Root cause determination method and apparatus, electronic device, and computer-readable storage medium

Abstract

The application is suitable for the technical field of environmental monitoring, and provides a root cause determination method and device, electronic equipment and a computer readable storage medium. The method comprises the following steps: acquiring an alarm event and a historical alarm causal graph, generating a current alarm causal graph according to the alarm event and the historical alarm causal graph; determining each candidate root cause node and downstream alarm nodes corresponding to each candidate root cause node according to a directed reachability relationship of each current alarm node in the current alarm causal graph, and a matching relationship between a trigger time interval between each current alarm node and a time lag window of a corresponding causal edge; determining a target root cause node from each candidate root cause node according to an associated strength corresponding to a causal path from each candidate root cause node to a corresponding downstream alarm node, and outputting alarm information corresponding to the target root cause node, so as to improve the efficiency and accuracy of root cause positioning.

Description

Technical Field

[0001] This application belongs to the field of environmental monitoring technology, and in particular relates to a root cause determination method, apparatus, electronic device and computer-readable storage medium. Background Technology

[0002] As data centers, communication equipment rooms, and other infrastructure rooms continue to expand in scale, the number of power and environmental control equipment deployed in these rooms is increasing. The operating status of these power and environmental control equipment directly affects the safe and stable operation of business equipment within the room. Therefore, a dynamic and environmental monitoring system (i.e., a power and environmental monitoring system) is typically used to centrally monitor the equipment and environment in the room, generating corresponding alarm information when equipment malfunctions or environmental data becomes abnormal.

[0003] However, due to the power supply, control, or operational dependencies between different devices in the data center, an anomaly in one device may cause changes in the operating status of other devices, resulting in multiple alarms within a short period of time. When there are a large number of alarms, the initial anomaly alarm and subsequent related alarms are mixed together, easily forming an alarm storm. This makes it difficult for maintenance personnel to accurately identify the root cause alarm from multiple alarms, leading to prolonged periods of unresolved faults and potentially even the spread of the fault. Summary of the Invention

[0004] In view of this, embodiments of this application provide a root cause determination method, apparatus, electronic device, and computer-readable storage medium, which can improve the efficiency and accuracy of root cause localization.

[0005] A first aspect of this application provides a root cause determination method, the method comprising: Obtain alarm events and historical alarm cause graphs, and generate current alarm cause graphs based on alarm events and historical alarm cause graphs; wherein, the current alarm cause graph includes multiple current alarm nodes corresponding to alarm events and causal edges between each current alarm node among the multiple current alarm nodes, and each causal edge has a corresponding causal propagation direction, time delay window and correlation strength; Based on the directed reachability of each current alarm node in the current alarm cause graph, and the matching relationship between the triggering time interval between each current alarm node and the time delay window of the corresponding cause edge, determine each candidate root cause node and the downstream alarm node corresponding to each candidate root cause node. Based on the correlation strength of the causal path from each candidate root cause node to the corresponding downstream alarm node, the target root cause node is determined from each candidate root cause node, and the alarm information corresponding to the target root cause node is output.

[0006] In this embodiment, the alarm cause-effect graph formed in the previous round is used as the historical alarm cause-effect graph, and the current alarm cause-effect graph is generated using the alarm events in the current round and the historical alarm cause-effect graph. This allows the causal relationship to be updated as the alarm status changes. Then, the alarm propagation path is jointly verified by the directed reachability relationship and the time-delay window, and the target root cause node is determined by combining the correlation strength of the causal path. This can reduce misjudgments caused by relying solely on the order of alarms or static correlation relationships, and improve the efficiency and accuracy of root cause location.

[0007] In one possible implementation, based on the correlation strength of the causal paths from each candidate root cause node to its corresponding downstream alarm node, a target root cause node is determined from the candidate root cause nodes, and the alarm information corresponding to the target root cause node is output, including: The root cause confidence of each candidate root cause node is determined based on the association strength, and the target root cause node is determined from each candidate root cause node based on the root cause confidence. The target causal chain is determined based on the causal path from the target root cause node to the downstream alarm node corresponding to the target root cause node. The target causal chain includes the target root cause node, the downstream alarm node, and the causal edges connecting the target root cause node and the downstream alarm node. The target causal chain is displayed according to the causal transmission direction of each causal edge. The alarm information is output based on the target causal chain; the alarm information includes the root cause alarm information corresponding to the target root cause node, the root cause confidence of the target root cause node, and at least one of the target causal chain.

[0008] In this implementation, the root cause confidence of candidate root cause nodes is determined based on the correlation strength of the causal path, and the root cause alarm information, root cause confidence, or target causal chain displayed according to the causal transmission direction corresponding to the target root cause node is output. This solves the problem that it is difficult to judge the reliability of the result and the basis for alarm propagation when only the root cause node is output, making the root cause determination result more intuitive and traceable.

[0009] In one possible implementation, generating the current alarm cause-effect graph based on alarm events and historical alarm cause-effect graphs includes: Based on the triggering status of multiple current alarm nodes corresponding to alarm events within the corresponding time delay window, update the conditional probabilities between each current alarm node in the historical alarm cause-effect graph; Obtain the physical topology relationship of the nodes, and construct a target prior matrix to characterize the topological prior relationship between alarm nodes based on the physical topology relationship of the nodes. Based on the alarm type corresponding to each current alarm node, determine the causal check lag order corresponding to each current alarm node; Under the constraint of the target prior matrix, causal relationship tests are performed on historical alarm events according to the causal test lag order. Based on the causal relationship test results, the causal edges between current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge are updated. The correlation strength of each causal edge is updated based on the physical topology of the nodes and the co-occurrence of historical alarm events. Based on the updated correlation strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node, the causal strength of each causal edge is determined. The causal edges in the historical alarm causal graph are updated according to the causal strength to generate the current alarm causal graph.

[0010] In this implementation, the current alarm causal graph is generated by updating the conditional probability of the current alarm event based on the historical alarm causal graph, and updating the causal edges by combining the node physical topology relationship, causal relationship test, association strength and causal strength. This solves the problem that the fixed alarm causal graph is difficult to adapt to the current alarm mode change in a timely manner, while maintaining the continuity of causal relationship between the previous and next rounds.

[0011] In one possible implementation, a target prior matrix is ​​constructed to characterize the topological prior relationships between alarm nodes based on the physical topology relationships of the nodes, including: Based on the power supply direction of the nodes, an energy flow adjacency matrix is ​​constructed to represent the energy transfer relationship between the corresponding alarm nodes; Based on the node signal acquisition link and the node signal control link, a signal flow adjacency matrix is ​​constructed to characterize the signal transmission relationship between corresponding alarm nodes; Based on node dependencies, a control flow adjacency matrix is ​​constructed to represent the control transmission relationship between corresponding alarm nodes; The energy flow adjacency matrix, signal flow adjacency matrix, and control flow adjacency matrix are fused according to the fusion weights corresponding to each adjacency matrix to obtain the target prior matrix.

[0012] In this implementation, by fusing the adjacency matrices of energy flow, signal flow, and control flow, the topological prior relationships between alarm nodes can be more comprehensively characterized.

[0013] In one possible implementation, under the constraint of the target prior matrix, causal relationship tests are performed on historical alarm events according to the lag order of the causal test. Based on the causal relationship test results, the causal edges between current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge are updated, including: Based on the target prior matrix, determine the direction to be tested supported by the topological prior relationship between the first alarm node and the second alarm node; the first alarm node and the second alarm node are any two nodes in the current alarm nodes that have a physical topological connection relationship. Obtain the matrix elements in the target prior matrix that correspond to the direction to be tested; Adjust the discrimination criteria for causality testing based on matrix elements; According to the lag order of the causality test, the causality relationship test is performed on the historical alarm events corresponding to the first alarm node and the second alarm node to obtain the causality relationship test results. Based on the causal relationship test results and the adjusted discrimination conditions, causal edges with the same causal propagation direction as the direction to be tested are generated to update the causal edges between current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge.

[0014] In this implementation, by constraining the direction and discrimination conditions of causal relationship testing through the target prior matrix, it is possible to reduce pseudo-causal edges that do not conform to physical topological relationships.

[0015] In one possible implementation, the conditional probabilities between current alarm nodes in the historical alarm causality graph are updated based on the triggering status of multiple current alarm nodes corresponding to the alarm event within the corresponding time delay window, including: The number of times the alarm event corresponding to the first alarm node is triggered in the alarm events is counted, and the number of times the alarm event corresponding to the second alarm node is triggered within a preset time delay window after the alarm event corresponding to the first alarm node is triggered; Based on the number of triggers obtained from statistics, determine the conditional probability of the alarm event corresponding to the second alarm node being triggered in this round under the condition that the alarm event corresponding to the first alarm node is triggered. Obtain the pre-update conditional probability between the first and second alarm nodes in the historical alarm causality graph; Based on the conditional probability before the update, the conditional probability in this round, and the preset update step size, update the conditional probability between the first alarm node and the second alarm node in the historical alarm causal graph.

[0016] In this implementation, the conditional probability of the current round is determined by counting the number of times the second alarm node is triggered within a preset time delay window after the first alarm node is triggered. The conditional probability is then updated based on the conditional probability before the update, the conditional probability of the current round, and the preset update step size. This solves the problem that the historical conditional probability cannot reflect the recent alarm triggering relationship in a timely manner and that fluctuations in a single round of alarms can easily lead to sudden changes in the conditional probability, so that the conditional probability can smoothly adapt to changes in alarm mode.

[0017] In one possible implementation, the association strength of each causal edge is updated based on the physical topology of the nodes and the co-occurrence of historical alarm events, including: The physical proximity between two alarm nodes is determined based on the physical space parameters corresponding to the two alarm nodes connected by the causal edge. Determine the topology connection strength between the two alarm nodes based on the topology connection relationship between the devices corresponding to the two alarm nodes; The intensity of historical co-occurrence between the two alarm nodes is determined based on the co-occurrence of historical alarm events corresponding to the two alarm nodes. The correlation strength of causal edges is obtained by weighting physical proximity, topological connection strength, and historical co-occurrence strength.

[0018] In this implementation, by integrating physical proximity, topological connectivity strength, and historical co-occurrence strength, the physical rationality and interpretability of causal edge association strength can be improved.

[0019] In one possible implementation, the causal strength of each causal edge is determined based on the updated association strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node. The causal edges in the historical alarm causal graph are then updated based on the causal strength, including: Based on the causal propagation direction of the causal edge, the alarm node pointed to by the causal edge is determined as the downstream alarm node, and the other alarm node connected by the causal edge is determined as the upstream alarm node. Get the updated conditional probability of the historical alarm event corresponding to the downstream alarm node being triggered under the condition that the historical alarm event corresponding to the upstream alarm node is triggered, and the historical occurrence probability of the historical alarm event corresponding to the downstream alarm node. The causal strength of a causal edge is determined based on its correlation strength, the difference between the updated conditional probability and the historical occurrence probability, and the historical occurrence probability. Based on the causal strength and edge filtering threshold, update the causal edges between each current alarm node in the historical alarm causal graph.

[0020] In this implementation, by filtering causal edges using causal strength and edge filtering threshold, edges with weak causal relationships can be filtered out, thereby improving the reliability of the current alarm causal graph.

[0021] In one possible implementation, determining the root cause confidence of each candidate root cause node based on the association strength includes: Determine the prior occurrence probability of each candidate root cause node; Determine the conditional probability that the alarm event of the corresponding downstream alarm node will be triggered within the corresponding time delay window under the condition that the alarm event corresponding to each candidate root cause node is triggered. The root cause probability of each candidate root cause node is determined based on the prior occurrence probability of each candidate root cause node, the conditional probability of the corresponding downstream alarm node, and the correlation strength of each causal edge in the corresponding causal path. The root cause probability of each candidate root cause node is normalized to obtain the root cause confidence of each candidate root cause node.

[0022] In this implementation, by combining the prior occurrence probability of candidate root cause nodes, the conditional probability of downstream alarm nodes, and the correlation strength of causal paths, the credibility of candidate root cause nodes can be evaluated more comprehensively.

[0023] In one possible implementation, determining the target root cause node from each candidate root cause node based on the root cause confidence level includes: For each candidate root cause node, if the corresponding candidate root cause node is inactive and the confidence level of the corresponding root cause reaches the first confidence threshold, the corresponding candidate root cause node will be switched to the root cause active state. If the corresponding candidate root cause node is in the root cause activation state, the corresponding root cause confidence reaches the second confidence threshold, and the duration of the root cause activation state reaches the minimum residence time, the root cause activation state of the corresponding candidate root cause node is maintained. If the corresponding candidate root cause node is in a root cause activation state and the corresponding root cause confidence is lower than the second confidence threshold, the root cause activation state of the corresponding candidate root cause node shall be revoked. Candidate root cause nodes that are in the root cause activation state are identified as target root cause nodes; The first confidence threshold is greater than the second confidence threshold.

[0024] In this implementation, by controlling the root cause activation state through dual confidence thresholds and minimum dwell time, the root cause output oscillation caused by short-term fluctuations in root cause confidence can be reduced.

[0025] In one possible implementation, when the root cause confidence of multiple candidate root cause nodes all reach a first confidence threshold, the candidate root cause node in the root cause activation state is determined as the target root cause node, including: Based on the root cause confidence of multiple candidate root cause nodes and the number of downstream alarm nodes corresponding to each candidate root cause node, a candidate root cause node is selected from multiple candidate root cause nodes. If the selected candidate root cause node is different from the candidate root cause node that is currently in the root cause activation state, and the difference in root cause confidence between the two is less than the switching margin, the candidate root cause node that is currently in the root cause activation state will continue to be determined as the target root cause node. When the root cause confidence difference reaches the switching margin, the selected candidate root cause node is determined as the target root cause node.

[0026] In this implementation, by combining root cause confidence, the number of downstream alarm nodes, and switching margin to select the target root cause node, frequent switching between similar candidate root causes can be avoided.

[0027] A second aspect of this application provides a root cause determination apparatus, the apparatus comprising: The acquisition module is used to acquire alarm events and historical alarm cause-effect graphs, and generate the current alarm cause-effect graph based on the alarm events and historical alarm cause-effect graphs. The current alarm cause-effect graph includes multiple current alarm nodes corresponding to alarm events and causal edges between each current alarm node. Each causal edge has a corresponding causal propagation direction, time delay window and correlation strength. The candidate determination module is used to determine each candidate root cause node and the downstream alarm node corresponding to each candidate root cause node based on the directed reachability relationship of each current alarm node in the current alarm cause graph and the matching relationship between the trigger time interval between each current alarm node and the time delay window of the corresponding cause edge. The root cause determination module is used to determine the target root cause node from each candidate root cause node based on the correlation strength of the causal path from each candidate root cause node to the corresponding downstream alarm node, and output the alarm information corresponding to the target root cause node.

[0028] A third aspect of this application provides an electronic device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, it implements the method as described in any of the embodiments of the first aspect above.

[0029] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method as described in any of the embodiments of the first aspect above.

[0030] A fifth aspect of this application provides a computer program product that, when run on an electronic device, causes the electronic device to perform a method as described in any of the embodiments of the first aspect above.

[0031] The beneficial effects of the second to fifth aspects mentioned above can all be referred to the beneficial effects of the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a schematic flowchart of a root cause determination method provided in an embodiment of this application; Figure 2 This is a schematic diagram illustrating the construction of a target prior matrix provided in an embodiment of this application; Figure 3 This is a timing diagram of an incremental update strategy for an alarm cause-effect graph with a three-level time scale provided in an embodiment of this application; Figure 4 This is a schematic diagram illustrating a root cause alarm and target causal chain provided in an embodiment of this application; Figure 5 This is a schematic diagram of a state machine and hysteresis curve for determining dual-threshold hysteresis root causes, provided in an embodiment of this application. Figure 6 This is a schematic flowchart of a root cause determination method provided in an embodiment of this application; Figure 7 This is a schematic diagram of the functional architecture of a root cause determination system provided in an embodiment of this application; Figure 8 This is a schematic diagram of the structure of a root cause determination device provided in an embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0034] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0035] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0036] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0037] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0038] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0039] It should be understood that the sequence number of each step in this embodiment does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of this application embodiment. As the scale of data centers, communication equipment rooms, and other infrastructure equipment rooms continues to expand, the number of power equipment and environmental control equipment deployed in these rooms is increasing. The operating status of power equipment and environmental control equipment directly affects the safe and stable operation of business equipment within the equipment room. Therefore, a dynamic and environmental monitoring system (i.e., a power and environmental monitoring system) is typically used to centrally monitor the equipment and environment in the equipment room, generating corresponding alarm information when equipment operation is abnormal or environmental data is abnormal.

[0040] The power and environment monitoring system can collect the operating status of equipment such as power distribution cabinets, uninterruptible power supplies, power distribution units, batteries, and air conditioners, as well as environmental parameters such as temperature, humidity, smoke, and water leakage. It can also generate alarm events when the monitored values ​​exceed the threshold or when the equipment status is abnormal.

[0041] There may be power supply, signal or control dependencies between different monitoring nodes. An anomaly may propagate along the corresponding relationship and trigger multiple subsequent alarms, thus forming an alarm set that includes both root cause alarms and related alarms.

[0042] Existing monitoring systems can assist in troubleshooting through alarm classification, time sorting, alarm merging, or preset rules. However, when multiple alarms occur concurrently, it may still be difficult to distinguish between root cause alarms and downstream alarms. In other words, the above methods are insufficient to accurately identify the root cause alarm from multiple alarms, resulting in longer fault location times and a higher risk of inaccurate root cause determination.

[0043] To address the aforementioned issues, embodiments of this application provide a root cause determination method, apparatus, electronic device, and computer-readable storage medium. The method uses the alarm cause-effect graph generated in the previous round as a historical alarm cause-effect graph, and generates the current alarm cause-effect graph using the current round of alarm events and the historical alarm cause-effect graph. This allows the causal relationship to be updated as the alarm state changes. Furthermore, the method uses directed reachability and time-delay windows to jointly verify the alarm propagation path, and combines the correlation strength of the causal path to determine the target root cause node. This reduces misjudgments caused by relying solely on the order of alarms or static correlations, improving the efficiency and accuracy of root cause localization.

[0044] The following describes in detail, with reference to the accompanying drawings, a root cause determination method, apparatus, electronic device, computer-readable storage medium, and computer program provided in the embodiments of this application.

[0045] The root cause determination method provided in this application can be applied to monitoring scenarios where multiple alarm events with propagation relationships are continuously generated, such as the operation monitoring scenarios of data centers, communication equipment rooms, industrial equipment, energy equipment, or other infrastructure. The root cause determination method provided in this application can be executed by an electronic device with data processing capabilities. The electronic device can be a device deployed on an environmental monitoring gateway, edge server, or cloud centralized platform. The following description uses an electronic device as the execution subject.

[0046] In a specific scenario, a medium-sized data center, room A, has an area of ​​approximately 400 square meters and is equipped with one main input power distribution cabinet, two uninterruptible power supply (UPS) main units, four row-head power distribution units, 20 server racks, four precision air conditioners, 24 temperature and humidity sensors, eight water leakage detection devices, twelve smoke detectors, one building automation controller, and one fire alarm control unit. The method provided in this application embodiment is executed by an environmental monitoring gateway. Subsequent steps will be described in conjunction with this scenario.

[0047] See Figure 1 The diagram illustrates a flowchart of a root cause determination method provided in an embodiment of this application; as shown below. Figure 1 As shown, the method may include the following steps: Step 101: Obtain alarm events and historical alarm cause-effect graphs, and generate the current alarm cause-effect graph based on the alarm events and historical alarm cause-effect graphs.

[0048] The historical alarm cause-effect graph is the alarm cause-effect graph formed and saved in the previous round of root cause determination; the current alarm cause-effect graph is the graph formed after updating the historical alarm cause-effect graph based on the alarm events in this round. The current alarm cause-effect graph formed in this round can be used as the historical alarm cause-effect graph in the next round.

[0049] Alarm events are event records generated when a monitored object exhibits an anomaly. Each alarm event can include an alarm type, the identifier of the associated device, a trigger timestamp, and an alarm level. Alarm types can include electrical, temperature and humidity, battery, air conditioning, fire protection, and security categories; alarm levels can include severe, important, general, and alert. The current alarm node is the alarm node corresponding to the alarm events in this round, and multiple current alarm nodes constitute the alarm scope to be analyzed in this round.

[0050] The current alarm cause-effect graph includes multiple current alarm nodes and causal edges between them. Each causal edge has a causal propagation direction, a time delay window, and a correlation strength, representing the propagation direction of the alarm impact, the allowable propagation time range, and the degree of correlation between two alarm nodes, respectively. That is, the current alarm cause-effect graph can be represented as G=(V,E), where V represents the set of current alarm nodes and E represents the set of causal edges. A current alarm node is a node in the current alarm cause-effect graph used to represent an alarm type or alarm event. Different current alarm nodes can correspond to different devices or different types of alarm events. A causal edge is an edge connecting two current alarm nodes and has a direction, used to represent the possible causal propagation relationship between the two current alarm nodes. The causal propagation direction is the propagation direction indicated by the causal edge from the upstream alarm node to the downstream alarm node.

[0051] The time delay window can be used as a preset attribute of alarm nodes or causal edges to determine whether another alarm event occurs within the allowed propagation time after an alarm event is triggered.

[0052] Among them, the correlation strength is a parameter used to characterize the degree of correlation between two current alarm nodes connected by a causal edge.

[0053] When running for the first time and there is no previous alarm cause graph, the electronic device can initialize the historical alarm cause graph using existing historical alarm data and node physical topology relationships; after the first root cause determination is completed, each subsequent round is iteratively updated based on the previous graph.

[0054] When step 101 is executed, the electronic device receives the alarm events of the current round, extracts the alarm type, node identifier, trigger timestamp and alarm level of each alarm event, and determines the corresponding current alarm node according to the alarm type and node identifier; at the same time, it reads the historical alarm cause-effect graph saved in the previous round, updates the conditional probability, causal edge and correlation strength related to the current alarm node in the current round, and generates the current alarm cause-effect graph.

[0055] For example, in the aforementioned computer room A, the following alarm events are generated sequentially within the current inference time window: 14:23:05.120 alarm a1 for uninterruptible power supply bypass switching of circuit 1 in distribution cabinet; 14:23:07.380 alarm a2 for low output voltage of PDU-3 in the rack head cabinet; 14:23:20.640 alarm a3 for high intake air temperature of R12 in the rack; 14:24:35.110 alarm a4 for insufficient cooling of AC-2 air conditioning unit. The electronic equipment thus determines the four current alarm nodes corresponding to a1 to a4 and reads the alarm cause-effect graph saved in the previous round as the historical alarm cause-effect graph.

[0056] In one possible implementation, the process of generating the current alarm cause-effect graph based on alarm events and historical alarm cause-effect graphs includes: The electronic device first updates the conditional probabilities between the current alarm nodes in the historical alarm causality graph based on the triggering status of multiple current alarm nodes corresponding to the alarm event within the corresponding time lag window. Next, it acquires the node physical topology relationships and constructs a target prior matrix to characterize the topological prior relationships between alarm nodes based on these relationships. Then, it determines the causal verification lag order corresponding to each current alarm node based on the alarm type. Here, the node physical topology relationship refers to the physically based connections or dependencies between different monitoring nodes. In environmental monitoring scenarios, the node physical topology relationship can be determined based on the power supply relationship, signal link, and control dependency relationship between the devices corresponding to each alarm node; in other monitoring scenarios, it can also be determined based on the corresponding entity connection relationship or functional dependency relationship between the monitored objects.

[0057] Further, under the constraint of the target prior matrix, causal relationship testing is performed on the historical alarm events according to the causal test lag order. Based on the causal relationship test results, the causal edges between the current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge are updated. Subsequently, the association strength of each causal edge is updated according to the physical topology and the co-occurrence of the historical alarm events. Here, historical alarm events are alarm events recorded before the current round of alarm events, used to perform causal relationship testing and determine historical occurrence probabilities and historical co-occurrence. The causal test lag order represents the number of discrete time steps for causal relationship testing backtracking, and can be pre-configured according to the propagation delay characteristics of the alarm type corresponding to each current alarm node. The propagation delay characteristics are the time-scale characteristics exhibited by different types of alarms from the occurrence of an upstream anomaly to the triggering of a downstream alarm. Different alarm types can have different propagation delay characteristics.

[0058] For example, in a specific implementation, the propagation delay of fire alarms is less than 1 second, its time delay window can be 5 seconds, and the causality check lag order can be 1; the propagation delay of electrical alarms can be 0.1 seconds to 5 seconds, its time delay window can be 10 seconds, and the causality check lag order can be 3; the propagation delay of temperature and humidity alarms can be 30 seconds to 10 minutes, its time delay window can be 15 minutes, and the causality check lag order can be 5; the propagation delay of air conditioning alarms can be 1 minute to 30 minutes, its time delay window can be 30 minutes, and the causality check lag order can be 5; the propagation delay of battery alarms can be 5 minutes to 2 hours, its time delay window can be 4 hours, and the causality check lag order can be 8.

[0059] When two connected alarm nodes correspond to different alarm types, the larger of the causal check lag order corresponding to the two alarm types can be determined as the causal check lag order between the two alarm nodes to cover a longer alarm propagation process.

[0060] The target prior matrix transforms the physical topological relationships of nodes into matrix elements, which are used to limit the possible causal transmission directions and adjust the discrimination conditions for causal relationship testing, thereby enabling the statistical results of data to corroborate the actual connection relationships.

[0061] Finally, based on the updated association strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node, the causal strength of each causal edge is determined, and the causal edges in the historical alarm causal graph are updated according to the causal strength to generate the current alarm causal graph.

[0062] The electronic device forms a current alarm causal graph from multiple current alarm nodes and updated causal edges. The current alarm causal graph only retains the current alarm nodes and their valid causal edges involved in the current root cause determination, and saves the updated results for use in the next round of root cause determination. This iterative approach combines the current round of alarm evidence with the graph structure of the previous round, which can both continue the learned stable causal relationships and allow conditional probabilities, edge structure, and association strength to change with new alarm patterns. When a current alarm node lacks available historical edges, the electronic device can generate candidate causal edges in directions supported by the target prior matrix, and decide whether to add the candidate causal edges to the current alarm causal graph through causal relationship testing and causal strength screening.

[0063] Therefore, the current alarm cause-effect graph is not built from scratch in each round, nor is it a direct copy of the historical alarm cause-effect graph. Instead, it is updated in a targeted manner based on the graph structure related to the alarm events in the current round.

[0064] For example, for the aforementioned data center A, the previous alarm causal graph already contained alarm nodes such as power distribution and temperature control, along with their relationships. When a1 to a4 appear in this round, the electronic equipment only updates the conditional probabilities, causal edges, and correlation strengths between these current alarm nodes, forming a current alarm causal graph that matches the alarm scope of this round.

[0065] This reduces the computational burden of repeated graph construction and improves the graph structure's adaptability to recent alarm states, thus solving the problem that fixed alarm cause-effect graphs cannot adapt to changes in current alarm patterns in a timely manner, while maintaining the continuity of causal relationships between successive cycles.

[0066] In one possible implementation, a target prior matrix is ​​constructed to characterize the topological prior relationships between alarm nodes based on the physical topology relationships of the nodes, including: First, based on the power supply direction of the nodes, an energy flow adjacency matrix is ​​constructed to represent the energy transfer relationship between corresponding alarm nodes. This energy flow adjacency matrix can be an adjacency matrix constructed based on the power supply direction between the devices represented by the nodes, used to represent the relationship of energy transfer from upstream power supply equipment to downstream power receiving equipment. For example, the power supply relationship can include distribution cabinet to uninterruptible power supply (UPS), UPS to row cabinet, row cabinet to distribution unit, and distribution unit to cabinet. Second, based on the node signal acquisition link and node signal control link, a signal flow adjacency matrix is ​​constructed to represent the signal transfer relationship between corresponding alarm nodes. This signal flow adjacency matrix is ​​an adjacency matrix constructed based on the acquisition signal link and control signal link between the devices represented by the nodes, used to represent the signal transfer relationship between sensors, automation controllers, and equipment control terminals. For example, the signal transfer relationship can include temperature and humidity sensor to automation controller, automation controller to air conditioning unit, water leakage detection equipment to monitoring gateway, and smoke detector to fire controller.

[0067] Next, based on node dependencies, a control flow adjacency matrix is ​​constructed to represent the control transmission relationships between corresponding alarm nodes. This control flow adjacency matrix can be an adjacency matrix constructed based on the control dependencies between the devices represented by the nodes, used to represent the transmission relationships of control commands or linkage actions. For example, control dependencies may include the fire protection system shutting down the fresh air supply, the fire protection system controlling the air conditioning to stop, the group control system controlling the air conditioning to start and stop, and the emergency system controlling the switching of uninterruptible power supplies.

[0068] Finally, the energy flow adjacency matrix, signal flow adjacency matrix, and control flow adjacency matrix are fused according to their respective fusion weights to obtain the target prior matrix. The fusion weights are parameters representing the proportions of the energy flow adjacency matrix, signal flow adjacency matrix, and control flow adjacency matrix in the target prior matrix. The sum of the fusion weights for the three types of adjacency matrices can be 1.

[0069] In this embodiment, the energy flow adjacency matrix, signal flow adjacency matrix, and control flow adjacency matrix can be represented by M_energy, M_signal, and M_control, respectively, and the target prior matrix can be represented by M_prior. They are then fused in the following manner: M_prior=α1·M_energy+α2·M_signal+α3·M_control, and α1+α2+α3=1 Here, α1, α2, and α3 represent the fusion weights corresponding to the three types of adjacency matrices, respectively. In a specific example, α1=0.5, α2=0.3, and α3=0.2 can be set. The fusion weights can also be adjusted according to the data center type or the subsystem with a high incidence of failures. For example, α1 can be increased in scenarios with frequent power distribution failures, and α2 can be increased in scenarios with frequent cooling anomalies.

[0070] In the alarm scenario of the aforementioned data center A, topological prior relationships can be set in the energy flow adjacency matrix based on the power distribution topology, with a1 pointing to a2 and a2 pointing to a3. Similarly, a topological prior relationship can be set in the signal flow adjacency matrix based on the sensing and control signal links, with a3 pointing to a4. These three types of adjacency matrices are then fused to obtain the target prior matrix. (See also...) Figure 2 , Figure 2 The construction process of the target prior matrix is ​​illustrated. The energy flow adjacency matrix, signal flow adjacency matrix, and control flow adjacency matrix are weighted according to their respective fusion weights, forming the target prior matrix at the weighted fusion node. This target prior matrix is ​​used to constrain subsequent causal relationship verification. In this embodiment, by fusing the energy flow, signal flow, and control flow adjacency matrices, the topological prior relationships between alarm nodes can be more comprehensively characterized.

[0071] In one possible implementation, under the constraint of the target prior matrix, a causal relationship test is performed on historical alarm events. Based on the causal relationship test results, the causal edges between current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge are updated, including: First, a first alarm node and a second alarm node are identified from the current alarm nodes. The first alarm node and the second alarm node are any two nodes in the current alarm nodes that have a physical topological connection. For any combination of the first alarm node and the second alarm node, based on the target prior matrix, a direction to be tested, supported by the topological prior relationship, is determined between the first alarm node and the second alarm node. This direction to be tested is the direction determined by the target prior matrix that requires causal relationship testing between the first alarm node and the second alarm node. The matrix element corresponding to this direction in the target prior matrix represents the degree of support of the physical topological relationship for that direction.

[0072] Secondly, obtain the matrix elements in the target prior matrix corresponding to the direction to be tested. Adjust the discrimination conditions for the causal relationship test based on the matrix elements. The discrimination conditions are the conditions used by the electronic device to determine whether to generate a causal edge based on the causal relationship test results. The electronic device can use any one or a combination of the PC algorithm, Granger causality test, or mutual information method to perform causal relationship tests on historical alarm events.

[0073] Subsequently, causal relationship tests were performed on the historical alarm events corresponding to the first and second alarm nodes according to the lag order of the causal test, and the causal relationship test results were obtained. Based on the causal relationship test results and the adjusted discrimination conditions, causal edges with the same causal propagation direction as the direction to be tested are generated to update the causal edges between current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge.

[0074] In one implementation, Granger causality testing can be used to inject the target prior matrix as both hard and soft constraints into the causality test. For the direction to be tested supported by the target prior matrix, the discrimination threshold for the causality test can be adjusted based on the corresponding matrix elements. The adjusted discrimination threshold can be expressed as: p_th(i,j)=p0·(1 γ·M_prior[i][j]) Where p_th(i,j) represents the discrimination threshold corresponding to the direction to be tested from the first alarm node to the second alarm node, p0 represents the baseline discrimination threshold, γ represents the prior injection strength coefficient, and M_prior[i][j] represents the matrix element in the target prior matrix corresponding to the direction to be tested. p0 can be 0.05, and γ can be 0.5. The larger the matrix element, the higher the support of the target prior matrix for the direction to be tested.

[0075] When M_prior[i][j]=0, the physical topology does not support the direction from the first alarm node to the second alarm node, and the electronic device does not generate a causal edge in that direction; when M_prior[i][j]>0, the electronic device judges the causal relationship test result according to the adjusted discrimination condition, and generates a causal edge consistent with the direction to be tested when the test result meets the adjusted discrimination condition.

[0076] For example, in the aforementioned computer room A, the target prior matrix supports the test direction a1 to a2, and M_prior[a2][a1]=0. Therefore, the electronic device can perform causal relationship testing in the direction a1 to a2 and prohibit the generation of causal edges from a2 to a1, thereby updating the causal edges between current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge.

[0077] This implementation method constrains the direction and discrimination conditions of causal relationship testing through the target prior matrix, thereby reducing pseudo-causal edges that do not conform to physical topological relationships and generating a current alarm causal graph that is more in line with the actual scenario.

[0078] In one possible implementation, the conditional probabilities between current alarm nodes in the historical alarm causality graph are updated based on the triggering status of multiple current alarm nodes corresponding to the alarm event within the corresponding time delay window, including: First, the number of times the alarm event corresponding to the first alarm node is triggered is counted, and the number of times the alarm event corresponding to the second alarm node is triggered within a preset time lag window after the alarm event corresponding to the first alarm node is triggered is also counted. The time lag window is a statistical time range set according to the propagation time lag characteristics of the alarm type. After the historical alarm event corresponding to the first alarm node is triggered, only the historical alarm events corresponding to the second alarm node that fall within the corresponding time lag window are counted.

[0079] Secondly, based on the statistically obtained trigger count, the conditional probability of the alarm event corresponding to the second alarm node being triggered in the current round is determined under the condition that the alarm event corresponding to the first alarm node is triggered. Next, the pre-update conditional probability between the first alarm node and the second alarm node in the historical alarm causality graph is obtained. Finally, based on the pre-update conditional probability, the current round conditional probability, and the preset update step size, the conditional probability between the first alarm node and the second alarm node in the historical alarm causality graph is updated.

[0080] Let a_i represent the first alarm node, a_j represent the second alarm node, N_t(a_i) represent the number of times the alarm event corresponding to a_i is triggered in this round, and N_t(a_i→a_j,T_i) represent the statistical number of times a_j is triggered within a fixed time delay window T_i after each trigger of a_i.

[0081] P_t(a_j|a_i)=N_t(a_i→a_j,T_i) / N_t(a_i) _t(a_j|a_i)=(1 λ)· _(t 1)(a_j|a_i)+λ·P_t(a_j|a_i) Where P_t(a_j|a_i) represents the conditional probability of this round. _(t 1)(a_j|a_i) represents the conditional probability before update in the historical alarm causal graph. _t(a_j|a_i) represents the updated conditional probability, and λ represents the preset update step size, which can take values ​​between 0.01 and 0.10.

[0082] In computer room A, the number of triggers in this round can be counted for a1→a2, a2→a3, and a3→a4 respectively. The conditional probabilities of this round can be fused with the conditional probabilities saved in the previous round to obtain P(a2|a1)=0.93, P(a3|a2)=0.81, and P(a4|a3)=0.72.

[0083] Therefore, by counting the number of times the second alarm node is triggered within a preset time delay window after the first alarm node is triggered, the conditional probability of this round is determined. The conditional probability before the update, the conditional probability of this round, and the preset update step size are then updated to solve the problems that the historical conditional probability cannot reflect the recent alarm triggering relationship in a timely manner and that the fluctuation of a single round of alarms can easily lead to sudden changes in the conditional probability. This allows the conditional probability to adapt smoothly to changes in alarm modes.

[0084] In one possible implementation, the association strength of each causal edge is updated based on the physical topology and the co-occurrence of historical alarm events, including: First, the physical proximity between two alarm nodes is determined based on the physical space parameters corresponding to the two alarm nodes connected by the causal edge. Physical proximity is a parameter determined by the physical distance between the devices corresponding to the two alarm nodes connected by the causal edge, and it characterizes the spatial proximity of the two devices. The smaller the device distance, the higher the physical proximity can be. Physical space parameters can include physical parameters such as the physical distance between the devices represented by the alarm nodes and the area of ​​the data center.

[0085] Secondly, the topology connection strength between the two alarm nodes is determined based on the topology connection relationship between the devices corresponding to the two alarm nodes. Furthermore, the historical co-occurrence strength between the two alarm nodes is determined based on the co-occurrence of historical alarm events corresponding to the two alarm nodes. The topology connection strength is a parameter determined based on the topology connection relationship between the devices corresponding to the two alarm nodes. No topology connection, connection via a first-level intermediate node, and direct connection can each correspond to different topology connection strengths. The historical co-occurrence strength is a normalized parameter determined based on the frequency of co-occurrence of historical alarm events corresponding to the two alarm nodes within a corresponding preset time delay window.

[0086] Finally, the physical proximity, topological connectivity strength, and historical co-occurrence strength are weighted to obtain the association strength of the causal edge. The association strength is a parameter obtained by weighting the physical proximity, topological connectivity strength, and historical co-occurrence strength. In this embodiment, w_ij can represent the association strength of the causal edge pointing from alarm node a_i to alarm node a_j.

[0087] Specifically, electronic devices can determine the distance scale d0 based on the physical distance d_ij between the devices and the area S of the equipment room, and determine the physical proximity Prox(i,j) in the following manner: Prox(i,j)=exp( d_ij / d0), d0=0.1×√S After obtaining the physical proximity, topological connectivity strength, and historical co-occurrence strength, the association strength of causal edges can be determined as follows: w_ij=β1·Prox(i,j)+β2·Conn(i,j)+β3·Hist(i,j), and β1+β2+β3=1 Where Conn(i,j) represents the topological connectivity strength, Hist(i,j) represents the historical co-occurrence strength, and β1, β2, and β3 represent the weights corresponding to physical proximity, topological connectivity strength, and historical co-occurrence strength, respectively. The topological connectivity strengths corresponding to no connectivity, connectivity via a first-level intermediate node, and direct connectivity can be 0, 0.5, and 1, respectively; β1, β2, and β3 can be 0.4, 0.4, and 0.2, respectively.

[0088] For example, for the causal edge a1→a2 in the above computer room A, the physical distance d_ij from the power distribution cabinet to PDU-3 is 1.2 meters, the computer room area S is 400 square meters, therefore d0 is 2 meters, Prox(i,j)=exp( 1.2 / 2)≈0.549; The two devices are directly connected by power supply, Conn(i,j)=1; The historical co-occurrence strength Hist(i,j)=0.85. Taking β1=0.4, β2=0.4, β3=0.2, we can obtain the correlation strength w_ij≈0.7896 of this causal edge.

[0089] In this implementation, by integrating physical proximity, topological connectivity strength, and historical co-occurrence strength, the physical rationality and interpretability of causal edge association strength can be improved.

[0090] In one possible implementation, the causal strength of each causal edge is determined based on the updated association strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node. The causal edges in the historical alarm causal graph are then updated based on the causal strength, including: First, based on the causal propagation direction of the causal edge, the alarm node pointed to by the causal edge is determined as the downstream alarm node, and the other alarm node connected by the causal edge is determined as the upstream alarm node. Second, the updated conditional probability of the historical alarm event corresponding to the downstream alarm node being triggered, and the historical occurrence probability of the historical alarm event corresponding to the downstream alarm node, are obtained under the condition that the historical alarm event corresponding to the upstream alarm node is triggered. Here, the upstream alarm node is the alarm node corresponding to the starting end of the causal edge; the downstream alarm node is the alarm node pointed to by the causal edge. The causal propagation direction of the causal edge is from the upstream alarm node to the downstream alarm node.

[0091] Historical occurrence probability is the probability determined based on the occurrence of historical alarm events corresponding to downstream alarm nodes in historical data. It is used to characterize the basic occurrence level of the downstream alarm event without limiting the occurrence of upstream alarm events.

[0092] Furthermore, the causal strength of a causal edge is determined based on its association strength, the difference between the updated conditional probability and the historical occurrence probability, and the historical occurrence probability. Finally, the causal edges between current alarm nodes in the historical alarm causal graph are updated based on the causal strength and the edge filtering threshold. The causal strength, determined by the association strength of the causal edge, the difference between the updated conditional probability and the historical occurrence probability of the downstream alarm node, and the historical occurrence probability, is used to evaluate the effectiveness of the corresponding causal edge. The edge filtering threshold is used to determine whether to retain a causal edge. Electronic devices can retain causal edges whose causal strength reaches the edge filtering threshold and delete those whose causal strength is lower than the edge filtering threshold.

[0093] In this embodiment, C_ij can represent the causal strength of the causal edge pointing from the upstream alarm node a_i to the downstream alarm node a_j, and is calculated as follows: C_ij=w_ij×[P(a_j|a_i) P(a_j)] / max[P(a_j),ε] Where w_ij represents the correlation strength of the causal edge, P(a_j|a_i) represents the updated conditional probability that the historical alarm event corresponding to the downstream alarm node is triggered given that the historical alarm event corresponding to the upstream alarm node is triggered, P(a_j) represents the historical occurrence probability of the historical alarm event corresponding to the downstream alarm node, ε represents the parameter used to avoid the denominator being zero, and ε can be 0.01. The edge filtering threshold θ_c can be 0.3.

[0094] For example, for the aforementioned causal edge a1→a2, the electronic device determines the causal strength based on its correlation strength, P(a2|a1), and P(a2). If the causal strength of this edge is higher than the edge filtering threshold θ_c=0.3, it is retained. For other causal edges with causal strength lower than the edge filtering threshold, they are removed from the alarm causal graph to update the causal edges between current alarm nodes in the historical alarm causal graph.

[0095] In this implementation, causal edges can be filtered by causal strength and edge filtering threshold, which can filter out edges with weak causal relationships and improve the reliability of the current alarm causal graph.

[0096] In another possible implementation of this method, the method further includes: The conditional probabilities between alarm nodes can be updated according to the triggering status of the current alarm event within the corresponding time lag window, based on the first update cycle. The first update cycle is the period used to update the conditional probabilities between alarm nodes, corresponding to a micro-update on a second-level scale. The first update cycle can be from 1 second to 10 seconds.

[0097] Furthermore, the causal strength of each causal edge can be re-determined based on the updated conditional probabilities according to the second update cycle, and the causal edges can be updated based on the causal strength. The second update cycle is the cycle used to re-determine the causal strength and update the causal edges, corresponding to an hourly update. The second update cycle can be from 30 minutes to 1 hour.

[0098] Furthermore, the system can also update the correlation strength of each causal edge in the causal path corresponding to the target root cause node according to the third update cycle, or in response to the confirmation result of the operations and maintenance personnel regarding the target root cause node, based on the confirmation result and the root cause confidence of the target root cause node. The third update cycle is the cycle used to update the correlation strength of each causal edge in the causal path in conjunction with the confirmation result of the operations and maintenance personnel, corresponding to a daily macro update. The third update cycle can be 24 hours, or it can be triggered when the confirmation result of the operations and maintenance personnel regarding the target root cause node is obtained.

[0099] Finally, the alarm causal graph is updated based on the updated conditional probabilities, causal edges, and correlation strength; wherein the first update cycle is shorter than the second update cycle, and the second update cycle is shorter than the third update cycle.

[0100] At the start of the first update cycle, the electronic device updates the current conditional probability estimate based on the current alarm events using an exponential moving average. This update method can be represented as: (a_j|a_i)←(1 λ)· (a_j|a_i)+λ·obs(a_j|a_i) in, (a_j|a_i) represents the currently maintained conditional probability estimate, obs(a_j|a_i) represents the observation within the current update cycle, and λ represents the micro-update step size. When the current alarm event corresponding to alarm node a_i occurs, if the current alarm event corresponding to alarm node a_j occurs within the corresponding time delay window, obs(a_j|a_i) can be 1; otherwise, it can be 0. obs(a_j|a_i) can also be the co-occurrence frequency N_recent(a_i→a_j,T_w) / N_recent(a_i) within the most recent short period.

[0101] The micro-update step size λ represents the proportion of influence of the current observation on the historical conditional probability estimate. A larger λ indicates a faster response of the conditional probability to changes in recent alarm patterns; a smaller λ indicates a more stable change in the conditional probability. λ can be set between 0.01 and 0.10, for example, 0.05. For cross-type alarm combinations, the time lag window can be the larger value between the time lag windows corresponding to the two alarm types.

[0102] When the second update cycle arrives, the electronic device recalculates the causal strength of each causal edge based on the updated conditional probabilities and re-examines causal edges near the edge selection threshold. Causal edges entering the re-examination set must satisfy the following: C_ij∈[θ_c δ_c,θ_c+δ_c] Where θ_c represents the edge filtering threshold, and δ_c represents the boundary bandwidth. θ_c can be 0.3, and δ_c can be between 0.03 and 0.10. For causal edges that enter the re-examination set, the electronic device can re-perform the conditional independence test, Granger causality test, or mutual information test, and continue to use the target prior matrix for constraints.

[0103] The results of the mid-update can include: retaining causal edges that pass the test; deleting causal edges that fail the test and whose causal strength is below the edge selection threshold; or slightly reducing the correlation strength of the corresponding causal edges. Deleted causal edges can be added to the observation list, and when subsequent micro-updates show that their co-occurrence strength has recovered, they can be re-added to the candidate edge set if the target prior matrix supports the corresponding direction.

[0104] When the third update cycle arrives or receives confirmation from operations personnel regarding the target root cause node, the electronic device can update the correlation strength of each causal edge in the causal path corresponding to the target root cause node based on the confirmation result. The confirmation result can be represented as a feedback label y, y∈{0,1}; y=1 indicates that the operations personnel have correctly confirmed the target root cause node, and y=0 indicates that the operations personnel have incorrectly confirmed the target root cause node. The update method for correlation strength can be represented as follows: w_ij←w_ij+η·[y P_root(a_i|S_t)]·w_ij Where η represents the feedback learning rate, which can be 0.01; P_root(a_i|S_t) represents the root cause confidence when the electronic device outputs the target root cause node. The above update method can also be expressed as w_ij←w_ij·{1+η·[y P_root(a_i|S_t)]}. When y=1 and the root cause confidence is insufficient, the association strength in the causal path corresponding to the target root cause node is enhanced; when y=0 and the root cause confidence is high, the corresponding association strength is weakened.

[0105] To ensure that the updated association strength remains within a predetermined range, the association strength can be truncated as follows: w_ij ← min[1, max(0, w_ij)] The third update cycle can only apply to the actual output causal chain from the target root cause node to its downstream alarm nodes, as well as the competing causal chain related to the target root cause node denied by the maintenance personnel, without uniformly updating all causal edges in the alarm causal graph.

[0106] After completing the three-level update, the electronic device recalculates the causal strength of the affected causal edges and writes the updated conditional probability, causal edge set, and association strength back to the alarm causal graph, so that the updated alarm causal graph can continue to be used for subsequent root cause confidence calculation and target root cause node determination.

[0107] For example, in the alarm scenario of the above-mentioned data center A, the electronic equipment uses the alarm event to micro-update the conditional probability, and updates the causal edges near the edge screening threshold 30 minutes later; after the operation and maintenance personnel confirm that a1 is the correct target root cause node, they set the feedback label to 1 and perform a small positive update on the corresponding association strengths in a1→a2, a2→a3 and a3→a4.

[0108] See Figure 3 , Figure 3 The three-level timescale incremental update strategy for the alarm cause-effect graph is illustrated. On a unified time axis, the first update cycle updates the conditional probability at a second-level frequency, the second update cycle re-examines causal edges near the edge filtering threshold at an hour-level frequency, and the third update cycle updates the correlation strength of causal edges at a daily frequency or in response to the confirmation results of operations and maintenance personnel. These three types of updates work together on the alarm cause-effect graph.

[0109] During the maintenance of the historical alarm causal graph, electronic devices perform layered updates of different statistics according to different update cycles. The update results of each cycle are written back to the historical alarm causal graph, enabling subsequent cycles to generate the current alarm causal graph based on the latest conditional probabilities, causal edges, and correlation strengths. This update method can balance the response speed of recent alarm patterns, the stability of edge structures, and the efficiency of operational feedback utilization.

[0110] Step 102: Based on the directed reachability of each current alarm node in the current alarm causal graph, and the matching relationship between the triggering time interval between each current alarm node and the time delay window of the corresponding causal edge, determine the candidate root cause node and the downstream alarm node corresponding to each candidate root cause node.

[0111] Among them, a directed reachability relationship means that starting from a current alarm node, it is possible to reach another current alarm node by following the causal propagation direction of one or more causal edges.

[0112] Among them, the candidate root cause node is an alarm node in the current alarm node set that can reach other current alarm nodes according to the causal propagation direction, and whose triggering time relationship of the corresponding alarm event matches the time delay window of the causal edge; the downstream alarm node corresponding to the candidate root cause node is a current alarm node that can be reached from the candidate root cause node along the causal propagation direction and whose triggering time relationship satisfies the corresponding time delay window.

[0113] The matching relationship between the trigger time interval and the time delay window refers to the fact that the trigger time interval between the alarm events corresponding to the current alarm nodes at both ends of the causal edge is within the time delay window of the corresponding causal edge.

[0114] The electronic device traverses the current alarm cause-effect graph along the causal propagation direction, starting from each current alarm node. For adjacent current alarm nodes in the causal path, the triggering time interval of the corresponding alarm event and the time delay window of the causal edge are compared side by side. The starting point that is valid in both direction and timing is determined as the candidate root cause node, and the current alarm node reached along the path is determined as the corresponding downstream alarm node.

[0115] For example, in the current alarm cause-effect graph, there are a1→a2, a2→a3 and a3→a4. The trigger interval of each adjacent alarm event falls within the time delay window of the corresponding cause-effect edge. Therefore, a1 can be identified as a candidate root cause node, and a2, a3 and a4 can be identified as the downstream alarm nodes corresponding to a1.

[0116] By simultaneously verifying the reachability of the graph structure and the edge-by-edge triggering timing of the actual alarm sequence, alarm nodes that have physical paths but whose current triggering time does not conform to the propagation law can be excluded.

[0117] Step 103: Based on the correlation strength of the causal path from each candidate root cause node to the corresponding downstream alarm node, determine the target root cause node from each candidate root cause node and output the alarm information corresponding to the target root cause node.

[0118] A causal path refers to the alarm nodes and causal edges traversed from a candidate root cause node along the causal propagation direction to one or more corresponding downstream alarm nodes. The correlation strength corresponding to a causal path can be determined based on the correlation strength of each causal edge in the path. For example, the correlation strength of each causal edge in the path can be aggregated by multiplying, weighting, or taking the minimum value to obtain the correlation strength corresponding to the causal path. The greater the correlation strength corresponding to a causal path, the higher the probability that the candidate root cause node will cause the corresponding downstream alarm node to be triggered along the causal path.

[0119] Specifically, the electronic device can acquire the causal path from each candidate root cause node to its corresponding downstream alarm node, and evaluate the explanatory power of each candidate root cause node for its corresponding downstream alarm node based on the correlation strength of each causal path, thereby determining the target root cause node from among the candidate root cause nodes. Optionally, the target root cause node can be determined directly based on the correlation strength of each causal path, or the root cause confidence of each candidate root cause node can be determined first based on the correlation strength, and then the target root cause node can be determined based on the root cause confidence.

[0120] For example, if the current alarm cause graph contains causal edges a1→a2, a2→a3, and a3→a4, and the causal paths from candidate root cause node a1 to downstream alarm nodes a2, a3, and a4 have high correlation strength, while other candidate root cause nodes can explain fewer downstream alarm nodes or the correlation strength of their corresponding causal paths is low, then candidate root cause node a1 can be identified as the target root cause node.

[0121] In one possible implementation, based on the correlation strength of the causal paths from each candidate root cause node to its corresponding downstream alarm node, a target root cause node is determined from the candidate root cause nodes, and the alarm information corresponding to the target root cause node is output, including: First, the root cause confidence of each candidate root cause node is determined based on the correlation strength. Then, the target root cause node is determined from these candidate root cause nodes based on their root cause confidence. The root cause confidence is a parameter characterizing the degree to which a candidate root cause node is credible as the root cause of the current alarm event. The degree of correlation between the downstream alarm nodes and their causal paths that a candidate root cause node can explain can affect its root cause confidence. The target root cause node is the alarm node determined by the electronic device based on the root cause confidence of each candidate root cause node, used to represent the root cause of the current alarm event.

[0122] Secondly, based on the causal path from the target root cause node to the downstream alarm node corresponding to the target root cause node, the target causal chain is determined. The target causal chain includes the target root cause node, the downstream alarm node, and the causal edges connecting the target root cause node and the downstream alarm node. The target causal chain is displayed according to the causal transmission direction of each causal edge. Finally, alarm information is output based on the target causal chain. The alarm information includes at least one of the root cause alarm information corresponding to the target root cause node, the root cause confidence of the target root cause node, and the target causal chain.

[0123] Among them, root cause alarm information is the information of the alarm event corresponding to the target root cause node, which may include alarm type, device identifier, trigger timestamp and alarm level.

[0124] Specifically, the electronic device compares the root cause confidence of each candidate root cause node, determines the target root cause node from the candidate root cause nodes based on the comparison results, and takes the alarm event corresponding to the target root cause node as the root cause alarm of the current alarm event set, so as to output the alarm information corresponding to the target root cause node.

[0125] In this implementation, alarm information corresponding to the target root cause node can be displayed on the display interface, which is used to present the root cause determination results to operations and maintenance personnel. The display interface can display the target root cause node, root cause confidence level, and target causal chain in a related manner.

[0126] In practice, the electronic device starts from the target root cause node, determines the causal path to the corresponding downstream alarm node along the causal propagation direction, and defines this causal path as the target causal chain. Then, the display interface highlights the root cause alarm information and root cause confidence level corresponding to the target root cause node, and sequentially displays the downstream alarm nodes and causal edges in the target causal chain according to the causal propagation direction. The downstream alarm nodes in the target causal chain constitute the set of downstream alarm nodes corresponding to the target root cause node. The display interface can also display the trigger time of each alarm event and the root cause activation or hold status of the target root cause node.

[0127] For example, in the alarm scenario described above, the electronic device displays the uninterruptible power supply bypass switching alarm corresponding to a1 as the root cause alarm, and displays a1→a2→a3→a4 as the target causal chain. The trigger time offsets of a2, a3, and a4 relative to a1 are approximately 2 seconds, 15 seconds, and 90 seconds, respectively. As a result, the four alarms converge into one root cause output, and the root cause is first given approximately 0.5 seconds after the last alarm is triggered.

[0128] See Figure 4 , Figure 4 The diagram shows the root cause alarm and target causal chain display results in the above-mentioned data center A scenario. The target root cause node a1 is highlighted with a root cause identifier, and a1, a2, a3, and a4, along with their corresponding causal edges, are displayed sequentially according to the causal propagation direction. Each causal edge can also display the causal strength and conditional probability, and the timeline below is used to display the triggering order of each alarm event.

[0129] In this implementation, by determining the root cause confidence of candidate root cause nodes based on the correlation strength of causal paths, and outputting root cause alarm information, root cause confidence, or target causal chain displayed according to the causal transmission direction, the problem of difficulty in judging the reliability of results and the basis for alarm propagation when only root cause nodes are output can be solved, making the root cause determination results more intuitive and traceable.

[0130] In a further embodiment of the above implementation, determining the root cause confidence of each candidate root cause node based on the association strength includes: The electronic device first determines the prior probability of occurrence of each candidate root cause node. Then, it determines the conditional probability that the alarm event of the corresponding downstream alarm node will be triggered within the corresponding time lag window, given that the alarm event corresponding to each candidate root cause node is triggered. The prior probability is determined based on the occurrence of historical alarm events corresponding to the candidate root cause node, representing the basic probability of the alarm event corresponding to that candidate root cause node occurring before considering the current downstream alarm event.

[0131] Furthermore, the root cause probability of each candidate root cause node is determined based on its prior occurrence probability, the conditional probability of its corresponding downstream alarm node, and the correlation strength of each causal edge in the corresponding causal path. The root cause probabilities of each candidate root cause node are then normalized to obtain its root cause confidence. Here, the root cause probability is a parameter determined by the electronic device before normalization, based on the prior occurrence probability of the candidate root cause node, the conditional probability of its corresponding downstream alarm node, and the correlation strength of each causal edge in the corresponding causal path. The normalization process converts the root cause probabilities of each candidate root cause node into comparable root cause confidence scores. The normalization factor can be determined based on the root cause probabilities of each candidate root cause node participating in the current candidate evaluation.

[0132] In practice, the electronic device determines the prior occurrence probability P(a_i) of the candidate root cause node a_i, and determines the conditional probability P(a_j|a_i) of each downstream alarm node a_j corresponding to a_i being triggered within the corresponding time delay window. The electronic device also weights the corresponding conditional probabilities or the path weights formed by the conditional probabilities based on the correlation strength of each causal edge in the causal path from a_i to each downstream alarm node, and determines the root cause probability of the candidate root cause node accordingly. For ease of representation, the conditional probability term in the following formula can represent the conditional probability term that has already incorporated the correlation strength of the corresponding causal path.

[0133] P_root(a_i|S_t)={P(a_i)·∏[j∈Desc(i)∩S_t]P(a_j|a_i)} / Z Where S_t represents the current set of alarm nodes, Desc(i) represents the set of downstream alarm nodes reachable from the candidate root cause node a_i in the alarm causal graph, and Z represents the normalization factor. The more current downstream alarm nodes a candidate root cause node can explain, and the higher the correlation strength between the corresponding conditional probability and the causal path, the higher its root cause confidence can be.

[0134] For example, for the current set of alarm nodes S_t={a1,a2,a3,a4}, the electronic device determines the root cause probability based on the prior occurrence probability of each alarm node, the conditional probability of the corresponding downstream alarm node, and the correlation strength of the corresponding causal path, and performs normalization processing to obtain P_root(a1)≈0.94, P_root(a2)≈0.04, P_root(a3)≈0.01 and P_root(a4)≈0.01.

[0135] In a further embodiment of the above implementation, determining the target root cause node from each candidate root cause node based on the root cause confidence level includes: First, for each candidate root cause node, if the corresponding candidate root cause node is in an inactive state and the corresponding root cause confidence reaches the first confidence threshold, the corresponding candidate root cause node is switched to the root cause active state. Here, the inactive state is the state in which the candidate root cause node has not yet been output as the target root cause node; the root cause active state is the state in which the candidate root cause node has met the activation conditions and has been output as the target root cause node.

[0136] Then, the root cause activation state of the corresponding candidate root cause node is maintained when the corresponding root cause confidence level reaches the second confidence threshold and the duration of the root cause activation state reaches the minimum dwell time. The minimum dwell time is the shortest duration required to maintain the root cause activation state after the candidate root cause node switches to the root cause activation state.

[0137] Furthermore, if the corresponding candidate root cause node is in a root cause activation state and the corresponding root cause confidence is lower than the second confidence threshold, the root cause activation state of the corresponding candidate root cause node is revoked. Finally, candidate root cause nodes that are in the root cause activation state are identified as target root cause nodes; In the above implementation, the first confidence threshold is greater than the second confidence threshold. The first confidence threshold is used to control the candidate root cause node to switch from an inactive state to a root cause active state; the second confidence threshold is used to control whether the candidate root cause node maintains or cancels its root cause active state. The first confidence threshold being greater than the second confidence threshold creates a hysteresis interval between the two thresholds.

[0138] The root cause confidence of a candidate root cause node can be a real-time rolling value. When a new alarm event enters the current inference time window, an existing alarm event times out or is removed from the current inference time window after recovery, the downstream alarm node corresponding to the candidate root cause node changes, the normalization factor changes, or the alarm cause-effect graph is incrementally updated, the root cause confidence can change accordingly.

[0139] In practice, the electronic device can maintain the current state, first activation time, most recent update time, and current root cause confidence for each candidate root cause node. When a candidate root cause node is inactive and its root cause confidence reaches the first confidence threshold, it is switched to the root cause active state and the first activation time is recorded. When a candidate root cause node is active, its root cause confidence reaches the second confidence threshold, and the duration of its active state reaches the minimum dwell time, its active state is maintained. When a candidate root cause node is active and its root cause confidence is lower than the second confidence threshold, its active state is revoked, and other candidate root cause nodes are re-evaluated.

[0140] The above state transition relationship can be expressed as: S0→S1: P_root(a_i|S_t)≥θ_r1 S1 holds that P_root(a_i|S_t)≥θ_r2, and t_now t_on(i)≥T_hold S1→S0: P_root(a_i|S_t)<θ_r2 Where S0 represents the inactive state, S1 represents the root cause activation state, θ_r1 represents the first confidence threshold, θ_r2 represents the second confidence threshold, T_hold represents the minimum dwell time, t_on(i) represents the first activation time of the candidate root cause node a_i, and t_now represents the current time. In a specific example, θ_r1 can be 0.85, θ_r2 can be 0.60, and T_hold can be 5 seconds.

[0141] For example, in the alarm scenario described above, P_root(a1) is approximately 0.94 and reaches the first confidence threshold of 0.85, causing the electronic device to switch a1 to the root cause active state. For the next 30 seconds, P_root(a1) remains at or above the second confidence threshold of 0.60 and meets the minimum dwell time requirement; therefore, a1 remains in the root cause active state.

[0142] See Figure 5 , Figure 5 The upper part shows the state transition relationship between the inactive state S0 and the root cause active state S1. Figure 5 The lower half of the diagram shows the hysteresis interval formed by the first confidence threshold and the second confidence threshold. When the root cause confidence fluctuates between the two thresholds, the candidate root cause node can maintain its current state, thereby reducing the frequent changes of the target root cause node.

[0143] In a further embodiment of the above implementation, when the root cause confidence of multiple candidate root cause nodes all reach a first confidence threshold, the candidate root cause node in the root cause activation state is determined as the target root cause node, including: First, a candidate root cause node is selected from multiple candidate root cause nodes based on their root cause confidence scores and the number of downstream alarm nodes corresponding to each candidate root cause node. The number of downstream alarm nodes refers to the number of downstream alarm nodes that the candidate root cause node can explain within the current alarm node set. The number of downstream alarm nodes can be used to evaluate the coverage of the current alarm event set by the candidate root cause node.

[0144] Secondly, if the selected candidate root cause node is different from the currently active candidate root cause node, and the difference in root cause confidence between the two is less than the handover margin, the currently active candidate root cause node is then designated as the target root cause node. Furthermore, if the difference in root cause confidence reaches the handover margin, the selected candidate root cause node is designated as the target root cause node.

[0145] The switching margin is a root cause confidence difference threshold used to determine whether to switch the current target root cause node to another candidate root cause node.

[0146] In practice, when the root cause confidence of multiple candidate root cause nodes all reach the first confidence threshold, the electronic device selects a candidate root cause node based on its root cause confidence and the number of downstream alarm nodes, prioritizing those with higher root cause confidence and the ability to explain more downstream alarm nodes. If the selected candidate root cause node differs from the currently active candidate root cause node, the difference in their root cause confidence and the switching margin are further compared.

[0147] When the root cause confidence difference is less than the handover margin, the electronic device continues to use the candidate root cause node currently in the root cause active state as the target root cause node; when the root cause confidence difference reaches the handover margin, the selected candidate root cause node is determined as the new target root cause node. The handover margin can be between 0.05 and 0.10.

[0148] In this implementation, by combining root cause confidence, the number of downstream alarm nodes, and switching margin to select the target root cause node, frequent switching between similar candidate root causes can be avoided.

[0149] To provide a more comprehensive description of the above scheme, Figure 6 A schematic diagram of a root cause determination method is shown, taking an environmental monitoring system as an example.

[0150] like Figure 6As shown, the multi-source alarm streams generated by the environmental monitoring system first enter the alarm access and normalization stage. In this stage, the alarm type, device identifier, trigger timestamp, alarm level, and subsystem category of each alarm event are extracted, and alarm event sequence A is formed according to a unified data format, so that alarm events generated by different devices and different subsystems can be processed in a unified manner.

[0151] The next step is to construct the target prior matrix. Based on the power supply direction, acquisition signal link, control signal link, and control dependency relationships between devices in the environmental monitoring system, an energy flow adjacency matrix M_energy, a signal flow adjacency matrix M_signal, and a control flow adjacency matrix M_control are constructed respectively. The three adjacency matrices are then fused according to their respective fusion weights to obtain the target prior matrix M_prior. The target prior matrix is ​​used to characterize the degree to which the physical topology supports the causal propagation direction between alarm nodes.

[0152] After obtaining the alarm event sequence A, the corresponding time delay window and causality test lag order are determined according to the propagation time delay characteristics of each alarm type. For two alarm nodes with different alarm types, the larger of the causality test lag orders corresponding to the respective alarm types can be used as the causality test lag order between the two alarm nodes. By statistically analyzing the number of times the historical alarm events corresponding to the first alarm node are triggered, and the number of times the historical alarm events corresponding to the second alarm node are triggered within the corresponding time delay window after the historical alarm events corresponding to the first alarm node are triggered, the conditional probability between the two alarm nodes is obtained.

[0153] During the causality verification phase, the directions to be verified between alarm nodes, supported by physical topology relationships, are determined based on the target prior matrix, and the discrimination conditions for causality verification are adjusted according to the corresponding matrix elements. Causality verification is performed on historical alarm events according to the corresponding causality verification lag order, and the causal edges of the historical alarm causality graph are updated based on the causality verification results and the adjusted discrimination conditions. For causal propagation directions not supported by the target prior matrix, no causal edges are generated in the corresponding directions; for causal propagation directions supported by the target prior matrix, the discrimination conditions are adjusted according to the corresponding matrix elements to reduce the possibility of generating causal edges that violate the physical topology relationships of the devices.

[0154] After obtaining the updated causal edges, the physical proximity is determined based on the physical distance between the devices corresponding to the two alarm nodes connected by the causal edge and the data center area. The topological connection strength is determined based on the topological connection relationship between the two devices, and the historical co-occurrence strength is determined based on the co-occurrence of historical alarm events corresponding to the two alarm nodes. The physical proximity, topological connection strength, and historical co-occurrence strength are weighted to obtain the association strength of the causal edge. Further, the causal strength of the causal edge is determined based on the association strength, the updated conditional probability between the corresponding alarm nodes, and the historical occurrence probability of downstream alarm nodes. Causal edges are then filtered based on the causal strength and an edge filtering threshold to obtain the current alarm causal graph used for real-time root cause inference.

[0155] In the real-time root cause inference phase, alarm events generated within the current inference time window are acquired, and each alarm event is associated with the corresponding alarm node in the current alarm causal graph, resulting in the current alarm node set S_t. Based on the directed reachability of each current alarm node in the alarm causal graph, and the matching relationship between the triggering time interval between each current alarm node and the time delay window of the corresponding causal edge, candidate root cause nodes and their corresponding downstream alarm nodes are determined. Then, based on the prior occurrence probability of each candidate root cause node, the conditional probability of the corresponding downstream alarm node, and the association strength of each causal edge in the corresponding causal path, the root cause probability of each candidate root cause node is determined, and each root cause probability is normalized to obtain the root cause confidence P_root(a_i|S_t) of each candidate root cause node.

[0156] When identifying the target root cause node, a dual-threshold hysteresis judgment is performed on the root cause confidence of each candidate root cause node. When the root cause confidence of a candidate root cause node reaches the first confidence threshold, the candidate root cause node is switched to the root cause active state; when its root cause confidence reaches the second confidence threshold and the duration of the root cause active state reaches the minimum dwell time, its root cause active state is maintained; when its root cause confidence falls below the second confidence threshold, its root cause active state is revoked. This reduces frequent switching of the target root cause node caused by short-term fluctuations in root cause confidence.

[0157] The alarm cause-effect graph can also be incrementally updated according to three different update cycles. In the first update cycle, the conditional probabilities between alarm nodes are updated based on the triggering status of the current alarm event within the corresponding time lag window. In the second update cycle, the causal strength of causal edges is re-determined based on the updated conditional probabilities, and causal edges near the edge filtering threshold are updated. In the third update cycle, when the confirmation result of the target root cause node is obtained by operations personnel, the association strength of each causal edge in the corresponding causal path is updated based on the confirmation result and the root cause confidence of the target root cause node. The updated conditional probabilities, causal edges, and association strengths are written back to the alarm cause-effect graph for subsequent root cause inference.

[0158] Taking the alarm events occurring in data center A as an example, the environmental monitoring system sequentially generates an uninterruptible power supply (UPS) bypass switching alarm a1, a low output voltage alarm for the power distribution unit a2, a high cabinet temperature alarm a3, and an insufficient air conditioning cooling alarm a4. After the above processing, a causal path a1→a2→a3→a4 is formed in the alarm cause-effect graph. The electronic equipment determines that the root cause confidence of a1 is approximately 0.94 and switches a1 to the root cause active state, ultimately outputting the UPS bypass switching alarm corresponding to a1 and the target causal chain a1→a2→a3→a4. After the maintenance personnel confirm the target root cause node, the confirmation result can also be used to update the correlation strength of each causal edge in the corresponding causal path, thereby enabling the alarm cause-effect graph to continuously evolve.

[0159] Based on the same inventive concept as the above-described method embodiments, this application also provides a root cause determination system for environmental alarms. See also Figure 7 , Figure 7 This diagram illustrates the functional architecture of a root cause determination system provided in an embodiment of this application. The system interacts with an environmental monitoring system, a physical topology configuration library, and an operation and maintenance terminal or work order system, and includes an alarm access and normalization module M1, a three-flow prior construction module M2, a time-delay hierarchical causal learning module M3, a real-time root cause inference module M4, a root cause output and visualization module M5, and an incremental update and feedback module M6.

[0160] The alarm access and normalization module M1 is used to receive multi-source alarm streams generated by the environmental monitoring system, normalize the alarm events to obtain a standardized alarm event sequence A, and provide the standardized alarm event sequence A to the three-stream prior construction module M2 and the time-delay hierarchical causal learning module M3.

[0161] The three-flow prior construction module M2 is used to construct the energy flow adjacency matrix, signal flow adjacency matrix, and control flow adjacency matrix based on the standardized alarm event sequence A and the power distribution topology, signal links, and control dependencies provided by the physical topology configuration library. The three adjacency matrices are then fused to obtain the target prior matrix M_prior. The target prior matrix M_prior is then provided to the time-delay hierarchical causal learning module M3.

[0162] The time-delay hierarchical causal learning module M3 is used to perform time-delay hierarchical statistics and causal relationship tests based on the standardized alarm event sequence A and the target prior matrix M_prior, determine the causal edges between alarm nodes and their causal propagation directions, and filter causal edges by combining the correlation strength and causal strength of each causal edge to generate the current alarm causal graph G. The current alarm causal graph G is provided to the real-time root cause reasoning module M4.

[0163] The real-time root cause reasoning module M4 is used to determine candidate root cause nodes and their corresponding downstream alarm nodes based on the alarm cause-effect graph G and the current alarm node set S_t, and to calculate the root cause confidence P_root(a_i|S_t) for each candidate root cause node. The root cause output and visualization module M5 is used to perform dual-threshold hysteresis judgment on the root cause confidence, determine the target root cause node, and output the root cause alarm, root cause confidence, and target cause-effect chain to the operation and maintenance terminal or work order system.

[0164] The incremental update and feedback module M6 receives root cause determination results and confirmation results from the operation and maintenance terminal or work order system. It updates the conditional probabilities between alarm nodes, the causal edges in the alarm cause-effect graph, and the correlation strength of each causal edge through a three-level incremental update method, and feeds the update results back to the time-delay hierarchical causal learning module M3. Thus, the system forms a closed-loop processing process from multi-source alarm access, target prior matrix construction, alarm cause-effect graph generation, real-time root cause reasoning and result output, to operation and maintenance feedback and alarm cause-effect graph update.

[0165] It should be noted that the above system embodiment mainly describes the root cause determination process of environmental alarms from the perspectives of overall functional architecture, data flow between modules, and interaction with external systems. To further illustrate the functional implementation of the above method on the device side, the following section combines... Figure 8 The functional modules used to execute the root cause determination method for the aforementioned environmental alarms are described below. The device embodiment and the aforementioned method embodiment are based on the same inventive concept; the specific processing procedures of each module and the resulting technical effects can be found in the aforementioned method embodiment.

[0166] See Figure 8 The diagram shows a schematic representation of a root cause determination device according to an embodiment of this application. For ease of explanation, only the parts relevant to the embodiments of this application are shown.

[0167] The root cause determination device 800 for environmental alarms includes: The acquisition module 801 is used to acquire alarm events and historical alarm cause-effect graphs, and generate the current alarm cause-effect graph based on the alarm events and historical alarm cause-effect graphs; wherein, the current alarm cause-effect graph includes multiple current alarm nodes corresponding to alarm events and causal edges between each current alarm node among the multiple current alarm nodes, and each causal edge has a corresponding causal propagation direction, time delay window and correlation strength. The candidate determination module 802 is used to determine each candidate root cause node and the downstream alarm node corresponding to each candidate root cause node based on the directed reachability relationship of each current alarm node in the current alarm cause graph and the matching relationship between the trigger time interval between each current alarm node and the time delay window of the corresponding cause edge. The root cause determination module 803 is used to determine the target root cause node from each candidate root cause node based on the correlation strength of the causal path from each candidate root cause node to the corresponding downstream alarm node, and output the alarm information corresponding to the target root cause node.

[0168] In one possible implementation, the acquisition module 801 includes: The conditional probability update unit is used to update the conditional probability between each current alarm node in the historical alarm causal graph based on the triggering status of multiple current alarm nodes corresponding to the alarm event within the corresponding time delay window. The prior matrix construction unit is used to obtain the physical topology relationship of the nodes and construct a target prior matrix to characterize the topological prior relationship between alarm nodes based on the physical topology relationship of the nodes. The lag order determination unit is used to determine the causal check lag order corresponding to each current alarm node based on the alarm type corresponding to each current alarm node. The causality verification unit is used to perform causality verification on the historical alarm events according to the causality verification lag order under the constraint of the target prior matrix, and update the causal edges between the current alarm nodes in the historical alarm causality graph and the causal propagation direction of each causal edge according to the causality verification result. The association strength update unit is used to update the association strength of each causal edge according to the physical topology relationship and the co-occurrence of the historical alarm events; The causal edge update and graph generation unit is used to determine the causal strength of each causal edge based on the updated association strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node, update the causal edges in the historical alarm causal graph based on the causal strength, and generate the current alarm causal graph.

[0169] In one possible implementation, the prior matrix construction unit includes: The energy flow adjacency matrix construction sub-unit is used to construct an energy flow adjacency matrix that represents the energy transfer relationship between corresponding alarm nodes based on the node power supply direction. The signal flow adjacency matrix construction sub-unit is used to construct a signal flow adjacency matrix that represents the signal transmission relationship between corresponding alarm nodes based on the node signal acquisition link and the node signal control link. The control flow adjacency matrix construction sub-unit is used to construct a control flow adjacency matrix that represents the control transmission relationship between corresponding alarm nodes based on node dependencies. The matrix fusion subunit is used to fuse the energy flow adjacency matrix, the signal flow adjacency matrix, and the control flow adjacency matrix according to the fusion weights corresponding to each adjacency matrix to obtain the target prior matrix.

[0170] In one possible implementation, the causality verification unit includes: The direction to be tested determination subunit is used to determine the direction to be tested supported by the topological prior relationship between the first alarm node and the second alarm node based on the target prior matrix; the first alarm node and the second alarm node are any two nodes among the current alarm nodes that have a physical topological connection relationship; The matrix element acquisition subunit is used to acquire the matrix element in the target prior matrix that corresponds to the direction to be tested. The discrimination condition adjustment subunit is used to adjust the discrimination conditions of the causal relationship test according to the matrix elements; The causality test execution subunit is used to perform causality tests on the historical alarm events corresponding to the first alarm node and the second alarm node according to the causality test lag order, and obtain the causality test results. The causal edge generation subunit is used to generate causal edges whose causal transmission direction is consistent with the direction to be tested, based on the causal relationship test results and the adjusted discrimination conditions, so as to update the causal edges between the current alarm nodes in the historical alarm causal graph and the causal transmission direction of each causal edge.

[0171] In one possible implementation, the conditional probability update unit includes: The trigger count statistics subunit is used to count the number of times the alarm event corresponding to the first alarm node is triggered in the alarm event, and the number of times the alarm event corresponding to the second alarm node is triggered within the preset time delay window after the alarm event corresponding to the first alarm node is triggered. The conditional probability determination subunit is used to determine the conditional probability of the alarm event corresponding to the second alarm node being triggered under the condition that the alarm event corresponding to the first alarm node is triggered, based on the number of triggers obtained statistically. The pre-update conditional probability acquisition subunit is used to acquire the pre-update conditional probability between the first alarm node and the second alarm node in the historical alarm causal graph; The conditional probability update subunit is used to update the conditional probability between the first alarm node and the second alarm node in the historical alarm causal graph based on the conditional probability before the update, the conditional probability in the current round, and the preset update step size.

[0172] In one possible implementation, the association strength update unit includes: The physical proximity determination subunit is used to determine the physical proximity between the two alarm nodes based on the physical space parameters corresponding to the two alarm nodes connected by the causal edge. The topology connection strength determination subunit is used to determine the topology connection strength between the two alarm nodes based on the topology connection relationship corresponding to the two alarm nodes. The historical co-occurrence intensity determination subunit is used to determine the historical co-occurrence intensity between the two alarm nodes based on the co-occurrence of historical alarm events corresponding to the two alarm nodes. The weighted processing subunit is used to perform weighted processing on the physical proximity, the topological connection strength, and the historical co-occurrence strength to obtain the association strength of the causal edge.

[0173] In one possible implementation, the causal edge update and graph generation unit includes: The upstream and downstream alarm node determination subunit is used to determine the alarm node pointed to by the causal edge as the downstream alarm node and the other alarm node connected by the causal edge as the upstream alarm node, based on the causal transmission direction of the causal edge. The probability acquisition subunit is used to acquire the updated conditional probability of the alarm event corresponding to the downstream alarm node being triggered under the condition that the alarm event corresponding to the upstream alarm node is triggered, as well as the historical occurrence probability of the historical alarm event corresponding to the downstream alarm node. The causal strength determination subunit is used to determine the causal strength of the causal edge based on the association strength of the causal edge, the difference between the updated conditional probability and the historical occurrence probability, and the historical occurrence probability. The causal edge update subunit is used to update the causal edges between the current alarm nodes in the historical alarm causal graph according to the causal strength and the edge filtering threshold.

[0174] In one possible implementation, the confidence level and target root cause determination unit includes: The prior occurrence probability determination subunit is used to determine the prior occurrence probability of each of the candidate root cause nodes; The downstream conditional probability determination subunit is used to determine the conditional probability that the alarm event of the corresponding downstream alarm node will be triggered within the corresponding time delay window under the condition that the alarm event corresponding to each of the candidate root cause nodes is triggered. The root cause probability determination subunit is used to determine the root cause probability of each candidate root cause node based on the prior occurrence probability of each candidate root cause node, the conditional probability of the corresponding downstream alarm node, and the correlation strength of each causal edge in the corresponding causal path. The normalization processing subunit is used to normalize the root cause probability of each candidate root cause node to obtain the root cause confidence of each candidate root cause node.

[0175] In one possible implementation, the confidence level and target root cause determination unit further includes: The root cause activation subunit is used to switch the corresponding candidate root cause node to the root cause activation state when the corresponding candidate root cause node is in an inactive state and the confidence of the corresponding root cause reaches the first confidence threshold. The root cause retention subunit is used to maintain the root cause activation state of the corresponding candidate root cause node when the corresponding candidate root cause node is in the root cause activation state, the corresponding root cause confidence reaches the second confidence threshold, and the duration of the root cause activation state reaches the minimum residence time. The root cause cancellation subunit is used to cancel the root cause activation state of the corresponding candidate root cause node when the corresponding candidate root cause node is in the root cause activation state and the corresponding root cause confidence is lower than the second confidence threshold. The target root cause node determination subunit is used to determine the candidate root cause node that is in the root cause activation state as the target root cause node; Wherein, the first confidence threshold is greater than the second confidence threshold.

[0176] When the root cause confidence of multiple candidate root cause nodes all reach the first confidence threshold, the confidence and target root cause determination unit further includes: The candidate root cause node selection subunit is used to select a candidate root cause node from the plurality of candidate root cause nodes based on the root cause confidence of the plurality of candidate root cause nodes and the number of downstream alarm nodes corresponding to each candidate root cause node. The current target root cause retention subunit is used to continue to determine the candidate root cause node currently in the root cause activation state as the target root cause node when the selected candidate root cause node is different from the candidate root cause node currently in the root cause activation state, and the difference in root cause confidence between the two is less than the switching margin. The target root cause switching subunit is used to determine the selected candidate root cause node as the target root cause node when the root cause confidence difference reaches the switching margin.

[0177] It should be noted that the information interaction and execution process between the above-mentioned devices, modules or units are based on the same concept as the aforementioned method embodiments. Their specific functions and technical effects can be found in the method embodiments section, and will not be repeated here.

[0178] See Figure 9 The diagram illustrates the structure of an electronic device according to an embodiment of this application. Figure 9 As shown, the electronic device 900 of this embodiment includes: at least one processor 910 ( Figure 9Only one is shown in the diagram), memory 920, and computer program 921 stored in memory 920 and executable on at least one processor 910, wherein processor 910 executes computer program 921 to implement the steps in the above-described root cause determination method embodiments.

[0179] Electronic device 900 may be a server, physical server, computing device, etc. This electronic device may include, but is not limited to, processor 910 and memory 920. Those skilled in the art will understand that... Figure 9 This is merely an example of electronic device 900 and does not constitute a limitation on electronic device 900. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0180] The processor 910 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0181] In some embodiments, memory 920 may be an internal storage unit of electronic device 900, such as a hard disk or memory of electronic device 900. In other embodiments, memory 920 may be an external storage device of electronic device 900, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on electronic device 900. Furthermore, memory 920 may include both internal and external storage units of electronic device 900. Memory 920 is used to store operating system, application programs, boot loader, data, and other programs, such as program code of computer programs. Memory 920 may also be used to temporarily store data that has been output or will be output.

[0182] In specific implementations, the processor 910, memory 920, and computer program 921 described in the embodiments of this application can execute the embodiments of the root cause determination method of this application, which will not be repeated here.

[0183] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0184] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0185] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0186] In the embodiments provided in this application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0187] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0188] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0189] If an integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0190] The implementation of all or part of the processes in the methods of the above embodiments can also be accomplished by a computer program product. When the computer program product is run on an electronic device, the electronic device can implement the steps in the various method embodiments described above.

[0191] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for determining root causes, characterized in that, The method includes: Obtain alarm events and historical alarm cause graphs, and generate a current alarm cause graph based on the alarm events and historical alarm cause graphs; wherein, the current alarm cause graph includes multiple current alarm nodes corresponding to the alarm events and causal edges between each current alarm node among the multiple current alarm nodes, and each causal edge has a corresponding causal propagation direction, time delay window and correlation strength; Based on the directed reachability of each current alarm node in the current alarm cause graph, and the matching relationship between the triggering time interval between each current alarm node and the time delay window of the corresponding cause edge, each candidate root cause node and the downstream alarm node corresponding to each candidate root cause node are determined. Based on the correlation strength of the causal path from each candidate root cause node to the corresponding downstream alarm node, the target root cause node is determined from each candidate root cause node, and the alarm information corresponding to the target root cause node is output.

2. The method as described in claim 1, characterized in that, The step of determining the target root cause node from the candidate root cause nodes based on the correlation strength of the causal paths from each candidate root cause node to the corresponding downstream alarm node, and outputting the alarm information corresponding to the target root cause node, includes: The root cause confidence of each candidate root cause node is determined based on the association strength. The target root cause node is determined from each of the candidate root cause nodes based on the root cause confidence level. A target causal chain is determined based on the causal path from the target root cause node to the downstream alarm node corresponding to the target root cause node; the target causal chain includes the target root cause node, the downstream alarm node, and causal edges connecting the target root cause node and the downstream alarm node; the target causal chain is displayed according to the causal transmission direction of each causal edge therein; The alarm information is output according to the target causal chain; the alarm information includes the root cause alarm information corresponding to the target root cause node, the root cause confidence of the target root cause node, and at least one of the target causal chain.

3. The method as described in claim 1, characterized in that, The step of generating the current alarm cause-effect graph based on the alarm event and the historical alarm cause-effect graph includes: Based on the triggering status of multiple current alarm nodes corresponding to the alarm event within the corresponding time delay window, update the conditional probability between each current alarm node in the historical alarm cause-effect graph; Obtain the physical topology relationship of the nodes, and construct a target prior matrix to characterize the topological prior relationship between alarm nodes based on the physical topology relationship of the nodes; Based on the alarm type corresponding to each current alarm node, determine the causal check lag order corresponding to each current alarm node; Under the constraint of the target prior matrix, causal relationship testing is performed on the historical alarm events according to the causal test lag order, and the causal edges between the current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge are updated according to the causal relationship test results. The correlation strength of each causal edge is updated based on the physical topology of the nodes and the co-occurrence of historical alarm events. Based on the updated correlation strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node, the causal strength of each causal edge is determined. The causal edges in the historical alarm causal graph are updated according to the causal strength to generate the current alarm causal graph.

4. The method as described in claim 3, characterized in that, The step of constructing a target prior matrix to characterize the topological prior relationships between alarm nodes based on the node physical topology relationships includes: Based on the power supply direction of the nodes, an energy flow adjacency matrix is ​​constructed to represent the energy transfer relationship between the corresponding alarm nodes; Based on the node signal acquisition link and the node signal control link, a signal flow adjacency matrix is ​​constructed to characterize the signal transmission relationship between corresponding alarm nodes; Based on node dependencies, a control flow adjacency matrix is ​​constructed to represent the control transmission relationship between corresponding alarm nodes; The energy flow adjacency matrix, the signal flow adjacency matrix, and the control flow adjacency matrix are fused according to the fusion weights corresponding to each adjacency matrix to obtain the target prior matrix.

5. The method as described in claim 4, characterized in that, The step of performing causal relationship testing on the historical alarm events according to the causal test lag order under the constraint of the target prior matrix, and updating the causal edges between the current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge based on the causal relationship test results, includes: Based on the target prior matrix, the direction to be tested supported by the topological prior relationship is determined between the first alarm node and the second alarm node; the first alarm node and the second alarm node are any two nodes among the current alarm nodes that have a physical topological connection relationship; Obtain the matrix element in the target prior matrix that corresponds to the direction to be tested; Adjust the discrimination criteria for the causal relationship test based on the matrix elements; According to the causal test lag order, perform causal relationship testing on the historical alarm events corresponding to the first alarm node and the second alarm node to obtain the causal relationship test results; Based on the causal relationship test results and the adjusted discrimination conditions, causal edges with causal propagation directions consistent with the direction to be tested are generated to update the causal edges between the current alarm nodes in the historical alarm causal graph and the causal propagation direction of each causal edge.

6. The method as described in claim 3, characterized in that, The step of updating the conditional probabilities between the current alarm nodes in the historical alarm causality graph based on the triggering status of the multiple current alarm nodes corresponding to the alarm event within the corresponding time delay window includes: The number of times the alarm event corresponding to the first alarm node is triggered in the alarm events is counted, and the number of times the alarm event corresponding to the second alarm node is triggered within a preset time delay window after the alarm event corresponding to the first alarm node is triggered; Based on the number of triggers obtained from statistics, determine the conditional probability of the alarm event corresponding to the second alarm node being triggered in this round under the condition that the alarm event corresponding to the first alarm node is triggered; Obtain the pre-update conditional probability between the first alarm node and the second alarm node in the historical alarm causal graph; Based on the conditional probability before the update, the conditional probability of the current round, and the preset update step size, update the conditional probability between the first alarm node and the second alarm node in the historical alarm causal graph.

7. The method as described in claim 3, characterized in that, The step of updating the association strength of each causal edge based on the physical topology of the nodes and the co-occurrence of the historical alarm events includes: The physical proximity between the two alarm nodes is determined based on the physical space parameters corresponding to the two alarm nodes connected by the causal edge. The topological connection strength between the two alarm nodes is determined based on the topological connection relationship corresponding to the two alarm nodes. Based on the co-occurrence of historical alarm events corresponding to the two alarm nodes, the historical co-occurrence intensity between the two alarm nodes is determined; The physical proximity, topological connectivity, and historical co-occurrence strength are weighted to obtain the association strength of the causal edge.

8. The method as described in claim 7, characterized in that, The step of determining the causal strength of each causal edge based on the updated association strength, the updated conditional probability, and the historical occurrence probability of the corresponding current alarm node, and updating the causal edges in the historical alarm causal graph according to the causal strength, includes: Based on the causal propagation direction of the causal edge, the alarm node pointed to by the causal edge is determined as the downstream alarm node, and the other alarm node connected by the causal edge is determined as the upstream alarm node. Under the condition that the alarm event corresponding to the upstream alarm node is triggered, the updated conditional probability that the alarm event corresponding to the downstream alarm node is triggered, and the historical occurrence probability of the historical alarm event corresponding to the downstream alarm node are obtained. The causal strength of the causal edge is determined based on the correlation strength of the causal edge, the difference between the updated conditional probability and the historical occurrence probability, and the historical occurrence probability. Based on the causal strength and edge filtering threshold, update the causal edges between each current alarm node in the historical alarm causal graph.

9. The method as described in claim 2, characterized in that, The step of determining the root cause confidence of each candidate root cause node based on the association strength includes: Determine the prior occurrence probability of each of the candidate root cause nodes; Determine the conditional probability that the alarm event of the corresponding downstream alarm node will be triggered within the corresponding time delay window under the condition that the alarm event corresponding to each of the candidate root cause nodes is triggered. The root cause probability of each candidate root cause node is determined based on the prior occurrence probability of each candidate root cause node, the conditional probability of the corresponding downstream alarm node, and the correlation strength of each causal edge in the corresponding causal path. The root cause probability of each candidate root cause node is normalized to obtain the root cause confidence of each candidate root cause node.

10. The method as described in claim 9, characterized in that, The step of determining the target root cause node from each of the candidate root cause nodes based on each of the root cause confidence scores includes: For each of the candidate root cause nodes, if the corresponding candidate root cause node is in an inactive state and the confidence level of the corresponding root cause reaches the first confidence level threshold, the corresponding candidate root cause node will be switched to the root cause active state. The root cause activation state of the corresponding candidate root cause node is maintained when the corresponding root cause node is in the root cause activation state, the corresponding root cause confidence reaches the second confidence threshold, and the duration of the root cause activation state reaches the minimum residence time. If the corresponding candidate root cause node is in the root cause activation state and the corresponding root cause confidence is lower than the second confidence threshold, the root cause activation state of the corresponding candidate root cause node shall be revoked. The candidate root cause node that is in the root cause activation state is determined as the target root cause node; Wherein, the first confidence threshold is greater than the second confidence threshold.

11. The method as described in claim 10, characterized in that, When the root cause confidence of multiple candidate root cause nodes all reach the first confidence threshold, determining the candidate root cause node in the root cause activation state as the target root cause node includes: Based on the root cause confidence of the multiple candidate root cause nodes and the number of downstream alarm nodes corresponding to each candidate root cause node, a candidate root cause node is selected from the multiple candidate root cause nodes. If the selected candidate root cause node is different from the candidate root cause node currently in the root cause activation state, and the difference in root cause confidence between the two is less than the switching margin, the candidate root cause node currently in the root cause activation state shall continue to be determined as the target root cause node. If the root cause confidence difference reaches the switching margin, the selected candidate root cause node is determined as the target root cause node.

12. A root cause determination device, characterized in that, The device includes: The acquisition module is used to acquire alarm events and historical alarm cause-effect graphs, and generate a current alarm cause-effect graph based on the alarm events and historical alarm cause-effect graphs; wherein, the current alarm cause-effect graph includes multiple current alarm nodes corresponding to the alarm events and causal edges between each current alarm node among the multiple current alarm nodes, and each causal edge has a corresponding causal propagation direction, time delay window and correlation strength; The candidate determination module is used to determine each candidate root cause node and the downstream alarm node corresponding to each candidate root cause node based on the directed reachability relationship of each current alarm node in the current alarm cause graph and the matching relationship between the trigger time interval between each current alarm node and the time delay window of the corresponding cause edge. The root cause determination module is used to determine the target root cause node from the candidate root cause nodes based on the correlation strength of the causal path from each candidate root cause node to the corresponding downstream alarm node, and output the alarm information corresponding to the target root cause node.

13. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, implements the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 11.

Images