Abnormal root cause positioning method based on topology correlation

Abstract

The application relates to the technical field of computer system anomaly detection and fault positioning, and provides an abnormal root cause positioning method based on topology correlation. In order to solve the problem that a traditional abnormal root cause positioning method cannot process a cascading failure caused by an implicit dependency relationship, the method constructs a high-dimensional point cloud by collecting multi-dimensional monitoring indexes of multiple components during normal operation of the system and extracts a persistent homology feature as a steady-state topology template, calculates the persistent homology feature of an instantaneous high-dimensional point cloud after the multi-dimensional monitoring indexes are collected in real time, compares the persistent homology feature with the steady-state topology template to identify an abnormal topology feature, traces back simplex vertices constituting the abnormal topology feature, and performs deviation analysis on instantaneous monitoring data and historical baselines to position a structural disturbance source, realizes accurate root cause positioning without depending on any predefined dependency relationship between components, and significantly improves the accuracy and robustness of abnormal root cause positioning of a complex distributed system.

Description

Technical Field

[0001] This invention relates to the field of computer system anomaly detection and fault location technology, and in particular to a method for analyzing monitoring data and tracing root causes of distributed systems using computational topology, specifically a root cause localization method based on topological association. Background Technology

[0002] Root cause analysis, in large-scale distributed computing systems, refers to the process of automatically identifying and locating the root cause of an anomaly from numerous interconnected services, nodes, and components when monitoring and alarm systems detect abnormal indicators such as soaring service response latency or a sharp drop in computing resource utilization. It is a core requirement of Intelligent Operations and Maintenance (AIOps). With the large-scale deployment of AI training clusters, cloud computing platforms, and enterprise-level microservice architectures, the dependencies between system components are becoming increasingly complex and dynamically changing. Traditional manual troubleshooting methods can no longer meet the operational needs for efficient fault recovery within minutes, placing higher demands on the automation, real-time performance, and accuracy of root cause analysis.

[0003] Traditionally, root cause analysis of anomalies typically employs the following approaches: Causal methods based on service dependency graphs, which utilize distributed tracing data to construct a microservice call topology graph and, upon an anomaly, perform link propagation or a variant of the PageRank algorithm to identify key nodes in the anomaly propagation; methods based on time-series metric correlation analysis, which calculate Pearson correlation coefficients or Granger causality between all fine-grained monitoring metrics, connect highly correlated metrics into a dynamic causal graph, and then perform root cause inference; and methods based on log event mining, which use natural language processing to template logs, learn temporal or spatial correlation patterns between different log events, and construct an event propagation tree to locate the root cause. While these methods differ in their specific implementation paths, they all adhere to a common underlying technical assumption: the fault propagates along a "dependency graph" composed of nodes and edges, which can be pre-constructed or learned in real-time.

[0004] However, the aforementioned traditional techniques have a fundamental problem: when the system has a large number of implicit dependencies that cannot be predefined, such as cascading failures caused by shared GPU memory bandwidth contention, kernel bypass resource contention, and transient network micro-spikes, these failures are not directly reflected in the call chain and logs. Methods based on explicit dependency graphs cannot capture and propagate such failures, leading to a sharp decline in the accuracy of root cause localization.

[0005] The core reason for this problem lies in the assumption that default faults inevitably propagate along some explicitly modelable dependency path. Under this technical approach, all technical efforts focus on how to construct and reason about this "dependency graph" more quickly and accurately, resulting in a technical path where "the dependencies must be known before the root cause of dependency disruption can be located." However, the dependencies in large-scale distributed systems are not static, complete, or exhaustive. Implicit coupling mechanisms such as shared resource contention and kernel bypass competition inherently lack describable explicit connection structures, making root cause localization based on explicit graph principles unable to overcome the bottleneck of implicit fault localization. Therefore, traditional anomaly root cause localization methods, adhering to the technical assumption that "faults propagate along explicit dependency graphs," are unable to handle cascading faults caused by implicit dependencies, and the accuracy of root cause localization encounters an insurmountable technical bottleneck.

[0006] Therefore, how to accurately locate the root cause of anomalies without relying on any predefined dependencies between components has become a technical problem that urgently needs to be solved in the field of intelligent operation and maintenance. Summary of the Invention

[0007] To address the aforementioned technical problems, this invention provides an anomaly root cause localization method based on topological association. By representing the global state of the system as a high-dimensional monitoring data point cloud, a topological deformation tracing mechanism based on continuous coherence features is constructed for root cause localization. This differs from the static association reasoning mode in traditional technologies that rely on pre-built service dependency graphs or explicit causal graphs. It can achieve accurate root cause localization of various cascading failures, including implicit resource contention, without relying on any predefined dependencies between components. It eliminates the blind spot of perception of unmodeled dependencies based on explicit association methods, significantly improving the accuracy and robustness of anomaly root cause localization in complex distributed systems.

[0008] To address the aforementioned technical problems, this invention provides the following technical solution: an anomaly root cause localization method based on topological association, comprising: during a period of normal system operation, collecting multidimensional monitoring indicators of multiple components constituting the system, constructing a high-dimensional point cloud characterizing the global state of the system, and extracting the continuous coherence features of the high-dimensional point cloud as a steady-state topological template; collecting the multidimensional monitoring indicators of the multiple components in real time to construct an instantaneous high-dimensional point cloud, calculating the continuous coherence features of the instantaneous high-dimensional point cloud, and identifying anomalous topological features from the continuous coherence features of the instantaneous high-dimensional point cloud by comparing them with the steady-state topological template; tracing the simplex vertices constituting the anomalous topological features, performing deviation analysis on the instantaneous monitoring data corresponding to the simplex vertices and their historical baselines, and locating the component corresponding to the vertex with the largest deviation as the structural disturbance source causing topological deformation.

[0009] As a preferred embodiment of the anomaly root cause localization method based on topological association described in this invention, the continuous coherence features of the instantaneous high-dimensional point cloud are calculated, and anomalous topological features are identified from the continuous coherence features of the instantaneous high-dimensional point cloud by comparing them with the steady-state topological template. This includes: calculating the continuous coherence features of the instantaneous high-dimensional point cloud to obtain a first persistent graph, and using the persistent graph corresponding to the steady-state topological template as a second persistent graph; calculating the Wasserstein distance between the first persistent graph and the second persistent graph as a quantitative indicator of global topological perturbation; and when the global topological perturbation exceeds a preset perturbation threshold, identifying feature points in the first persistent graph that cannot form an optimal match with any feature point in the second persistent graph as the anomalous topological features.

[0010] Beneficial Effects: The solution implemented in this invention constructs a high-dimensional point cloud from multi-component, multi-dimensional monitoring indicators collected during the system's normal operation and extracts its persistent cohomology features as a steady-state topology template. This first achieves a comprehensive and accurate representation of the global topology of the system's healthy operating state, establishing a steady-state baseline in the form of a persistent graph that does not depend on any explicit dependencies between components. Based on this, an instantaneous high-dimensional point cloud is constructed by real-time collection of multi-dimensional monitoring indicators, and its persistent cohomology features are calculated and compared with the steady-state topology template. Abnormal topology features are identified from the instantaneous persistent cohomology features, thereby achieving real-time perception of abnormal deformations in the system's global topology. Unlike traditional fault detection methods that rely on pre-built service dependency graphs or causal graphs, this method directly captures anomalies from the overall shape changes of high-dimensional point clouds, enabling the effective detection of faults that cannot be described by graph models, such as implicit resource contention and kernel bypass. Furthermore, by tracing the simplex vertices that constitute the abnormal topological features, it performs deviation analysis on the instantaneous monitoring data corresponding to the simplex vertices and their historical baselines. The component corresponding to the vertex with the largest deviation is identified as the structural disturbance source causing the topological deformation. This achieves a precise inverse mapping from the abstract topological feature space to specific physical components, thus unlocking the key to root cause localization under zero graph dependency conditions.

[0011] By combining the above interconnected effects, a three-in-one topological deformation tracing mode is constructed, which includes "high-dimensional point cloud topology template construction - real-time perturbation detection of persistent homology features - simplex vertex inverse mapping tracing".

[0012] Therefore, unlike traditional technologies that adhere to the assumption of "fault propagation along explicit dependency graphs" and rely on pre-built dependency graphs for correlation reasoning, this invention represents the global state of the system as a high-dimensional point cloud and achieves root cause localization based on the comparison of continuous coherence features and vertex tracing. This transforms the traditional "correlation reasoning" mode, which is limited by predefined graphs, into a "topological deformation tracing" mode with zero graph dependence. Ultimately, it achieves accurate anomaly root cause localization without relying on any predefined component dependency graphs. This solves the problem in the background technology that "traditional anomaly root cause localization methods cannot handle cascading failures caused by implicit dependencies because they adhere to the technical path of fault propagation along explicit dependency graphs." It significantly improves the accuracy, robustness, and ability to perceive and cover implicit faults in the localization of anomalies in complex distributed systems. Attached Figure Description

[0013] Figure 1 A flowchart illustrating the anomaly root cause localization method based on topological association provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the first sub-process of the anomaly root cause localization method based on topological association provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the second sub-process of the anomaly root cause localization method based on topological association provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0014] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to specific examples. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] This invention provides a method for anomaly root cause localization based on topology association. This method can be a data processing engine hosted by an operations and maintenance management server or a cloud monitoring platform, capable of driving intelligent operations and maintenance applications across multiple dimensions, including but not limited to: First, in AI training cluster operations and maintenance, by constructing a high-dimensional point cloud from multi-dimensional monitoring metrics of GPU nodes, parameter servers, and data storage nodes, and comparing these metrics with continuous coherence features, the source of structural disturbances can be located. This identifies the root causes of training slowdowns caused by implicit resource contention such as shared GPU memory bandwidth contention and NVLink topology bottlenecks, without relying on service call chains or network topology graphs. Second, in cloud computing platform performance management, by performing topology deformation analysis on metrics such as CPU, memory, network throughput, and disk I / O of massive virtual machines or container instances, the source instance causing mutual interference in multi-tenant performance can be located, providing accurate basis for elastic scaling and resource isolation strategies. Third, in intelligent fault diagnosis of microservice architectures, by stretching metrics such as request latency, error rate, and concurrent connection count of each microservice instance into a high-dimensional point cloud, the cascading anomaly topological features caused by shared resource contention such as database connection pool exhaustion or message queue backlog are captured. Furthermore, through simplex vertex inverse mapping, the root cause is accurately located to the primary cause service, overcoming the inherent defect of traditional methods that rely on call chain graphs and cannot perceive faults propagating along non-call chain paths. Fourth, in the operation and maintenance of enterprise-level big data processing platforms (such as Hadoop / Spark clusters), by performing topological modeling of multi-dimensional operational metrics of computing nodes, storage nodes, and management nodes, the sudden drop in job execution efficiency caused by data skew, disk I / O contention, or garbage collection pauses is identified, and the root cause is located to a specific computing task or data partition. This invention solves the problem of accurate implicit fault location in distributed systems under zero-prior-dependency graph conditions, providing a general core data capability for the automated and intelligent operation and maintenance of various large-scale computing clusters and cloud environments.

[0016] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0017] In the following embodiments, the operation and maintenance monitoring of an AI training cluster containing 100 nodes is used as an application scenario to describe the technical solution of the present invention in detail. It should be understood that the above specific business scenario is only an exemplary description for ease of explanation. The technical solution provided by the present invention can be applied to any information system environment that requires anomaly root cause localization, such as distributed systems, computing clusters, and cloud environments that can collect multi-dimensional monitoring indicators, such as microservice clusters, big data processing platforms, and distributed database clusters. Its application scope is not limited to this.

[0018] Example 1: Anomaly root cause localization method based on topological association.

[0019] In this embodiment, please refer to Figure 1 , Figure 1 This is a flowchart illustrating the anomaly root cause localization method based on topological association provided in an embodiment of the present invention. Figure 1 As shown, in this embodiment, applied to a server, the steps include S11-S13: S11: During the period when the system is operating without abnormalities, collect multi-dimensional monitoring indicators of multiple components constituting the system, construct a high-dimensional point cloud representing the global state of the system, and extract the continuous coherence features of the high-dimensional point cloud as a steady-state topology template.

[0020] Multidimensional monitoring metrics refer to a collective term for various types of parameters collected from the various components constituting the system under monitoring through monitoring agents or interfaces, used to quantify the operational status of the components in different dimensions. In this embodiment, multidimensional monitoring metrics include, but are not limited to: CPU utilization, memory utilization, disk I / O rate, network throughput, GPU utilization, and GPU memory bandwidth utilization. It should be noted that any performance metric that can be quantified and reflects the instantaneous operational status of a component can be included in the scope of multidimensional monitoring metrics.

[0021] High-dimensional point cloud: refers to a set of data points representing the state of various components within a system within a corresponding time window in a high-dimensional space. In this embodiment, the high-dimensional point cloud is constructed by treating the processed M-dimensional monitoring index vector of each component as a point in the high-dimensional space. The coordinates of this point are determined by its values ​​in the M index dimensions. This representation method models the global state of the system as a geometric object, laying the foundation for subsequent topology analysis.

[0022] Persistent Homology Feature (PHF): This refers to the numerical features extracted from high-dimensional point clouds through persistent homology (PH) calculations, describing the evolution of their cross-scale topological structure. In this embodiment, the persistent homology feature is specifically represented as a persistent diagram or a persistent homology barcode. Unlike simply calculating the connectivity and other features of a point cloud at a single scale, the persistent homology feature records the complete lifecycle of the topological structure in a high-dimensional point cloud, such as connected components (0-dimensional homology class), closed loops, or holes (1-dimensional homology class), from its "birth" to its "death," thus providing a robust mathematical tool for characterizing fine-grained shape information of the system state.

[0023] Steady-state topology template: refers to the baseline model representing the "standard topological shape" of the system's healthy state, formed by statistical learning of the persistent homology features of its high-dimensional point cloud during stable operation without anomalies. In this embodiment, the steady-state topology template consists of a set of persistent graph feature points with stable lifecycles that repeatedly appear across multiple time windows, along with their "birth-death" coordinate intervals. It defines the baseline of topological invariants during normal system operation.

[0024] The specific implementation of this step is as follows: First, the period during which the system operates without abnormalities is designated as the learning period, which is then divided into multiple consecutive time windows. W 1, W 2,..., W T T is a positive integer representing the total number of windows. For each time window... W i Perform the following operations: Collect M-dimensional monitoring metrics for the K target components (e.g., K=100 GPU nodes) constituting the system, where M is the number of dimensions of the monitoring metrics. To improve data quality, perform quantile aggregation on the time-series data of each dimension of the metrics for each component within the window, generating an M′-dimensional (M′ is the aggregated feature dimension, which can be several times M) metric aggregation vector representing the overall state of that component within the window.

[0025] Secondly, the same time window W i The M′-dimensional index aggregation vector of all K components is regarded as K data points in the high-dimensional space RM′, thus forming the high-dimensional point cloud corresponding to this time window. PC i .

[0026] Then, for each high-dimensional point cloud PC i The persistent homology characteristics of the Vietoris-Rips (VR) simplex complex within a preset scale range are calculated. This embodiment can calculate one-dimensional persistent homology, which can effectively capture the topological structure of the system's functional modules composed of multiple components. The calculation results are presented as persistent graphs. Dgm i The topological features are stored in the form of a matrix, where the coordinates of each feature point p=(b,d) represent the scale parameters at the "birth" and "death" of the feature. Existing techniques related to Vietoris-Rips simplex complexes, continuous cohomology feature computation, and one-dimensional continuous cohomology can be found in well-known computational topology knowledge and will not be elaborated upon here.

[0027] Finally, a persistent graph summarizing all time windows throughout the entire learning period { Dgm 1, Dgm 2,..., Dgm T To eliminate sporadic fluctuations, the lifetime l= d b Exceeding the preset persistence threshold Robust topological features were identified. These robust features were then subjected to cluster analysis based on Wasserstein distance to identify topological feature clusters that stably appeared across multiple windows. Clusters with birth-death coordinate intervals corresponding to their centers having variances below a preset variance threshold were selected. d The topological feature clusters are ultimately defined as steady-state topological templates. Tstable The specific implementation method of cluster analysis based on Wasserstein distance, as well as the methods for setting the persistence threshold and variance threshold, will be elaborated in detail in the subsequent Example 3.

[0028] It should be noted that the above-mentioned high-dimensional point cloud construction methods are not limited to vectorization methods based on quantile aggregation. In one example, a vectorization method based on time-series features can be used. By performing time-series decomposition on each dimension of the indicator within the window, the decomposed components are used as feature values ​​to construct vectors, which is suitable for scenarios that need to capture the evolution patterns of indicators. In another example, a method based on a deep autoencoder can be used. By training an autoencoder, the high-dimensional original data is compressed into low-dimensional embedding vectors, and the embedding vectors are used as point cloud data points, which is suitable for scenarios where the original indicator has extremely high dimensionality and highly nonlinear correlations. Any technical means that can transform multi-component, multi-indicator time-series data into structured vectors is within the scope of protection of this invention.

[0029] For example, in an AI training cluster environment with 100 nodes, during a 7-day learning period, five metrics—CPU, memory, GPU utilization, GPU memory bandwidth, and network throughput—are collected for each node in 5-minute time windows. For each time window, the metrics of each node are aggregated using quantiles (25%, 50%, and 75% quantiles can be used), resulting in a 100-point, 15-dimensional high-dimensional point cloud. After calculation and clustering through the above steps, a steady-state topology template is obtained. Tstable This template Tstable It stably contains a long-lived one-dimensional homology class (ring structure) that reveals a stable functional topology formed between GPU nodes in the cluster due to periodic collective communication (such as All-Reduce operations).

[0030] In step S11, a high-dimensional point cloud of system performance indicators is constructed and robust persistent coherence features are extracted from it as a steady-state topology template. This achieves a comprehensive and accurate representation of the global topology of the system's healthy operating state. A steady-state baseline is established in the form of a persistent graph or barcode that does not depend on any explicit dependencies between components. This solves the problem that traditional techniques require predefined dependency graphs and provides a reliable and robust comparison benchmark for subsequent online anomaly detection.

[0031] S12: Collect multi-dimensional monitoring indicators of the multiple components in real time to construct an instantaneous high-dimensional point cloud, calculate the continuous cohomology features of the instantaneous high-dimensional point cloud, and identify abnormal topological features from the continuous cohomology features of the instantaneous high-dimensional point cloud by comparing them with the steady-state topology template.

[0032] The specific implementation of this step is as follows: First, during the system's online operation, M-dimensional monitoring indicators of the K components in step S11 are collected in real time at the same frequency and indicator dimensions as in the historical learning phase. A sliding window with the same size W as the learning window is maintained. When data within the window is refreshed, an instantaneous high-dimensional point cloud representing the current instantaneous state of the system is constructed using the same method as in step S11. PC now .

[0033] Secondly, calculation PC now The persistent cohomology features are used to obtain its persistent graph. Dgm now .

[0034] Then, Dgm now With steady-state topology template Tstable A comparison is performed. The purpose of the comparison is to quantify the topological differences between the two and identify the specific sources of these differences. In this embodiment, the Wasserstein distance can be used as a measure of global topological differences. Calculation Dgm now and Tstable Wasserstein distance Δ between corresponding persistent graphs topo .

[0035] Finally, a preset perturbation threshold τ is set. When Δ topo When the value exceeds τ, a significant anomaly in the system topology is determined. At this point, an optimal matching algorithm (such as the Hungarian Algorithm) is executed to find the optimal correspondence between feature points in the two persistent graphs. Dgm now Those who cannot be with TstableAny feature point that forms a matching feature point, or a feature point with an extremely high matching cost, is identified as an anomalous topological feature. These feature points represent newly emerging, disappearing, or significantly changed topological structures within the system's topology.

[0036] It should be noted that the methods for measuring topological differences described above are not limited to Wasserstein distance. In one example, Bottleneck distance can be used, which measures the difference by calculating the maximum-minimum distance between feature point pairs in two persistent graphs. This is suitable for fast detection scenarios sensitive to the most significant topological changes. In another example, Lp-norm distance based on persistent landscape can be used, which calculates the difference by converting the persistent graph into a landscape function in a function space. This is suitable for scenarios requiring richer and more stable feature analysis. Any metric capable of quantifying differences between persistent graphs falls within the scope of this invention.

[0037] For example, following the previous example, at a certain real-time runtime, an instantaneous high-dimensional point cloud is constructed. PC now Persistent graph Dgm now ,and Tstable The Wasserstein distance suddenly spikes to 3.5 (τ=1.0). Optimal matching analysis reveals that... Dgm now A short-lived, independent, newly emerging one-dimensional homology class feature has emerged, which... Tstable There is no corresponding entity in the topology, so it is identified as an anomalous topological feature. The appearance of this anomalous feature indicates that a transient, malfunctioning "loop" has formed inside the system.

[0038] In step S12, by constructing a real-time high-dimensional point cloud, calculating its continuous coherence features, and comparing them with a steady-state template, real-time perception of abnormal deformation of the global topology of the system is achieved. Unlike the fault detection mode that relies on pre-constructed graphs in traditional technologies, this step directly captures anomalies from the overall shape changes of the high-dimensional data point cloud. It solves the problem that faults such as implicit resource competition, which cannot be described by graph models, are difficult to detect, and achieves high coverage and high sensitivity detection effects for multiple types of anomalies.

[0039] S13: Trace the simplex vertices that constitute the abnormal topological features, perform deviation analysis on the instantaneous monitoring data corresponding to the simplex vertices and their historical baselines, and locate the component corresponding to the vertex with the largest deviation as the structural disturbance source causing topological deformation.

[0040] Simplex vertex: In constructing a Vietoris-Rips simplex complex of a high-dimensional point cloud, the most basic 0-dimensional data point that constitutes its basic elements—simplexes (such as edges, triangles, etc.). In the technical context of this invention, each simplex vertex uniquely corresponds to a multi-dimensional monitoring indicator vector of a specific component in the system within a specific time window. Its data structure contains the component's identity and timestamp information, serving as a mapping anchor connecting the abstract topological feature space and the specific physical component.

[0041] Structural disturbance source: This refers to the component ultimately identified in this scheme as the root cause of abnormal deformation in the global topology of the system. It differs from the traditional concept of "root cause" and does not specifically refer to the node where the software failure first occurs. Rather, mathematically, it refers to the component whose drastic fluctuations in monitoring indicators are the primary contributor to the distortion of the high-dimensional point cloud geometry, thereby generating abnormal topological features.

[0042] The specific implementation of this step is as follows: First, in step S12, an instantaneous high-dimensional point cloud is constructed. PC now At the same time, a mapping table is recorded synchronously. Map This table will PC now Each data point in p i (i.e., the aggregated vector of metrics for a component), along with the unique identifier of the component to which it belongs. ID i and timestamp T i One-to-one correspondence. This step serves as a bridge connecting the topological space and the physical world.

[0043] Next, the topological features identified as anomalous in step S12 are analyzed. Taking a newly formed one-dimensional homology class (loop) as an example, its simple complex structure is analyzed to obtain the set of all 1-simplexes (edges) that constitute the "loop". Further, the indices of all non-repeating vertices (0-simplexes) of these 1-simplexes are extracted as Vanomaly.

[0044] Then, based on the vertex index set Vanomaly and the mapping table... Map Query the component identity ID (i.e., identity identifier) ​​corresponding to these vertices.

[0045] Then, for each component in Vanomaly, retrieve its instantaneous monitoring data value at the current moment, and retrieve the historical average monitoring data of that component under the same or similar operating conditions (such as the same period of a week) from the historical baseline in the time dimension.

[0046] Finally, deviation analysis is performed. The standardized offset between the instantaneous monitoring data value of each vertex and its historical baseline value is calculated. In this embodiment, the L2 norm based on multi-dimensional Z-score can be used as this offset. The component corresponding to the vertex with the largest standardized offset is ultimately located as the structural disturbance source causing this topological deformation.

[0047] It should be noted that the above-mentioned deviation analysis methods are not limited to the L2 norm based on Z-scores. In one example, Mahalanobis distance can be used, which, by considering the covariance between the dimensions of each indicator, can more effectively handle scenarios where there is correlation between indicators. In another example, a model trained using unsupervised anomaly detection algorithms such as Isolation Forest can be used, taking the instantaneous data of each vertex as input and directly outputting the anomaly score as the deviation degree. Any technical means that can quantify the degree of deviation of the multidimensional features of a single data point from its historical baseline is within the scope of protection of this invention.

[0048] For example, following the previous example, the abnormal topological features (newly formed loop) identified in step S12 are analyzed. It is found that the vertex indices corresponding to the key "edges" constituting the loop point to "Node-37", "Node-89", and "Node-102". A deviation analysis reveals that among the five-dimensional monitoring metrics of "Node-37", the instantaneous Z-score of "GPU memory bandwidth utilization" is -4.5 (i.e., 4.5 standard deviations lower than the historical average), and its L2 norm is much higher than that of other nodes. Therefore, the system identifies "Node-37" as the structural disturbance source causing the topological deformation of this AI training cluster, indicating that a bottleneck in its GPU memory bandwidth is the root cause of this abnormal loop.

[0049] In step S13, by tracing the simplex vertices that constitute the abnormal topological features and performing multidimensional baseline deviation analysis, a precise reverse mapping and root cause localization from the abstract topological feature space to specific physical components is achieved. This opens up the final key technical link for root cause localization under zero graph dependency conditions and solves the problem that traditional graph methods cannot locate the source of faults propagating in non-call chain.

[0050] In this embodiment, through sequential processing of S11-S13, and through the complete technical link of "steady-state topology template construction - instantaneous topology feature comparison - simplex vertex inverse mapping tracing", the anomaly root cause localization method based on topology association of claim 1 is fully realized. It provides a brand-new solution for intelligent operation and maintenance of large-scale distributed systems that does not rely on any predefined dependency graph and can break through the fundamental technical bottlenecks of traditional methods. It significantly improves the accuracy, robustness and ability to perceive and cover implicit faults in the anomaly root cause localization of complex distributed systems.

[0051] Example 2: Specific construction method of high-dimensional point cloud.

[0052] In this embodiment, during periods of normal system operation, multi-dimensional monitoring indicators of multiple components constituting the system are collected to construct a high-dimensional point cloud representing the global state of the system, including: The system is divided into multiple consecutive time windows during the period of normal operation. Within each time window, the multidimensional monitoring indicators of each target component constituting the system are aggregated by quantiles to generate an aggregated indicator vector of the target component within the time window. The aggregated vectors of the indicators of all the target components within the same time window are used as data points to form the window point cloud corresponding to the time window. Calculate the standardized Euclidean distance between any two data points in the window point cloud, and use the standardized Euclidean distance as a similarity metric to construct the Vietoris-Rips simplex of the window point cloud as a high-dimensional point cloud representing the global state of the system within the time window.

[0053] Quantile aggregation is a data summary statistical method that extracts specific quantile values ​​from the time-series data of various monitoring indicators within a certain time window, compressing a variable-length time series into a fixed-length feature vector. For example, for the CPU utilization indicator, if 30 data points are collected within a 5-minute window, the 25%, 50%, and 75% quantile values ​​can be taken as the features of the indicator within this window, thus compressing the 30-dimensional time-series data into 3-dimensional data. Quantile aggregation can effectively eliminate data noise caused by sampling interval jitter, instantaneous spikes, etc., extract robust statistical information reflecting the main operating status of components within a certain time period, and solve data consistency problems caused by incomplete alignment of sampling times of different components.

[0054] Standardized Euclidean distance: This refers to the distance calculated after Z-score standardization (i.e., subtracting the mean and dividing by the standard deviation) of each dimensional component before calculating the Euclidean distance. Compared to the standard Euclidean distance without any processing, standardized Euclidean distance effectively eliminates the unequal weighting effect on the point cloud geometry caused by the different physical meanings and units of measurement of various monitoring indicators (e.g., CPU is measured as a percentage, network I / O is measured in Mbps, with huge differences in their numerical range and fluctuation amplitude). This ensures that abnormal fluctuations in any dimension are objectively and fairly contributed to and reflected in the distance calculation.

[0055] Vietoris-Rips Simplicial Complex (VR Complex): refers to a method for constructing simple complexes, widely used in topological data analysis. Its construction rule is: given a distance threshold... Below, for any k+1 points in the point cloud, if the distance between each pair of points is less than... These points then span a k-simula. By traversing different... This allows for the construction of a series of simple complexes, forming a filtering sequence for subsequent continuous homology analysis. The reason why this invention prefers Vietoris-Rips complexes is that their construction relies only on pairwise distance information, without requiring prior knowledge of the embedding dimension of the data, making them particularly suitable for processing high-dimensional, sparse operation and maintenance monitoring indicator data.

[0056] The specific implementation of this embodiment is as follows: First, during the learning period of the system without abnormal operation as described in Example 1, the acquisition time is divided into continuous and equal-length time windows, for example, the window length is W=5 minutes.

[0057] Secondly, in each W i Within the window, for each target component (such as a node) in the system N k The component extracts preset quantile values ​​(e.g., 25th, 50th, 75th) from the time-series data of the M-dimensional monitoring indicators it collects. N k In the window W i The states within are aggregated by an index vector of length M×3. v i ,k} represents.

[0058] Then, in the same window W i The aggregate vector of all K components { v i ,1; v i ,2;..., v i K data points constitute a high-dimensional point cloud within this window. PC i .

[0059] Next, based on the similarity between any two vectors, a Vietoris-Rips simplification complex is constructed. This embodiment first performs global standardization on the aggregated vectors generated by all components within all historical windows, that is, calculates the global mean and standard deviation for each dimension, and then performs Z=(X... The μ) / σ transformation yields the standardized vector {v^i,k}. In the standardized vector space, the standardized Euclidean distance between any two points p and q is calculated. dpq .

[0060] Finally, a series of scale parameters are set. For each If the normalized Euclidean distance between any pair of points in a point cloud d pq < Then, construct the corresponding simplexes among them. Combining all these simplexes constitutes the simplex at that scale parameter. We use the Vietoris-Rips simplex complex to characterize the global state of the system, and then use the complex of this series of cross-scale parameters as input for subsequent continuous cohomology calculations.

[0061] In this embodiment, by introducing quantile aggregation, global normalization, and Vietoris-Rips complex construction, the operation and maintenance monitoring data is transformed for the first time into a simple complex filtering sequence without preset embedding dimensions and robust to dimensional differences. This further improves the accuracy and robustness of high-dimensional point clouds in representing the global state of the system, building upon the basic effects achieved in the above embodiments, and lays the foundation for extracting high-quality continuous homology features in the future.

[0062] Example 3: Specific method for generating steady-state topology templates.

[0063] In this embodiment, extracting the persistent homology features of the high-dimensional point cloud as a steady-state topological template includes: Calculate the one-dimensional persistent cohomology of the Vietoris-Rips simple complex within a preset scale range to obtain the corresponding persistent graph; Extract the topological features in the persistent graph corresponding to each time window whose lifespan exceeds a preset persistence threshold to form a robust topological feature set for the time window; Clustering based on Wasserstein distance is performed on the robust topological feature sets of all the time windows. The topological feature clusters corresponding to the cluster centers whose variance in the birth-death coordinate interval is lower than a preset variance threshold are defined as the steady-state topological template.

[0064] One-dimensional persistent cohomology refers to an analytical dimension in persistent cohomology computation that specifically tracks the birth, evolution, and disappearance of one-dimensional topological features (i.e., loops, perforated structures). Unlike zero-dimensional persistent cohomology, which focuses on how connected components of a point cloud merge, one-dimensional persistent cohomology focuses on closed-loop structures. In systems with periodic collaborative communication patterns, such as AI training clusters, this effectively captures the functional closed-loop topology composed of multiple nodes, reflecting their collaborative working logic, and is a key indicator characterizing the functional structure of such systems.

[0065] Persistent graph: A standardized planar visualization of persistent homology features, with the horizontal axis representing the "birth" scale and the vertical axis representing the "death" scale. Each topological feature discovered from persistent homology analysis corresponds to a point (b, d) in the persistent graph. The farther the point is from the diagonal, the longer its lifespan (d) is. b) The longer the length, the higher its topological significance is generally considered to be.

[0066] Birth-death coordinate interval: This refers to the distribution range of multiple persistent graph feature points belonging to the same cluster along the "birth" and "death" axes during the formation of a stable topological template through clustering. The smaller the variance of the birth-death coordinate interval, the more stable the appearance and disappearance locations of the topological feature are across multiple historical observations. It is a core statistic for defining the inherent and stable topological features of a system.

[0067] The specific implementation of this embodiment is as follows: First, regarding each time window during the learning period in Example 2... W i Constructed, across a series of scale parameters The Vietoris-Rips simple complex filtering sequence is used to perform one-dimensional persistent cohomology computation, and the computation process outputs a persistent graph. Dgm i Each point (b, d) in the persistent graph represents a closed-loop structure in the point cloud of that window that is born at scale b and is filled and dies at scale d.

[0068] Secondly, set a preset persistence threshold θ = α × ( max ), where α is a preset coefficient, which can take values ​​between 0.05 and 0.2, preferably 0.1. For each persistent graph Dgm i Only retain the lifetime l=d For feature points where b>θ, noisy feature points that are close to the diagonal and have short lifespans are removed, and the remaining points constitute the robust topological feature set of the window. F i .

[0069] Then, all T historical robust feature sets { F 1,..., F TAll feature points in the cluster are mixed together and a clustering algorithm based on Wasserstein distance is executed. The Wasserstein distance can simultaneously consider the differences in the geometric position of feature points on the "birth-death" plane and the differences in the number of corresponding points. By setting a cluster size or the minimum distance between clusters, the algorithm groups similar feature points into the same cluster.

[0070] Then, for each cluster obtained from the clustering... C m Calculate the centroid (i.e., cluster center) and the variances Var(b) and Var(d) of all points in the cluster at the "birth" and "death" coordinates.

[0071] Finally, set the preset variance threshold. d The variances of all centroid coordinates and cluster-specific coordinates are lower than d Clusters C m The extracted coordinates (or coordinate distribution) of the cluster centers constitute the steady-state topological template of this invention. Tstable This template exists as a set of highly stable, recurring topological feature points.

[0072] It should be noted that existing technologies related to one-dimensional continuous cohomology, persistent graphs, and birth-death coordinate intervals can be found in the relevant knowledge of computational topology, and will not be elaborated here.

[0073] Furthermore, the generation method of the aforementioned steady-state topological template is not limited to clustering methods based on Wasserstein distance. In one example, clustering based on Bottleneck distance can be used, which measures the difference by calculating the maximum and minimum distances between feature point pairs of two persistent graphs. This is suitable for template generation scenarios that are sensitive to the most significant topological changes. In another example, clustering based on the Lp norm distance of persistent landscapes can be used. This involves converting the persistent graph into a landscape function in a function space and then calculating its differences. This is suitable for scenarios that require richer and more stable feature analysis. Any technique capable of extracting stable topological feature clusters from multiple historical persistent graphs falls within the protection scope of this invention.

[0074] For example, following the previous example, we calculate the one-dimensional continuous cohomology for each of the 2016 window point clouds (12 points / hour, 24 hours / day) generated by a 100-node AI cluster over 7 days. We set θ=0.1. maxAfter screening, all robust feature points were clustered. The results showed that a cluster of feature points representing loops formed by some GPU nodes during periodic All-Reduce collective communication was successfully identified and defined as part of the steady-state topology template. The variance of the birth-death coordinate interval was extremely small (Var(b)<0.01, Var(d)<0.01).

[0075] In this embodiment, by introducing persistence threshold screening and robust topological feature clustering based on Wasserstein distance, a statistical learning of the steady-state topological structure of the system is formed. This achieves the effect of automatically extracting the baseline of stable topological invariants from multi-window observation data, further solving the problem of baseline non-robustness caused by fluctuations in the normal state of the system, and significantly improving the accuracy and generalization ability of the steady-state topological template to characterize the normal "shape" of the system.

[0076] Example 4: Specific identification methods for abnormal topological features.

[0077] In this embodiment, please refer to Figure 2 , Figure 2 This is a schematic diagram of the first sub-process of the anomaly root cause localization method based on topological association provided in an embodiment of the present invention. Figure 2 As shown, in this embodiment, the persistent cohomology features of the instantaneous high-dimensional point cloud are calculated, and anomalous topological features are identified from the persistent cohomology features of the instantaneous high-dimensional point cloud by comparing them with the steady-state topological template, including: S21: Calculate the continuous cohomology features of the instantaneous high-dimensional point cloud to obtain the first persistent graph, and use the persistent graph corresponding to the steady-state topology template as the second persistent graph; S22: Calculate the Wasserstein distance between the first persistent graph and the second persistent graph as a quantitative indicator of global topological perturbation. S23: When the global topology perturbation exceeds a preset perturbation threshold, the feature points in the first persistent graph that cannot form an optimal match with any feature point in the second persistent graph are identified as the abnormal topology features.

[0078] Wasserstein distance, also known as Earth Mover's distance, is a metric that measures the difference between two probability distributions or sets of points. In this invention, it treats feature points in one persistent graph as "pile of dirt" to be moved, and feature points in another persistent graph as "pits" to be filled, calculating the minimum total "moving work" required to transform one persistent graph into the other. Compared to other distances that only focus on the most significant differences (such as the Bottleneck distance), Wasserstein distance more comprehensively reflects the overall differences in the quantity, location, and lifetime of topological features, making it a preferred metric for measuring changes in global topology.

[0079] Global topology perturbation: This refers to a quantitative index used to characterize the degree of difference in topology between the instantaneous state and steady state of a system, as measured by the Wasserstein distance. The larger the value of this quantitative index, the further the current global topology of the system deviates from its baseline form during healthy operation, and the higher the probability of anomalies.

[0080] The specific implementation of this embodiment is as follows: First, during the online detection phase, real-time monitoring data is acquired and an instantaneous high-dimensional point cloud is constructed. PC now Calculate its persistent cohomology features to obtain the first persistent graph. Dgm now Simultaneously, the steady-state topological template Tstable generated in Example 1 or 3 is directly used as the second persistent graph in the form of its cluster centroid set. Dgm stable .

[0081] Secondly, calculation Dgm now and Dgm stable The Wasserstein distance between the two graphs needs to be calculated by projecting both graphs onto the same "birth-death" coordinate system. To simplify the calculation, only the projections of their respective diagonals can be calculated, or an approximate solution can be obtained using the Sinkhorn algorithm or similar methods. The result is denoted as Δ. topo , as a quantitative indicator of global topology perturbation.

[0082] Then, Δ topo The result is compared with a preset perturbation threshold τ. The threshold τ can be determined based on the Wasserstein distance sequence of the historical learning period, for example, taking k times the historical mean (k>3).

[0083] Finally, when Δ topoWhen the time is greater than τ, determine which specific topological structures have changed. This can be achieved by solving an optimal transport or assignment problem (such as using the Hungarian algorithm). Dgm now Finding points in Dgm stable Or the best match on the diagonal. Dgm now Those in the middle and Dgm stable No point in the set can form a low-cost match (e.g., the matching cost exceeds a preset cost threshold). C max The "isolated points" were ultimately identified as anomalous topological features, representing a newly generated topological structure that had never appeared in the healthy state of the system.

[0084] For example, continuing from the previous example, at the moment a fault occurs, Δ is calculated. topo =3.5, far exceeding the threshold τ=1.0 set based on historical data. Optimal matching revealed that... Dgm now There is a feature point with coordinates (2.1, 2.5). Dgm stable There were no points in the corresponding region, and matching it with the diagonal would be extremely costly. Therefore, this point was successfully identified as an anomalous topological feature of this fault.

[0085] In this embodiment, by introducing Wasserstein distance as a global perturbation metric and extracting anomalous features based on optimal matching, a complete process from "quantification of degree" to "precise localization" of system topology deformation is achieved. This further solves the problem of how to decompose the overall difference into specific sources of anomalies, significantly improving the accuracy and interpretability of anomalous topology feature identification.

[0086] Example 5: Anomaly feature recognition based on multi-scale barcodes.

[0087] In this embodiment, when the global topology perturbation exceeds a preset perturbation threshold, feature points in the first persistent graph that cannot form an optimal match with any feature point in the second persistent graph are identified as the abnormal topology features, including: At N different preset scales, instantaneous continuous cohomology barcodes of the instantaneous high-dimensional point cloud and steady-state continuous cohomology barcodes of the steady-state topological template are constructed respectively, where N is a natural number; At each preset scale, calculate the lifetime of each homology class in the instantaneous continuous homology barcode and the relative rate of change of the lifetime of the corresponding homology class in the steady-state continuous homology barcode; Homologous classes whose relative rate of change exceeds a preset rate of change threshold are identified as anomalous topological features.

[0088] Persistent coherence barcodes: These are another standardized and visual representation of persistent coherence features. They draw a horizontal line segment for each discovered topological feature, with the left endpoint representing the "birth" scale and the right endpoint representing the "death" scale. Compared to persistent graphs, persistent coherence barcodes more intuitively display the lifecycle and quantity of each topological feature.

[0089] The specific implementation of this embodiment is as follows: First, select N representative discrete scale parameters to construct a multi-scale analysis scale set { 1, 2,..., N}, where N is a natural number.

[0090] Secondly, for each scale j The instantaneous high-dimensional point cloud and the steady-state topological template at this scale are traversed separately. All existing homology classes and their lifetimes are counted and recorded. The results are then organized into instantaneous persistent homology barcodes. steady-state continuous coherence barcode .

[0091] Then, at each scale, the two barcodes are compared. For For each homology class in the dataset, search for... The homology class with the closest "birth" scale is taken as its corresponding term. The relative rate of change of the life cycle of this homology class is calculated, i.e., | l now l stable | / l stable .

[0092] Finally, set a preset rate of change threshold. r (For example, 20%). When the relative rate of change of the lifetime of a certain homogeneous class exceeds... r , or in If no corresponding item (representing a newborn) can be found in the table, it is identified as an anomalous topological feature.

[0093] It should be noted that the above-mentioned multi-scale anomaly feature identification methods are not limited to methods based on the relative rate of change of the life cycle. In one example, a determination method based on the absolute change of homology class persistence can be used to identify homology classes whose life cycle changes exceed a preset absolute threshold as anomalies; in another example, a comprehensive determination can be made by combining the birth position offset and death position offset of homology classes. Any technical means that can compare barcode differences and identify abnormal homology classes at multiple preset scales is within the protection scope of this invention.

[0094] For example, following the previous example, in Δ topo Once the threshold is exceeded, the system operates in parallel at three scales ( A barcode is constructed using the following parameters: (0.8, 1.0, 1.2). At a scale of 1.2, it was found that BC now A homology class representing a loop has a lifespan that is longer than... BC stable The lifecycle of the corresponding homology class was shortened by 60% (far exceeding the threshold). r =20%), so the homology class was identified as an anomaly, indicating that the stability of the loop had been severely compromised.

[0095] In this embodiment, by constructing a multi-scale continuously homogeneous barcode and calculating the relative change rate of the lifetime, parallel and independent detection of subtle changes in topological features at different resolutions is achieved. This further solves the problem that a single Wasserstein distance may miss, and that the local structure has undergone significant deformation without affecting global matching, thus significantly improving the sensitivity and fine granularity of anomaly detection.

[0096] Example 6: Preprocessing to improve the robustness of Wasserstein distance calculation.

[0097] In this embodiment, before calculating the Wasserstein distance between the first persistent graph and the second persistent graph, the method further includes: The first persistent image is resampled so that the first persistent image and the second persistent image have the same number of feature points; wherein, feature points whose birth-death coordinates are located within a preset range below the diagonal of the persistent image are removed during resampling.

[0098] The specific implementation of this embodiment is as follows: First, examine the first persistent graph before calculating the Wasserstein distance. Dgm now With the second persistent graph Dgm stable The number of feature points in the system. Due to the fluctuating nature of the system's instantaneous state, Dgmnow The points awarded are often higher than those awarded for stability. Dgm stable .

[0099] Secondly, if the two quantities are different, then the one with more points... Dgm now Perform resampling to make its number of points the same as Dgm stable Consistency. The principle of resampling is to prioritize retaining salient feature points with longer lifecycles and farther from the diagonal.

[0100] Then, during the resampling process, a noise removal region is forcibly defined. Specifically, for birth-death coordinates that satisfy... d b < d noise (i.e., feature points located within a preset range near the diagonal) are directly removed during resampling. d noise The setting can be based on the noise level of historical data, typically 0.05 multiplied by the maximum scale.

[0101] Finally, the standardized data (consistent number of points and distribution) will be processed... and Dgm stable Perform Wasserstein distance calculation.

[0102] It should be noted that the above resampling and noise removal methods are not limited to methods based on a preset range below the diagonal. In one example, a truncation method based on feature point persistence ranking can be used to retain the top K feature points with the highest persistence; in another example, a clustering method based on feature point density can be used to remove feature points in regions with excessively low density. Any technical means that enables two persistent images to be compared to have comparable scale and removes noise features falls within the protection scope of this invention.

[0103] In this embodiment, by resampling the persistent graph and removing noise features as preprocessing, the two objects to be compared are placed under "equal conditions" and "clean background". This further solves the problem of Wasserstein distance calculation distortion caused by differences in data point size and short-lifetime noise, and significantly improves the accuracy and robustness of the global topological perturbation metric.

[0104] Example 7: Feedback verification of positioning results and adaptive relocation.

[0105] In this embodiment, after identifying the component corresponding to the vertex with the largest deviation as the structural disturbance source causing topological deformation, the method further includes: Acquire real-time monitoring data for the next time window after positioning is completed, construct a feedback instantaneous high-dimensional point cloud, and calculate its continuous cohomology features; The continuous homology features of the instantaneous high-dimensional point cloud are compared again with the steady-state topological template; When the comparison results show that the abnormal topological features have disappeared or the global topological disturbance degree has fallen back to below the preset disturbance threshold, the location of the structural disturbance source is confirmed to be valid; otherwise, the tracing and deviation analysis steps are re-executed to locate new structural disturbance sources.

[0106] The specific implementation of this embodiment is as follows: First, after root cause localization is completed in step S13 of Example 1, the system does not directly terminate the process, but instead starts a feedback verification timer. When the next complete time window begins, monitoring metrics of all components are collected again to construct a feedback instantaneous high-dimensional point. PC feedback .

[0107] Secondly, for PC feedback Calculate its persistent cohomology characteristics and compare them again with the steady-state topology template to calculate the global topology perturbation degree. Alternatively, check whether previously identified anomalous topological features still exist.

[0108] Then, the location validity is determined. If If the disturbance level has fallen below the preset disturbance threshold τ, or if the previously identified abnormal topological feature points have disappeared from the persistent map, then the fault has been eliminated, and the structural disturbance source located this time is accurate and effective.

[0109] Finally, if If the value remains above the threshold, or if abnormal topological features persist, it means that the previous location may have been inaccurate (e.g., a symptom point was located instead of the root cause), or that multiple sources of failure exist. In this case, the system automatically triggers a relocation process, excluding the already located components, and re-executes the tracing and deviation analysis steps of step S13 in Embodiment 1 in the remaining vertices to locate new and more accurate sources of structural disturbance.

[0110] It should be noted that the aforementioned feedback verification and adaptive relocation mechanism is not limited to a single verification method based on the next time window. In one example, data from multiple time windows can be continuously collected for multiple verifications. When the global topology perturbation degree of N consecutive windows all falls below the threshold, the positioning is confirmed to be effective. In another example, a step-by-step elimination strategy can be adopted during relocation, successively eliminating the components with the highest deviation until the system returns to steady state. Any technical means that can verify the effectiveness of positioning based on post-positioning feedback data and re-execute the tracing steps when positioning is inaccurate is within the scope of protection of this invention.

[0111] This embodiment creatively solves the problem of misjudgment that may be caused by one-time positioning in traditional anomaly positioning by introducing a feedback verification and adaptive repositioning closed-loop mechanism after positioning. It realizes online confirmation and automatic error correction of the validity of positioning results, further solves the problem that the initial positioning may be inaccurate, and significantly improves the reliability and autonomy of the anomaly root cause positioning system.

[0112] Example 8: Specific tracing method based on simplex vertex inverse mapping.

[0113] In this embodiment, please refer to Figure 3 , Figure 3 This is a schematic diagram of the second sub-process of the anomaly root cause localization method based on topological association provided in an embodiment of the present invention. For example... Figure 3 As shown, in the embodiment described, the simplex vertices constituting the abnormal topological features are traced, and the instantaneous monitoring data corresponding to the simplex vertices are analyzed for deviation from their historical baselines. The component corresponding to the vertex with the largest deviation is identified as the structural disturbance source causing the topological deformation, including: S31: When constructing the instantaneous high-dimensional point cloud, record the mapping relationship between each data point and the identity identifier and timestamp of its component; S32: Analyze the simplex that constitutes the anomalous topological feature, and obtain the indices of all vertices of the anomalous topological feature; S33: Based on the index and the mapping relationship, query the identity of all vertices and retrieve the historical monitoring data value of each vertex in the corresponding time window of the historical baseline; S34: Calculate the standardized offset between the instantaneous monitoring data value and the historical monitoring data value of each vertex, and locate the component corresponding to the vertex with the largest standardized offset as the structural disturbance source.

[0114] Simplex: In computational topology, it refers to the basic geometric element that constructs a simplex complex. In this invention, a simplex can be a 0-simplex (point) consisting of one vertex, a 1-simplex (edge) consisting of two vertices, or a 2-simplex (triangle) consisting of three vertices, etc.

[0115] Vertex index: refers to the index used in constructing a transient high-dimensional point cloud. PC now In a simple complex, a computer program assigns a unique numerical number or position number to each data point that represents the state of a component. This index is the basis for the program to perform calculations and references on each data point. In a simple complex, vertices are identified by their indexes.

[0116] Historical baseline: refers to stored historical operating data comparable to the current system time window. In this embodiment, the historical baseline is a database composed of statistical values ​​(such as mean and quantiles) of monitoring data of each component within each specific time window (such as 15:00-15:05 every Tuesday) over a long period of time (such as several weeks). Using historical data under the same operating conditions as the baseline can effectively eliminate the interference of normal periodic fluctuations in the system (such as the load difference between weekdays and weekends).

[0117] Standardized offset: A standardized numerical indicator used to quantify the degree to which a component's current state deviates from its historical baseline. By eliminating dimensional and variance differences, standardized offset enables an objective and impartial comparison of the overall anomaly degree of different components and indicators across different dimensions under a unified scale.

[0118] The specific implementation of this embodiment is as follows: First, in step S12 of Example 1, an instantaneous high-dimensional point cloud is constructed. PC now At the same time, a mapping dictionary is generated and maintained in parallel. Map The dictionary Map The key ( Key ) is the index of each data point in the point cloud; the corresponding value ( Value ) is a data structure that contains the identity of the component from which the data point originates and the timestamp of the data collection.

[0119] Secondly, after step S12 identifies an anomalous topological feature, the Vietoris-Rips simplicial complex structure constituting that feature is analyzed. For example, if the anomalous feature is a newly formed one-dimensional homology class, the indices of the vertices of all non-repeating 0-simplicials involved in all simplexes (edges) forming this "loop" are extracted to form the source index set V={ idx 1, idx 2,...}.

[0120] Then, iterate through the index set V, taking each index as an index. idx As the key, in the mapping dictionary Map A query was performed to obtain a list of identifiers for suspicious components. ID 1, ID 2,...}.

[0121] Next, deviation analysis was performed on each suspicious component. Based on its... ID With the label of the current time window, retrieve historical monitoring data values ​​(such as historical average values ​​for the same period) from the historical baseline database under the same or similar operating conditions.

[0122] Finally, the standardized offset is calculated. The following scheme can be used to calculate the vector of instantaneous monitoring data values ​​for each suspected component at the current moment. x now Its historical baseline vector m history Standardized offset between S All suspicious components were processed according to their... S Sort the values ​​and normalize the offsets. S The component corresponding to the vertex with the largest value is ultimately located and output as the structural disturbance source.

[0123] For example, following the previous example, after identifying the anomalous topological features (newly formed rings) in step S12, the system analyzes and finds that its features are composed of vertex indices "37, 89, 102", etc. This is done within the simultaneously maintained mapping dictionary. Map A query confirmed that the three indexes point to "Node-37", "Node-89", and "Node-102" respectively. The average values ​​of various indicators for these three nodes over the past 7 days were retrieved from the historical baseline database. The comprehensive standardized offset of Node-37 was then calculated. S Node 37 =5.8, which is much higher than 0.9 for Node-89 and 1.2 for Node-102. Therefore, the system finally outputs "The root cause of this exception is: Node-37".

[0124] In this embodiment, by explicitly recording mapping relationships, parsing topology structures, performing dictionary-style fast queries, and calculating comprehensive deviations, a complete reverse mapping tracing mechanism with a rigorous logical link is constructed, tracing back from "topology anomaly features" to "physical root cause components." This further solves the problem of how to translate abstract topology analysis results into specific operation and maintenance objects, and achieves end-to-end automated and accurate location of anomaly root causes.

[0125] Example 9: Implementation of specific root cause localization based on the linkage analysis of associated vertices.

[0126] In this embodiment, before locating the component corresponding to the vertex with the largest normalized offset as the structural disturbance source, the method further includes: Obtain all associated simplex vertices of the component corresponding to the vertex with the largest normalized offset; Calculate the comprehensive deviation index of all associated simplex vertices, wherein the comprehensive deviation index is a weighted average of the standardized offsets of the associated simplex vertices, and the weights are determined based on the persistent contribution of each associated simplex vertex to the anomalous topological feature; When the ratio of the offset of the vertex with the largest standardized offset to the combined deviation index of all its associated simplex vertices is lower than a preset attribution confidence threshold, the component corresponding to the vertex with the largest standardized offset, together with the component with the highest combined deviation index among its associated simplex vertices, is jointly located as the associated structural disturbance source group that causes topological deformation.

[0127] Associated simplex vertices: In the simplex complex structure that constitutes the anomalous topological feature, other vertices that are directly connected to the vertex with the largest offset through a simplex (such as an edge or triangle) and are "bound" to each other because they jointly participate in forming the anomalous feature. The components represented by these vertices have a close coupling relationship with the component with the largest offset in the faulty topology.

[0128] Preset attribution confidence threshold: This refers to the decision threshold used to determine whether a failure should be attributed to multiple related components. Its value is typically set between 0.5 and 2.0. The logic behind setting this threshold is as follows: if the failure is caused independently by a single root cause component, its offset should be significantly greater than that of other related components; conversely, if the component with the largest offset is not significantly different from the average deviation of its related components, the cause of the failure is likely a common, implicit abnormal interaction behavior of that group of components.

[0129] The specific implementation of this embodiment is as follows: First, in Example 8, the vertex with the largest offset is located. v max and their corresponding offsets S max Instead of immediately taking this as the final result, we use spanning tree or hierarchical clustering methods to search for vertices within the simplex representing anomalous topological features. v max The set of all associated simplex vertices with topological connectivity. V assoc .

[0130] Secondly, obtain V assoc Each vertex v j Standardized offset S j .

[0131] Then, calculate V assoc The comprehensive deviation index Sˉ assoc The index can be calculated using a weighted average, with its weights... w j This is the key to the solution, and its weight is... w j Based on the vertex vj The contribution of the vertex to the initial identification of the anomalous topological feature is used to determine this. Specifically, it can be defined as the vertex. v j The proportion of lifecycle changes of this anomalous feature caused by removal or perturbation, or the participation of the vertex as a key "birth" or "death" moment of the simplex in continuous cohomology calculation.

[0132] Next, the attribution confidence ratio is calculated. R = S max / Sˉ assoc .

[0133] Finally, a decision is made. When R Greater than or equal to the preset attribution confidence threshold k (For example, k When =1.5), it indicates v max If the anomaly is significantly isolated and dominant, then it should be independently located according to the scheme of Example 8. v max The corresponding component. When R < k This indicates that the fault is caused by a group of interconnected components. At this point, the localization strategy changes: the system will... v max The corresponding components, along with V assoc One or more components with the highest comprehensive deviation index are collectively identified as a group of related structural disturbance sources and output.

[0134] It should be noted that the above-mentioned methods for analyzing the linkage of related vertices are not limited to a comprehensive deviation index weighted by persistent contribution. In one example, a weight determination method based on the topological centrality of related vertices can be used, assigning weights according to the betweenness centrality or degree centrality of each related vertex in the anomalous topological features; in another example, a comprehensive evaluation method based on cluster ensemble can be used, determining the related component group through the ensemble results of multiple deviation calculation methods. Any technical means that can perform comprehensive deviation evaluation based on the topological characteristics of related vertices and determine whether multi-component attribution exists falls within the protection scope of this invention.

[0135] For example, continuing from the previous example, suppose Node-37's S max =5.8, its associated vertices are Node-89 and Node-102, their S The values ​​are 0.9 and 1.2, but calculations show that Node-89 has an extremely high sustained contribution weight in constituting anomalous topological features, causing the weighted composite to deviate from the index. Sˉassoc It reached 4.5. At this point... R =5.8 / 4.5≈1.29, which is lower than the set threshold. k =1.5. Therefore, the system determined that this was an associated fault, and identified Node-37 and Node-89, which contributed the most, as the "associated structure disturbance source group", suggesting that abnormal communication between the two may have caused cluster topology distortion.

[0136] This embodiment introduces a linkage analysis mechanism based on continuous contribution weighting of associated vertices, which changes the limitation of the traditional "single-point attribution" localization method. It realizes the identification and group localization of implicit associated faults caused by tight topological coupling between components, and further solves the technical problem of distinguishing between "primary cause" and "accomplice" in fault propagation. It significantly improves the localization accuracy and the comprehensiveness of operation and maintenance decisions when facing complex associated faults.

[0137] Example 10: Specific implementation of calculating the standardized offset.

[0138] In this embodiment, calculating the standardized offset between the instantaneous monitoring data value and its historical monitoring data value for each vertex includes: Obtain the instantaneous value and historical baseline mean of the component corresponding to the vertex in each dimension of the monitoring index; Calculate the difference between the instantaneous value of each monitoring indicator and the mean of the historical baseline for that dimension, and divide it by the standard deviation of the historical baseline for that dimension to obtain the single-dimensional Z-score of the component in each dimension. The L2 norm of all the aforementioned one-dimensional Z-scores is taken as the standardized offset.

[0139] The specific implementation of this embodiment is as follows: First, for components that require offset calculation C k Obtain the instantaneous vector composed of its M-dimensional monitoring indicators at the current moment. x =( x 1, x 2,..., x M Simultaneously, from the historical baseline database, the historical mean vector of this component under the same operating conditions as the current time window is retrieved. m =( m 1, m 2,..., m M ) and historical standard deviation vector s =( s 1, s 2,..., s M ).

[0140] Secondly, for each monitoring metric dimension m (1≤m≤M) of this component, calculate its one-dimensional Z-score: This step unifies indicators with different dimensions and fluctuation ranges onto the same dimensionless Z-score scale, whose value represents the standard deviation multiple of the deviation from the historical mean.

[0141] Finally, M The individual Z-scores are combined to form a deviation vector. z =( z 1, z 2,..., z M ), calculate the L2 norm (Euclidean norm) of the vector as the final standardized offset. S =∥z∥2, this metric comprehensively considers the deviation of the component across all dimensions, and is a comprehensive measure of anomalies.

[0142] It should be noted that the calculation method for the standardized offset described above is not limited to the L2 norm based on a single-dimensional Z-score. In one example, the L1 norm (Manhattan distance) can be used as the comprehensive offset, suitable for scenarios where the contribution of each indicator dimension needs to be evaluated independently; in another example, the L∞ norm (Chebyshev distance) can be used, taking the maximum deviation of each dimension as the comprehensive offset, suitable for scenarios focusing on the performance of the most anomalous dimension. Any standardized calculation method that can uniformly measure the degree of deviation of multi-dimensional indicators falls within the protection scope of this invention.

[0143] This embodiment provides a rigorous multidimensional baseline deviation quantification scheme through the calculation method of "single-dimensional Z-score + L2 norm", thereby further solving the problem of how to scientifically and uniformly measure the degree of anomaly under multiple indicator dimensions, making the positioning results have repeatable and verifiable mathematical basis, and improving the decision credibility of automated operation and maintenance.

[0144] The anomaly root cause localization methods based on topological association described in the above embodiments can be recombined as needed to obtain combined implementation schemes, but all are within the protection scope claimed by this invention.

[0145] In one embodiment, a computer device is provided, which may be a server, such as a server-side device, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a topology-based root cause localization method on the server side.

[0146] Those skilled in the art will understand that the methods provided in the embodiments of the present invention can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. The methods can also be implemented as a computer program product stored in one or more computer-readable storage media, including but not limited to: disks, optical disks, read-only memory (ROM), random access memory (RAM), flash memory, etc. When the computer program product is executed by one or more data processing devices (such as computers), the devices perform the steps as described in any of the preceding method embodiments.

[0147] The software tools, components, or models not belonging to our company that appear in the embodiments of this invention are merely illustrative examples and do not represent actual use.

[0148] The data collection in this embodiment of the invention complies with the requirements of relevant laws and regulations, such as the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China, GDPR (General Data Protection Regulation of the European Union), or information security standards of other countries and regions.

[0149] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for locating the root causes of anomalies based on topological association, characterized in that, include: During the period when the system is operating without abnormalities, multidimensional monitoring indicators of multiple components constituting the system are collected, a high-dimensional point cloud representing the global state of the system is constructed, and the continuous cohomology features of the high-dimensional point cloud are extracted as a steady-state topology template. Multidimensional monitoring indicators of the multiple components are collected in real time to construct an instantaneous high-dimensional point cloud. The continuous cohomology features of the instantaneous high-dimensional point cloud are calculated, and abnormal topological features are identified from the continuous cohomology features of the instantaneous high-dimensional point cloud by comparing them with the steady-state topological template. Tracing the simplex vertices that constitute the abnormal topological features, performing deviation analysis on the instantaneous monitoring data corresponding to the simplex vertices and their historical baselines, and identifying the component corresponding to the vertex with the largest deviation as the structural disturbance source causing topological deformation.

2. The anomaly root cause localization method based on topological association as described in claim 1, characterized in that, During periods of normal system operation, multi-dimensional monitoring metrics of multiple components constituting the system are collected to construct a high-dimensional point cloud representing the global state of the system, including: The system is divided into multiple consecutive time windows during the period of normal operation. Within each time window, the multidimensional monitoring indicators of each target component constituting the system are aggregated by quantiles to generate an aggregated indicator vector of the target component within the time window. The aggregated vectors of the indicators of all the target components within the same time window are used as data points to form the window point cloud corresponding to the time window. Calculate the standardized Euclidean distance between any two data points in the window point cloud, and use the standardized Euclidean distance as a similarity metric to construct the Vietoris-Rips simplex of the window point cloud as a high-dimensional point cloud representing the global state of the system within the time window.

3. The anomaly root cause localization method based on topological association as described in claim 2, characterized in that, Extracting the persistent homology features of the high-dimensional point cloud as a steady-state topological template includes: Calculate the one-dimensional persistent cohomology of the Vietoris-Rips simple complex within a preset scale range to obtain the corresponding persistent graph; Extract the topological features in the persistent graph corresponding to each time window whose lifespan exceeds a preset persistence threshold to form a robust topological feature set for the time window; Clustering based on Wasserstein distance is performed on the robust topological feature sets of all the time windows. The topological feature clusters corresponding to the cluster centers whose variance in the birth-death coordinate interval is lower than a preset variance threshold are defined as the steady-state topological template.

4. The anomaly root cause localization method based on topological association as described in claim 1, characterized in that, Calculate the persistent cohomology features of the instantaneous high-dimensional point cloud, and identify anomalous topological features from the persistent cohomology features of the instantaneous high-dimensional point cloud by comparing them with the steady-state topological template, including: The continuous cohomology features of the instantaneous high-dimensional point cloud are calculated to obtain the first persistent graph, and the persistent graph corresponding to the steady-state topology template is used as the second persistent graph. Calculate the Wasserstein distance between the first persistent graph and the second persistent graph as a quantitative indicator of global topological perturbation. When the global topology perturbation exceeds a preset perturbation threshold, feature points in the first persistent graph that cannot form an optimal match with any feature point in the second persistent graph are identified as abnormal topology features.

5. The anomaly root cause localization method based on topological association as described in claim 4, characterized in that, When the global topology perturbation exceeds a preset perturbation threshold, feature points in the first persistent graph that cannot form an optimal match with any feature point in the second persistent graph are identified as the abnormal topology features, including: At N different preset scales, instantaneous continuous cohomology barcodes of the instantaneous high-dimensional point cloud and steady-state continuous cohomology barcodes of the steady-state topological template are constructed respectively, where N is a natural number; At each preset scale, calculate the lifetime of each homology class in the instantaneous continuous homology barcode and the relative rate of change of the lifetime of the corresponding homology class in the steady-state continuous homology barcode; Homologous classes whose relative rate of change exceeds a preset rate of change threshold are identified as anomalous topological features.

6. The anomaly root cause localization method based on topological association as described in claim 4, characterized in that, Before calculating the Wasserstein distance between the first persistent graph and the second persistent graph, the following steps are also included: The first persistent image is resampled so that the first persistent image and the second persistent image have the same number of feature points; wherein, feature points whose birth-death coordinates are located within a preset range below the diagonal of the persistent image are removed during resampling.

7. The anomaly root cause localization method based on topological association as described in any one of claims 4-6, characterized in that, After identifying the component corresponding to the vertex with the largest deviation as the structural disturbance source causing topological deformation, the following is also included: Acquire real-time monitoring data for the next time window after positioning is completed, construct a feedback instantaneous high-dimensional point cloud, and calculate its continuous cohomology features; The continuous homology features of the instantaneous high-dimensional point cloud are compared again with the steady-state topological template; When the comparison results show that the abnormal topological features have disappeared or the global topological disturbance degree has fallen back to below the preset disturbance threshold, the location of the structural disturbance source is confirmed to be valid; otherwise, the tracing and deviation analysis steps are re-executed to locate new structural disturbance sources.

8. The anomaly root cause localization method based on topological association as described in claim 1, characterized in that, Tracing the simplex vertices that constitute the anomalous topological features, performing deviation analysis on the instantaneous monitoring data corresponding to the simplex vertices and their historical baselines, and identifying the components corresponding to the vertices with the largest deviations as structural disturbance sources causing topological deformation, including: When constructing the instantaneous high-dimensional point cloud, the mapping relationship between each data point and the identity identifier and timestamp of its component is recorded; The simplex constituting the anomalous topological feature is analyzed to obtain the indices of all vertices of the anomalous topological feature; Based on the index and the mapping relationship, query the identity of all vertices and retrieve the historical monitoring data value of each vertex in the corresponding time window of the historical baseline; Calculate the standardized offset between the instantaneous monitoring data value and the historical monitoring data value of each vertex, and locate the component corresponding to the vertex with the largest standardized offset as the structural disturbance source.

9. The anomaly root cause localization method based on topological association as described in claim 8, characterized in that, Before locating the component corresponding to the vertex with the largest standardized offset as the structural disturbance source, the method further includes: Obtain all associated simplex vertices of the component corresponding to the vertex with the largest normalized offset; Calculate the comprehensive deviation index of all associated simplex vertices, wherein the comprehensive deviation index is a weighted average of the standardized offsets of the associated simplex vertices, and the weights are determined based on the persistent contribution of each associated simplex vertex to the anomalous topological feature; When the ratio of the offset of the vertex with the largest standardized offset to the combined deviation index of all its associated simplex vertices is lower than a preset attribution confidence threshold, the component corresponding to the vertex with the largest standardized offset, together with the component with the highest combined deviation index among its associated simplex vertices, is jointly located as the associated structural disturbance source group that causes topological deformation.

10. The anomaly root cause localization method based on topological association as described in claim 8 or 9, characterized in that, Calculate the normalized offset between the instantaneous monitoring data value and its historical monitoring data value for each vertex, including: Obtain the instantaneous value and historical baseline mean of the component corresponding to the vertex in each dimension of the monitoring index; Calculate the difference between the instantaneous value of each monitoring indicator and the mean of the historical baseline for that dimension, and divide it by the standard deviation of the historical baseline for that dimension to obtain the single-dimensional Z-score of the component in each dimension. The L2 norm of all the aforementioned one-dimensional Z-scores is taken as the standardized offset.

Images