Methods, apparatus, and computer program products for data attribution

Abstract

The present disclosure relates to a method, device and computer program product for data attribution. The method comprises obtaining a historical data set and a plurality of thread invocation functions corresponding to the historical data set. The method further comprises constructing a knowledge graph based on the historical data set and the plurality of thread invocation functions. The method further comprises determining, based on a thread invocation function of current data, historical data associated with the current data in the knowledge graph for attributing the current data. In this way, the historical data associated with the current data can be quickly screened out, the problem of false matching can be effectively overcome, the efficiency and accuracy of attribution can be improved, and resource waste can be avoided.

Description

Technical Field

[0001] This disclosure relates to the field of computers, and more specifically, to methods, apparatus, and computer program products for data attribution. Background Technology

[0002] Currently, in the operation and maintenance of storage servers (e.g., network attached storage servers), the analysis of data unavailability issues typically relies on developers manually parsing core dump files and locating the root cause of the failure by examining thread call stacks, context parameters, and other relevant information. This process requires developers to rely on their personal experience to deeply understand system architecture, file access protocols, and other professional knowledge.

[0003] You can also use the keyword search function of the defect tracking system to match historical issues to determine whether a new issue is a recurrence of a known defect. These tools are based on text matching logic, comparing user-input keywords with historical issue descriptions or solutions to support issue classification. Summary of the Invention

[0004] Embodiments of this disclosure provide a method, apparatus, and computer program product for data attribution.

[0005] In a first aspect of the embodiments of this disclosure, a method for data attribution is provided. The method includes acquiring a historical dataset and multiple thread-calling functions corresponding to the historical dataset. The method also includes constructing a knowledge graph based on the historical dataset and the multiple thread-calling functions. Furthermore, the method includes determining historical data in the knowledge graph associated with the current data for attributing the current data, based on thread-calling functions for the current data.

[0006] In a second aspect of embodiments of this disclosure, an electronic device is provided. The electronic device includes one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement a method for data attribution. The method includes acquiring a historical dataset and a plurality of thread-called functions corresponding to the historical dataset. The method also includes constructing a knowledge graph based on the historical dataset and the plurality of thread-called functions. The method further includes determining, based on thread-called functions for current data, historical data in the knowledge graph associated with the current data for attributing the current data.

[0007] In a third aspect of embodiments of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements a method for data attribution. The method includes acquiring a historical dataset and a plurality of thread-calling functions corresponding to the historical dataset. The method also includes constructing a knowledge graph based on the historical dataset and the plurality of thread-calling functions. Furthermore, the method includes determining, based on thread-calling functions for current data, historical data in the knowledge graph associated with the current data for attributing the current data.

[0008] It should be understood that the description in the Summary of the Invention section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0009] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram of an example environment in which several embodiments of the present disclosure may be implemented is shown;

[0011] Figure 2 A flowchart of a method for data attribution according to some embodiments of the present disclosure is shown;

[0012] Figure 3 A schematic diagram of a knowledge graph including historical data is shown according to some embodiments of the present disclosure;

[0013] Figure 4 A flowchart illustrating a method for adding new historical data to a knowledge graph according to some embodiments of the present disclosure is shown;

[0014] Figure 5 A schematic diagram of a knowledge graph including multiple historical data is shown according to some embodiments of the present disclosure; and

[0015] Figure 6 A block diagram of a device that can implement several embodiments of the present disclosure is shown. Detailed Implementation

[0016] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0017] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0018] As mentioned above, although R&D personnel can manually locate the root cause of data unavailability issues, locating cross-domain problems requires collaboration among multiple teams, leading to high communication costs. The parsing process of core dump files is repetitive and time-consuming, making it difficult to improve efficiency. In addition, the fragmented nature of individual experience means that similar problems may repeatedly consume resources due to personnel changes or insufficient collaboration, making it difficult to form a systematic knowledge accumulation.

[0019] Meanwhile, keyword-based search methods also have limitations in practical applications. General-purpose tools lack structured integration of knowledge in the storage server domain, making it difficult to accurately associate thread patterns with the root cause of problems. Furthermore, text matching is susceptible to variations in wording, leading to frequent missed or false detections, thus limiting the reference value of solutions and making it difficult to meet the needs of rapid classification in complex scenarios.

[0020] To address this, embodiments of this disclosure propose a scheme for data attribution. The method involves acquiring a historical dataset and multiple thread call functions corresponding to the historical dataset, then constructing a knowledge graph based on the historical dataset and the multiple thread call functions, and finally determining the historical data in the knowledge graph associated with the current data for attribution based on the thread call functions of the current data. In this way, the knowledge graph transforms historical data and its thread call functions into a structured relationship network. By matching the thread call functions, historical data associated with the current data can be quickly filtered out, effectively overcoming mismatch problems, improving the efficiency and accuracy of attribution, and avoiding resource waste.

[0021] Figure 1 A schematic diagram of an example environment 100 in which various embodiments of this disclosure may be implemented is shown. For example... Figure 1As shown, the example environment 100 may include a knowledge graph 101. The knowledge graph 101 is a framework for expressing, storing, and associating knowledge in a graph structure. Essentially, it constructs a semantic network through nodes and edges to describe concepts, entities, and relationships. The knowledge graph 101 can be used to integrate heterogeneous data, supporting knowledge reasoning, semantic search, and intelligent decision-making, such as helping search engines directly present structured answers. The knowledge graph 101 typically includes root nodes and child nodes. Root nodes usually represent the starting node of a core entity or ontology concept in the domain, serving as the central hub for information aggregation and defining the topic boundaries of the graph. Child nodes are specific instances or attributes directly associated with the root node, used to refine knowledge and expand details. The two are dynamically connected through relational edges, forming a hierarchical semantic network. Child nodes can further serve as root nodes for other nodes, enabling the knowledge graph 101 to present a non-linear, complex relational structure.

[0022] In this embodiment, a knowledge graph can be constructed by acquiring historical datasets and multiple thread call functions corresponding to those datasets. The historical datasets can include multiple historical data points, which may represent various types of data unavailability issues, such as storage volume mounting failures, file access timeouts, or metadata corruption. Each historical data point typically corresponds to at least one thread call function. A thread is the smallest unit of execution scheduled by the operating system, and the thread call function records the hierarchical call relationships of functions during program execution. For example, a thread call function for a particular historical data point might contain a function call frame `NFSv4_statetable:closed`, which reflects the execution logic of the protocol layer state table closing operation. The call function serves as the specific step executed by the thread (such as resource locking, state updating, or error handling), and is directly associated with the historical data. This association allows the thread call function to characterize the technical context of the historical data, providing a basis for attribution analysis.

[0023] In some embodiments, after obtaining historical datasets and function calls from multiple threads, a knowledge graph 101 can be constructed by mapping the identifiers of the historical data to the root node and mapping the function calls from multiple threads to child nodes. For example, as... Figure 1As shown, the knowledge graph 101 may include root node 103-1, root node 103-2, and root node 103-N. Each root node's child nodes include the corresponding thread call function, and each child node includes one frame of call function. In some embodiments, different root nodes may share the same child node; for example, root node 103-1 and root node 103-2 may share child node 105. Of course, besides the above methods, the thread call function can be used as the root node, with related historical datasets as child nodes. Alternatively, a weighted network can be constructed based on function call frequency, with high-frequency call functions as core nodes to build the knowledge graph 101. This disclosure does not limit the method of constructing the knowledge graph 101. In this way, historical datasets and multiple thread call functions are structurally processed, providing efficient support for rapid attribution of subsequent data unavailability problems.

[0024] In some embodiments, after constructing the knowledge graph 101, when a new data unavailability problem occurs, the knowledge graph 101 can be searched to determine historical data 109 associated with the currently unavailable data, as an attribution reference. For example, as... Figure 1 As shown, historical data 109 used to attribute current data 107 can be determined by calculating the similarity between the thread call function of current data 107 and multiple thread call functions in the knowledge graph, and then recommended to technicians 111. Alternatively, historical data 109 with similar connection patterns can be matched based on the topological position of the call function of current problem 107 in the knowledge graph 101. Furthermore, abnormal features in the current thread call function, such as abnormal return values ​​and timeout flags, can be identified, and historical data 109 with similar abnormal features can be searched in the knowledge graph 101. Historical data 109 determined in the above manner can have similar thread call patterns and function execution paths to current data 107, indicating that they may share the same root cause. For example, if both historical data 109 and current data 107 contain abnormal calls to the "NFSv4_state table: closed" function, it is very likely that both are due to state table management issues.

[0025] In this way, similar data can be quickly located through structured knowledge graphs, which greatly shortens the problem diagnosis time. Secondly, accurate thread call function matching can effectively avoid the semantic ambiguity problem of traditional keyword search and improve the attribution accuracy.

[0026] It should be understood that the architecture and functionality in example environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of this disclosure. Embodiments of this disclosure can also be applied to other environments with different structures and / or functionalities.

[0027] The following will combine Figures 2 to 6The process of implementing the embodiments of this disclosure is described in detail. For ease of understanding, the specific data mentioned in the following description are exemplary and not intended to limit the scope of protection of this disclosure. It is understood that the embodiments described below may also include additional actions not shown and / or actions shown may be omitted, and the scope of this disclosure is not limited in this respect.

[0028] Figure 2 A flowchart of a method 200 for offloading compressed loads according to some embodiments of the present disclosure is shown. Method 200 can be performed by a data attribution device in an electronic device, and includes blocks 202, 204, and 206. At block 202, a historical dataset and multiple thread call functions corresponding to the historical dataset are obtained. The historical dataset and its corresponding thread call functions can be obtained in various ways; for example, information related to historical data unavailability issues can be extracted from system logs, core dump files, or monitoring tools, and the corresponding thread call functions can be parsed using debugging tools or performance analyzers. In some embodiments, to improve search efficiency, the obtained thread call functions can be filtered, retaining only key function calls that have a significant impact on historical data. For example, a threshold (also called a first threshold) can be set through statistical analysis or expert experience to filter function calls whose call frequency exceeds the threshold or whose probability of occurrence increases significantly when anomalies occur. These functions often have a stronger causal relationship with data unavailability issues, thus providing a basis for subsequent rapid matching.

[0029] At box 204, a knowledge graph is constructed based on historical datasets and function calls from multiple threads. For example, as shown... Figure 1 As shown, knowledge graph 101 can be constructed by mapping the identifiers of historical data to the root node and mapping multiple thread function calls to child nodes. Alternatively, thread function calls can be used as the root node, with related historical datasets as child nodes. A weighted network can also be constructed based on function call frequency, with high-frequency function calls serving as core nodes. This disclosure does not restrict the method of constructing knowledge graph 101.

[0030] At box 206, a function is invoked based on the current data to determine historical data in the knowledge graph associated with the current data and used to attribute the current data. For example, as... Figure 1As shown, historical data 109 used to attribute current data 107 can be determined by calculating the similarity between the thread call function of current data 107 and multiple thread call functions in the knowledge graph, and then recommended to technicians 111. Alternatively, historical data 109 with similar connection patterns can be matched based on the topological position of the call function of current problem 107 in the knowledge graph 101. Furthermore, abnormal features in the current thread call function, such as abnormal return values ​​and timeout flags, can be identified, and historical data 109 with similar abnormal features can be searched in the knowledge graph 101. Historical data 109 determined in the above manner can have similar thread call patterns and function execution paths to current data 107, indicating that they may share the same root cause. For example, if both historical data 109 and current data 107 contain abnormal calls to the "NFSv4_state table: closed" function, it is very likely that both are due to state table management issues.

[0031] In this way, knowledge graphs are used to transform historical data and its thread call functions into a structured relationship network. By matching the thread call functions, historical data related to the current data can be quickly filtered out, effectively overcoming the problem of mismatch, improving the efficiency and accuracy of attribution, and avoiding resource waste.

[0032] The following will combine Figures 3 to 6 The following describes a specific example process for scheduling resources. In this disclosure, the embodiments are explained in the order of constructing a knowledge graph including historical data, adding new historical data to the knowledge graph, and searching the knowledge graph. Specific data mentioned in the following description are exemplary and are not intended to limit the scope of this disclosure. It is understood that the embodiments described below may also include additional actions not shown and / or actions shown may be omitted, and the scope of this disclosure is not limited in this respect.

[0033] Figure 3 A schematic diagram of a knowledge graph 300 including historical data according to some embodiments of the present disclosure is shown. As described above, there are various ways to construct a knowledge graph based on a historical dataset and multiple thread function calls. The following explanation uses the example of mapping the identifiers of historical data to the root node and mapping multiple thread function calls to child nodes to construct the knowledge graph. Figure 3 As shown, for historical data identified by Jira as UNITYD-58912, we can first obtain the function calls from multiple threads with influence greater than a threshold. The specific method for obtaining this information is as described above and will not be repeated here. In this embodiment, the historical data identified by Jira as UNITYD-58912 involves four threads:

[0034] Thread 1:

[0035] NFSV4_Client Entity: Locking Client Owner

[0036] State management context: State mapping context

[0037] NFSV4 Status Table: Off

[0038] NFSV4_Off

[0039] Thread 2:

[0040] NFSV4_Client Entity: Locking Client Owner

[0041] State management context: State mapping context

[0042] NFSV4 Status Table: Off

[0043] NFSV4_Off

[0044] Thread 3:

[0045] NFSV4 Request: Awaiting Response

[0046] NFSV4_Callback: Send Message

[0047] Delegation: Send Interruption

[0048] File_lock data: Locking files

[0049] NFSV4_Owner: Open

[0050] NFSV4_Open

[0051] Thread 4:

[0052] NFSV4_Client Entity: Locking Client Owner

[0053] NFSV4 Client Entity: Client Owner Lock: Client Owner Lock NFSV4 Client Entity: Owner

[0054] NFSV4_Open

[0055] In some embodiments, UNITYD-58912 can be mapped to the root node 301, and the function calls and context information of the four threads can be mapped to child nodes. Additionally, the child nodes can also include the number of function calls, such as... Figure 3As shown, child node 303 indicates that the `NFSV4_ClientEntity: Lock Client Owner` function is called 3 times. This function is used to lock the owner list of client instances in the NFSv4 protocol to prevent concurrent access conflicts; child node 305 indicates that the `NFSV4_Close` function is called 2 times. This function is used to close the NFSv4 file handle and release related resources; child node 307 indicates that the `NFSV4_StateTable: Close` function is called 2 times. This function is used to clean up the entries in the NFSv4 protocol state table; node 309 indicates that the `StateManagementContext: StateMappingContext` function is called 2 times. This function is used to manage the context information of the NFSv4 protocol state machine; child node 313 indicates that the `NFSV4_Owner: Open` function is called 1 time. This function is used to establish the association between the NFSv4 file owner and the file; child node 315 indicates... The following functions are invoked: 1 call to the `NFSV4_ClientEntity:Owner` function, which retrieves the owner information of the client instance; 2 call to the `NFSV4_ClientEntity:ClientOwnerLock:ClientOwnerLock` function, which provides a locking mechanism for the client owner list; 3 call to the `NFSV4_Request:WaitForResponse` function, which makes the NFSv4 client wait for a server response; 3 call to the `NFSV4_Delegation:SendInterruption` function, which interrupts NFSv4 delegation operations; 3 call to the `NFSV4_Callback:SendMessage` function, which implements message sending using the NFSv4 callback mechanism; and 3 call to the `File_LockData:LockFile` function, which provides file lock management services. Therefore, it can be seen that in this embodiment, the knowledge graph's structural nodes sequentially include function names, counts, child nodes, sibling nodes, and a question list.

[0056] In this way, each child node contains a complete record of the called function, the number of calls, and context information. This structured storage method can accurately represent the scenario in which the problem occurred, providing a complete execution path tracing capability for subsequent problem analysis and improving the accuracy of attribution and localization. For example, by using the record of the "NFSV4_Client Entity: Lock Client Owner" function being called 3 times in child node 303, technicians can quickly determine whether there is a lock contention problem.

[0057] like Figure 3 As shown, child nodes can be arranged according to the actual execution order of function calls by threads. This time-preserving characteristic can completely reproduce the program execution flow when the problem occurs, helping technicians to intuitively understand the causal relationship between function calls. When analyzing functional anomalies, the preceding operations can be traced along the node sequence to accurately locate the fault propagation path.

[0058] In some embodiments, child nodes can also be associated with domain groups based on storage system architecture. Domain groups include at least one of file access protocol groups, file system groups, file groups, and volume groups. For example, nodes 303, 305, 307, 309, and 319 are associated with file access protocol group 327, and node 315 is associated with file group 329. This hierarchical organization allows for quick focusing on modules potentially involved in a problem through domain groups, narrowing the analysis scope from the global system to a specific domain. When a new problem arises, historical cases within the same domain group can be prioritized, improving search efficiency. Furthermore, it facilitates collaboration among experts from different domains, allowing each to focus on their area of ​​expertise. For instance, experts in the file system group can focus on pattern analysis of relevant nodes without dealing with the technical details of the protocol layer, thus achieving professional division of labor and knowledge reuse.

[0059] Figure 4 A flowchart of a method 400 for adding new historical data to a knowledge graph according to some embodiments of the present disclosure is shown. In block 402, the identifiers of the historical data are mapped to the root node. For example, as... Figure 3 As shown, when a new data unavailability issue arises, the identifier corresponding to the new issue can be mapped to another root node. In box 404, it is determined whether the called function is the same as the called function of another historical data in the knowledge graph. For example, this can be determined by comparing the function name, call level, and parameter characteristics to see if the called function in the new issue already exists in the knowledge graph. If they are the same, box 406 is executed to increment the cumulative count of the child node corresponding to that called function. For example, as... Figure 3 As shown, if the original record of child node 303 was called 3 times, and a new question calls the function again, its count will be updated to 4 times. This disclosure allows different root nodes to share the same child node, reducing data redundancy, and at the same time, reveals high-frequency failure patterns through frequency statistics, improving subsequent search efficiency. If the called function is different from the called function of another historical data in the knowledge graph, then execution box 408 is executed to map the called function to the child node. If the called function does not exist in the knowledge graph, a new child node is created.

[0060] In box 410, the identifier corresponding to the root node and the name of the called function corresponding to the child node are encoded as key-value pairs based on a hash strategy. Historical data identifiers can be converted into unique hash values ​​using a hash algorithm, serving as the keys, while the metadata of the child nodes, such as the number of calls and associated domain groups, serves as the values. The hash mapping structure supports fast retrieval with O(1) time complexity, for example, directly locating child nodes by hash key, avoiding traversing the entire graph and significantly improving matching efficiency. In box 412, the child nodes are associated with domain groups based on the storage system architecture. For example, as... Figure 3As shown, nodes 303, 305, 307, 309, and 319 are associated with file access protocol group 327, and node 315 is associated with file group 329. These associations can be implemented using preset rules, such as manually mapping to predefined domain groups based on the functional attributes of the called functions. Alternatively, natural language processing can be used to parse function names; for example, functions containing "file lock" are automatically categorized into the "file group." Domain group classification can quickly narrow down the scope of problem analysis. When a new problem involves file lock anomalies, the system prioritizes matching historical nodes within the "file group" to avoid wasting resources on global searches.

[0061] Figure 5 A schematic diagram of a knowledge graph 500 including multiple historical data is shown according to some embodiments of the present disclosure. For example... Figure 5 As shown, Knowledge Graph 500 is based on Knowledge Graph 300, and when new data becomes unavailable, it follows... Figure 4 The steps shown construct a new knowledge graph. Figure 5 The situation of root node 501 and child nodes 503 to 529 is the same as that of the root node 501 and child nodes 503 to 529. Figure 3 The root node 301 and child nodes 303 to 329 are the same, which will not be elaborated here. Figure 3 For the knowledge graph constructed based on historical data identified as UNITYD-58912, if the new historical data is identified as UNITYD-83361, then UNITYD-83361 can be mapped to the root node 531.

[0062] like Figure 5 As shown, compared to knowledge graph 300, knowledge graph 500 creates new child nodes including child nodes 533, 535, and 537. Child node 533 indicates a call to the NFSV4_Client Entity: Lock Client Owner function three times. This function is mainly used to implement exclusive access control to the owner list of client instances in the network file system protocol, preventing data races caused by multiple threads modifying the owner list simultaneously through a mutex lock mechanism. Child node 535 indicates a call to the file node: Find Component function once. This function is responsible for quickly locating specific file components in the file system directory structure. Child node 537 indicates a call to the file naming node: Exclusive Lock function once. This function provides a fine-grained concurrency control mechanism for the file system. Furthermore, it can be seen that root node 501 and root node 531 share child node 515. Figure 3 In the middle, child node 315 is called 1 time, while... Figure 5 In the middle, the number of times child node 515 is called is 2.

[0063] In some embodiments, after constructing a knowledge graph, when a new data unavailability issue arises, a similarity-based method can be used to search the knowledge graph for corresponding historical data. This process may include calculating the similarity (also called first similarity) between multiple thread call functions in the knowledge graph and the thread call functions of the current data, and then calculating the similarity (also called second similarity) between each historical data point and the current data based on the similarity of multiple call functions for each historical data point. Next, historical data with a similarity greater than a threshold (also called the second threshold) in the historical dataset can be identified as data used to attribute the current data. Finally, historical data can be displayed in descending order of similarity. When a technician selects a historical data point, the domain group based on the storage system architecture and the historical resolution strategy corresponding to the selected historical data's thread call functions are displayed. Taking the new issue SDNAS-20773 as an example, the system obtained a group of suspicious threads through filtering by the longest hang time, with the following context:

[0064] Thread 1:

[0065] NFSV4_Client Entity: Locking Client Owner

[0066] State management context: State mapping context

[0067] NFSV4 Status Table: Off

[0068] Network file system off

[0069] Thread 2:

[0070] NFSV4 Request: Awaiting Response

[0071] NFSV4_Callback: Send Message

[0072] Delegation: Send Interruption

[0073] File_lock data: Locking files

[0074] NFSV4_Owner: Open

[0075] Open the network file system

[0076] Thread 3:

[0077] NFSV4_Client Entity: Locking Client Owner

[0078] NFSV4 Client Entity: Client Owner Lock: Client Owner Lock NFSV4 Client Entity: Owner

[0079] Open the network file system

[0080] Thread 4:

[0081] File_NameNode: Exclusive Lock

[0082] File_lock data: Locking files

[0083] smb2_thread context: Reply to creation

[0084] Knowledge graphs, such as Figure 5 As shown, knowledge about two root cause issues has been accumulated. These thread call functions can be analyzed one by one. Since the function names in each frame can be indexed from the system hierarchy group, the corresponding nodes in the knowledge graph can be quickly found. The final output is shown in Table 1. Based on the output, the system can provide technical personnel with suggestions on the similarity or matching probability of known issues. For example, a new issue may have an 83% correlation probability with the known issue UNITYD-58912.

[0085] Table 1: Problem Analysis Results

[0086]

[0087] In this way, by organizing the knowledge accumulated during the handling of historical problems, this knowledge becomes easier to reuse in future automatic classifications. Applied to storage servers as shared, general knowledge, the problem-solving experience and knowledge are particularly valuable to technical personnel. In modern development processes, transforming personal knowledge into an intelligent knowledge database will greatly improve the efficiency of problem summarization, demonstration, and reference.

[0088] Figure 6 A schematic block diagram of an example device 600 that can be used to implement embodiments of the present disclosure is shown. As shown, device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 602 or loaded from storage unit 608 into random access memory (RAM) 603. Various programs and data required for the operation of device 600 may also be stored in RAM 603. The computing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0089] Multiple components in device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of monitors, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0090] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as method 200. For example, in some embodiments, method 200 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of method 200 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform method 200 by any other suitable means (e.g., by means of firmware).

[0091] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload programmable logic devices (CPLDs), and so on.

[0092] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0093] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. Furthermore, although operations are depicted in a specific order, this should be understood as requiring that such operations be performed in the specific order shown or in sequential order, or requiring that all illustrated operations be performed to achieve the desired result. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented individually or in any suitable sub-combination in multiple implementations.

[0094] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A method for data attribution, comprising: Retrieve the historical dataset and the corresponding thread call functions; Based on the historical dataset and the multiple thread call functions, a knowledge graph is constructed. as well as Based on the current data, a thread calls a function to determine the historical data in the knowledge graph that is associated with the current data and used to attribute the current data.

2. The method according to claim 1, wherein obtaining the historical dataset and the multiple thread calling functions corresponding to the historical data includes: For historical data in the historical dataset, obtain at least one thread calling function whose influence on the historical data is greater than a first threshold.

3. The method according to claim 1, wherein constructing the knowledge graph based on the historical dataset and the multiple thread call functions includes: Map the identifiers of the historical data to the root node; as well as The multiple thread call functions are mapped to child nodes to construct the knowledge graph, wherein the order of the child nodes corresponds to the order in which the multiple thread call functions are called.

4. The method according to claim 3, wherein constructing the knowledge graph based on the historical dataset and all the aforementioned thread call functions further includes: The identifier corresponding to the root node and the name of the called function corresponding to the child node are encoded into key-value pairs based on a hash strategy. as well as The knowledge graph is constructed based on the key-value pairs, using a hash mapping structure.

5. The method according to claim 4, wherein constructing the knowledge graph based on the historical dataset and the multiple thread call functions further includes: The child node is associated with a domain group based on the storage system architecture, the domain group including at least one of the following: file access protocol group, file system group, file group, and volume group.

6. The method according to claim 5, wherein the historical dataset includes first data and second data, and constructing the knowledge graph based on the historical dataset and the multiple thread call functions further includes: Determine whether the first calling function of the first data and the second calling function of the second data are the same calling function; In response to the fact that the first calling function of the first data and the second calling function of the second data are the same calling function, it is determined that the first data and the second data share the same child node, wherein the child node includes the calling function and the cumulative number of times the calling function is called.

7. The method of claim 1, wherein determining historical data in the knowledge graph associated with the current data for attributing the current data comprises: Determine multiple first similarities between the multiple thread call functions in the knowledge graph and the thread call functions in the current data; as well as The historical data is determined based on the multiple first similarities and the second threshold.

8. The method of claim 7, wherein determining the historical data comprises: Based on the multiple first similarities, a second similarity is determined for each historical data in the historical dataset; Historical data in the historical dataset with a second similarity greater than the second threshold are identified as data used to attribute the current data.

9. The method according to claim 8, further comprising: The historical data are displayed in descending order of their second similarity.

10. The method according to claim 9, further comprising: In response to the user selecting one of the historical data, the system displays the domain group based on the storage system architecture and the historical resolution strategy corresponding to the thread call function of the selected historical data.

11. An electronic device, comprising: At least one processor; as well as Coupled to the at least one processor and having instructions stored thereon, the instructions, when executed by the at least one processor, cause the electronic device to: Retrieve the historical dataset and the corresponding thread call functions; Based on the historical dataset and the multiple thread call functions, a knowledge graph is constructed. as well as Based on the current data, a thread calls a function to determine the historical data in the knowledge graph that is associated with the current data and used to attribute the current data.

12. The device of claim 11, wherein the instructions for acquiring historical datasets and the instructions for calling functions of multiple threads corresponding to said historical data include instructions for: For historical data in the historical dataset, obtain at least one thread calling function whose influence on the historical data is greater than a first threshold.

13. The device of claim 11, wherein the instructions for constructing a knowledge graph based on the historical dataset and the plurality of thread-invoking functions include instructions for the following: Map the identifiers of the historical data to the root node; and The multiple thread call functions are mapped to child nodes to construct the knowledge graph, wherein the order of the child nodes corresponds to the order in which the multiple thread call functions are called.

14. The device of claim 13, wherein the instructions for constructing the knowledge graph based on the historical dataset and all the thread-calling functions further include instructions for the following: Encode the identifier corresponding to the root node and the function name corresponding to the child node into key-value pairs using a hash strategy; and The knowledge graph is constructed based on the key-value pairs, using a hash mapping structure.

15. The device of claim 14, wherein the instructions for constructing the knowledge graph based on the historical dataset and the plurality of thread-invoking functions further include instructions for the following: The child node is associated with a domain group based on the storage system architecture, the domain group including at least one of the following: file access protocol group, file system group, file group, and volume group.

16. The device of claim 15, wherein the historical dataset includes first data and second data, wherein the instructions for constructing a knowledge graph based on the historical dataset and the plurality of thread-invoking functions further include instructions for the following: Determine whether the first calling function of the first data and the second calling function of the second data are the same calling function; In response to the fact that the first calling function of the first data and the second calling function of the second data are the same calling function, it is determined that the first data and the second data share the same child node, wherein the child node includes the calling function and the cumulative number of times the calling function is called.

17. The apparatus of claim 11, wherein the instructions for determining historical data in the knowledge graph associated with the current data for attributing the current data further include instructions for: Determine multiple first similarities between the multiple thread call functions in the knowledge graph and the thread call functions in the current data; and The historical data is determined based on the multiple first similarities and the second threshold.

18. The device of claim 17, wherein the instructions for determining the historical data further include instructions for: Based on the multiple first similarities, a second similarity is determined for each historical data in the historical dataset; Historical data in the historical dataset with a second similarity greater than the second threshold are identified as data used to attribute the current data.

19. The device of claim 18, wherein the instructions, when executed by the at least one processor, further cause the electronic device to: The historical data are displayed in descending order of their second similarity.

20. A computer program product tangibly stored on a non-volatile computer-readable medium and comprising machine-executable instructions that, when executed, cause a machine to: Retrieve the historical dataset and the corresponding thread call functions; Based on the historical dataset and the multiple thread call functions, a knowledge graph is constructed. as well as Based on the current data, a thread calls a function to determine the historical data in the knowledge graph that is associated with the current data and used to attribute the current data.

Images