Fault detection method, device, apparatus and storage medium

Abstract

The application relates to the technical field of network center operation and maintenance, in particular to a fault detection method and device, equipment and a storage medium; the method is applied to a data center network, comprising the following steps: when detecting abnormal network side data, calling a network side analysis model to analyze the abnormal network side data, obtaining network side abnormal analysis results; determining whether there is abnormal end side according to the abnormal network side data; when determining that there is abnormal end side, calling an end side analysis model to analyze the network side abnormal analysis results and the abnormal network side data, obtaining end side abnormal analysis results; the network side analysis model and the end side analysis model are both constructed based on a large language model; and determining a fault root cause according to the network side abnormal analysis results and the end side abnormal analysis results. The scheme can improve the fault detection efficiency.

Description

Technical Field

[0001] This application relates to the technical field of network center operation and maintenance, and in particular to a fault detection method, apparatus, device and storage medium. Background Technology

[0002] The network architecture of a data center network includes the network side (core layer + aggregation layer switches) for accessing the Internet / users, and the endpoint side (access layer and individual servers / virtual machines) for connecting servers. In related technologies, for the operation and maintenance of hyperscale data center networks, the endpoint side and the network side are usually treated as independent management domains, meaning that fault analysis on the endpoint side and the network side is independent. Whether a fault occurs on the endpoint side or the network side, the corresponding operation and maintenance personnel must manually trace back the logs and build hypotheses based on experience to verify each item one by one before the fault can be located.

[0003] However, this operation and maintenance method in related technologies has gradually revealed many drawbacks; firstly, manual log backtracking is slow, and secondly, fault location relies heavily on expert experience; these two reasons have led to low efficiency in fault detection of data center networks.

[0004] Therefore, improving the efficiency of data center network fault detection is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide a fault detection method, device, computer equipment, and storage medium that can improve the efficiency of fault detection in data center networks, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a fault detection method applied to a data center network, the method comprising:

[0007] When abnormal data is detected on the network side, the network side analysis model is invoked to analyze the abnormal data and obtain the abnormal data analysis results.

[0008] Based on the network-side anomaly data, determine whether there are end-side anomalies;

[0009] When an edge-side anomaly is determined to exist, the edge-side analysis model is invoked to analyze the network-side anomaly analysis results and the network-side anomaly data to obtain the edge-side anomaly analysis results; both the network-side analysis model and the edge-side analysis model are built based on the large language model;

[0010] Based on the network-side anomaly analysis results and the end-side anomaly analysis results, the root cause of the fault is determined.

[0011] In one embodiment, the step of calling the network-side analysis model to analyze the network-side abnormal data and obtaining network-side abnormal analysis results includes:

[0012] The network-side analysis model is invoked to analyze the network-side abnormal data and determine the first execution order of each network-side detection dimension;

[0013] According to the first execution order, the detection tools corresponding to each of the network-side detection dimensions are called sequentially to perform detection and obtain the network-side anomaly analysis results.

[0014] In one embodiment, determining whether an end-side anomaly exists based on the network-side anomaly data includes:

[0015] Determine the network-side anomaly type and / or network-side anomaly magnitude of the network-side abnormal data;

[0016] A query is performed in the identifier table to determine whether the network-side anomaly type and / or the network-side anomaly magnitude exist in the identifier table; the identifier table includes multiple anomaly types and anomaly magnitudes related to end-side anomalies.

[0017] If the network-side anomaly type and / or the network-side anomaly magnitude exist in the identification table, then an end-side anomaly is determined to exist.

[0018] In one embodiment, the network-side anomaly analysis result includes the network-side anomaly range and the network-side anomaly time. The endpoint analysis model is invoked to analyze the network-side anomaly analysis result and the network-side anomaly data to obtain the endpoint anomaly analysis result, including:

[0019] Based on the network-side anomaly range and network topology, determine the impact range on the endpoint.

[0020] The endpoint analysis model is invoked to analyze the analysis object, and the endpoint anomaly analysis results are obtained; the analysis object includes the endpoint's influence range, the network-side anomaly time, and the network-side anomaly data.

[0021] In one embodiment, determining the root cause of the fault based on the network-side anomaly analysis results and the endpoint-side anomaly analysis results includes:

[0022] The network-side anomaly analysis results, the endpoint-side anomaly analysis results, and historical fault events are used to construct a collaborative analysis template; the historical fault events include historical fault data, historical fault causes, and historical fault ranges.

[0023] The collaborative analysis model is used to process the collaborative analysis template to determine the root cause of the failure.

[0024] In one embodiment, the collaborative analysis model is the end-side analysis model.

[0025] In one embodiment, the method further includes:

[0026] When abnormal data is detected on the edge, the edge analysis model is invoked to analyze the object and obtain the edge anomaly analysis result; the object of analysis is the abnormal data on the edge.

[0027] In one embodiment, the step of calling the endpoint analysis model to analyze the analysis object and obtain endpoint anomaly analysis results includes:

[0028] The endpoint analysis model is invoked to analyze the analysis object, and the second execution order of each endpoint detection dimension is determined.

[0029] According to the second execution order, the detection tools corresponding to each of the edge detection dimensions are called sequentially to perform detection and obtain the edge anomaly analysis results.

[0030] Secondly, this application also provides a fault detection device applied to a data center network. The device includes a network-side intelligent agent, an evaluation module, an edge-side intelligent agent, and a collaborative analysis module, wherein:

[0031] When the network-side intelligent agent detects abnormal network-side data, it calls the network-side analysis model to analyze the abnormal network-side data and obtain the network-side abnormality analysis results.

[0032] The evaluation module is used to determine whether there is an end-side anomaly based on the network-side anomaly data;

[0033] The edge-side agent is used to call the edge-side analysis model to analyze the network-side anomaly analysis results and the network-side anomaly data when an edge-side anomaly is determined to exist, so as to obtain the edge-side anomaly analysis results; both the network-side analysis model and the edge-side analysis model are built based on the large language model;

[0034] The collaborative analysis module is used to determine the root cause of the fault based on the network-side anomaly analysis results and the end-side anomaly analysis results.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the fault detection method as described in any one of the first aspects above.

[0036] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the fault detection method as described in any one of the first aspects above.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the fault detection method as described in any one of the first aspects above.

[0038] The aforementioned fault detection methods, devices, equipment, and storage media, when determining network-side abnormal data, firstly, utilize a network-side analysis model to analyze the network-side abnormal data and obtain network-side abnormality analysis results; secondly, they determine whether end-side abnormalities exist based on the network-side abnormal data. If no end-side abnormality exists, it indicates that the fault is located on the network side, and therefore the root cause of the fault can be determined solely based on the network-side abnormality analysis results. However, when it is determined that an end-side abnormality exists, it is necessary to call the end-side analysis model to analyze and process the network-side abnormal data and network-side abnormality analysis results to obtain end-side abnormality analysis results. Furthermore, based on the end-side abnormality analysis results and the network-side abnormality analysis results, a collaborative judgment is made, thereby achieving more accurate fault location and obtaining the specific root cause of the fault.

[0039] Compared with related technologies, the fault detection method provided in this application relies on the knowledge understanding and analysis capabilities of a large language model to conduct in-depth analysis of abnormal data on the end side and / or network side, which can locate faults more quickly and improve efficiency. Furthermore, when it is determined that there is an end-side anomaly based on network-side abnormal data, the computer device can call the end-side analysis model and the network-side analysis model to perform collaborative analysis, thereby achieving a more comprehensive fault analysis and obtaining a more accurate root cause of the fault. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a schematic diagram of the data center network structure in one embodiment;

[0042] Figure 2 This is a flowchart illustrating a fault detection method in one embodiment;

[0043] Figure 3 This is a flowchart illustrating the execution steps of a network-side intelligent agent in one embodiment;

[0044] Figure 4 This is a flowchart illustrating the execution steps of an edge-side intelligent agent in one embodiment;

[0045] Figure 5 This is a schematic diagram of the overall logic of a fault detection method in one embodiment;

[0046] Figure 6 This is a structural block diagram of a fault detection device in one embodiment;

[0047] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0049] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0050] The fault detection method provided in this application embodiment is executed by a computer device and is used to detect faults such as... Figure 1 The data center network shown is undergoing fault detection. The data center network has a three-layer architecture: the access layer (connecting servers and terminal devices), the aggregation layer (providing policy control and traffic management), and the core layer (high-speed forwarding and cross-region interconnection). The data center network structure is divided into the endpoint side and the network side. The endpoint side refers to the access layer, servers, and edge network devices directly connected to servers, such as cloud servers and smart network interface cards (NICs), and top-of-rack (TOR) switches. The network side includes the aggregation layer and core layer switches (responsible for cross-rack or cross-region data transmission, routing decisions, and global traffic control) and network links.

[0051] Computer equipment can be, but is not limited to, various personal computers, laptops, and servers. A server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0052] In one exemplary embodiment, such as Figure 2 As shown, a fault detection method is provided, which can be applied to... Figure 1 The following steps, 11 to 14, are used as an example of computer equipment in the example:

[0053] Step 11: When abnormal data is detected on the network side, the network side analysis model is invoked to analyze the abnormal data and obtain the abnormal data analysis results.

[0054] In the embodiments of this application, a network-side intelligent agent is configured for the network side and an end-side intelligent agent is configured for the end side in a computer device; wherein, the end-side intelligent agent is built on the end-side analysis model; the network-side intelligent agent is built on the network-side analysis model; both the network-side analysis model and the end-side analysis model are large language models (LLM).

[0055] The network-side intelligent agent is used to monitor the incoming and outgoing data of the core and aggregation layers of the network side, as well as the operating status of each switch, and to analyze operating indicators. Then, based on the results of the abnormal analysis of operating indicators, it determines abnormal network-side data; or the network-side intelligent agent can directly obtain abnormal network-side data determined by the active probing algorithm configured within the data center network. Abnormal network-side data includes, but is not limited to, abnormal time windows, abnormal indicators, and abnormal data sources (such as inbound / outbound ports or service sources).

[0056] When identifying network-side abnormal data, the network-side agent invokes the network-side analysis model to analyze and process the abnormal data, obtaining the network-side abnormal analysis results derived by the model. These results include the scope of the network-side abnormality (e.g., a specific core switch) and the time of the abnormality; the time of the abnormality can be a specific moment or a time period.

[0057] Step 12: Determine whether there are any end-side anomalies based on the network-side anomaly data.

[0058] Some network-side anomalies may be caused by end-side device failures. Therefore, in this embodiment, when determining network-side anomaly data, the network-side anomaly data is analyzed to determine whether end-side anomalies exist. If end-side anomalies are determined to exist, the end-side analysis model needs to be invoked to participate in fault analysis, thereby better locating the specific root cause of the fault. If no end-side anomalies are determined to exist, the specific root cause of the fault only needs to be located based on the network-side anomaly analysis results determined by the network-side analysis model.

[0059] Specifically, operations and maintenance personnel can pre-define an identifier table, which includes multiple anomaly types and magnitudes related to end-side anomalies. When identifying network-side anomaly data, the corresponding network-side anomaly type and magnitude are determined. Then, the identifier table is queried to confirm whether the network-side anomaly type and magnitude exist.

[0060] If the identifier table contains a network-side anomaly type and a network-side anomaly magnitude, then an end-side anomaly is determined to exist; if the identifier table does not contain a network-side anomaly type or a network-side anomaly magnitude, then an end-side anomaly is determined not to exist.

[0061] Step 13: When it is determined that there is an end-side anomaly, call the end-side analysis model to analyze the network-side anomaly analysis results and network-side anomaly data to obtain the end-side anomaly analysis results.

[0062] In this embodiment of the application, when it is determined that there is an end-side anomaly based on network-side anomaly data, the end-side analysis model is invoked to analyze the network-side anomaly analysis results and the network-side anomaly data to obtain the end-side anomaly analysis results. The end-side anomaly analysis results include the range of the end-side anomaly and the duration of the end-side anomaly.

[0063] Step 14: Determine the root cause of the fault based on the network-side anomaly analysis results and the end-side anomaly analysis results.

[0064] In the embodiments of this application, a collaborative analysis model is used to perform collaborative analysis on the network-side anomaly analysis results and the terminal-side anomaly analysis results, thereby determining the specific root cause of the fault; wherein, the collaborative analysis model can be either the network-side analysis model or the terminal-side analysis model; the collaborative analysis model can also be an independent model built based on a large language model.

[0065] Furthermore, there is no specific order between steps 11 and 12; steps 11 can be executed first, steps 12 can be executed first, or steps 11 and 12 can be executed simultaneously.

[0066] In the aforementioned fault detection method, when identifying network-side abnormal data, on the one hand, the network-side analysis model is used to analyze the network-side abnormal data to obtain network-side abnormality analysis results; on the other hand, the existence of end-side abnormalities is determined based on the network-side abnormal data. If no end-side abnormality exists, it indicates that the fault is located on the network side, and therefore the root cause of the fault can be determined solely based on the network-side abnormality analysis results. However, when the existence of end-side abnormalities is determined, the end-side analysis model needs to be invoked to analyze and process the network-side abnormal data and network-side abnormality analysis results to obtain end-side abnormality analysis results. Furthermore, based on the end-side abnormality analysis results and the network-side abnormality analysis results, a collaborative judgment is made, thereby achieving more accurate fault location and obtaining the specific root cause of the fault.

[0067] Compared with related technologies, the fault detection method provided in this application relies on the knowledge understanding and analysis capabilities of a large language model to conduct in-depth analysis of abnormal data on the end side and / or network side, which can locate faults more quickly and improve efficiency. Furthermore, when it is determined that there is an end-side anomaly based on network-side abnormal data, the computer device can call the end-side analysis model and the network-side analysis model to perform collaborative analysis, thereby achieving a more comprehensive fault analysis and obtaining a more accurate root cause of the fault.

[0068] In one embodiment, step 11, which involves calling the network-side analysis model to analyze the network-side abnormal data and obtain the network-side abnormal analysis results, may specifically include: calling the network-side analysis model to analyze the network-side abnormal data and determining the first execution order of each network-side detection dimension; and according to the first execution order, sequentially calling the detection tools corresponding to each network-side detection dimension to perform detection and obtain the network-side abnormal analysis results.

[0069] Specifically, such as Figure 3 The diagram shown illustrates a processing flow of a network-side intelligent agent, illustrating the specific steps involved in determining the network-side anomaly analysis results. Multiple detection dimensions are pre-defined for the network side, such as... Figure 3 The example allows setting dimensions for traffic analysis, proactive probing, layered analysis, and log correlation analysis. This embodiment does not specify the exact types of network-side analysis dimensions; these can be set by operations and maintenance personnel according to actual needs.

[0070] For each network-side detection dimension, a corresponding detection tool is configured, and each network-side detection dimension corresponds to at least one detection tool. The detection tool can be in the form of a script, an algorithm, a plugin, an API (Application Programming Interface), or a Model Context Protocol (MCP) and is pre-configured.

[0071] The network-side analysis agent populates the network-side analysis template with network-side anomaly data and network-side topology (which can be represented as a topology graph or XML). The populated template is then input into the network-side analysis model for processing. Task prompts in the template instruct the model to analyze the anomaly data in conjunction with the network-side topology to identify at least one possible network-side predicted fault. Based on this fault, the model determines the first execution order among the network-side detection dimensions. This first execution order represents the probability of detecting a fault in each network-side detection dimension.

[0072] In one example, if the network-side abnormal data is related to traffic anomalies, then in the first execution order output by the network-side analysis model, the traffic analysis dimension should be the first priority; that is, the probability of identifying a fault is relatively high when executing the detection tool corresponding to traffic analysis.

[0073] Furthermore, according to the order of each network-side detection dimension in the first execution order, the detection tools for each network-side detection dimension are called sequentially to perform detection, and the detection results corresponding to each network-side detection dimension are obtained.

[0074] In one possible implementation, the detection of each network-side detection dimension is performed sequentially according to the first execution order to obtain the detection results corresponding to each network-side detection dimension; then, the detection results that indicate the presence of faults in the detection results corresponding to each network-side detection dimension are summarized to obtain the network-side anomaly analysis results.

[0075] In another possible implementation, the network-side detection dimensions are detected sequentially according to the first execution order. For each network-side detection dimension, when the detection tool corresponding to that network-side detection dimension obtains a detection result, it is determined whether the detection result indicates the existence of a fault. If the detection result indicates the existence of a fault, the detection result corresponding to that network-side detection dimension is taken as the network-side anomaly analysis result, and the detection of subsequent network-side detection dimensions is stopped. If the detection result indicates that there is no fault, the subsequent network-side detection dimensions are continued to be executed.

[0076] For the actions that the network-side agent can perform, an action set needs to be predefined and constructed. In one embodiment, the action set of the network-side agent defines the following actions A1-A4:

[0077] Action A1: Traffic Time-Series Feature Extraction and Behavior Analysis: By calling the time-series data processing capabilities provided by the basic model, abnormal traffic fluctuations and change patterns can be detected in a timely manner.

[0078] Action A2: Run end-to-end probes to actively detect traffic anomalies: By using open network detection functionality, the Agent is given the ability to detect network connectivity and performance in a timely manner.

[0079] Action A3: Run packet loss location algorithm and perform layered protocol analysis: Based on the basic model, complete the detection of packet loss and error indicators (such as CRC, Error and Discard packets in the inbound and outbound directions of network ports). At the same time, open the physical layer and link layer protocol inspection, network layer and ARP cache optimization, transport layer congestion control, half-connection queue overflow investigation capabilities, and call the semantic understanding capabilities of the end-side analysis model to parse the header features of HTTP / DNS and other protocols to detect protocol compliance.

[0080] Action A4: Correlate and read network device log information to comprehensively verify fault information: The end-side analysis model provides the ability to process unstructured log files. During log correlation analysis, it completes the correlation of alarm information between different devices based on semantics, realizing the understanding and analysis function of non-predefined information. The log analysis results corroborate the network-side abnormal information.

[0081] In one embodiment, in step 12, the identifier table contains multiple triggering conditions. These triggering conditions may only include the anomaly type; for example, triggering condition A could be packet loss anomaly, meaning that when the network-side anomaly data is of a high packet loss rate, an end-side anomaly can be determined. Triggering conditions may also include anomaly type and anomaly magnitude; for example, triggering condition B could be packet loss anomaly with a packet loss rate greater than 30%. That is, only when the network-side anomaly data is of an anomaly type and the packet loss rate is greater than 30% can an end-side anomaly be determined; otherwise, no end-side anomaly exists.

[0082] In one embodiment, step 13 involves calling the endpoint analysis model to analyze the network-side anomaly analysis results and network-side anomaly data to obtain endpoint anomaly analysis results. Specifically, this may include: determining the impact range of the endpoint based on the network-side anomaly range and network topology; calling the endpoint analysis model to analyze the analysis object to obtain endpoint anomaly analysis results; the analysis object includes the impact range of the endpoint, the network-side anomaly time, and the network-side anomaly data.

[0083] Specifically, the network topology of a data center network includes the link relationships and routing rules between the end-side servers and edge network devices and the network-side switches. First, based on the network topology, the impact range of the network-side anomaly range on the end-side is determined. For example, if the network-side anomaly range is core switch A, according to the network topology of the data center network, the end-side servers 1 and 2 have a link / routing relationship with core switch A. Therefore, the impact range on the end-side is end-side servers 1 and 2.

[0084] Furthermore, the impact range of the endpoint, the abnormal data of the network side, and the analysis results of the network side are taken as the analysis objects of the endpoint analysis model. The endpoint analysis model is used to analyze and process the analysis objects to obtain the endpoint anomaly analysis results.

[0085] The above describes the execution process of the network-side agent and network-side analysis model when identifying network-side anomalies in a data center network, as well as the process of the endpoint analysis model participating in collaborative fault analysis. However, endpoint anomalies can also occur in data center networks; the following further elaborates on the execution process of the endpoint agent and endpoint analysis model when identifying endpoint anomalies.

[0086] In one embodiment, the fault detection method provided in this application further includes: when abnormal data is detected on the end side, calling the end side analysis model to analyze the analysis object and obtaining the end side abnormal analysis result; the analysis object is the abnormal data on the end side.

[0087] Specifically, the edge-side intelligent agent monitors the data and operational status of the access layer and various servers / edge network devices on the edge, performs operational indicator analysis, and then determines edge-side abnormal data based on the anomaly analysis results of the operational indicators; alternatively, the edge-side intelligent agent can directly obtain edge-side abnormal data determined by the active probing algorithm configured within the data center network. Edge-side abnormal data includes, but is not limited to, abnormal time windows, abnormal indicators, and abnormal data sources (such as specific servers or data sources). Furthermore, when determining edge-side abnormal data, the edge-side intelligent agent treats the abnormal data as the analysis object and calls the edge-side analysis model to process the analysis object, obtaining the edge-side anomaly analysis results.

[0088] In one embodiment, the process of calling the edge analysis model to analyze the analysis object and obtain the edge anomaly analysis result may specifically include: calling the edge analysis model to analyze the analysis object and determining the second execution order of each edge detection dimension; according to the second execution order, sequentially calling the detection tools corresponding to each edge detection dimension to perform detection and obtain the edge anomaly analysis result.

[0089] In the embodiments of this application, the analysis object of the edge analysis model may be edge-side abnormal data determined by the edge-side agent, or it may be network-side abnormal data, network-side abnormal analysis results, and the edge-side influence range determined based on the network-side abnormal range.

[0090] like Figure 4 The diagram shown illustrates a processing flow of an edge-side intelligent agent, illustrating the specific steps involved in determining the edge-side anomaly analysis results. Multiple edge-side detection dimensions are pre-defined, such as... Figure 4 The example allows setting dimensions for indicator data preprocessing, indicator anomaly detection, multi-dimensional indicator analysis, and analysis model parameter optimization. This embodiment does not specify the exact types of the defined edge-side analysis dimensions; these can be set by operations and maintenance personnel according to actual needs.

[0091] Configure a corresponding detection tool for each edge detection dimension, and each edge detection dimension must correspond to at least one detection tool. The detection tool can be in the form of a script, an algorithm, a plugin, an API (Application Programming Interface), or a Model Context Protocol (MCP) and be pre-configured.

[0092] The edge-side analysis agent populates the analysis object and the edge-side network topology (which can be topology data represented in the form of a topology diagram or XML) into the edge-side analysis template, and then inputs the populated edge-side analysis template into the edge-side analysis model for processing. The task prompts in the edge-side analysis template instruct the edge-side analysis model to analyze the analysis object, identify at least one possible edge-side predicted fault, and determine a second execution order among the edge-side detection dimensions based on at least one possible edge-side predicted fault. The second execution order output by the edge-side analysis model represents the probability of finding faults in each edge-side detection dimension.

[0093] Furthermore, according to the order of each end-side detection dimension in the second execution order, the detection tools for each end-side detection dimension are called sequentially to perform detection, and the detection results corresponding to each end-side detection dimension are obtained.

[0094] In one possible implementation, the detection of each edge detection dimension is performed sequentially according to the second execution order to obtain the detection results corresponding to each edge detection dimension; then, the detection results that indicate the presence of faults in the detection results corresponding to each edge detection dimension are summarized to obtain the edge anomaly analysis results.

[0095] In another possible implementation, the detection of each edge detection dimension is performed sequentially according to the second execution order. For each edge detection dimension, when the detection tool corresponding to that edge detection dimension obtains a detection result, it is determined whether the detection result indicates the existence of a fault. If the detection result indicates the existence of a fault, the detection result corresponding to that edge detection dimension is taken as the edge anomaly analysis result, and the detection of subsequent edge detection dimensions is stopped. If the detection result indicates that there is no fault, the subsequent edge detection dimensions are executed.

[0096] For actions that can be executed by the edge agent, an action set needs to be predefined and constructed. In one embodiment, the action set of the edge agent defines the following actions B1-B4:

[0097] Action B1, Selection of End-Side Device Indicators and Data Preprocessing: Based on the end-side analysis model, the system provides the ability to understand the correlation between indicators, selects indicators with alarm significance for detection, and performs indicator preprocessing through the basic model, as well as resampling / missing value supplementation.

[0098] Action B2, real-time detection of time-series indicators, and pattern detection: The basic model provides anomaly detection for time-series indicators (such as indicator degradation, sudden rises and falls, and pattern detection capabilities), and detects and collects indicator-level abnormal information.

[0099] Action B3, multi-dimensional indicator correlation analysis, verification and feedback: Based on the semantic understanding capability of indicators provided by the edge analysis model, it realizes the correlation analysis of similar indicators and provides comprehensive verification of abnormal information.

[0100] Action B4: Optimize anomaly detection model parameters: Based on the anomaly analysis results from the edge side, the edge analysis model adaptively adjusts the basic detection model parameters through reinforcement learning to achieve precise control of the detection behavior.

[0101] In one embodiment, step 14, the process of determining the root cause of the fault based on the network-side anomaly analysis results and the terminal-side anomaly analysis results, may specifically include: constructing a collaborative analysis template from the network-side anomaly analysis results, the terminal-side anomaly analysis results, and historical fault events; and using the collaborative analysis model to process the collaborative analysis template to determine the root cause of the fault.

[0102] Specifically, historical fault events include historical fault data, historical fault causes, and historical fault scope. An edge-side analysis model is used as the collaborative analysis model. Network-side anomaly analysis results, edge-side anomaly analysis results, the data center network topology, and multiple historical fault events or experiential knowledge obtained from the knowledge base are populated into the collaborative analysis template. The populated collaborative analysis template is then input into the edge-side analysis model for processing, yielding the fault root cause output by the edge-side analysis model. The task prompts in the collaborative analysis template instruct the collaborative analysis model to analyze the network-side and edge-side anomaly analysis results based on historical fault events or experiential knowledge, determine the fault root cause, and generate a fault report using inference data.

[0103] The overall logic of the fault detection method provided in this application is as follows: Figure 5As shown, a network topology structure (endpoint + network side) and a knowledge base (historical fault events + experiential knowledge) for the data center network are pre-constructed as reference information for root cause localization. Furthermore, combining network-side and end-side anomaly data with network topology information, and leveraging the multimodal unstructured data understanding capabilities of LLM, the fault scope is quickly defined. Then, based on historical fault patterns, fault analysis is performed using end-side and / or network-side analysis models to determine the end-side and / or network-side anomaly analysis results. Further, the knowledge base is used to collaboratively analyze the network-side and end-side anomaly analysis results to pinpoint the specific root cause of the fault. Finally, a fault report containing anomaly descriptions, fault scope, and root cause is generated. After manual review, the fault report updates the knowledge base, continuously improving the accuracy and efficiency of root cause localization.

[0104] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0105] Based on the same inventive concept, this application also provides a fault detection device for implementing the fault detection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more fault detection device embodiments provided below can be found in the limitations of the fault detection method described above, and will not be repeated here.

[0106] In one exemplary embodiment, such as Figure 6 As shown, a fault detection device 600 is provided, including a network-side intelligent agent 601, an evaluation module 602, an end-side intelligent agent 603, and a collaborative analysis module 604, wherein:

[0107] When the network-side intelligent agent 601 detects abnormal network-side data, it calls the network-side analysis model to analyze the abnormal network-side data and obtain the network-side abnormality analysis results.

[0108] The evaluation module 602 is used to determine whether there are end-side anomalies based on network-side anomaly data;

[0109] The edge-side intelligent agent 603 is used to call the edge-side analysis model to analyze the network-side anomaly analysis results and network-side anomaly data when an edge-side anomaly is determined to exist, and obtain the edge-side anomaly analysis results; both the network-side analysis model and the edge-side analysis model are built based on the large language model;

[0110] The collaborative analysis module 604 is used to determine the root cause of the fault based on the network-side anomaly analysis results and the end-side anomaly analysis results.

[0111] The aforementioned fault detection device 600, when determining abnormal data on the network side, firstly analyzes the abnormal data using a network-side analysis model to obtain network-side anomaly analysis results; secondly, it determines whether end-side anomalies exist based on the network-side abnormal data. If no end-side anomalies exist, it indicates that the fault is located on the network side, thus the root cause of the fault can be determined solely based on the network-side anomaly analysis results. However, when it is determined that an end-side anomaly exists, the end-side analysis model needs to be invoked to analyze and process the abnormal data and network-side anomaly analysis results to obtain end-side anomaly analysis results. Furthermore, based on the end-side anomaly analysis results and the network-side anomaly analysis results, a collaborative judgment is made, thereby enabling more accurate fault location and determining the specific root cause of the fault.

[0112] Compared with related technologies, the fault detection method provided in this application relies on the knowledge understanding and analysis capabilities of a large language model to conduct in-depth analysis of abnormal data on the end side and / or network side, which can locate faults more quickly and improve efficiency. Furthermore, when it is determined that there is an end-side anomaly based on network-side abnormal data, the computer device can call the end-side analysis model and the network-side analysis model to perform collaborative analysis, thereby achieving a more comprehensive fault analysis and obtaining a more accurate root cause of the fault.

[0113] In one embodiment, the network-side intelligent agent 601 is specifically used for:

[0114] The network-side analysis model is invoked to analyze network-side abnormal data and determine the first execution order of each network-side detection dimension;

[0115] According to the first execution order, the detection tools corresponding to each network-side detection dimension are called in sequence to perform detection and obtain the network-side anomaly analysis results.

[0116] In one embodiment, the evaluation module 602 is specifically used for:

[0117] Determine the type and / or magnitude of network-side anomalies in the network-side abnormal data;

[0118] Search the identifier table to determine if there are network-side anomaly types and / or network-side anomaly magnitudes in the identifier table; the identifier table includes multiple anomaly types and magnitudes related to end-side anomalies.

[0119] If the identification table contains network-side anomaly type and / or network-side anomaly magnitude, then an end-side anomaly is determined to exist.

[0120] In one embodiment, the network-side anomaly analysis results include the network-side anomaly range and the network-side anomaly time. The edge-side intelligent agent 603 is specifically used for:

[0121] Determine the scope of impact on the endpoint based on the network-side anomaly range and network topology.

[0122] The endpoint analysis model is invoked to analyze the analysis object and obtain the endpoint anomaly analysis results; the analysis object includes the impact range of the endpoint, the time of the network-side anomaly, and the network-side anomaly data.

[0123] In one embodiment, the edge-side intelligent agent 603 is specifically used for:

[0124] A collaborative analysis template is constructed by combining network-side anomaly analysis results, terminal-side anomaly analysis results, and historical fault events; historical fault events include historical fault data, historical fault causes, and historical fault scope.

[0125] By using a collaborative analysis model, the collaborative analysis template is processed to determine the root cause of the failure.

[0126] In one embodiment, the collaborative analysis module 604 is specifically used for:

[0127] When abnormal data is detected on the edge, the edge analysis model is invoked to analyze the object and obtain the edge anomaly analysis results; the object of analysis is the abnormal data on the edge.

[0128] In one embodiment, the edge-side intelligent agent 603 is specifically used for:

[0129] The edge-side analysis model is invoked to analyze the analysis object and determine the second execution order of each edge-side detection dimension;

[0130] According to the second execution order, the detection tools corresponding to each edge detection dimension are called in sequence to perform detection and obtain edge anomaly analysis results.

[0131] Each module in the aforementioned fault detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0132] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a fault analysis method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0133] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0134] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the steps in the above embodiments of the end-to-end network fault analysis method.

[0135] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the steps in the above embodiments of the end-to-end network fault analysis method.

[0136] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the steps in the above-described embodiments of the end-to-end network fault analysis method.

[0137] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0138] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0139] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0140] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A fault detection method, characterized in that, Applied to data center networks, the method includes: When abnormal data is detected on the network side, the network side analysis model is invoked to analyze the abnormal data and obtain the abnormal data analysis results. Based on the network-side anomaly data, determine whether there are end-side anomalies; When an edge-side anomaly is determined to exist, the edge-side analysis model is invoked to analyze the network-side anomaly analysis results and the network-side anomaly data to obtain the edge-side anomaly analysis results; both the network-side analysis model and the edge-side analysis model are built based on the large language model; Based on the network-side anomaly analysis results and the end-side anomaly analysis results, the root cause of the fault is determined.

2. The method according to claim 1, characterized in that, The process of calling the network-side analysis model to analyze the network-side abnormal data and obtaining network-side abnormal analysis results includes: The network-side analysis model is invoked to analyze the network-side abnormal data and determine the first execution order of each network-side detection dimension; According to the first execution order, the detection tools corresponding to each of the network-side detection dimensions are called sequentially to perform detection and obtain the network-side anomaly analysis results.

3. The method according to claim 1 or 2, characterized in that, The step of determining whether there is an end-side anomaly based on the network-side anomaly data includes: Determine the network-side anomaly type and / or network-side anomaly magnitude of the network-side abnormal data; A query is performed in the identifier table to determine whether the network-side anomaly type and / or the network-side anomaly magnitude exist in the identifier table; the identifier table includes multiple anomaly types and anomaly magnitudes related to end-side anomalies. If the network-side anomaly type and / or the network-side anomaly magnitude exist in the identification table, then an end-side anomaly is determined to exist.

4. The method according to claim 3, characterized in that, The network-side anomaly analysis results include the network-side anomaly range and the network-side anomaly time. The endpoint analysis model is invoked to analyze the network-side anomaly analysis results and the network-side anomaly data to obtain endpoint anomaly analysis results, including: Based on the network-side anomaly range and network topology, determine the impact range on the endpoint. The endpoint analysis model is invoked to analyze the analysis object, and the endpoint anomaly analysis results are obtained; the analysis object includes the endpoint's influence range, the network-side anomaly time, and the network-side anomaly data.

5. The method according to claim 4, characterized in that, The step of determining the root cause of the fault based on the network-side anomaly analysis results and the terminal-side anomaly analysis results includes: The network-side anomaly analysis results, the endpoint-side anomaly analysis results, and historical fault events are used to construct a collaborative analysis template; the historical fault events include historical fault data, historical fault causes, and historical fault ranges. The collaborative analysis model is used to process the collaborative analysis template to determine the root cause of the failure.

6. The method according to claim 5, characterized in that, The collaborative analysis model is the end-side analysis model.

7. The method according to claim 1, characterized in that, The method further includes: When abnormal data is detected on the edge, the edge analysis model is invoked to analyze the object and obtain the edge anomaly analysis result; the object of analysis is the abnormal data on the edge.

8. The method according to claim 4 or 7, characterized in that, The step of calling the endpoint analysis model to analyze the analysis object and obtaining endpoint anomaly analysis results includes: The endpoint analysis model is invoked to analyze the analysis object, and the second execution order of each endpoint detection dimension is determined. According to the second execution order, the detection tools corresponding to each of the edge detection dimensions are called sequentially to perform detection and obtain the edge anomaly analysis results.

9. A fault detection device, characterized in that, Applied to data center networks, the device includes a network-side intelligent agent, an evaluation module, an edge-side intelligent agent, and a collaborative analysis module, wherein: When the network-side intelligent agent detects abnormal network-side data, it calls the network-side analysis model to analyze the abnormal network-side data and obtain the network-side abnormality analysis results. The evaluation module is used to determine whether there is an end-side anomaly based on the network-side anomaly data; The edge-side agent is used to call the edge-side analysis model to analyze the network-side anomaly analysis results and the network-side anomaly data when an edge-side anomaly is determined to exist, so as to obtain the edge-side anomaly analysis results; both the network-side analysis model and the edge-side analysis model are built based on the large language model; The collaborative analysis module is used to determine the root cause of the fault based on the network-side anomaly analysis results and the end-side anomaly analysis results.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images