A device monitoring method and electronic device

Abstract

The application discloses a device monitoring method and an electronic device, relates to the technical field of device management, and comprises the following steps: acquiring multi-source heterogeneous data of a device to be detected; performing node identification and relationship extraction on the multi-source heterogeneous data, constructing a time sequence knowledge graph, extracting a time sequence subgraph associated with an alarm event from the time sequence knowledge graph, and performing feature coding on nodes and edges in the time sequence subgraph. Based on a graph neural network, message passing is performed on the coded time sequence subgraph, the attention weight between each node and its neighbor node is determined, and the neighbor node features are aggregated based on the attention weight to obtain node update features containing context information. According to each attention weight, path reverse tracing is performed to determine a plurality of candidate root cause paths, and a comprehensive confidence is calculated according to the node update features, and a root cause analysis result is output according to the confidence, so that traditional fault positioning depending on expert experience is converted into quantifiable intelligent root cause analysis. The accuracy of fault positioning is ensured.

Description

Technical Field

[0001] This application relates to the field of equipment management technology, and in particular to an equipment monitoring method and electronic device. Background Technology

[0002] The Baseboard Management Controller (BMC), as the management unit of server and data center infrastructure, runs independently of the host operating system, providing out-of-band remote monitoring, management, and recovery capabilities. Traditional BMC monitoring primarily relies on the Intelligent Platform Management Interface (IPMI) protocol to collect sensor data such as temperature, voltage, and fan speed, using threshold alarms to determine hardware health. However, with the growth in data center scale and the increasing complexity of network attack methods, traditional BMC monitoring systems suffer from data silos and a lack of correlation, hindering in-depth root cause analysis of faults. Therefore, improving the accuracy of fault root cause analysis through BMC monitoring is crucial. Summary of the Invention

[0003] This application provides a device monitoring method and an electronic device to at least solve the problem of poor accuracy in root cause analysis of board management controller failures in related technologies.

[0004] This application provides a device monitoring method applicable to cloud or edge gateways, the method comprising: Acquire multi-source heterogeneous data from the device under test; the multi-source heterogeneous data includes multimodal health data and safety probe data; Node identification and relationship extraction are performed on multi-source heterogeneous data to construct a temporal knowledge graph. The temporal knowledge graph includes multiple nodes and edges connecting multiple nodes. Each edge has time attribute information to represent the effective time interval of the relationship. Upon detecting an alarm event, extract the temporal subgraph associated with the alarm event from the temporal knowledge graph, and perform feature encoding on the nodes and edges in the temporal subgraph. The encoded temporal subgraph is message-passed using a graph neural network to determine the attention weights between each node and its neighboring nodes. The features of the neighboring nodes are then aggregated based on the attention weights to obtain node update features containing contextual information. Multiple candidate root cause paths are identified by reverse tracing based on each attention weight, and the comprehensive confidence of each candidate root cause path is determined based on node update characteristics. The root cause analysis results are then output based on the comprehensive confidence.

[0005] This application also provides a device monitoring apparatus suitable for cloud or edge gateways. The apparatus includes an acquisition unit, a construction unit, an extraction unit, an encoding unit, a first determination unit, a first update unit, a second determination unit, a third determination unit, and an output unit. The acquisition unit is used to acquire multi-source heterogeneous data of the device under test; wherein, the multi-source heterogeneous data includes multimodal health data and safety probe data; The construction unit is used to identify nodes and extract relationships from multi-source heterogeneous data to build a time-series knowledge graph. The time-series knowledge graph includes multiple nodes and edges connecting multiple nodes. Each edge has time attribute information to represent the effective time interval of the relationship. The extraction unit is used to extract a time-series subgraph associated with the alarm event from the time-series knowledge graph when an alarm event is detected. The encoding unit is used to encode the features of nodes and edges in the temporal subgraph; The first determining unit is used to perform message passing on the encoded temporal subgraph based on the graph neural network, and to determine the attention weight between each node and its neighboring nodes. The first update unit is used to aggregate the features of neighboring nodes based on attention weights to obtain node update features containing context information. The second determining unit is used to determine multiple candidate root cause paths by performing path back-source tracing based on each attention weight; The third determining unit is used to determine the comprehensive confidence level of each candidate root cause path based on the node update characteristics; The output unit is used to output the root cause analysis results based on the overall confidence level.

[0006] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described device monitoring methods when executing the computer program.

[0007] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described device monitoring methods.

[0008] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described device monitoring methods.

[0009] This application acquires multi-source heterogeneous data from the devices under test, unifying previously scattered multi-source data and breaking down the data silos of traditional device monitoring, thus achieving comprehensive monitoring of various types of data. By identifying nodes and extracting relationships from the multi-source heterogeneous data, a temporal knowledge graph is constructed, forming a dynamically evolving panoramic monitoring map that supports historical backtracking. When an alarm event is detected, a temporal subgraph associated with the alarm event is extracted from the temporal knowledge graph, and the nodes and edges in the temporal subgraph are feature-encoded, providing a unified and spatiotemporally semantically rich input for root cause analysis. Based on a graph neural network, message passing is performed on the encoded temporal subgraph to determine the attention weights between each node and its neighboring nodes. Neighboring node features are aggregated based on these attention weights to obtain node update features containing contextual information, thereby automatically learning the propagation relationships of faults or attacks in complex topologies and highlighting critical paths. Path back-tracing is performed based on each attention weight to determine multiple candidate root cause paths, and a comprehensive confidence score is calculated based on the node update features. The root cause analysis results are output according to the confidence score, thus transforming traditional fault location relying on expert experience into quantifiable intelligent root cause analysis. This technical solution utilizes the message passing mechanism and attention weight learning of graph neural networks to automatically capture the topological relationships and fault propagation patterns between nodes. Root cause localization can be achieved without manually writing complex rules, ensuring the accuracy of fault location. Through path reverse tracing and comprehensive confidence calculation, it not only outputs the most likely root cause node but also provides a complete reasoning path and confidence scores for each dimension, facilitating understanding and verification by operations and maintenance personnel. Simultaneously, the dynamic evolution mechanism of the time-series knowledge graph preserves historical states, supporting data queries at any point in time, providing a data foundation for fault review and trend analysis. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart illustrating a device monitoring method provided in this application embodiment; Figure 2 A flowchart for constructing a time-series knowledge graph is provided in an embodiment of this application; Figure 3 A flowchart illustrating a method for determining the overall confidence level of each candidate root cause path, provided in an embodiment of this application; Figure 4 A framework diagram of a device monitoring system provided in an embodiment of this application; Figure 5This is a schematic diagram of the structure of a device monitoring device according to an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0013] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0014] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] Example 1

[0016] The embodiments of this application provide a device monitoring method, and the method is described in detail below in conjunction with the execution flow of the device monitoring method. Figure 1 A flowchart of a device monitoring method provided in this application embodiment, applicable to cloud or edge gateways, the method includes: S101: Acquire multi-source heterogeneous data of the device under test.

[0017] Multi-source heterogeneous data can be collected by lightweight probes deployed on the terminal and transmitted from the terminal to the cloud or edge gateway. For ease of explanation, this application will focus on the cloud-based processing flow. The cloud can be a centralized management platform.

[0018] Multi-source heterogeneous data can include multimodal health data and safety probe data.

[0019] In practical applications, two types of functional modules can be deployed on the terminal: a multimodal hardware health collector and an endogenous security probe set. The multimodal hardware health collector is used to collect and process multimodal health data, while the endogenous security probe set is used to collect and process security probe data.

[0020] Depending on the type of data to be collected, the multimodal hardware health collector may include an intelligent platform management interface sensor monitoring submodule, a system event log (SEL) intelligent parsing submodule, a Redfish resource aggregation submodule, and an in-band host status bridge.

[0021] The IPMI sensor monitoring submodule, through the IPMI device driver in the baseboard management controller kernel, polls all sensors defined in the Sensor Data Record (SDR) repository at a configurable frequency of 1Hz. It collects instantaneous values ​​and statistical characteristics such as temperature, voltage, current, and fan speed. These statistical characteristics can include the mean, variance, maximum, and minimum values ​​over the past minute. Supported sensor types include, but are not limited to, temperature sensors, voltage sensors, current sensors, fan speed sensors, and power consumption sensors.

[0022] The SEL intelligent parsing submodule monitors new event logs captured by the IPMI message channel in real time. This submodule has a built-in rule-based and machine learning-based event parser. The rule engine is used to parse standard SEL entries with fixed formats. For custom complex SEL entries, a lightweight natural language processing model based on the Bidirectional Encoder Representation (BERT) from Transformer is used for semantic understanding, transforming them into structured event triples (entity, attribute, value). For example, the entity is "Disk_Array_Controller", the attribute is "Predictive_Failure_Alert", and the value is "True".

[0023] The Redfish resource aggregation submodule acts as a Redfish client, establishing connections with Redfish-compliant sub-devices within the server via HyperText Transfer Protocol Secure (HTTPS). It periodically sends Redfish query requests, such as every 5 minutes, to collect in-depth data that IPMI cannot obtain. This includes data such as wear leveling counts, spare block counts, and high-temperature history for Non-Volatile Memory Express (NVMe) Solid State Drives (SSDs); input voltage, output voltage, output current, efficiency, and cumulative runtime for Power Supply Units (PSUs); and port packet transmission / reception error rates, packet loss rates, and link jitter counts for Network Interface Cards (NICs).

[0024] The in-band host status bridge communicates with a lightweight agent installed on the host via a dedicated communication channel between the BMC and the host, such as a Keyboard Controller Style (KCS) interface, a virtual serial port, or a vendor-defined message (VDM) based on Peripheral Component Interconnect Express (PCIe), to obtain critical status information of the host operating system, such as the operating system kernel log (dmesg), the status of critical system services, CPU utilization, and memory usage.

[0025] The built-in security probe set may include a firmware integrity measurement and vulnerability scanning engine, an out-of-band network traffic deep inspection engine, and a remote control behavior auditing and privileged access monitoring module. The firmware integrity measurement and vulnerability scanning engine may include a static measurement submodule, a runtime integrity monitoring submodule, and a proactive vulnerability scanning submodule. The out-of-band network traffic deep inspection engine collects and analyzes full network metadata and in-depth protocol parsing. The remote control behavior auditing and privileged access monitoring module may include a session recording and analysis submodule and a privileged command interception submodule.

[0026] The static measurement submodule utilizes the BMC's root of trust (Boot ROM) to perform a hash measurement on the main firmware partition at each power-on boot, comparing it with the golden hash value stored in the One-Time Programmable (OTP) or Physically Unclonable Function (PUF) derived key encrypted storage area. If the measurement fails, it forces booting from the read-only recovery partition and generates an unremovable hardware security alarm. Measurement failure itself should not cause the device to crash; instead, it should allow the device to come online with a trusted identity and issue an alarm, with the read-only recovery partition assuming the role of trusted identity. Booting from the read-only recovery partition prevents persistent firmware-level implantation and ensures the manageability and recoverability of the BMC.

[0027] The runtime integrity monitoring submodule, based on the Linux kernel's Integrity Measurement Architecture (IMA), performs real-time monitoring of critical executable files, dynamic link libraries, and configuration files in the BMC file system. Any unauthorized file modification operations will be immediately captured and logged.

[0028] The proactive vulnerability scanning submodule periodically retrieves the latest Common Vulnerabilities and Exposures (CVE) fingerprint databases from encrypted local storage or via a secure out-of-band channel from vendor vulnerability databases. It scans the version numbers and configuration parameters of various services running within the BMC and matches them against the CVE fingerprint database to identify components with known vulnerabilities. These services include the web server, Secure Shell (SSH) service, and IPMI service.

[0029] The out-of-band network traffic deep inspection engine, embedded in the BMC's physical network card driver layer or virtual bridge layer, employs a zero-copy packet capture module. It utilizes extended Berkeley PacketFilter (eBPF) technology for efficient packet filtering and preprocessing, collecting full network metadata, including traditional five-tuple information, Transmission Control Protocol (TCP) flags, window size, session start and end times, packet intervals, and payload length distribution. Deep protocol parsing is performed to extract command codes, completion codes, and sensitive fields from command parameters. For SSH protocols, it analyzes key exchange algorithms, authentication attempts, and session channel opening requests. For HTTPS protocols, it parses certificate information and Server Name Indication (SNI) during the Transport Layer Security (TLS) handshake process and compares them with malicious domains in the threat intelligence database.

[0030] The session recording and analysis submodule records the entire lifecycle of all remote control sessions initiated through the BMC. It not only records metadata (operator, time, source IP), but also decodes the Virtual Network Computing (VNC) / Remote Framebuffer (RFB) protocol data streams of kernel-based Virtual Machines (KVMs). Using computer vision technology, it periodically captures screen images and uses Optical Character Recognition (OCR) to identify key characters such as login prompts, command inputs, and system error messages. For virtual media mounting operations, it records the mounted image file name and size, and calculates a hash value to compare with known legitimate operating system (OS) image libraries to determine if the image is malicious or unauthorized.

[0031] The privileged command interception submodule sets up hook functions in the BMC's IPMI driver layer and World Wide Web (Web) server layer to intercept all high-risk operations involving permission modification, account creation / deletion, firmware upgrades, and security configuration changes. These operations require secondary authorization before execution; for example, confirmation from another administrator through a separate approval channel, or real-time recording and reporting as high-risk events.

[0032] S102: Perform node identification and relationship extraction on multi-source heterogeneous data to construct a time-series knowledge graph.

[0033] A temporal knowledge graph consists of multiple nodes and edges connecting the nodes. Each edge has temporal attribute information used to represent the effective time interval of a relationship.

[0034] Node types include physical server nodes, BMC device nodes, hardware component nodes, Internet Protocol (IP) address nodes, user account nodes, and event nodes.

[0035] Physical server nodes are the most basic entity type in the graph, representing each specific physical machine in the data center. Each server node not only contains static asset information, but more importantly, it carries the dynamic operational status that changes over time.

[0036] The BMC node represents the baseboard management controller entity on each server. It is an important component for out-of-band management and a key object for security protection. The BMC node is connected to the physical server node through a management relationship edge, forming a one-to-one subordinate relationship.

[0037] Hardware component nodes are fine-grained models of the various replaceable units within a server, including the Central Processing Unit (CPU), memory modules, hard drives, power supply units, fan modules, Redundant Array of Inexpensive Disks (RAID) cards, network interface cards (NICs), etc. Each hardware component node is connected to its parent physical server node via containment edges.

[0038] IP address nodes represent all IP entities in the network related to BMC management, including the BMC's own management IP addresses, workstation IPs of operations and maintenance personnel, management IPs of automated operations and maintenance systems, and potential attack source IPs. IP address nodes focus on characterizing network behavior and correlating threat intelligence.

[0039] The User Accounts node represents all user entities that can access the BMC, including local BMC users, Lightweight Directory Access Protocol (LDAP) / Active Directory (AD) domain users, and automated accounts that log in via SSH keys. The User Accounts node is designed with access control and operations auditing in mind.

[0040] Event nodes are a special entity type in a temporal knowledge graph, representing discrete events that occur at a specific point in time, such as sensor alarms, log entries, security alerts, and operation records. Event nodes are connected to related entity nodes, such as servers, BMCs, IP addresses, and user account nodes, through participation relationship edges, forming a complete context for the event.

[0041] Edge types include management edges (manages), contain edges (contains), network connection edges (connects_to), command execution edges (executes_command), and trigger edges (triggers).

[0042] The management relationship edge indicates that the BMC has out-of-band management privileges over a physical server; the inclusion relationship edge indicates that the physical server contains a specific hardware component; the network connection edge indicates that a network connection has been established between an IP address and the BMC device; the command execution edge indicates that a user account has executed a management command on the BMC; and the triggering relationship edge indicates that a change in hardware state causes an event or that there is a causal triggering relationship between events. Each edge has a time attribute.

[0043] The direction of the management relationship edge is from the BMC node to the physical server node, indicating that the BMC has out-of-band management permissions for a certain physical server, and can monitor the server hardware status, perform power control operations, and access the serial port console, etc. For the time attribute, the time attributes of the management relationship edge include the relationship establishment time (since), the relationship termination time (until), and the last verification time (last_verified). If it is still valid, the relationship termination time is null. When the server replaces the BMC or the motherboard is replaced due to failure, resulting in a change of the BMC, the original management relationship edge is marked as terminated, and a new management relationship edge is established, completely recording the evolution history of the management relationship. For the weight attribute, the weight of the management relationship represents the control level of the BMC over the server, including full control (can perform all operations, weight 1.0), limited control (monitoring only, no control operations, weight 0.5), and failover mode (backup relationship in redundant BMC scenarios, weight 0.3), etc.

[0044] Both time and weight attributes are recorded in the attribute fields of each relation edge in the temporal knowledge graph, stored alongside edge type identifier, direction, and semantics. These time and weight attributes are persisted as edge attributes in the edge storage structure of the temporal knowledge graph, and their historical traceability is ensured by time sharding and snapshot mechanisms.

[0045] The direction of an containment edge indicates that the physical server node points to a hardware component node, such as the CPU, memory, hard drive, power supply, or fan. A containment edge signifies that the physical server contains a specific hardware component, reflecting the server's physical structure. For time attributes, containment edges include component installation time (installed_at), component removal time (removed_at), and last detection time (last_detected). If the component is still active, the removal time is null. When a hardware component fails and is replaced, or when it is upgraded, the graph updates the effective time of the containment edge to fully record the server's configuration change history. For location attributes, for pluggable components, containment edges also include location information, such as CPU socket number (CPU0 / CPU1), memory slot number (DIMM_A1), hard drive slot number (Bay1), and power supply slot number (PSU1). This location information is crucial for locating physical faults.

[0046] The direction of network connection edges represents a bidirectional relationship between IP address nodes and BMC nodes. A network connection edge signifies that a network connection has been established between a specific IP address and a BMC device, reflecting network layer reachability and access relationships. Regarding time attributes, network connection edges exhibit complex temporal characteristics. Each network connection session corresponds to a temporary edge, whose time attributes include connection establishment time (start_time), connection termination time (end_time), and session duration. The system aggregates multiple connections between the same IP address and BMC pair, generating relational edges with statistical characteristics, including the first connection time, the last connection time, the total number of connections, and the average connection interval. `duration = end_time - start_time`. The difference between these two timestamps, in seconds / milliseconds, is stored in the edge attribute information of the network connection edge. For session attributes, each network connection session contains rich attribute information, including transport layer protocol, source port, destination port, TCP flag sequence, total number of packets, total number of bytes, average packet length, maximum packet length, minimum packet length, and connection status (normal closure / reset / timeout). These attributes provide rich features for identifying abnormal network behavior.

[0047] The direction of the command execution edge is from the user account node to the BMC node. The command execution edge represents the user account executing a management command on the BMC, reflecting the user's operational behavior. For each command execution, there is a corresponding edge with a precise timestamp, including the command execution time (executed_at), command completion time (completed_at), and execution duration (duration). For a series of commands in a session, the system maintains the temporal order of the command sequence. The difference between duration = completed_at - executed_at is stored in the edge attribute information of the command execution edge. For continuous command sequences within a session, the system maintains the temporal order of the commands to facilitate subsequent command-level Markov sequence modeling and anomaly detection. Regarding command attributes, the command execution edge contains detailed attributes of the command, including command type (SSH command, IPMI command, Redfish API, or Web operation), command plaintext or Application Programming Interface (API) call, command parameters, execution result (success, failure, or partial success), return code, output digest, and risk level (low, medium, high, or severe). For high-risk commands such as user permission modification, firmware upgrade, or cold reboot, the edge will be marked with a status requiring secondary authorization.

[0048] The direction of triggering relationship edges is either from a hardware component node to an event node or vice versa. Triggering relationship edges indicate that a hardware state change causes an event, or that there is a causal triggering relationship between events, reflecting the fault propagation path. For time attributes, the time attributes of triggering relationship edges include trigger time (triggered_at), detection latency (the delay from state change to event recording), and event association window identifier (used to group related events within the same time window). For triggering relationships between events, the edges contain temporal logic information, such as the time difference between event A and event B. For causal relationship attributes, through causal inference by the intelligent analysis engine, triggering relationship edges can carry causal confidence (causal_confidence), representing the probability that the machine learning model believes event A causes event B. It also includes the reasoning basis, such as statistical significance, temporal constraint satisfaction, and domain rule matching degree.

[0049] In this application, the nodes corresponding to the multi-source heterogeneous data are determined by entity identification and parsing; the edges between nodes are established by relation identification; the multi-source heterogeneous data is associated with the corresponding nodes or edges as dynamic attributes, and the time series of the dynamic attributes is updated by appending, thereby maintaining the integrity of historical data.

[0050] Traditional monitoring systems store various types of data, such as server hardware data, log events, network traffic, and security alarms, in different databases, lacking organic connections between them. In contrast, the temporal knowledge graph constructed in this application transforms the fundamental information of the entire data center into a dynamically evolving knowledge network. In this network, each server, each BMC, and each IP address becomes a node in the graph. Their management relationships, network connections, and event triggering relationships become the edges connecting the nodes. All monitoring metrics, log content, and security events are dynamically updated over time as attributes of the nodes, fundamentally changing the technical predicament of isolated data and static relationships in traditional BMC monitoring systems.

[0051] S103: When an alarm event is detected, extract the temporal subgraph associated with the alarm event from the temporal knowledge graph, and perform feature encoding on the nodes and edges in the temporal subgraph.

[0052] The subgraph extraction strategy expands outward k hops from the alarm node, usually k=3, retaining only relationships that are valid or have changed within the time window. It includes all event nodes that may be related to the alarm and extracts the key temporal features of each node within the time window.

[0053] In the temporal subgraph, the node features of each node are encoded into a multidimensional feature vector, which can include static features, dynamic features, event features, and context features.

[0054] Static features are inherent attributes of nodes that do not change over time. They can include entity type encoding such as one-hot vectors; node importance weights such as the service level carried by the server; and historical failure statistics.

[0055] Dynamic features can include time-series statistics within a time window, trends, abrupt change detection results, and periodic characteristics. Time-series statistics can include mean, maximum, minimum, and variance. Trends can include upward, downward, or stable trends.

[0056] Event characteristics refer to the event information associated with a node, which may include event type code; event severity; and the distance between the event occurrence time and the alarm time.

[0057] Contextual features refer to the structural information of nodes in a graph, which may include node degree, betweenness centrality, clustering coefficient, etc.

[0058] Betweenness centrality and clustering coefficients are obtained by performing a graph traversal algorithm on the root cause analysis subgraph and are recalculated in each time window to reflect structural dynamics. For example, taking node v as an example, the proportion of times node v appears as a bridge on the shortest path between other node pairs is used as the betweenness centrality. The neighboring nodes of node v are traversed, and node v is paired with its neighbors to check if an edge is formed; the ratio of the actual number of edges to the maximum possible number of edges is used as the clustering coefficient.

[0059] Each relation edge in the temporal subgraph is also encoded as a multidimensional feature vector, which encodes the type, temporal effective features, relational strength features, and directional features of each edge in the temporal subgraph into an edge feature vector.

[0060] Edge type encoding uses one-hot encoding to represent the edge type.

[0061] Time validity characteristics can include information such as relationship duration, the distance between the relationship establishment time and the alarm time, and whether the relationship is active within the time window.

[0062] Different types of edges have different parameters included in their relationship strength features. For network connection edges, these parameters may include the number of data packets and bytes; for management relationship edges, they may include the permission level; and for trigger relationship edges, they may include the confidence level.

[0063] Directional characteristics can include whether the relationship is directional, and the relationship between the direction and the direction of fault propagation.

[0064] S104: Based on the graph neural network, message passing is performed on the encoded temporal subgraph to determine the attention weight between each node and its neighboring nodes; and based on the attention weight, the features of the neighboring nodes are aggregated to obtain the node update features containing context information.

[0065] To determine the attention weights, the node feature vectors of each node in the encoded temporal subgraph are first linearly transformed to obtain higher-order node feature vectors. Based on these higher-order node feature vectors, relation-aware attention coefficients are calculated to determine the attention coefficient for each edge. The attention coefficients of all neighboring nodes of each node are then normalized to obtain the attention weights between each node and its neighbors.

[0066] In each layer of the graph neural network, nodes update their own feature representations by aggregating information from their neighbors, resulting in node-updated features that include contextual information.

[0067] S105: Based on the attention weights, perform reverse tracing to determine multiple candidate root cause paths, and determine the comprehensive confidence of each candidate root cause path based on the node update characteristics. Output the root cause analysis results based on the comprehensive confidence.

[0068] The reverse path tracing starts from the alarm node. It identifies all incoming neighbor nodes from the temporal subgraph, sorts them according to attention weights, and selects several as candidate parent nodes. Time constraints are then applied to each candidate parent node, and those with timestamps earlier than the current node's timestamp are selected as the next-level starting point. This process is repeated until a termination condition is met, outputting multiple candidate root cause paths. Termination conditions may include reaching a node where backtracking is no longer possible (e.g., an external IP address or physical hardware), a cumulative attention score below a threshold, or reaching a preset maximum depth, typically not exceeding 5 hops.

[0069] The calculation of overall confidence can include four dimensions: path confidence, node anomaly, causal strength, and explanatory consistency. The overall confidence is obtained by weighted summation of the values ​​of these four dimensions. The top three candidate root cause paths with the highest overall confidence can be selected, with the root cause of the candidate root cause path with the highest overall confidence being output as the primary root cause, and the root causes of the two candidate root cause paths with the next highest overall confidence being output as secondary root causes.

[0070] As can be seen from the above technical solution, acquiring multi-source heterogeneous data from the devices under test unifies the previously scattered multi-source data, thereby breaking the problem of data silos in traditional device monitoring and achieving complete monitoring of various types of data. By identifying nodes and extracting relationships from multi-source heterogeneous data, a temporal knowledge graph is constructed, forming a dynamic, evolving, and historically traceable panoramic monitoring graph. When an alarm event is detected, a temporal subgraph associated with the alarm event is extracted from the temporal knowledge graph, and the nodes and edges in the temporal subgraph are feature-encoded, thus providing a unified input rich in spatiotemporal semantics for root cause analysis. Based on a graph neural network, message passing is performed on the encoded temporal subgraph to determine the attention weights between each node and its neighboring nodes. Based on the attention weights, the features of neighboring nodes are aggregated to obtain node update features containing contextual information, thereby automatically learning the propagation relationships of faults or attacks in complex topologies and highlighting critical paths. This approach utilizes path reversal tracing based on attention weights to identify multiple candidate root cause paths. It then calculates a comprehensive confidence score based on node update features and outputs the root cause analysis results according to the confidence score. This transforms traditional fault location, which relies on expert experience, into quantifiable intelligent root cause analysis. The technical solution leverages the message passing mechanism and attention weight learning of graph neural networks to automatically capture the topological relationships between nodes and fault propagation patterns. Root cause location can be achieved without manually writing complex rules, ensuring the accuracy of fault location. Through path reversal tracing and comprehensive confidence score calculation, it not only outputs the most likely root cause node but also provides a complete reasoning path and confidence scores for each dimension, facilitating understanding and verification by operations and maintenance personnel. Simultaneously, the dynamic evolution mechanism of the time-series knowledge graph preserves historical states, supporting data queries at any point in time, providing a data foundation for fault review and trend analysis.

[0071] Example 2

[0072] Figure 2 A flowchart for constructing a time-series knowledge graph is provided in this application embodiment. The method includes the following steps: S201: Construct nodes in the graph based on the node types contained in the multi-source heterogeneous data.

[0073] Based on the data sources and content characteristics of multi-source heterogeneous data, the types of nodes included in the multi-source heterogeneous data are determined.

[0074] For example, sensor data necessarily involves a hardware component entity and a server entity, network traffic necessarily involves source IP and destination IP entities as well as the destination BMC entity, and SEL logs necessarily involve the sensor entity that generated the event and the server entity to which it belongs.

[0075] Map the identifiers of each node in multi-source heterogeneous data to standardized node identifiers in the graph.

[0076] In practical applications, the system can pre-configure and dynamically maintain a mapping table of identifiers to standardized node identifiers. The sources of identifiers can include sensor names, IP addresses, hostnames, serial numbers, etc.

[0077] The mapping relationship can be established by recording server serial numbers, BMA addresses and management IPs, CPU memory hard disk slots, sensor naming conventions, etc. in the asset ledger during the factory or network access phase to establish an initial mapping from identifiers to standardized node identifiers; during the operation phase, when new identifiers such as new IPs or new hardware components enter the system for the first time, the new entity creation process generates new standardized node identifiers and writes them into the mapping table; during the maintenance phase, as BMCs are replaced, IPs are reassigned, components are replaced, etc., the mapping table is updated synchronously by lifecycle management.

[0078] When multiple nodes correspond to the same standardized node identifier, the standardized node identifiers of each node are adjusted using context information to achieve entity disambiguation and ensure that the correct node can be associated with the standardized node identifier.

[0079] For example, consider two different physical servers, Server A and Server B, with BMCs BMC A and BMC B respectively. Both have an IPMI sensor named CPU0 Temp. However, the CPU0 temperature (Temp) alone cannot uniquely identify the node. In this case, we can use the source BMC identifier (source_bmc_id) = BMC A to query the management relationship edge between BMC A and Server A, confirming that BMC A belongs to Server A. Then, we can query the inclusion relationship edge of Server A to locate the CPU0 hardware component node under Server A, and map CPU0 Temp to a standardized node identifier {type: hardware_component, server: Server A, slot: CPU0, sensor: CPU0 Temp}.

[0080] For each standardized node identifier that appears for the first time, a corresponding node is created and its attribute information storage structure is initialized. Attribute information can include static attribute information and dynamic attribute information.

[0081] Static attributes may include entity type, entity number, asset information, BMC firmware version, stock keeping unit (SKU), baseboard model, hardware component specifications, network information, user account, physical location, etc. Among them, the entity number can use a standardized node identifier.

[0082] Dynamic attribute information can include sensor data, host-side status, Redfish depth metrics, security counts, anomaly markers, and event trigger flags. Sensor data can include temperature, voltage, current, fan speed, power consumption, humidity, and vibration. Host-side status can include CPU utilization, memory usage, disk I / O, and network throughput. Redfish depth metrics can include historical NVMe wear leveling spare block temperature, PSU efficiency cumulative runtime, NIC port error rate, packet loss rate, and link jitter. Security counts can include login failures, brute-force attacks, IPMI command frequency, and firmware integrity metric status. Anomaly markers can include mutation points, trend deviations, and cluster anomalies. Event trigger flags can include current alarm status, last configuration change time, and last firmware upgrade time.

[0083] S202: Identify the relationships between nodes and establish edges between nodes in the graph.

[0084] Extract explicit relationships between nodes from multi-source heterogeneous data.

[0085] Explicit relationships refer to explicit relationships that are directly extracted from data. For example, network traffic data inherently implies the connection between the source IP and the target BMC, sensor data implies the inclusion relationship between hardware components and servers, and sensor-generated data in SEL logs implies the triggering relationship between events and sensors.

[0086] Perform correlation analysis on multi-source heterogeneous data to extract implicit relationships between nodes.

[0087] Implicit relationships refer to relationships discovered through association analysis. For example, by analyzing the event sequence within a time window, if multiple failed login attempts by IP address A are followed by a successful login to BMC, it can be inferred that there may be an attacker relationship between IP address A and the successful login event; if multiple servers simultaneously exhibit elevated temperatures, it can be inferred that they share the same physical proximity within the same server rack.

[0088] Based on the geographical location and time synchronization of each node, the spatiotemporal relationship between each node is determined.

[0089] Spatiotemporal relationships refer to the locational and temporal synchronization relationships between nodes. For example, servers located in the same rack have physical proximity relationships, events occurring within the same time window have temporal co-occurrence relationships, and nodes with low network latency have network proximity relationships.

[0090] Explicit relations, implicit relations, and spatiotemporal relations are selected as candidate relation sets. The candidate relation set is traversed to establish edges between nodes in the graph.

[0091] In the specific implementation, if no target candidate relation exists in the graph, edges are created between nodes corresponding to the target candidate relation. The target candidate relation is any one of the candidate relations in the candidate relation set. Creating edges between nodes corresponding to the target candidate relation includes setting the start time, setting the relation type, and initializing edge attribute information.

[0092] If a target candidate relation exists in the graph and the target candidate relation has terminated, activate the target candidate relation. Activation operations may include setting a new start time, updating edge attribute information, and reactivating records.

[0093] If a target candidate relation exists in the graph and the target candidate relation has not terminated, update the edge attribute information corresponding to the target candidate relation. The update operation can include extending the termination time, adding edge attribute information, updating statistical information, etc.

[0094] S203: Multi-source heterogeneous data is dynamically associated with corresponding nodes or edges in the graph, and time series data is added using an incremental update method to obtain a time-series knowledge graph.

[0095] The entity attribute information in multi-source heterogeneous data is used as the node attribute information of the corresponding node. The entity attribute information can include static attribute information and dynamic attribute information.

[0096] The relational attribute information in multi-source heterogeneous data is used as the edge attribute information of the corresponding edge. The relational attribute information may include edge type identifier, time attribute information, confidence attribute information and context attribute information.

[0097] The attribute association process can include time alignment and attribute mapping.

[0098] Time alignment aligns the timestamps of data points with the timelines of entity attributes, ensuring that data is stored in the correct chronological order. For data points from different data sources but close in time, the system may perform aggregation or interpolation within a time window.

[0099] Attribute mapping maps data values ​​to specific attribute fields of an entity. For example, a sensor reading of 85.3 is mapped to the temperature attribute of a CPU node and appended with the current timestamp. The number of failed logins in a network stream record is mapped to the number of failed logins (failed_logins) attribute of an IP address node.

[0100] Considering that attribute information is dynamically changing, in order to maintain the integrity of historical data, incremental updates can be used to update the time series of dynamic attributes in an append-only manner, rather than overwriting historical data. Each attribute value update adds a new data point to the end of the time series.

[0101] Employing an incremental update mechanism, when a new data point arrives, the system first locates the relevant entity node and then appends the data point to the corresponding attribute's time series. This process ensures data consistency and integrity. For high-frequency data, such as sensor readings per second, the system can use batch write optimization, aggregating data points over a period of time and writing them to storage all at once, reducing I / O overhead. For changes in relationships, such as the establishment of new network connections or the termination of old connections, the system creates new relationship edges or updates the termination time of existing edges. This design allows the graph to accurately reflect the dynamic lifecycle of relationships.

[0102] To create a complete configuration change audit trail, a version management mechanism can be set up. For changes to static attributes such as configuration information, the system uses versioned storage to record the value before and after each change, as well as information such as the change time, reason for change, and operator of change, thereby forming a complete configuration change audit trail.

[0103] In this application, a temporal knowledge graph is constructed to unify previously isolated multi-source data into nodes and edges, achieving the fusion of multi-source data. Each edge has a clear temporal attribute, enabling the graph to accurately reflect the dynamic lifecycle of relationships and supporting data querying and historical backtracking at any time. By combining explicit relationship extraction, implicit relationship mining, and spatiotemporal relationship calculation, not only are the directly expressed relationships in the data captured, but potential association patterns are also discovered, providing rich contextual information for subsequent root cause analysis and ensuring the accuracy of root cause determination. Incremental update and version management mechanisms ensure data integrity and traceability, meeting the needs of compliance auditing and historical tracing.

[0104] Example 3

[0105] After identifying nodes and extracting relationships from multi-source heterogeneous data to construct a time-series knowledge graph, time sharding and snapshot mechanisms can be used to store the time-series knowledge graph.

[0106] The data in the time-series knowledge graph is horizontally partitioned according to the time dimension. Each time partition is used to store the valid node attribute information and valid relationships within its corresponding time period. For example, time partitioning is performed in 1-hour units, and each partition stores the valid entity attributes and relationships within that hour.

[0107] This time-sliced ​​storage method allows querying the map status at a specific time point to simply read the data from the relevant time slice, greatly improving query efficiency.

[0108] For high-frequency data such as sensor readings per second, the system adopts batch write optimization, which aggregates data points over a period of time and writes them to storage at once to reduce input and output overhead.

[0109] Periodically create snapshots of the time-series knowledge graph and store them in a designated storage area.

[0110] For example, a snapshot of the complete map is created every hour as a reference point for time backtracking.

[0111] A knowledge graph snapshot includes the current values ​​of static and dynamic attribute information for each node in the time-series knowledge graph, as well as the valid relationships between nodes. Valid relationships refer to edges that are still active within their designated time period and have not yet terminated at the specified time or the snapshot's time. Snapshots are stored in a separate storage area for rapid response to historical state queries.

[0112] Record incremental change logs between two graph snapshots. The incremental change logs include information on changes in node attributes, edge attributes, and the addition or deletion of relationships.

[0113] When it is necessary to reconstruct the state at a specific point in time between snapshots, the system can apply incremental logs based on the most recent snapshot to achieve precise time-point backtracking. For example, to query the graph state at 14:30, the system first locates the snapshot at 14:00, and then applies the incremental change logs between 14:00 and 14:30 to reconstruct the accurate historical state.

[0114] In the graph, each node corresponds to an entity, and the edges between nodes represent the relationships between them. Both nodes and edges in the graph have their own lifecycles, meaning that entities and relationships also have their own lifecycles. The system ensures the accuracy and maintainability of the graph through a lifecycle management mechanism.

[0115] Entity lifecycle: When a new hardware component is installed, a new IP address appears for the first time, or a new user is created, the corresponding entity node is created and marked as active. When a component is removed, an IP address remains inactive for an extended period (e.g., more than 30 days), or a user is deleted, the entity node is marked as obsolete, but its historical data is still retained; it is simply no longer used for real-time queries.

[0116] Relationship lifecycle: Each relationship edge has a defined start time and an optional end time. When a relationship is no longer valid, such as when a network connection is broken or user permissions are revoked, the edge's end time is set to the current time, and the relationship becomes historical. Historical relationship edges are no longer returned in normal queries, but they are still visible in data queries set for a specific time period.

[0117] This application enables evolutionary pattern mining of temporal knowledge graphs. By analyzing historical graphs, typical patterns of entity states and relationships changing over time can be discovered. These evolutionary patterns provide important prior knowledge for fault prediction and anomaly detection, and can be encoded into machine learning models or used as rules for expert systems.

[0118] The typical patterns identified by evolution pattern mining can include the following categories: (1) Fault propagation chain: For example, a fault propagation chain is formed by a decrease in fan speed, an increase in CPU temperature, a CPU thermal throttling, an increase in business processing latency, and a breach of service SLA. (2) Attack kill chain: For example, an attack kill chain is formed by an external IP performing TCP scanning on the BMC port, an attempt to use a weak SSH password, a successful login, an abnormal IPMI command sequence, and a firmware upgrade request. (3) Time-series periodic pattern: For example, a peak in batch SSH login failures from 02:00 to 04:00 every day, and a routine upgrade window for maintenance every Wednesday. (4) Resource exhaustion pattern: For example, a memory usage rate increases monotonically for N minutes, triggering an Out Of Memory (OOM) alarm, showing a typical linear growth curve followed by a sudden change. (5) Related propagation pattern: For example, after an IP is added to the blacklist, the access frequency of BMCs with network connections to it decreases in a short period of time, which can be used as an assessment of the impact range after a threat intelligence hit. (6) Anomaly Precursor Pattern: For example, if the same IP initiates a firmware read operation on the BMC within 48 hours after the CVE-2024-1234 scan occurs, it can be used as input for predictive alarms. (7) Maintenance Operation Pattern: For example, if the frequency of BMC restarts / configuration changes is significantly higher than the baseline within a 24-hour window before and after a firmware upgrade, it can be used to distinguish between human maintenance and abnormal events. Each pattern can be described by four types of information: triggering conditions, sequence constraints, time windows, and confidence levels. These can be encoded into the rule engine or injected into machine learning features.

[0119] A tiered data retention strategy can be adopted for data storage. Based on the data type and business needs, the system implements a tiered data retention strategy. Raw sensor data is retained for a short period, such as 7 days, for recent fault diagnosis; aggregated data is retained for a longer period, such as 1 year, for trend analysis and capacity planning; important events and audit data are permanently retained for compliance audits and historical traceability.

[0120] Through time sharding and snapshot mechanisms, the time-series knowledge graph not only records the current state but also preserves the historical state more completely, supporting data queries at any point in time. Each node's attributes are timestamped, forming a complete time series, and each relation edge has a clearly defined effective time interval. This allows the system to track changes in node states and relations over time, discovering evolutionary patterns in entity states and relationships. These evolutionary patterns provide crucial prior knowledge for fault prediction and anomaly detection. Simultaneously, the layered data retention strategy controls storage costs while ensuring data availability.

[0121] Example 4

[0122] The encoded temporal subgraph is processed by a graph neural network to determine the attention weights between each node and its neighboring nodes.

[0123] First, a linear transformation is performed on the node feature vectors of each node in the encoded temporal subgraph to obtain the transformed node feature vectors. For each node i, its original feature vector x... i The higher-order representation h is obtained by transforming the learnable weight matrix W. i =W×x i ; where h i This represents the transformed node feature vector. The transformed node feature vectors of each node are combined to form the transformed node feature matrix.

[0124] The weight matrix W maps all nodes to the same attention computation space, making the subsequent calculation of attention coefficients comparable.

[0125] For example, the node feature vector x1 may contain dimensions such as [0.85, 0.72, 0.45, 0.90, ...], which correspond to feature fields such as entity type, node importance weight, normalized value of historical failure count, normalized value of average temperature within the time window, and normalized value of CPU utilization, respectively. After linear transformation, we get h1=[0.23, 0.45, 0.67, 0.12, ...].

[0126] Secondly, based on the node feature matrix, the attention parameter vector, embedding vector, and time decay factor corresponding to each edge in the temporal subgraph, the attention coefficients of each edge in the temporal subgraph are determined. For each edge (i, j, r), where i is the source node, j is the target node, and r is the relation type, i.e., the edge type.

[0127] The formula for calculating the attention coefficient is: ; in, It is the attention parameter vector of edge type r. It is the embedding vector of edge type r, and || denotes vector concatenation. It is the attention coefficient between node i and node j with edge type r. It represents the node characteristics after the transformation of node i. It is the node feature after node j transformation. LeakyReLU is a variant of the modified linear unit that allows negative values ​​to pass but multiplies them by a small coefficient to avoid the neuron death problem.

[0128] and These are all learnable model parameters, obtained through the training process.

[0129] For edges related to event nodes, a time decay factor α_time is introduced, α_time=exp(-β·Δt), where Δt=|t_event-t_alert| represents the time difference between event time t_event and alarm time t_alert, and β is the decay coefficient that controls the decay rate.

[0130] For example, for event 1 (IPMI command event), the initial attention is e=0.85, Δt=10 seconds, and β=0.1. Then, α_time=exp(-0.1×10)=0.368, and the decayed attention is e', e'=e×α_time=0.85×0.368=0.313. The introduction of the time decay factor makes the impact of events further away from the alarm time smaller on the current alarm, which conforms to the temporal order principle of causality.

[0131] Then, based on the attention coefficients of each edge in the temporal subgraph, the edges between each node and its neighboring nodes in the temporal subgraph are normalized to determine the normalized attention weights between each node and its neighboring nodes.

[0132] The normalization formula is ; In the formula, the superscript 'r' of each symbol indicates the type of edge, and N i It is the set of all neighboring nodes of node i. This represents the normalized attention weights between nodes i and j with edge type r. Normalization ensures that the sum of the attention weights of all incoming edges for each node is 1, facilitating subsequent weighted aggregation operations. A multi-head attention mechanism is employed, consisting of multiple parallel attention heads, each learning a different attention distribution. Finally, the outputs of the multiple heads are concatenated or averaged to enhance the model's expressive power and stability.

[0133] The features of neighboring nodes are aggregated based on attention weights to obtain node update features that include contextual information. In each layer of the graph neural network, the node feature vectors of neighboring nodes are weighted and aggregated using the normalized attention weights corresponding to each attention head, resulting in the aggregated feature vector corresponding to each attention head. , W r It is a transformation matrix of relation type r, and σ is an activation function such as ReLU or Tanh.

[0134] The aggregated message is fused with the node's own features, and the fused result is used to update the node, thus obtaining the node update feature. , Where M represents M attention heads, This is the feature obtained by fusing the aggregated message with the node's own features at the k-th attention head. The final updated node feature. By stacking multiple layers of graph neural networks, information can propagate further across the graph. The first layer primarily aggregates information from one-hop neighbors, the second layer aggregates information from two-hop neighbors, and so on. After multiple layers of propagation, the representation of the alarm node contains information from all relevant nodes in the entire subgraph.

[0135] Through the aforementioned graph neural network message passing mechanism, the updated features of each node not only contain its own original information but also incorporate information from its neighboring nodes and even multi-hop neighbors, forming a node representation with rich context. The learning of attention weights enables the model to automatically identify which neighboring nodes and relationship types are more important to the current task, avoiding the limitation of treating all neighbors equally in traditional graph convolution. The introduction of the time decay factor allows the model to consider the temporal relationships of events, better aligning with the causal logic of actual fault propagation. The multi-head attention mechanism enhances the model's expressive power, enabling it to capture different types of association patterns.

[0136] Example 5

[0137] Multiple candidate root cause paths are determined by reverse tracing of paths based on each attention weight.

[0138] Starting with the alarm node, all incoming neighbor nodes are identified from the time-series subgraph. Incoming neighbor nodes are those that point to the current node via directed edges. In fault propagation scenarios, these nodes may be potential causes of the current node's anomaly. For example, for a service interruption alarm node, its incoming neighbors might include operating system unresponsive event nodes, BMC hard reset command event nodes, etc.

[0139] All incoming neighbor nodes are sorted according to attention weights, and multiple incoming neighbor nodes are selected as candidate parent nodes.

[0140] A higher attention weight indicates a stronger association between the neighboring node and the current node, making it more likely to be the previous hop on the fault propagation path. Typically, the top-k neighbors with the highest attention weights are selected as candidate parent nodes. The value of k can be adjusted based on the specific situation, generally ranging from 3 to 5.

[0141] Perform time constraint verification on each candidate parent node. Only candidate parent nodes with timestamps earlier than the current node's timestamp conform to causal logic, because the cause must occur before the effect. For example, if the current node's timestamp is 14:23:15, then only candidate parent nodes with timestamps earlier than 14:23:15 can serve as the starting point for the next layer.

[0142] The candidate parent node whose timestamp is earlier than the current node's timestamp is taken as the starting point of the next layer, and the operation steps of all incoming neighbor nodes that determine the starting point from the time sequence subgraph are returned until the termination condition is met, and then multiple candidate root cause paths are output.

[0143] Termination conditions may include: reaching a node where backtracking is no longer possible, such as an external IP address or physical hardware, which are usually the starting points of a fault chain; or the accumulated attention score being lower than a preset threshold, indicating that the importance of subsequent paths is already very low; or reaching a preset maximum depth, usually no more than 5 hops, to avoid excessively long paths that lead to interpretation difficulties and excessive computational overhead.

[0144] A beam search strategy is employed to retain the top-k candidate paths. Each path consists of a series of nodes and edges, along with a cumulative attention score. The cumulative attention score is equal to the product of the normalized attention coefficients along each edge of the root cause candidate path, including time decay.

[0145] For example, in the scenario of alarm service interruption, the candidate root cause path reverse tracing is IP_185.xxx, BMC-03, server A, event_downtime, and alarm service interruption. The normalized attention coefficients for each edge are α(alarm, event_downtime) = 0.95, α(event_downtime, server A) = 0.90, α(server A, BMC-03) = 0.85, and α(BMC-03, IP_185) = 0.80. For the event edge, the time decay Δt = 10s, β = 0.1, and the attention after decay... , The cumulative score multiplied together is score = 0.35 × 0.90 × 0.85 × 0.80 ≈ 0.214. In implementation, the cumulative score can also be taken as the log-sum of the attention of each side to avoid numerical underflow. The sorting result is equivalent to the multiplication.

[0146] By tracing back the path to the source, the model can start from the alarm node and trace backward along the path with high attention weights to find the root cause node or event that may have caused the alarm. This method does not require pre-defined fault propagation rules, but automatically discovers the most likely causal path through the learned attention weights. The bundle search strategy ensures that multiple candidate paths are retained for subsequent comprehensive evaluation while keeping the computational complexity under control, avoiding the risk of missing the true root cause due to too many or too few searches. Time constraint verification ensures that the causal path conforms to the chronological principle, improving the reliability of the results.

[0147] Example 6

[0148] Figure 3 A flowchart of a method for determining the comprehensive confidence of each candidate root cause path provided in this application embodiment is included, the method comprising the following steps: S301: Based on the normalized attention weights of each edge in each candidate root cause path, determine the cumulative attention score of each candidate root cause path, and apply a penalty factor to the cumulative attention score based on the path length to obtain the path confidence of each candidate root cause path.

[0149] The formula for calculating path confidence is: Path Confidence = Cumulative Attention Score × γ (L-1) ; Here, the cumulative attention score is the product of the normalized attention coefficients along each edge of the path, γ is the length penalty coefficient, usually taken as 0.9~0.95, to suppress the influence of excessively long causal chains on the ranking, and L is the path length.

[0150] The path length specifically refers to the number of edges and hops contained in the candidate root cause path, and is often measured by the number of nodes minus 1.

[0151] For example, if the path length is 4 and γ = 0.9, then the penalty factor is 0.9. 4 If the cumulative score is 0.214, then the path confidence is 0.214 × 0.656 ≈ 0.140.

[0152] The introduction of the length penalty factor avoids the model's tendency to favor long paths, because while excessively long paths may contain more information, they also increase the possibility of misjudgment.

[0153] S302: Based on the degree of deviation between the node update characteristics of the root cause nodes in each candidate root cause path and their corresponding historical statistical values, determine the node anomaly degree of each candidate root cause path.

[0154] The formula for calculating node anomaly is anomaly = Σw k |(x k -μ k ) / σ k |; Where anomaly is the node anomaly degree, x k It is the current attribute value, μ k It is the historical mean, σ k It is the historical standard deviation, w k It is attribute weight.

[0155] w k Typically, each dimension corresponds one-to-one with a node's static features, dynamic features, event features, and contextual features, forming a configurable or learnable weight vector. For example, for a CPU node, if the current temperature is 95°C, the historical mean is 70°C, and the historical standard deviation is 5°C, then the standardized deviation for this dimension is |(95-70) / 5|=5. If the weight for this dimension is 0.3, then its contribution is 1.5. The node anomaly score is obtained by summing the contributions of all dimensions.

[0156] The anomaly degree of a node reflects the degree of deviation between the current state of the root cause node and its normal state. The greater the deviation, the more likely the node is to be the real source of the fault.

[0157] S303: Determine the causal strength of each candidate root cause path based on the temporal order of root cause events and alarm events in each candidate root cause path, as well as the frequency of root cause events as the root cause of alarm events in historical statistics.

[0158] The formula for calculating causal strength is: Causal Strength = P(Root Cause Type | Alarm Type) × Time Series Consistency Factor; Where P(root cause type|alarm type) is the conditional probability estimated from historical statistical data, representing the frequency of a certain root cause type occurring under a certain alarm type.

[0159] The timing consistency factor is used to check whether the timing sequence of the root cause event and the alarm conforms to causal logic. If the root cause event occurs before the alarm event, the value is 1.0; otherwise, it is 0.

[0160] For example, in path A, the attack events from 14:22 to 14:23 occur before the system crash at 14:23:15, and the timing consistency factor is 1.0; in path B, the fan failure at 14:10 occurs before the system crash, and the timing consistency factor is also 1.0. If historical statistics show that the frequency of security vulnerabilities as root causes in business interruption alarms is 0.35, then the causality strength of path A is 0.35 × 1.0 = 0.35.

[0161] Causal strength combines historical experience with current temporal constraints, making use of the statistical patterns of big data while ensuring the logical rationality of a single inference.

[0162] S304: Analyze the logical matching degree between the root cause event and the alarm event in each candidate root cause path to determine the consistency of the interpretation of each candidate root cause path.

[0163] Interpretive consistency is evaluated using a predefined interpretive consistency matrix, where rows represent root cause types, columns represent alarm types, and matrix elements represent logical match scores.

[0164] For example, the match rate between system crash alarms and security vulnerability root causes is 0.95, the match rate with fan failure root causes is 0.85, and the match rate with power supply problem root causes is 0.90. Interpretive consistency reflects the domain experts' prior knowledge of the logical relationships between different types of root causes and alarms, compensating for domain common sense that pure data-driven methods may overlook.

[0165] S305: The path confidence, node anomaly, causal strength, and explanatory consistency of each candidate root cause path are weighted and summed to obtain the comprehensive confidence of each candidate root cause path.

[0166] The formula for calculating the overall confidence level is as follows: ; Where k represents the dimension, corresponding to the four dimensions of path confidence, node anomaly, causal strength, and explanatory consistency. These are the weight values ​​for the corresponding dimensions. It is the value of the corresponding dimension. It is the overall confidence level.

[0167] The confidence level can be determined through expert experience or learned from historical data using machine learning methods. For example, if the weights of the four dimensions are 0.3, 0.25, 0.25, and 0.2, and the values ​​of the four dimensions of path A are 0.140, 0.8, 0.35, and 0.95, then the overall confidence level is 0.3×0.140+0.25×0.8+0.25×0.35+0.2×0.95=0.042+0.2+0.0875+0.19=0.5195.

[0168] Finally, the root cause analysis results are output in descending order of overall confidence level. If the top 1 confidence level is ≥0.6, it is output as the primary root cause; if the top 2 or top 3 confidence level is ≥0.4, it is output as the secondary possible root cause; if the confidence level is <0.4, the item is not output.

[0169] The reasoning path can be output visually. For example, using the ← symbol to represent the causal direction, following the path from result to cause, the output format is: Business interruption ← [Host] Operating system unresponsive (attention weight 0.98) ← [BMC] Issued a hard reset command (attention weight 0.95) ← [Management network] Illegal SSH session from IP 185.xxx.xxx.xxx (attention weight 0.92) ← [IP 185.xxx.xxx.xxx] Known vulnerability CVE-2024-1234 exists (root cause, confidence 0.89).

[0170] By comprehensively calculating confidence levels, the model not only considers the attention weights in the graph structure but also combines node anomaly, historical causal strength, and interpretability consistency, forming a multi-dimensional evaluation system. This multi-dimensional evaluation avoids the one-sidedness of a single indicator and improves the accuracy of root cause localization. The setting of confidence thresholds enables the system to distinguish between primary and secondary possible root causes, providing hierarchical decision support for operations personnel. The visualized output of the inference path facilitates operations personnel's understanding of the complete chain of fault propagation.

[0171] Example 7

[0172] Before performing node identification and relationship extraction on multi-source heterogeneous data and constructing a time-series knowledge graph, the multi-source heterogeneous data is preprocessed.

[0173] First, convert the various formats of multi-source heterogeneous data into standardized data with a unified format.

[0174] The system receives data in various formats from all BMC terminals and converts it into a unified columnar storage format (Apache Parquet), suitable for large-scale data analysis. During the conversion process, the system attaches a global data center tag to each data entry, such as server room, rack, cluster, and business line, to facilitate subsequent multi-dimensional queries and analysis.

[0175] The data can be in various formats, including structured time-series data such as sensor readings, semi-structured logs such as SEL entries, unstructured network flow metadata such as packet capture records, and security events such as audit logs.

[0176] Secondly, all standardized data are aligned along the timeline to generate time-series data with equal intervals.

[0177] Since different data sources have different sampling frequencies, such as temperature data at 1Hz, Redfish data every 5 minutes, and SEL events triggered irregularly, multiple interpolation or Kalman filtering techniques can be used to align all data onto a unified time axis.

[0178] Multiple imputation estimates missing values ​​more accurately than simple mean imputation by establishing a regression model between variables and using information from other variables. Kalman filtering is a recursive optimal estimation algorithm suitable for state estimation of dynamic systems, capable of handling noisy data and providing uncertainty quantification. Aligned data generates evenly spaced time series data, facilitating subsequent feature engineering and model training.

[0179] Then, derived features are generated based on the time-series data within the sliding window.

[0180] The size of the sliding window can be configured according to business needs, such as the past 1 hour, 24 hours, or 7 days. Derived features can include statistical features such as mean, variance, maximum value, minimum value, skewness, and kurtosis; frequency domain features such as Fourier transform coefficients and power spectral density; and time series features such as Markov transition probability matrix, periodicity index, and autocorrelation coefficient.

[0181] For example, the first-order difference of CPU temperature reflects the rate of temperature change, the Fourier transform coefficients of fan speed reveal the periodic pattern of fan speed, the 7-day periodicity index of SSH login failures identifies the differences between weekdays and weekends, and the Markov transition probability matrix of IPMI command sequences characterizes the sequence pattern of command execution. The derived features directly serve the specific downstream tasks of node edge feature encoding and graph neural network root cause analysis of temporal knowledge graphs. For instance, the Markov transition probability matrix of IPMI command sequences and the 7-day periodicity index of SSH login failures are both feature designs oriented towards security and fault semantics.

[0182] Finally, equally spaced time-series data and derived features are used as multi-source heterogeneous data for constructing a time-series knowledge graph.

[0183] The preprocessed data has a unified format, aligned timelines, and rich feature representations, laying a solid foundation for subsequent map construction and intelligent analysis.

[0184] The data preprocessing workflow described above solves the problems of inconsistent formats, inconsistent sampling frequencies, and insufficient information content in multi-source heterogeneous data. Unified formatting enables data from different sources to be processed and analyzed within the same framework. Time axis alignment eliminates time discrepancies between different data sources, making cross-data source correlation analysis possible. The generation of derived features extracts higher-order information from the raw data, such as trends, periodicity, and sequence patterns, providing data support for fault prediction and anomaly detection. The sliding window design allows the system to capture patterns at different time scales, from short-term abrupt changes to long-term trends.

[0185] Figure 4This application provides a framework diagram of a device monitoring system, which includes a terminal data acquisition and execution layer and a cloud-edge intelligent analysis engine layer. The terminal data acquisition and execution layer includes a multimodal hardware health collector and an intrinsic security probe set. The cloud-edge intelligent analysis engine layer includes a data cleaning and unified feature space builder and a multimodal correlation analysis and anomaly detection engine. The data cleaning and unified feature space builder includes a heterogeneous data normalization module, a time-series data alignment and interpolation module, and a feature engineering pipeline. The multimodal correlation analysis and anomaly detection engine includes a time-series knowledge graph builder and a root cause analysis model based on graph neural networks.

[0186] The multimodal hardware health collector is deployed in both the BMC's operating system kernel space and user space. As a software subsystem of the BMC, it includes kernel mechanisms such as drivers, user-mode daemons, eBPF, and IMA. Its operation relies on the BMC's system-on-chip (SoC) computing resources. The intrinsic security probe set is also deployed within the BMC, responsible for firmware integrity measurement, out-of-band network traffic detection, and remote control behavior auditing.

[0187] Heterogeneous data normalization, time series data alignment and interpolation, feature engineering pipeline, time series knowledge graph builder, and root cause analysis model based on graph neural network are deployed on a centralized management server or edge gateway and run in a containerized manner. They are pure software components belonging to the cloud-edge analysis engine layer and rely on the computing and storage resources of general-purpose x86 or ARM servers.

[0188] In this application, the temporal knowledge graph builder abstracts heterogeneous, isolated, and time-series BMC monitoring data into a unified knowledge network with a time dimension, which is the foundation for breaking down data silos. The root cause analysis model based on graph neural networks uses a graph attention network (GAT) on the temporal graph to achieve reverse tracing of fault propagation paths and confidence ranking, which is crucial for upper-level intelligent decision-making. Terminal-side data is collected through a multimodal hardware health collector and an intrinsic safety probe set. The feature engineering pipeline is a key intermediate step determining the usability of downstream models, responsible for the derivation of statistical features, frequency domain features, and temporal features. Heterogeneous data normalization, temporal data alignment, and interpolation together constitute a unified feature space, representing the standardization and time alignment steps that data must undergo before entering the graph.

[0189] Example 8

[0190] Figure 5This is a schematic diagram of the structure of a device monitoring device according to an embodiment of this application. It is applicable to cloud or edge gateways. The device includes an acquisition unit 51, a construction unit 52, an extraction unit 53, an encoding unit 54, a first determination unit 55, a first update unit 56, a second determination unit 57, a third determination unit 58, and an output unit 59. The acquisition unit 51 is used to acquire multi-source heterogeneous data of the device under test; wherein, the multi-source heterogeneous data includes multimodal health data and safety probe data; Construction unit 52 is used to identify nodes and extract relationships from multi-source heterogeneous data to construct a time-series knowledge graph; wherein, the time-series knowledge graph includes multiple nodes and edges connecting multiple nodes, and each edge has time attribute information for representing the effective time interval of the relationship; Extraction unit 53 is used to extract a time series subgraph associated with the alarm event from the time series knowledge graph when an alarm event is detected. Encoding unit 54 is used to encode the features of nodes and edges in the temporal subgraph; The first determining unit 55 is used to perform message passing on the encoded temporal subgraph based on the graph neural network and determine the attention weight between each node and its neighboring nodes. The first update unit 56 is used to aggregate the features of neighboring nodes based on attention weights to obtain node update features containing context information. The second determining unit 57 is used to determine multiple candidate root cause paths by performing path reverse tracing based on each attention weight. The third determining unit 58 is used to determine the comprehensive confidence level of each candidate root cause path based on the node update characteristics; Output unit 59 is used to output the root cause analysis results based on the overall confidence level.

[0191] In some embodiments, the building unit includes a node building subunit, an edge building subunit, an association subunit, and an appending subunit; The node building subunit is used to build nodes in the graph based on the node types contained in the multi-source heterogeneous data; Edge construction sub-units are used to identify the relationships between nodes and establish edges between nodes in the graph; The association subunit is used to associate multi-source heterogeneous data as dynamic attributes with corresponding nodes or edges in the graph; Adding sub-units is used to add time series data using an incremental update method to obtain a time series knowledge graph.

[0192] In some embodiments, the node construction subunit is used to determine the node types contained in the multi-source heterogeneous data based on the data source and content characteristics of the multi-source heterogeneous data; Map the identifiers of each node in multi-source heterogeneous data to standardized node identifiers in the graph; When multiple nodes correspond to the same standardized node identifier, the standardized node identifier of each node is adjusted using context information. For the first appearance of a standardized node identifier, create the corresponding node and initialize its attribute information storage structure.

[0193] In some embodiments, edge construction subunits are used to extract explicit relationships between nodes from multi-source heterogeneous data; Perform correlation analysis on multi-source heterogeneous data to extract implicit relationships between nodes; Based on the geographical location and time synchronization of each node, the spatiotemporal relationship between each node is determined; Explicit relations, implicit relations, and spatiotemporal relations are used as candidate relation sets; Traverse the candidate relation set to establish edges between nodes in the graph.

[0194] In some embodiments, the edge construction subunit is used to create edges between nodes corresponding to a target candidate relation when no target candidate relation exists in the graph; wherein, the target candidate relation is any one of the candidate relations in the candidate relation set; If a target candidate relation exists in the graph and the target candidate relation has been terminated, activate the target candidate relation. If a target candidate relation exists in the graph and the target candidate relation has not terminated, update the edge attribute information corresponding to the target candidate relation.

[0195] In some embodiments, the association subunit is used to use entity attribute information in multi-source heterogeneous data as node attribute information of the corresponding node; wherein, entity attribute information includes static attribute information and dynamic attribute information; The relational attribute information in multi-source heterogeneous data is used as the edge attribute information of the corresponding edge; wherein, the relational attribute information includes edge type identifier, time attribute information, confidence attribute information and / or context attribute information.

[0196] In some embodiments, a storage unit is also included; Storage units are used to store time-series knowledge graphs using time-sharding and snapshot mechanisms.

[0197] In some embodiments, the storage unit is used to horizontally divide the data of the time-series knowledge graph according to the time dimension, and each time slice is used to store the valid node attribute information and valid relationships within its corresponding time period; Periodically create snapshots of the time-series knowledge graph and store them in a designated storage area. The snapshots include the current values ​​of the static attribute information and dynamic attribute information of each node in the time-series knowledge graph, as well as the valid relationships between the nodes. Record incremental change logs between two graph snapshots; the incremental change logs include information on changes in node attributes, edge attributes, and the addition or deletion of relationships.

[0198] In some embodiments, the encoding unit is used to encode the static features, dynamic features, event features, and context features of each node in the temporal subgraph into a node feature vector; wherein, the context features include node degree, betweenness centrality used to characterize the node's connectivity role in the network, and clustering coefficients used to characterize the tightness of the connection between the node and its neighboring nodes. The type, time validity features, relation strength features, and directional features of each edge in the time series subgraph are encoded into edge feature vectors.

[0199] In some embodiments, the first determining unit includes a transformation subunit, a coefficient determining subunit, and a normalization subunit; The transformation subunit is used to perform a linear transformation on the node feature vectors of each node in the encoded temporal subgraph to obtain the transformed node feature matrix. The coefficient determination subunit is used to determine the attention coefficients of each edge in the temporal subgraph based on the node feature matrix, the attention parameter vector, the embedding vector, and the time decay factor corresponding to each edge in the temporal subgraph. The normalization subunit is used to normalize the edges between each node and its neighboring nodes in the time series subgraph based on the attention coefficients of each edge in the time series subgraph, and to determine the normalized attention weight between each node and its neighboring nodes.

[0200] In some embodiments, the first updating unit is configured to perform weighted aggregation of the node feature vectors of neighboring nodes in each layer of the graph neural network using the normalized attention weights corresponding to each attention head, so as to obtain the aggregated feature vectors corresponding to each attention head; wherein, the target node is any node among all nodes in the temporal subgraph. The aggregated feature vectors corresponding to each attention point are concatenated or averaged to obtain the node update features of the target node.

[0201] In some embodiments, the second determining unit is configured to determine all incoming neighbor nodes of the starting point from the time sequence subgraph, using the alarm node as the starting point. Sort all incoming neighbor nodes according to attention weights and select multiple incoming neighbor nodes as candidate parent nodes. Perform time constraint verification on each candidate parent node; The candidate parent node whose timestamp is earlier than the current node is taken as the starting point of the next layer, and the operation steps of all incoming neighbor nodes that determine the starting point from the time sequence subgraph are returned until the termination condition is met, and then multiple candidate root cause paths are output.

[0202] In some embodiments, the third determining unit is configured to determine the cumulative attention score of each candidate root cause path based on the normalized attention weight of each edge in each candidate root cause path, and apply a penalty factor to the cumulative attention score based on the path length to obtain the path confidence of each candidate root cause path. Based on the degree of deviation between the node update characteristics of the root cause nodes in each candidate root cause path and their corresponding historical statistical values, the node anomaly degree of each candidate root cause path is determined. The causal strength of each candidate root cause path is determined based on the temporal order of the root cause event and the alarm event in each candidate root cause path, as well as the frequency of the root cause event as the root cause of the alarm event in historical statistics. Analyze the logical matching degree between the root cause event and the alarm event in each candidate root cause path to determine the consistency of the explanation of each candidate root cause path; The path confidence, node anomaly, causal strength, and explanatory consistency of each candidate root cause path are weighted and summed to obtain the comprehensive confidence of each candidate root cause path.

[0203] In some embodiments, before performing node identification and relationship extraction on multi-source heterogeneous data and constructing a time-series knowledge graph, the system further includes a transformation unit, an alignment unit, a generation unit, and an as-a unit; The conversion unit is used to convert multi-source heterogeneous data in various formats into standardized data with a unified format; Alignment units are used to align all standardized data along the time axis to generate time-series data with equal intervals. The generation unit is used to generate derived features based on time-series data within a sliding window; wherein, the derived features include statistical features, frequency domain features, and time-series features; As a unit, it is used to combine equally spaced time-series data and derived features as multi-source heterogeneous data for constructing time-series knowledge graphs.

[0204] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0205] For a description of the features in the embodiment corresponding to the equipment monitoring device, please refer to the relevant description in the embodiment corresponding to the equipment monitoring method, which will not be repeated here.

[0206] As can be seen from the above technical solution, acquiring multi-source heterogeneous data from the devices under test unifies the previously scattered multi-source data, thereby breaking the problem of data silos in traditional device monitoring and achieving complete monitoring of various types of data. By identifying nodes and extracting relationships from multi-source heterogeneous data, a temporal knowledge graph is constructed, forming a dynamic, evolving, and historically traceable panoramic monitoring graph. When an alarm event is detected, a temporal subgraph associated with the alarm event is extracted from the temporal knowledge graph, and the nodes and edges in the temporal subgraph are feature-encoded, thus providing a unified input rich in spatiotemporal semantics for root cause analysis. Based on a graph neural network, message passing is performed on the encoded temporal subgraph to determine the attention weights between each node and its neighboring nodes. Based on the attention weights, the features of neighboring nodes are aggregated to obtain node update features containing contextual information, thereby automatically learning the propagation relationships of faults or attacks in complex topologies and highlighting critical paths. This approach utilizes path reversal tracing based on attention weights to identify multiple candidate root cause paths. It then calculates a comprehensive confidence score based on node update features and outputs the root cause analysis results according to the confidence score. This transforms traditional fault location, which relies on expert experience, into quantifiable intelligent root cause analysis. The technical solution leverages the message passing mechanism and attention weight learning of graph neural networks to automatically capture the topological relationships between nodes and fault propagation patterns. Root cause location can be achieved without manually writing complex rules, ensuring the accuracy of fault location. Through path reversal tracing and comprehensive confidence score calculation, it not only outputs the most likely root cause node but also provides a complete reasoning path and confidence scores for each dimension, facilitating understanding and verification by operations and maintenance personnel. Simultaneously, the dynamic evolution mechanism of the time-series knowledge graph preserves historical states, supporting data queries at any point in time, providing a data foundation for fault review and trend analysis.

[0207] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described device monitoring method embodiments.

[0208] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described device monitoring method embodiments when it is run.

[0209] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0210] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described device monitoring method embodiments.

[0211] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described device monitoring method embodiments.

[0212] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be performed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip (SoC), a complex programmable logic device (CPLD), a microprocessor (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination thereof. The aforementioned computer program (also known as a program, software, software application, app, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0213] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0214] The foregoing has provided a detailed description of a device monitoring method, apparatus, electronic device, computer-readable storage medium, and computer program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for monitoring equipment, characterized in that, Applicable to cloud or edge gateways, the method includes: Acquire multi-source heterogeneous data of the device under test; wherein, the multi-source heterogeneous data includes multimodal health data and safety probe data; Node identification and relationship extraction are performed on the multi-source heterogeneous data to construct a temporal knowledge graph; wherein, the temporal knowledge graph includes multiple nodes and edges connecting multiple nodes, and each edge has time attribute information for representing the effective time interval of the relationship; Upon detecting an alarm event, a temporal subgraph associated with the alarm event is extracted from the temporal knowledge graph, and the nodes and edges in the temporal subgraph are feature-encoded. The encoded temporal subgraph is message-passed based on a graph neural network to determine the attention weight between each node and its neighboring nodes; and the features of the neighboring nodes are aggregated based on the attention weight to obtain node update features containing context information. Multiple candidate root cause paths are determined by reverse tracing of the paths based on the attention weights, and the comprehensive confidence of each candidate root cause path is determined based on the node update features. The root cause analysis results are then output based on the comprehensive confidence.

2. The equipment monitoring method according to claim 1, characterized in that, Node identification and relationship extraction are performed on the multi-source heterogeneous data to construct a time-series knowledge graph, including: Based on the node types contained in the multi-source heterogeneous data, construct the nodes in the graph; Identify the relationships between nodes and establish edges between nodes in the graph; The multi-source heterogeneous data is dynamically associated with the corresponding nodes or edges in the graph, and time-series data is added using an incremental update method to obtain a time-series knowledge graph.

3. The equipment monitoring method according to claim 2, characterized in that, Based on the node types contained in the multi-source heterogeneous data, the nodes in the graph are constructed, including: Based on the data source and content characteristics of the multi-source heterogeneous data, determine the node types contained in the multi-source heterogeneous data; The identifiers of each node in the multi-source heterogeneous data are mapped to standardized node identifiers in the graph; When multiple nodes correspond to the same standardized node identifier, the standardized node identifier of each node is adjusted using context information. For the first appearance of a standardized node identifier, create the corresponding node and initialize its attribute information storage structure.

4. The equipment monitoring method according to claim 2, characterized in that, Identify the relationships between nodes and establish edges between nodes in the graph, including: Extract explicit relationships between nodes from the multi-source heterogeneous data; The multi-source heterogeneous data is subjected to correlation analysis to extract the implicit relationships between nodes; Based on the geographical location and time synchronization of each node, the spatiotemporal relationship between each node is determined; The explicit relations, the implicit relations, and the spatiotemporal relations are used as a candidate relation set; Traverse the candidate relation set to establish edges between nodes in the graph.

5. The equipment monitoring method according to claim 4, characterized in that, Traversing the candidate relation set to establish edges between nodes in the graph includes: If no target candidate relation exists in the graph, an edge is created between the nodes corresponding to the target candidate relation; wherein, the target candidate relation is any one of the candidate relations in the set of candidate relations; If a target candidate relationship exists in the graph and the target candidate relationship has been terminated, the target candidate relationship is activated. If a target candidate relationship exists in the graph and the target candidate relationship has not terminated, update the edge attribute information corresponding to the target candidate relationship.

6. The equipment monitoring method according to claim 2, characterized in that, Associating the multi-source heterogeneous data as dynamic attributes to corresponding nodes or edges in the graph includes: The entity attribute information in the multi-source heterogeneous data is used as the node attribute information of the corresponding node; wherein, the entity attribute information includes static attribute information and dynamic attribute information; The relational attribute information in the multi-source heterogeneous data is used as the edge attribute information of the corresponding edge; wherein, the relational attribute information includes edge type identifier, time attribute information, confidence attribute information and / or context attribute information.

7. The equipment monitoring method according to claim 1, characterized in that, After performing node identification and relationship extraction on the multi-source heterogeneous data to construct a time-series knowledge graph, the method further includes: The time-series knowledge graph is stored using time sharding and snapshot mechanisms.

8. The equipment monitoring method according to claim 7, characterized in that, The time-series knowledge graph is stored using time sharding and snapshot mechanisms, including: The data of the time-series knowledge graph is horizontally segmented according to the time dimension, and each time segment is used to store the effective node attribute information and effective relationships within its corresponding time period. Periodically create graph snapshots of the time-series knowledge graph and store the graph snapshots in a designated storage area; wherein, the graph snapshot includes the current values ​​of the static attribute information, the current values ​​of the dynamic attribute information, and the effective relationships between the nodes in the time-series knowledge graph; Record incremental change logs between two graph snapshots; wherein, the incremental change logs include information on changes in node attributes, changes in edge attributes, and additions or deletions of relationships.

9. The equipment monitoring method according to claim 1, characterized in that, Feature encoding of nodes and edges in the temporal subgraph includes: The static features, dynamic features, event features, and context features of each node in the temporal subgraph are encoded into node feature vectors; wherein, the context features include node degree, betweenness centrality which characterizes the node’s connectivity role in the network, and clustering coefficient which characterizes the tightness of the connection between the node and its neighboring nodes. The type, time validity features, relationship strength features, and directional features of each edge in the temporal subgraph are encoded into edge feature vectors.

10. The equipment monitoring method according to claim 1, characterized in that, Based on graph neural networks, message passing is performed on the encoded temporal subgraph to determine the attention weights between each node and its neighboring nodes, including: A linear transformation is performed on the node feature vectors of each node in the encoded temporal subgraph to obtain the transformed node feature matrix; Based on the node feature matrix, the attention parameter vector, embedding vector, and time decay factor corresponding to each edge in the temporal subgraph, the attention coefficients of each edge in the temporal subgraph are determined. Based on the attention coefficients of each edge in the temporal subgraph, the edges between each node and its neighboring nodes in the temporal subgraph are normalized to determine the normalized attention weights between each node and its neighboring nodes.

11. The equipment monitoring method according to claim 10, characterized in that, Based on the attention weights, the features of neighboring nodes are aggregated to obtain node update features containing contextual information, including: In each layer of the graph neural network, the node feature vectors of neighboring nodes are weighted and aggregated using the normalized attention weights corresponding to each attention head to obtain the aggregated feature vectors corresponding to each attention head; wherein, the target node is any node among all nodes in the temporal subgraph. The aggregated feature vectors corresponding to each attention point are concatenated or averaged to obtain the node update features of the target node.

12. The equipment monitoring method according to claim 1, characterized in that, Based on the attention weights mentioned above, reverse path tracing is performed to determine multiple candidate root cause paths, including: Starting from the alarm node, all incoming neighbor nodes of the starting point are determined from the time sequence subgraph; Sort all incoming neighbor nodes according to attention weights and select multiple incoming neighbor nodes as candidate parent nodes. Perform time constraint verification on each of the candidate parent nodes; The candidate parent node whose timestamp is earlier than the current node is taken as the starting point of the next layer, and the operation steps of all incoming neighbor nodes of the starting point determined from the time sequence subgraph are returned until the termination condition is met, and then multiple candidate root cause paths are output.

13. The equipment monitoring method according to claim 1, characterized in that, The comprehensive confidence of each candidate root cause path is determined based on the node update features, including: Based on the normalized attention weights of each edge in each candidate root cause path, the cumulative attention score of each candidate root cause path is determined, and a penalty factor is applied to the cumulative attention score based on the path length to obtain the path confidence of each candidate root cause path. Based on the degree of deviation between the node update characteristics of the root cause nodes in each candidate root cause path and their corresponding historical statistical values, the node anomaly degree of each candidate root cause path is determined. The causal strength of each candidate root cause path is determined based on the temporal order of the root cause event and the alarm event in each candidate root cause path, as well as the frequency of the root cause event as the root cause of the alarm event in historical statistics. Analyze the logical matching degree between the root cause events and the alarm events in each candidate root cause path to determine the consistency of the interpretation of each candidate root cause path; The path confidence, node anomaly, causal strength, and explanatory consistency of each candidate root cause path are weighted and summed to obtain the comprehensive confidence of each candidate root cause path.

14. The equipment monitoring method according to claim 1, characterized in that, Before performing node identification and relationship extraction on the multi-source heterogeneous data to construct a time-series knowledge graph, the following steps are also included: The various formats of the multi-source heterogeneous data are converted into standardized data with a unified format; Align all standardized data with the timeline to generate time-series data at equal intervals; Derivative features are generated based on time-series data within a sliding window; wherein, the derived features include statistical features, frequency domain features, and time-series features; The equally spaced time-series data and the derived features are used as multi-source heterogeneous data for constructing a time-series knowledge graph.

15. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the device monitoring method as described in any one of claims 1 to 14.

Images