Root cause localization method and apparatus, device and storage medium

Abstract

The present application relates to the technical field of the Internet, and provides a root cause localization method and apparatus, a device and a storage medium. The method comprises: when performing root cause localization, acquiring a timing heterogeneous graph; using attributes of nodes in the timing heterogeneous graph to delete normal nodes and edges connected to the normal nodes in the timing heterogeneous graph; reconstructing the timing heterogeneous graph having undergone the deletion processing, so as to obtain an abnormal sub-graph, wherein reachable edges exist between a failure node and other nodes in the abnormal sub-graph; and determining the root cause of the failure node in the abnormal sub-graph. By using the solution of the present application, the reconstructed abnormal sub-graph not only retains the reachability between the failure node and other nodes, but also reduces the scale of an original node and noise caused by the normal nodes, thereby improving the efficiency and accuracy of root cause localization.

Description

Root cause location method, device, equipment and storage medium

[0001] This application claims priority to Chinese patent application number 202310782549.X, filed on June 28, 2023, entitled “Method, device, apparatus and storage medium for root cause location,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of Internet technology, and in particular to a method, apparatus, device, and storage medium for root cause locating. Background Art

[0003] With the advancement of computer and network technologies, dependencies between nodes have emerged in many scenarios. A single node failure can disrupt the entire business. For example, internet applications are broken down into multiple microservices, each of which has a call relationship with the other. A single microservice failure can render the entire internet application unusable. Efficiently locating the root cause of a node failure is crucial to quickly restore business after a node failure.

[0004] In related technologies, root cause identification involves manually labeling and updating the fault's causal chain. This chain is then used with customized algorithms to determine the root cause. This manual labeling and updating of the causal chain results in low root cause identification efficiency.

[0005] Summary of the Invention

[0006] The present application provides a method, apparatus, device, and storage medium for root cause location, which can improve the efficiency of root cause determination.

[0007] In a first aspect, the present application provides a method for root cause location, the method comprising:

[0008] A time series heterogeneous graph is obtained, which includes nodes, edges and attributes of the nodes, wherein the nodes include an initial fault node. Based on the attributes of the node, normal nodes and edges connected to the normal nodes in the time series heterogeneous graph are deleted, and the deleted time series heterogeneous graph is reconstructed to obtain an abnormal subgraph. There are reachable edges between the current fault node and other nodes in the abnormal subgraph. The current fault node is obtained based on the initial fault node, and the root cause of the initial fault node is determined in the abnormal subgraph.

[0009] In the solution presented in this application, after obtaining a temporal heterogeneous graph, the normal nodes and the edges connecting them are deleted from the temporal heterogeneous graph, and the temporal heterogeneous graph is reconstructed. The resulting abnormal subgraph contains reachable edges between the current faulty node and other nodes. The abnormal subgraph is then used to determine the root cause of the initial faulty node. Because the reconstructed abnormal subgraph not only preserves the reachability of the faulty node and other nodes but also reduces the size of the original node and the noise caused by normal nodes, it can improve the efficiency and accuracy of root cause location.

[0010] In one example, before deleting the normal node, a new faulty node is selected from the neighboring nodes of the initial faulty node, and the new faulty node is used for traversal to obtain the nodes and edges on which the new faulty node depends. The temporal heterogeneous graph is updated based on the obtained nodes and edges, so that the scale of the updated temporal heterogeneous graph is relatively small, reducing the search space for the root cause.

[0011] In one example, before selecting a new faulty node from the neighboring nodes of the initial faulty node, if it is determined that the initial faulty node is not an abnormal node, the new faulty node is determined as the current faulty node. The current faulty node is then used to determine the root cause of the current faulty node in the abnormal subgraph, and the root cause of the current faulty node is determined as the root cause of the initial faulty node. In this way, if the initial faulty node is not an abnormal node, there is no alarm information for the initial faulty node, which may make the determined root cause inaccurate. By re-determining the faulty node, the accuracy of the root cause is improved.

[0012] In one example, after identifying an abnormal subgraph, the topology and node attributes of the abnormal subgraph are used to determine a probability transition matrix for node failures in the abnormal subgraph. Using this probability transition matrix, the random walk probabilities from the current faulty node to other nodes in the abnormal subgraph are determined. The top X nodes in the abnormal subgraph ranked by random walk probabilities, from highest to lowest, are identified as the root causes of the current faulty node, where X is a positive integer. In this way, the probability transition matrix is ​​used to determine the probability of anomaly propagation between nodes, and the random walk probabilities are used to reflect the probability of a node being the root cause.

[0013] In one example, when determining the probability transition matrix, an adjacency matrix for the abnormal subgraph is constructed based on the topological structure of the abnormal subgraph. The characteristics of the edges in the abnormal subgraph are determined based on the attributes of the nodes in the abnormal subgraph. Based on the adjacency matrix, a deep neural network algorithm is used to learn these characteristics and obtain a probability transition matrix for node failures in the abnormal subgraph. In this way, the probability of abnormal propagation between nodes is learned using the deep neural network algorithm.

[0014] In one example, since a node may be the root cause of the problem, before determining the node failure probability transition matrix, self-loop edges are added to each node in the abnormal subgraph, allowing the node to return to itself. Furthermore, to allow energy to flow back during the random walk, reverse edges are added between nodes, allowing energy to flow back between nodes.

[0015] In one example, when reconstructing a post-deletion time series heterogeneous graph, the shortest path between nodes in the post-deletion time series heterogeneous graph is determined. Following this shortest path, edges are added to disconnected nodes in the post-deletion time series heterogeneous graph to obtain the abnormal subgraph. Because the shortest path makes the nodes more compact, the computational effort required to subsequently determine the root cause is relatively small.

[0016] In one example, the timing heterogeneous graph also includes the attributes of the edge. Considering that the node has time attributes, there is generally no root cause in the non-fault time window, so the timing heterogeneous graph is filtered based on the fault time window. Considering that only the nodes and edges on which the initial fault node depends will cause the fault node failure, the timing heterogeneous graph can also include only the nodes and edges on which the fault node depends, and further filter the timing heterogeneous graph, so that the scale of the timing heterogeneous graph is relatively small, the amount of calculation is reduced, and the efficiency of root cause location is improved.

[0017] In one example, the nodes and edges of the time series heterogeneous graph are generated based on the topology and call chains between nodes. The attributes of the nodes are generated based on monitoring indicators, which include one or more of alarms, performance indicators, or logs. In this way, a time series heterogeneous graph can be automatically modeled.

[0018] In a second aspect, the present application provides a root cause location apparatus, which includes at least one module, and the at least one module is used to implement the root cause location method provided in the first aspect or any example of the first aspect.

[0019] In some embodiments, the modules in the root cause location device are implemented by software, and the modules in the root cause location device are program modules. In other embodiments, the modules in the root cause location device are implemented by hardware or firmware.

[0020] In a third aspect, the present application provides a computing device comprising a processor and a memory, wherein the processor is configured to execute instructions stored in the memory so that the computing device performs the root cause location method provided in the first aspect or any one of the examples in the first aspect.

[0021] In a fourth aspect, the present application provides a computer-readable storage medium comprising computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the root cause location method provided in the first aspect or any one of the examples in the first aspect.

[0022] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed by a computing device, enables the computing device to execute the root cause location method provided in the first aspect or any one of the examples in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] FIG1 is a schematic diagram of a timing isomorphic graph provided by an exemplary embodiment of the present application;

[0024] FIG2 is a schematic diagram of a subgraph of a time-series heterogeneous graph provided by an exemplary embodiment of the present application;

[0025] FIG3 is a schematic diagram of a system architecture provided by an exemplary embodiment of the present application;

[0026] FIG4 is a schematic diagram of the structure of a computing device provided by an exemplary embodiment of the present application;

[0027] FIG5 is a flowchart of a root cause location process provided by an exemplary embodiment of the present application;

[0028] FIG6 is a flowchart of a method for root cause location provided by an exemplary embodiment of the present application;

[0029] FIG7 is a schematic diagram of sub-graph reconstruction provided by an exemplary embodiment of the present application;

[0030] FIG8 is a schematic structural diagram of an apparatus for root cause location provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0032] The following is an explanation of some terminology concepts involved in the embodiments of this application.

[0033] 1. Temporal heterogeneous graph

[0034] It is defined as G = (ν, ε, X, Y), where ν represents the node set consisting of the nodes included in the temporal heterogeneous graph, ε represents the edge set consisting of the edges between the nodes, X represents the attribute matrix of the nodes containing time attributes, and Y represents the attribute matrix of the edges.

[0035] A temporally heterogeneous graph is also associated with a node type mapping function φ and an edge type mapping function Correlation, φ is expressed as ν→τ, Expressed as ε→ρ, τ and ρ represent predefined sets of node and edge types, respectively, and the sum of the number of elements in the two sets is greater than 2. For example, as shown in Figure 1, the time series heterogeneous graph of the cloud platform includes seven types of nodes: applications, processes, databases, virtual machines, cloud disks, physical machines, and switches. The time series heterogeneous graph also includes rich interactions between nodes, such as virtual machines deployed on physical machines.

[0036] 2. Subgraph extraction of temporal heterogeneous graphs

[0037] Given a temporal heterogeneous graph G = (ν, ε, X, Y), a subgraph extracted from the temporal heterogeneous graph is also a temporal heterogeneous graph. For example, see Figure 2. In the temporal heterogeneous graph shown in Figure 1, the portion marked by the dashed box can be considered a subgraph of the temporal heterogeneous graph. In Figure 2, the extracted subgraph only includes one virtual machine and two cloud disks.

[0038] 3. Root Cause Location in Time Series Heterogeneous Graphs

[0039] Given a temporal heterogeneous graph G = (ν, ε, X, Y) and a faulty node u, the goal is to learn a root cause score function f(·) such that for any node A belonging to ν, S A =f(A), and S A This reflects the probability that node A is the root cause of the faulty node. By ranking the probabilities corresponding to all nodes, at least one of the top-ranked nodes is considered to be the root cause of the faulty node.

[0040] 4. Random walk is used to represent irregular changes. After the random walk, a series of random trajectories will be generated.

[0041] The background of this application is described below.

[0042] Currently, root cause location of cloud platform failures has attracted widespread attention. Different O&M scenarios, such as storage, cloud, and wireless networks, often require different business domain knowledge. The available O&M data is also inconsistent and incomplete. This requires current root cause location methods to be closely integrated with the business, making them difficult to migrate to other scenarios. Therefore, a universal root cause location framework is needed to model and address root cause location issues in different scenarios.

[0043] Furthermore, the use of microservice architectures is becoming increasingly widespread, and the scale of cloud platforms is also growing rapidly. This growth includes not only the number of microservices but also the expansion of infrastructure components, such as virtual machines, physical machines (such as servers), switches, and cloud disks. Existing operations and maintenance scenarios can often be abstracted as large-scale, time-series, heterogeneous graphs containing multiple nodes and relationships, with objects at different levels experiencing varying frequencies of change. However, existing computing frameworks are often very time-consuming to process large-scale graph data. For users and operations personnel, the timeliness of root cause identification is crucial. Therefore, root cause identification methods must consider both time consumption and accuracy.

[0044] Based on this, this application provides a root cause location method that can be abstracted to root cause location in actual operation and maintenance scenarios using a time-series heterogeneous graph, such as cloud platform scenarios. This method can be performed by a root cause location device. This device can be a hardware device, such as a computing device like a server or terminal. The server can be a cloud server or a local server. The device can also be a software device, such as a software program running on a hardware device.

[0045] The following introduces the system architecture provided by the embodiments of the present application.

[0046] Figure 3 provides a schematic diagram of a system architecture that includes a database and a root cause location device. In a cloud platform scenario, the database can include a graph database and a time series database. Alarms, call chains, topology structures, and logs can be stored in the graph database, while performance indicators can be stored in the time series database. For example, this data can be stored in the database in the form of data queues. The root cause location device obtains data from the database to construct a time series heterogeneous graph and constructs the time series heterogeneous graph. The root cause location device then performs root cause location processing. In another example of a cloud platform scenario, the database stores a time series heterogeneous graph, and the root cause location device obtains the time series heterogeneous graph from the database to perform root cause location processing.

[0047] In one example, as shown in Figure 3, the system architecture also includes a training device for training and updating a root cause prediction model used in root cause location. The training device also provides a query interface for users to query model training progress and a user feedback interface for users to confirm training completion.

[0048] In one example, referring to FIG3 , the system architecture further includes a monitoring module, which determines whether the model performance of the root cause positioning processing meets the requirements based on the positioning results of the root cause positioning device, and notifies the training device to retrain the model if the requirements are not met.

[0049] The hardware structure of the above computing device is introduced below.

[0050] As shown in Figure 4 , computing device 400 may be implemented using a general bus architecture. Computing device 400 includes at least one processor 401, a communication bus 402, a memory 403, and at least one network interface 404. The computing device shown in Figure 4 is the root cause location apparatus shown in Figure 3 .

[0051] The processor 401 is, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 401 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0052] Communication bus 402 is used to transmit information between the above components. Communication bus 402 can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in Figure 4, but this does not mean that there is only one bus or one type of bus.

[0053] The memory 403 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 403 is, for example, independent and connected to the processor 401 via the communication bus 402. The memory 403 can also be integrated with the processor 401.

[0054] Optionally, the memory 403 is used to store the topology structure and call chain mentioned below. When the computing device 400 needs to use the topology structure and call chain, the processor 401 accesses the memory 403 to obtain the topology structure and call chain stored in the memory 403.

[0055] Network interface 404 uses any transceiver or other device for communicating with other devices or communication networks. Network interface 404 includes a wired network interface and may also include a wireless network interface. A wired network interface may be, for example, an Ethernet interface. An Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. A wireless network interface may be a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0056] In a specific implementation, as an example, the processor 401 may include one or more CPUs.

[0057] In a specific implementation, as an example, the computing device 400 may include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0058] In some embodiments, the memory 403 is used to store program code 4031 for executing the root cause location method of the present application, and the processor 401 executes the program code 4031 stored in the memory 403. In other words, the computing device 400 can implement the root cause location method provided in the method embodiment through the processor 401 and the program code 4031 in the memory 403.

[0059] Before describing the root cause location method flow in this embodiment, let's briefly introduce the flowchart of this application. See Figure 5. In this application, the input is a temporal heterogeneous graph and an initial fault node, or data used to generate a temporal heterogeneous graph and an initial fault node. The output is the root cause of the initial fault node. This method primarily consists of three stages: data processing to obtain a temporal heterogeneous graph, subgraph extraction to obtain an abnormal subgraph, and root cause location based on the abnormal subgraph. These three stages correspond to steps 601 to 605 described below.

[0060] The data processing phase for obtaining a heterogeneous time series graph includes module selection, anomaly detection, and graph modeling. Module selection selects different modules based on different input data. This is optional. Module selection selects different modules based on different scenarios and input data. For example, when the input data only includes topology, alerts, and call chains, the executed modules do not include anomaly detection or supervised prediction. When a heterogeneous time series graph can be directly obtained, anomaly detection and graph modeling are also optional.

[0061] The subgraph extraction phases for obtaining abnormal subgraphs include: subgraph generation, entry node refresh, and subgraph reconstruction. Subgraph generation is optional and is used to filter the temporal heterogeneous graph. Entry node refresh is also optional and is used to redefine new fault nodes in the temporal heterogeneous graph and perform breadth-first search based on these new fault nodes. Subgraph reconstruction is used to obtain abnormal subgraphs.

[0062] The root cause location phases based on the abnormal subgraph include: node embedding, probability determination, and node sorting. Node embedding embeds the attributes of nodes in the abnormal subgraph into vectors. Probability determination uses the root cause prediction model to determine the random walk probability of each node. Node sorting ranks the random walk probabilities of the nodes from highest to lowest, identifying the top X nodes (where X is a positive integer) as the root causes of the initial fault.

[0063] In the microservice scenario, the data required for the above different processing is different. See Table 1. When the root cause prediction model is a supervised model, historical fault history is used to train the root cause prediction model. When the root cause prediction model is an unsupervised model, the topology structure and call chain summary are used to obtain the root cause.

[0064] Table 1

[0065] The following describes the root cause location method flow in conjunction with Figure 6. Referring to steps 601 to 605 in Figure 6, the execution subject of the method flow may be the computing device 400 described in Figure 4. In Figure 6, the root cause location method in a cloud platform scenario is used as an example for description.

[0066] Step 601: Obtain a time series heterogeneous graph, which includes nodes, edges, and attributes of the nodes.

[0067] In this embodiment, when root cause location is performed, a database stores a time series heterogeneous graph, and the computing device obtains the time series heterogeneous graph from the database. For example, if the scale of the platform has not changed and this is not the first time root cause location is performed, the database already stores the time series heterogeneous graph corresponding to the platform.

[0068] Alternatively, if a time series heterogeneous graph is not currently constructed, the computing device obtains the topology structure and the call chain between nodes. The topology structure includes nodes and the connection relationships between nodes. The call chain between nodes refers to the call relationship between nodes. The computing device determines the nodes from the topology structure and uses the call chain between nodes to determine the direction relationship between the edges of the nodes. For example, if node A calls node B, the edge between node A and node B is node A pointing to node B.

[0069] The time series heterogeneous graph obtained by the computing device includes an initial fault node, which is an input fault node with a fault. The purpose of root cause location is to determine the root cause of the initial fault node.

[0070] The computing device obtains monitoring indicators, which include one or more of alarms, performance indicators or logs. For example, in the cloud platform scenario, performance indicators include CPU utilization, memory occupancy and number of call failures. Alarms include one or more of the number of call failures exceeding a threshold, the CPU exceeding a threshold or the memory occupancy exceeding a threshold. Each alarm has multiple levels, including emergency, important, warning and normal, and the urgency of different levels is different. In order to facilitate root cause location in the following text, the anomalies determined based on performance indicators and / or logs are unified as alarms. In this way, after the anomaly is determined, the anomaly is associated with the corresponding node or edge as an alarm. The attributes of the node are the alarms that exist for the node, and the attributes of the edge are the alarms that exist for the edge.

[0071] There are many types of anomalies. The following provides four possible anomalies: (1) Peak increase, which refers to a sudden increase in the indicator; (2) Peak decrease, which refers to a sudden decrease in the indicator; (3) Horizontal shift, which refers to a significant increase in the indicator over a period of time, such as an increase exceeding the first threshold; (4) Horizontal shift, which refers to a significant decrease in the indicator over a period of time, such as a decrease exceeding the second threshold. Considering the large amount of data on the cloud platform, a detector may not be able to detect all types of anomalies. In order to detect all types of anomalies in performance indicators, computing devices can use an anomaly detection model to perform anomaly detection. This anomaly detection model integrates unsupervised detection models with low time complexity, such as Prophet, robust seasonal-trend decomposition (Robust STL), and 3σ. In this anomaly detection model, as long as one of the detected anomalies is considered an anomaly, it is considered an anomaly.

[0072] When the monitoring indicators include logs, the computing device parses the logs and extracts log events from the logs. For example, the computing device can use a log parsing model to drain the stream parsed logs. The computing device then embeds the log events to obtain an embedding vector for the log events. For example, the computing device embeds the log events into vectors, that is, the computing device uses pre-trained global vectors (glob) for word embedding and uses term frequency-inverse document frequency (TF-IDF) for sentence embedding. The computing device then inputs the embedding vector of the log event into a prediction model to obtain an anomaly score for the log event, and determines log events whose anomaly score exceeds a threshold as anomalies. For example, the prediction model can be a deep support vector data description (SVDD) model based on a multi-layer perceptron.

[0073] Step 602: In the time series heterogeneous graph, obtain the nodes and edges that the initial fault node depends on within the fault time window through breadth-first search traversal, and update the time series heterogeneous graph based on the obtained nodes and edges.

[0074] In this embodiment, to reduce the size of a temporal heterogeneous graph, the graph can be filtered using a fault time window. The fault time window refers to a period of time that may cause a fault at the initial fault node. Events occurring within the non-fault time window cannot be the root cause of the initial fault node. The temporal heterogeneous graph also includes edge attributes, which include time information. For example, if a node is a microservice, the time information in the edge attributes is the microservice call time period. The node attributes also include time information. The computing device deletes nodes and edges from the temporal heterogeneous graph that are not within the fault time window. Then, within the deleted temporal heterogeneous graph, the computing device performs a breadth-first search traversal starting from the initial fault node to obtain the nodes and edges on which the initial fault node depends. The computing device retains the nodes and edges on which the initial fault node depends in the temporal heterogeneous graph and deletes the nodes and edges on which the initial fault node does not depend from the temporal heterogeneous graph. This allows filtering of the temporal heterogeneous graph to reduce the computational complexity of root cause location.

[0075] It should be noted that the time series heterogeneous graph is a directed graph, so when performing a breadth-first search traversal from the initial fault node, some nodes will not be traversed, and are not the nodes that the initial fault node depends on.

[0076] It should also be noted that the embodiments of the present application are described using breadth-first search as an example, and other search methods may also be used for traversal, such as breadth-first search.

[0077] Step 603: Select a new faulty node from the neighboring nodes of the initial faulty node, obtain the nodes and edges that the new faulty node depends on in the temporal heterogeneous graph through breadth-first search traversal, and update the temporal heterogeneous graph based on the obtained nodes and edges.

[0078] In this embodiment, the computing device identifies nodes directly connected to the initial fault node in a temporal heterogeneous graph as neighbor nodes. If a neighbor node's attributes indicate an abnormal alarm, the neighbor node is identified as an abnormal node. If an abnormal node exists among the neighbor nodes, the node with the most abnormal alarms is selected and identified as the new fault node. For example, in a microservices scenario, the neighbor node with the most failed calls is identified as the new fault node. A breadth-first search is then used to traverse the temporal heterogeneous graph to obtain the nodes and edges on which the new fault node depends. The nodes and edges on which the new fault node depends are retained in the temporal heterogeneous graph, while the remaining nodes and edges are deleted from the temporal heterogeneous graph, thereby updating the temporal heterogeneous graph. In this way, updating the temporal heterogeneous graph using the new fault node reduces its size and conserves processing resources for root cause identification.

[0079] It should be noted that, when the alarm of the initial fault node is not normal, the initial fault node is an abnormal node, and step 603 may be executed or not. Executing step 603 can make the scale of the time series heterogeneous graph smaller.

[0080] When the alarm of the initial fault node is normal and there is an abnormal node among the neighboring nodes of the initial fault node, the initial fault node is not an abnormal node, and step 603 can be executed, and the new fault node determined in step 603 is updated as the current fault node. In this way, when the root cause is subsequently located, the alarm in the vector of the current fault node is not a zero vector, which can make the determined root cause more accurate.

[0081] It should also be noted that step 602 and step 603 are optional steps, that is, step 602 and step 603 may not be performed.

[0082] Step 604: based on the attributes of the node, delete the normal node and the edge connected to the normal node in the time series heterogeneous graph, reconstruct the deleted time series heterogeneous graph, and obtain an abnormal subgraph. There are reachable edges between the current faulty node and other nodes in the abnormal subgraph.

[0083] In this embodiment, after acquiring a temporal heterogeneous graph, the computing device identifies nodes that have been reported as normal as normal nodes, then determines the edges connected to the normal nodes and deletes the normal nodes and the edges connected to them from the temporal heterogeneous graph, thereby obtaining a post-deletion temporal heterogeneous graph. If there are nodes in the post-deletion temporal heterogeneous graph that are not connected to edges, the computing device adds edges to these nodes according to a certain rule, ensuring that the current faulty node has a reachable edge with every other node, thereby obtaining an abnormal subgraph. For example, in Figure 7, the left side shows the temporal heterogeneous graph, with white nodes representing normal nodes and black nodes representing abnormal nodes. The right side shows the abnormal subgraph, which only includes abnormal nodes. This way, the abnormal subgraph not only preserves the reachability between the current faulty node and the abnormal nodes, but also reduces the size of the temporal anomaly graph and the noise caused by normal nodes due to the absence of normal nodes. Here, a reachable edge exists between the current faulty node and every other node. This edge can be a direct connection or an edge connected through an intermediate abnormal node, meaning that the current faulty node can reach every other node.

[0084] In step 604, when the initial fault node is an abnormal node, the current fault node is the initial fault node; when the initial fault node is not an abnormal node, the current fault node is a neighbor node of the initial fault node.

[0085] In one example, in step 604, a minimum spanning tree-like algorithm may be used to reconstruct the abnormal subgraph, as follows:

[0086] The shortest path between nodes in the deleted temporal heterogeneous graph is determined, and edges are added to the disconnected nodes in the deleted temporal heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

[0087] In this embodiment, the computing device calculates multiple paths between any two nodes in the deleted temporal heterogeneous graph. The paths between each pair of nodes are summed to obtain the sum of the multiple paths between the abnormal nodes in the temporal heterogeneous graph. The sum of the multiple paths is sorted in ascending or descending order to determine the shortest path. The computing device then adds edges to the disconnected nodes in the temporal heterogeneous graph along the shortest path, ensuring that the current faulty node has a reachable edge to any other node, thereby obtaining the abnormal subgraph.

[0088] In the embodiment of the present application, in the microservice call scenario, an algorithm pseudo code for obtaining an abnormal subgraph using a time series heterogeneous graph is also provided:

[0089] Input: graph G, source node u

[0090] Output: New graph New source node (Output:new graph new source node u)

[0091] Initialize

[0092] while true do

[0093] map

[0094] For all v belonging to τ u Execute (for allv∈τ u do), where τ u Represents the neighbor nodes of u.

[0095] If v is abnormal then

[0096] Sabnormal[v] = number of failed calls

[0097] End if statement (end if)

[0098] End for statement (end for)

[0099] m = the maximum number of failed calls v in Sabnormal

[0100] If u is abnormal and length Sabnormal == 1 then

[0101] u=m

[0102] If u is a normal node and the number of elements in the Sabnormal set is greater than 0, execute (else if u is abnormal and length Sabnormal>0 then)

[0103] u=m

[0104] Else break

[0105] End if statement (end if)

[0106] End while statement (end while)

[0107] in, Express Perform a breadth-first search traversal and get

[0108] return (return ).

[0109] Among them, graph G is a time-series heterogeneous graph, the source node is the initial fault node, and the new source node is the new fault node.

[0110] Step 605: Determine the root cause of the initial fault node in the abnormal subgraph.

[0111] In this embodiment, after obtaining the abnormal subgraph, the computing device embeds the nodes in the abnormal subgraph into a vector in order to support the subsequent root cause prediction model, which can also be understood as encoding the node into a vector. For example, the node type and the node attribute are embedded by one-hot encoding. When embedding, the dimension of the vector of each node is the same. For example, the attribute of the node is the alarm of the node. If the abnormal subgraph includes 6 types of nodes, each node has 20 types of alarms, and each alarm is divided into multiple levels (such as emergency, important, warning and normal), the length of the vector of each node is 6+20*4=86. In the case where the current fault node is the initial fault node, the computing device uses the initial fault node and the random walk algorithm to calculate the probability that all nodes in the abnormal subgraph are the root cause of the initial fault node, and the top X nodes with the highest probability are determined as the root cause of the initial fault node. If the current faulty node is not the initial faulty node, the computing device uses the current faulty node and a random walk algorithm to calculate the probability that all nodes in the abnormal subgraph are the root cause of the current faulty node, and determines the top X nodes with the highest probabilities as the root cause of the current faulty node. The root cause of the current faulty node is then determined as the root cause of the initial faulty node. The random walk algorithm may be a supervised random walk algorithm.

[0112] In one example, in step 605, when determining the random walk probability, a multi-layer neural network is used to learn the probability of abnormal propagation between nodes, and random walks are simulated with the support of energy vectors and probability transfer matrices to determine the probability of each node being the root cause. The exemplary process is as follows:

[0113] Based on the topological structure and node attributes of the abnormal subgraph, a probability transfer matrix of node failure in the abnormal subgraph is determined. Based on the probability transfer matrix, the random walk probability from the current faulty node to other nodes in the abnormal subgraph is determined. The top X nodes in the abnormal subgraph with the highest random walk probability in descending order are determined as the root causes of the current faulty node, where X is a positive integer.

[0114] In this embodiment, for nodes i and j in an abnormal subgraph, where i and j are both less than or equal to the number of nodes in the abnormal subgraph, the computing device uses the abnormal subgraph's topology and node attributes to determine the probability that node i's failure is caused by node j, obtaining the value of the element in the i-th row and j-th column of the probability transfer matrix. Based on this approach, the computing device determines the probability transfer matrix for node failures in the abnormal subgraph and normalizes the probability transfer matrix. The computing device initializes the energy vector of the current faulty node, which can be set to 1, and initializes the energy vectors of other nodes, which can be set to 0. The computing device determines the random walk probability from the current faulty node to other nodes through a random walk of length k. The random walk probability is equal to the product of the energy vector of the current faulty node and p times p. The random walk probability is used to simulate a random walk of length k. k can be set as needed, for example, k is 10, and p is an element in the probability transfer matrix. The computing device sorts the random walk probabilities in the abnormal subgraph from large to small, and determines the top X nodes as the root causes of the current fault node. X can be set according to an empirical value, for example, X is set to 1.

[0115] In addition, in order to make the root cause of the current fault node more accurate, the node with a random walk probability higher than a certain threshold among the X nodes is determined as the root cause of the current fault node.

[0116] It should be noted that the current fault node here is the initial fault node, or the new fault node mentioned above.

[0117] In one example, a computing device may use the adjacency matrix of an abnormal subgraph to determine a probability transition matrix, construct an adjacency matrix of the abnormal subgraph based on the topological structure of the abnormal subgraph, determine the characteristics of the edges in the abnormal subgraph based on the attributes of the nodes in the abnormal subgraph, and use a deep neural network algorithm to learn the characteristics based on the adjacency matrix to obtain a probability transition matrix of node failures in the abnormal subgraph.

[0118] In this embodiment, the adjacency matrix of the abnormal subgraph is represented as A. Assuming that the abnormal subgraph includes N nodes, N is greater than or equal to 2, and A is an N×N matrix. Assuming that there is no edge between the i-th node and the j-th node, the element Ai,j in the i-th row and j-th column takes a value of 0. Assuming that there is an edge from the i-th node to the j-th node between the i-th node and the j-th node, the element in the i-th row and j-th column takes a value of 1. Assuming that there is no edge from the i-th node to the j-th node between the i-th node and the j-th node, but there is an edge from the j-th node to the i-th node, then the element in the i-th row and j-th column takes a value of 0. The computing device constructs the adjacency matrix of the abnormal subgraph based on this method.

[0119] The computing device then inputs the node attributes into a graph convolutional network (GCN) to obtain node features. The features of the nodes at both endpoints of each edge are concatenated to obtain the features of each edge. For example, the features of the i-th node are represented as G(i), the features of the j-th node are represented as G(j), and the features of the edge between the i-th node and the j-th node are represented as the matrix [G(i), G(j)]. For example, assuming the features of the i-th node are an a×b matrix and the features of the j-th node are an a×b matrix, the concatenation of the features of the i-th node and the j-th node results in an a×2b matrix. The computing device multiplies the features of each edge by the adjacency matrix to obtain a product matrix. This product matrix is ​​input into the deep neural network algorithm, and the output is the probability transition matrix of node failures in the abnormal subgraph.

[0120] In addition, the present invention also provides a process for training a deep neural network algorithm, given an abnormal subgraph, and specifying the fault node in the abnormal subgraph, as well as the root cause of the fault node. And also given an initial GCN and an initial deep neural network algorithm, the energy vector δ and The δ of the faulty node is 1, and the δ of other nodes is 0. =1 / RC, RC represents the number of root causes. For a faulty node, there may be multiple root causes. The computing device uses the initial GCN to extract the features of each node and concatenates the node features to obtain the features of the edges between the nodes. The computing device uses the initial deep neural network algorithm to learn the features of each edge, and then simulates a random walk of length k by multiplying δ by k times p to obtain the predicted result, that is, the predicted random walk probability. The cosine function is used to calculate the difference between the predicted result and the actual result. Based on the difference, the initial GCN and initial deep neural network algorithms are updated until the predicted results are consistent with the actual results. If the difference between them is less than a certain value, or the number of updates reaches a certain threshold, it is determined that the training of the CGN and deep neural network algorithms is completed, and the GCN and deep neural network algorithms form a root cause prediction model.

[0121] In addition, GCN and deep neural network algorithms can also be trained separately.

[0122] In one example, since the root cause of a node may be the node itself, before determining the node failure probability transfer matrix, a self-loop edge is added to each node in the abnormal subgraph so that the edge starts from the node and returns to itself.

[0123] In addition, in order to allow energy to flow back during the random walk, reverse edges between nodes are added between nodes so that the energy between nodes can flow back.

[0124] In one example, after the root cause of the initial fault node is determined, the root cause prediction model may be iteratively updated using the root cause of the initial fault node.

[0125] In an embodiment of the present application, a pseudo code of an algorithm for determining the root cause of a faulty node using an abnormal subgraph is also provided:

[0126] Input: graph G1 with N nodes, source node u, root causes set RC corresponding to node u (only training), random walk length k

[0127] Output: score for each node (that is, the random walk probability of each node)

[0128] Preform first-order GCN convolution on G1, G[u] represents the embedded feature of node u

[0129] Adding self-loops and reverse edges to G1

[0130] Initialize the energy vector δ, Adjacency matrix A(Initialize energy vectorδ, adjacent matrix A)

[0131] δ[u]=1

[0132] For all i∈RC do

[0133] Ending a for loop (end for)

[0134] Probability transfer matrix (transfer matrix) P ij=DNN([G(i),G(j)]*A ij )

[0135] P ij =soft max(sigmoid(P ij )), P ij =soft max(sigmoid(P ij )) indicates that the probability transfer matrix is ​​normalized.

[0136] δ=δ·p k

[0137] If training then

[0138] Denotes δ and The loss is equal to 1 minus δ and The cosine distance.

[0139] End if loop (end if)

[0140] Return

[0141] Among them, graph G1 is the abnormal subgraph, and the source node is the current fault node.

[0142] In this embodiment, while extracting abnormal subgraphs, the reachability of faulty and abnormal nodes is preserved, significantly reducing the size of the heterogeneous temporal graph and the noise caused by normal nodes during the execution of the root cause location algorithm. Furthermore, a supervised random walk algorithm combined with a graph neural network is provided. This algorithm requires only a small amount of training data containing faulty nodes and root causes to learn the probability of anomaly propagation between nodes, and then determines the random walk probability of each node being the root cause through random walks.

[0143] In addition, since most operation and maintenance scenarios can be modeled using time-series heterogeneous graphs, the embodiments of the present application can be applied to a variety of operation and maintenance scenarios, have certain universality, and strong generalization capabilities. For example, it can be applied to operation and maintenance platforms such as storage, cloud, and wireless networks.

[0144] In the embodiments of the present application, in order to better demonstrate the advantages of the embodiments of the present application, experiments were conducted on a cloud platform and the artificial intelligence for operations 2000 (AIOps2020) dataset to verify the corresponding beneficial effects of the present application, which are specifically described from the following aspects:

[0145] 1. Baseline Model: AutoMap dynamically generates fault correlations using various types of time series metrics and designs heuristic models using forward, self-directed, and reverse random walk algorithms to diagnose root causes. It also supports the use of historical faults to calculate the global weight of metrics. Groot constructs a temporal causal relationship graph based on the dependency graph, summarizing various types of metrics, logs, and the expertise of site reliability engineers (SREs). It locates the root cause of faults based on a personalized PageRank.

[0146] 2. Dataset: Create artificial anomaly events. Artificial anomaly events are generated as follows: For each event, select c (in the following experiments, consider c = 1, 2, or 3) entities from the event. For each target entity, select s other entities, where s is a positive integer, and calculate the Euclidean distance between their attribute vectors x_i and the target attribute vector x of the target entity. Then, select the node with the largest Euclidean distance to replace the target entity.

[0147] Performance Description: On most cloud platforms, some faults may have multiple root causes. When multiple root causes exist, traditional precision, recall, and F1 scores cannot accurately measure prediction accuracy. This application uses root cause precision (S) to evaluate the accuracy of all models.

[0148] Among them, I is the set of all abnormal events, R i is the set of real root causes, P i Is a set of predicted root causes (length equal to R i ), the overall performance of the embodiment of the present application and the baseline model on the hybrid cloud platform is shown in Tables 2 and 3, and the overall performance on the AIOps2020 dataset is shown in Table 4. In Table 2, the embodiment of the present application executes the complete process shown in Figure 6 and also has the baseline model execute step 604. In Table 3, the embodiment of the present application does not execute step 604 in Figure 6. In Table 4, the embodiment of the present application does not execute step 604 in Figure 6.

[0149] Table 2

[0150] Table 3

[0151] Table 4

[0152] From Tables 2 to 4, it can be seen that the performance of the root cause accuracy S is much better than all baseline models, which proves the effectiveness of the solution in the embodiment of the present application. For all methods, it is assumed that the length of the random walk (number of PageRank iterations) is set to 10, and 10 samples are randomly selected as historical faults for each fault type (less than 2% of the total sample size). Table 2 summarizes the experimental results on the hybrid cloud dataset. It can be seen that the solution in the embodiment of the present application achieved the best results in all categories of faults.

[0153] Comparing Table 2 and Table 3, we can also see that deleting normal nodes and the edges connecting normal nodes, as well as reconstructing the subgraph can significantly improve the accuracy of root cause location.

[0154] As can be seen from Table 4, the root cause accuracy of the solution in the embodiment of the present application far exceeds that of AutoMap and Groot. This also shows that the solution in the embodiment of the present application can adapt to different operation and maintenance scenarios and accurately diagnose the root cause of the fault.

[0155] The following describes the root cause location apparatus provided by the present application.

[0156] Figure 8 is a structural diagram of a root cause location device provided in an embodiment of the present application. The device can be implemented as part or all of the device through software, hardware, or a combination of both. The device provided in an embodiment of the present application can implement the processes shown in Figures 5 and 6 of the embodiment of the present application. The device includes: a graph modeling module 810, a subgraph extraction module 820, and a root cause location module 830, wherein:

[0157] A graph modeling module 810 is used to obtain a time series heterogeneous graph, which includes nodes, edges, and attributes of the nodes. The nodes include the initial fault node. Specifically, the graph modeling module 810 can be used to implement the graph modeling function of step 601 and execute the implicit steps included in step 601.

[0158] The subgraph extraction module 820 is configured to delete normal nodes and edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, reconstruct the time series heterogeneous graph after deletion, and obtain an abnormal subgraph. In the abnormal subgraph, there are reachable edges between the current faulty node and other nodes. The current faulty node is obtained based on the initial faulty node. Specifically, the module can be used to implement the subgraph extraction of step 604 and execute the implicit steps included in step 604.

[0159] The root cause location module 830 is used to determine the root cause of the initial fault node in the abnormal subgraph, and can be specifically used to implement the root cause location function of step 605 and execute the implicit steps included in step 605.

[0160] In one example, the subgraph extraction module 820 is further configured to:

[0161] Before deleting the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, a new faulty node is selected from the neighboring nodes of the initial faulty node, where the new faulty node is an abnormal node;

[0162] In the temporal heterogeneous graph, obtaining nodes and edges on which the new fault node depends by traversing the graph through breadth-first search;

[0163] The temporal heterogeneous graph is updated based on the obtained nodes and edges.

[0164] In one example, the subgraph extraction module 820 is further configured to: before selecting a new faulty node from neighboring nodes of the initial faulty node, determine that the initial faulty node is not an abnormal node;

[0165] The root cause location module 830 is configured to:

[0166] Based on the current fault node, determining a root cause of the current fault node in the abnormal subgraph, the current fault node being the new fault node;

[0167] The root cause of the current faulty node is determined as the root cause of the initial faulty node.

[0168] In one example, the root cause location module 830 is configured to:

[0169] Determine a probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph;

[0170] Determine, based on the probability transfer matrix, a random walk probability from the current faulty node to other nodes in the abnormal subgraph;

[0171] The top X nodes in the abnormal subgraph that are ranked in descending order by random walk probability are determined as the root causes of the current fault node, where X is a positive integer.

[0172] In one example, the root cause location module 830 is configured to:

[0173] Constructing an adjacency matrix of the abnormal subgraph based on the topological structure of the abnormal subgraph;

[0174] Determining features of edges in the abnormal subgraph based on attributes of nodes in the abnormal subgraph;

[0175] Based on the adjacency matrix, a deep neural network algorithm is used to learn the features to obtain a probability transition matrix of node failures in the abnormal subgraph.

[0176] In one example, the root cause location module 830 is further configured to:

[0177] Before determining the probability transfer matrix of node failure in the abnormal subgraph, self-loop edges and reverse edges between nodes are added to each node in the abnormal subgraph.

[0178] In one example, the subgraph extraction module 820 is configured to:

[0179] Determine the shortest path between nodes in the time series heterogeneous graph after the deletion process;

[0180] Add edges to the disconnected nodes in the deleted time series heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

[0181] In one example, the temporal heterogeneous graph further includes attributes of the edges; and the subgraph extraction module 820 is further configured to:

[0182] Before deleting the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, traversing the time series heterogeneous graph to obtain the nodes and edges that the faulty node depends on within the fault time window by using a breadth-first search;

[0183] Based on the obtained nodes and edges, the temporal heterogeneous graph is updated.

[0184] In one example, the graph modeling module 810 is configured to:

[0185] Based on the topological structure and the call chains between the nodes, the nodes and edges of the temporal heterogeneous graph are generated;

[0186] Based on monitoring indicators, attributes of the node are generated, where the monitoring indicators include one or more of alarms, performance indicators, or logs.

[0187] Embodiments of the present application also provide a computer program product containing instructions. This computer program product can be software or a program product containing instructions that can be run on a computing device or stored on any available medium. When this computer program product is run on at least one computing device, it causes the at least one computing device to perform the root cause location method.

[0188] Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the root cause location method.

[0189] Those skilled in the art will appreciate that the various method steps and units described in the embodiments disclosed in this application can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0190] In the several embodiments provided in this application, it should be understood that the disclosed system architecture, device and method can be implemented in other ways. For example, the device embodiment described above is only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0191] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0192] In addition, each module in each embodiment of the present application can be integrated into a processing module, each module can exist physically separately, or two or more modules can be integrated into a module. The above-mentioned integrated modules can be implemented in the form of hardware or software modules.

[0193] If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0194] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for locating a root cause, characterized in that: The method comprises: Acquire a time series heterogeneous graph, wherein the time series heterogeneous graph includes nodes, edges, and attributes of the nodes, and the nodes include initial fault nodes; Based on the attributes of the node, the normal node and the edge connected to the normal node in the time series heterogeneous graph are deleted, and the time series heterogeneous graph after the deletion is reconstructed to obtain an abnormal subgraph, in which there are reachable edges between the current faulty node and other nodes in the abnormal subgraph, and the current faulty node is obtained based on the initial faulty node; A root cause of the initial fault node is determined in the abnormal subgraph.

2. The method according to claim 1, characterized in that Before deleting the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, the method further includes: Selecting a new fault node from neighboring nodes of the initial fault node, wherein the new fault node is an abnormal node; In the time series heterogeneous graph, obtaining nodes and edges on which the new fault node depends by traversing through breadth-first search; The temporal heterogeneous graph is updated based on the obtained nodes and edges.

3. The method according to claim 2, characterized in that Before selecting a new faulty node from the neighboring nodes of the initial faulty node, the method further includes: Determining that the initial fault node is not an abnormal node; Determining the root cause of the initial fault node in the abnormal subgraph includes: Based on the current fault node, determining the root cause of the current fault node in the abnormal subgraph, the current fault node being the new fault node; The root cause of the current faulty node is determined as the root cause of the initial faulty node.

4. The method according to claim 3, characterized in that The determining, based on the current faulty node, in the abnormal subgraph, a root cause of the current faulty node includes: Determine a probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph; Based on the probability transfer matrix, determining the random walk probability from the current faulty node to other nodes in the abnormal subgraph; X nodes with the highest random walk probability in the abnormal subgraph are sorted from largest to smallest and are determined as the root causes of the current fault node, where X is a positive integer.

5. The method according to claim 4, characterized in that The determining of the probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph includes: Based on the topological structure of the abnormal subgraph, construct an adjacency matrix of the abnormal subgraph; Determine the characteristics of the edges in the abnormal subgraph based on the attributes of the nodes in the abnormal subgraph; Based on the adjacency matrix, a deep neural network algorithm is used to learn the features to obtain a probability transfer matrix of node failures in the abnormal subgraph.

6. The method according to claim 4 or 5, characterized in that: Before determining the probability transfer matrix of node failures in the abnormal subgraph, the method further includes: In the abnormal subgraph, self-loop edges and reverse edges between nodes are added to each node.

7. The method according to any one of claims 1 to 6, characterized in that: The step of reconstructing the deleted time series heterogeneous graph to obtain an abnormal subgraph includes: Determine the shortest path between nodes in the time series heterogeneous graph after the deletion process; Add edges to the unconnected nodes in the deleted time series heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

8. The method according to any one of claims 1 to 7, characterized in that: The time series heterogeneous graph further includes the attributes of the edge; before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph based on the attributes of the node, the method further includes: In the time series heterogeneous graph, obtaining nodes and edges that the initial fault node depends on within the fault time window by traversing through breadth-first search; Based on the obtained nodes and edges, the temporal heterogeneous graph is updated.

9. The method according to any one of claims 1 to 8, characterized in that: The obtaining of the time series heterogeneous graph includes: Based on the topological structure and the call chains between the nodes, the nodes and edges of the temporal heterogeneous graph are generated; Based on monitoring indicators, attributes of the node are generated, and the monitoring indicators include one or more of alarms, performance indicators or logs.

10. A root cause location device, characterized in that: The device comprises: A graph modeling module, used to obtain a time series heterogeneous graph, wherein the time series heterogeneous graph includes nodes, edges and attributes of the nodes, and the nodes include initial fault nodes; A subgraph extraction module is used to delete the normal nodes and the edges connected to the normal nodes in the time series heterogeneous graph based on the attributes of the nodes, reconstruct the time series heterogeneous graph after the deletion process, and obtain an abnormal subgraph, in which there are reachable edges between the current faulty node and other nodes in the abnormal subgraph, and the current faulty node is obtained based on the initial faulty node; A root cause location module is used to determine the root cause of the initial fault node in the abnormal subgraph.

11. The device according to claim 10, characterized in that The sub-graph extraction module is further used for: Before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph based on the attribute of the node, selecting a new faulty node from the neighboring nodes of the initial faulty node, wherein the new faulty node is an abnormal node; In the time series heterogeneous graph, obtaining nodes and edges on which the new fault node depends by traversing through breadth-first search; The temporal heterogeneous graph is updated based on the obtained nodes and edges.

12. The device according to claim 11, characterized in that The subgraph extraction module is further used to: before selecting a new fault node from the neighboring nodes of the initial fault node, determine that the initial fault node is not an abnormal node; The root cause location module is used to: Based on the current fault node, determining the root cause of the current fault node in the abnormal subgraph, the current fault node being the new fault node; The root cause of the current faulty node is determined as the root cause of the initial faulty node.

13. The device according to claim 12, characterized in that The root cause location module is used to: Determine a probability transfer matrix of node failures in the abnormal subgraph based on the topological structure and node attributes of the abnormal subgraph; Based on the probability transfer matrix, determining the random walk probability from the current faulty node to other nodes in the abnormal subgraph; X nodes with the highest random walk probability in the abnormal subgraph are sorted from largest to smallest and are determined as the root causes of the current fault node, where X is a positive integer.

14. The device according to claim 13, characterized in that The root cause location module is used to: Based on the topological structure of the abnormal subgraph, construct an adjacency matrix of the abnormal subgraph; Determine the characteristics of the edges in the abnormal subgraph based on the attributes of the nodes in the abnormal subgraph; Based on the adjacency matrix, a deep neural network algorithm is used to learn the features to obtain a probability transfer matrix of node failures in the abnormal subgraph.

15. The device according to claim 13 or 14, characterized in that The root cause location module is also used for: Before determining the probability transfer matrix of node failure in the abnormal subgraph, in the abnormal subgraph, self-loop edges and reverse edges between nodes are added to each node.

16. The device according to any one of claims 10 to 15, characterized in that The sub-graph extraction module is used for: Determine the shortest path between nodes in the time series heterogeneous graph after the deletion process; Add edges to the unconnected nodes in the deleted time series heterogeneous graph according to the shortest path to obtain the abnormal subgraph.

17. The device according to any one of claims 10 to 16, characterized in that The temporal heterogeneous graph also includes the attributes of the edge; the subgraph extraction module is further used for: Based on the attributes of the node, before deleting the normal node and the edge connected to the normal node in the time series heterogeneous graph, in the time series heterogeneous graph, obtaining the nodes and edges that the initial fault node depends on within the fault time window by traversing through a breadth-first search; Based on the obtained nodes and edges, the temporal heterogeneous graph is updated.

18. The device according to any one of claims 10 to 17, characterized in that The graph modeling module is used to: Based on the topological structure and the call chains between the nodes, the nodes and edges of the temporal heterogeneous graph are generated; Based on monitoring indicators, attributes of the node are generated, and the monitoring indicators include one or more of alarms, performance indicators or logs.

19. A computing device, characterized in that The computing device includes a processor and a memory; The processor is configured to execute instructions stored in the memory so that the computing device performs the method according to any one of claims 1 to 9.

20. A computer-readable storage medium, characterized in that: The storage medium comprises computer program instructions, and when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1 to 9.

Images