Method and apparatus for determining the contribution of time factor

Abstract

This application provides a method and apparatus for determining the contribution of time factors, relating to the field of root cause analysis technology, for accurately quantifying the contribution of time factors and improving the accuracy of root cause analysis. The method involves obtaining a first initiation interval and a first end interval for a first anomalous event, and obtaining a second initiation interval for a second anomalous event. When it is determined that the first anomalous event has a causal influence on the second anomalous event in the time dimension, a composite physical decay model is used to determine the first residual expectation and the second residual expectation corresponding to each time point based on the relationship between each time point within the second initiation interval and the first initiation interval and the first end interval. Based on the first residual expectation and the second residual expectation corresponding to each time point, the residual influence intensity corresponding to each time point is determined. Based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval, the time factor contribution of the first anomalous event to the second anomalous event is determined.

Description

Technical Field

[0001] This application relates to the field of root cause analysis technology, and in particular to a method and apparatus for determining the contribution of time factors. Background Technology

[0002] In large-scale distributed systems, cloud-native architectures, or complex industrial control networks, abnormal events in system components (such as sudden increases in metrics, log errors, link timeouts, and configuration changes) often exhibit complex cascading propagation characteristics. When a failure occurs, quickly and accurately identifying the root cause event is crucial to ensuring system availability.

[0003] Existing root cause analysis algorithms (such as those based on random walks, causal graphs, or temporal correlation) heavily rely on the time factor contribution when evaluating the causal contribution of one anomalous event to another. The time factor contribution is a quantitative indicator that measures the causal influence of one anomalous event on another over time.

[0004] In existing technologies, when calculating the time factor contribution of one anomalous event to another anomalous event, the time factor contribution is usually determined based on the simple temporal sequence and overlap of the two anomalous events.

[0005] However, monitoring systems typically employ periodic sampling (e.g., sampling every 1 or 5 minutes) or asynchronous reporting mechanisms. This means that the precise moment when an abnormal event actually occurs and ends cannot be captured accurately in real time. Traditional algorithms often simply take the moment when the anomaly is first observed as the occurrence time of the abnormal event, ignoring the time uncertainty within the sampling interval, leading to distortion of the order and time delay weights in causal deduction. Secondly, relying on a simple temporal order ignores the physical decay law of the fault's influence and the cliff-like dissipation effect brought about by recovery behavior. It lacks the ability to accurately quantify the causal pathogenicity in the time dimension, which may lead to misjudging old events that have naturally decayed to the point of having no impact as the root cause, or confusing the long-tail residual impact of recovered events with the continuously active impact, thus resulting in inaccurate identification of the root cause event. Summary of the Invention

[0006] This application provides a method and apparatus for determining the contribution of time factors, which can accurately quantify the contribution of one anomalous event to another anomalous event in terms of time factors, thereby improving the accuracy and reliability of root cause analysis.

[0007] In a first aspect, embodiments of this application provide a method for determining the contribution of a time factor, the method comprising: Obtain the first start interval and the first end interval of the first abnormal event, and obtain the second start interval of the second abnormal event, wherein the first start interval is an uncertain time interval containing the actual trigger time of the first abnormal event, and the first end interval is an uncertain time interval containing the actual end time of the first abnormal event; When it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension, the first residual expectation and the second residual expectation corresponding to each time point are determined by the composite physical decay model based on the relationship between each time point in the second start interval and the first start interval and the first end interval. Based on the first residual expectation and the second residual expectation corresponding to each time point, the residual influence intensity corresponding to each time point is determined. The first residual expectation represents the expected residual intensity of the fault-induced influence of the first abnormal event at the corresponding time point due to the natural decay of the half-life mechanism. The second residual expectation represents the expected residual intensity of the first abnormal event at the corresponding time point due to the cliff-like drop and long-tail dissipation caused by the operation and maintenance recovery intervention. Based on the residual influence intensity at each time point and the interval length of the second initiation interval, the time factor contribution of the first anomalous event to the second anomalous event is determined.

[0008] Secondly, embodiments of this application also provide an apparatus for determining the contribution of a time factor, the apparatus comprising: The acquisition module is used to acquire the first start interval and the first end interval of the first abnormal event, and to acquire the second start interval of the second abnormal event, wherein the first start interval is an uncertain time interval containing the actual trigger time of the first abnormal event, and the first end interval is an uncertain time interval containing the actual end time of the first abnormal event. The first determining module is used to determine the first residual expectation and the second residual expectation corresponding to each time point when it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension. Based on the relationship between each time point in the second start interval and the first start interval and the first end interval, the module uses a composite physical attenuation model to determine the first residual expectation and the second residual expectation corresponding to each time point. Based on the first residual expectation and the second residual expectation corresponding to each time point, the module determines the residual influence intensity corresponding to each time point. The first residual expectation represents the expected residual intensity of the fault-induced influence of the first abnormal event at the corresponding time point due to the natural attenuation of the half-life mechanism. The second residual expectation represents the expected residual intensity of the first abnormal event at the corresponding time point due to the cliff-like drop and long-tail dissipation caused by the operation and maintenance recovery intervention. The second determining module is used to determine the time factor contribution of the first abnormal event to the second abnormal event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval.

[0009] Thirdly, embodiments of this application also provide an electronic device, including: Processor; and Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform the method for determining the contribution of the time factor as described in the first aspect.

[0010] Fourthly, embodiments of this application also provide a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the method for determining the contribution of the time factor as described in the first aspect.

[0011] Fifthly, this application provides a computer program product that, when invoked by a computer, causes the computer to execute the method steps for determining the contribution of the time factor as described in the first aspect.

[0012] The beneficial effects of this application are as follows: In the method for determining the time factor contribution provided in this application embodiment, firstly, a first start interval and a first end interval of a first abnormal event are obtained, and a second start interval of a second abnormal event is obtained; then, when it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension, a composite physical attenuation model is used to determine the first residual expectation and the second residual expectation corresponding to each time point based on the relationship between each time point in the second start interval and the first start interval and the first end interval, and based on the first residual expectation and the second residual expectation corresponding to each time point, the residual influence intensity corresponding to each time point is determined; finally, based on the residual influence intensity corresponding to each time point and the interval length of the second start interval, the time factor contribution of the first abnormal event to the second abnormal event is determined. In this way, modeling the actual trigger and actual end times as intervals (first start interval, first end interval, second start interval) aligns with the observation mechanism of actual monitoring systems. This fundamentally eliminates the systematic bias introduced by sampling intervals and avoids errors caused by directly using the first observed anomaly time as the precise occurrence time. Furthermore, a composite physical decay model is introduced, using the first residual expectation to characterize the exponential decay of the half-life and the second residual expectation to characterize the precipitous drop and long-tail dissipation. This ensures that the time factor contribution accurately reflects the evolution of the fault's pathogenicity in the physical world. Additionally, by integrating and averaging the residual influence intensity at each time point within the second start interval, the accuracy of root cause localization is significantly improved. In summary, this method accurately quantifies the time factor contribution of one anomaly to another, improving the precision and reliability of root cause analysis.

[0013] Furthermore, other features and advantages of this application will be set forth in the following description and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described herein are used to provide a further understanding of this application, constitute a part of this application, and do not constitute an improper limitation of this application. In the accompanying drawings: Figure 1 This is a schematic diagram of an optional system architecture applicable to the embodiments of this application.

[0015] Figure 2 This is a schematic diagram illustrating the implementation process of a method for determining the contribution of a time factor, provided in an embodiment of this application.

[0016] Figure 3 This is a schematic diagram illustrating the probability of the existence of an abnormal event E, as provided in an embodiment of this application.

[0017] Figure 4 This is a schematic diagram of a natural attenuation sub-model provided in an embodiment of this application.

[0018] Figure 5 This is a schematic diagram of a cliff-tail recovery sub-model provided in an embodiment of this application.

[0019] Figure 6 This is a schematic diagram illustrating the residual influence intensity provided in an embodiment of this application.

[0020] Figure 7 This is a schematic diagram of a first scenario illustrating the residual influence intensity provided in an embodiment of this application.

[0021] Figure 8 This is a schematic diagram of a second scenario for the residual influence intensity provided in an embodiment of this application.

[0022] Figure 9 This is a schematic diagram of a third scenario for the residual influence intensity provided in an embodiment of this application.

[0023] Figure 10 This is a schematic diagram of a device for determining the contribution of a time factor, provided in an embodiment of this application.

[0024] Figure 11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0025] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While some embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this application. It should be understood that the drawings and embodiments of this application are for illustrative purposes only and are not intended to limit the scope of protection of this application.

[0026] It should be understood that the steps described in the method embodiments of this application may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this application is not limited in this respect.

[0027] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc., mentioned in this application are used only to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0028] It should be noted that the terms "a" and "a plurality of" used in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0029] The names of the messages or information exchanged between multiple devices in the embodiments of this application are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0030] The design concept of the embodiments of this application is briefly introduced below: In large-scale distributed systems, cloud-native architectures, or complex industrial control networks, abnormal events in system components (such as sudden increases in metrics, log errors, link timeouts, and configuration changes) often exhibit complex cascading propagation characteristics. When a failure occurs, quickly and accurately identifying the root cause event is crucial to ensuring system availability.

[0031] Existing root cause analysis algorithms (such as those based on random walks, causal graphs, or temporal correlation) heavily rely on the time factor contribution when evaluating the causal contribution of one anomalous event to another. The time factor contribution is a quantitative indicator that measures the causal influence of one anomalous event on another over time.

[0032] In existing technologies, when calculating the time factor contribution of one anomalous event to another, the contribution is typically determined based on the simple temporal order and overlap of the two anomalous events. Specifically, the time factor contribution is determined by the time difference and simple overlap ratio of the two anomalous events.

[0033] However, existing technologies have the following drawbacks: (1) Monitoring systems typically use periodic sampling (such as sampling every 1 minute or 5 minutes) or asynchronous reporting mechanisms. This means that the exact moment when an abnormal event actually occurs and ends cannot be captured in real time. Traditional algorithms often simply take the moment when the abnormality is first observed as the time when the abnormal event occurs, ignoring the time uncertainty within the sampling interval, which leads to distortion of the order and time delay weight of causal inference. For example, if an abnormality is observed when sampling at 08:05, but no abnormality is observed when sampling at 08:00, the actual time when the abnormality occurs may not be 08:05, but a moment within 08:00-08:05. (2) In fact, the residual effects of system anomalies include not only the natural decay of half-life over time (such as residual pressure from memory leaks and gradual recovery after cache breakdown), but also the "cliff-like" drop caused by specific operational recovery actions (such as service restarts and traffic diversion) and the subsequent "long-tail" fault characteristics. Existing models cannot accurately depict the complex evolution of the physical world, thus leading to inaccurate identification of root cause events.

[0034] Therefore, how to solve the time distortion problem caused by the uncertainty of monitoring and sampling in existing technologies, as well as the shortcomings of not being able to accurately characterize the residual impact of faults and the physics of cliff recovery, are urgent problems to be solved.

[0035] In view of this, this application provides a method for determining the contribution of time factors, which can both accommodate the uncertainty of observation time and accurately quantify the contribution of time factors in complex time-series decay. First, a first start interval and a first end interval of a first anomalous event are obtained, and a second start interval of a second anomalous event is obtained. The first start interval is an uncertain time interval containing the actual trigger time of the first anomalous event, and the first end interval is an uncertain time interval containing the actual end time of the first anomalous event. Then, when it is determined that the first anomalous event has a causal influence on the second anomalous event in the time dimension, a composite physical decay model is used to determine the contribution of time factors based on each time point within the second start interval and the first start interval. The relationship between the interval and the first end interval is used to determine the first residual expectation and the second residual expectation corresponding to each time point. Based on the first residual expectation and the second residual expectation corresponding to each time point, the residual impact intensity corresponding to each time point is determined. The first residual expectation represents the expected residual intensity of the fault-induced impact of the first abnormal event at the corresponding time point due to the natural decay of the half-life mechanism. The second residual expectation represents the expected residual intensity of the first abnormal event at the corresponding time point due to the cliff-like drop and long-tail dissipation caused by the operation and maintenance recovery intervention. Finally, based on the residual impact intensity corresponding to each time point and the interval length of the second start interval, the time factor contribution of the first abnormal event to the second abnormal event is determined. In this way, the actual trigger time and the actual end time are modeled as intervals (first start interval, first end interval, second start interval), which conforms to the observation mechanism of actual monitoring systems. This fundamentally eliminates the systematic bias introduced by the sampling interval and avoids the error caused by directly taking the time point of the first observation of the anomaly as the precise occurrence time. At the same time, a composite physical decay model is introduced, which uses the first residual expectation to characterize the exponential decay of the half-life (the natural decay when the first anomaly is not repaired), and the second residual expectation to characterize the precipitous drop and long-tail dissipation (the instantaneous drop after maintenance and recovery intervention and subsequent residues). This allows the time factor contribution to truly reflect the evolution of the pathogenicity of the fault in the physical world. In addition, by integrating and averaging the residual influence intensity at each time point within the second start interval, the time factor contribution is essentially an average probability, which greatly improves the accuracy of root cause localization. In summary, the time factor contribution of one anomaly to another is accurately quantified, improving the accuracy and reliability of root cause analysis.

[0036] In particular, the preferred embodiments of this application will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments of this application and the features in the embodiments can be combined with each other without conflict.

[0037] See Figure 1The diagram illustrates an optional system architecture applicable to an embodiment of this application. This system architecture may include: terminal devices (101a, 101b) and server 102. The terminal devices (101a, 101b) and server 102 can interact via a communication network. The communication network may employ wireless communication or wired communication methods. For example, the terminal devices (101a, 101b) can access the network and communicate with server 102 via cellular mobile communication technology. This cellular mobile communication technology may include, for example, 5G (5th generation mobile networks) or next-generation mobile communication technology. Optionally, the terminal devices (101a, 101b) can access the network and communicate with server 102 via short-range wireless communication. This short-range wireless communication method may include, for example, wireless fidelity (Wi-Fi) technology.

[0038] This application embodiment does not impose any limitation on the number of communication devices involved in the above system architecture. For example, the above system architecture may include more terminal devices, or it may include fewer terminal devices, or it may also include other network devices. Figure 1 As shown, only terminal devices (101a, 101b) and server 102 are described as examples. The following is a brief introduction to the above communication devices and their respective functions.

[0039] The terminal devices (101a, 101b) and the server 102 can communicate through a communication network.

[0040] In one alternative implementation, the communication network can be a wired network or a wireless network. Therefore, the terminal devices (101a, 101b) and the server 102 can be connected directly or indirectly via wired or wireless communication. For example, the terminal devices (101a, 101b) can be indirectly connected to the server 102 via a wireless access point, or the terminal devices (101a, 101b) can be directly connected to the server 102 via the Internet; this application does not impose any limitations on this.

[0041] For example, the terminal device (101a, 101b) may include, but is not limited to: mobile phone, tablet computer, laptop computer, desktop computer, e-book reader, smart voice interaction device, smart home appliance, vehicle terminal and other devices; various clients may be installed on the terminal device, which may be an application (such as a browser, game software, etc.) or a webpage, mini program, etc.

[0042] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0043] The method for determining the contribution of time factors provided by the exemplary embodiments of this application will be described below in conjunction with the above system architecture and with reference to the accompanying drawings. It should be noted that the above system architecture is only shown for the purpose of understanding the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0044] See Figure 2 The diagram shown illustrates the implementation flow of a method for determining the contribution of a time factor according to an embodiment of this application. Taking a server as an example, the specific implementation flow of this method is as follows: S20: Obtain the first start interval and the first end interval of the first abnormal event, and obtain the second start interval of the second abnormal event.

[0045] The first start interval is an uncertain time interval containing the actual trigger time of the first abnormal event, the first end interval is an uncertain time interval containing the actual end time of the first abnormal event, and the second start interval is an uncertain time interval containing the actual trigger time of the second abnormal event.

[0046] In this embodiment of the application, the first abnormal event and the second abnormal event are any two abnormal events among the abnormal events corresponding to the root cause analysis task. For example, the first abnormal event is: the database connection pool is full, and the second abnormal event is: the downstream service interface response times out.

[0047] In this embodiment of the application, since the monitoring system adopts periodic sampling (e.g., sampling once every 1 minute or 5 minutes) or asynchronous reporting mechanism, there is an unavoidable uncertainty in the precise time when the abnormal event is actually triggered and ended. Therefore, this embodiment of the application does not directly use a single point in time. The occurrence and end of each abnormal event are characterized by two time intervals (i.e., the start interval and the end interval). By parsing the monitoring sampling sequence, the start interval and end interval corresponding to each abnormal event are obtained.

[0048] Optionally, in this application embodiment, a possible implementation is provided for obtaining the first start interval and the first end interval of the first abnormal event, and obtaining the second start interval of the second abnormal event, specifically by performing the following operations: S200: Obtain the first moment when the first abnormal event was detected in an inactive state and the second moment when the first abnormal event was detected in an active state, and take the time range from the first moment to the second moment as the first start interval of the first abnormal event.

[0049] In this embodiment of the application, the monitoring sampling sequence is parsed to obtain the first moment when the first abnormal event was last detected in an inactive state and the second moment when the first abnormal event was first detected in an active state. The first moment is taken as the left endpoint of the first start interval of the first abnormal event, and the second moment is taken as the right endpoint of the first start interval of the first abnormal event.

[0050] Among them, the actual triggering time of any abnormal event is within the starting interval [s] min s max The distribution within the region follows a uniform distribution. Based on the principle of maximum entropy, assume the actual trigger time t of an abnormal event... c Belongs to a uniform distribution t c ~[s min ,s max The first probability density function corresponding to the actual triggering time of this abnormal event is ft. c (x)=1 / (s max -s min ).

[0051] S201: Obtain the third moment when the first abnormal event was last detected and the fourth moment when the first abnormal event was no longer detected, and take the time range from the third moment to the fourth moment as the first end interval of the first abnormal event.

[0052] In this embodiment of the application, the monitoring sampling sequence is parsed to obtain the third moment when the first abnormal event was last detected and the fourth moment when the first abnormal event was no longer detected and the third moment when the first abnormal event was detected and the fourth moment when the first abnormal event was no longer detected. The third moment is taken as the left endpoint of the first end interval of the first abnormal event and the fourth moment is taken as the right endpoint of the first end interval of the first abnormal event.

[0053] Among them, the actual end time of any abnormal event is within the end interval [e min e max The distribution within the region follows a uniform distribution. Based on the principle of maximum entropy, assume the true end time t of an abnormal event is... e Belongs to a uniform distribution t e ~[e min ,e max The second probability density function corresponding to the true end time of this abnormal event is ft. e (y)=1 / (e max-e min ).

[0054] Furthermore, it is worth noting that in the embodiments of this application, the probability P of an abnormal event E being in an active state at any time t is... E (t) represents the "actual start time t". c ≤t, and the actual end time t e The joint probability of "≥ t" is used to calculate the cumulative distribution function corresponding to the first and second probability density functions of the abnormal event E. Multiplying the two cumulative distribution functions yields the probability existence function of the abnormal event E. This probability existence function precisely characterizes the gradual change in probability of the abnormal event E: linearly increasing from 0 to 1 in the initiation interval, remaining at 1 during the plateau period, and linearly decreasing from 1 to 0 in the termination interval. The specific expression of the probability existence function is as follows:

[0055] For example, see Figure 3 The diagram shown is a schematic representation of the probability of the existence of an abnormal event E provided in the embodiments of this application. The horizontal axis represents the absolute time t, and the vertical axis represents the probability of the existence of the abnormal event E. It depicts a piecewise probability trapezoid constructed based on four time points (the left and right endpoints of the start interval and the left and right endpoints of the end interval), which characterizes the uncertainty of the start and end caused by the monitoring sampling interval.

[0056] S202: Obtain the fifth moment when the second abnormal event was last detected and the sixth moment when the second abnormal event was first detected and the second abnormal event was detected and the sixth moment when the second abnormal event was detected and the second abnormal event was detected and the time range from the fifth moment to the sixth moment is taken as the second start interval of the second abnormal event.

[0057] In this embodiment of the application, the monitoring sampling sequence is parsed to obtain the fifth moment when the second abnormal event was last detected in an inactive state and the sixth moment when the second abnormal event was first detected in an active state. The fifth moment is taken as the left endpoint of the second start interval of the second abnormal event, and the sixth moment is taken as the right endpoint of the second start interval of the second abnormal event.

[0058] In this way, by using the boundary combination of "last inactivity → first activity" and "last still active → first no longer active", the maximum possible time range of the actual trigger time and the actual end time can be accurately locked, ensuring that the time interval is neither too wide (introducing noise) nor too narrow (missing the possibility), and ensuring that the determination of the contribution of the subsequent time factor is not affected by the uncertainty of time, so as to more accurately determine the contribution of the time factor.

[0059] S21: When it is determined that the first anomalous event has a causal influence on the second anomalous event in the time dimension, the first residual expectation and the second residual expectation corresponding to each time point are determined by the composite physical decay model based on the relationship between each time point in the second start interval and the first start interval and the first end interval. Based on the first residual expectation and the second residual expectation corresponding to each time point, the residual influence intensity corresponding to each time point is determined.

[0060] The first residual expectation represents the expected residual strength of the failure-induced impact of the first anomaly at the corresponding time point, which naturally decays due to the half-life mechanism. The second residual expectation represents the expected residual strength of the first anomaly at the corresponding time point, which experiences a sharp drop and long-tail dissipation due to operational and maintenance recovery intervention. Specifically, the first residual expectation is: the expected residual strength of the failure-induced impact of the first anomaly at the corresponding time point, which is the result of integrating the expected probability distribution of the actual trigger time of the first anomaly within the first start interval, based on the natural decay of the half-life mechanism. The second residual expectation is: the expected residual strength of the first anomaly at the corresponding time point, which experiences a sharp drop and long-tail dissipation due to operational and maintenance recovery intervention, based on integrating the expected probability distribution of the actual end time of the first anomaly within the first end interval, based on the natural decay of the first anomaly at the corresponding time point.

[0061] In this embodiment, when it is determined that the first anomalous event has no causal influence on the second anomalous event in the time dimension, the time factor contribution of the first anomalous event to the second anomalous event is directly determined to be 0. Only after determining that the first anomalous event has a causal influence on the second anomalous event in the time dimension will a composite physical decay model be used. Based on the relationship between each time point within the second initiation interval and the first initiation interval and the first end interval, the first residual expectation and the second residual expectation corresponding to each time point are determined. Based on the first residual expectation and the second residual expectation corresponding to each time point, the residual influence intensity corresponding to each time point is determined. Finally, based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval, the time factor contribution of the first anomalous event to the second anomalous event is determined. This achieves preliminary screening before complex calculations, reducing complexity and improving the efficiency of determining the time factor contribution.

[0062] The condition for the first anomalous event to have a causal influence on the second anomalous event in the time dimension is as follows: the left endpoint of the first initiation interval is not greater than the right endpoint of the second initiation interval, and (the right endpoint of the first termination interval is not less than the left endpoint of the second initiation interval, or the theoretical maximum residual influence intensity of the first anomalous event on the second anomalous event is not less than the residual influence threshold). That is, when the left endpoint of the first initiation interval is not greater than the right endpoint of the second initiation interval, and the right endpoint of the first termination interval is not less than the left endpoint of the second initiation interval, the first anomalous event is determined to have a causal influence on the second anomalous event in the time dimension; when the left endpoint of the first initiation interval is not greater than the right endpoint of the second initiation interval, and the theoretical maximum residual influence intensity of the first anomalous event on the second anomalous event is not less than the residual influence threshold, the first anomalous event is determined to have a causal influence on the second anomalous event in the time dimension.

[0063] Optionally, in this application embodiment, a possible implementation is provided for determining whether the first anomalous event has a causal influence on the second anomalous event in the time dimension, specifically by performing the following operations: SA1: Determine if the left endpoint of the first start interval is greater than the right endpoint of the second start interval. If yes, execute SA2; otherwise, execute SA3.

[0064] In this embodiment of the application, the left endpoint of the first start interval being greater than the right endpoint of the second start interval indicates that the earliest possible active time of the first abnormal event is later than the latest possible active time of the second abnormal event. At this time, the first abnormal event can never trigger the second abnormal event, and the time factor contribution of the first abnormal event to the second abnormal event is 0 (i.e., T(A→B) = 0).

[0065] SA2: Determines that the first anomalous event does not have a causal influence on the second anomalous event in the time dimension.

[0066] In this embodiment of the application, when the left endpoint of the first start interval is greater than the right endpoint of the second start interval, it is determined that the first abnormal event has no causal influence on the second abnormal event in the time dimension, and the time factor contribution of the first abnormal event to the second abnormal event is determined to be 0; or, when the right endpoint of the first end interval is less than the left endpoint of the second start interval, and the theoretical maximum residual influence intensity of the first abnormal event on the second abnormal event is less than the residual influence threshold, it is determined that the first abnormal event has no causal influence on the second abnormal event in the time dimension.

[0067] SA3: Determine whether the right endpoint of the first ending interval is less than the left endpoint of the second starting interval, and whether the theoretical maximum residual influence intensity of the first abnormal event on the second abnormal event is less than the residual influence threshold. If yes, execute SA2; otherwise, execute SA4.

[0068] The physical meaning of the theoretical maximum residual influence intensity is: the maximum residual influence intensity that the first anomaly event may produce within the second initiation interval, where the residual influence threshold is a sufficiently small threshold (e.g., 10). ﹣2 If the right endpoint of the first termination interval is less than the left endpoint of the second initiation interval, and the theoretical maximum residual influence intensity of the first abnormal event on the second abnormal event is less than the residual influence threshold, then it means that the long tail influence of the first abnormal event has completely dissipated. At this time, the causal influence of the first abnormal event on the second abnormal event in the time dimension can be ignored, and the contribution of the first abnormal event to the second abnormal event in the time factor is 0 (i.e., T(A→B) = 0).

[0069] In this embodiment, the theoretical maximum residual influence intensity can be obtained by calculating the residual influence intensity corresponding to the left endpoint of the second initiation interval. Specifically, the theoretical maximum residual influence intensity is the value obtained by substituting the left endpoint of the second initiation interval into the calculation expression of the residual influence intensity, or it can be the value obtained by substituting the left endpoint of the second initiation interval into the scaled calculation expression of the residual influence intensity. This embodiment does not impose any limitation on this. The computational complexity of the scaled calculation expression of the residual influence intensity is lower than that of the calculation expression of the residual influence intensity. The scaled calculation expression of the residual influence intensity is a simplified expression constructed based on the attenuation distance, physical attenuation rate, cliff reduction factor, and long-tail dissipation rate between the right endpoint of the first initiation interval, the right endpoint of the first termination interval, and the left endpoint of the second initiation interval.

[0070] SA4: Determine the causal influence of the first anomalous event on the second anomalous event in the time dimension.

[0071] In this way, for event pairs that do not meet the causal time sequence (cause follows effect) or have essentially dissipated, the subsequent complex calculation of time factor contribution is skipped, significantly reducing the computational overhead and response latency of the system in high-concurrency alarm storm scenarios. Furthermore, by comparing the theoretical maximum residual influence intensity with the residual influence threshold, it ensures that only truly potentially pathogenic abnormal event pairs enter the fine calculation process, thereby improving the purity and accuracy of the final root cause recommendation list.

[0072] In this embodiment, the composite physical attenuation model includes: a natural attenuation sub-model and a cliff-tail recovery sub-model. The expression for the composite physical attenuation model is: I raw (t|t c ,t e =base(t,t) c )×recoveryFactor(t,t e ), where base(t,t cThe natural decay sub-model (t, t) is used to characterize the spontaneous decay of the fault-induced impact of the first anomalous event over time. e The cliff-end long-tail recovery sub-model is used to characterize the pattern of a sharp drop in the impact of a fault after performing maintenance and recovery operations on the first abnormal event, followed by a long-tail dissipation phase. The natural decay sub-model and the cliff-end long-tail recovery sub-model are described in detail below: (1) Natural decay sub-model: It is an exponential decay function with the actual triggering time of the first abnormal event as the time origin and the physical decay rate as the decay constant; the physical decay rate is obtained by conversion based on the preset physical half-life, and the physical half-life represents that the fault influence induced by the fault source will be halved after each physical half-life when the fault source continues to exist.

[0073] In this embodiment of the application, the expression for the natural decay sub-model is:

[0074] Among them, t c Let λ be the assumed true trigger time of the abnormal event, and λ be the physical decay rate, calculated based on a preset physical half-life. Specifically, according to the exponential decay equation... Taking the natural logarithm of both sides yields the following:

[0075] For example, in a cloud-native microservice architecture, assuming the physical half-life of infrastructure alerts (e.g., memory leaks) is set to 15 minutes (i.e., 900 seconds), the corresponding physical decay rate is:

[0076] For example, see Figure 4 The diagram shown is a schematic of the natural decay sub-model provided in the embodiments of this application, where the horizontal axis represents the relative elapsed time t - t0. c (Unit: 15 min half-life), the vertical axis represents the residual effect, showing the physical characteristics of the physical residual effect of the event on the system after the assumed actual triggering time, which decays exponentially over time according to the half-life law (e.g., 15 minutes).

[0077] (2) Cliff Long Tail Recovery Sub-model: It is a piecewise function with the actual end time of the first abnormal event as the segment node. Before the actual end time, the value of the cliff long tail recovery sub-model is a preset constant (the preset constant represents the complete retention of the fault-induced impact when the operation and maintenance recovery operation has not been performed, and the preset constant can be 1). After the actual end time, the cliff long tail recovery sub-model is an exponential decay function with the cliff reduction coefficient as the instantaneous drop ratio and the long tail dissipation rate as the decay constant. The cliff reduction coefficient represents the proportion of the fault-induced impact that drops sharply after the operation and maintenance recovery operation is performed on the first abnormal event. The long tail dissipation rate represents the decay rate of the residual fault-induced impact that dissipates over time after the sharp drop.

[0078] In this embodiment of the application, the expression for the cliff-tailed recovery sub-model is:

[0079] Among them, t e The assumed true end time of the abnormal event is α∈[0,1], which is the cliff reduction coefficient (e.g., taking 0.2 means that the influence drops by 80% at the moment of recovery), and γ is the long tail dissipation rate. The long tail dissipation rate after recovery is preset (e.g., taking 0.02).

[0080] For example, see Figure 5 The diagram shown is a schematic of the cliff-tail recovery sub-model provided in the embodiments of this application. The horizontal axis represents time t, and the vertical axis represents the recovery factor discount ratio (i.e., residual effect). It shows the composite recovery mechanism in which the residual effect of an event drops instantaneously "cliff-like" after it is cancelled or recovered at the actual end time, accompanied by the dissipation of the slender tail.

[0081] In this way, the natural decay sub-model accurately depicts the exponential decay without intervention through the half-life mechanism, while the cliff-tail recovery sub-model incorporates the instantaneous drop in pathogenicity caused by maintenance recovery actions (such as restarts) and the subsequent slow long-tail dissipation into a unified framework, solving the problem that traditional methods cannot accurately depict complex evolution patterns.

[0082] In this embodiment of the application, the natural decay sub-model in the composite physical decay model determines the first residual expectation corresponding to each time point based on the relationship between each time point in the second start interval and the first start interval; at the same time, the cliff long-tail recovery sub-model in the composite physical decay model determines the second residual expectation corresponding to each time point based on the relationship between each time point in the second start interval and the first end interval.

[0083] Optionally, in this embodiment, since the actual start and end times follow a uniform distribution within their respective intervals, using discrete sampling in the dual continuous space would result in a computational complexity of O(N). 2By utilizing the conditional independence of probability expectation, and fixing the current time t, a fully analytical definite integral derivation is performed using the fundamental theorem of calculus to solve for the residual influence intensity at time t in O(1) complexity. Using the natural decay sub-model in the composite physical decay model, based on the relationship between each time point in the second start interval and the first start interval, the first residual expectation corresponding to each time point is determined. Then, the expectation integral of the natural decay sub-model is performed on the probability distribution at the actual trigger time to obtain the first expectation integral term. Based on the first expectation integral term and the relative positional relationship between each time point in the second start interval and the first start interval, the first residual expectation corresponding to each time point is determined.

[0084] In this embodiment, the first expected integral term is a general probability expected decay expression for the observation time obtained by integrating the probability distribution of the natural decay sub-model over the actual triggering time. The expression for the first expected integral term is:

[0085] By solving the integral, the expression of the first expected integral term is divided into three algebraic analytical expressions according to the position of t:

[0086] Optionally, in this embodiment of the application, when determining the first residual expectation corresponding to each time point based on the relative positional relationship between each time point in the second starting interval and the first starting interval using the first expected integral term, for each time point in the second starting interval, according to the three-segment algebraic analytical expression, there are three cases, as follows: Case 1: When a time point is less than the left endpoint of the first start interval, the first residual expectation of that time point is determined to be 0.

[0087] Here, one time point is any one of the time points within the second start interval. Each time point is a time point after dividing the second start interval into N equal-length sub-intervals (e.g., the number of integration steps N is 20). The division step size Δt = the length of the second start interval / N. The time points are: t k = the left endpoint of the second starting interval + k×Δt, where k=0,1,...,N.

[0088] Case 2: When a point in time is greater than or equal to the left endpoint of the first start interval and less than the right endpoint of the first start interval, the first residual expectation at a point in time is determined based on the physical attenuation rate, the total cumulative attenuation from the left endpoint of the first start interval to a point in time, and the interval length of the first start interval.

[0089] In this embodiment of the application, when a time point is greater than or equal to the left endpoint of the first start interval and less than the right endpoint of the first start interval, the formula for calculating the first residual expectation at that time point is:

[0090] Where λ is the physical decay rate, and t is any time point within the second start-up interval. This is the right endpoint of the first starting interval. This is the left endpoint of the first starting interval.

[0091] Case 3: When a time point is greater than or equal to the right endpoint of the first start interval, the first residual expectation at a time point is determined based on the physical attenuation rate, the difference between the total cumulative attenuation from the left endpoint of the first start interval to a time point and the total cumulative attenuation from the right endpoint of the first start interval to a time point, and the interval length of the first start interval.

[0092] In this embodiment of the application, when a time point is greater than or equal to the right endpoint of the first initiation interval, the formula for calculating the first residual expectation at that time point is:

[0093] In this way, by using analytical formulas instead of approximate numerical integration, the truncation error caused by discretization is avoided, ensuring that the accurate first residual expectation can be output under any time position relationship, thus laying the foundation for the reliability of the final time factor contribution.

[0094] Optionally, in this embodiment, since the actual start and end times follow a uniform distribution within their respective intervals, using discrete sampling in the dual continuous space would result in a computational complexity of O(N). 2 By utilizing the conditional independence of probability expectation, and fixing the current time t, a fully analytical definite integral derivation is performed using the fundamental theorem of calculus to solve for the residual influence intensity at time t in O(1) complexity. Using the cliff-tailed recovery sub-model in the composite physical attenuation model, based on the relationship between each time point in the second start interval and the first end interval, the second residual expectation corresponding to each time point is determined. Then, the expectation integral of the cliff-tailed recovery sub-model is performed on the probability distribution at the actual end time to obtain the second expectation integral term. Based on the relative positional relationship between each time point in the second start interval and the first end interval, the second residual expectation corresponding to each time point is determined using the second expectation integral term.

[0095] In this way, since the actual triggering time and the end time follow a uniform distribution within the interval, by taking the expected integral of the sub-model on the probability distribution, the uncertainty of the "unknown exact time" can be transformed into a definite expected value (first expected integral term, second expected integral term), which provides a theoretical basis for subsequent segmented calculations for different time points. Once the expected integral term is calculated, for any time point under consideration, the residual expectation can be obtained by substituting its position (left, middle, right) relative to the interval into the corresponding algebraic analytical expression, without repeating numerical integration. This greatly improves the efficiency of real-time calculation of the contribution of a large number of events to the time factor in a large-scale microservice architecture, and achieves fast query with O(1) complexity.

[0096] In this embodiment, the second expected integral term is a general probability expectation reduction expression about the observation time obtained by integrating the probability distribution of the cliff long-tail recovery sub-model over the actual termination time. The expression for the second expected integral term is:

[0097] By solving the integral, the expression of the second expected integral term is divided into three algebraic analytical expressions according to the position of t:

[0098] Optionally, in this embodiment, when determining the second residual expectation corresponding to each time point based on the relative positional relationship between each time point in the second starting interval and the first ending interval using the second expected integral term, for each time point in the second starting interval, according to the three-segment algebraic analytical expression, there are three cases, as follows: Case 1: When a time point is less than or equal to the left endpoint of the first termination interval, the second residual expectation of that time point is determined to be 1.

[0099] Case 2: When a time point is greater than the left endpoint of the first termination interval and less than or equal to the right endpoint of the first termination interval, the second residual expectation of a time point is determined based on the distance from a time point to the right endpoint of the first termination interval, the cumulative long-tail dissipation from the left endpoint of the first termination interval to a time point, the cliff reduction factor, the long-tail dissipation rate, and the interval length of the first termination interval.

[0100] In this embodiment of the application, when a time point is greater than the left endpoint of the first end interval and less than or equal to the right endpoint of the first end interval, the formula for calculating the second residual expectation at that time point is:

[0101] Where α is the cliff reduction factor, γ is the long-tail dissipation rate, and t is any time point within the second initiation interval. The right endpoint of the first ending interval. It is the left endpoint of the first ending interval.

[0102] Case 3: When a time point is greater than the right endpoint of the first termination interval, the second residual expectation at a time point is determined based on the difference between the total cumulative long-tail dissipation from the left endpoint of the first termination interval to a time point and the total cumulative long-tail dissipation from the right endpoint of the first termination interval to a time point, the cliff reduction factor, the long-tail dissipation rate, and the interval length of the first termination interval.

[0103] In this embodiment of the application, when a time point is greater than the right endpoint of the first end interval, the formula for calculating the second residual expectation at that time point is:

[0104] This allows the contribution of the time factor to truly distinguish between different failure scenarios such as "recent sudden occurrence", "long tail that has been restarted", and "natural decay", significantly improving the accuracy of root cause analysis.

[0105] Furthermore, in the embodiments of this application, when determining the residual influence intensity corresponding to each time point based on the first residual expectation and the second residual expectation corresponding to each time point, the following operations are performed for each time point: multiply the first residual expectation and the second residual expectation of a time point to obtain the residual influence intensity of that time point.

[0106] The expression for the residual influence intensity at a given time point is as follows:

[0107] For example, see Figure 6 The diagram shown is a schematic of the residual influence intensity provided in the embodiment of this application. The second start interval is to the right of the first end interval. The horizontal axis is time t and the vertical axis is the residual influence intensity. It shows the curve of the combined residual influence intensity generated after the half-life decay and the recovery cliff.

[0108] For example, see Figure 7 The diagram shown illustrates the first scenario of residual impact intensity provided in this embodiment of the application. The corresponding scenario is either a zombie alert or slow degradation, with the line graph data being [1.0, 0.70, 0.45, 0.30, 0.10]. Although the first abnormal event A is active for a long time (with a probability P...),... A (t)=1), but its influence intensity I(t) is continuously suppressed by the physical decay rate λ. When it reaches the window of the second abnormal event B (i.e. the second start interval), it has naturally decayed to a low level of 0.10, thus avoiding the interference of zombie alarms on the root cause graph in the traditional algorithm.

[0109] For example, see Figure 8 The diagram shown illustrates a second scenario of residual impact intensity provided in this embodiment of the application. The corresponding scenario is a recent sudden or high-frequency anomaly, with the line graph data being [1.0, 0.95, 0.90, 0.85, 0.80]. Because the window between the fault triggering time of the first anomaly event A and the second anomaly event B is extremely short, the half-life decay is minimal, maintaining a high impact intensity of 0.80 at time t3, accurately capturing its high confidence as a root cause.

[0110] For example, see Figure 9 The diagram shown illustrates a third scenario of residual impact intensity provided in this embodiment, where the corresponding scenario is service restart or manual intervention, and the line graph data is [1.0, 0.70, 0.15, 0.10, 0.05]. The first abnormal event A occurs at time t. e When recovery is triggered, the cliff-tail recovery sub-model takes effect instantly, causing an instantaneous cliff of influence intensity (from 0.70 to 0.15) with an α-proportion (drop of 80%). Subsequently, it continues to dissipate at a long-tail dissipation rate γ, leaving only a weak influence of 0.05 at time t3, accurately reflecting the blocking effect of the operation and maintenance restart action on fault propagation.

[0111] S22: Based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval, determine the time factor contribution of the first abnormal event to the second abnormal event.

[0112] Optionally, in this embodiment of the application, a possible implementation is provided for determining the time factor contribution of the first anomalous event to the second anomalous event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval. Specifically, the following operations are performed: S220: Using the composite trapezoidal rule, the residual influence intensity corresponding to each time point is cumulatively calculated to obtain the time-series cumulative influence area.

[0113] In this embodiment of the application, the formula for calculating the cumulative area of ​​influence over time is:

[0114] Where Δt is the partitioning step size, I(t0) is the residual influence intensity corresponding to the left endpoint of the second starting interval, and I(t) N ) represents the residual influence intensity corresponding to the right endpoint of the second initiation interval, I(t) k ) represents the residual influence intensity corresponding to the k-th time point in the second start interval.

[0115] S221: Divide the cumulative impact area of ​​the time series by the interval length of the second start interval to obtain the time factor contribution of the first abnormal event to the second abnormal event.

[0116] In this embodiment, the cumulative impact area is divided by the length of the second initiation interval, and then normalized and averaged over time to obtain the time factor contribution of the first anomalous event to the second anomalous event. The expression for calculating the time factor contribution of the first anomalous event A to the second anomalous event B is as follows:

[0117] in, This is the right endpoint of the second starting interval. The left endpoint of the second initiation interval is the time factor contribution, which is within the range of [0,1]. The time factor contribution represents the average probability that the first abnormal event is active and has physical pathogenicity during the occurrence of the second abnormal event.

[0118] In this way, by utilizing the residual influence intensity of discrete sampling points within the second initiation interval, the area under the curve is approximated with high precision to obtain the cumulative influence area of ​​the time series. This area represents the total time factor contribution of the first anomalous event within the entire initiation interval of the second anomalous event. After dividing by the interval length, the resulting time factor contribution is an average probability value between 0 and 1, eliminating the influence of the duration of different events. This allows the time factor contribution to be directly used as an edge weight for weighted fusion with other dimensional features such as topological connectivity and prior degradation factors, or for fair comparison among multiple candidate root causes.

[0119] Furthermore, in this embodiment, after obtaining the time factor contribution of the first abnormal event to the second abnormal event, the time factor contribution is injected as an edge weight into the root cause graph of the root cause analysis task. Based on the root cause graph, the root cause analysis result of the root cause analysis task is determined, thereby improving the accuracy and reliability of the root cause analysis. Specifically, the time factor contribution is injected as an edge weight into the transition probability matrix of the root cause graph of the root cause analysis task. Combining topological association and transaction graph, a recommended ranking list of fault root cause nodes is calculated and output, thereby obtaining the root cause analysis result.

[0120] Additionally, it is worth noting that in this embodiment, the time factor contribution between other abnormal event pairs is also obtained (including the time factor contribution of abnormal event A to abnormal event B, and the time factor contribution of abnormal event B to abnormal event A). The time factor contribution between each abnormal event pair is then injected as an edge weight into the root cause graph of the root cause analysis task, and the root cause analysis result of the root cause analysis task is determined based on the root cause graph.

[0121] Furthermore, an example of a method for determining the contribution of a time factor in an embodiment of this application is given. Assume that the system detects two abnormal events in a microservice anomaly: a first abnormal event A (e.g., the database connection pool is full) and a second abnormal event B (e.g., a downstream service interface response timeout). The first start interval of the first abnormal event is [0, 10], and the first end interval is [30, 40]. The second start interval of the second abnormal event is [20, 30]. The physical attenuation rate is set to λ = 0.05, the cliff reduction factor is set to α = 0.3, the long-tail dissipation rate is set to γ ​​= 0.02, and the number of integration steps is set to N = 20.

[0122] For example, at time point t=25, it is clear that t belongs to the second initiation interval and satisfies the initial screening condition that the first anomalous event has a causal influence on the second anomalous event in the time dimension. Since t=25 is the initiation interval of the first anomalous event A, and since t> the right endpoint of the first initiation interval (i.e., 25>10), the first residual expectation is:

[0123] For the second residual expectation, t=25 is to the left of the first termination interval [30, 40], which means for all possible true termination times t. e For all ∈ [30, 40], t ≤ t e The corresponding second residual expectation at this point is:

[0124] Finally, the residual influence intensity at t=25 is: I(25)=Term1×Term2=0.37171×1=0.37171.

[0125] For example, for t=35, t falls within the first termination interval [30, 40], which represents some possible true termination times t. e The remainder expectation is greater than t, and partially less than t. In this case, the second residual expectation will split into two subintervals for analytical integration:

[0126] When determining the time factor contribution of the first anomalous event A to the second anomalous event B, within the second initiation interval [20, 30], the step size Δt = (30 - 20) / 20 = 0.5, and the calculations are made for t0 = 20, t1 = 20.5, ..., t 20=30, the I(t) values ​​at these 21 time points (I(20)≈0.2897, ..., I(25)≈0.3717, ..., I(30)≈0.4772), then the composite trapezoidal rule is used to accumulate the residual influence intensity corresponding to each time point, and the cumulative influence area of ​​the time series Area≈3.753 is obtained. Finally, the time factor contribution of the first abnormal event A to the second abnormal event B is calculated as: T(A→B) =3.753 / (30-20) =0.3753.

[0127] Furthermore, based on the same technical concept, embodiments of this application provide a device for determining the contribution of a time factor, which is used to implement the above-described method flow of embodiments of this application. For example, see [link to relevant documentation]. Figure 10 As shown, the device 1000 for determining the contribution of the time factor may include: an acquisition module 1001, a first determination module 1002, a second determination module 1003, a screening module 1004, and a root cause analysis module 1005, wherein: The acquisition module 1001 is used to acquire the first start interval and the first end interval of the first abnormal event, and to acquire the second start interval of the second abnormal event, wherein the first start interval is an uncertain time interval containing the actual trigger time of the first abnormal event, and the first end interval is an uncertain time interval containing the actual end time of the first abnormal event. The first determining module 1002 is used to determine the first residual expectation and the second residual expectation corresponding to each time point when it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension, by using a composite physical attenuation model, based on the relationship between each time point in the second start interval and the first start interval and the first end interval, and to determine the residual influence intensity corresponding to each time point based on the first residual expectation and the second residual expectation corresponding to each time point. The first residual expectation represents the expected residual intensity of the fault-induced influence of the first abnormal event at the corresponding time point due to the natural attenuation of the half-life mechanism, and the second residual expectation represents the expected residual intensity of the first abnormal event at the corresponding time point due to the cliff-like drop and long-tail dissipation caused by the operation and maintenance recovery intervention. The second determining module 1003 is used to determine the time factor contribution of the first abnormal event to the second abnormal event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval.

[0128] In an optional embodiment, when obtaining the first start interval and the first end interval of the first abnormal event, and obtaining the second start interval of the second abnormal event, the acquisition module 1001 is further configured to: Obtain the first moment when the first abnormal event was last detected and the second moment when the first abnormal event was detected and the first moment when the first abnormal event was detected and the first moment when the first abnormal event was detected and the second moment, and take the time range from the first moment to the second moment as the first start interval of the first abnormal event; Get the third moment when the first abnormal event was last detected and the fourth moment when the first abnormal event was no longer detected, and take the time range from the third moment to the fourth moment as the first end interval of the first abnormal event. The fifth moment when the second abnormal event was last detected and the sixth moment when the second abnormal event was first detected and the second abnormal event was detected and the sixth moment when the second abnormal event was first detected and the second abnormal event was detected and the time range from the fifth moment to the sixth moment is taken as the second start interval of the second abnormal event.

[0129] In an optional embodiment, the filtering module 1004 is used to: When the left endpoint of the first trigger interval is greater than the right endpoint of the second trigger interval, it is determined that the first anomalous event has no causal influence on the second anomalous event in the time dimension; or, When the right endpoint of the first termination interval is less than the left endpoint of the second initiation interval, and the theoretical maximum residual influence intensity of the first abnormal event on the second abnormal event is less than the residual influence threshold, it is determined that the first abnormal event has no causal influence on the second abnormal event in the time dimension.

[0130] In one optional embodiment, the composite physical attenuation model includes: a natural attenuation sub-model and a cliff-tail recovery sub-model; The natural decay sub-model is: an exponential decay function with the actual triggering time of the first abnormal event as the time origin and the physical decay rate as the decay constant. The physical decay rate is obtained by converting based on the preset physical half-life. The cliff-end long-tail recovery sub-model is a piecewise function with the actual end time of the first abnormal event as the segment node. Before the actual end time, the value of the cliff-end long-tail recovery sub-model is a preset constant. After the actual end time, the cliff-end long-tail recovery sub-model is an exponential decay function with the cliff reduction coefficient as the instantaneous drop ratio and the long-tail dissipation rate as the decay constant. The cliff reduction coefficient represents the proportion of the fault-induced impact that drops sharply after the operation and maintenance recovery operation is performed on the first abnormal event. The long-tail dissipation rate represents the decay rate of the residual fault-induced impact that dissipates over time after the cliff drop.

[0131] In an optional embodiment, when determining the first residual expectation and the second residual expectation corresponding to each time point based on the relationship between each time point within the second start interval and the first start interval and the first end interval using a composite physical attenuation model, the first determining module 1002 is further configured to: The expected integral of the natural decay sub-model at the actual trigger time is performed to obtain the first expected integral term. Based on the relative positional relationship between each time point in the second start interval and the first start interval, the first residual expectation corresponding to each time point is determined using the first expected integral term. The expected integral of the long-tail recovery sub-model of the cliff is performed on the probability distribution at the actual end time to obtain the second expected integral term. Based on the relative positional relationship between each time point in the second start interval and the first end interval, the second residual expectation corresponding to each time point is determined using the second expected integral term.

[0132] In an optional embodiment, when determining the first residual expectation corresponding to each time point based on the relative positional relationship between each time point in the second start interval and the first start interval using the first expected integral term, the first determining module 1002 is further configured to: For each time point within the second start interval, perform the following operations: When a time point is less than the left endpoint of the first start interval, the first residual expectation of that time point is determined to be 0; When a point in time is greater than or equal to the left endpoint of the first start interval and less than the right endpoint of the first start interval, the first residual expectation at a point in time is determined based on the physical decay rate, the total cumulative decay from the left endpoint of the first start interval to a point in time, and the interval length of the first start interval. When a point in time is greater than or equal to the right endpoint of the first start interval, the first residual expectation at a point in time is determined based on the physical decay rate, the difference between the total cumulative decay from the left endpoint of the first start interval to a point in time and the total cumulative decay from the right endpoint of the first start interval to a point in time, and the interval length of the first start interval.

[0133] In an optional embodiment, when determining the second residual expectation corresponding to each time point based on the relative positional relationship between each time point within the second start interval and the first end interval using the second expected integral term, the first determining module 1002 is further configured to: For each time point within the second start interval, perform the following operations: When a time point is less than or equal to the left endpoint of the first termination interval, the second residual expectation of that time point is determined to be 1; When a time point is greater than the left endpoint of the first termination interval and less than or equal to the right endpoint of the first termination interval, the second residual expectation of a time point is determined based on the distance from a time point to the right endpoint of the first termination interval, the total cumulative long-tail dissipation from the left endpoint of the first termination interval to a time point, the cliff reduction factor, the long-tail dissipation rate, and the interval length of the first termination interval. When a time point is greater than the right endpoint of the first termination interval, the second residual expectation at a time point is determined based on the difference between the total cumulative long-tail dissipation from the left endpoint of the first termination interval to a time point and the total cumulative long-tail dissipation from the right endpoint of the first termination interval to a time point, the cliff reduction factor, the long-tail dissipation rate, and the interval length of the first termination interval.

[0134] In an optional embodiment, when determining the time factor contribution of the first abnormal event to the second abnormal event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval, the second determining module 1003 is further configured to: Using the composite trapezoidal rule, the residual influence intensity corresponding to each time point is cumulatively calculated to obtain the time-series cumulative influence area; Divide the cumulative impact area of ​​the time series by the length of the second initiation interval to obtain the time factor contribution of the first abnormal event to the second abnormal event.

[0135] In an optional embodiment, the root cause analysis module 1005 is used to: The contribution of time factors is injected as edge weights into the root cause graph of the root cause analysis task, and the root cause analysis results of the root cause analysis task are determined based on the root cause graph.

[0136] Based on the description of the method and apparatus embodiments above, an exemplary embodiment of the present invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method according to an embodiment of the present invention.

[0137] This application also provides a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this application.

[0138] This application also provides a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this application.

[0139] See Figure 11The diagram below illustrates a structural block diagram of an electronic device 1100 that can serve as a server or client of this application, which is an example of a hardware device that can be applied to various aspects of this application. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0140] like Figure 11 As shown, the electronic device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 1102 or a computer program loaded from storage unit 1108 into random access memory (RAM) 1103. The RAM 1103 may also store various programs and data required for the operation of the device 1100. The computing unit 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0141] Multiple components in electronic device 1100 are connected to I / O interface 1105, including: input unit 1106, output unit 1107, storage unit 1108, and communication unit 1109. Input unit 1106 can be any type of device capable of inputting information to electronic device 1100. Input unit 1106 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 1107 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 1108 may include, but is not limited to, disk and optical disk. Communication unit 1109 allows electronic device 1100 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers and / or chipsets, such as Bluetooth devices, WiFi devices, worldwide interoperability for microwave access (WiMax) devices, cellular communication devices, and / or the like.

[0142] The computing unit 1101 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above. For example, in some embodiments, the above-described method for determining time factor contribution can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1100 via ROM 1102 and / or communication unit 1109. In some embodiments, the computing unit 1101 can be configured to perform the above-described method for determining time factor contribution by any other suitable means (e.g., by means of firmware).

[0143] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0144] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM) or flash memory, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0145] As used in this application, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device, PLD) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0146] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0147] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0148] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other.

[0149] Furthermore, it should be understood that the above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of the invention. Therefore, any equivalent variations made in accordance with the claims of this invention are still within the scope of this application.

Claims

1. A method of determining a contribution of a time factor, characterized in that, include: Obtain the first start interval and the first end interval of the first abnormal event, and obtain the second start interval of the second abnormal event, wherein the first start interval is an uncertain time interval containing the actual trigger time of the first abnormal event, and the first end interval is an uncertain time interval containing the actual end time of the first abnormal event; When it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension, the first residual expectation and the second residual expectation corresponding to each time point are determined by the composite physical decay model based on the relationship between each time point in the second start interval and the first start interval and the first end interval. Based on the first residual expectation and the second residual expectation corresponding to each time point, the residual influence intensity corresponding to each time point is determined. The first residual expectation represents the expected residual intensity of the fault-induced influence of the first abnormal event at the corresponding time point due to the natural decay of the half-life mechanism. The second residual expectation represents the expected residual intensity of the first abnormal event at the corresponding time point due to the cliff-like drop and long-tail dissipation caused by the operation and maintenance recovery intervention. Based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval, the time factor contribution of the first abnormal event to the second abnormal event is determined.

2. The method of claim 1, wherein, The step of obtaining the first start interval and the first end interval of the first abnormal event, and obtaining the second start interval of the second abnormal event, includes: The first moment when the first abnormal event was last detected as being in an inactive state and the second moment when the first abnormal event was first detected as being in an active state are obtained, and the time range from the first moment to the second moment is taken as the first start interval of the first abnormal event. The third moment when the first abnormal event was last detected and the fourth moment when the first abnormal event was no longer detected is obtained, and the time range from the third moment to the fourth moment is taken as the first end interval of the first abnormal event. The fifth moment when the second abnormal event was last detected and the sixth moment when the second abnormal event was first detected and the second abnormal event was detected and the sixth moment when the second abnormal event was detected and the time range from the fifth moment to the sixth moment is taken as the second start interval of the second abnormal event.

3. The method of claim 1, wherein, Before determining the first residual expectation and the second residual expectation corresponding to each time point based on the relationship between each time point within the second initiation interval and the first initiation interval and the first termination interval, when it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension, the method further includes: When the left endpoint of the first trigger interval is greater than the right endpoint of the second trigger interval, it is determined that the first abnormal event has no causal influence on the second abnormal event in the time dimension; or, When the right endpoint of the first termination interval is less than the left endpoint of the second initiation interval, and the theoretical maximum residual influence intensity of the first abnormal event on the second abnormal event is less than the residual influence threshold, it is determined that the first abnormal event does not have a causal influence on the second abnormal event in the time dimension.

4. The method of claim 1, wherein, The composite physical attenuation model includes: a natural attenuation sub-model and a cliff-tail recovery sub-model; The natural decay sub-model is: an exponential decay function with the actual triggering time of the first abnormal event as the time origin and the physical decay rate as the decay constant. The physical decay rate is obtained by conversion based on a preset physical half-life. The cliff-end long-tail recovery sub-model is a piecewise function with the actual end time of the first abnormal event as the segment node. Before the actual end time, the value of the cliff-end long-tail recovery sub-model is a preset constant. After the actual end time, the cliff-end long-tail recovery sub-model is an exponential decay function with the cliff reduction coefficient as the instantaneous drop ratio and the long-tail dissipation rate as the decay constant. The cliff reduction coefficient represents the proportion of the fault-induced impact that drops sharply after the operation and maintenance recovery operation is performed on the first abnormal event. The long-tail dissipation rate represents the decay rate of the residual fault-induced impact that dissipates over time after the sharp drop.

5. The method of claim 4, wherein, The step of determining the first residual expectation and the second residual expectation corresponding to each time point through a composite physical attenuation model, based on the relationship between each time point within the second start interval and the first start interval and the first end interval, includes: The natural decay sub-model is integraled over the probability distribution at the actual triggering time to obtain a first expected integral term. Based on the first expected integral term and the relative positional relationship between each time point in the second start interval and the first start interval, the first residual expectation corresponding to each time point is determined. The expected integral of the cliff long-tail recovery sub-model is performed on the probability distribution of the actual end time to obtain a second expected integral term. Based on the relative positional relationship between each time point in the second start interval and the first end interval, the second residual expectation corresponding to each time point is determined using the second expected integral term.

6. The method of claim 5, wherein, The step of determining the first residual expectation corresponding to each time point based on the relative positional relationship between each time point within the second start interval and the first start interval, using the first expected integral term, includes: For each time point within the second start interval, perform the following operations: When a time point is less than the left endpoint of the first start interval, the first residual expectation of the time point is determined to be 0; When the time point is greater than or equal to the left endpoint of the first start interval and less than the right endpoint of the first start interval, the first residual expectation of the time point is determined based on the physical attenuation rate, the total cumulative attenuation from the left endpoint of the first start interval to the time point, and the interval length of the first start interval. When the time point is greater than or equal to the right endpoint of the first start-up interval, the first residual expectation of the time point is determined based on the physical attenuation rate, the difference between the total cumulative attenuation from the left endpoint of the first start-up interval to the time point and the total cumulative attenuation from the right endpoint of the first start-up interval to the time point, and the interval length of the first start-up interval.

7. The method as described in claim 5, characterized in that, The step of determining the second residual expectation corresponding to each time point based on the relative positional relationship between each time point within the second start interval and the first end interval using the second expected integral term includes: For each time point within the second start interval, perform the following operations: When a time point is less than or equal to the left endpoint of the first end interval, the second residual expectation of the time point is determined to be 1; When a time point is greater than the left endpoint of the first end interval and less than or equal to the right endpoint of the first end interval, the second residual expectation of the time point is determined based on the distance from the time point to the right endpoint of the first end interval, the total cumulative long-tail dissipation from the left endpoint of the first end interval to the time point, the cliff reduction factor, the long-tail dissipation rate, and the interval length of the first end interval. When the first time point is greater than the right endpoint of the first end interval, the second residual expectation of the first time point is determined based on the difference between the total cumulative long-tail dissipation from the left endpoint of the first end interval to the first time point and the total cumulative long-tail dissipation from the right endpoint of the first end interval to the first time point, the cliff reduction factor, the long-tail dissipation rate, and the interval length of the first end interval.

8. The method of claim 1, wherein, The determination of the time factor contribution of the first anomalous event to the second anomalous event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval includes: Using the composite trapezoidal rule, the residual influence intensity corresponding to each time point is cumulatively calculated to obtain the time-series cumulative influence area. Divide the cumulative impact area of ​​the time series by the interval length of the second start interval to obtain the time factor contribution of the first abnormal event to the second abnormal event.

9. The method of claim 1, wherein, After determining the time factor contribution of the first anomalous event to the second anomalous event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval, the method further includes: The contribution of the time factor is injected as an edge weight into the root cause graph of the root cause analysis task, and the root cause analysis result of the root cause analysis task is determined based on the root cause graph.

10. A device for determining the contribution of a time factor, characterized in that, include: The acquisition module is used to acquire the first start interval and the first end interval of the first abnormal event, and to acquire the second start interval of the second abnormal event, wherein the first start interval is an uncertain time interval containing the actual trigger time of the first abnormal event, and the first end interval is an uncertain time interval containing the actual end time of the first abnormal event. The first determining module is used to determine the first residual expectation and the second residual expectation corresponding to each time point when it is determined that the first abnormal event has a causal influence on the second abnormal event in the time dimension, by using a composite physical decay model, based on the relationship between each time point in the second start interval and the first start interval and the first end interval, and to determine the residual influence intensity corresponding to each time point based on the first residual expectation and the second residual expectation corresponding to each time point. The first residual expectation represents the expected residual intensity of the fault-induced influence of the first abnormal event at the corresponding time point due to the natural decay of the half-life mechanism, and the second residual expectation represents the expected residual intensity of the first abnormal event at the corresponding time point due to the cliff-like drop and long-tail dissipation caused by the operation and maintenance recovery intervention. The second determining module is used to determine the time factor contribution of the first abnormal event to the second abnormal event based on the residual influence intensity corresponding to each time point and the interval length of the second initiation interval.

Images