A node topology perception and fault detection method based on a graph neural network

Abstract

The application discloses a node topology perception and fault detection method based on a graph neural network, relates to the technical field of network equipment fault detection, and comprises the following steps: step one, acquiring a partial observable topology graph of a current network, multi-dimensional time sequence monitoring data of each observable node, and alarm logs; step two, constructing a node feature matrix according to the partial observable topology graph, the multi-dimensional time sequence monitoring data and the alarm logs, and generating a preset number of candidate completed topology samples by using a causal perception topology completion model; each candidate completed topology sample comprises a node set, an edge set and an uncertainty weight of each completed edge; wherein the causal perception topology completion model is based on a variational graph autoencoder, and when a completed edge is generated, a causal graph obtained in the last round of causal discovery is used for causal regularization constraint, so that the generation of a candidate completed edge with a causal effect intensity lower than a preset effect threshold in the causal graph is inhibited.

Description

Technical Field

[0001] This invention relates to the field of network equipment fault detection technology, specifically to a node topology perception and fault detection method based on graph neural networks. Background Technology

[0002] In large enterprise networks or hybrid cloud networks involving cross-domain collaboration or multiple clouds and edges, network management platforms face two major challenges: missing topology and data. Due to security isolation, access restrictions, or sensor malfunctions, monitoring systems can only acquire partial network topology connections and real-time performance data of some nodes. For example, they can only observe the core layer and access layer, leaving a large number of nodes in the aggregation layer in a blind spot. When a fault occurs, multiple nodes in the observable area simultaneously exhibit abnormal indicators and a large number of alarms. However, most of these are derivative anomalies caused by the fault propagating along the network. Operations personnel find it difficult to distinguish the cause and effect from the limited observable information, frequently misjudging the effect as the cause, leading to incorrect root cause location and delayed fault recovery.

[0003] In existing technologies, GNN fault detection methods suffer from a sharp decline in performance when topology is missing, and can only capture statistical correlations between nodes, unable to make causal inferences; while causal discovery methods are highly dependent on complete topology structures and sufficient observation data. The scenario urgently needs a unified framework that can automatically complete potentially missing topology and state information under partially observable conditions, and use causal relationships to eliminate false associations during the completion process, ultimately providing causal-level fault root cause localization results with confidence. Summary of the Invention

[0004] To achieve the above objectives, the present invention provides the following technical solution: A node topology awareness and fault detection method based on graph neural networks, the method comprising: Step 1: Obtain a partial observable topology of the current network, multi-dimensional time-series monitoring data of each observable node, and alarm logs; Step 2: Construct a node feature matrix based on the partially observable topology graph, multidimensional time-series monitoring data, and alarm logs. Use a causal-aware topology completion model to generate a preset number of candidate completed topology samples. Each candidate completed topology sample contains a set of nodes, a set of edges, and an uncertainty weight for each completed edge. The causal-aware topology completion model is based on a variational graph autoencoder. When generating completed edges, it applies causal regularization constraints based on the causal graph obtained from the previous round of causal discovery to suppress the generation of candidate completed edges with causal effect strengths lower than a preset effect threshold in the causal graph. Step 3: For each candidate topology completion sample, perform causal discovery based on the topology and node characteristics of the sample to obtain the corresponding directed causal graph, and calculate the causal contribution of each node to the current abnormal node through counterfactual intervention. Step 4: Summarize the causal contribution of each node corresponding to the candidate topology completion samples under the preset number, obtain the causal contribution distribution of each node, and determine the mean and variance of the causal contribution of each node. Step 5: Based on the mean and variance of the causal contribution of each node, and the node anomaly score calculated based on multi-dimensional time-series monitoring data, and the topology completion confidence determined by the uncertainty weight of each completion edge in the candidate completion topology sample, calculate the comprehensive root cause score of each node, and determine the nodes with a comprehensive root cause score higher than the first preset threshold and a variance lower than the second preset threshold as high-confidence root cause nodes. Step 6: Output the high-confidence root cause node and the directed causal propagation path starting from the high-confidence root cause node.

[0005] Furthermore, the process of constructing the node feature matrix is ​​as follows: Statistical aggregation of multidimensional time-series monitoring data yields multidimensional time-series feature vectors for each observable node. The alarm logs are encoded by node to obtain the alarm encoding vector for each observable node; The multidimensional temporal feature vector is concatenated with the alarm coding vector to form a node feature matrix. The rows of the node feature matrix correspond to observable nodes, and the columns correspond to the concatenated features.

[0006] Furthermore, a predetermined number of candidate completed topology samples are generated using a causal perception topology completion model, including: The node feature matrix and the set of observable edges are input into the variational graph autoencoder to obtain the latent variable distribution parameters, and the latent representation vector is sampled from them. Based on the implicit representation vector, predict the connection probability between nodes and generate the link prediction probability matrix; The link prediction probability matrix is ​​causally regularized using the causal graph obtained from the previous round of causal discovery to suppress candidate completion edges that lack causal effects in both directions. A candidate complete topology sample is generated based on the probability matrix after causal regularization. The sampling and generation process is repeated a preset number of times to obtain a preset number of candidate completed topology samples. Each completed edge is assigned an uncertainty weight, which is determined by the frequency of the completed edge in different samples and the causal regularization result.

[0007] Furthermore, the process of obtaining the corresponding directed causal graph is as follows: For observable nodes in the candidate completion topology sample, their initial node features are used; for placeholder nodes in the completion region, weighted message passing is performed along the edges of the sample to estimate node features, and the weight of the weighted message passing is proportional to the uncertainty weight of the edge. The observable node features are concatenated with the estimated features of the occupant nodes in the completed region to form a complete node feature matrix; Using the complete node feature matrix as input, a directed adjacency matrix is ​​learned by optimizing an objective function that includes a feature reconstruction error term and a directed acyclic constraint term. The directed adjacency matrix is ​​then used as the directed causal graph corresponding to the candidate completed topology sample.

[0008] Furthermore, the causal contribution of each node to the current anomalous node is calculated through counterfactual intervention, including: Obtain the current set of abnormal nodes and determine the upstream node of each abnormal node in the directed cause-effect graph; Perform counterfactual intervention on each upstream node, set the outgoing causal edge effect strength of that upstream node in the directed causal graph to zero, and calculate the change in the abnormal score of the abnormal node before and after the intervention. The change in abnormal scores is taken as the causal contribution of the upstream node to the abnormal node. If the same upstream node corresponds to multiple abnormal nodes, the maximum value of its causal contribution is taken as the final causal contribution of the upstream node.

[0009] Furthermore, the process of obtaining the causal contribution distribution of each node is as follows: Collect a preset number of candidate topology completion samples and their corresponding causal contribution records. For each node, extract its causal contribution value in each candidate completed topology sample to form a causal contribution sequence, where the corresponding value of the sample that is not assigned a causal contribution is recorded as zero; Based on the causal contribution sequence, the causal contribution distribution of the node is obtained. The causal contribution distribution reflects the value and fluctuation range of the probability of the node as a root cause under different topological completion assumptions.

[0010] Furthermore, the process of determining the mean and variance of the causal contribution of each node is as follows: The summation of the element values ​​in the causal contribution sequence of each node is divided by a preset number to obtain the mean causal contribution. The deviation of each element value in the causal contribution sequence from the mean causal contribution is calculated, and the causal contribution variance is obtained based on the deviation. The causal contribution variance reflects the fluctuation of the causal contribution of the node among different topological completion hypotheses.

[0011] Furthermore, the process of calculating the comprehensive root cause score for each node is as follows: The mean causal contribution, variance of causal contribution, node anomaly score obtained from multidimensional time-series monitoring data, and topology completion confidence determined based on the uncertainty weight of completion edges in the candidate completion topology samples are obtained. Normalization was performed on the mean of causal contribution, variance of causal contribution, node anomaly score and topology completion confidence. The variance of causal contribution was reverse normalized so that the smaller the variance, the larger the normalized value. The normalized data from the four categories are weighted and merged according to preset weight coefficients to obtain the comprehensive root cause score.

[0012] Furthermore, the process of outputting high-confidence root cause nodes and the directed causal propagation path starting from the high-confidence root cause nodes is as follows: Obtain the average causal graph, starting from the high-confidence root cause node and traversing along the causal direction to obtain the directed propagation path from the root cause node to the affected node. For each directed edge in the directed propagation path, calculate the comprehensive confidence level based on the causal effect strength of the directed edge and the topological completion confidence level of the two endpoints. Output the directed propagation path, and visually distinguish between observable nodes and complete region nodes in the propagation path graph, and present the confidence level of the directed edges based on the overall confidence level.

[0013] The present invention provides a node topology perception and fault detection method based on graph neural networks, which has the following beneficial effects: (1) This invention achieves accurate localization of causal-level fault root causes under partially observable topological conditions through a two-way enhanced closed-loop mechanism of causal perception topology completion and counterfactual intervention reasoning. It effectively distinguishes between real root cause nodes and derivative abnormal nodes generated by fault propagation, decouples the real causal propagation link from correlation confusion, avoids misjudging the effect of the fault as the cause, significantly reduces the root cause localization error rate, and outputs a measure of uncertainty in root cause inference.

[0014] (2) This invention optimizes the topology completion process by combining topology completion and causal discovery. The topology completion process is guided by causal consistency constraints and the causal discovery process is supported by multi-topology sampling integration. It can operate stably in complex environments with a high proportion of missing network topologies. It can complete high-precision root cause localization with only some observable topologies and limited monitoring data, greatly reducing the dependence on the complete topology of the entire network and the monitoring data of all nodes, and adapting to the information missing in unobserved areas.

[0015] (3) By outputting a causal root cause propagation path diagram with confidence level annotation and hierarchical handling suggestions, this invention can accurately lock high-confidence root cause nodes and actively detect and guide low-confidence areas, avoid blind investigation and excessive intervention, effectively shorten the fault location and recovery time, realize the closed-loop intelligent operation of the whole process from topology completion, causal inference, root cause location to verification and update, reduce the burden of manual root cause analysis, and improve the overall network operation and maintenance efficiency. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the method of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 This application provides a node topology awareness and fault detection method based on graph neural networks, the method comprising: Step 1: Obtain a partial observable topology of the current network, multi-dimensional time-series monitoring data of each observable node, and alarm logs; The process of obtaining a partial observable topology of the current network includes: The system sends a topology information query request to the network management system and receives a list of currently discoverable network devices and connection relationship data between them. The connection relationship data includes physical link connections and logical routing adjacency relationships. The physical link connections are derived from the adjacency information reported by the link layer discovery protocol, and the logical routing adjacency relationships are derived from the routing table entries exported from the routing protocol database. An initial adjacency matrix is ​​constructed based on the connection relationship data. The elements in the initial adjacency matrix indicate whether there is a direct connection between two nodes. The initial adjacency matrix is ​​marked with observability annotations. Nodes covered by the monitoring system are marked as observable nodes, links covered by the monitoring system are marked as observable edges, and areas where topology information cannot be obtained due to security isolation, access restrictions, or sensor disconnection are marked as unobservable areas, forming a partially observable topology graph. The partially observable topology graph is stored in a graph data structure, containing a set of observable nodes, a set of observable edges, and boundary node identifiers of unobservable areas.

[0019] The process of acquiring multidimensional time-series monitoring data for each observable node includes: The system sends a time-series data query request to the performance monitoring system, carrying a list of observable node identifiers, a list of monitoring indicator types, and time window parameters. It receives multiple time-series data records for each observable node within a preset time window, each containing a collection timestamp and values ​​for multiple monitoring indicators. The monitoring indicator types include at least three of the following: CPU utilization, memory utilization, port packet loss rate, port error packet count, link bandwidth utilization, and link latency. The system preprocesses the collected time-series data, including missing value interpolation and outlier truncation. It then extracts features from the preprocessed time-series data using a preset statistical aggregation method, generating a multi-dimensional time-series feature vector for each observable node. The preset statistical aggregation method includes calculating at least two of the following statistics within the preset time window: mean, variance, maximum value, and trend slope. All statistics for the same node are then concatenated into a multi-dimensional time-series feature vector.

[0020] The process of obtaining alarm logs includes: The system sends an alarm query request to the alarm management platform, which includes a list of observable node identifiers and an alarm query time range. It receives a list of alarm events returned by the alarm management platform, where each alarm event includes an alarm timestamp, an alarm type identifier, and the identifier of the node that generated the alarm. The system groups the alarm event list by node identifier and extracts all alarm type identifiers for each observable node within the alarm query time range, forming an alarm type sequence for that node. The system encodes the alarm type sequence to generate an alarm encoding vector for each observable node. This alarm encoding vector, in the form of one-hot encoding or embedded vectors, indicates whether a specific type of alarm event has occurred at that node within the alarm query time range.

[0021] Step 2: Construct a node feature matrix based on the partially observable topology graph, multidimensional time-series monitoring data, and alarm logs. Use a causal-aware topology completion model to generate a preset number of candidate completed topology samples. Each candidate completed topology sample contains a set of nodes, a set of edges, and an uncertainty weight for each completed edge. The causal-aware topology completion model is based on a variational graph autoencoder. When generating completed edges, it applies causal regularization constraints based on the causal graph obtained from the previous round of causal discovery to suppress the generation of candidate completed edges with causal effect strengths lower than a preset effect threshold in the causal graph. The observable topology map is based on the current network environment. Due to security isolation policies between different management domains, monitoring permission restrictions on different network segments, some sensors or acquisition agents being offline, or low-power nodes being in a dormant state, the monitoring system can only obtain a part of the nodes and connection relationships in the entire network topology, and cannot obtain a complete snapshot of the entire network topology. The specific process of constructing the node feature matrix is ​​as follows: The multidimensional time-series feature vector of each observable node is extracted from the acquired multidimensional time-series monitoring data. This multidimensional time-series feature vector is composed of the statistical aggregates of various monitoring indicators for each observable node within a preset time window, including at least two of the following statistical measures: mean, variance, maximum value, and trend slope. The feature dimension is denoted as... .

[0022] Extract the alarm encoding vector for each observable node from the acquired alarm logs. Specifically, for each observable node, collect all alarm type identifiers that appear within the alarm query time range to form an alarm type set. Based on the preset alarm type set, generate a fixed-dimensional binary vector, where each bit in the vector corresponds to an alarm type. If a certain type of alarm occurs at the node, the corresponding bit is set to 1; otherwise, it is set to 0. This binary vector is the alarm encoding vector, and the feature dimension is denoted as . .

[0023] Feature fusion is performed on the multi-dimensional temporal feature vector and the alarm coding vector. The two are concatenated along the feature dimension to obtain the initial node feature vector of each observable node, with dimension 1. + Before splicing, the multidimensional time-series feature vectors are normalized to eliminate the dimensional differences between different monitoring indicators; the alarm coding vectors are kept in their binary form or subjected to low-dimensional embedding transformation to convert the high-dimensional sparse one-hot coding into dense vectors before splicing.

[0024] Based on the list of observable node identifiers in the partially observable topology graph, the order of nodes participating in the construction of the node feature matrix is ​​determined. The initial node feature vectors of all observable nodes are then stacked sequentially to form a node feature matrix X, with the number of rows equal to the total number of observable nodes and the number of columns... + , or the total dimension after embedding transformation; each row in the node feature matrix corresponds to the feature representation of an observable node, and each column corresponds to a feature dimension.

[0025] The node feature matrix X, together with the set of observable edges of a portion of the observable topology graph, is used as input to the variational graph autoencoder in the causal perceptive topology completion model to subsequently learn the distribution of latent variables of nodes and generate candidate completion topology samples. The feature values ​​in the node feature matrix contain both numerical information reflecting the node's operating status, which comes from multi-dimensional time-series monitoring data, and semantic information reflecting the node's alarm events, which comes from alarm logs. This allows the model to simultaneously utilize the node's performance status and event context to infer missing edges during the topology completion process.

[0026] The specific process of generating candidate topology completion samples is as follows: The encoder part of the variational graph autoencoder is input by the node feature matrix X and the set of observable edges of a partially observable topological graph. The encoder is composed of a graph convolutional network with a preset number of layers. It performs message passing based on the adjacency relationship defined by the set of observable edges, performs multi-layer neighborhood aggregation on the feature vector of each observable node, and outputs the latent variable distribution parameters of each observable node, namely the latent variable mean vector and the latent variable variance vector. The latent variable distribution parameters characterize the position of each observable node in the latent space and its uncertainty range.

[0027] The latent representation vector of each observable node is obtained by randomly sampling from the latent variable distribution of each observable node. Specifically, for each node, a sample point is drawn from the normal distribution defined by its corresponding mean vector and variance vector as the latent representation vector of that node. The latent representation vectors of all observable nodes constitute the latent representation matrix Z.

[0028] The latent representation matrix Z is input into the decoder part of the variational graph autoencoder; the decoder performs an inner product operation on the latent representation vectors of any two nodes, and maps the inner product result to the probability value that there is a connection between the two nodes through an activation function; the connection probability is calculated for all node pairs to obtain the link prediction probability matrix, where each element represents the predicted probability that there is an edge between the corresponding node pairs.

[0029] Causal regularization constraints are applied to the link prediction probability matrix. Specifically, the directed causal graph output by the causal discovery module in the previous iteration is obtained. In the first iteration, the causal graph is initialized as an empty causal graph containing only observable edges and no edge weights. The causal effect strength value of each directed edge in the directed causal graph is extracted. For candidate completion edges in the link prediction probability matrix whose prediction probability is higher than a preset connection threshold, it is checked whether there is a causal path in the directed causal graph between the two nodes corresponding to the candidate completion edge, and whether the causal effect strength exceeds the preset effect threshold in either direction. If there is no causal path in either direction that meets the above conditions, it is determined that the candidate completion edge lacks causal propagation attributes. A penalty term is applied to the candidate completion edge in the loss function of the variational graph autoencoder to reduce its prediction probability after the next parameter update.

[0030] Based on the link prediction probability matrix after applying causal regularization constraints, a binary screening is performed using a preset probability threshold. Node pairs with prediction probabilities higher than the preset probability threshold are identified as completion edges, generating a candidate completion topology sample. The node set of this sample includes all observable nodes and completion region placeholder nodes introduced by the completion edges, and the edge set includes the original edges in the observable edge set and all newly generated completion edges.

[0031] The process of sampling from the latent variable distribution to generate candidate complete topology samples is repeated a predetermined number of times, denoted as K times, to obtain K candidate complete topology samples. Since the latent representation vector extracted from the latent variable distribution is different each time, the link prediction probability matrix generated by the decoder is also different. Therefore, the K samples show diversity in the number of completed edges and connection methods, reflecting the uncertainty of topology completion itself.

[0032] For each completed edge in each candidate completed topology sample, calculate the uncertainty weight. The calculation of the uncertainty weight takes into account the frequency of the completed edge in the K samples. The lower the frequency, the lower the uncertainty weight of the edge. At the same time, the causal consistency score obtained by the completed edge in the causal regularization constraint process is also considered. The lower the causal consistency score, the lower the uncertainty weight of the edge.

[0033] Step 3: For each candidate topology completion sample, perform causal discovery based on the topology and node characteristics of the sample to obtain the corresponding directed causal graph, and calculate the causal contribution of each node to the current abnormal node through counterfactual intervention. The specific process of obtaining the corresponding directed causal graph is as follows: Based on the currently processed candidate completed topology sample, the feature representations of all nodes contained in the sample are determined. For nodes belonging to the observable node set, their corresponding initial node feature vectors in the node feature matrix X are directly used as their feature representations. For nodes belonging to the placeholder nodes of the completed region, since they lack direct observation data, a weighted message passing method is used for feature estimation. The weighted message passing method is as follows: starting from the learnable initial embedding vector of the placeholder node of the completed region, neighborhood feature aggregation is performed along the edges in the candidate completed topology sample. During aggregation, the message passing weight of each edge is proportional to the uncertainty weight of that edge, that is, the edge with the higher uncertainty weight contributes more to the aggregation. After a preset number of iterative aggregations, the estimated feature vector of the placeholder node of the completed region is obtained. The initial feature vectors of the observable nodes and the estimated feature vectors of the placeholder nodes of the completed region are concatenated in node order to form the complete node feature matrix corresponding to the candidate completed topology sample.

[0034] Based on the complete node feature matrix as input, a differentiable causal discovery algorithm is used to learn the directed causal graph under the candidate completed topology sample. The differentiable causal discovery algorithm represents the causal graph structure as a directed adjacency matrix. The element in the i-th row and j-th column of the directed adjacency matrix represents the causal effect strength from node i to node j. The element value of zero indicates that there is no causal edge in that direction. The learning of the directed adjacency matrix is ​​achieved by optimizing an objective function containing two parts of loss: the first part is the error loss for feature reconstruction of the complete node feature matrix based on the directed adjacency matrix. This error loss measures the deviation when using the features of the cause node to predict the features of the effect node, forcing the directed adjacency matrix to capture the true causal generation relationship between nodes; the second part is the directed acyclicity constraint loss. This constraint loss transforms the acyclicity condition that the causal graph must satisfy into a differentiable mathematical form, ensuring that the graph structure corresponding to the learned directed adjacency matrix does not contain any directed loops.

[0035] The optimized directed adjacency matrix is ​​output as the directed causal graph corresponding to the candidate completed topology sample. The weight of each directed edge in the directed causal graph represents the strength of the causal effect, and the direction of the edge represents the direction of the causal influence. The acyclic structure ensures the logical consistency of causal reasoning. Each candidate completed topology sample generates an independent directed causal graph, resulting in a total of K directed causal graphs corresponding to the K candidate completed topology samples.

[0036] The specific process for determining the causal contribution of the current anomalous node is as follows: Determine the set of abnormal nodes at the current moment; specifically, obtain the node anomaly score of each observable node. The node anomaly score is calculated based on multi-dimensional time-series monitoring data and is used to measure the degree to which the actual operating state of the node deviates from the normal baseline mode; determine the observable nodes whose node anomaly scores exceed the preset anomaly threshold as the current abnormal nodes, and form the abnormal node set; the nodes in the abnormal node set are the target nodes for tracing the root cause.

[0037] For each abnormal node in the abnormal node set, determine its upstream node set in the directed causal graph corresponding to the current candidate completed topology sample. The upstream node is determined as follows: taking the abnormal node as the endpoint, search for all starting nodes with non-zero causal edges pointing to the abnormal node in the directed adjacency matrix of the directed causal graph, and include these starting nodes in the upstream node set of the abnormal node. Further, recursively perform the above search operation for each direct upstream node until a preset tracing depth is reached or there are no more upstream nodes, and then merge all the searched nodes into the upstream node set.

[0038] For each upstream node in the upstream node set of each anomalous node, a counterfactual intervention operation is performed one by one. The counterfactual intervention operation includes: temporarily setting the causal effect strength values ​​of all outgoing causal edges of the upstream node to zero in the directed adjacency matrix of the directed causal graph, thereby simulating the severing of the causal influence of the upstream node on all its downstream nodes, and obtaining the directed adjacency matrix after intervention; recalculating the reconstructed feature vector of the anomalous node based on the directed adjacency matrix after intervention, which is obtained by weighted aggregation of the causal node features of the anomalous node in the directed causal graph after intervention; comparing the reconstructed feature vector with the actual feature vector of the anomalous node and calculating the degree of deviation between the two, which is used as the estimated anomalous score of the anomalous node after intervention; calculating the difference between the original anomalous score of the anomalous node before intervention and the estimated anomalous score after intervention, which represents the decrease in the anomalousness of the anomalous node after removing the causal influence of the upstream node, and using this difference as the causal contribution of the upstream node to the anomalous node.

[0039] For each upstream node, if it belongs to the upstream node set of multiple abnormal nodes, its causal contribution to each abnormal node is calculated separately, and the maximum value is taken as the final causal contribution of the upstream node under the current candidate completed topology sample. All calculated causal contributions are associated with the corresponding node identifier and stored to form the causal contribution record of the candidate completed topology sample.

[0040] Step 4: Summarize the causal contribution of each node corresponding to the candidate topology completion samples under the preset number, obtain the causal contribution distribution of each node, and determine the mean and variance of the causal contribution of each node. The specific process for obtaining the causal contribution distribution of each node is as follows: By collecting causal contribution records of all candidate completed topology samples; a causal contribution record is generated for each candidate completed topology sample, which contains the mapping relationship between each node in the sample and its final causal contribution; the K causal contribution records corresponding to the K candidate completed topology samples are summarized into a contribution set, which covers all nodes that have been assigned a causal contribution in at least one sample.

[0041] For each node, extract the causal contribution value of that node in all K samples from the contribution set to form the causal contribution sequence of that node; for a node that is not assigned a causal contribution in a certain sample, record its causal contribution value in that sample as zero; the length of the causal contribution sequence is equal to the preset number K, and each element in the sequence corresponds to the causal contribution of that node under a candidate completed topology sample.

[0042] Based on the causal contribution sequence of each node, the causal contribution distribution of that node is calculated. The causal contribution distribution is described by the empirical distribution function of the causal contribution sequence, reflecting the probability of that node as a root cause under different topological completion assumptions and its fluctuation range. The causal contribution distribution captures the transmission effect of topological completion uncertainty to the causal inference process. If a node is assigned a high causal contribution in most candidate completed topological samples, its distribution is concentrated and skewed to the right. If the causal contribution of a node varies greatly among different samples, its distribution is dispersed and has a large variance, indicating that the judgment of the root cause of that node is highly dependent on the topological completion assumption used.

[0043] The causal contribution sequences of all nodes and their corresponding causal contribution distributions are associated and stored, and then passed to the subsequent mean and variance determination stages. The causal contribution distribution provides two key inputs for the subsequent comprehensive root cause score calculation: the central tendency index of the distribution, which measures the average probability of the node being a root cause; and the dispersion index of the distribution, which measures the stability and reliability of the root cause inference result under different topological assumptions.

[0044] The specific process for determining the mean and variance of the causal contribution of each node is as follows: Obtain the causal contribution sequence for each node; the length of the causal contribution sequence is a preset number K, and the f-th element in the sequence represents the causal contribution value of the node in the f-th candidate complete topology sample, where f is the sequence index, f=1,2,…,K; for a node that has not been assigned a causal contribution in a certain sample, the value of this element is zero.

[0045] The mean of the causal contribution sequence of each node is calculated. Specifically, all K elements in the causal contribution sequence of the node are summed, and the sum is divided by a preset number K. The arithmetic mean of the sum is the mean of the causal contribution of the node. The mean of the causal contribution reflects the average probability of the node being the root cause of the failure under all K candidate topology completion hypotheses. The higher the mean, the more likely the node is to be identified as a node with significant causal influence in most topology completion hypotheses, and the higher its confidence as the root cause.

[0046] The variance of the causal contribution sequence for each node is calculated. Specifically, the square of the difference between each element in the causal contribution sequence of that node and the mean causal contribution is calculated. The sum of the K squared differences is then divided by a preset number K to obtain the variance of the causal contribution of that node. The variance of the causal contribution reflects the degree of fluctuation of the causal contribution of that node among different candidate completed topology samples: the smaller the variance, the more consistent the root cause judgment of that node is under different topology completion assumptions, and the inference result is stable and reliable; the larger the variance, the more the causal contribution of that node depends on which topology completion assumption is used, the greater the uncertainty of the inference result, and the higher the risk of the node being misjudged or missed.

[0047] The mean and variance of causal contribution of each node are associated with the node identifier and stored to form a node-level causal statistical record.

[0048] Step 5: Calculate the comprehensive root cause score of each node based on the mean and variance of the causal contribution of each node, the node anomaly score calculated based on multi-dimensional time-series monitoring data, and the topology completion confidence score determined based on the uncertainty weight of each completion edge in the candidate completion topology sample. Nodes with a comprehensive root cause score higher than the first preset threshold and a variance lower than the second preset threshold are identified as high-confidence root cause nodes. The specific process for calculating the comprehensive root cause score for each node is as follows: Obtain the mean causal contribution μ and the variance of causal contribution σ for each node. 2 The mean causal contribution μ reflects the average probability that the node is identified as the root cause of the failure under all K candidate completion topology assumptions, and the variance of the causal contribution σ 2 This reflects the degree of fluctuation in the root cause inference results of the node between different topological completion hypotheses; these two types of data come from the causal discovery and counterfactual intervention stages and carry statistical information at the causal level.

[0049] Calculate the node anomaly score 'a' for each node. The node anomaly score is calculated based on the acquired multidimensional time-series monitoring data. Specifically, for each node, obtain its multidimensional time-series feature vector within a preset time window. The multidimensional time-series feature vector is composed of the statistical aggregation of various monitoring indicators. Input the multidimensional time-series feature vector into a pre-trained node anomaly detection model. The node anomaly detection model is established based on the feature distribution under historical normal operating conditions and outputs the degree to which the current feature vector of the node deviates from the normal distribution, which is the node anomaly score 'a'. The node anomaly score 'a' is independent of the causal analysis process and measures the degree of anomaly in the node's operating state itself from a data-driven perspective, complementing the causal contribution.

[0050] Calculate the topology completion confidence level *c* for each node. The topology completion confidence level is determined based on the uncertainty weights of each completion edge in the candidate completion topology samples. Specifically, for observable nodes, the topology completion confidence level *c* is directly set to 1, indicating that the existence and connectivity of the node are completely confirmed by the measured data, and there is no uncertainty introduced by the completion. For placeholder nodes in the completion region, retrieve all generated candidate completion topology samples, extract all completion edges directly connected to the placeholder node and their corresponding uncertainty weights, calculate the average of these uncertainty weights, and use this average as the topology completion confidence level *c* for the placeholder node in the completion region. The topology completion confidence level *c* reflects the credibility of the node's existence and connectivity in the network topology: the closer *c* is to 1, the more consistently the node and its connections appear in different completion hypotheses, indicating high credibility; the closer *c* is to 0, the more frequently the node and its connections appear in only a few completion hypotheses, indicating low credibility.

[0051] Due to the mean μ of causal contribution and the variance σ of causal contribution 2 The four types of data—node anomaly score (a), topology completion confidence score (c)—have different dimensions and value ranges, and need to be normalized separately to map them to a unified value range in order to ensure the rationality of subsequent weighted fusion.

[0052] For the mean causal contribution μ, a maximum-minimum normalization method is used: obtain the set of mean causal contribution values ​​for all nodes, extract the maximum and minimum values, subtract the minimum value from the mean causal contribution μ of each node, and then divide by the difference between the maximum and minimum values ​​to obtain the normalized mean causal contribution. Its value ranges from 0 to 1.

[0053] For the variance of causal contribution σ 2 The method employs inverse normalization: smaller variance indicates more reliable inference, so its reciprocal is used for mapping. Specifically, the reciprocal of the causal contribution variance σ² of each node is calculated, and then the reciprocals of all nodes are normalized by a minimum-maximum method to obtain the normalized causal inference reliability index. The value ranges from 0 to 1, with a higher value indicating a higher reliability of the causal inference; this reliability index It has an inverse relationship with the original variance σ².

[0054] For the node anomaly score 'a', the same maximum-minimum normalization method is used: obtain the set of node anomaly scores for all nodes, extract the maximum and minimum values ​​from them, and normalize the node anomaly score 'a' for each node to obtain the normalized node anomaly score. The value ranges from 0 to 1.

[0055] For the topology completion confidence score c, since its value naturally falls within the range of 0 to 1, the original value can be used directly in the fusion calculation. Alternatively, it can be smoothed as needed, and the smoothed result can be used as the normalized topology completion confidence score. .

[0056] Based on the normalized data of the four categories from each node, the comprehensive root cause score R for each node is calculated according to the preset weighted fusion formula; the weighted fusion formula is: ; in, The normalized mean causal contribution represents the average probability of this node being a root cause at the causal level. The normalized causal inference reliability index characterizes the stability of the root cause inference result under different topological assumptions. The smaller the variance, the closer the index is to 1, and the greater its positive contribution to the comprehensive root cause score. The normalized node anomaly score represents the degree of anomaly in the node's operational state at the data level. The normalized topology completion confidence score represents the credibility of the node in the network topology; α, β, γ, and δ are preset weight coefficients that control the relative importance of four factors—causal contribution, inference reliability, node anomaly degree, and topology confidence—in the comprehensive root cause score.

[0057] The preset weight coefficients α, β, γ, and δ satisfy the constraint condition α+β+γ+δ=1. Their specific values ​​are determined by grid search or Bayesian optimization on the historical failure case dataset. The optimization objective is to maximize the hit rate of high-confidence root cause nodes in the top of the comprehensive root cause score ranking.

[0058] Through weighted fusion calculation, each node obtains a comprehensive root cause score R, which ranges from 0 to 1. The comprehensive root cause score R integrates four aspects of information: if a node has a high mean causal contribution, low variance, stable and reliable inference, high node anomaly score, and high topology completion confidence, then its comprehensive root cause score is close to 1; conversely, if a node has a low causal contribution, unstable inference, normal operating status, or questionable node existence, then its comprehensive root cause score will be reduced accordingly.

[0059] The comprehensive root cause score R of each node is associated and stored with the node identifier, mean causal contribution μ, variance of causal contribution σ², node anomaly score a, topology completion confidence c, and various normalized intermediate quantities to form a node-level comprehensive evaluation record.

[0060] The specific process for identifying high-confidence root cause nodes is as follows: The first and second preset thresholds are preset parameters that are adaptively determined based on historical operating data and fault cases of the actual network environment. The setting process is completed offline before the next fault detection. The first preset threshold is the judgment threshold for the comprehensive root cause score. It is set by obtaining a historical failure case dataset, which contains multiple failure events with labeled real root cause nodes. For each historical failure event, after performing the complete steps, the comprehensive root cause score ranking results of each node are obtained. The hit condition is that the real root cause node enters the top preset position in the comprehensive root cause score ranking. Threshold scanning is performed within the preset candidate threshold range, and the threshold that makes the hit rate of root cause nodes in historical failure cases exceed the preset hit rate lower limit and the false judgment rate lower than the preset false judgment rate upper limit is selected as the first preset threshold. The second preset threshold is the threshold for determining the variance of causal contribution. It is set by obtaining the variance of the causal contribution of correct root cause nodes in each failure event from a historical failure case dataset, forming a statistical sample set of correct root cause variances. The statistical sample set of correct root cause variances is then fitted with a distribution, and the upper preset quantile value of this distribution is taken as the second preset threshold. The upper preset quantile value means that in historical correct root cause cases, the proportion of samples with a causal contribution variance lower than this threshold reaches a preset percentage, thereby ensuring that nodes meeting this variance condition have inference stability comparable to historical correct root causes. Obtain the calculated comprehensive root cause score R for each node and the variance of the causal contribution of each node determined in step four. 2 For each node, the node identifier, the comprehensive root cause score R, and the variance of causal contribution σ² are combined into a triplet of data to form a node evaluation list to be judged. The node evaluation list covers all nodes that were assigned a comprehensive root cause score in step five, including observable nodes and placeholder nodes in the completion region.

[0061] The system reads the first preset threshold Th_R and the second preset threshold Th_σ from the preset storage area. The first preset threshold Th_R is the judgment threshold for the comprehensive root cause score. Its value is determined by performing a threshold scan on the historical fault case validation set, with the optimization goal of maximizing the balance between the hit rate of high-confidence root cause nodes and the false positive rate. The second preset threshold Th_σ is the judgment threshold for the variance of causal contribution. Its value is determined by statistically analyzing the upper limit of the variance distribution of the causal contribution of correct root cause nodes in historical fault cases. It is usually set to the preset quantile value of the variance distribution of historical correct root cause nodes. The first preset threshold and the second preset threshold are preset parameters that can be adjusted according to the fault characteristics of the actual network environment during system deployment.

[0062] By traversing each node in the node evaluation list, a two-condition joint judgment is performed. The two-condition joint judgment includes: a first condition judgment, comparing the comprehensive root cause score R of the current node with a first preset threshold Th_R; if R is greater than Th_R, the first condition is satisfied; and a second condition judgment, comparing the causal contribution variance σ² of the current node with a second preset threshold Th_σ. 2 If the value is less than Th_σ, then the second condition is satisfied; the current node is marked as a high-confidence root cause node if and only if the first and second conditions are satisfied simultaneously; the logic of the joint determination of the two conditions is as follows: the comprehensive root cause score is higher than the threshold, indicating that the node performs outstandingly in the comprehensive evaluation of the four dimensions of causal significance, inference reliability, degree of its own anomalousness and topological credibility; the causal contribution variance is lower than the threshold, indicating that the root cause inference of the node is highly consistent, stable and reliable under different topological completion assumptions; both conditions must be satisfied simultaneously to ensure that the output root cause node has both high accuracy and high credibility.

[0063] Nodes that do not meet the dual-condition joint judgment are further divided into two categories: For nodes whose comprehensive root cause score R is higher than the first preset threshold Th_R but whose causal contribution variance σ² is higher than or equal to the second preset threshold Th_σ, they are marked as low-confidence root cause nodes; these nodes have a certain root cause probability at the causal level, but their root cause inference results are greatly affected by the uncertainty of topological completion, and the conclusions are unstable under different topological assumptions, requiring further verification; For nodes whose comprehensive root cause score R is lower than or equal to the first preset threshold Th_R, they are marked as excluded nodes and are not included in the root cause candidate output.

[0064] All high-confidence root cause nodes are sorted from highest to lowest according to their comprehensive root cause score R, forming a high-confidence root cause node list. Each entry in the high-confidence root cause node list includes a node identifier, a comprehensive root cause score R, a mean causal contribution μ, and a variance of causal contribution σ. 2 The node anomaly score (a) and topology completion confidence score (c) provide a complete source tracing basis for subsequent construction of directed causal propagation paths and result output.

[0065] Step 6: Output the high-confidence root cause node and the directed causal propagation path starting from the high-confidence root cause node; Obtain the list of high-confidence root cause nodes; each entry in the high-confidence root cause node list includes a node identifier, a comprehensive root cause score R, a mean causal contribution μ, and a variance of causal contribution σ. 2 The list includes node anomaly score (a) and topology completion confidence (c). The list is sorted from high to low by the comprehensive root cause score (R), and the nodes at the top of the list are the most likely root causes of failure identified by the system.

[0066] Obtain the data required to construct the propagation path; specifically, this includes: obtaining the set of directed causal graphs corresponding to all candidate topology completion samples from step three, totaling K directed causal graphs; obtaining the average causal graph, which is obtained by weighted averaging of the directed adjacency matrices of the K directed causal graphs, where the weight of each directed adjacency matrix is ​​related to the causal discovery confidence of the candidate topology completion sample, and the weight of each directed edge in the average causal graph represents the average causal effect strength from the source node to the target node.

[0067] Construct a directed causal propagation path starting from a high-confidence root cause node: For each high-confidence root cause node in the list of high-confidence root cause nodes, starting from that node, perform a directed path traversal on the average causal graph to construct a directed causal propagation path from that root cause node to each affected node.

[0068] In the specific process of directed path traversal, the current high-confidence root cause node is set as the starting point of the path and added to the visited node set and the current layer node set. Starting from the current layer node set, all outgoing edges with the current layer node as the source node and whose causal effect strength exceeds the preset propagation threshold are retrieved in the directed adjacency matrix of the average causal graph. The target nodes of these outgoing edges are added to the next layer node set. The current layer node set is updated to the next layer node set, and the retrieval and expansion operations are repeated until the next layer node set is empty or the preset maximum propagation depth is reached.

[0069] During the traversal, the directed edges traversed in each step of expansion and their corresponding source and target nodes are recorded to form a directed path from the root cause node to each reachable node. For nodes that can be reached by multiple paths, the path with the strongest cumulative causal effect is retained as the main propagation path, and the remaining paths are stored as alternative propagation paths.

[0070] Calculate the confidence score for each directed edge in the propagation path: For each directed edge on each propagation path, calculate its overall confidence score to distinguish the credibility of different propagation links in the output.

[0071] The comprehensive confidence of a directed edge is calculated as follows: extract the causal effect strength value of the directed edge in the average causal graph; extract the topological completion confidence values ​​c_source and c_target of the source node and target node of the directed edge, and take the smaller value of the two as the lower limit of the topological confidence of the edge; multiply the causal effect strength value with the lower limit of the topological confidence to obtain the comprehensive confidence of the directed edge.

[0072] The overall confidence level reflects two aspects of information: the strength of the causal effect reflects the statistical significance and effect size of the causal relationship in the data, and the lower limit of the topological confidence level reflects the credibility of the existence of the nodes at both ends of the causal link. If the propagation path passes through the placeholder nodes of the completion area, the lower limit of the topological confidence level of the relevant directed edge is low, and the overall confidence level is reduced accordingly, indicating that there is an inference risk due to topological uncertainty in this propagation path for the operation and maintenance personnel.

[0073] Output high-confidence root cause nodes and propagation path results: The data is sent to maintenance personnel or downstream automated maintenance systems via a pre-defined output interface. The structured output data includes: root cause node summary information, which presents all high-confidence root cause nodes in list form. Each root cause node is accompanied by its comprehensive root cause score R, mean causal contribution μ, and variance of causal contribution σ. 2 The system includes node anomaly score (a) and topology completion confidence (c). Root cause nodes are sorted in descending order of comprehensive root cause score, and maintenance personnel can prioritize handling root cause nodes that rank higher.

[0074] The directed causal propagation path graph data presents the fault propagation path starting from the high-confidence root cause node in a directed graph data structure. In the directed causal propagation path graph, nodes are represented by geometric shapes, with observable nodes and placeholder nodes in the completion area distinguished by different fill styles or border styles. Directed edges are represented by lines with arrows, the direction of which indicates the direction of causal propagation. The thickness of the directed edge line represents the overall confidence of the edge; the thicker the line, the higher the confidence, and the thinner the line, the greater the uncertainty of the propagation relationship. For propagation edges with an overall confidence of less than a preset confidence threshold, they are drawn with dashed lines or semi-transparent styles to alert maintenance personnel that the propagation path may have a high inference risk and manual verification is recommended.

[0075] For low-confidence regions, if there is a propagation path segment in the causal propagation path graph that passes through the completed region, the completed confidence level of that region and recommended verification actions will be output separately. Recommended verification actions include sending active probe data packets to that region to confirm the connection relationship or requesting temporary monitoring permissions to obtain direct observation data.

[0076] After outputting the results, the system continuously monitors whether new observation data is acquired; new observation data includes proactive detection results reported by maintenance personnel based on recommended verification actions or additional observation data collected after the monitoring system gains new permissions.

[0077] When new observation data is detected, the system extracts the node and edge information involved in the new observation data, updates the observable edge set and observable node set of part of the observable topology graph in step one, and supplements the multidimensional time series monitoring data of the new observation node into the multidimensional time series monitoring data; based on the updated data, the system updates the topology completion results, causal graph structure and root cause localization conclusions for the affected subgraph region, and outputs the updated high-confidence root cause node and directed causal propagation path.

[0078] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0079] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0080] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A node topology awareness and fault detection method based on a graph neural network, characterized in that, This method This includes, step one: obtaining a partial observable topology of the current network, multi-dimensional time-series monitoring data of each observable node, and alarm logs; Step 2: Construct a node feature matrix based on the partially observable topology graph, multidimensional time-series monitoring data, and alarm logs. Use a causal-aware topology completion model to generate a preset number of candidate completed topology samples. Each candidate completed topology sample contains a set of nodes, a set of edges, and an uncertainty weight for each completed edge. The causal-aware topology completion model is based on a variational graph autoencoder. When generating completed edges, it applies causal regularization constraints based on the causal graph obtained from the previous round of causal discovery to suppress the generation of candidate completed edges with causal effect strengths lower than a preset effect threshold in the causal graph. Step 3: For each candidate topology completion sample, perform causal discovery based on the sample's topology and node characteristics to obtain the corresponding directed causal graph, and calculate the causal contribution of each node to the current abnormal node through counterfactual intervention. Step 4: Summarize the causal contribution of each node corresponding to the candidate topology completion samples under the preset number, obtain the causal contribution distribution of each node, and determine the mean and variance of the causal contribution of each node. Step 5: Based on the mean and variance of the causal contribution of each node, and the node anomaly score calculated based on multi-dimensional time-series monitoring data, and the topology completion confidence determined by the uncertainty weight of each completion edge in the candidate completion topology sample, calculate the comprehensive root cause score of each node, and determine the nodes with a comprehensive root cause score higher than the first preset threshold and a variance lower than the second preset threshold as high-confidence root cause nodes. Step 6: Output the high-confidence root cause node and the directed causal propagation path starting from the high-confidence root cause node.

2. The node topology perception and fault detection method based on graph neural networks according to claim 1, characterized in that, The process of constructing the node feature matrix is ​​as follows: Statistical aggregation of multidimensional time-series monitoring data yields multidimensional time-series feature vectors for each observable node. The alarm logs are encoded by node to obtain the alarm encoding vector for each observable node; The multidimensional temporal feature vector is concatenated with the alarm coding vector to form a node feature matrix. The rows of the node feature matrix correspond to observable nodes, and the columns correspond to the concatenated features.

3. The node topology perception and fault detection method based on graph neural networks according to claim 2, characterized in that, A predetermined number of candidate completed topology samples are generated using a causal-aware topology completion model, including: The node feature matrix and the set of observable edges are input into the variational graph autoencoder to obtain the latent variable distribution parameters, and the latent representation vector is obtained by sampling. Based on the implicit representation vector, predict the connection probability between nodes and generate the link prediction probability matrix; Using the causal graph obtained from the previous round of causal discovery, causal regularization is applied to the link prediction probability matrix to suppress candidate completion edges that lack causal effects in both directions. Based on the probability matrix after causal regularization, a candidate complete topology sample is generated. The sampling and generation process is repeated a preset number of times to obtain a preset number of candidate completed topology samples. Each completed edge is assigned an uncertainty weight, which is determined by the frequency of the completed edge in different samples and the causal regularization result.

4. The node topology perception and fault detection method based on graph neural networks according to claim 1, characterized in that, The process of obtaining the corresponding directed causal graph is as follows: For observable nodes in the candidate completed topology sample, use their initial node features; For the placeholder nodes in the completed region, weighted message passing is performed along the edges of the sample to estimate the node features. The weight of the weighted message passing is proportional to the uncertainty weight of the edge. The observable node features are concatenated with the estimated features of the occupant nodes in the completed region to form a complete node feature matrix; Using the complete node feature matrix as input, a directed adjacency matrix is ​​learned by optimizing an objective function that includes a feature reconstruction error term and a directed acyclic constraint term. The directed adjacency matrix is ​​then used as the directed causal graph corresponding to the candidate completed topology sample.

5. The node topology perception and fault detection method based on graph neural networks according to claim 4, characterized in that, The causal contribution of each node to the current anomalous node is calculated through counterfactual intervention, including: Obtain the current set of abnormal nodes and determine the upstream node of each abnormal node in the directed cause-effect graph; Perform counterfactual intervention on each upstream node, set the outgoing causal edge effect strength of that upstream node in the directed causal graph to zero, and calculate the change in the abnormal score of the abnormal node before and after the intervention. The change in abnormal scores is taken as the causal contribution of the upstream node to the abnormal node. If the same upstream node corresponds to multiple abnormal nodes, the maximum value of its causal contribution is taken as the final causal contribution of the upstream node.

6. The node topology perception and fault detection method based on graph neural networks according to claim 1, characterized in that, The process of obtaining the causal contribution distribution of each node is as follows: Collect a preset number of candidate topology completion samples and their corresponding causal contribution records. For each node, extract its causal contribution value in each candidate completed topology sample to form a causal contribution sequence, where the corresponding value of the sample that is not assigned a causal contribution is recorded as zero; Based on the causal contribution sequence, the causal contribution distribution of the node is obtained. The causal contribution distribution reflects the value and fluctuation range of the node as a root cause under different topological completion assumptions.

7. The node topology perception and fault detection method based on graph neural networks according to claim 6, characterized in that, The process of determining the mean and variance of the causal contribution of each node is as follows: The summation of the element values ​​in the causal contribution sequence of each node is divided by a preset number to obtain the mean causal contribution. The deviation of each element value in the causal contribution sequence from the mean causal contribution is calculated, and the causal contribution variance is obtained based on the deviation. The causal contribution variance reflects the fluctuation of the causal contribution of the node among different topological completion hypotheses.

8. The node topology perception and fault detection method based on graph neural networks according to claim 1, characterized in that, The process of calculating the comprehensive root cause score for each node is as follows: The mean causal contribution, variance of causal contribution, node anomaly score obtained from multidimensional time-series monitoring data, and topology completion confidence determined based on the uncertainty weight of completion edges in the candidate completion topology samples are obtained. The mean of causal contribution, variance of causal contribution, node anomaly score, and confidence score of topology completion were normalized respectively, with the variance of causal contribution being inversely normalized. The normalized data from the four categories are weighted and merged according to preset weight coefficients to obtain the comprehensive root cause score.

9. The node topology perception and fault detection method based on graph neural networks according to claim 1, characterized in that, The process of outputting high-confidence root cause nodes and the directed causal propagation path starting from the high-confidence root cause nodes is as follows: Obtain the average causal graph, starting from the high-confidence root cause node and traversing along the causal direction to obtain the directed propagation path from the root cause node to the affected node. For each directed edge in the directed propagation path, calculate the comprehensive confidence level based on the causal effect strength of the directed edge and the topological completion confidence level of the two endpoints. Output the directed propagation path, and visually distinguish between observable nodes and complete region nodes in the propagation path graph, and present the confidence level of the directed edges based on the overall confidence level.

Images