Device fault tracing analysis method and device based on dynamic graph attention network

Abstract

The application provides a device fault tracing analysis method and device based on a dynamic graph attention network, acquires alarm data, topology data and location data of multiple communication network elements, determines the fault propagation correlation degree between network elements based on alarm timing, location data and multi-specialty topology data and constructs a multi-topology fault propagation graph; performs attention calculation and feature aggregation on OTN, IPRAN and wireless access topology branches respectively through a dynamic graph attention network, and fuses to obtain network element fault representation; matches the fault representation with a preset fault diagnosis tree, filters a fault propagation path based on attention weight, determines a root cause score in combination with a diagnosis matching score and reverse attention of a downstream network element, so as to determine a fault root cause network element and a target fault propagation path. The application can improve the accuracy of fault root cause and propagation path identification in a multi-specialty communication network.

Description

Technical Field

[0001] This invention relates to the field of intelligent fault analysis technology for communication networks, and in particular to a method and apparatus for tracing and analyzing device faults based on dynamic graph attention networks. Background Technology

[0002] As communication networks continue to expand, complex networking relationships emerge between different specialized networks such as OTN transmission networks, IPRAN bearer networks, and wireless access networks. When a communication network element fails, the fault may propagate along network links to other network elements, causing multiple related network elements to generate alarms within a short period of time.

[0003] Existing fault analysis methods typically determine the fault correlation between different network elements based on alarm occurrence time or a single network topology relationship. However, in multi-disciplinary communication networks, different network elements may be simultaneously affected by multiple professional topology relationships, making it difficult to accurately characterize the fault propagation relationship between network elements based solely on alarm timing or a single topology relationship. When multiple upstream and downstream network elements generate alarms consecutively, it is also easy to misjudge downstream network elements affected by upstream faults as the source of the fault.

[0004] Therefore, how to accurately characterize the fault propagation relationship between network elements that generate alarms in multi-disciplinary communication networks, in order to distinguish the root cause network element from the downstream network elements affected by the fault propagation, and to determine the corresponding fault propagation path, has become an urgent technical problem to be solved. Summary of the Invention

[0005] The present invention aims to solve the problem in the prior art that when a cascading failure occurs in a multi-professional communication network, it is difficult to accurately characterize the fault propagation relationship between different network elements, and thus difficult to distinguish the root cause network element from the downstream network elements affected by the fault propagation, and to determine the fault propagation path.

[0006] To address the aforementioned technical problems, this invention provides a device fault tracing and analysis method based on dynamic graph attention networks, comprising:

[0007] Acquire alarm data, topology data, and location data of multiple communication network elements, wherein the topology data includes OTN link topology data, IPRAN bearer topology data, and radio access topology data; Using the network element as a graph node, the node features of the graph node are extracted from the alarm data, and the fault propagation correlation degree between the graph nodes is determined according to the alarm time sequence, the location data and the topology data. When the fault propagation correlation degree meets the preset correlation conditions, a fault propagation directed edge is established between the corresponding graph nodes according to the alarm time sequence to obtain a multi-topology fault propagation graph. The multi-topology fault propagation graph is input into a dynamic graph attention network, and corresponding topology branches are formed based on the OTN link topology data, the IPRAN bearer topology data, and the radio access topology data, respectively. In each topology branch, the attention weight of the directed edge of the fault propagation is determined according to the alarm timing, the topology connectivity represented by the topology data, and the fault propagation correlation, and the node features of the correlation graph nodes are aggregated based on the attention weight. The aggregation results of different topology branches are fused to obtain the fault representation of each network element. The fault representation is matched with the preset fault diagnosis tree corresponding to the network element to obtain a diagnosis matching score, and effective fault propagation directed edges are selected from the fault propagation directed edges based on the attention weight to form candidate fault propagation paths. The root cause score of the candidate root cause network element is determined based on the fault characterization, the diagnostic matching score, and the attention weight from the downstream network element to the candidate root cause network element. The root cause network element and the target fault propagation path are determined based on the root cause score and the attention weight of each fault propagation directed edge in the candidate fault propagation path.

[0008] Further, newly added alarm data is acquired, and the graph node to be updated corresponding to the newly added alarm data is determined; when the graph node to be updated corresponds to a newly added network element, the graph node to be updated is added to the multi-topology fault propagation graph and associated with the corresponding topology data; when the graph node to be updated corresponds to an existing network element, the fault propagation correlation degree between the graph node to be updated and the relevant graph nodes is re-determined, and the corresponding fault propagation directed edge is updated according to the re-determined fault propagation correlation degree to obtain a dynamic multi-topology fault propagation graph.

[0009] Furthermore, before extracting the node features of the graph nodes, a corresponding alarm time window is determined based on the initial fault level carried by the alarm data, and the alarm data, topology data, and location data within the alarm time window are spatiotemporally aligned; the topology-weighted spatiotemporal support of the alarm itemset is determined based on the alarm time of the alarm data, the location data, and the topology connectivity between network elements; the spatiotemporal topology entropy of the alarm itemset is determined based on the topology-weighted spatiotemporal support; and the alarm data is denoised based on the spatiotemporal topology entropy and the corresponding entropy threshold.

[0010] Furthermore, the spatiotemporal fusion similarity between the two graph nodes is determined based on the time interval between the alarms corresponding to the two graph nodes, the spatial distance between the corresponding network elements, and the topology connectivity identifier. The spatiotemporal fusion similarity is then corrected by entropy decay based on the spatiotemporal topology entropy of the corresponding alarm itemset to obtain the fault propagation correlation degree.

[0011] Furthermore, in each topology branch, the node features of the graph nodes are linearly mapped, and an attention score is determined based on the node features of the current graph node, the node features of adjacent graph nodes, the time interval between corresponding alarms, the topology connectivity, and the fault propagation correlation. The attention scores are normalized to obtain attention weights, and a multi-head attention mechanism is used to weight and aggregate the node features of adjacent graph nodes according to the attention weights.

[0012] Furthermore, a pre-set fault diagnosis tree is determined according to the specialty to which the network element belongs. The fault characterization and alarm type of the network element are matched with the fault diagnosis rules in the pre-set fault diagnosis tree to obtain the diagnosis matching score. The attention weights of two related graph nodes are compared in different propagation directions. The effective fault propagation direction is determined according to the comparison result. The directed edges of the fault propagation corresponding to the effective fault propagation direction are connected to form a candidate fault propagation path.

[0013] Furthermore, the degree of anomaly of the candidate root cause network element is determined based on its fault characterization; the degree of matching between the candidate root cause network element and the corresponding fault diagnosis rule is determined based on the diagnostic matching score; and the degree of downstream fault reverse interference is determined based on the attention weight from downstream network elements to the candidate root cause network element. A root cause score is determined based on the degree of anomaly, the diagnostic matching score, and the degree of downstream fault reverse interference, and a path evaluation value is determined by combining the attention weight of each directed edge in the candidate fault propagation path. Based on this, the fault root cause network element and the target fault propagation path are determined.

[0014] The present invention also provides a device for tracing and analyzing equipment faults based on dynamic graph attention networks, including a data acquisition module, a fault propagation graph construction module, a fault characterization determination module, a propagation path determination module, and a root cause determination module. Each module is configured to perform the corresponding steps in the above-described device fault tracing and analysis method.

[0015] Compared with the prior art, the present invention has at least the following beneficial effects: This invention comprehensively utilizes alarm timing, network element location, and multi-disciplinary topology relationships such as OTN, IPRAN, and wireless access to determine the fault propagation correlation between network elements, and constructs directed edges for fault propagation accordingly. This allows the constructed fault propagation graph to more accurately reflect the fault correlation relationships and potential propagation directions in multi-disciplinary communication networks. Furthermore, by establishing graph attention processing branches for different professional topologies and performing node feature aggregation and multi-topology fusion based on attention weights, the contribution of different associated network elements to the current network element fault state can be quantified, thereby obtaining a network element fault representation that reflects cross-disciplinary fault propagation relationships. Based on this, the invention combines the fault representation with the diagnostic results of a pre-set fault diagnosis tree, and further considers the reverse interference of downstream network elements on candidate root cause network elements and the attention weights of each directed edge for fault propagation in the candidate propagation path. This enables the differentiation between the root cause network element and downstream network elements affected by fault propagation among multiple consecutive alarming network elements, and determines the target fault propagation path corresponding to the root cause network element, improving the accuracy of fault tracing analysis in multi-disciplinary communication networks. Attached Figure Description

[0016] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0017] Figure 1 A schematic diagram of the overall process of the device fault tracing and analysis method based on dynamic graph attention network provided in an embodiment of the present invention; Figure 2 A flowchart illustrating the real-time fusion of multi-source alarms and adaptive spatiotemporal topology entropy noise reduction processing for integrated batch processing. Figure 3 A flowchart illustrating the incremental construction of a dynamic multi-topology fault propagation graph; Figure 4 A schematic diagram of the fault characterization determination process based on dynamic graph attention network; Figure 5 A schematic diagram illustrating the process of integrating fault diagnosis trees and fault characterization with root cause scoring and fault propagation path determination. Figure 6 This is a schematic diagram of the device fault tracing and analysis device based on dynamic graph attention network provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that, in this invention, "network element" refers to a communication device or logical network entity in a communication network that can generate alarms and participate in network topology connections, including but not limited to OTN transmission network elements, IPRAN bearer network elements, and radio access network elements. The "multi-topology fault propagation graph" refers to a fault propagation graph that shares a set of network element graph nodes and simultaneously associates OTN link topology relationships, IPRAN bearer topology relationships, and radio access topology relationships; it does not refer to multiple independent and unrelated fault propagation graphs. The Dynamic Graph Attention Network (DGAT), based on this shared graph node set, forms corresponding topology branches for different professional topology relationships, performing attention calculations and node feature aggregation respectively.

[0020] It should also be noted that the “attention weight” described in this invention is used to characterize the relative contribution of adjacent network elements to the current network element’s fault state; the “fault characterization” is a feature representation obtained by the dynamic graph attention network after fusing the current network element’s own node features, associated node features, alarm timing and topological relationships; the “root cause score” is a comprehensive score used to evaluate the likelihood of a candidate network element as the source of the original fault, and is not necessarily equivalent to a probability value.

[0021] like Figure 1 As shown, this embodiment provides a device fault tracing and analysis method based on dynamic graph attention networks. This method can be executed by a communication network operation and maintenance platform, a fault analysis server, a server cluster, or other electronic devices with data processing capabilities.

[0022] Step S101: Obtain alarm data, topology data, and location data of multiple communication network elements, wherein the topology data includes OTN link topology data, IPRAN bearer topology data, and wireless access topology data; The alarm data is used to characterize abnormal states detected during the operation of communication network elements, and may include one or more of the following: network element identifier, alarm time, alarm type, initial fault level, alarm status, and service impact information. Alarm data can be obtained in real time through a network management system, alarm platform, or streaming message interface.

[0023] The topology data is used to characterize the link connections between network elements, including OTN link topology data, IPRAN bearer topology data, and radio access topology data. This topology data can be obtained from resource management systems, configuration management databases (CMDBs), or other network resource data sources. OTN link topology data describes the network element connections in optical transmission links, IPRAN bearer topology data describes the network element connections in the bearer network, and radio access topology data describes the network element connections on the radio access side.

[0024] The location data is used to characterize the spatial location of network elements, and may include, for example, the latitude and longitude coordinates of the network element, site coordinates, or other location parameters that can reflect the spatial distance between different network elements. Location relationships and topological connection relationships belong to different dimensions of network element relationships: two network elements that are spatially close may not necessarily have an effective communication link, while two network elements that are spatially far apart may form a direct connection through a transmission link or bearer link.

[0025] Step S102: Using the network element as a graph node, extract the node features of the graph node from the alarm data, and determine the fault propagation correlation degree between graph nodes according to the alarm timing, the location data and the topology data. When the fault propagation correlation degree meets the preset correlation conditions, establish a fault propagation directed edge between the corresponding graph nodes according to the alarm timing to obtain a multi-topology fault propagation graph. For each network element, node features are extracted from the alarm data corresponding to that network element. Node features may include alarm type code, initial fault level, service impact features, alarm statistical features, and other fault-related features that can characterize the abnormal state of the current network element. When using the spatiotemporal topology entropy denoising implementation method described later, node features may also include the spatiotemporal topology entropy of the corresponding alarm itemset.

[0026] For any two graph nodes to be judged, the fault propagation correlation degree is determined based on the alarm timing of the alarms corresponding to the two graph nodes, the spatial relationship between the two network elements, and the topological connection relationship between the two network elements in the multi-disciplinary topology. The fault propagation correlation degree is used to characterize the strength of the fault propagation correlation between the two network elements in the current alarm scenario.

[0027] When the fault propagation correlation meets the preset correlation conditions, a directed edge for fault propagation is established between the two graph nodes according to the order of alarm occurrence time. For example, if the alarm time of the first network element is earlier than that of the second network element, and the fault propagation correlation between the two meets the preset correlation conditions, an initial directed edge for fault propagation can be established with the graph node corresponding to the first network element as the starting point and the graph node corresponding to the second network element as the ending point.

[0028] The resulting multi-topology fault propagation graph shares the same set of network element nodes and separately stores the professional topology relationships of OTN, IPRAN, and radio access. For example, the same network element A can be connected to network element B in the OTN topology and to network element C in the IPRAN topology. Subsequently, the dynamic graph attention network determines the neighbor set and propagation contribution in the corresponding topology branches.

[0029] Step S103: Input the multi-topology fault propagation graph into the dynamic graph attention network, and form corresponding topology branches based on the OTN link topology data, the IPRAN bearer topology data, and the radio access topology data, respectively. In each topology branch, determine the attention weight of the directed edge of the fault propagation according to the alarm timing, the topology connectivity represented by the topology data, and the fault propagation correlation. Aggregate the node features of the correlation graph nodes based on the attention weight, and fuse the aggregation results of different topology branches to obtain the fault representation of each network element. The dynamic graph attention network forms OTN topology branches, IPRAN topology branches, and radio access topology branches for OTN link topology data, IPRAN topology data, and radio access topology data, respectively. These three topology branches can share the basic node characteristics of the graph nodes, but each branch determines its adjacency constraints based on its respective professional topology relationships.

[0030] In each topology branch, for the current graph node and its associated graph nodes, attention weights are determined based on alarm timing, topology connectivity, and fault propagation correlation. The larger the attention weight, the higher the contribution of the corresponding associated graph node to the fault state of the current graph node. Subsequently, the node features of the associated graph nodes are weighted and aggregated according to the attention weights to obtain the updated features in the corresponding topology branch.

[0031] After the OTN, IPRAN, and radio access topology branches each complete node feature aggregation, the aggregation results from each topology branch are fused to obtain the fault characterization of each network element. This fault characterization includes both the current network element's own anomaly information and the propagation contribution information of related network elements in different professional topologies to the fault state of that network element.

[0032] Step S104: Match the fault representation with the preset fault diagnosis tree corresponding to the network element to obtain a diagnosis matching score, and filter effective fault propagation directed edges from the fault propagation directed edges based on the attention weight to form candidate fault propagation paths. The system pre-configures corresponding fault diagnosis trees for different specialties. For the current network element, a pre-configured fault diagnosis tree is selected based on the specialty to which the network element belongs. The fault characteristics and alarm types of the network element are then matched with the fault diagnosis rules in the diagnosis tree to obtain a diagnosis matching score. This diagnosis matching score is used to characterize the degree of matching between the current network element's abnormal state and the corresponding specialty's fault diagnosis rules.

[0033] Subsequently, the directed edges for fault propagation are filtered based on the attention weights output by the dynamic graph attention network. It should be noted that the initial directed edges for fault propagation can be established according to the alarm sequence; in the causal direction filtering stage, in order to evaluate the propagation direction of the same pair of related network elements, the attention weights of the first propagation direction and the second propagation direction can be calculated based on the bidirectional message passing in the underlying topology adjacency relationship of the node, respectively. The attention weight of the second propagation direction can be used only as a reverse causal discrimination quantifier, and does not indicate that a reverse fault propagation directed edge has been established in the initial multi-topology fault propagation graph.

[0034] The attention weights corresponding to the first and second propagation directions are compared, and the effective fault propagation direction is determined based on the comparison result. When the propagation direction corresponding to the initial fault propagation directed edge meets the preset direction determination condition, the fault propagation directed edge is retained; when it does not meet the preset direction determination condition, the fault propagation directed edge is pruned. The retained effective fault propagation directed edges are connected according to the propagation direction to form one or more candidate fault propagation paths.

[0035] Step S105: Determine the root cause score of the candidate root cause network element based on the fault characterization, the diagnostic matching score, and the attention weight from the downstream network element to the candidate root cause network element; and determine the fault root cause network element and the target fault propagation path based on the root cause score and the attention weight of each fault propagation directed edge in the candidate fault propagation path.

[0036] For candidate root cause network elements in the candidate fault propagation path, the degree of abnormality is determined based on the fault characterization of the candidate root cause network element, the degree of matching with the corresponding fault diagnosis rule is determined based on the diagnosis matching score, and the degree of downstream fault reverse interference is determined based on the attention weight from downstream network elements to candidate root cause network elements.

[0037] When a candidate network element has a high degree of its own anomaly and a high diagnostic matching score, and the overall attention from downstream network elements to this candidate network element is low, it indicates that the anomaly of this network element is more likely to be caused by its own fault, rather than by the reverse influence of the abnormal state of downstream network elements. Therefore, its root cause score can be improved accordingly.

[0038] The path evaluation value of each candidate fault propagation path is determined based on the root cause score and the attention weights of the directed edges in the fault propagation path. The path evaluation value comprehensively reflects the likelihood that the network element at the path's starting side is the source of the fault and the reliability of the fault propagation relationship between adjacent network elements within the path. The target fault propagation path is determined based on the path evaluation values ​​of each candidate fault propagation path, and the candidate root cause network element corresponding to the target fault propagation path is identified as the root cause network element of the fault.

[0039] Therefore, this embodiment no longer uses only the "earliest network element that generates an alarm" as the root cause of the fault. Instead, it uses multi-disciplinary topology relationships to establish a fault propagation graph, quantifies the fault propagation contribution between different network elements through dynamic graph attention network, and combines professional fault diagnosis rules and downstream reverse interference to complete the root cause determination, so that the root cause network element and the affected downstream network elements can be more clearly distinguished.

[0040] like Figure 2 As shown, in some implementations, before extracting node features from the graph nodes in the alarm data, the alarm data can undergo integrated stream-batch spatiotemporal alignment and spatiotemporal topological entropy denoising processing. This implementation is mainly used to reduce the impact of noisy alarms such as repetitive heartbeats and sporadic pulses on subsequent fault propagation correlation calculations.

[0041] Step S201: Determine the corresponding alarm time window based on the initial fault level carried by the alarm data, and perform spatiotemporal alignment on the alarm data, topology data and location data within the alarm time window.

[0042] The initial fault level can be the original level identifier already carried by the alarm system when collecting alarms. It is used to select different alarm analysis time ranges and is not equivalent to the handling level re-formed based on the final root cause analysis results. For alarms with a large impact range, a larger time window can be configured to retain related alarms generated during cross-network element propagation; for ordinary alarms, a smaller time window can be configured to reduce irrelevant alarms from entering subsequent analysis.

[0043] In one specific implementation, based on a Spring Cloud microservice and integrated stream / batch processing architecture, a container gateway can be used to access network data sources such as wireless, IPRAN, OTN, transmission, and environmental data via a plugin approach. Simultaneously, it can acquire real-time streaming alarms as well as batch topology, location, and service traffic inventory data. This access method is one implementation of the data acquisition layer and does not limit the specific access framework for the multiple communication network elements claimed in the claims.

[0044] In one example, the window adjustment coefficient The initial fault level is configured as follows: L1-L2 are set to 1.0, L3-L4 to 0.6, L5 to 0.3, and L6 to 0.2. For high-level faults, the associated alarm collection range is expanded accordingly, and for ordinary faults, the alarm window is reduced accordingly, so as to balance the retention of associated alarms and the control of computational load.

[0045]

[0046] in, Initial fault level The corresponding alarm time window; This is the window adjustment coefficient corresponding to the initial fault level; This represents the original number of alarms sorted by alarm time, and ; and The first The alarm time and corresponding network element location of each alarm; It is a distance function; This is a spatial distance penalty factor. (Used) and with Normalization ensures that the summation term matches the actual number of adjacent alarm intervals; when When the location is expressed in latitude and longitude, a preset minimum alarm time window is used. The distance can be spherical or planar distance after scale conversion.

[0047]

[0048] in, To mitigate the spatiotemporal alignment loss between alarm streaming data and batch topology or location data; A non-empty set of batch topology or location data; This is a collection of streaming alarm data; , These are the balance parameters for time difference and spatial distance, respectively; Let distance be the function. By minimizing the spatiotemporal alignment loss, the streaming alarm record with the lowest spatiotemporal cost can be selected for each batch of records, and a network element consistency mapping can be established; when If empty, skip the alignment loss calculation for this batch.

[0049] Step S202: Determine the topological weighted spatiotemporal support of the alarm itemset.

[0050] Alarms within the alarm time window are divided into one or more alarm item sets. For any alarm itemset, not only are the temporal proximity of each alarm and the spatial distance between the corresponding network elements considered, but also the topology connectivity identifiers in the CMDB or network resource management system are read. This is to reduce false associations caused by alarm times being close but no actual effective link connection exists between network elements. For the original alarm records... ,by This indicates the type of alarm recorded.

[0051]

[0052] in, Indicates alarm item set Topological weighted spatiotemporal support; This refers to the number of alarms within the alarm time window. This is an indicator function that is used when an alarm is logged. Alarm types Belongs to alarm item set The value is 1 if the condition is met, otherwise it is 0. , and These are time, space, and topological weights, respectively. The current alarm time is... For item cluster center alarm time; and For the corresponding network element; This serves as a topology connectivity identifier. The above syntax clearly defines the hierarchical relationship between alarm records and alarm itemsets, avoiding the misclassification of records. Directly writing itemset elements can lead to ambiguity.

[0053] Step S203: Determine the spatiotemporal topological entropy of the alarm itemset based on the topological weighted spatiotemporal support.

[0054] In this embodiment, "spatiotemporal topological entropy" is used to characterize the spatiotemporal and topological distribution characteristics of different types of alarms in an alarm item set. Unlike ordinary entropy, which is calculated only based on alarm frequency, spatiotemporal topological entropy incorporates alarm time, network element location, and network topological connectivity through topological weighted spatiotemporal support before calculation.

[0055]

[0056] in, Alarm type The smooth normalized topological support satisfies ; For alarm items The corresponding spatiotemporal topological entropy; The number of alarm types in the alarm item set; This is used to avoid normalizing positive numbers with zero denominators and scaling them. The number of alarm types is moderated to avoid excessive linear amplification of entropy value by itemset size.

[0057] Step S204: After obtaining the spatiotemporal topological entropy, the entropy value is combined with the corresponding entropy threshold to perform noise reduction processing on the alarm data to obtain the target alarm data.

[0058] The entropy threshold can be configured or optimized based on historical alarm processing results, the risk of missed detection corresponding to the initial fault level, and the risk of redundant alarms. Target alarm data continues to be used for node feature extraction and fault propagation correlation determination.

[0059] In some embodiments, the entropy threshold is optimized based on the loss from unfiltered valid fault alarms and the redundancy loss from unfiltered noise alarms. The entropy threshold can be determined according to the following formula:

[0060] in, To optimize the obtained entropy threshold, The threshold to be evaluated. and These are the balancing weights for missed detection loss and redundancy loss, respectively. This represents the loss corresponding to the incorrect filtering of valid fault alarms. This indicates the redundancy loss corresponding to unfiltered noise alarms. For high-level L1-L2 faults, this can improve... Prioritize retaining core related alarms; for L6 common faults, this can improve... To reduce the retention rate of redundant alarms such as repeated heartbeats.

[0061] After obtaining the entropy threshold, a three-layer noise reduction process can be performed: the first layer removes impulse noise based on the spatiotemporal topological entropy and the entropy threshold; the second layer aggregates and deduplicates duplicate heartbeat alarms; and the third layer cleans and regularizes abnormal fields and dirty data. The processed target alarm data can be represented as follows:

[0062] in, This is the target alarm dataset after noise reduction. For network element identification, For alarm time, For network element location, Alarm type For business traffic loss, The initial fault level, This represents the spatiotemporal topological entropy corresponding to the alarm itemset. Following the threshold direction used in the original technical documentation, The itemset is used as the first-level impulse noise removal object. The alarm data will be processed further.

[0063] like Figure 3As shown in the figure, this embodiment further explains the construction process of the multi-topology fault propagation graph and the incremental update process based on the newly added alarms.

[0064] Step S301: Use network elements as shared graph nodes and associate multi-disciplinary topology relationships for the graph nodes.

[0065] The network element identifiers within the current analysis scope are traversed to form a graph node set V. Each graph node can be associated with its corresponding node characteristics, and the connection relationships of the network element in OTN link topology, IPRAN bearer topology, and radio access topology are recorded. Thus, the same graph node can participate in one or more specialized topology relationships.

[0066] In one specific implementation, the initial attributes of a graph node may include at least the network element number, initial fault level, service traffic loss, spatiotemporal topology entropy, and network element coordinates. In the subsequent dynamic graph attention network input layer, it may further carry alarm time window, fault propagation correlation degree, and topology connectivity identifier, so that the aforementioned alarm preprocessing results can be continuously transmitted to the fault propagation modeling and feature encoding stages.

[0067] In one example, network elements A, B, and C can form an ABC connection relationship in the OTN topology, while A and D are connected in the IPRAN topology, and B and D are associated in the radio access topology; the above multiple topology relationships share the set of network element nodes A, B, C, and D, rather than splitting them into three completely independent fault diagrams.

[0068] Step S302: Determine the fault propagation correlation between graph nodes based on alarm timing, location data, and topology data.

[0069] For network elements and First, the time interval between corresponding alarms, the spatial distance between two network elements, and the topological connectivity identifier between two network elements are determined, and then the spatiotemporal fusion similarity is determined accordingly. When using the spatiotemporal topological entropy preprocessing of Example 2, the spatiotemporal topological entropy can also be used to perform entropy decay correction on the spatiotemporal fusion similarity.

[0070]

[0071] in, Indicates network element and The spatiotemporal similarity between them can be used as a means of realizing fault propagation correlation. , , These are time, space, and topological weights, respectively. and For the corresponding alarm time; For alarm time window; This is the parameter for adjusting entropy decay; This represents the spatiotemporal topological entropy of the corresponding alarm itemset; The scale-normalized spatial distance between two network elements; This serves as the topological connectivity identifier. Therefore, each weighted component is located at... interval, and then .

[0072] Set association threshold As a preset association condition. When At that time, it is determined that there is a fault association between two network elements that needs to enter subsequent propagation analysis, and an initial directed edge for fault propagation is established according to the order of alarm occurrence time. This can be... Stored as the fault propagation correlation strength of this node pair for use in subsequent dynamic graph attention network computations.

[0073] Step S303: Incrementally update the multi-topology fault propagation map based on the newly added alarm data.

[0074] Continuously receive new alarm data and determine the graph node to be updated based on the network element identifier in the new alarm. When the network element corresponding to the new alarm does not yet exist in the current graph node set, add the corresponding graph node to the current multi-topology fault propagation graph and associate it with OTN, IPRAN and / or radio access topology relationships from the topology resource data.

[0075] When a new alarm corresponds to an existing network element, it is not necessary to recalculate the fault propagation correlation degree for all network element pairs. Instead, the graph node to be updated corresponding to the existing network element is taken as the center, and relevant graph nodes with topological connection relationship or within the current analysis range are determined. The fault propagation correlation degree between the graph node to be updated and the relevant graph nodes is re-determined, and the corresponding fault propagation directed edges are added, deleted or updated according to the re-determined fault propagation correlation degree.

[0076] The updated dynamic multi-topology fault propagation graph is obtained. ,in, The set of network element nodes at the current moment. This represents the set of directed edges for fault propagation that are currently valid. The updated dynamic multi-topology fault propagation graph is then input into the dynamic graph attention network as a new multi-topology fault propagation graph. Through local incremental updates, the graph structure can continuously evolve with the alarm flow, while reducing redundant computations on graph regions unaffected by new alarms.

[0077] During incremental updates, historically valid directed edges of fault propagation that are not affected by new alarms and still meet the association conditions are retained, and the entire graph is not cleared and reconstructed; at the same time, a binary dynamic adjacency matrix corresponding to the current set of fault propagation edges is maintained. Where there are adjacent edges used for message passing ,otherwise Fault propagation correlation strength Saved as an independent edge attribute, and not written repeatedly. This avoids the need for quadratic weighting of similarity in subsequent attention calculations. The updated node feature vectors, binary dynamic adjacency matrix, fault propagation correlation strength, and topological relationships of each discipline are used as inputs to the dynamic graph attention network.

[0078] like Figure 4 As shown, this embodiment further explains the multi-topology branches, attention weight calculation, node feature aggregation, and cross-topology fusion of dynamic graph attention networks.

[0079] Step S401: Form corresponding topology branches according to OTN link topology, IPRAN bearer topology and radio access topology respectively, and perform linear mapping on node characteristics.

[0080] For each topological branch, the set of neighboring nodes of the current graph node is determined based on the relevant topological relationships. Different topological branches can use their respective linear mapping parameters to map the original node features to the target feature space for subsequent attention calculations.

[0081] Before performing linear mapping on each topology branch, the spatiotemporal topology entropy, initial fault level, business traffic loss, fault propagation correlation, adaptive alarm time window, and topology connectivity identifier carried by the node can be read, and the dynamic adjacency matrix at the current moment can be cached as the adjacency constraint boundary for attention calculation.

[0082] Step S402: Determine the attention score based on the current graph node, adjacent graph nodes, alarm timing, topological connectivity, and fault propagation correlation.

[0083]

[0084] in, express Adjacent graph nodes at time To the current graph node The raw attention score during message delivery; Assign an attention scoring vector; , , These are learnable linear mapping parameters; and For the first In the layer and The node characteristics; "Indicates feature splicing; This represents the binary adjacency relationship of the current dynamic graph; This indicates the correlation degree of fault propagation. Because... As an adjacency mask, the fault propagation correlation is weighted only once in the above formula.

[0085] The above calculation makes the attention score not only dependent on the characteristics of the two nodes themselves, but also subject to the joint constraints of the alarm time interval, the current topological adjacency relationship and the aforementioned fault propagation correlation, thus enabling dynamic adjustment of the contribution of different neighboring nodes for the current fault propagation scenario.

[0086] Step S403: Normalize the attention score to obtain the attention weight.

[0087]

[0088] in, for Current graph node at any given time The set of neighboring nodes in the corresponding topological branch; For messages from adjacent graph nodes Pass to the current graph node The normalized attention weights at time are defined by their indices following the order of "receiving node first, sending node last"; for any non-empty neighbor set, the following condition is met. .

[0089] Step S404: A multi-head attention mechanism is used to weight and aggregate the node features of the associated graph nodes according to the attention weights, and residual updates are performed.

[0090]

[0091] in, For the number of heads; For the first Aggregation parameters corresponding to each attention head; It is a non-linear activation function; For residual mapping parameters, when the input and output feature dimensions are the same, The identity matrix can be used. By setting the residual term outside the nonlinear aggregation term, the original fault characteristics of the current graph node can be directly preserved when the dimensions are matched.

[0092] By using a multi-head attention mechanism, the propagation contribution of associated graph nodes to the current graph node can be learned from different feature subspaces. Then, the outputs of multiple attention heads can be combined to improve the ability to represent complex cascading failure relationships.

[0093] Step S405: Combine the aggregation results of different topology branches to obtain the fault characterization of each network element.

[0094] After obtaining the node aggregation results for the OTN topology branch, IPRAN topology branch, and wireless access topology branch respectively, the aggregation results of the three topology branches are fused. The fusion can be performed using linear mapping after feature concatenation, weighted fusion, or other fusion methods that can preserve the features of different topology branches.

[0095] In one specific implementation, the outputs of different topology branches can be weighted according to the branch weights corresponding to the current fault sequence and then concatenated to form a unified node feature. The fused node feature can then be input into the next layer of the dynamic graph attention network, repeatedly performing topology branch mapping, attention calculation, and node feature aggregation. The number of network stacking layers can be configured according to the fault link length or fault complexity, thereby fusing fault propagation information from higher-order neighbor network elements layer by layer.

[0096] After multi-layer coding is completed, the final fault characterization includes not only the abnormal characteristics of the network element itself, but also the device location, alarm timing, multi-professional topology relationship, spatiotemporal topology entropy, service traffic loss and the contribution information of related network elements to propagation; at the same time, the attention weight of each layer is retained for subsequent fault propagation direction screening and root cause scoring.

[0097] After one or more layers of dynamic graph attention processing, the final fault representation of each network element is obtained. This fault characterization reflects the abnormal state of the network element itself and the propagation contribution of related network elements in the multi-disciplinary topology to the fault state of the network element, and is used for subsequent fault diagnosis tree matching and root cause analysis.

[0098] like Figure 5 As shown, after obtaining the fault characterization of each network element, the root cause analysis is further performed by integrating the professional fault diagnosis tree and the dynamic graph attention weight.

[0099] It should be noted that the original Figure 5 The term "root cause confidence score" used in this specification is uniformly referred to as "root cause rating," both representing a comprehensive evaluation value used to compare the likelihood of candidate network elements as sources of failure. In the following implementation, the components can be normalized to ensure the root cause rating is within the range specified in the standard implementation. The range is defined, but the root cause score is still a comprehensive score used for ranking and comparison, and is not necessarily equivalent to the probability value calibrated from the real sample.

[0100] Step S501: Determine the corresponding preset fault diagnosis tree based on the professional category of the network element, and determine the diagnosis matching score.

[0101] The system can pre-configure fault diagnosis trees for different specialties such as wireless access, IPRAN, OTN, and environmental monitoring. Each fault diagnosis tree stores the fault types, alarm combinations, and diagnostic rules for the corresponding specialized equipment. For the network element to be analyzed, the system selects the corresponding fault diagnosis tree based on the specialty of the network element, and inputs its fault characteristics and alarm types into the corresponding diagnostic rules for matching, thus obtaining a diagnostic matching score. .

[0102] In one specific implementation, the retrieval depth of the fault diagnosis tree can be set based on the initial fault level carried by the alarm data: more complete diagnostic rules are traversed for high-level faults (L1-L2), while shallower rules are retrieved for ordinary faults (L6), thus reducing the computational load of rule retrieval for ordinary alarms. During the diagnosis tree matching process, the fault failure type and remote self-healing feasibility identifier corresponding to the matching rules can also be recorded synchronously, serving as the basis for subsequent fault scheduling and self-healing channel selection.

[0103] The diagnostic matching score is used to represent the degree of matching between the current fault state of a network element and professional fault diagnosis rules. By using data-driven fault representations together with professional diagnostic rules, it is possible to avoid relying solely on fixed rules or neural network features for root cause determination.

[0104] Step S502: Select effective directed edges for fault propagation based on the attention weights corresponding to different propagation directions, and form candidate fault propagation paths.

[0105] For two related graph nodes and , mentioned above Indicates that the message is from Transmission Attention weights at different times. To ensure that the indices of the attention weights are consistent with the start and end points of the directed edges in fault propagation, we define... Direction of fault propagation The corresponding propagation weight.

[0106]

[0107] In one implementation, if the initial fault propagation directed edge is ,and If the initial propagation direction satisfies the preset dominance condition, the directed edge of the fault propagation is retained, where, The threshold for determining the direction is set; otherwise, the initial directed edge for fault propagation is pruned, instead of directly generating a new directed edge for fault propagation that is the opposite of the initial alarm timing. After filtering the propagation directions of each node pair, the remaining directed edges for fault propagation are connected according to the propagation direction to obtain a set of candidate fault propagation paths.

[0108] Each candidate fault propagation path can record the starting candidate root cause network element, intermediate propagation network element, and terminal affected network element, and cache the attention weight of the directed edges of fault propagation in each segment of the path and the fault propagation correlation of the corresponding node pairs for subsequent root cause scoring and path evaluation.

[0109] Step S503: Determine the root cause score of the candidate root cause network element based on the fault characterization, diagnostic matching score and the degree of reverse interference from downstream faults.

[0110]

[0111] in, Candidate network elements The degree of normalization anomaly; and These are the minimum and maximum values ​​of the L2 norm of the node features in the current candidate network element set, respectively; for The set of downstream neighbors in the candidate propagation path; To be pointed to in reverse by the downstream neighbor The average level of interference; For diagnostic matching score; , and These are used to balance the degree of anomaly, the degree of diagnostic matching, and low reverse interference, respectively. When When there are no downstream neighbors, the summation term is 0, thus avoiding the division by zero issue. According to the above value constraints, .

[0112] The above formula is passed Negative correction is applied to downstream reverse interference: the higher the propagation weight from downstream network elements to candidate root cause network elements, the better. The larger, The smaller the value, the higher the root cause score. Therefore, when the candidate network element itself has a high degree of abnormality, a high degree of matching with professional fault diagnosis rules, and low reverse interference from downstream faults, a relatively high root cause score can be obtained.

[0113] Step S504: Determine the target fault propagation path based on the root cause score and the attention weights of the directed edges of each fault propagation path in the candidate fault propagation path.

[0114]

[0115] in, This represents any candidate fault propagation path; the cumulative result of the root cause scores of network elements in the path is used to reflect the strength of the root cause features on that path; For directed edges The corresponding propagation weights, the product of the propagation weights within the path, are used to reflect the propagation reliability of the entire path; This represents the target fault propagation path with the highest path evaluation value.

[0116] Based on the target fault propagation path and the root cause scores of candidate root cause network elements, the final root cause network element is determined. For example, the network element at the starting point of the target fault propagation path and whose root cause score meets the root cause selection criteria can be identified as the root cause network element, and the target fault propagation path can be output as the propagation link that causes downstream faults to occur from this root cause network element.

[0117] In some implementations, the aforementioned root cause network elements and target fault propagation paths can be further used for fault handling. This implementation is a subsequent application of the fault tracing results and does not limit the method for determining the aforementioned root cause network elements and target fault propagation paths.

[0118] In a preferred implementation, the fault handling level and scheduling priority can be determined first based on the root cause score, business traffic loss and fault duration, and then the corresponding level of management personnel, maintenance teams and work order templates can be matched according to the fault handling level.

[0119] Specifically, it can read the root cause network element of the fault, the target fault propagation path, the root cause score of each network element, and the remote self-healing feasibility identifier obtained by diagnostic tree matching, and summarize the business traffic loss, professional and regional information of each affected network element in the target fault propagation path to form fault handling data.

[0120] The system can aggregate the root cause network element of the fault, the target fault propagation path, diagnostic matching information, service impact information, and the handling rules recorded in the pre-set fault diagnosis tree to form structured fault handling data. Based on the degree of fault impact, service loss information, and root cause analysis results, the system determines the handling priority and selects between remote self-healing or manual handling channels based on the fault type and the remote self-healing feasibility information in the diagnosis tree.

[0121] In one example, the severity level of a fault can be quantified according to the following relationship:

[0122] in, To quantify the severity level of the fault, values ​​1 to 6 correspond to L1 to L6, respectively. Root cause score for the faulty network element; To normalize the equivalent business loss due to faults; For the classification scale parameter; To round up, the calculation result is definitively limited to between 1 and 6 by operating on the minimum and maximum values ​​of the outer layer. The original technical documentation provides an example of converting fault traffic into service loss at 2.56 yuan / GB. This value is only an example of service loss conversion and can be configured according to actual operating cost parameters before normalizing the conversion result.

[0123] After determining the fault level, dispatch objects can be matched according to the six-level handling rules. For example, L1-L2 particularly serious faults are pushed to the provincial branch deputy general manager, L3-L4 serious faults are pushed to the provincial branch department general manager and the municipal deputy general manager in charge, L5 relatively serious faults are pushed to the provincial branch deputy general manager and the municipal department manager, and L6 general faults are pushed to the professional supervisor and the municipal center director. The system can call standardized work order templates according to the professional category of the root cause network element, and write the target fault propagation path, root cause score, and fault topology relationship into the work order fields, while pre-filling the front-line personnel check-in navigation and nearby maintenance resource dispatch interfaces.

[0124] For root cause network elements with remote self-healing feasibility indicators, they are assigned to the remote command issuance channel; for root cause network elements without remote repair capabilities, they are assigned to the manual on-site dispatch channel. The self-healing dispatch priority considers root cause score, normalized service loss, and fault duration simultaneously, and uses the complementary term of an exponential decay function to characterize the urgency of handling that accumulates with increasing duration, as expressed below:

[0125] in, For root cause network elements The corresponding self-healing scheduling priority; , , These are the priority weights for root cause score, business loss, and duration, respectively. This is the fault duration adjustment coefficient; This indicates the duration of the fault. Due to... Follow It increases monotonically; therefore, all other things being equal, the longer the fault duration, the better. The higher; the system follows The order in which self-healing commands are issued is determined from high to low.

[0126] After determining the classification and priority, relevant notifications can be pushed via SMS, automated IVR, or intelligent communication assistant group chat. For remote self-healing faults, recovery configuration commands are issued to the corresponding professional network administrator through the command platform. For manually handled faults, standardized scheduling work orders with the target fault propagation path are generated. Classified scheduling records, self-healing command issuance logs, and collaborative group chat creation information can be uniformly incorporated into the subsequent end-to-end data persistence process.

[0127] For faults that meet the conditions for remote self-healing, pre-set recovery commands can be issued through the corresponding professional network management or command platform. For faults that do not meet the conditions for remote self-healing, a maintenance work order containing the root cause network element, the target fault propagation path, and diagnostic information can be generated and sent to the corresponding maintenance object. By outputting the fault propagation path along with the work order, maintenance personnel can directly understand the propagation relationship between the root cause device and downstream affected devices.

[0128] In some implementations, the fault tracing results, fault handling records, and actual handling results can be persisted throughout the entire process to form historical samples for subsequent algorithm evaluation and parameter updates.

[0129] The persistent data may include alarm data, dynamic multi-topology fault propagation graphs, network element fault representations, attention weights, diagnostic matching scores, root cause scores, target fault propagation paths, fault work orders, remote self-healing execution results, and actually confirmed fault root causes. The system can further analyze indicators such as work order response time, fault closure status, and root cause localization deviation to evaluate the processing performance of the current algorithm under different fault scenarios.

[0130] Based on historical samples and evaluation metrics, the spatiotemporal topological entropy thresholds, learnable parameters in the dynamic graph attention network, and balance parameters of each component in the root cause score can be updated separately. For parameters involving discrete threshold selection, updates can be made through historical sample search, validation set evaluation, or other parameter optimization methods. For continuously learnable parameters in the dynamic graph attention network, updates can be made through gradient optimization based on the training loss. This ensures that the parameter update process matches the mathematical properties of the corresponding parameters, and the updated algorithm parameters are used for subsequent fault source analysis.

[0131] In one specific implementation, the fault work order, self-healing issuance record, fault handling level, root cause score, and target fault propagation path are bidirectionally bound to the collaborative session established by the intelligent communication assistant for that work order. The collaborative session data may include text, photos and videos of the fault site, and temporary collaborative records from engineers; simultaneously, the on-site check-in coordinates of frontline personnel, navigation routes, dispatcher response times, and the final closed-loop status of the fault are collected, and the collected data undergoes field standardization and duplicate data cleanup.

[0132] Based on the above end-to-end data, the average response time of work orders can be extracted according to the L1-L6 fault handling levels. Overall fault resolution rate and root cause location error We will collect KPIs and simultaneously summarize the final handling scores of work orders and the data on the decline in business traffic losses. High-impact faults of levels L1-L2 can be used to build a high-weight training sample set, while ordinary faults of level L6 can form a regular sample set to balance the sample impact of different levels of faults during the model iteration process.

[0133] In one implementation, the following multi-objective joint loss can be constructed:

[0134] in, The total loss for the entire iteration process. For root cause identification in a single root cause scenario, cross-entropy loss is used. To fit the loss of the fault propagation link normalized according to the number of edges of the target path, To mitigate KPI performance losses; , These are the balanced weights for the link fitting term and the scheduling performance term, respectively. In the current The root cause probabilities are obtained by performing Softmax normalization on the root cause scores among the candidate network elements. The true root cause label for the unique heat form; Let the set of edges represent the target fault propagation path. For directed edges The propagation weight; and These are the normalized work order response time and root cause localization error, respectively. The failure closed-loop resolution rate; , , These are non-negative loss weights. Normalization avoids the direct addition of different dimensions of time, proportion, and positioning error, preventing a single KPI from unexpectedly dominating the total loss.

[0135] For continuously learnable parameters in the dynamic graph attention network and learnable balance parameters in the root cause scoring, gradient optimization can be used to update them based on the joint loss. For parameters such as entropy thresholds that participate in discrete screening, they can be updated through historical sample search, validation set evaluation, or other discrete parameter optimization methods. The updated parameters form the algorithm configuration data and are fed back to the corresponding processing stages for the next round of alarm preprocessing, fault propagation graph construction, dynamic graph attention encoding, and root cause analysis, thereby achieving a closed loop of fault perception, graph modeling, feature encoding, root cause analysis, scheduling and handling, and model iteration.

[0136] To further illustrate the processing logic of the above method, the following is a non-limiting example. Assume that there are network elements A, B, C, and D in the current multi-professional communication network, where A and B have an OTN link connection, B and C have an IPRAN bearer connection, and C and D have a radio access side association.

[0137] When network element A first generates a link anomaly alarm, and subsequently network elements B, C, and D generate related alarms in adjacent time periods, the system acquires the alarm time, location, and corresponding OTN, IPRAN, and radio access topology relationships of the four network elements. Based on the alarm timing, spatial distance, and topology connections, the system determines the fault propagation correlation degree of different node pairs and establishes initial directed edges for fault propagation on node pairs that meet the correlation conditions.

[0138] After inputting the above multi-topology fault propagation graph into the dynamic graph attention network, the OTN topology branch mainly learns the propagation contribution between A and B, the IPRAN topology branch mainly learns the propagation contribution between B and C, and the wireless access topology branch mainly learns the propagation contribution between C and D. After the results of different topology branches are fused, fault representations of A, B, C and D are obtained respectively.

[0139] Furthermore, based on the specialties of A, B, C, and D, the corresponding pre-set fault diagnosis trees are invoked to obtain the diagnosis matching score of each network element, and the effective fault propagation edges are screened by combining the attention weights of the nodes on the two propagation directions. If the propagation directions from A to B, B to C, and C to D all meet the conditions for determining effective propagation directions, then the candidate propagation path A→B→C→D is formed.

[0140] Calculate root cause scores for A, B, C, and D respectively. Using the aforementioned subscript convention as an example, the propagation weight from A to B is denoted as... The interference weight that points from B to A is denoted as... When A has a high degree of anomaly and a high diagnostic matching score, and the interference weight from B to A is low, while B, C, and D are strongly affected by the propagation from their upstream nodes, A can obtain a relatively high root cause score. After evaluating the path by combining the propagation weights of each edge A→B, B→C, and C→D, A can be identified as the root cause network element, and A→B→C→D can be identified as the target fault propagation path. This example illustrates that the present invention can distinguish between the original fault source and the downstream alarms caused by propagation effects when multiple network elements continuously alarm.

[0141] Reference Figure 6 This embodiment provides a device for tracing and analyzing device faults based on dynamic graph attention networks. This device can be implemented through software modules, hardware circuits, or a combination of both, and can be deployed in a communication network operation and maintenance platform, server, or server cluster.

[0142] The device includes a data acquisition module 61, a fault propagation map construction module 62, a fault characterization determination module 63, a propagation path determination module 64, and a root cause determination module 65.

[0143] The data acquisition module 61 is used to acquire alarm data of multiple communication network elements, topology data to characterize the link connection relationship between network elements, and location data to characterize the spatial location of network elements. The topology data includes OTN link topology data, IPRAN bearer topology data, and wireless access topology data.

[0144] The fault propagation graph construction module 62 is used to extract the node features of the graph nodes from the alarm data, taking the network element as the graph node, and determine the fault propagation correlation degree between the graph nodes according to the alarm time sequence of the alarm data, the location data and the topology data; when the fault propagation correlation degree meets the preset correlation conditions, the fault propagation directed edge is established between the corresponding graph nodes according to the alarm time sequence to obtain a multi-topology fault propagation graph.

[0145] The fault characterization determination module 63 is used to input the multi-topology fault propagation graph into the dynamic graph attention network, form corresponding topology branches based on the OTN link topology data, the IPRAN bearer topology data and the radio access topology data respectively, determine the attention weight of the directed edge of the fault propagation in each topology branch, aggregate the node features of the association graph nodes based on the attention weight, and fuse the aggregation results of different topology branches to obtain the fault characterization of each network element.

[0146] The propagation path determination module 64 is used to match the fault representation with the preset fault diagnosis tree corresponding to the professional field to which the network element belongs, to obtain a diagnosis matching score, and to filter effective fault propagation directed edges from the fault propagation directed edges based on the attention weight, so as to form candidate fault propagation paths.

[0147] The root cause determination module 65 is used to determine the root cause score of the candidate root cause network element based on the fault characterization, the diagnostic matching score, and the attention weight from the downstream network element to the candidate root cause network element, and to determine the fault root cause network element and the target fault propagation path based on the root cause score and the attention weight of each fault propagation directed edge in the candidate fault propagation path.

[0148] In some implementations, the fault propagation graph construction module is also used to determine the graph nodes to be updated based on the newly added alarm data, and to perform incremental updates on the node set and related fault propagation directed edges based on whether the graph nodes to be updated belong to newly added network elements or existing network elements.

[0149] In some implementations, the data acquisition module or the independent alarm preprocessing module is further configured to determine the alarm time window based on the initial fault level, perform spatiotemporal alignment on alarm data, topology data and location data, determine the topology-weighted spatiotemporal support and spatiotemporal topology entropy, and perform alarm noise reduction based on the spatiotemporal topology entropy.

[0150] The specific processing procedures for each module in the above-mentioned device can be referred to the corresponding descriptions in the foregoing method embodiments, and will not be repeated here. Each of the above modules can be implemented entirely or partially through software, hardware, or a combination thereof; each module can be deployed as an independent functional unit, or it can be combined and deployed according to the actual system architecture.

[0151] In some implementations, the fault propagation graph construction module 62 is also used to acquire new alarm data, locally update graph nodes and fault propagation directed edges according to the graph nodes to be updated corresponding to the new network elements or existing network elements, and input the dynamic multi-topology fault propagation graph into the dynamic graph attention network.

[0152] In some implementations, the data acquisition module 61 or the independently configured alarm preprocessing module is further used to determine the alarm time window based on the initial fault level, perform spatiotemporal alignment on alarm data, topology data and location data, calculate topology-weighted spatiotemporal support and spatiotemporal topology entropy, and obtain target alarm data based on the entropy threshold.

[0153] In some implementations, the fault characterization determination module 63 is further used to perform linear mapping on the node features of each topology branch, determine the attention score based on the current graph node, adjacent graph nodes, alarm time interval, topology connectivity and fault propagation correlation, normalize the attention score, and use a multi-head attention mechanism to complete node feature aggregation and residual update.

[0154] In some implementations, the propagation path determination module 64 is further used to compare the attention weights of interconnected graph nodes in the first propagation direction and the second propagation direction, retain the fault propagation directed edges that meet the preset direction determination conditions, and form candidate fault propagation paths; the root cause determination module 65 is further used to determine the root cause score based on the degree of anomaly, the diagnostic matching score, and the degree of downstream fault reverse interference, and to determine the path evaluation value based on the root cause score and the attention weights of each fault propagation directed edge in the path.

[0155] Figure 7 A schematic diagram of the structure of an electronic device is shown. For example... Figure 7 As shown, the electronic device may include a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other through the communication bus 740.

[0156] The processor 710 can be a central processing unit, graphics processing unit, network processor, or other processing unit with data processing and instruction execution capabilities. The memory 730 is used to store computer programs, alarm data, topology data, location data, and intermediate data generated during fault tracing analysis. The communication interface 720 can be used for data communication with network management systems, alarm platforms, resource management systems, CMDBs, or other operation and maintenance systems.

[0157] The processor 710 executes the device fault tracing analysis method based on dynamic graph attention network described in any of the foregoing embodiments by calling the computer program stored in the memory 730. The method includes acquiring alarm data, topology data and location data of multiple communication network elements, constructing a multi-topology fault propagation graph, using dynamic graph attention network to determine the fault characterization of network elements, fusing a preset fault diagnosis tree to screen fault propagation paths, and determining the root cause network element and the target fault propagation path.

[0158] This embodiment also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the device fault tracing analysis method based on dynamic graph attention networks described in any of the foregoing embodiments.

[0159] The computer-readable storage medium may include a read-only memory, random access memory, flash memory, solid-state drive, magnetic disk, optical disk, or other storage medium capable of storing computer programs.

[0160] The embodiments described above are only for illustrating the technical solutions of the present invention, and are not intended to limit the scope of protection of the present invention. Those skilled in the art can substitute, combine, or appropriately adjust the technical features in the above embodiments without departing from the technical concept of the present invention; as long as the corresponding technical solutions still adopt the technical concept of the present invention, they should all fall within the protection scope of the present invention.

[0161] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A method for tracing and analyzing device faults based on dynamic graph attention networks, characterized in that, include: Acquire alarm data, topology data, and location data of multiple communication network elements, wherein the topology data includes OTN link topology data, IPRAN bearer topology data, and radio access topology data; Using the network element as a graph node, the node features of the graph node are extracted from the alarm data, and the fault propagation correlation degree between the graph nodes is determined according to the alarm time sequence, the location data and the topology data. When the fault propagation correlation degree meets the preset correlation conditions, the fault propagation directed edge is established between the corresponding graph nodes according to the alarm time sequence to obtain a multi-topology fault propagation graph. The multi-topology fault propagation graph is input into a dynamic graph attention network, and corresponding topology branches are formed based on the OTN link topology data, the IPRAN bearer topology data, and the radio access topology data, respectively. In each topology branch, the attention weight of the directed edge of the fault propagation is determined according to the alarm timing, the topology connectivity represented by the topology data, and the fault propagation correlation. The node features of the correlation graph nodes are aggregated based on the attention weight. The aggregation results of different topology branches are fused to obtain the fault representation of each network element. The fault representation is matched with the preset fault diagnosis tree corresponding to the network element to obtain a diagnosis matching score, and effective fault propagation directed edges are selected from the fault propagation directed edges based on the attention weight to form candidate fault propagation paths. The root cause score of the candidate root cause network element is determined based on the fault characterization, the diagnostic matching score, and the attention weight from the downstream network element to the candidate root cause network element. The root cause network element and the target fault propagation path are determined based on the root cause score and the attention weight of each fault propagation directed edge in the candidate fault propagation path.

2. The device fault tracing analysis method based on dynamic graph attention network according to claim 1, characterized in that, Also includes: Acquire newly added alarm data and determine the graph node to be updated corresponding to the newly added alarm data; When the graph node to be updated corresponds to a newly added network element, the graph node to be updated is added to the multi-topology fault propagation graph, and the corresponding topology data is associated with the graph node to be updated. When the graph node to be updated corresponds to an existing network element, the fault propagation correlation degree between the graph node to be updated and the relevant graph node is re-determined, and the corresponding fault propagation directed edge is updated according to the re-determined fault propagation correlation degree to obtain a dynamic multi-topology fault propagation graph. The dynamic multi-topology fault propagation graph is used as the updated multi-topology fault propagation graph and input into the dynamic graph attention network.

3. The device fault tracing analysis method based on dynamic graph attention network according to claim 1, characterized in that, Before extracting the node features of the graph nodes from the alarm data, the process also includes: The corresponding alarm time window is determined based on the initial fault level carried by the alarm data, and the alarm data, topology data and location data within the alarm time window are spatiotemporally aligned. Based on the alarm time, location data, and topological connectivity between network elements represented by the topological data, the topological weighted spatiotemporal support of the alarm itemset is determined. The spatiotemporal topological entropy of the alarm itemset is determined based on the topological weighted spatiotemporal support, and the alarm data is denoised based on the spatiotemporal topological entropy and the corresponding entropy threshold to obtain the target alarm data. The target alarm data is used as alarm data to determine the node characteristics and the correlation between the fault propagation.

4. The device fault tracing analysis method based on dynamic graph attention network according to claim 3, characterized in that, Determining the fault propagation correlation between graph nodes based on the alarm timing of the alarm data, the location data, and the topology data includes: Determine the time interval between alarms corresponding to two graph nodes, the spatial distance between network elements corresponding to the two graph nodes, and the topology connectivity identifier between network elements corresponding to the two graph nodes; The spatiotemporal fusion similarity between the two graph nodes is determined based on the time interval, the spatial distance, and the topological connectivity identifier. The spatiotemporal fusion similarity is corrected by entropy decay based on the spatiotemporal topological entropy of the corresponding alarm itemset to obtain the fault propagation correlation.

5. The device fault tracing analysis method based on dynamic graph attention network according to claim 1, characterized in that, The step of determining the attention weights of the directed edges for fault propagation in each topological branch, and aggregating the node features of the nodes in the association graph based on the attention weights, includes: Perform linear mapping on the node features in each topological branch; For the current graph node, the attention score between the current graph node and each of its neighboring graph nodes is determined based on the node characteristics of the current graph node, the node characteristics of its neighboring graph nodes, the time interval between corresponding alarms, the topological connectivity, and the fault propagation correlation. The attention scores are normalized to obtain the attention weights of the corresponding directed edges for fault propagation. A multi-head attention mechanism is adopted to perform weighted aggregation of the node features of the adjacent graph nodes according to the attention weights, and to perform residual update in combination with the node features of the current graph node to obtain the aggregation result of the corresponding topological branch.

6. The device fault tracing analysis method based on dynamic graph attention network according to claim 1, characterized in that, The step of matching the fault representation with a pre-set fault diagnosis tree corresponding to the specialty of the network element, and filtering valid fault propagation directed edges from the fault propagation directed edges based on the attention weight, includes: The corresponding preset fault diagnosis tree is determined according to the professional category to which the network element belongs, and the fault diagnosis rules in the preset fault diagnosis tree are matched with the fault characteristics and alarm types of the network element to obtain the diagnosis matching score. For two interconnected graph nodes, the attention weights corresponding to the first propagation direction and the second propagation direction are compared, and the effective fault propagation direction between the two graph nodes is determined based on the comparison result. The directed edges corresponding to the effective fault propagation directions are retained, and the retained directed edges are connected according to the propagation direction to form the candidate fault propagation path.

7. The device fault tracing analysis method based on dynamic graph attention network according to claim 1, characterized in that, The step of determining the root cause score of candidate root cause network elements and determining the faulty root cause network element and the target fault propagation path based on the root cause score includes: The degree of abnormality of the candidate root cause network element is determined based on the fault characterization of the candidate root cause network element, the degree of matching between the candidate root cause network element and the corresponding fault diagnosis rule is determined based on the diagnostic matching score, and the degree of downstream fault reverse interference is determined based on the attention weight from downstream network elements to the candidate root cause network element. The root cause score of the candidate root cause network element is determined based on the degree of anomaly, the diagnostic matching score, and the degree of reverse interference from downstream faults. The path evaluation value of the corresponding candidate fault propagation path is determined based on the root cause score of the network element in each candidate fault propagation path and the attention weight of each directed edge of fault propagation. The target fault propagation path and the fault root cause network element are then determined based on the path evaluation value.

8. A device for tracing and analyzing equipment faults based on dynamic graph attention networks, characterized in that, include: The data acquisition module is used to acquire alarm data of multiple communication network elements, topology data to characterize the link connection relationship between network elements, and location data to characterize the spatial location of network elements. The topology data includes OTN link topology data, IPRAN bearer topology data, and radio access topology data. The fault propagation graph construction module is used to extract the node features of the graph nodes from the alarm data, with the network element as the graph node, and determine the fault propagation correlation degree between the graph nodes according to the alarm time sequence of the alarm data, the location data and the topology data. When the fault propagation correlation degree meets the preset correlation conditions, the module establishes the fault propagation directed edge between the corresponding graph nodes according to the alarm time sequence to obtain a multi-topology fault propagation graph. The fault characterization determination module is used to input the multi-topology fault propagation graph into the dynamic graph attention network, form corresponding topology branches based on the OTN link topology data, the IPRAN bearer topology data and the radio access topology data respectively, determine the attention weight of the directed edge of the fault propagation in each topology branch, aggregate the node features of the association graph nodes based on the attention weight, and fuse the aggregation results of different topology branches to obtain the fault characterization of each network element. The propagation path determination module is used to match the fault representation with the preset fault diagnosis tree corresponding to the professional category of the network element to obtain a diagnosis matching score, and to filter effective fault propagation directed edges from the fault propagation directed edges based on the attention weight to form candidate fault propagation paths. The root cause determination module is used to determine the root cause score of the candidate root cause network element based on the fault characterization, the diagnostic matching score, and the attention weight from the downstream network element to the candidate root cause network element, and to determine the fault root cause network element and the target fault propagation path based on the root cause score and the attention weight of each fault propagation directed edge in the candidate fault propagation path.

9. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the device fault tracing analysis method based on dynamic graph attention network as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the device fault tracing analysis method based on dynamic graph attention network as described in any one of claims 1 to 7.

Images