Fault root cause localization method and related apparatus

Abstract

The present application provides a fault root cause localization method and a related apparatus, which can be applied to a fault root cause localization scenario. The method comprises: determining the conditional intensity of a root alarm on the basis of the root alarm and a derived alarm in a training data set, and then using an alarm type of the root alarm as an input and the conditional intensity as an output to train a model, to obtain a target model, wherein the target model can be used for evaluating the conditional intensity of an alarm event. For a first alarm event on which fault root cause localization is to be performed, the conditional intensities of historical alarm events are obtained by means of the target model, then a second alarm event whose the conditional intensity is greater than a preset threshold at the moment when the first alarm event occurs is screened from among the historical alarm events, and the second alarm event is considered as a root cause triggering the first alarm event, so that fault root cause localization can be implemented without depending on topology information between nodes.

Description

A fault root cause positioning method and related device

[0001] The present application claims priority from the Chinese patent application No. 202410868658.8 filed on June 28, 2024, and entitled "A fault root cause positioning method and related device", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of artificial intelligence, in particular to a fault root cause positioning method and related device. BACKGROUND

[0003] In order to meet high performance and high availability, many businesses gradually carry out distributed transformation and multi-site multi-center disaster recovery, which leads to a large increase in the number of nodes. For operation and maintenance personnel, the scale of the monitoring object has also increased significantly. In a distributed system, there is a complex network topology relationship between nodes. When a fault occurs in a node, it may lead to a series of faults, resulting in fault alarms in multiple nodes. Due to the large scale of nodes, it becomes more difficult for operation and maintenance personnel to locate the root cause of the fault, and the fault locating time is seriously degraded.

[0004] The core of fault locating is to build an alarm knowledge graph, and the construction of the alarm knowledge graph usually requires the topology information of the nodes. For example, a current fault locating method is to mine the association between alarms through frequent item sets, and then build a knowledge graph. Specifically, first, find the frequently occurring alarm combinations, which are the frequent item sets. Then, combined with the topology information between nodes, filter out irrelevant alarm combinations (i.e. remove nodes without connection relationship). Then, build an alarm knowledge graph according to the filtered results, and finally, based on the alarm knowledge graph, combine random walk algorithm to realize root cause positioning.

[0005] In the process of building the alarm knowledge graph, the topology information plays a very important role. According to the topology information, irrelevant alarm combinations can be filtered out to ensure the accuracy of the alarm knowledge graph and the accuracy of fault locating. However, in a distributed system, the topology relationship between nodes is often very complex, and it is difficult to obtain complete and accurate topology information, which affects the accuracy of fault root cause positioning. SUMMARY

[0006] The present application provides a fault root cause positioning method and related device, which can realize fault root cause positioning without the help of topology information between nodes.

[0007] The first aspect of the present application provides a fault root cause positioning method, which can be applied to a fault root cause positioning device. The method comprises: obtaining a training data set, the training data set comprising a plurality of alarm event sequences, each alarm event sequence indicating a plurality of alarm events in a time period and an alarm type of each alarm event, the plurality of alarm events comprising a root alarm and a derived alarm, the derived alarm being triggered by the root alarm; determining a conditional strength of the root alarm based on a time of occurrence of the derived alarm, the conditional strength being used to indicate a probability of the root alarm triggering the derived alarm at any time, the conditional strength being greater than a preset threshold at the time of occurrence of the derived alarm; training a model with an alarm type of the root alarm in the training data set as input and the conditional strength of the root alarm as output, to obtain a target model; obtaining a first alarm event and a historical alarm event sequence, the first alarm event occurring at a first time, the historical alarm event sequence indicating a plurality of historical alarm events occurring before the first time and alarm types of the plurality of historical alarm events; inputting the alarm types of the plurality of historical alarm events into the target model to obtain a conditional strength of each historical alarm event; determining a second alarm event triggering the first alarm event from the plurality of historical alarm events based on the conditional strength of each historical alarm event, the conditional strength of the second alarm event at the first time being greater than the preset threshold.

[0008] The fault root cause positioning method provided by the first aspect of the present application can be divided into an offline model training phase and an online running phase. In the offline training phase, alarm event data set used for training the model is obtained first, the data set comprising a plurality of alarm event sequences, each alarm event sequence comprising a plurality of alarm events in a continuous time domain.

[0009] The conditional strength is used to represent a probability that an alarm event may trigger other alarm events at a certain time. The greater the conditional strength, the greater the probability of triggering a derived alarm. The value of the conditional strength changes over time. When the conditional strength at a certain time is greater than a preset threshold, it is considered that a derived alarm will be triggered at the time. In other words, at the time of occurrence of the derived alarm, the conditional strength of the root alarm is greater than the preset threshold. The preset threshold can be obtained according to expert experience or adjusted according to the running situation. The root alarm and the derived alarm triggered by the root alarm are labeled in the training data set. The conditional strength of the root alarm can be determined according to the time of occurrence of the derived alarm. Specifically, the conditional strength of the root alarm at the time of triggering the derived alarm is greater than the preset threshold, and the conditional strength of the root alarm at the time of not triggering the derived alarm is less than the preset threshold. The alarm type of the alarm event is used as the input of the model, and the conditional strength of the alarm event is used as the output of the model to train the model. After the training converges, the target model is obtained, which can be used to evaluate the conditional strength of the alarm event.

[0010] For a first alarm event to be subjected to root cause positioning, the conditional strength of historical alarm events is obtained through the target model. Then, a second alarm event is screened from the historical alarm events, which has a conditional strength greater than a preset threshold at the time when the first alarm event occurs, and the second alarm event is considered as the root cause triggering the first alarm event.

[0011] In the first aspect of the present application, the conditional strength of the root alarm is determined according to the root alarm and the derived alarm in the training data set, and then a model is trained with the alarm type of the root alarm as input and the conditional strength as output, so that the trained model can be used to evaluate the conditional strength of an alarm event. For a first alarm event to be subjected to fault root cause positioning, the conditional strength of historical alarm events is obtained through the target model, and then a second alarm event is screened from the historical alarm events, which has a conditional strength greater than a preset threshold at the time when the first alarm event occurs, and the second alarm event is the root cause triggering the first alarm event, so that fault root cause positioning can be realized without relying on the inter-node topology information. The result of fault root cause positioning is not affected by the accuracy of the topology information.

[0012] In a possible implementation manner of the first aspect, the method further includes: obtaining a first alarm type of the first alarm event and a first device type of a node where the first alarm event is located; determining a prior strength of the first alarm event based on the first alarm type and the first device type, the prior strength being used to indicate a probability of occurrence of the first alarm type in a device of the first device type; and the step of determining, based on the conditional strength of each historical alarm event, the second alarm event triggering the first alarm event from the plurality of historical alarm events includes: determining, based on the conditional strength of each historical alarm event and the prior strength, the second alarm event triggering the first alarm event from the plurality of historical alarm events, the second alarm event having a conditional strength greater than a preset threshold at the first time and greater than the prior strength.

[0013] The prior strength refers to a probability of independent occurrence of the first alarm event on a device of a certain type without the influence of other alarm events. The prior strength can be determined based on the alarm type and the device type, and combined with expert experience. Alternatively, the prior strength can be obtained by calculating a probability of occurrence of an alarm of a certain type on a device of a certain type in historical data.

[0014] For a first alarm event to be subjected to fault root cause positioning, a first alarm type of the event and a first device type of a node where the event is located are acquired. A priori strength of the first alarm event is determined according to the first alarm type and the first device type. Then, alarm events whose conditional strength at the first time instant is greater than a preset threshold are filtered out from the plurality of historical alarm events, and the conditional strength of the alarm event is compared with the a priori strength of the first alarm event. If the conditional strength of the alarm event is greater than the a priori strength of the first alarm event, the alarm event is considered as a root alarm, that is, the alarm event is a second alarm event triggering the first alarm event. If the conditional strength of the alarm event is less than or equal to the a priori strength of the first alarm event, the first alarm event is considered to be independently generated, and the first alarm event itself is the root alarm.

[0015] In this possible implementation manner, the root alarm is further determined in combination with the a priori strength of the alarm, which can improve the accuracy of root cause positioning.

[0016] In a possible implementation manner of the first aspect, the method further includes: in a case where no alarm event whose conditional strength at the first time instant is greater than the preset threshold exists in the plurality of historical alarm events, determining that the first alarm event is a root alarm.

[0017] If no alarm event whose conditional strength at the first time instant is greater than the preset threshold exists in the historical alarm events, it is considered that no alarm triggering the first alarm event exists in the historical alarm events, that is, the first alarm event itself is the root alarm, instead of being triggered by other alarms. In this possible implementation manner, how to determine the root alarm when no second alarm event exists is illustrated, which improves the completeness of the scheme.

[0018] In a possible implementation manner of the first aspect, each alarm event sequence further indicates a device type of a node where each alarm event is located, and the method further includes: constructing a binary tuple, the binary tuple including an alarm type of each alarm event and the device type of the node where each alarm event is located; dividing each alarm event sequence into a plurality of sub-modules based on a co-occurrence frequency of the binary tuple; and the step of training the model with the alarm type of the root alarm in the training data set as input and the conditional strength of the root alarm as output includes: training the model with the alarm type of the root alarm in each sub-module as input and the conditional strength as output.

[0019] In this possible implementation manner, the alarm event sequence further indicates the device type of the node where each alarm event in the sequence is located, or the network element type of the network element where the alarm event is located. Training the model with the alarm type and the device type of the alarm event as input can improve the prediction accuracy of the model for the conditional strength of the alarm event.

[0020] During training, the alarm type and the device type of the alarm event are constructed as a binary tuple, denoted as (alarm type, device type). The binary tuple relationship is a concept in mathematics, which refers to an ordered pair composed of two elements. In this relationship, each element can be associated with another element, so this relationship can be used to describe the relationship between objects or the relationship between attributes. Subsequent data processing only analyzes the fault propagation relationship between binary tuples, without distinguishing the fault association within the binary tuple.

[0021] For each alarm event sequence, a weighted graph is constructed based on the co-occurrence frequency of the binary tuple using the principle of complex network community division, and the alarm event sequence is divided into multiple sub-modules. The sub-modules rarely co-occur, so each sub-module can be solved for model parameters separately. That is, when training the model, use each sub-module's data to train the model separately, so that the training data can be effectively reduced in dimension, greatly reducing the data complexity and improving the training efficiency of the model.

[0022] In a possible implementation of the first aspect, each alarm event sequence further indicates the device type of the node where each alarm event is located and the occurrence time of each alarm event, and the step of training the model with the alarm type of the root alarm in the training data set as input and the conditional intensity of the root alarm as output includes: training the model with the alarm type of the root alarm, the device type of the node where the root alarm is located, and the occurrence time of the root alarm in the training data set as input and the conditional intensity of the root alarm as output.

[0023] In this possible implementation, in addition to the alarm type, the alarm event sequence also indicates the device type of the node where the alarm event is located and the occurrence time of the alarm event. When training the model, the alarm type, device type, and occurrence time of the alarm event are used as model inputs, which can improve the prediction accuracy of the model for the conditional intensity of the alarm event.

[0024] In a possible implementation of the first aspect, the method further includes: determining a second time based on the conditional intensity of each historical alarm event, the second time being a time when the conditional intensity of the historical alarm event is greater than a preset threshold; and generating an early warning information based on the second time.

[0025] In the possible implementation, the target model can be used to predict the time when the alarm event is likely to occur, and a warning can be given. Specifically, the target model can be used to obtain the conditional strength of the historical alarm events and the first alarm event, and then the second time when the conditional strength is greater than the preset threshold can be determined, and the second time is the time when the derived alarm is likely to be triggered. Further, it is determined that the conditional strength of which alarm event is greater than the preset threshold at the second time, and the alarm type of the alarm event is the alarm type of the derived alarm that is likely to be triggered at the second time.

[0026] Then, the warning information is generated based on the second time, and is sent to the user interface. The warning information can include the root alarm that is likely to trigger the derived alarm, the second time when the derived alarm is triggered, and the alarm type of the derived alarm. After receiving the warning information, the operation and maintenance personnel can take targeted measures in advance, so as to avoid the occurrence of faults and ensure the stable operation of the system.

[0027] In a possible implementation of the first aspect, the model is a time point process (TPP) model.

[0028] The second aspect of the present application provides a data processing apparatus, including an acquisition unit, a determination unit, a training unit and an input unit. The acquisition unit is configured to acquire a training data set, the training data set including a plurality of alarm event sequences, each alarm event sequence indicating a plurality of alarm events in a time period and an alarm type of each alarm event, the plurality of alarm events including a root alarm and a derived alarm, the derived alarm being triggered by the root alarm; the determination unit is configured to determine a conditional strength of the root alarm based on a time of occurrence of the derived alarm, the conditional strength being used to indicate a probability of the root alarm triggering the derived alarm at any time, the conditional strength being greater than a preset threshold at the time of occurrence of the derived alarm; the training unit is configured to train a model with the alarm type of the root alarm in the training data set as input and the conditional strength of the root alarm as output, to obtain a target model; the acquisition unit is further configured to acquire a first alarm event and a historical alarm event sequence, the first alarm event occurring at a first time, the historical alarm event sequence indicating a plurality of historical alarm events occurring before the first time and alarm types of the plurality of historical alarm events; and the input unit is configured to input the alarm types of the plurality of historical alarm events into the target model to obtain a conditional strength of each historical alarm event; and the determination unit is further configured to determine a second alarm event triggering the first alarm event from the plurality of historical alarm events based on the conditional strength of each historical alarm event, the conditional strength of the second alarm event at the first time being greater than the preset threshold.

[0029] In a possible implementation manner of the second aspect, the acquisition unit is further configured to acquire a first alarm type of the first alarm event and a first device type of a node where the first alarm event is located; the determination unit is further configured to determine a priori strength of the first alarm event based on the first alarm type and the first device type, the a priori strength being used to indicate a probability of occurrence of the first alarm type in a device of the first device type; and the determination unit is specifically configured to determine, from the plurality of historical alarm events, a second alarm event triggering the first alarm event based on the conditional strength of each historical alarm event and the a priori strength, the second alarm event having a conditional strength greater than the preset threshold at the first time and greater than the a priori strength.

[0030] In a possible implementation manner of the second aspect, the apparatus further includes a judgment unit configured to, in a case where there is no alarm event in the plurality of historical alarm events having a conditional strength greater than the preset threshold at the first time, judge the first alarm event as a root alarm.

[0031] In a possible implementation manner of the second aspect, each alarm event sequence further indicates a device type of a node where each alarm event is located, and the apparatus further includes a construction unit configured to construct a binary tuple, the binary tuple including an alarm type of each alarm event and the device type of the node where each alarm event is located; a division unit configured to divide each alarm event sequence into a plurality of sub-modules based on a co-occurrence frequency of the binary tuple; and a training unit specifically configured to train a model with an alarm type of a root alarm in each sub-module as input and a conditional strength as output.

[0032] In a possible implementation manner of the second aspect, each alarm event sequence further indicates a device type of a node where each alarm event is located and a time of occurrence of each alarm event, and the training unit is specifically configured to train a model with an alarm type of a root alarm, a device type of a node where the root alarm is located, and a time of occurrence of the root alarm in a training data set as input and a conditional strength of the root alarm as output.

[0033] In a possible implementation manner of the second aspect, the determination unit is further configured to determine a second time based on the conditional strength of each historical alarm event, the second time being a time at which the conditional strength of the historical alarm event is greater than the preset threshold; and the apparatus further includes a generation unit configured to generate early warning information based on the second time.

[0034] In a possible implementation manner of the second aspect, the model is a time point process (TPP) model.

[0035] The fault root cause positioning apparatus provided in the second aspect is used to execute the method in the first aspect or any possible implementation manner of the first aspect.

[0036] The third aspect of the present application provides a fault root cause positioning device, comprising a processor and a memory. The memory is configured to store instructions, and the processor is configured to acquire the instructions stored in the memory to execute the method in the first aspect or any possible implementation manner of the first aspect.

[0037] The fourth aspect of the present application provides a computer readable storage medium comprising instructions, which, when executed on a computer, cause the computer to execute the method in the first aspect or any possible implementation manner of the first aspect.

[0038] The fifth aspect of the present application provides a computer program product comprising instructions, which, when executed on a computer, cause the computer to execute the method in the first aspect or any possible implementation manner of the first aspect.

[0039] The sixth aspect of the present application provides a chip system comprising at least one processor and a communication interface, wherein the communication interface and the at least one processor are interconnected through a line, and the at least one processor is configured to execute a computer program or instructions to execute the method in the first aspect or any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0040] FIG. 1 is a schematic diagram of one embodiment of the fault root cause positioning method provided by the embodiments of the present application;

[0041] FIG. 2 is a schematic diagram of a flow of model training in the embodiments of the present application;

[0042] FIG. 3 is a schematic diagram of another embodiment of the fault root cause positioning method provided by the embodiments of the present application;

[0043] FIG. 4 is a schematic diagram of a flow of an online running stage in the embodiments of the present application;

[0044] FIG. 5 is a schematic diagram of a structure of the fault root cause positioning device provided by the embodiments of the present application;

[0045] FIG. 6 is a schematic diagram of another structure of the fault root cause positioning device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0046] The embodiments of the present application provide a fault root cause positioning method, which can realize fault root cause positioning without the help of topology information between nodes. The embodiments of the present application also provide corresponding devices, computer readable storage media, computer program products and the like. The following will be described respectively.

[0047] The embodiments of the present application will be described below in conjunction with the drawings, obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Those skilled in the art can know that with the development of technology and the appearance of new scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0048] The terms "root alarm", "root cause alarm" and "root source alarm", "model" and "network" and the like in the specification and claims of the present application and the above-mentioned drawings can be used interchangeably. Unless otherwise specified, the ordinal numbers "first", "second" and the like are used to distinguish a plurality of objects, and are not used to limit the order, time sequence, priority or importance of the plurality of objects. It should be understood that the terms thus used can be interchangeable under appropriate circumstances, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0049] In order to meet high performance and high availability, many businesses gradually carry out distributed transformation and multi-site multi-center disaster recovery, which leads to a large increase in the number of nodes. For the operation and maintenance personnel, the scale of the monitoring object has also increased significantly. In a distributed system, there is a complex network topology relationship between nodes, and when a certain node fails, a series of failures may be derived, causing multiple nodes to also appear failure alarms. Due to the large scale of nodes, it becomes more difficult for the operation and maintenance personnel to locate the failure root cause, and the failure locating time is seriously degraded.

[0050] The core of failure locating is to build an alarm knowledge graph, and building an alarm knowledge graph usually requires the topology information of nodes. For example, a current failure locating method is to mine the association between alarms through frequent item sets, and then build a knowledge graph. Specifically, first, find the frequently occurring alarm combinations, which are the frequent item sets. Then, combined with the topology information between nodes, filter out irrelevant alarm combinations (i.e. remove nodes without connection relationship). Then, build an alarm knowledge graph according to the filtered results, and finally, based on the alarm knowledge graph, combine random walk algorithm to realize root cause locating.

[0051] In the process of constructing the alarm knowledge graph, the topology information occupies a very important position. According to the topology information, irrelevant alarm combinations can be filtered out, and the accuracy of the alarm knowledge graph and the accuracy of fault positioning are ensured. However, in a distributed system, the topology relationship between nodes is often very complex, and it is difficult to obtain complete and accurate topology information, which affects the accuracy of fault root cause positioning.

[0052] Therefore, the embodiment of the present application provides a fault root cause positioning method. The model is trained to enable the model to evaluate the conditional strength of the alarm event. The conditional strength indicates the probability that the alarm event may trigger a derivative alarm event at any time after the occurrence of the alarm event. When the conditional strength of the alarm event at a certain time is greater than a preset threshold, it is considered that the alarm event will trigger other alarm events at the time. For a first alarm event to be positioned, a second alarm event with a conditional strength greater than a preset threshold at the time of the first alarm event is selected from historical alarm events. The second alarm event is the root cause of the first alarm event, so that the root cause of the fault can be positioned without the topology information between nodes.

[0053] The fault root cause positioning method provided by the embodiment of the present application can be applied to different scenarios such as software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS), and is effective for HCS, eSight, eAPPOps, and eOMC network management alarm root cause positioning.

[0054] Please refer to Fig. 1, which is an embodiment of the fault root cause positioning method provided by the embodiment of the present application. As shown in Fig. 1, the embodiment includes steps 101 to 106.

[0055] 101, obtain a training data set, the training data set includes a plurality of alarm event sequences, each alarm event sequence indicates a plurality of alarm events in a time period and an alarm type of each alarm event, the plurality of alarm events include root alarms and derivative alarms, and the derivative alarms are triggered by the root alarms.

[0056] An alarm refers to a notification generated when a device operating state deviates from a normal condition and needs to be paid attention to or handled by a user, and is important information for an operation and maintenance personnel to understand the internal operating state of a device and perform fault positioning. An alarm event data set used for training a model is obtained, and the data set includes a plurality of alarm event sequences, each alarm event sequence including a plurality of alarm events in a continuous time domain.

[0057] Some alarms of the device can be triggered by a state, i.e., there is a correlation between the alarms, and thus the alarm events included in each alarm event sequence can be classified into root alarms and derived alarms. The root alarm is the root cause alarm event that triggers a series of faults, and the derived alarm is the alarm event caused by the root alarm. For example, route unreachable is caused by interface failure, and the alarm generated by the interface failure is the root cause alarm, and the alarm generated by route unreachable is the derived alarm. It can be understood that an alarm event can be triggered by other alarm events (i.e., the alarm event is a derived alarm), or it can trigger other alarm events (i.e., the alarm event is a root cause alarm). When the number of nodes is large, a large number of alarm events can occur, and the operation and maintenance personnel can only handle the root fault or preferentially handle the root fault, thereby improving the processing efficiency and ensuring the normal operation of the system.

[0058] Each alarm event sequence indicates the alarm type of the alarm events included in the sequence. The alarm type can be a performance alarm, a security alarm, and a capacity alarm, etc., such as high CPU usage, high memory usage, and system security threats, etc.

[0059] 102, determine the condition strength of the root alarm based on the occurrence time of the derived alarm, the condition strength is used to indicate the probability that the root alarm triggers the derived alarm at any time, and the condition strength is greater than a preset threshold at the occurrence time of the derived alarm.

[0060] The condition strength represents the probability that an alarm event can trigger other alarm events at a certain time, and the condition strength can also be called occurrence strength. The condition strength is a value that changes over time, for example, the condition strength of event A is the largest at 1 second after the event occurs, and then the condition strength slowly decreases, or event A can also maintain uniform influence, and the value of the condition strength is stable. The greater the condition strength, the greater the probability of triggering a derived alarm. When the condition strength at a certain time is greater than a preset threshold, it is considered that a derived alarm will be triggered at that time. In other words, at the occurrence time of the derived alarm, the condition strength of the root alarm is greater than the preset threshold. The preset threshold can be obtained according to expert experience or adjusted according to the running situation.

[0061] The root alarm and the derived alarm triggered by the root alarm are labeled in the training data set, and the condition strength of the root alarm can be determined according to the occurrence time of the derived alarm. Specifically, the condition strength of the root alarm is greater than the preset threshold at the time when the derived alarm is triggered, and the condition strength of the root alarm is less than the preset threshold at the time when the derived alarm is not triggered.

[0062] 103, train the model by taking the alarm type of the root alarm in the training data set as input and taking the condition strength of the root alarm as output, to obtain a target model.

[0063] The model is trained using the alarm events in the training data set. In the training process, different alarm event sequences are used to train the model. Specifically, for each alarm event sequence, the alarm type of the alarm event is used as the input of the model, and the conditional intensity of the alarm event is used as the output of the model to train the model. The conditional intensity of the alarm event can be determined by the derived alarms triggered by the alarm event. After training converges, the target model is obtained, which can be used to evaluate the conditional intensity of the alarm event.

[0064] In one possible solution, the alarm event sequence also indicates the device type of the node where each alarm event in the sequence is located, or the network element type of the network element where the alarm event is located. Training the model using the alarm type and device type of the alarm event as input can improve the prediction accuracy of the model for the conditional intensity of the alarm event.

[0065] In training, the alarm type and device type of the alarm event are constructed as a binary tuple, denoted as (alarm type, device type). The binary tuple relationship is a concept in mathematics, which refers to an ordered pair composed of two elements. In this relationship, each element can be associated with another element, so this relationship can be used to describe the relationship between objects or the relationship between attributes. Subsequent data processing only analyzes the fault propagation relationship between binary tuples, without distinguishing the fault association within the binary tuple.

[0066] For each alarm event sequence, a weighted graph is constructed based on the co-occurrence frequency of the binary tuples using the community division principle of complex networks, and the alarm event sequence is divided into multiple sub-modules. The sub-modules rarely co-occur, so the model parameters can be solved for each sub-module respectively. That is, when training the model, use the data of each sub-module to train the model respectively, so that the training data can be effectively reduced in dimension, greatly reducing the data complexity and improving the training efficiency of the model.

[0067] In one possible solution, in addition to the alarm type and device type, the alarm event sequence also indicates the occurrence time of each alarm event. When training the model, the alarm type, device type, and occurrence time of the alarm event are used as the input of the model, so that the change of the conditional intensity over time can be more accurately reflected, and the prediction accuracy of the model for the conditional intensity of the alarm event can be improved.

[0068] Optionally, the trained model is a temporal point process (TPP) model. The TPP model is a probabilistic genetic model for processing continuous time event sequences. The training process of the model is described below taking the TPP model as an example.

[0069] For the offline dataset S, each sequence s in S is a sequence of alarm events, and a sequence of alarm events is denoted as where s denotes the event type of the sequence, and different sequences s are different. i denotes the normalized occurrence time of the i-th event in the sequence, The main purpose of normalization is to transform data into a certain range of values, which is a method of pre-processing data. By converting data to a uniform scale, the performance and accuracy of machine learning algorithms can be improved. i denotes the event type corresponding to the alarm event, which is determined by the binary tuple (alarm type, device type). That is, the event type k i includes the alarm type of the alarm event and the device type of the node where the alarm event is located, Defining the event type as the Cartesian product of the alarm type and the device type has two purposes: the first is to distinguish different alarm types, and the second is to generalize the learned TPPs on devices belonging to the same type. For two alarm events in a sequence of alarm events, if the alarm type and the device type are the same, the two alarm events are represented as the same event type, and it is believed that their occurrence essentially follows the same causal relationship, even if they come from different devices.

[0070] The framework design of the TPP model follows the encoding-decoding structure of existing NPPs models, and it is trained in an unsupervised manner without manual annotation. During the training process, for the moment when a derived alarm is triggered, the conditional intensity of the root alarm at that moment is compared with a preset threshold. If the conditional intensity does not reach the threshold, the conditional intensity is increased. The encoder of the TPP model uses a recurrent neural network (RNN) in the form of an ordinary differential equation (ODE), i.e., ODE-RNN. ODE-RNN is a combination of recurrent neural networks and ordinary differential equations, which is used to encode a given sequence of alarm events into a continuous-time hidden state. The decoder of the TPP model can use a normal neural network (NN).

[0071] In the process of encoding the training data, first, the event type k i of each alarm event is converted into an embedding vector, i.e., v i = V[k i ].

[0072] where V is a set of parameters for incremental learning. The continuous-time embedded hidden state can be derived by ODE-RNN:

[0073] Where h(t) represents the state of the alarm event in the model at time t. For ODE equations, The equations for a recurrent neural network are shown below.

[0074] During the decoding phase, the representation state h(t) of the alarm event in the model is fed back to a regular neural network to predict the embedded state at any time t. That is, the conditional strength λ of any event type k (t) are all estimated as embedded events and Dot product:

[0075] λ k (t)=e(t·v k e(t)=NN(h(t))

[0076] The encoder-decoder model is obtained by minimizing the negative log-likelihood (NLL) function on the dataset:

[0077] Where Θ = {f, RNN, NN, V}. Corresponding to past events As a condition, in the time interval [t] i Observed in ,t) The predicted probability of type k events. The probability that no type k event will be observed during the remainder of the time interval [0, T] is... The negative log-likelihood formula above can be obtained from the negative logarithms of these two probabilities. Negative log-likelihood is a loss function used to solve classification problems. It primarily measures the difference between the model's predictions and the actual results, quantifying this difference through the loss function to help optimize model performance.

[0078] The model training process can be understood in conjunction with Figure 2. As shown in Figure 2, t represents the continuous time domain, and the alarm event sequence includes three alarm events. The first alarm occurs at time t1 and is [1,0,0]. T The values ​​are indicated by white boxes. The next alarm occurs at time t2 and is in the range [0, 1, 0]. T The value is represented by a black sphere. The next alarm occurs at time t3, and its value is [0,0,1]. T , indicated by a black box.

[0079] h(t0) = 0 represents the initial state of the model, and V represents the parameter set obtained after converting the event type of the alarm event into an embedding vector. The embedded hidden states are calculated based on the initial state h(t0). It is actually conditional intensity, but also needs to be processed by a decoder. For example, by a neural network NN to obtain the estimated conditional intensity Input V into a recurrent neural network RNN, which embeds information included in a parameter set into a model as an encoder, thereby compressing high-dimensional information. An ODE equation can describe the law of state change, and the ODE equation can output the numerical value of the conditional intensity changing over time, that is, the estimated conditional intensity at any time. After obtaining the estimated conditional intensity at t1, adjust the parameters of the NN, RNN and ODE equation based on the estimated conditional intensity and the true value at t1.

[0080] Then calculate the estimated conditional intensity at t2 by the ODE equation, and then decode by the NN to obtain the estimated conditional intensity The subsequent processing process is similar to that at t1, and the parameters of the model are adjusted based on the estimated data and the true value. The same is true for the time after that, until the model converges to obtain a target model that can accurately evaluate the conditional intensity of the alarm event.

[0081] It can be understood that in addition to the TPP model, other models can also be used for training, such as NTPP model or NPP model, which are not limited here.

[0082] 104、Obtain a first alarm event and a sequence of historical alarm events, the first alarm event occurring at a first time, and the sequence of historical alarm events indicating a plurality of historical alarm events occurring before the first time and alarm types of the plurality of historical alarm events.

[0083] Steps 101 to 103 are the offline training process of the model. After the model is trained, it can be used to evaluate the conditional intensity of the alarm event online, and then determine the root alarm (i.e. root cause positioning) according to the conditional intensity.

[0084] Obtain a first alarm event and a sequence of historical alarm events to be subjected to fault root cause positioning. The first alarm event can be an alarm that has just occurred, or an alarm that has not been processed in the historical operation process. The sequence of historical alarm events includes a plurality of historical alarm events occurring before the first alarm event. The sequence of historical alarm events also indicates the alarm type of each historical alarm event included in the plurality of historical alarm events.

[0085] 105、Input the alarm types of the plurality of historical alarm events into the target model to obtain the conditional intensity of each historical alarm event.

[0086] The alarm types of the plurality of historical alarm events are input into the target model, and the target model outputs the conditional strength of each historical alarm event.

[0087] Optionally, if the device type of the node where the alarm event is located and the occurrence time of the alarm event are also used as input data to train the model during the training process of the model, the historical alarm event sequence should also include the device type of the node where each historical alarm event is located and the occurrence time of each historical alarm event, and the device type and the occurrence time are input into the target model together, so as to obtain more accurate conditional strength.

[0088] 106、Based on the conditional strength of each historical alarm event, a second alarm event triggering the first alarm event is determined from the plurality of historical alarm events, and the conditional strength of the second alarm event at the first time is greater than a preset threshold.

[0089] The occurrence time of the first alarm event is the first time, and after obtaining the conditional strength of each historical alarm event, the second alarm event with a conditional strength greater than a preset threshold at the first time is screened out, and the second alarm event is considered as the root alarm triggering the first alarm event.

[0090] When there are multiple alarm events in the historical alarm events with a conditional strength greater than a preset threshold at the first time, the alarm event with an occurrence time closest to the first time can be considered as the root alarm triggering the first alarm event, that is, the alarm event with an occurrence time closest to the first time is the second alarm event. It can also be that the alarm event with the maximum conditional strength is screened out from the plurality of historical alarm events with a conditional strength greater than a preset threshold at the first time, and the alarm event is determined as the second alarm event triggering the first alarm event.

[0091] In one possible solution, the second alarm event triggering the first alarm event is further determined in combination with the prior strength of the first alarm event. The prior strength refers to the probability of the independent occurrence of the first alarm event on a certain type of device without the influence of other alarm events. The prior strength can be determined based on the alarm type and the device type, and in combination with expert experience. It can also be obtained by calculating the probability of the occurrence of a certain type of alarm on a certain type of device in historical data.

[0092] Specifically, for a first alarm event to be subjected to fault root cause positioning, a first alarm type of the event and a first device type of a node where the event is located are acquired. A priori strength of the first alarm event is determined according to the first alarm type and the first device type. Then, alarm events whose conditional strengths at a first time are greater than a preset threshold are filtered out from a plurality of historical alarm events, and the conditional strength of the alarm event is compared with the a priori strength of the first alarm event. If the conditional strength of the alarm event is greater than the a priori strength of the first alarm event, the alarm event is considered as a root alarm, that is, the alarm event is a second alarm event triggering the first alarm event. If the conditional strength of the alarm event is less than or equal to the a priori strength of the first alarm event, the first alarm event is considered to be independently occurred, and the first alarm event itself is the root alarm.

[0093] If there is no alarm event whose conditional strength at the first time is greater than the preset threshold in the historical alarm events, it is considered that there is no alarm triggering the first alarm in the historical alarm events, that is, the first alarm event itself is the root alarm, rather than being triggered by other alarms.

[0094] In a possible solution, the time when an alarm event is likely to occur can be predicted through a target model, and a warning can be given. Specifically, the conditional strengths of the historical alarm events and the first alarm event can be obtained through the target model, and then a second time when the conditional strength is greater than a preset threshold can be determined, and the second time is the time when a derivative alarm is likely to be triggered. Further, it is determined that the conditional strength of which alarm event at the second time is greater than the preset threshold, and the alarm type of the alarm event is the alarm type of the derivative alarm that is likely to be triggered at the second time.

[0095] Then, a warning information is generated based on the second time, and is sent to a user interface. The warning information can include a root alarm that is likely to trigger a derivative alarm, a second time when the derivative alarm is triggered, and an alarm type of the derivative alarm. After receiving the warning information, an operation and maintenance personnel can perform targeted processing in advance, so as to avoid the occurrence of a fault and ensure stable operation of the system.

[0096] In this embodiment, the condition strength of the root alarm is determined according to the root alarm and the corresponding derived alarm in the training data set, and then the information of the root alarm is taken as the input and the condition strength is taken as the output to train the model, so that the trained model can be used to evaluate the condition strength of the alarm event. For a first alarm event to be subjected to fault root cause positioning, the condition strength of the historical alarm event is obtained through the target model, and then a second alarm event whose condition strength at the moment when the first alarm event occurs is greater than a preset threshold is screened out from the historical alarm events, and the second alarm event is the root cause triggering the first alarm event, so that fault root cause positioning is realized without relying on topology information. The fault root cause positioning result is not affected by the accuracy of the topology information. According to the experimental results, the root cause positioning accuracy in this embodiment is improved by 60%.

[0097] Optionally, in this example, the alarm type of the alarm event and the device type of the node where the alarm event is located are constructed into a binary tuple, the alarm event sequence is divided into multiple sub-modules based on the co-occurrence frequency of the binary tuple, and the data of each sub-module is processed respectively, so that the training data can be effectively reduced in dimension, the data complexity is greatly reduced, and the training efficiency of the model is improved.

[0098] In combination with the content of the embodiment shown in FIG. 1, the overall flow of the fault root cause positioning method provided in this embodiment will be described below based on FIG. 3.

[0099] FIG. 3 is a whole flow involved in the fault root cause positioning method provided in this embodiment, wherein the state space dimension reduction, the TPP modeling, the NEC neural network, the fault correlation model and the root cause analysis are included in this embodiment. As shown in FIG. 3, the fault root cause positioning flow can be divided into a training state and an inference state. The training state is the offline training process of the model, and the inference state is the online inference process after the model is trained. In the training state, the alarm data is first compressed, specifically including space compression and time compression. The alarm is sliced through a time window, so as to reduce redundant alarm data and improve the efficiency of data processing. For example, the same alarm event occurring multiple times on a certain device is compressed into one piece of data.

[0100] After the alarm data is compressed, state space dimensionality reduction is performed. Specifically, the alarm type of the alarm event and the network element type of the network element where the alarm event is located are first constructed into a binary tuple, and then through the graph distance, the binary tuples with high co-occurrence frequency are divided into a sub-module. When processing data, the model is trained with the sub-module as the granularity, so that the training data can be effectively reduced in dimension, greatly reducing the data complexity and improving the training efficiency of the model. Then the alarm event sequence is modeled, and the model framework uses the TPP model, of course, other models can also be used, and the specific place is not limited. In the modeling process, the Hawkes process is used to describe the derivation dynamics relationship between alarm nodes. Hawkes process is a self-excited point process that allows past events to affect the probability of future events in some way. This process is non-Markovian, meaning that the occurrence of any historical event will affect the probability of future event occurrence for a long time and can lead to critical burst events. That is, after a certain alarm occurs, the alarm will have a long-term impact on the subsequent operation process, in other words, the conditional intensity of the alarm exists for a long time and changes with time.

[0101] Then the TPP model is processed by a neural episodic control (NEC) neural network. NEC is a deep reinforcement learning agent that can quickly absorb new experiences and take action based on them. Specifically, the probability of future event occurrence is predicted from past data based on Bayesian theory, and then calculated by ODE. After the model training converges, the target model is obtained, which can be in the form of ODE-GRU. The conditional intensity of historical alarm events can be obtained through the target model, and the historical alarm events with a conditional intensity greater than a preset threshold at the time of fault occurrence are the root alarms.

[0102] Further, the fault propagation graph can also be annotated according to expert experience to improve the accuracy of fault root cause positioning. Among them, the fault propagation graph can be annotated by existing annotated industry knowledge, and the industry knowledge is published in the form of assets. Business rules summarized during operation can also be written back to obtain the fault propagation graph. Through the fault propagation graph, some incorrect root cause positioning results can be corrected, for example, according to the conditional intensity, it is determined that the root cause of fault A is fault B, but through the fault propagation graph, it is found that there is no propagation relationship between fault B and fault A, which means that fault B is not the root cause of fault A.

[0103] After the model is trained, it can be used in the online running stage, that is, the inference state in the process. First, real-time alarm events are obtained through a network management device, which can be Prometheus, HCS, esight, NetEco, etc. After obtaining the real-time alarm data, the alarm data is first compressed. Then the conditional strength of each alarm event is obtained through the target model, and the root cause of the alarm event is determined in combination with the fault propagation graph. For the obtained fault root cause positioning result, manual confirmation is performed to ensure the accuracy of the result. One root alarm can trigger multiple derived alarms, and the root alarm and the triggered multiple derived alarms are combined into one work order and sent to the operation and maintenance personnel responsible for processing the alarm.

[0104] The online running stage is described in detail below in combination with FIG. 4. As shown in FIG. 4, after the operation and maintenance personnel enters the alarm center and clicks to enter the analysis state, the alarm center analyzes the alarm events reported by the network management device using the target model. After obtaining the analysis result, the operation and maintenance personnel judges whether the analysis is completed. If not, the button for entering the analysis state is continuously clicked. After judging that the analysis is completed, the alarm details are obtained by clicking. The operation and maintenance personnel judges whether the information of the alarm event is accurate. If not, the information can be modified. For example, the alarm type of the alarm event is modified. After modification, the modification result is synchronized to the alarm center, the root cause analysis operation history, and the basic information operation history. According to the alarm details, a legend of the root cause alarm / derived alarm can be generated, and a list including the root cause alarm and the corresponding derived alarm can be further highlighted. Then, the operation and maintenance personnel judges whether the causal relationship between the root cause alarm and the derived alarm is correct according to the expert experience or the annotated fault propagation graph. If not, the modification is performed, and the modification result is synchronized to the alarm legend and the root cause analysis operation history.

[0105] After the list of the root cause alarm and the corresponding derived alarm is generated, the list can be folded and compressed to save display space. To view the specific content, the list can be clicked to expand, so as to display the folded alarm event. One alarm event can trigger multiple derived alarms. In order to improve the processing efficiency, the root alarm and the triggered multiple derived alarms are combined into one work order, and then the work order is transferred to the corresponding personnel for operation and processing. For the multiple alarm events in the combined work order, the main alarm event can be selected and marked or highlighted. Then, the work order operation is performed, and the personnel responsible for processing will prioritize the main alarm after receiving the work order. In this way, the stability of the system can be improved. For the alarm list, the alarm title in the alarm list can be clicked to view the detailed information of each alarm event.

[0106] The above describes the embodiments of the present application from the perspective of the method. The related devices in the embodiments of the present application are introduced from the perspective of the specific device implementation.

[0107] Please refer to FIG. 5, the embodiment of the present application provides a schematic diagram of a fault root cause positioning device 500. Wherein the fault root cause positioning device 500 comprises an acquisition unit 501, a determination unit 502, a training unit 503 and an input unit 504.

[0108] The acquisition unit 501 is configured to acquire a training data set, the training data set comprising a plurality of alarm event sequences, each alarm event sequence indicating a plurality of alarm events and an alarm type of each alarm event in a time period, the plurality of alarm events comprising a root alarm and a derived alarm, the derived alarm being triggered by the root alarm.

[0109] The determination unit 502 is configured to determine a condition strength of the root alarm based on a time of occurrence of the derived alarm, the condition strength being used to indicate a probability of the root alarm triggering the derived alarm at any time, the condition strength being greater than a preset threshold at the time of occurrence of the derived alarm.

[0110] The training unit 503 is configured to train a model with the alarm type of the root alarm in the training data set as input and the condition strength of the root alarm as output, to obtain a target model.

[0111] The acquisition unit 501 is further configured to acquire a first alarm event and a historical alarm event sequence, the first alarm event occurring at a first time, the historical alarm event sequence indicating a plurality of historical alarm events and alarm types of the plurality of historical alarm events occurring before the first time.

[0112] The input unit 504 is configured to input the alarm types of the plurality of historical alarm events into the target model to obtain a condition strength of each historical alarm event.

[0113] The determination unit 502 is further configured to determine a second alarm event triggering the first alarm event from the plurality of historical alarm events based on the condition strength of each historical alarm event, the condition strength of the second alarm event at the first time being greater than a preset threshold.

[0114] Optionally, the acquisition unit 501 is further configured to acquire a first alarm type of the first alarm event and a first device type of a node where the first alarm event is located; the determination unit 502 is further configured to determine a prior strength of the first alarm event based on the first alarm type and the first device type, the prior strength being used to indicate a probability of the first alarm type occurring in a device of the first device type; and the determination unit 502 is specifically configured to determine the second alarm event triggering the first alarm event from the plurality of historical alarm events based on the condition strength of each historical alarm event and the prior strength, the condition strength of the second alarm event at the first time being greater than the preset threshold and greater than the prior strength.

[0115] Optionally, the fault root cause positioning apparatus 500 further comprises a judging unit 505 configured to judge the first alarm event as a root alarm in a case where there is no alarm event in the plurality of historical alarm events with a condition strength greater than a preset threshold at the first time point.

[0116] Optionally, each alarm event sequence further indicates a device type of a node where each alarm event is located, and the fault root cause positioning apparatus 500 further comprises a constructing unit 506 configured to construct a binary tuple, the binary tuple comprising an alarm type of each alarm event and the device type of the node where each alarm event is located; a dividing unit 507 configured to divide each alarm event sequence into a plurality of sub-modules based on a co-occurrence frequency of the binary tuple; and the training unit 503 is specifically configured to train a model with the alarm type of the root alarm in each sub-module as input and the condition strength as output.

[0117] Optionally, each alarm event sequence further indicates a device type of a node where each alarm event is located and a time point of occurrence of each alarm event, and the training unit 503 is specifically configured to train a model with the alarm type of the root alarm, the device type of the node where the root alarm is located and the time point of occurrence of the root alarm as input and the condition strength of the root alarm as output.

[0118] Optionally, the determining unit 502 is further configured to determine a second time point based on the condition strength of each historical alarm event, the second time point being a time point at which the condition strength of the historical alarm event is greater than a preset threshold; and the fault root cause positioning apparatus 500 further comprises a generating unit 508 configured to generate early warning information based on the second time point.

[0119] Optionally, the model is a time point process (TPP) model.

[0120] The modules in the fault root cause positioning apparatus 500 perform operations of the fault root cause positioning apparatus as described in the foregoing embodiments of FIG. 1 and FIG. 3, and details are not described herein again.

[0121] Please refer to FIG. 6, which is a possible structural schematic diagram of a fault root cause positioning apparatus 600 provided by an embodiment of the present application, comprising a processor 601, a communication interface 602, a memory 603 and a bus 604. The processor 601, the communication interface 602 and the memory 603 are connected with each other through the bus 604. In an embodiment of the present application, the processor 601 is configured to control and manage actions of the fault root cause positioning apparatus, for example, the processor 601 is configured to execute steps performed by the fault root cause positioning apparatus in the method embodiment shown in FIG. 1. The communication interface 602 is configured to support the fault root cause positioning apparatus to communicate. The memory 603 is configured to store program codes and data of the fault root cause positioning apparatus.

[0122] The processor 601 can be a central processing unit, a general purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic device, transistor logic, hardware components, or any combination thereof. It can implement or execute various example logical blocks, modules, and circuits described in connection with the disclosure. The processor can also be a combination of computing functions, such as a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and the like. The bus 604 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 6, but it does not mean that there is only one bus or only one type of bus.

[0123] The embodiments of the present application also provide a computer readable storage medium, which includes instructions, when the instructions are run on a computer, causing the computer to execute the method in the embodiments shown in FIG. 1 and FIG. 3.

[0124] The embodiments of the present application also provide a computer program product including instructions, when the computer program product is run on a computer, causing the computer to execute the method in the embodiments shown in FIG. 1 and FIG. 3.

[0125] The embodiments of the present application also provide a chip system, which includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected through a line, and the at least one processor is used to run a computer program or instructions to execute the method in the embodiments shown in FIG. 1 and FIG. 3.

[0126] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0128] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0129] The units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments of the present application.

[0130] In addition, each functional unit in the embodiments of the present application can be integrated in one processing unit, or each unit can exist physically as a separate unit, or two or more units can be integrated in one unit. The integrated unit can be implemented in the form of hardware, or in the form of a software functional unit.

[0131] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present application essentially or substantially, or all or part of the technical solutions, can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disk, and various other media that can store program codes.

Claims

1. A method for locating the root cause of a fault, characterized in that, include: Obtain a training dataset, which includes multiple alarm event sequences. Each alarm event sequence indicates multiple alarm events within a time period and the alarm type of each alarm event. The multiple alarm events include a root alarm and derived alarms, and the derived alarms are triggered by the root alarm. The condition strength of the root alarm is determined based on the occurrence time of the derived alarm. The condition strength is used to indicate the probability that the root alarm will trigger a derived alarm at any time. The condition strength is greater than a preset threshold at the occurrence time of the derived alarm. The target model is obtained by using the alarm type of the root alarm in the training dataset as input and the conditional strength of the root alarm as output to train the model. Obtain a first alarm event and a sequence of historical alarm events. The first alarm event occurs at a first moment, and the sequence of historical alarm events indicates multiple historical alarm events that occurred before the first moment and the alarm types of the multiple historical alarm events. Input the alarm types of the multiple historical alarm events into the target model to obtain the conditional strength of each historical alarm event; Based on the condition strength of each historical alarm event, a second alarm event that triggers the first alarm event is determined from the plurality of historical alarm events, wherein the condition strength of the second alarm event at the first time is greater than a preset threshold.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the first alarm type of the first alarm event and the first device type of the node where the first alarm event is located; The prior strength of the first alarm event is determined based on the first alarm type and the first device type, and the prior strength is used to indicate the probability of the first alarm type occurring in a device of the first device type. The step of determining the second alarm event that triggers the first alarm event from the plurality of historical alarm events based on the conditional strength of each historical alarm event includes: Based on the conditional strength and the prior strength of each historical alarm event, a second alarm event that triggers the first alarm event is determined from the plurality of historical alarm events. The conditional strength of the second alarm event at the first moment is greater than a preset threshold and is also greater than the prior strength.

3. The method according to claim 1 or 2, characterized in that, The method further includes: If none of the multiple historical alarm events has an alarm event with a condition strength greater than a preset threshold at the first moment, then the first alarm event is determined to be the root alarm.

4. The method according to any one of claims 1 to 3, characterized in that, Each alarm event sequence also indicates the device type of the node where each alarm event occurs, and the method further includes: Construct a tuple, which includes the alarm type of each alarm event and the device type of the node where each alarm event is located; Each alarm event sequence is divided into multiple sub-modules based on the co-occurrence frequency of the binary tuples; The step of training a model by taking the alarm type of the root alarm in the training dataset as input and the conditional strength of the root alarm as output includes: The model is trained by taking the alarm type of the root alarm in each submodule as input and the conditional strength as output.

5. The method according to any one of claims 1 to 4, characterized in that, Each alarm event sequence also indicates the device type of the node where each alarm event occurs and the time when each alarm event occurs. The step of training the model by taking the alarm type of the root alarm in the training dataset as input and the conditional strength of the root alarm as output includes: The model is trained by taking the alarm type of the root alarm in the training dataset, the device type of the node where the root alarm is located, and the occurrence time of the root alarm as input, and the conditional strength of the root alarm as output.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: The second moment is determined based on the conditional strength of each historical alarm event, and the second moment is the moment when the conditional strength of the historical alarm event is greater than a preset threshold. Early warning information is generated based on the second time point.

7. The method according to any one of claims 1 to 6, characterized in that, The model is a time-point process (TPP) model.

8. A fault root cause location device, characterized in that, include: The acquisition unit is used to acquire a training dataset, which includes multiple alarm event sequences. Each alarm event sequence indicates multiple alarm events within a time period and the alarm type of each alarm event. The multiple alarm events include a root alarm and derived alarms, and the derived alarms are triggered by the root alarm. A determining unit is configured to determine the condition strength of the root alarm based on the occurrence time of the derived alarm, wherein the condition strength is used to indicate the probability that the root alarm triggers a derived alarm at any time, and the condition strength is greater than a preset threshold at the occurrence time of the derived alarm. The training unit is used to train the model by taking the alarm type of the root alarm in the training dataset as input and the conditional strength of the root alarm as output, so as to obtain the target model. The acquisition unit is further configured to acquire a first alarm event and a sequence of historical alarm events, wherein the first alarm event occurs at a first moment, and the sequence of historical alarm events indicates multiple historical alarm events that occurred before the first moment and the alarm types of the multiple historical alarm events; The input unit is used to input the alarm types of the multiple historical alarm events into the target model to obtain the conditional strength of each historical alarm event; The determining unit is further configured to determine, based on the condition strength of each historical alarm event, a second alarm event that triggers the first alarm event from the plurality of historical alarm events, wherein the condition strength of the second alarm event at the first moment is greater than a preset threshold.

9. The apparatus according to claim 8, characterized in that, The acquisition unit is also used for: Obtain the first alarm type of the first alarm event and the first device type of the node where the first alarm event is located; The determining unit is further configured to: The prior strength of the first alarm event is determined based on the first alarm type and the first device type, and the prior strength is used to indicate the probability of the first alarm type occurring in a device of the first device type. The determining unit is specifically used for: Based on the conditional strength and the prior strength of each historical alarm event, a second alarm event that triggers the first alarm event is determined from the plurality of historical alarm events. The conditional strength of the second alarm event at the first moment is greater than a preset threshold and is also greater than the prior strength.

10. The apparatus according to claim 8 or 9, characterized in that, The device further includes: The judgment unit is used to determine that the first alarm event is a root alarm when there is no alarm event with a condition strength greater than a preset threshold at the first time among the plurality of historical alarm events.

11. The apparatus according to any one of claims 8 to 10, characterized in that, Each alarm event sequence also indicates the device type of the node where each alarm event occurs, and the device further includes: A construction unit is used to construct a binary tuple, wherein the binary tuple includes the alarm type of each alarm event and the device type of the node where each alarm event is located; A partitioning unit is used to divide each alarm event sequence into multiple sub-modules based on the co-occurrence frequency of the binary tuples; The training unit is specifically used for: The model is trained by taking the alarm type of the root alarm in each submodule as input and the conditional strength as output.

12. The apparatus according to any one of claims 8 to 11, characterized in that, Each alarm event sequence also indicates the device type of the node where each alarm event occurs and the time when each alarm event occurs. The training unit is specifically used for: The model is trained by taking the alarm type of the root alarm in the training dataset, the device type of the node where the root alarm is located, and the occurrence time of the root alarm as input, and the conditional strength of the root alarm as output.

13. The apparatus according to any one of claims 8 to 12, characterized in that, The determining unit is further configured to: The second moment is determined based on the conditional strength of each historical alarm event, and the second moment is the moment when the conditional strength of the historical alarm event is greater than a preset threshold. The device further includes: The generation unit is used to generate early warning information based on the second time point.

14. The apparatus according to any one of claims 8 to 13, characterized in that, The model is a time-point process (TPP) model.

15. A data processing apparatus, characterized in that, include: Processor and memory; The memory is used to store instructions; The processor is configured to execute instructions stored in the memory to implement the method according to any one of claims 1 to 7.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by one or more processors, it implements the method as described in any one of claims 1 to 7.

17. A computer program product containing instructions, characterized in that, When the computer program product is run on a computer, it causes the computer to perform the method as described in any one of claims 1 to 7.

Images