation path can also be considered. Thus, the higher the path weight, the more reliable the fault propagation path, allowing the most reliable fault propagation path to be analyzed from multiple candidate paths.

[0185] In the actual algorithm implementation, the spatial positioning analysis unit can output the following: spatial features (256 dimensions, containing spatial association information of monitoring points); spatial attention weights (n×n matrix, representing the spatial association strength between different monitoring points); spatiotemporal features (256 dimensions, containing spatiotemporal association information of monitoring points); spatiotemporal attention weights (dimension T×n×T×n, representing the spatiotemporal association strength between different monitoring points at different time points); fault propagation path (including the propagation order and time from the root cause node to other nodes); fault root cause location (the monitoring point where the fault root cause is located, the corresponding monitoring item, and the physical location).

[0186] The spatiotemporal attention weights can be calculated from the temporal attention weights and spatial attention weights. The spatial attention weights can be calculated using the following formula: .

[0187] Where D: topological distance matrix, representing the topological distance between monitoring points; dk: dimension of the key vector; softmax: normalization function, ensuring that the sum of attention weights is 1.

[0188] In this embodiment of the application, through steps S1241-S1244, the fault propagation path is extracted from the cause-effect graph, and the temporal and spatial propagation paths are obtained by associating temporal features and spatial features respectively. Finally, they are fused into a spatiotemporal propagation path, which can depict the temporal propagation sequence and spatial diffusion trajectory of the fault, providing a clear and accurate propagation picture for fault root cause localization.

[0189] S13: Based on spatiotemporal characteristics, perform fault detection on each monitoring item.

[0190] In step S13, the fault identification unit in the fault detection module performs fault identification based on the spatiotemporal features obtained from the spatiotemporal correlation analysis in the aforementioned steps, determines whether there are any abnormalities in each monitored item, identifies the specific type of fault, locates the fault location, and determines the severity of the fault.

[0191] The embodiments of this application, through steps S11-S13, obtain spatiotemporal features through data acquisition, feature fusion, causal graph construction, and temporal and spatial correlation analysis, and perform fault detection accordingly. This can comprehensively utilize the temporal dependencies and spatial propagation relationships in multi-source heterogeneous monitoring data to improve the accuracy of fault detection.

[0192] The following is combined Figure 12 and Figure 13 This section further introduces the specific process of fault detection based on spatiotemporal features.

[0193] Figure 12 This is a flowchart of a fault detection based on spatiotemporal features provided in an embodiment of this application.

[0194] Figure 13 This is a schematic diagram of a fault detection and subsequent analysis provided in an embodiment of this application.

[0195] like Figure 12 As shown, in some implementations, step S13 may further include the following steps S131-S133: S131: Identify abnormal nodes among the nodes based on spatiotemporal characteristics.

[0196] In step S131, the spatial positioning analysis unit determines whether each node is abnormal based on the spatiotemporal characteristics corresponding to each node in the causal graph. For example, whether the reconstruction error of the spatiotemporal characteristics reaches a preset threshold can be used to determine whether each node is abnormal, thereby identifying abnormal nodes.

[0197] S132: Based on the cause-effect graph, identify the nodes that have a causal relationship with the abnormal nodes.

[0198] In step S132, in the causal graph, starting from the abnormal node, trace back along the directed edges of the causal graph to determine the nodes that can be directly pointed to by a directed edge or indirectly pointed to by multiple directed edges. These nodes are nodes that have a causal relationship with the abnormal node.

[0199] S133: Take the abnormal node and the node that has a causal relationship with the abnormal node as the first suspected root cause node. Based on the influence of each first suspected root cause node on other nodes, determine the fault root cause node among the first suspected root cause nodes.

[0200] In step S133, anomalous nodes and nodes with causal relationships to anomalous nodes are designated as first suspected root cause nodes. For each first suspected root cause node, its influence on other nodes is analyzed. The higher the influence, the more upstream the first node is considered in the fault propagation path, and the more likely it is to be the root cause node that caused the fault. In some examples, the influence score of each node can be calculated based on the PageRank algorithm. The specific calculation formula is as follows: .

[0201] Where PR(v): PageRank value of node v; d: damping coefficient, which can be 0.85 in some examples; N: total number of nodes; The weight of edge (u, v), i.e. .

[0202] In this way, the node with the highest influence score can be identified as the root cause node of the fault. Then, based on the root cause node, the root cause of the fault can be determined, the corresponding root cause item can be output, and the monitoring point to which the root cause node belongs can be identified as an abnormal monitoring point. Based on the abnormal monitoring point, the physical location of the root cause can be determined.

[0203] This application embodiment, through steps S131-S133, from the perspective of monitoring projects, identifies abnormal nodes based on spatiotemporal features, uses causal graphs to trace back to obtain the first suspected root cause node, and locates the fault root cause node based on the node influence score of each first suspected root cause node. This can efficiently and accurately locate the root cause of the fault from a complex causal network.

[0204] After identifying the root cause of the fault, the fault detection module can also verify the accuracy of the root cause. The following section combines... Figure 13 and Figure 14 This section further details the specific process for verifying the accuracy of the root cause nodes of the fault.

[0205] Figure 14 This is a flowchart of a fault detection result verification provided in an embodiment of this application.

[0206] like Figure 14 As shown, in some implementations, step S13 may further include the following steps S134-S137: S134: Reconstruct the spatiotemporal features to obtain reconstructed features, and determine whether the monitoring point is abnormal based on the spatiotemporal features and the reconstructed features.

[0207] Please combine Figure 13In step S134, the fault identification unit uses an autoencoder to reconstruct the spatiotemporal features corresponding to each monitoring point, compresses the spatiotemporal features into a low-dimensional vector and then decodes and recovers them to obtain reconstructed features with the same dimension as the spatiotemporal features. Then, by comparing the difference between the spatiotemporal features and the reconstructed features, it can determine whether each monitoring point is abnormal.

[0208] For example, for each monitoring point, the reconstruction error between spatiotemporal features and reconstructed features can be used to determine whether the monitoring point is abnormal. The formula for calculating the reconstruction error is as follows: anomaly_score = .

[0209] Where, anomaly_score: reconstruction error; x: spatiotemporal feature; x': reconstruction feature; ||·||: L2 norm.

[0210] Thus, when the reconstruction error anomaly_score > threshold, the monitoring point is determined to be abnormal; otherwise, it is determined to be normal. Here, threshold is a pre-set reconstruction error threshold. In some examples, Threshold = mean reconstruction error of each monitoring point + k × standard deviation of reconstruction error of each monitoring point, where k is a multiplier, such as 2 or 3.

[0211] Please combine Figure 13 In some examples, to further improve the accuracy of monitoring point anomaly detection, the time-series abrupt change information output in step S122 can be combined to distinguish between normal fluctuations and abnormal faults, avoiding misjudging normal fluctuations as monitoring point anomalies. For example, if there is an abrupt change near a certain moment and the reconstruction error exceeds a threshold, it can be determined as an abnormal fault; if there is no abrupt change and the reconstruction error exceeds the threshold, it can be directly determined as normal fluctuation, or a comprehensive judgment can be made by combining historical data, etc.

[0212] Furthermore, it can further identify patterns of abnormal fluctuations. For example, periodic analysis can distinguish between periodic fluctuations and sudden failures; prediction errors can distinguish between predictable fluctuations and unpredictable failures; and range analysis can distinguish between controllable fluctuations and uncontrolled failures.

[0213] S135: For an anomaly monitoring point, trace back along the edges of the cause-effect graph to the second suspected root cause node that directly or indirectly points to the node under the anomaly monitoring point.

[0214] Please combine Figure 13The second suspected root cause node can be determined by combining the cause-effect graph. Specifically, in step S135, starting from the abnormal monitoring point, tracing back along the opposite direction of the directed edges in the cause-effect graph, the node that can be directly pointed to by a directed edge to a node under the abnormal monitoring point, or indirectly pointed to by multiple directed edges, is regarded as the second suspected root cause node. Here, the node under the abnormal monitoring point refers to the node corresponding to the monitored item under the abnormal monitoring in the cause-effect graph.

[0215] S136: Based on the influence of each second suspected root cause node on other nodes, determine the reference root cause node among the second suspected root cause nodes.

[0216] In step S136, for each second suspected root cause node, its influence on other nodes is analyzed. A higher influence indicates that the second node is positioned further upstream in the fault propagation path. In some examples, the influence score of each node can be calculated based on the PageRank algorithm, with the specific formula as follows: .

[0217] Where PR(v): PageRank value of node v; d: damping coefficient, which can be 0.85 in some examples; N: total number of nodes; The weight of edge (u, v), i.e. .

[0218] In this way, the node with the highest influence score can be identified as the reference root cause node, which can be used to verify the fault detection results obtained in the previous steps.

[0219] S137: Verify the fault root cause node based on the reference root cause node.

[0220] In step S137, the reference root cause node is compared with the fault root cause node determined in step S133: if they are the same, the verification is successful; if they are different, the fault detection can be performed again to determine the fault root cause node.

[0221] Please combine Figure 13 In some examples, the fault identification unit can also assess the severity of a fault based on spatiotemporal characteristics, thereby providing decision support for fault handling. For instance, it can comprehensively analyze one or more fault severity assessment indicators from dimensions such as the anomaly score of abnormal monitoring points, the number of abnormal monitoring points, the duration of anomalies, the magnitude of abnormal fluctuations, and the number of monitoring points affected by the fault. Weight coefficients are pre-assigned to each fault severity assessment indicator, and the indicators are weighted and summed based on these weight coefficients to obtain a fault severity score, which is then mapped to a fault severity level (e.g., minor, moderate, severe, urgent).

[0222] Thus, through the above steps, the fault identification unit can output information such as the set of abnormal monitoring points, abnormal fluctuation characteristics, fault root cause location, and fault severity. The set of abnormal monitoring points may include information such as the monitoring point ID, abnormal score, and abnormal indicator type for each abnormal monitoring point; the abnormal fluctuation characteristics may include information such as the abnormal start time, abnormal duration, abnormal fluctuation amplitude, and abnormal indicator type; the fault root cause location may include the fault root cause node, fault root cause item, and fault root cause physical location; and the fault severity may include information such as the fault severity score and fault severity level.

[0223] In this embodiment of the application, through steps S134-S137, from the perspective of monitoring points, abnormal nodes are detected based on reconstruction error, suspected root cause nodes are traced back along the cause-effect graph, and importance analysis is calculated to further accurately locate the root cause node of the fault. This can verify the root cause location results and improve the reliability of fault detection.

[0224] Please combine Figure 13 In some examples, after identifying the root cause node, the root cause analysis unit of the fault detection module can verify the accuracy of the root cause. For example, for the physical location of the root cause, a counterfactual reasoning method can be used to infer how the reasoning result would change if the physical location did not have a fault, thereby verifying whether the root cause location is accurate and outputting the root cause verification result.

[0225] The root cause verification can be quantified using the following formula: accuracy = ; recall = ; .

[0226] Where TP is the number of correctly detected root cause locations; FP is the number of falsely reported root cause locations; FN is the number of missed root cause locations; accuracy is the precision rate; and recall is the recall rate.

[0227] In this way, if ( The preset threshold can be set according to actual needs, such as 0.7 or 0.8. If the value is set to 0.7, the root cause of the fault can be determined to be correct. Otherwise, the root cause of the fault can be determined to be incorrect, and the root cause of the fault can be determined again.

[0228] It should be noted that the above example uses the verification of the root cause location of the fault as an example for illustration, and the embodiments of this application are not limited to this. In practical applications, other contents output by the fault identification unit can also be verified, such as using counterfactual reasoning methods to verify the accuracy of abnormal nodes, abnormal monitoring points, and abnormal indicator types.

[0229] Please combine Figure 14 In some examples, the root cause analysis unit can determine the type of the root cause of a failure (hereinafter referred to as the root cause type). For example, it can automatically match the root cause type based on a rule base set according to historical operation and maintenance experience, combined with information such as the spatiotemporal characteristics of abnormal nodes. The root cause type may include, but is not limited to, hardware failure, software failure, configuration error, and network congestion. Hardware failure may include device failure, port failure, link failure, etc.; software failure may include operating system failure, application failure, driver failure, etc.; configuration errors may include routing configuration errors, switching configuration errors, security configuration errors, etc.; network congestion may include insufficient bandwidth, traffic surges, uneven load, etc.

[0230] Please combine Figure 14 In some examples, the root cause analysis unit can combine the set of abnormal monitoring points, fault propagation paths, cause-effect graphs, network topology information, etc., to analyze the scope, degree and duration of the impact of the fault.

[0231] Please combine Figure 14 In some examples, the root cause analysis unit can generate troubleshooting suggestions based on the root cause and scope of the fault, providing decision support for operations and maintenance personnel. These suggestions may include, but are not limited to, hardware fault suggestions, software fault suggestions, configuration error suggestions, and network congestion suggestions. Hardware fault suggestions may include replacing faulty devices, replacing faulty ports, or replacing faulty links; software fault suggestions may include restarting the operating system, restarting applications, or updating drivers; configuration error suggestions may include correcting routing configurations, correcting switch configurations, or correcting security configurations; and network congestion suggestions may include increasing bandwidth, optimizing traffic scheduling, and load balancing.

[0232] Through the above steps, the root cause analysis unit can output information such as root cause severity, root cause type, root cause impact, and root cause recommendations.

[0233] In some examples, after locating the root cause node through the aforementioned steps, the constructed cause-effect graph can be further utilized to identify secondary faults caused by the root cause fault and perform noise reduction on these secondary faults to address the alarm storm problem caused by the fault cascading effect. The following section combines... Figure 14 and Figure 15 This needs to be explained.

[0234] Figure 15 This is a flowchart of a secondary fault noise reduction method provided in an embodiment of this application.

[0235] like Figure 15 As shown, in some implementations, step S13 may be followed by step S15: S15: Based on the cause-effect graph, identify the secondary faults caused by the root cause node during the propagation process, and disable the alarm triggers for the secondary faults.

[0236] In step S15, the fault denoising unit of the fault detection module can denoise the fault root cause location and other contents output by the aforementioned fault identification unit, and can also denoise the contents output by the aforementioned root cause analysis unit.

[0237] Please combine Figure 14 The fault denoising unit obtains root cause nodes from the fault identification unit or root cause analysis unit, and then analyzes the cascading propagation path of the fault based on the cause-effect graph. Faults corresponding to the root cause nodes are marked as primary faults; faults corresponding to non-root cause nodes (such as faults in other nodes caused by the propagation of the primary fault along the propagation path) are marked as secondary faults. Then, secondary faults can be marked as noise, and alarm triggers for secondary faults can be disabled, preventing alarms from being triggered.

[0238] Through the above steps, the fault denoising unit can output information such as the main fault node, the main fault index, the main fault location, the set of secondary fault nodes, the set of secondary fault indexes, and the set of secondary fault locations.

[0239] In this embodiment of the application, step S15 uses a cause-effect graph to distinguish between primary and secondary faults, which can improve the accuracy of fault analysis; disabling the alarm triggers of secondary faults can effectively solve the alarm storm problem caused by the fault cascading effect and reduce the alarm handling burden of maintenance personnel.

[0240] In some examples, the fault detection module also includes an output unit that formats and outputs the information from the fault denoising unit, thereby providing maintenance personnel with clear fault information to support subsequent fault handling decisions. The following section will combine... Figure 16 The fault output layer will be further introduced.

[0241] Figure 16 This is a schematic diagram illustrating the output and utilization of fault detection results provided in an embodiment of this application.

[0242] Please combine Figure 16The output unit of the fault detection module can receive the fault information output by the fault noise reduction unit and format the fault information into JSON format. The formatted fault information includes, but is not limited to, the following fields: basic information fields (such as fault ID field, fault type field, fault occurrence time field, etc.), location information fields (such as fault device field, fault port field, fault physical location field, etc.), severity fields (such as fault severity level field, fault severity score field, fault impact range field, etc.), root cause information fields (such as root cause node field, root cause item field, root cause type field, root cause occurrence time field, etc.), impact information fields (such as the number of monitoring points affected by the fault, the number of devices affected by the fault, etc.), and suggestion information (such as fault handling suggestions, etc.).

[0243] Please combine again Figure 16 In some examples, the fault detection system also includes a configuration tuning module that receives formatted fault information and fault handling suggestions from the output unit, learns the optimal configuration strategy based on a reinforcement learning framework, and generates configuration tuning recommendations. For example, based on the current network state and fault type, the configuration tuning module outputs the configuration parameters that need to be adjusted and their target values.

[0244] Please combine Figure 16 In some examples, the fault detection system also includes a decision execution module, which can be used with the configuration tuning module. For example, the security assessment unit in the decision execution module can perform a security assessment on the configuration tuning proposal, including checking equipment specification limitations and service impact; the configuration distribution unit can perform configuration parameter adjustments and distribute the configuration parameters to the target device (such as the core switch); the execution monitoring unit can monitor the execution status of the configuration parameter adjustments in real time and capture execution anomalies (such as configuration parameter distribution failure).

[0245] In some examples, the feedback optimization module of the fault detection system can receive adjusted network state data from the decision execution module and use it to update the parameters of the AI ​​operations and maintenance model (which includes two modules: fault identification and configuration tuning). For example, the data feedback unit in the feedback optimization module can feed the adjusted network state data back to the AI ​​operations and maintenance model; the incremental learning unit can update the parameters of the AI ​​operations and maintenance model using incremental learning; the model fine-tuning unit can update the parameters of the AI ​​operations and maintenance model using fine-tuning; and the continuous optimization unit can periodically evaluate model performance and continuously learn and improve.

[0246] The following examples, A and B, illustrate the fault detection method and system proposed in this application from a practical application perspective.

[0247] Example A: Fault detection for data center network environments

[0248] First, let's introduce the architecture of the fault detection system.

[0249] Specifically, the fault detection system is deployed in the data center network environment, as described below. Figure 17 Introducing the specific deployment architecture of the fault detection system: Figure 17 This is a system architecture diagram of a fault detection system provided in an embodiment of this application.

[0250] Please combine Figure 17 The data acquisition module is deployed on the network management server and communicates with the network devices to be monitored (such as routers, core switches, aggregation switches, access switches, servers, etc.) through protocols such as SNMP, NetFlow, sFlow, Telemetry, ICMP ping, LLDP, CDP, and SSH. It can be used to collect monitoring information, such as the network operation data of the aforementioned network devices.

[0251] Data preprocessing module: Deployed on the data processing server, it can receive raw data (such as collected monitoring information) collected by the data acquisition module and perform preprocessing operations such as data cleaning, format unification, time alignment, and feature extraction to obtain preprocessed monitoring information.

[0252] Fault detection module: Deployed on the AI ​​inference server, it may include a data preprocessing unit, a correlation analysis unit (which may include a multi-indicator correlation analysis unit, a time-series dependency modeling unit, and a spatial location analysis unit), a fault identification unit, a root cause analysis unit, a fault denoising unit, and an output unit. The fault detection module receives structured data (such as preprocessed monitoring information) output by the data preprocessing module, processes the structured data through the above-mentioned units, and outputs fault information (such as fault location).

[0253] Configuration tuning module: Deployed on the AI ​​inference server, it can receive fault information and root cause suggestions from the fault detection module, and generate configuration tuning suggestions that match the current fault based on the reinforcement learning framework.

[0254] Decision execution module: Deployed on the network management server, it may include a security assessment unit, a configuration distribution unit, and an execution monitoring unit. The decision execution module can receive configuration tuning suggestions, perform security assessments on these suggestions through the security assessment unit, execute configuration parameter adjustments through the configuration distribution unit, and monitor the execution status of the configuration parameter adjustments in real time through the execution monitoring unit.

[0255] Feedback Optimization Module: Deployed on the AI ​​training server, this module may include a data feedback unit, an incremental learning unit, and a model fine-tuning unit. The feedback optimization module receives adjusted network status data from the decision execution module and feeds it back to the AI ​​operations and maintenance model (which includes fault identification and configuration tuning modules) through the data feedback unit. The incremental learning unit and model fine-tuning unit update the parameters of the AI ​​operations and maintenance model, while the continuous optimization unit continuously learns and improves the system.

[0256] Second, the processing flow of each of the above modules will be described in detail.

[0257] First, the data acquisition module collects monitoring information, such as network operation data of network devices.

[0258] Specifically, the data acquisition module can collect performance metric data. For example, the data acquisition module can collect traffic data from each monitoring point via the SNMP protocol, latency metrics via ICMP ping, packet loss metrics via the NetFlow protocol, and CPU utilization and error rate via the SNMP protocol.

[0259] Specifically, the data acquisition module can collect basic device information. For example, the data acquisition module can obtain device description, device name, device location, and device contact information via the SNMP protocol; and obtain system information, hostname, and device list via the SSH protocol.

[0260] Specifically, the data acquisition module can collect network topology information data. For example, the data acquisition module can discover neighboring devices through the LLDP or CDP protocol.

[0261] Specifically, the data acquisition module can collect information data from monitoring points. For example, the data acquisition module can obtain port information of each monitoring point through protocols such as SNMP and SSH.

[0262] The sampling frequencies of the aforementioned monitoring data can be set as follows: traffic data is collected every second, latency metrics are collected every 5 seconds, CPU utilization is collected every 5 seconds, basic device information is collected every hour, network topology information is collected every hour, and monitoring point information is collected every hour. In other embodiments, other sampling frequencies can also be set, such as collecting traffic data every 2 seconds, etc., and this application does not limit this.

[0263] Then, the data preprocessing module performs preprocessing operations such as data cleaning, format unification, time alignment, and feature extraction on the monitoring information collected by the data acquisition module, and outputs the preprocessed structured data to the fault detection module.

[0264] Then, each unit in the fault detection module performs correlation analysis on the preprocessed structured data in terms of time and space dimensions to locate the fault location.

[0265] Specifically, the data preprocessing unit of the fault detection module can perform feature encoding and fusion operations on the preprocessed structured data. For example, the data preprocessing unit can encode performance index data into a 128-dimensional vector, basic equipment information data into a 40-dimensional vector, topology information data into a 32-dimensional vector, and monitoring point information data into a 24-dimensional vector. Then, through dimension concatenation, linear transformation, and dimension upgrading, a fusion operation is performed to obtain a 256-dimensional fused feature representation. It should be noted that in some other examples, other feature encoding dimensions can also be used, such as encoding performance index data into a 64-dimensional vector, etc., and this application does not limit this.

[0266] Specifically, the multi-indicator correlation analysis unit of the fault detection module can perform correlation analysis on the fused features output by the data preprocessing unit for multiple monitoring items. For example, the multi-indicator correlation analysis unit can use a multi-head attention mechanism, Pearson correlation coefficient, and mutual information estimation to capture the correlation between various monitoring items, and then construct a causal graph. Nodes in the causal graph can be monitoring items of all monitoring points, edges can be causal relationships between monitoring items, and edge weights can indicate the strength of the correlation between monitoring items. The multi-head attention mechanism can use 8 attention heads, with a key vector dimension of 32, a query vector dimension of 32, and a value vector dimension of 32. In other examples, the configuration parameters of the multi-head attention mechanism can also use other values, which are not limited in this application.

[0267] Specifically, the temporal dependency modeling unit of the fault detection module can perform temporal dependency modeling on the monitored items based on causal graphs, thereby achieving analysis in the time dimension. For example, it can perform operations such as sinusoidal position encoding, LSTM temporal modeling based on causal graphs, PELT change point detection, and temporal feature extraction, and output temporal features, temporal attention weights, change point locations, and temporal statistical features. The hidden layer dimension of the LSTM network can be set to 256, the time step can be set to 60 (i.e., 60 seconds of historical data), the learning rate can be set to 0.001, and the batch size can be set to 32. In other examples, the configuration parameters of the LSTM network can also be set to other values, which are not limited in this application.

[0268] Specifically, the spatial localization analysis unit of the fault detection module can perform spatial localization analysis on the temporal features output by the temporal dependency modeling unit, and further perform correlation analysis between the temporal and spatial dimensions. For example, the spatial localization analysis unit can perform spatial localization analysis through spatial information encoding, spatial attention mechanisms, etc., and output spatial features and spatial attention weights. The spatial localization analysis unit can also perform correlation analysis between the temporal and spatial dimensions through graph neural networks, spatiotemporal correlation analysis, and the PageRank algorithm, and output spatiotemporal features, spatiotemporal attention weights, fault propagation paths, etc. Among them, the number of graph convolutional layers of the graph neural network can be set to 2, the hidden layer dimension can be set to 256, the learning rate can be set to 0.001, and the batch size can be set to 32; the damping coefficient of the PageRank algorithm can be set to 0.85, and the number of iterations can be set to 100. In other examples, the above configuration parameters can also be set to other values, which are not limited in this application.

[0269] Specifically, the fault identification unit of the fault detection module can identify faults based on spatial features. For example, through operations such as anomaly detection based on reconstruction error, analysis of normal fluctuations and abnormal faults, precise fault location, and fault severity assessment, it can output a set of abnormal monitoring points, abnormal fluctuation characteristics, fault location, fault root cause location, and fault severity. The detection threshold for anomaly detection can be set to threshold = mean + 3 × standard deviation. In other examples, the detection threshold can also be set to other values, which are not limited in this application.

[0270] Specifically, the root cause analysis unit of the fault detection module can verify the accuracy of the fault root cause location output by the fault identification unit through counterfactual reasoning, identify the root cause type, analyze the root cause impact, generate root cause suggestions, integrate the above information into root cause information, and output it. When verifying the accuracy of the fault root cause location, a root cause verification threshold F1 score > 0.7 can be used. In other examples, the root cause verification threshold can also be set to other values, which are not limited in this application.

[0271] Specifically, the fault denoising unit of the fault detection module can perform fault denoising on the root cause information output by the root cause analysis unit. For example, it can distinguish between primary faults and secondary faults, mark secondary faults as noise, not trigger alarms, and output denoised fault information, which may include data such as primary fault node, primary fault index, primary fault location, set of secondary fault nodes, set of secondary fault indexes, and set of secondary fault locations.

[0272] Specifically, the output unit of the fault detection module can format and output the denoised fault information. For example, the denoised fault information can be converted into JSON format and output. The output JSON format information can include basic information, location information, severity information, root cause information, impact information, and other fault information for each fault node, and may also include suggestion information. When determining the severity information, the pre-assigned weight coefficients for each fault severity assessment index can be w1 = 0.3 (anomaly score), w2 = 0.2 (number of anomaly monitoring points), w3 = 0.2 (anomaly duration), w4 = 0.15 (anomaly fluctuation amplitude), and w5 = 0.15 (fault impact range). In other examples, the fault severity weights can also be set to other values, which are not limited in this application.

[0273] Afterwards, the configuration tuning module can receive fault information and suggestions from the fault detection module, and generate configuration tuning suggestions based on the reinforcement learning framework.

[0274] Specifically, the security assessment unit of the configuration tuning module can perform security assessments on the generated configuration tuning recommendations, such as checking for equipment specification limitations and business impact, to ensure that configuration adjustments will not lead to equipment overload or business interruption.

[0275] Specifically, the configuration distribution unit of the configuration tuning module can adjust configuration parameters and distribute them to the target device. These configuration parameters may include routing configuration, switching configuration, security configuration, bandwidth configuration, etc.

[0276] Specifically, the execution monitoring unit of the configuration tuning module can monitor the execution status of configuration parameter adjustments in real time and capture execution anomalies, such as configuration distribution failures and device response timeouts.

[0277] In addition, the feedback optimization module can optimize various parameters of the AI ​​operation and maintenance big model.

[0278] Specifically, the data feedback unit of the feedback optimization module can feed back the adjusted and collected monitoring information to the AI ​​operation and maintenance big model, including performance index data, basic equipment information data, network topology information data, and monitoring point information data.

[0279] Specifically, the incremental learning unit of the feedback optimization module can update the parameters of the AI ​​operations and maintenance model using incremental learning. For example, it can use new monitoring information to incrementally train the AI ​​operations and maintenance model to adapt to changes in the network environment.

[0280] Specifically, the model fine-tuning unit of the feedback optimization module can update the parameters of the AI ​​operation and maintenance large model through fine-tuning. For example, fault case data can be used to fine-tune the AI ​​operation and maintenance large model to improve its ability to identify specific fault types.

[0281] Specifically, the continuous optimization unit of the feedback optimization module can continuously learn and improve. For example, the model performance of the AI ​​operation and maintenance large model can be evaluated regularly, and the parameters and algorithms of the fault detection module can be adjusted based on the evaluation results to ensure that the fault detection module always maintains high accuracy and reliability.

[0282] Third, the following section will introduce the fault detection method and system of Example A, using a fault case as an example.

[0283] The data center is experiencing the following issues: degraded data center storage network performance, increased latency for multiple virtual machines accessing storage, and slower response times for some business systems.

[0284] The fault detection system utilizes the aforementioned fault detection methods to perform fault detection. For example, the data acquisition module collects metrics such as traffic, latency, and packet loss from electronic devices in the data center, including core switches, aggregation switches, and servers; the fault detection module detects that storage network latency has increased from the normal 2ms to over 15ms, and packet loss rate has increased from 0.01% to over 0.5%; the multi-metric correlation analysis unit discovers a strong positive correlation between server network card traffic and virtual machine network traffic; the time-series dependency modeling unit detects that server network card traffic suddenly drops to 0 at 3:20 PM, identifying 3:20 as the point of change; the spatial location analysis unit locates the root cause of the fault as the server network card (Server-05-NIC-01); the fault noise reduction unit distinguishes between primary faults (server network card) and secondary faults (virtual switch ports, virtual network cards); and the root cause analysis unit identifies the root cause type as a hardware fault and generates handling suggestions, such as recommending replacing the faulty core switch port or switching to a backup port.

[0285] Example B: Fault detection for enterprise campus network environments

[0286] First, let's introduce the architecture of the fault detection system.

[0287] Specifically, the fault detection system is deployed in the enterprise campus network environment, and the specific deployment architecture is as follows: Data acquisition module: Deployed on the campus network management server, it communicates with the network devices to be monitored (such as core switches, aggregation switches, access switches, wireless controllers, wireless APs, firewalls, routers, load balancers, etc.) via protocols such as SNMP, NetFlow, sFlow, Telemetry, ICMP ping, LLDP, CDP, and SSH.

[0288] Data preprocessing module: Deployed on the campus network data processing server.

[0289] Fault detection module: Deployed on the AI ​​inference server in the park, it may include a data preprocessing unit, a multi-indicator correlation analysis unit, a time-series dependency modeling unit, a spatial positioning analysis unit, a fault identification unit, a root cause analysis unit, a fault denoising unit, and an output unit.

[0290] Configuration and optimization module: Deployed on the AI ​​inference server in the park.

[0291] Decision execution module: Deployed on the campus network management server, it may include a security assessment unit, a configuration distribution unit, and an execution monitoring unit.

[0292] Feedback optimization module: Deployed on the AI ​​training server in the park, it may include data feedback unit, incremental learning unit and model fine-tuning unit, etc.

[0293] The functions of each module can be found in Example A above, and will not be repeated here.

[0294] Secondly, the characteristics of the network environment in the enterprise park will be introduced.

[0295] Specifically, unlike data center network environments, enterprise campus network environments have the following characteristics: The network is large in scale: it covers multiple buildings, multiple floors, and multiple departments, with 500-2000 network devices and 2000-10000 monitoring points.

[0296] The network topology is complex: a three-layer network architecture (core layer, aggregation layer, access layer) is adopted. The core layer is deployed with 2-4 core switches, the aggregation layer is deployed with aggregation switches according to buildings or regions, and the access layer is deployed with access switches according to floors or departments.

[0297] Extensive wireless network coverage: Deployment of wireless controllers and a large number of wireless access points (APs) achieves full wireless network coverage within the campus, supporting mobile office work for employees.

[0298] Strict network security protection: Deploy security devices such as firewalls, intrusion detection systems, and access control lists to ensure network security.

[0299] It offers a wide range of services, including office work, production, video conferencing, and file sharing, each with different network performance requirements.

[0300] Third, the processing flow of each of the above modules will be described in detail.

[0301] Considering the characteristics of the enterprise park network environment, the processing flow of each module is different from that of Example A. The following focuses on the parts that are different from Example A.

[0302] First, the data acquisition module collects monitoring information, such as network operation data of network devices.

[0303] Specifically, the data acquisition module can collect performance metrics data. For example, in addition to performance metrics data such as traffic data in Example A above, the data acquisition module can also collect wireless metrics such as signal strength, signal-to-noise ratio, and number of connections of the wireless AP through the CAPWAP protocol.

[0304] Specifically, the data acquisition module can collect basic device information data. For example, in addition to basic device information data such as the device name in Example A above, the data acquisition module can also obtain device information of the wireless AP through the wireless controller API.

[0305] Specifically, the data acquisition module can collect network topology information data. For example, in addition to network topology information data such as neighboring devices in Example A above, the data acquisition module can also obtain the association relationship between the wireless AP and the wireless controller through the wireless controller API.

[0306] Specifically, the data acquisition module can collect monitoring point information data. In addition to the monitoring point information data such as port information in Example A above, the data acquisition module can also obtain the port information of the wireless AP through the wireless controller API.

[0307] Among them, monitoring information related to wireless networks can be collected every 10 seconds.

[0308] Next, the data preprocessing module preprocesses the monitoring information collected by the data acquisition module. The processing flow can be found in Example A, and will not be repeated here.

[0309] Then, each unit in the fault detection module performs correlation analysis on the preprocessed structured data in terms of time and space dimensions to locate the fault location.

[0310] Specifically, the data preprocessing unit of the fault detection module can perform feature encoding and fusion operations on the preprocessed structured data. Building upon the feature encoding in Example A, wireless-related data can also be encoded into a 32-dimensional vector. The specific processing flow of the fusion operation can be found in Example A and will not be repeated here.

[0311] Specifically, the processing flow of the multi-index correlation analysis unit, time-series dependency modeling unit, fault identification unit, root cause analysis unit, and output unit of the fault detection module can be found in Example A, and will not be repeated here.

[0312] Furthermore, considering the greater complexity of the campus network topology, the time step for LSTM network time series modeling can be set to 120 to accommodate the relatively slow fault propagation speed. More graph convolutional layers can also be added, such as setting the number of graph convolutional layers in the graph neural network to 3 to accommodate the relatively complex network architecture. Given the larger normal fluctuations in campus networks, a lower anomaly detection threshold can be set, such as threshold = mean + 2.5 × standard deviation. Considering that core equipment failures are more important than those in data center networks, while multi-device failures are more common in campus networks, the breadth of the failure (e.g., the number of affected devices) is more important. Therefore, the w2 value can be increased. For example, the weighting coefficients of the fault severity assessment indicators can be set as follows: w1 = 0.25 (anomaly score), w2 = 0.25 (number of anomaly monitoring points), w3 = 0.2 (anomaly duration), w4 = 0.15 (anomaly fluctuation amplitude), w5 = 0.15 (fault impact range).

[0313] Afterwards, the configuration tuning module can receive fault information and suggestions from the fault detection module, and generate configuration tuning suggestions based on the reinforcement learning framework.

[0314] Specifically, the specific processing flow of the security assessment unit and execution monitoring unit of the configuration tuning module can be found in Example A, and will not be repeated here.

[0315] Specifically, the configuration distribution unit of the configuration tuning module can adjust configuration parameters and distribute them to the target device. In addition to routing configurations as shown in Example A, configuration parameters may also include wireless network-related parameters, such as wireless AP channel configuration and wireless AP power configuration.

[0316] In addition, the feedback optimization module can optimize the parameters of the fault detection module. The specific processing flow of each unit in the feedback optimization module can be found in Example A, and will not be repeated here.

[0317] Fourth, the fault detection method and system of Example B will be introduced below with reference to a fault case.

[0318] The campus network is experiencing the following issues: the wireless network performance in a certain office area is degraded, and users are reporting network lag.

[0319] The fault detection system utilizes the aforementioned fault detection methods to perform fault detection. For example, the data acquisition module collects indicators such as signal strength, signal-to-noise ratio (SNR), channel utilization, and number of connections of the wireless APs in the area; the fault detection module detects that the channel utilization of multiple wireless APs in the area exceeds 80%, and the SNR is below 15dB; the multi-indicator correlation analysis unit discovers a strong negative correlation between channel utilization and SNR; the time-series dependency modeling unit detects that the channel utilization starts to rise continuously from 10:00 AM; the spatial positioning analysis unit locates the root cause of the fault as improper channel configuration of the wireless AP in the center of the area; the fault denoising unit distinguishes between primary faults (central wireless APs) and secondary faults (surrounding wireless APs); the root cause analysis unit identifies the root cause type as a configuration error and generates processing suggestions, such as suggesting adjusting the channel configuration of the central wireless AP to avoid channel conflicts with surrounding wireless APs.

[0320] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention. For example, the steps described in the above embodiments can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in the present invention can be achieved, the present invention does not limit this.

[0321] Corresponding to the embodiments of the aforementioned fault detection methods, this application also provides embodiments of a fault detection system.

[0322] Figure 18 This is a schematic diagram of a fault detection system provided in an embodiment of this application.

[0323] like Figure 18 As shown, the fault detection system 1800 may include a data acquisition module 1810 and a fault detection module 1820.

[0324] The data acquisition module 1810 is used to collect monitoring information of each monitoring item at different times under multiple monitoring points; the fault detection module 1820 is used to perform time and space dimension correlation analysis on multiple monitoring items based on the monitoring information to obtain the spatiotemporal characteristics of each monitoring item; and to perform fault detection on each monitoring item based on the spatiotemporal characteristics.

[0325] In one possible implementation, the fault detection module 1820 is used to: generate a causal graph indicating the correlation between each monitoring item based on monitoring information; wherein the nodes of the causal graph are the monitoring items under each monitoring point; extract the temporal features corresponding to the nodes in the causal graph using a preset temporal analysis network; determine the spatial features corresponding to each node based on the topology information in the monitoring information; and obtain the spatiotemporal features based on the causal graph, temporal features, and spatial features.

[0326] In one possible implementation, the fault detection module 1820 is used to: analyze at least one of the correlation strength between monitoring items, the linear correlation between monitoring items, and the nonlinear correlation between monitoring items to obtain the correlation analysis results of monitoring items; take the monitoring items as nodes, and determine the edges between nodes and the weights corresponding to the edges based on the correlation analysis results of monitoring items; and construct a causal graph based on the nodes, edges, and the weights corresponding to the edges.

[0327] In one possible implementation, the fault detection module 1820 is used to: select time-series effective nodes whose self-association strength satisfies the time-series screening conditions based on the self-association strength of each node in the causal graph; perform time-series modeling on the time-series effective nodes using a time-series analysis network to obtain a time-series model, and extract time-series change features and time-series statistical features from the time-series model; wherein, the time-series change features and time-series statistical features form time-series features.

[0328] In one possible implementation, the fault detection module 1820 is used to: use a graph neural network to determine the network topology graph based on topology information, and determine the neighbor monitoring points of each monitoring point in the network topology graph; based on the causal graph, determine the association between the monitoring point and the neighbor monitoring points, and determine the effective neighbor monitoring points whose association meets the neighbor monitoring point screening conditions; and use graph convolution operation to aggregate the monitoring information of the effective neighbor monitoring points to obtain the spatial features corresponding to the nodes in the causal graph.

[0329] In one possible implementation, the fault detection module 1820 is used to: determine the fault propagation path based on the cause-effect graph; associate the fault propagation path with temporal features to obtain the temporal propagation path; associate the fault propagation path with spatial features to obtain the spatial propagation path; and determine the spatiotemporal propagation path based on the temporal propagation path and the spatial propagation path.

[0330] In one possible implementation, the fault detection module 1820 is used to: identify abnormal nodes among the nodes based on spatiotemporal characteristics; identify nodes that have a causal relationship with the abnormal nodes based on the causal graph; take the abnormal nodes and the nodes that have a causal relationship with the abnormal nodes as first suspected root cause nodes, and calculate the first influence score of each first suspected root cause node on other nodes; and determine the first fault root cause node among the first suspected root cause nodes based on the first influence score.

[0331] In one possible implementation, the fault detection module 1820 is used to: reconstruct the spatiotemporal features to obtain reconstructed features, and determine whether the monitoring point is abnormal based on the spatiotemporal features and the reconstructed features; for abnormal monitoring points, trace back along the edges of the causal graph to the second suspected root cause node directly or indirectly pointing to the node under abnormal monitoring; determine the reference root cause node among the second suspected root cause nodes based on the influence of each second suspected root cause node on other nodes; and verify the fault root cause node based on the reference root cause node.

[0332] In one possible implementation, the fault detection module 1820 is used to: determine, based on the cause-effect graph, the secondary faults caused by the fault at the root node during the propagation process, and disable alarm triggers for the secondary faults.

[0333] In one possible implementation, the system also includes a data preprocessing module (not shown in the figure), which is used to: encode the monitoring information of each monitoring item at each time point into a vector format for each monitoring point, and fuse the monitoring information in vector format corresponding to multiple monitoring items to obtain the fused monitoring information.

[0334] In one possible implementation, the data preprocessing module is used to: concatenate monitoring information in vector format corresponding to multiple monitoring items to obtain a concatenated vector; perform a linear transformation on the concatenated vector to map the concatenated vector to the target dimension, and use it as the fused monitoring information.

[0335] Figure 19 This is a schematic diagram of a computing device provided in an embodiment of this application.

[0336] like Figure 19 As shown, the computing device 1900 includes a processor 1901 and a memory 1902. Exemplarily, the computing device 1900 may also include a communications interface 1903 and a communications bus 1904.

[0337] The processor 1901, memory 1902, and communication interface 1903 communicate with each other via communication bus 1904. The communication interface 1903 may include a transmitter and receiver for communicating with other devices or communication networks, and may be a wired interface (port), such as a fiber distributed data interface (FDDI) or a gigabit Ethernet interface (GE).

[0338] In some embodiments, the processor 1901 is used to execute program 1905, specifically performing the relevant steps in the method embodiments described above. Specifically, program 1905 may include program code, which includes computer-executable instructions.

[0339] For example, processor 1901 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement some embodiments of this application. Computing device 1900 may include one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs. The CPU may be a single-core CPU or a multi-core CPU.

[0340] In some embodiments, memory 1902 is used to store program 1905. Memory 1902 may include high-speed random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device.

[0341] Specifically, program 1905 can be called by processor 1901 to cause computing device 1900 to perform the method operations described in the above embodiments.

[0342] Some embodiments of this application provide a computer-readable storage medium storing at least one executable instruction that, when executed on a computing device 1900, causes the computing device 1900 to perform the fault detection method described in the above embodiments.

[0343] The executable instructions can be used to cause the computing device 1900 to perform fault detection method operations.

[0344] For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device, etc.

[0345] This application provides a chip device in some embodiments, which is applied to a server. The chip device includes one or more interface circuits and one or more processors. The interface circuits and processors are interconnected via lines. The interface circuits are used to receive signals from the server's memory and send signals to the processors, the signals including computer instructions stored in the memory. When the server processor executes the computer instructions, the server performs various steps in the fault detection method shown in the above-described method embodiments.

[0346] The beneficial effects that the readable storage medium provided in some embodiments of this application can achieve can be referred to the beneficial effects in the corresponding fault detection methods provided above, and will not be repeated here.

[0347] It should be noted that in this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0348] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0349] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution apparatus, device, or equipment (such as a computer-based device, a processor-included device, or other device that can fetch and execute instructions from, an instruction execution apparatus, device, or equipment).

[0350] For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by or in conjunction with an instruction execution means, apparatus, or device.

[0351] More specific examples of computer-readable media (a non-exhaustive list) include the following: electrical connections having one or more wires (electronic devices), portable computer disks (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM).

[0352] Furthermore, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory. It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof.

[0353] In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc. The above embodiments are merely specific embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made based on the technical solutions of this application should be included within the scope of protection of this application.

Claims

1. A fault detection method, characterized in that, The method includes: The monitoring information of each monitoring item at multiple monitoring points at different times is collected separately. Based on the monitoring information, a correlation analysis of time and space dimensions is performed on multiple monitoring items to obtain the spatiotemporal characteristics of each monitoring item. Based on the aforementioned spatiotemporal characteristics, fault detection is performed on each of the monitoring items.

2. The method according to claim 1, characterized in that, Based on the monitoring information, a correlation analysis is performed on the multiple monitoring items in terms of time and space dimensions to obtain the spatiotemporal characteristics of each monitoring item, including: Based on the monitoring information, a cause-effect graph indicating the relationship between the monitoring items is generated; wherein, the nodes of the cause-effect graph are the monitoring items under each monitoring point; Using a pre-defined temporal analysis network, the temporal features corresponding to the nodes in the causal graph are extracted; Based on the topology information in the monitoring information, the spatial characteristics corresponding to each node are determined; The spatiotemporal features are obtained based on the causal graph, the temporal features, and the spatial features.

3. The method according to claim 2, characterized in that, The step of generating a cause-effect graph indicating the relationships between the various monitoring items based on the monitoring information includes: The correlation analysis results of monitoring items are obtained by analyzing at least one of the correlation strength, linear correlation, and nonlinear correlation among the monitoring items. The monitored items are used as nodes, and the edges between the nodes and the weights corresponding to the edges are determined based on the correlation analysis results of the monitored items. The causal graph is constructed based on the nodes, the edges, and the weights corresponding to the edges.

4. The method according to claim 2 or 3, characterized in that, The step of extracting temporal features corresponding to nodes in the causal graph using a preset temporal analysis network includes: Based on the strength of the self-association relationship between each node in the causal graph and itself, select the time-series valid nodes whose self-association relationship strength satisfies the time-series screening conditions. Using the aforementioned time series analysis network, time series modeling is performed on the time series effective nodes to obtain a time series model, and time series change features and time series statistical features are extracted from the time series model; wherein, the time series change features and the time series statistical features form the time series features.

5. The method according to any one of claims 2 to 4, characterized in that, The step of determining the spatial characteristics corresponding to each node based on the topology information in the monitoring information includes: Using a graph neural network, a network topology graph is determined based on the topology information, and neighboring monitoring points of each monitoring point in the network topology graph are determined respectively; Based on the cause-effect graph, the association between the monitoring point and the neighboring monitoring points is determined, and valid neighboring monitoring points whose associations meet the neighboring monitoring point screening conditions are identified among the neighboring monitoring points. By using graph convolution operations, the monitoring information of the effective neighbor monitoring points is aggregated to obtain the spatial features corresponding to the nodes in the causal graph.

6. The method according to claim 5, characterized in that, The process of obtaining the spatiotemporal features based on the causal graph, the temporal features, and the spatial features includes: The fault propagation path is determined based on the cause-effect graph; By associating the fault propagation path with the timing characteristics, a time propagation path is obtained; By associating the fault propagation path with the spatial features, a spatial propagation path is obtained; Based on the time propagation path and the spatial propagation path, determine the spatiotemporal propagation path.

7. The method according to any one of claims 2 to 6, characterized in that, The fault detection of each monitoring item based on the spatiotemporal characteristics includes: Based on the spatiotemporal characteristics, identify abnormal nodes among the nodes; Based on the causal graph, nodes that have a causal relationship with the abnormal nodes are identified; The abnormal node and the node that has a causal relationship with the abnormal node are designated as the first suspected root cause node. Based on the influence of each first suspected root cause node on other nodes, the fault root cause node is determined from the first suspected root cause node.

8. The method according to claim 7, characterized in that, The fault detection of each monitoring item based on the spatiotemporal characteristics also includes: The spatiotemporal features are reconstructed to obtain reconstructed features, and the monitoring point is determined to be abnormal based on the spatiotemporal features and the reconstructed features. For abnormal monitoring points, trace back along the edges of the cause-effect graph to the second suspected root cause node that directly or indirectly points to the node under the abnormal monitoring point; Based on the influence of each second suspected root cause node on other nodes, a reference root cause node is determined among the second suspected root cause nodes. The fault root cause node is verified based on the reference root cause node.

9. The method according to claim 7 or 8, characterized in that, After identifying the root cause node among the first suspected root cause nodes, the method further includes: Based on the causal graph, the secondary faults caused by the fault originating from the fault root node propagating along the spatiotemporal propagation path are determined, and the alarm triggers for the secondary faults are turned off.

10. A computing device, characterized in that, The computing device includes a memory and a processor; the memory and the processor are coupled; the memory is used to store computer program code, the computer program code including computer instructions, which, when executed by the processor, cause the computing device to perform the fault detection method as described in any one of claims 1 to 9.

Images