An intelligent time series data backtracking and reproduction method, system, device, medium and apparatus

Abstract

A method, system, device, medium, and apparatus for intelligent time-series data backtracking and reproduction, belonging to the field of big data analytics, includes: acquiring time-series data and performing spatiotemporal fusion processing to obtain a standardized time-series data sequence; obtaining event recognition results through an event recognition model; generating event causal links based on multiple events identified in the event recognition results using a pre-constructed causal inference network, whereby the event causal links indicate the causal relationships between multiple events and their corresponding conditional probabilities; and generating an interactive timeline containing event nodes and causal relationships to achieve backtracking and reproduction of the time-series data. This application constructs a hybrid deep learning model integrating a transformer network and a long short-term memory network to intelligently analyze standardized time-series data obtained through spatiotemporal fusion. This model can efficiently and accurately identify and locate key events, and then generate event causal links through a causal inference network to achieve backtracking and reproduction of the time-series data.

Description

Technical Field

[0001] This application belongs to the field of big data analysis technology, and in particular relates to a method, system, device, medium and apparatus for intelligent time series data backtracking and reproduction. Background Technology

[0002] With the deepening of digital transformation, enterprises and institutions have accumulated massive amounts of time-series data, including logs, monitoring metrics, business process records, and IoT sensor data. In scenarios such as data security auditing, compliance traceability, fault diagnosis, and business event reconstruction, higher demands are placed on the ability to trace and reproduce time-series data. However, existing technologies generally have the following shortcomings when dealing with the intelligent traceability needs of large-scale, multi-source, heterogeneous time-series data: 1. Traditional backtracking methods are inefficient and inaccurate. Traditional time-series data backtracking relies on manual keyword selection and log fragment assembly, resulting in extremely low retrieval efficiency when dealing with hundreds of millions of data points. Simple rule-based filtering methods fail to identify hidden anomaly patterns, leading to a high rate of missed key events and a source tracing accuracy of less than 60%. Furthermore, the maintenance of rule engines heavily depends on domain expert knowledge, making it difficult to adapt to dynamically changing business environments and the need to identify new anomaly patterns.

[0003] 2. Difficulty in fusing multi-source heterogeneous data Enterprise data comes from diverse sources, including databases, message queues, APIs, and IoT devices. The data formats are heterogeneous, encompassing JSON, XML, CSV, binary, and other formats, with inconsistent time granularity ranging from milliseconds to minutes, and a lack of a unified spatiotemporal alignment mechanism. Traditional solutions typically employ manually written ETL scripts for data cleaning and alignment, resulting in high maintenance costs, poor scalability, difficulty in adapting to scenarios with dynamically increasing data sources, and an inability to achieve accurate spatiotemporal correlation and fusion.

[0004] 3. Lack of intelligent causal analysis capabilities Existing backtracking systems can only display a list of events in a time series and cannot automatically infer causal relationships between events. In fault tracing scenarios, the system cannot automatically identify the complete causal propagation chain from the initial anomaly to the final failure, resulting in root cause localization heavily relying on expert experience, leading to long analysis cycles and low efficiency.

[0005] 4. Inadequate security and compliance safeguards. Traditional data backtracking solutions require centralized storage and processing of raw datasets scattered across various locations, posing serious risks of data leakage and unauthorized access by internal personnel. In cross-organizational data collaboration scenarios, privacy regulations restrict the export of raw data, limiting global backtracking and analysis capabilities. Furthermore, the lack of fine-grained access control and dynamic anonymization mechanisms for sensitive data makes it difficult to meet regulatory requirements for minimal data usage and dynamic authorization.

[0006] 5. Weak visualization and interactivity capabilities Existing systems mostly consist of static reports or simple charts, lacking interactive features. They cannot intuitively present the spatiotemporal evolution of complex events, resulting in high comprehension costs for business personnel and making it difficult to quickly extract key information from massive amounts of data and make decisions.

[0007] In summary, existing technologies for intelligent backtracking and reproduction of massive, multi-source, heterogeneous time-series data suffer from drawbacks such as low efficiency, poor accuracy, difficulty in data fusion, lack of causal reasoning, insufficient security and compliance guarantees, and weak visualization and interactive capabilities. Therefore, there is an urgent need for an intelligent, efficient, and scalable time-series data backtracking and reproduction system to address one or more of the aforementioned technical problems. Summary of the Invention

[0008] This application aims to at least partially address one of the technical problems in related technologies. To this end, this application provides an intelligent time-series data backtracking and reproduction method, system, device, medium, and apparatus. By constructing a hybrid deep learning model integrating a transformer network and a long short-term memory network, it intelligently analyzes standardized time-series data that integrates spatiotemporal data. It achieves dual analysis of time-series data from both global and local detail dimensions, enabling efficient and accurate identification and location of key events. Subsequently, it generates causal links of events through a causal inference network, realizing the backtracking and reproduction of time-series data.

[0009] To achieve the above objectives, in a first aspect, this application provides an intelligent time-series data backtracking and reproduction method, comprising: Acquire time-series data from at least one data source; The time-series data is subjected to spatiotemporal fusion processing to obtain a standardized time-series data sequence; The standardized time-series data sequence is input into a pre-trained event recognition model to obtain event recognition results. The event recognition model includes a first network and a second network. The first network is used to extract global temporal dependency features of the time-series data sequence, and the second network is used to extract local temporal evolution features of the time-series data sequence. The event recognition results are determined based on the fusion features of the global temporal dependency features and the local temporal evolution features. Based on the multiple events identified in the event identification results, a pre-constructed causal reasoning network is used to generate event causal links, which indicate the causal relationships between the multiple events and the corresponding conditional probabilities. Based on the event causal chain, an interactive timeline containing event nodes and causal relationships is generated to enable the backtracking and reproduction of time-series data.

[0010] Preferably, the step of performing spatiotemporal fusion processing on the time-series data includes: Based on the multi-source fusion logic of time matching, spatial matching, and business identifier association, time-series data fragments from different data sources are merged into a unified standardized time-series data sequence; Among them, time matching is configured such that the difference between the timestamps carried by data records from different data sources is less than a preset time window threshold; spatial matching is configured such that the distance between the geographical locations associated with data records from different data sources is less than a preset spatial distance threshold; and business identifier association is configured such that data records from different data sources have a common primary key field used to identify the same business entity.

[0011] Preferably, the first network is a transformer network based on a multi-head self-attention mechanism, used to capture the global dependency between any two time steps in the standardized time series data sequence; the second network is a long short-term memory network, used to capture the local time order and dynamic changes in the standardized time series data sequence.

[0012] Preferably, the training process of the event recognition model includes: Obtain sample time-series data sequences labeled with event types and time locations; The sample time series data sequence is input into the first network and the second network to obtain the predicted event type and predicted time position; A loss function is constructed based on the cross-entropy loss between the predicted event type and the labeled event type, and the deviation between the predicted time position and the labeled time position, so as to adjust the parameters of the first network and the second network based on the loss function.

[0013] Preferably, the causal reasoning network is a Bayesian network based on a directed acyclic graph, where nodes represent events and edges represent causal relationships labeled with conditional probabilities; the construction method of the causal reasoning network includes: Obtain the historical event sequence; Based on the Granger causality analysis algorithm and / or the Peter-Clark structural learning algorithm, the causal relationship direction between events is determined from the historical event sequence; Calculate the conditional probability corresponding to each causal relationship to complete the construction of the causal inference network.

[0014] Preferably, the event identification result also includes the result of classifying the identified events according to preset event types, wherein the preset event types include at least abnormal events, operation events, state change events, and composite business events; The operation events include recordable behaviors generated by actions initiated by users or system entities, such as user login, configuration changes, and service restarts. The state change events include changes in the internal attributes or operating state of the monitored object; The composite business event is an event with clear business semantics, which is composed of multiple underlying events combined according to a preset time sequence and causal logic.

[0015] Preferably, the steps for backtracking and reproducing time-series data include: Based on the events contained in the causal chain of the events, build an inverted index and a B+ tree index; The inverted index uses the event type as the key and the list of timestamps of the identified events as the values; the B+ tree index is constructed with timestamps as the primary key, and the leaf nodes store pointers to the corresponding event records. When performing an event backtracking query, the target event type is first filtered through the inverted index to obtain a candidate timestamp set consisting of event timestamps that match the event type. Then, the time range is filtered within the candidate timestamp set through the B+ tree index to obtain the final event retrieval result.

[0016] Preferably, the training data of the event recognition model, the standardized time-series data sequence, and the intermediate data of the event causal link are all encrypted during storage and computation; wherein, the decryption and computation operations related to the encrypted data are restricted to be performed in a hardware-isolated trusted execution environment, so that sensitive data fields in the traceback and reproduction results presented to the user are desensitized.

[0017] Preferably, in applications involving multi-party data joint modeling, each participant trains an event recognition model on local data to obtain local model parameters, uploads the encrypted local model parameters to the aggregation server for federated average aggregation, receives the global model parameters issued by the aggregation server and updates the local model, so as to achieve collaborative modeling under the condition that the original data does not leave the domain.

[0018] Preferably, the process of backtracking and reproducing time-series data also includes: Real-time acquisition of status parameters characterizing the local system status, including at least storage load, query frequency, data popularity, and input / output latency; The state parameters are input into a pre-trained deep reinforcement learning model to obtain the optimal resource scheduling action to be performed for the current state of the local system. The optimal resource scheduling action includes data storage level migration, data replica number adjustment and computing resource quota adjustment. Execute the optimal resource scheduling action; The reward function of the deep reinforcement learning model is constructed based on the changes in query response time and hardware resource usage of the local system before and after the execution of the optimal resource scheduling action.

[0019] Preferably, based on the event causal chain, an interactive timeline containing event nodes and causal relationships is generated and presented, including: It can receive drag and zoom operations, or click operations on event nodes by users on the timeline; In response to the drag operation, adjust the display time range of the time axis; In response to the scaling operation, the time scale granularity of the time axis is adjusted; In response to a click on a target event node, detailed information about the target event node is displayed on one side of the timeline. The detailed information includes the event type, occurrence time, associated entity identifier, and the causal relationship chain and its conditional probability output by the causal inference network, starting from the target event node.

[0020] Secondly, this application provides an intelligent time-series data backtracking and reproduction system, comprising: The data access and processing module is used to acquire time-series data from at least one data source and perform spatiotemporal fusion processing on the time-series data to obtain a standardized time-series data sequence. An event recognition module is deployed with a pre-trained event recognition model for performing event recognition on the standardized time-series data sequence. The event recognition model includes a first network for extracting global time-series dependency features and a second network for extracting local time-series evolution features. The event recognition result is determined based on the fusion features of the global time-series dependency features and the local time-series evolution features. The causal reasoning module is used to generate event causal links based on multiple events identified in the event identification results using a pre-constructed causal reasoning network. The event causal links indicate the causal relationships between the multiple events and the corresponding conditional probabilities. The interactive presentation module is used to generate and present an interactive timeline containing event nodes and causal relationships based on the event causal chain, so as to realize the backtracking and reproduction of time series data.

[0021] Secondly, this application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of any of the methods described above. Secondly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described above. Secondly, this application provides a data center fault retrospective analysis device, including the aforementioned intelligent time-series data retrospective and reproduction system, the device being used to perform the following operations: Acquire multi-source time-series data of computing nodes in the data center, including computing load monitoring data, application log data, and storage input / output performance data; Through the data access and processing module, the computing load monitoring data, application log data, and storage input / output performance data are time-aligned and associated with business identifiers to obtain a standardized time-series data sequence. The event recognition module identifies abnormal events of computing nodes, which include at least: abnormal computing load events, abnormal input / output delay events, and data read failure events. The causal reasoning module generates a fault propagation causal link, which indicates the causal relationship and corresponding conditional probability between the abnormal events of the multiple computing nodes. The interactive presentation module replays the fault propagation causal chain via a timeline to assist in locating the root cause of the fault.

[0022] Based on the above technical solution, the intelligent time-series data backtracking and reproduction method of this application has at least one of the following beneficial effects compared with the prior art: 1. This application constructs a hybrid deep learning model that integrates a transformer network and a long short-term memory network to intelligently analyze standardized time-series data that has undergone spatiotemporal fusion. The transformer network uses a multi-head self-attention mechanism to capture global temporal dependency features across long sequences, while the long short-term memory network simultaneously captures fine local temporal evolution features in the sequence. By fusing the two types of features, dual analysis of time-series data from both global patterns and local details is achieved. This enables automatic, efficient, and accurate identification and localization of key events, significantly improving the accuracy of complex event identification and temporal localization precision compared to a single model.

[0023] 2. This application constructs a causal reasoning network based on a Bayesian network of a directed acyclic graph, and uses Granger causal analysis algorithm and / or Peter-Clarke structural learning algorithm to automatically learn the causal relationship direction and conditional probability between events from historical event sequences. This enables intelligent reasoning and quantitative presentation of the causal links of events in complex business scenarios, upgrading from "event list display" to "causal relationship reasoning", helping users quickly locate the root cause of the fault or the source of the business, and significantly improving the depth of backtracking analysis and the accuracy of root cause location path.

[0024] 3. This application constructs a "usable but invisible" end-to-end security and compliance mechanism by keeping the data encrypted throughout the storage and computation process and strictly restricting decryption and computation operations to a hardware-isolated trusted execution environment. This ensures that while guaranteeing the ability to trace and reproduce events, the original data and sensitive fields are always in a secure, isolated, and desensitized state, thus meeting the stringent legal and regulatory requirements for data security and privacy protection.

[0025] 4. This application introduces a deep reinforcement learning model and constructs an autonomous decision-making framework with storage load, query frequency, data popularity, and input / output latency as state parameters, and data storage hierarchy migration, replica number adjustment, and computing resource quota adjustment as action spaces. It designs a multi-objective reward function based on changes in query response time and hardware resource usage, thereby achieving adaptive optimization scheduling of system resources and effectively reducing hardware costs while ensuring query performance. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart illustrating an intelligent time-series data backtracking and reproduction method provided in this application; Figure 2 This is an architecture diagram of an intelligent time-series data backtracking and reproduction system provided in this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0029] The terms “first,” “second,” “third,” “fourth,” “fifth,” “sixth,” “seventh,” and “eighth,” etc. (if present), in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein.

[0030] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, such that a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or apparatus.

[0031] like Figure 1 As shown in the figure, this application provides an intelligent time-series data backtracking and reproduction method, which mainly includes the following steps: S1. Obtain time-series data from at least one data source; S2. Perform spatiotemporal fusion processing on the time series data to obtain a standardized time series data sequence; S3. Input the standardized time-series data sequence into the pre-trained event recognition model to obtain the event recognition result; S4. Based on the multiple events identified in the event identification results, generate event causal links using a pre-constructed causal reasoning network; S5. Based on the event causal chain, generate an interactive timeline containing event nodes and causal relationships to enable the backtracking and reproduction of time-series data.

[0032] It should be noted that the subject executing this method can be a computer system or server cluster that integrates multi-source data access, intelligent analysis, secure computing, and interactive presentation capabilities.

[0033] The steps described above are explained in detail below.

[0034] In step S1, the system acquires time-series data from numerous data sources. These data sources include, but are not limited to, various databases (such as relational databases MySQL and PostgreSQL, and time-series databases Prometheus and InfluxDB), log systems (such as ELK), message queues (such as Kafka), Internet of Things (IoT) devices, application programming interfaces (APIs), and file servers. The system can handle structured, semi-structured, and unstructured multi-source heterogeneous data. To uniformly access these vastly different data sources, the system can employ a unified access gateway and design multiple data adapters. For example, for message queue data sources, a Kafka adapter can be deployed to support subscription access to real-time log streams; for databases, a database adapter can be deployed to support incremental data extraction and querying of databases; for IoT devices, an IoT adapter can be deployed to support sensor data acquisition for IoT protocols such as message queue telemetry transmission and restricted application protocols. Each adapter is responsible for completing the handshake, data retrieval, format parsing, and preliminary conversion for a specific protocol. Of course, the access method for data sources is not limited to the above adapter types and can be flexibly expanded according to actual needs. For example, a file adapter can be added to support batch import of CSV, JSON, Parquet, and other format files.

[0035] In step S2, the multi-source heterogeneous time-series data obtained in step S1 undergoes spatiotemporal fusion processing to eliminate inconsistencies in time granularity, spatial coordinates, and business identifiers among data sources, generating a standardized time-series data sequence with a unified structure. The core logic of this fusion process is a multi-source fusion logic based on time matching, spatial matching, and business identifier association. That is, multi-source data segments that meet any two or more conditions are regarded as components describing the same business chain and then fused together.

[0036] Specifically, time matching is configured such that the difference between the timestamps carried by data records from different data sources is less than a preset time window threshold. For example, if the generation time of an alarm record reported by a sensor and a log record differs by less than 0.1 seconds, they can be considered to be time-matched. Spatial matching is configured such that the distance between the geographical locations associated with data records from different data sources is less than a preset spatial distance threshold. For example, if the location reported by a mobile terminal and the location of a nearby camera are within 10 meters, they can be considered to be spatially matched. Business identifier association is configured such that data records from different data sources share a common primary key field used to identify the same business entity. For example, an order log and a payment log both contain the same "order number (order_id)," or a fault alarm and a server performance metric both contain the same "device number (device_id)." Through this fusion logic, the system can logically aggregate interrelated data fragments into a complete business event context.

[0037] In the specific operation of time alignment, a sliding window mechanism can be used. For example, a uniform time granularity of 1 second can be set, aligning the timestamps of each data source to the nearest 1-second time slot. For data gaps caused by different sampling frequencies, interpolation methods can be used to fill in the missing data. For example, for continuously changing indicators such as temperature and CPU utilization, linear interpolation can be applied; for discrete events such as changes in service status, nearest neighbor interpolation can be used, filling in with the nearest valid value. In the specific operation of spatial alignment, data with geographic location information can first be uniformly converted to the World Geodetic System 1984 (WGS84) coordinate system, and then a K-D-Tree spatial index structure can be used for nearest neighbor matching to efficiently calculate and filter out devices or records whose distance is within a threshold range.

[0038] After processing in step S2, a standardized time-series data sequence with continuous values ​​is obtained, carrying a unified timestamp, spatial label, and business identifier. Each element in the standardized time-series data sequence consists of a timestamp and a feature vector. The feature vector may contain the encoding vector of numerical indicators, categorical events, or text logs.

[0039] In step S3, the standardized time-series data sequence generated in step S2 is input into a pre-trained event recognition model for automatic identification and labeling of key events.

[0040] This event recognition model is a hybrid deep learning model consisting of two parts: a first network and a second network. The first network extracts global temporal dependency features from the standardized time-series data sequence, while the second network extracts local temporal evolution features of X. The event recognition result is determined based on the fusion of the global temporal dependency features and the local temporal evolution features.

[0041] In one possible implementation, the first network is a Transformer network based on a multi-head self-attention mechanism. The Transformer network can process the entire sequence in parallel. Through the multi-head attention mechanism, the query (Q), key (K), and value (V) are mapped to multiple different subspaces, and attention is calculated separately. Finally, the results are concatenated. The Transformer network can capture the direct correlation between any two time steps in the sequence. This makes the Transformer network good at identifying long-range, global anomalous patterns, such as discovering an input-output peak pattern that occurs periodically at 3 a.m. every day for months, or identifying a macroscopic chain of how a device failure propagates across different subsystems over several hours.

[0042] The second network is a Long Short-Term Memory (LSTM) network. LSTM is a special type of recurrent neural network that effectively solves the gradient vanishing problem in traditional recurrent neural networks when processing long sequences through three gating mechanisms: forget gate, input gate, and output gate. It excels at capturing the sequential relationships and dynamic evolution of time series within short time windows. This makes LSTM adept at identifying local, gradual changes. For example, it can accurately capture how the utilization of a graphics processor gradually decreases from 95% to 20% over ten minutes, rather than simply viewing it as a single, instantaneous change.

[0043] By cascading and fusing a transformer network and a long short-term memory network (LSTM), where the LSM input can be the output sequence of the transformer network, this hybrid model achieves a complementary and unified approach to global pattern analysis and local detail capture. Compared to using either model alone, it yields a more comprehensive and accurate representation of temporal features. The fused features are then passed through an output layer consisting of a fully connected layer and a normalized exponential function to generate the final event recognition result. This result is typically presented as a probability distribution vector, where each element corresponds to the probability of an event category (such as "normal," "disk failure," "network congestion," "high load," etc.).

[0044] Event recognition models require training before deployment. One possible implementation involves the following training process: First, acquire sample time-series data sequences labeled with event types and timestamps. These samples are partly manually labeled by domain experts and partly automatically labeled with high-confidence samples using a deterministic rule engine. Next, input the sample data into the first and second networks described above to obtain the event types and predicted timestamps predicted by the model. Then, construct a loss function based on the prediction results and the true labels. To ensure the model focuses not only on the accuracy of event classification but also on the precision of event time location, this application designs a composite loss function: Total Loss = Cross-Entropy Loss + λ·Time Bias Penalty Term. Here, the cross-entropy loss measures the difference between the predicted event type and the actual event type; the time bias penalty term measures the deviation between the model's predicted event time and the actual event time, for example, it can be calculated as the mean squared error of the time bias. λ is a hyperparameter used to balance the importance of the two loss terms, and its specific value can be determined on the validation set through tuning methods such as grid search. Finally, an adaptive moment estimator optimizer with weight decay, such as AdamW, is used to adjust the parameters of the first and second networks to minimize the loss function until the model converges.

[0045] The trained event recognition model described above can not only identify the occurrence of events but also classify them. In one possible implementation, the event recognition results also include classifications of the identified events according to preset event types. These preset event types include at least abnormal events, operational events, state change events, and composite business events. Operational events include recordable behaviors initiated by users or system entities, such as user login, configuration changes by system administrators, and service restarts. State change events refer to changes in the internal attributes or operating state of the monitored object, such as a server's state changing from "running" to "stopped," or a device's temperature changing from "normal" to "too high." Composite business events are higher-level events with clear business semantics, composed of multiple underlying atomic events combined according to a preset sequence and causal logic. For example, a composite business event of "order payment failure" might be composed of a series of atomic events: "user submits payment request," "bank interface returns rejection," and "order system executes rollback."

[0046] The automatic event identification mechanism employs a dual strategy combining rules and models. For simple and clear-cut anomalies, the rule engine can directly identify them; for example, a rule like "CPU utilization > 90% for 5 minutes" can be used to determine high-load events. The selection of parameters such as the threshold (e.g., 90%) and duration (e.g., 5 minutes) can be based on the long-term operational experience accumulated by domain experts or statistical analysis of historical data. For complex and subtle anomaly patterns, the aforementioned transformer-long short-term memory network hybrid model is used for intelligent identification.

[0047] In step S4, based on the multiple events identified in step S3, a pre-built causal reasoning network is used to automatically generate event causal links. These event causal links indicate the causal relationships between multiple events and their corresponding conditional probabilities.

[0048] In one possible implementation, the causal reasoning network is a Bayesian network based on a directed acyclic graph (DAG). In this network, each node represents an identified event, and the directed edges between nodes represent causal relationships where one event causes another. Each edge is labeled with a quantified conditional probability value, for example, P(event B | event A) = 0.91, indicating that the probability of event B occurring is 91% given that event A has occurred.

[0049] The construction process of this causal reasoning network is offline and based on historical data, and mainly includes the following steps: First, historical event sequence data is acquired. This data consists of time-stamped event logs output by the event recognition model in step S3 within a historical time period. Then, based on this data, a causal discovery algorithm is used to determine the direction of causal relationships between events. This application can flexibly use, but is not limited to, one or a combination of the following two algorithms: The first is the Granger Causality algorithm. The basic principle of this algorithm is that if past information about a variable X can significantly improve the prediction accuracy of another variable Y, that is, by constructing a vector autoregressive model and using the F-test, it is found that adding historical terms of X significantly reduces the prediction error of Y (e.g., p-value < 0.01), then X is considered a Granger cause of Y. This method is very suitable for analyzing whether there is predictability between events that occur sequentially in time. The second is the Peter-Clarke (PC) structure learning algorithm. This algorithm starts from a fully connected graph of all event nodes, and through a series of conditional independence tests (such as the chi-square test), gradually removes edges between nodes that become independent under the given condition of other nodes, and finally determines the direction of the edges based on the V-structure, thereby learning a complete network structure.

[0050] Finally, after determining the network structure (i.e., the directed edges of causal relationships), the conditional probability corresponding to each directed edge is calculated. This can be obtained by statistically analyzing the frequency of child events occurring when a parent event occurs in historical data. For example, the conditional probability P(data read failure | IO latency anomaly) can be calculated by statistically analyzing the proportion of "data read failure" events that immediately follow an "IO latency anomaly" event within a subsequent time window. At this point, a causal reasoning network containing nodes, directed edges, and conditional probabilities is complete.

[0051] When this network is applied to real-time or retrospective analysis, it can automatically infer and output a complete causal chain for a set of newly identified events, such as "IO latency event → data read failure event (probability 0.91) → GPU utilization decrease event (probability 0.87)", and calculate the joint probability of the causal chain (e.g., 0.91 × 0.87 = 0.79).

[0052] In step S5, based on the event causal chain generated in step S4, an interactive timeline containing event nodes and causal relationships is generated and presented, ultimately realizing intelligent and intuitive time-series data backtracking and reproduction.

[0053] This interactive process fully embodies the core innovation of "event simulation and reproduction." In one possible implementation, the system's front-end interface provides an interactive timeline area and receives various user operations: In response to the user's dragging operation on the timeline, the system adjusts the displayed time range of the timeline to help the user quickly locate the historical interval of interest; in response to the user's zooming operation on the timeline, the system adjusts the granularity of the timeline's time scale, allowing the user to simultaneously observe macro-level monthly trends and micro-level second-level event details; in response to the user's clicking operation on a target event node, the system expands a detailed information panel on one side of the timeline. This panel not only displays basic information such as event type, occurrence time, and associated entity identifiers (such as device number), but also highlights the causal relationship chain and its conditional probability output by the causal inference network, starting or ending with the current event node, allowing the user to understand the cause and effect by following the clues from any event.

[0054] To support efficient event retrieval, a dedicated indexing mechanism is needed in the backend of the interactive timeline. One possible implementation involves building an inverted index and a B+ tree index based on the events contained in the causal chain of the events. The inverted index is an efficient keyword-document mapping structure, using the event type as the key and a list of timestamps of all identified events belonging to that type as the value. The B+ tree index is a balanced multi-way search tree, built with timestamps as the primary key. All data records are stored in timestamp order, and its leaf nodes store pointers to the corresponding event records. Leaf nodes are connected by pointers, making it particularly suitable for range queries. When a user initiates a composite query that includes an event type and a time range (e.g., "query all 'GPU failure' events from October 1st to 2nd, 2025"), the system employs a two-stage query strategy: First, it quickly filters the target event type "GPU failure" using an inverted index, obtaining a candidate timestamp set composed of event timestamps matching this event type; then, it uses a B+ tree index to efficiently filter the time range within this candidate set, quickly selecting records falling within the specified time period. This combined indexing mechanism significantly improves the efficiency of backtracking retrieval under complex conditions. Of course, the indexing mechanism is not limited to these two; for geographic location information, a geohash index can also be introduced to accelerate spatial range queries.

[0055] In one possible implementation, to support complex multi-hop relationship queries and visualizations, the system can use a graph database to store and query event causal relationships. In the data model, events are modeled as graph nodes, causal relationships as directed edges, and information such as probability and latency attached to the edges serves as edge attributes. When a user needs to trace the complete causal path from event A to event C, the graph database's declarative query language can efficiently return all paths that meet the criteria, significantly outperforming multi-table join queries in traditional relational databases.

[0056] Data security and privacy protection are paramount throughout the entire backtracking and reproduction process. In one possible implementation, the data security mechanism of this solution is configured as follows: the training data of the event recognition model, the standardized time-series data sequence generated in step S2, and the intermediate data of the event causal chain generated in step S4 are all kept encrypted during storage and computation. Storage-state encryption can employ the advanced encryption standard AES-256 algorithm, with the key centrally managed by an independent Key Management System (KMS). Decryption and computation operations related to encrypted data are strictly restricted to hardware-isolated Trusted Execution Environments (TEEs), for example, by creating a hardware-encrypted memory region called a "secure enclave" within the central processing unit using Intel Software Protection Extensions (Intel SGX) technology. Within this enclave, data is decrypted, processed, and results are generated; the plaintext data throughout the process is invisible to the operating system, virtual machine monitor, and even the administrator outside the enclave. Once the calculation is complete, the results are re-encrypted or dynamically anonymized within the enclave before being output. Sensitive data fields (such as user name, ID number, device serial number, detailed IP address, etc.) in the final traceability and reproduction results presented to the user are all anonymized; for example, the beginning and end are retained while the middle is replaced with an asterisk. This ensures that while providing powerful analytical capabilities, the strict requirement of "data usable but not visible" is met.

[0057] Furthermore, in application scenarios involving collaborative modeling of multi-party data, such as multiple hospitals jointly training a model for identifying prescription violations, a federated learning-based implementation is provided. Each participant (e.g., multiple hospitals) independently trains an event recognition model on its own local data, obtaining local model parameters. Then, instead of uploading the raw data, the local model parameters, processed with homomorphic encryption or differential privacy, are uploaded to a central aggregation server. The aggregation server executes a federated averaging algorithm, which calculates the global model parameters by weighting the parameters uploaded by each party. The weights can be the proportion of each participant's sample data. After calculation, the aggregation server sends the updated global model parameters back to each participant to update their local models. This process iterates multiple times until the model converges. Throughout the entire process, the raw data of each party never leaves its own storage domain, achieving collaborative modeling while protecting data privacy.

[0058] One possible implementation provides a system resource adaptive optimization method based on deep reinforcement learning. This method runs continuously in the system background, collecting state parameters representing the current state of the local system in real time, forming a state vector. These state parameters include at least: storage load (disk space utilization of each storage node), query frequency (multiple dimensions such as the number of times different data shards are accessed per unit time), data popularity (calculated based on the time of the last access to data, decaying over time, e.g., popularity value = 1 / (current time - last access time)), and input / output latency (average response time of disk read / write, in milliseconds). Then, these state parameters are input into a pre-trained deep reinforcement learning model, namely a deep Q-network. A deep Q-network is a reinforcement learning algorithm that combines deep learning with Q-learning algorithms; it uses a deep neural network to approximate the action value function (Q-function). Based on the current state, the model calculates a Q-value (action value) for each candidate action in its action space. These candidate actions include: data storage tier migration (e.g., migrating frequently accessed hot data from HDDs to SSDs, or migrating cold data to lower-cost object storage), adjusting the number of data replicas (increasing hot data replicas to improve concurrent read performance, or reducing cold data replicas to save storage space), and adjusting computing resource quotas (dynamically allocating or reclaiming CPU and memory resources for different query or analysis tasks). The model selects the action with the largest Q-value as the optimal resource scheduling action for the current state and executes it automatically. The training objective of this deep Q-network model is to maximize the cumulative value of a carefully designed multi-objective reward function. This reward function is constructed based on the changes in query response time and hardware resource usage of the local system before and after the execution of the optimal resource scheduling action, specifically in the form of: R = α·ΔPerformance + β·ΔCost_saved -γ·Latency. Here, ΔPerformance represents performance improvement metrics such as the percentage reduction in query response time; ΔCost_saved represents cost reduction metrics such as hardware resource savings; Latency represents the additional latency penalty incurred by the resource scheduling action itself (such as data migration); α, β, and γ are weighting coefficients used to balance the relationship between performance, cost, and latency, and their specific values ​​can be determined by performing a grid search in a test environment. For example, in a set of experiments, α=0.5, β=0.3, and γ=0.2 can be set. The design of the reward function ensures that the strategy learned by the model can pursue optimal performance and lowest cost while avoiding excessive perturbation. The conditions for automatically triggering DQN to make optimization decisions can be: the average IO latency exceeds a preset threshold (such as 100 milliseconds), the access popularity of a certain data shard changes by more than 50% in a short period of time, or the disk utilization of a certain storage node exceeds 90%, etc.

[0059] like Figure 2 As shown, in one possible implementation, this application provides an intelligent time-series data backtracking and reproduction system, which adopts a hierarchical distributed architecture and is based on the same inventive concept as the above method embodiments.

[0060] As attached Figure 2 As shown, the overall architecture of this intelligent time-series data backtracking and reproduction system is divided into six layers from bottom to top: security and compliance layer, data access layer, data processing layer, storage and computing layer, model analysis layer, and application layer. Each layer communicates with the others through standardized data interfaces. Lower layers provide basic capabilities to upper layers, and data flows from bottom to top, undergoing access, processing, storage, and analysis before finally being presented at the top layer.

[0061] The security and compliance layer serves as the foundational safeguard for the entire system, integrating three core technologies: privacy computing, federated learning, and homomorphic encryption. This layer is responsible for providing all upper-layer modules with security services such as encrypted data storage, encrypted transmission, ciphertext computation, and access control, ensuring that the original data remains "usable but invisible" throughout its entire lifecycle.

[0062] The data access layer sits above the security and compliance layer, deploying a unified access interface and a multi-protocol engine. The unified access interface is specifically implemented as an API Gateway supporting representational state transitions and remote procedure call protocols, responsible for protocol conversion, flow control, authentication, and request routing. The multi-protocol engine includes various data adapters designed for different data source types, such as a Kafka adapter for connecting to message queues, a database adapter for connecting to relational databases, and an IoT adapter for connecting to IoT devices. This layer corresponds to the data access function of the data access and processing module, used to acquire time-series data from at least one data source.

[0063] The data processing layer deploys a real-time data cleaning module and a spatiotemporal fusion engine. The real-time data cleaning module is responsible for preprocessing the raw data, including deduplication, outlier filtering, and missing value completion. The spatiotemporal fusion engine executes the core data fusion logic, fusing heterogeneous time-series data from different sources into a standardized time-series data sequence with unified time granularity, aligned spatial coordinates, and consistent business identifiers, based on multi-source fusion logic of time matching, spatial matching, and business identifier association. This layer corresponds to the spatiotemporal fusion processing function of the data access and processing module.

[0064] The storage and computing layer employs a distributed columnar storage engine, supporting data sharding and replication mechanisms to achieve efficient storage and compression of massive amounts of time-series data. Simultaneously, this layer also deploys an adaptive optimization module. This module internally runs a reinforcement learning model based on a deep Q-network. By collecting real-time state parameters such as storage load, query frequency, data popularity, and input / output latency, it autonomously decides to execute optimization actions such as data storage hierarchy migration, replica number adjustment, and computing resource quota adjustment to achieve hardware cost optimization while ensuring query performance.

[0065] The model analysis layer is the intelligent core of the system, deploying three major analysis engines: a Transformer-LSTM fusion model, a causal inference network, and an intelligent analysis engine. The Transformer-LSTM fusion model corresponds to the event recognition module. This model consists of a cascaded Transformer network for extracting global temporal dependency features and a Long Short-Term Memory (LSTM) network for extracting local temporal evolution features. The event recognition result is obtained by classifying the fused features of the two types through the output layer. The causal inference network corresponds to the causal inference module. It is a Bayesian network based on a directed acyclic graph, where nodes represent events, directed edges indicate causal relationships, and are labeled with conditional probabilities. It is used to automatically generate causal links based on multiple identified events. The intelligent analysis engine coordinates and schedules the two models and provides auxiliary analysis functions such as anomaly detection.

[0066] The application layer deploys a multi-dimensional replay interactive interface and a management and analysis platform. The multi-dimensional replay interactive interface corresponds to an interactive presentation module, responsible for generating a timeline view containing interactive event nodes and causal relationship arrows with probability annotations based on the event causal chain output by the causal inference network. Users can adjust the time range and granularity of the backtracking by dragging and zooming the timeline, and expand to view detailed information about the event and the causal relationship chain starting from that node by clicking on the event node. The management and analysis platform provides comprehensive management functions such as business event tracing, data asset management, security and compliance monitoring, and business process optimization suggestions.

[0067] Through the organic collaboration of the above six-layer architecture, the system has fully realized a closed-loop technology stack, from unified access to multi-source heterogeneous time series data, spatiotemporal fusion processing, hybrid deep model event recognition, Bayesian network causal reasoning to interactive dimensional reproduction and full-process security and compliance assurance. It upgrades the traditional "data query" mode to the "event simulation reproduction" mode, significantly improving the intelligence level and user experience of time series data backtracking analysis.

[0068] In one possible implementation, to more specifically illustrate the application of the present invention, a data center fault backtracking analysis device is provided. This device includes the aforementioned intelligent time-series data backtracking and reproduction system. This device is specifically designed to perform fault diagnosis and backtracking analysis operations related to computing nodes within a data center. First, the device acquires multi-source time-series data of computing nodes within the data center through its data access module. These three types of data are: computing load monitoring data (e.g., GPU utilization and CPU utilization metrics from Prometheus), application log data (e.g., training task error information from the ELK system), and storage input / output performance data (e.g., read / write latency and throughput metrics from the Ceph storage system). Next, the device, through its internal data processing module, performs time alignment (e.g., unification to the second level) and association fusion based on business identifiers such as node IDs on the above three types of heterogeneous data to obtain a standardized time-series data sequence that comprehensively describes the operating status of the computing nodes. Then, the event recognition module inside the device uses a trained transformer-long short-term memory network hybrid model to automatically identify multiple abnormal computing node events strongly correlated with the current failure. These events include at least: abnormal computing load events (such as GPU utilization dropping below 30%), abnormal input / output latency events (such as read latency exceeding 100 milliseconds), and data read failure events (such as file not found or IO errors in application logs). After identifying these events, the causal reasoning module inside the device analyzes the temporal sequence and causal dependencies of these events based on a pre-built Bayesian network, automatically generating a complete fault propagation causal chain, such as "abnormal input / output latency event (10:02:35) → data read failure event (10:02:40, probability 0.91) → abnormal computing load event (10:03:00, probability 0.87)", thus clearly revealing that storage performance jitter is the root cause of data loading failure and ultimately GPU idleness. Finally, on the device's human-computer interaction module, maintenance personnel can intuitively replay the entire causal chain of fault propagation via a timeline, drag the slider to any key time point to view detailed information, and see causal relationship arrows with probability annotations. Sensitive data (such as specific node sequence numbers) throughout the entire backtracking process is anonymized, and all operations are recorded for auditing purposes. This device automates, intelligently visualizes, and enhances the complexity of cross-module fault diagnosis, significantly improving data center operation and maintenance efficiency and the accuracy of root cause localization.

[0069] The system of this invention can also be applied in several key fields.

[0070] (1) In the industrial internet fault tracing scenario, taking the spindle stoppage of an offshore oil drilling platform as an example. The system accesses data from 256 IoT sensors, including vibration, temperature, and pressure, as well as equipment maintenance logs. When the spindle stops, the LSTM autoencoder detects a sudden increase in the spindle speed sequence reconstruction error and immediately marks the "spindle stoppage event". The causal reasoning network traces back the preceding events and generates a causal chain with a probability of 0.82: "abnormal bearing temperature (09:10:20) → abnormal lubricating oil pressure (09:12:45) → spindle stoppage (09:15:10)". The application layer marks the three events on the timeline in the form of bubbles and stripes. Clicking on any node expands its detailed sensor data and causal relationship. This embodiment verifies the accurate reconstruction capability of the multi-level fault propagation chain in complex industrial environments, reducing the fault location time from several hours to minutes.

[0071] (3) In financial anti-fraud investigation scenarios, the system accesses real-time transaction logs and user behavior logs. For a large-amount transfer event at night, the transformer model identifies a multi-level rapid fund transfer chain of "A→B→C→D". The causal reasoning network further links the simultaneously occurring "login events from other locations," generating a fraudulent fund chain of "large-amount transfer → login from other locations (probability 0.92) → secondary transfer (probability 0.89)". The application layer dynamically displays fund flows and device associations on a geographic information map and a relationship network diagram. The entire transaction amount is thresholded using Paillier homomorphic encryption, and user identities are desensitized after decryption within the TEE enclave. Audit logs are tamper-proof throughout the process. This embodiment provides a template for the application of this application in financial scenarios with high security and compliance requirements.

[0072] (4) In the smart city emergency response scenario, the system integrates video surveillance, traffic flow, and GPS data from 122 / 120 emergency vehicles. The Transformer model identifies the ripple effect of congestion spreading outward from the accident site. The causal chain “vehicle collision → traffic congestion (17:32, probability 0.94) → rescue delay (probability 0.78)” is dynamically presented on a timeline that includes a map. The deep Q network detects a surge in access to geographic data in the accident area and automatically caches relevant road network data in the Redis cache layer, reducing the map query response time for emergency repair command to less than 25 milliseconds, thus improving the emergency response speed several times over.

[0073] (5) In the medical compliance traceability scenario, the system faces the rigid requirement that data should not leave the domain. Multiple hospitals jointly train the prescription anomaly identification model through federated learning. The original medical record data of each hospital never leaves the hospital, and only the encrypted parameters are federated and averaged on the central server. In a specific case, the model identified a violation of regulations by issuing prescriptions for the same patient with excessive total antibiotic dosage within a week, and generated a causal link by combining the drug circulation records. When querying and tracing, sensitive information such as the patient's name and ID number are decrypted and dynamically anonymized within the TEE enclave, and finally identified as "Zhang" and "110101". Presented in formats such as […], this fully meets the requirements for personal privacy protection. This embodiment demonstrates the technical feasibility and application value of this application under strong privacy regulations.

[0074] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0075] The foregoing has described specific embodiments of the present application. In some cases, the described actions or steps may be performed in a different order than those shown in the embodiments and the desired results may still be achieved. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are also possible or may be advantageous.

[0076] In the description of the embodiments of this application, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the embodiments of this application. In the embodiments of this application, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in the embodiments of this application, as well as the features of different embodiments or examples.

[0077] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0078] The above embodiments are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for intelligent time-series data backtracking and reproduction, characterized in that, include: Acquire time-series data from at least one data source; The time-series data is subjected to spatiotemporal fusion processing to obtain a standardized time-series data sequence; The standardized time-series data sequence is input into a pre-trained event recognition model to obtain event recognition results. The event recognition model includes a first network and a second network. The first network is used to extract global temporal dependency features of the time-series data sequence, and the second network is used to extract local temporal evolution features of the time-series data sequence. The event recognition results are determined based on the fusion features of the global temporal dependency features and the local temporal evolution features. Based on the multiple events identified in the event identification results, a pre-constructed causal reasoning network is used to generate event causal links, which indicate the causal relationships between the multiple events and the corresponding conditional probabilities. Based on the event causal chain, an interactive timeline containing event nodes and causal relationships is generated to enable the backtracking and reproduction of time-series data.

2. The method according to claim 1, characterized in that, The steps for performing spatiotemporal fusion processing on the time-series data include: Based on the multi-source fusion logic of time matching, spatial matching, and business identifier association, time-series data fragments from different data sources are merged into a unified standardized time-series data sequence; Among them, time matching is configured such that the difference between the timestamps carried by data records from different data sources is less than a preset time window threshold; spatial matching is configured such that the distance between the geographical locations associated with data records from different data sources is less than a preset spatial distance threshold; and business identifier association is configured such that data records from different data sources have a common primary key field used to identify the same business entity.

3. The method according to claim 1, characterized in that, The first network is a transformer network based on a multi-head self-attention mechanism, used to capture the global dependency between any two time steps in the standardized time series data sequence; the second network is a long short-term memory network, used to capture the local time order and dynamic changes in the standardized time series data sequence.

4. The method according to claim 1, characterized in that, The training process of the event recognition model includes: Obtain sample time-series data sequences labeled with event types and time locations; The sample time series data sequence is input into the first network and the second network to obtain the predicted event type and predicted time position; A loss function is constructed based on the cross-entropy loss between the predicted event type and the labeled event type, and the deviation between the predicted time position and the labeled time position, so as to adjust the parameters of the first network and the second network based on the loss function.

5. The method according to claim 1, characterized in that, The causal reasoning network is a Bayesian network based on a directed acyclic graph, where nodes represent events and edges represent causal relationships labeled with conditional probabilities; the construction method of the causal reasoning network includes: Obtain the historical event sequence; Based on the Granger causality analysis algorithm and / or the Peter-Clark structural learning algorithm, the causal relationship direction between events is determined from the historical event sequence; Calculate the conditional probability corresponding to each causal relationship to complete the construction of the causal inference network.

6. The method according to claim 1, characterized in that, The event identification results also include the results of classifying the identified events according to preset event types, which at least include abnormal events, operation events, state change events, and composite business events; The operation events include recordable behaviors generated by actions initiated by users or system entities, such as user login, configuration changes, and service restarts. The state change events include changes in the internal attributes or operating state of the monitored object; The composite business event is an event with clear business semantics, which is composed of multiple underlying events combined according to a preset time sequence and causal logic.

7. The method according to claim 6, characterized in that, The steps to achieve backtracking and reproduction of time series data include: Based on the events contained in the causal chain of the events, build an inverted index and a B+ tree index; The inverted index uses the event type as the key and the list of timestamps of the identified events as the values; the B+ tree index is constructed with timestamps as the primary key, and the leaf nodes store pointers to the corresponding event records. When performing an event backtracking query, the target event type is first filtered through the inverted index to obtain a candidate timestamp set consisting of event timestamps that match the event type. Then, the time range is filtered within the candidate timestamp set through the B+ tree index to obtain the final event retrieval result.

8. The method according to claim 1, characterized in that, The training data of the event recognition model, the standardized time-series data sequence, and the intermediate data of the event causal link are all encrypted during storage and computation. The decryption and computation operations related to the encrypted data are restricted to a hardware-isolated trusted execution environment so that sensitive data fields in the backtracking and reproduction results presented to the user are desensitized.

9. The method according to claim 8, characterized in that, In applications involving collaborative modeling of multi-party data, each participant trains an event recognition model on local data to obtain local model parameters, uploads the encrypted local model parameters to the aggregation server for federated average aggregation, receives the global model parameters issued by the aggregation server and updates the local model, so as to achieve collaborative modeling under the condition that the original data does not leave the domain.

10. The method according to claim 1, characterized in that, The process of backtracking and reproducing time-series data also includes: Real-time acquisition of status parameters characterizing the local system status, including at least storage load, query frequency, data popularity, and input / output latency; The state parameters are input into a pre-trained deep reinforcement learning model to obtain the optimal resource scheduling action to be performed for the current state of the local system. The optimal resource scheduling action includes data storage level migration, data replica number adjustment and computing resource quota adjustment. Execute the optimal resource scheduling action; The reward function of the deep reinforcement learning model is constructed based on the changes in query response time and hardware resource usage of the local system before and after the execution of the optimal resource scheduling action.

11. The method according to claim 1, characterized in that, Based on the aforementioned causal chain of events, an interactive timeline containing event nodes and causal relationships is generated and presented, including: It can receive drag and zoom operations, or click operations on event nodes by users on the timeline; In response to the drag operation, adjust the display time range of the time axis; In response to the scaling operation, the time scale granularity of the time axis is adjusted; In response to a click on a target event node, detailed information about the target event node is displayed on one side of the timeline. The detailed information includes the event type, occurrence time, associated entity identifier, and the causal relationship chain and its conditional probability output by the causal inference network, starting from the target event node.

12. An intelligent time-series data backtracking and reproduction system, characterized in that, include: The data access and processing module is used to acquire time-series data from at least one data source and perform spatiotemporal fusion processing on the time-series data to obtain a standardized time-series data sequence. An event recognition module is deployed with a pre-trained event recognition model for performing event recognition on the standardized time-series data sequence. The event recognition model includes a first network for extracting global time-series dependency features and a second network for extracting local time-series evolution features. The event recognition result is determined based on the fusion features of the global time-series dependency features and the local time-series evolution features. The causal reasoning module is used to generate event causal links based on multiple events identified in the event identification results using a pre-constructed causal reasoning network. The event causal links indicate the causal relationships between the multiple events and the corresponding conditional probabilities. The interactive presentation module is used to generate and present an interactive timeline containing event nodes and causal relationships based on the event causal chain, so as to realize the backtracking and reproduction of time series data.

13. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 11.

15. A data center fault backtracking analysis device, characterized in that, The device, comprising the intelligent time-series data backtracking and reproduction system as described in claim 12, is configured to perform the following operations: Acquire multi-source time-series data of computing nodes in the data center, including computing load monitoring data, application log data, and storage input / output performance data; Through the data access and processing module, the computing load monitoring data, application log data, and storage input / output performance data are time-aligned and associated with business identifiers to obtain a standardized time-series data sequence. The event recognition module identifies abnormal events of computing nodes, which include at least: abnormal computing load events, abnormal input / output delay events, and data read failure events. The causal reasoning module generates a fault propagation causal link, which indicates the causal relationship and corresponding conditional probability between the abnormal events of the multiple computing nodes. The interactive presentation module replays the fault propagation causal chain via a timeline to assist in locating the root cause of the fault.

Images